I'm working on access control system and on analysis tools for reasoning on it. In A.C. system based on policy, think about XACML specifications, the overall behaviour of the system cannot be clearly predict in case of multiple policies, also maybe conflicting.

Thus, my question is, from a developer side or a security system engineer, which are the main features that an analysis tool must have to help policy developing?

There are many example about change-impact analysis, properties verification, ..., but many of them seems to not be used in real application. Which are the real needs of security professionals?

  • How does security theater play into this? – Steve Sep 24 '13 at 16:15
  • Nothing, my fault, sorry. – andrex_jux Sep 24 '13 at 21:32

The magic word is RSOP = Resultant Set Of Policy.

Any useful tool tool should show

  • what the result of all policies are together (as if it was a single policy),
  • which policies took precedence and why, and
  • which did not take effect/were overridden by other policies and why,
  • Any policies which were corrupt or otherwise meaningless.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.