Re: Avoiding IBAC

On Tue, October 28, 2014 23:00, Daira Hopwood wrote:
> On 20/10/14 07:22, Rob Meijer wrote:
>> On Sun, October 19, 2014 05:22, Karp, Alan H wrote:
>>> Rob Meijer wrote:
>>>>
>>>> Maybe we should make that seven:
>>>>
>>>> 5. attenuation : turning a right into a weaker version of that right
>>>> suitable for attenuated authorization (delegation).
>>>> 6. decomposition : turning a right to a composite into a right to a
>>>> component suitable for decomposed authorization (delegation)
>>>> 7. logging : keeping track of identities tied to authorizations and
>>>> honored requests for accountability purposes.
>>>>
>>> I can imagine adding a few more, too, but sometimes precision gets in
>>> the
>>> way of clarity.
>>
>> I think at least 'logging' or maybe 'auditing' is essential for both
>> precision and clarity.
>
> Logging may or may not be essential, but it's not access control.
> Security does not consist only of access control.

The concept of 'accountable entity' is central to many forms of access
control. Thus the process of making an entity accountable can be an
essential part of access control.

If the access policy is : "Grant access to the 'accountable' holder of a
valid but fundamentally anonymous access token", than establishing
accountability by logging identity very much becomes part of access
control. Without the logging, the entity did not poses the necessary
attributes to adhere to the access policy.

> --
> Daira Hopwood ⚥
>
>