Controlling Break-the- glass Through Alignment A. Adriansyah B.F. van Dongen N. Zannone Washington D.C., 11 Sep th ASE/IEEE International Conference on Information Privacy, Security, Risk and Trust COMMIT/

Enforcement Mechanisms 2 Trace : aclreh Strict: “l” is not allowed Relaxed: to which extent deviations are allowed?

: aclreh: a: ac: acl Enforcement mechanisms Security policies define allowed behavior Basic idea: infringements are violations and as such should not be permitted 3 Trace

: aclreh Run-time Enforcement 4 Trace : a: ac: acl

Break-the-Glass Existing protection mechanisms are very rigid Systems have to cope with exceptions – e.g., dealing with emergencies Include break-the-glass functionality – Bypass security mechanisms – Introduce weak point in the system 5

Overview 6 Process Model AlignmentsBreak-the-glass Architecture High-level Deviations Experiments Trace (Event Log)

Alignments 7 Trace : l a r c lrc >> ct4ct4 lt3lt3 e et5et5 rt2rt2 Prefix Alignment : e a at1at1 Synchronous moves Move on Model Move on Log lrc >> ct4ct4 lt3lt3 e et5et5 rt2rt2 Alignment : a at1at1 >> ht9ht9 Non-completion is penalized

Overview 8 Process Model AlignmentsBreak-the-glass Architecture High-level Deviations Experiments Trace (Event Log)

Controlled Break-the-glass Architecture 9 Process Model User Restricted Data Event Log Security Officer Break-the-glass Control Conformance Checker Logging Server Access Control Deviation Budget

2 1 Controlled Break-the-glass Example 10 Trace : l a r c lrc >> ct4ct4 lt3lt3 e et5et5 rt2rt2 Prefix Alignment : e Budget 0

Overview 11 Process Model AlignmentsBreak-the-glass Architecture High-level Deviations Experiments Trace (Event Log)

l r r l Swapped Activities 12 Trace : a c Prefix Alignment : e lrc >> ct4ct4 lt3lt3 e et5et5 rt2rt2 a at1at1 Process Model lrc ct4ct4 e et5et5 rt3'rt3' a at1at1 lt2'lt2' Prefix Alignment (without Pattern) lrc >> ct4ct4 lt3lt3 e et5et5 rt2rt2 a at1at1 Pattern Synchronous move: x/2 Move on model: + 

l r r l Swapped Activities 13 Trace : a c Prefix Alignment : e lrc >> ct4ct4 lt3lt3 e et5et5 rt2rt2 a at1at1 Process Model lrc ct4ct4 e et5et5 rt3'rt3' a at1at1 lt2'lt2' Prefix Alignment (without Pattern) lrc >> ct4ct4 lt3lt3 e et5et5 rt2rt2 a at1at1 Pattern Synchronous move: x/2 Move on model: + 

r l Replaced Activities 14 Trace : a e Alignment : l Process Model e et5et5 rl >> ct4ct4 lt3lt3 a at1at1 rt2rt2 l t tt9'tt9' Pattern Synchronous move: x Move on model: +  t

Overview 15 Process Model AlignmentsBreak-the-glass Architecture High-level Deviations Experiments Trace (Event Log)

Experiments 16 Synthetic Data Generated traces from a process model Injected deviations in traces Real-life Data Logs of a Dutch hospital 70% used to mine process model 30% used to verify compliance Comparison between automatic and manual verification

Experiments: Synthetic data 17 Without pattern All possible patterns Selected patterns

Experiments: Real-life data 18 n. casesResultMotivation 1OverestimationRepetition of the same transition 6OverestimationReordering 5UnderestimationDifficult to manually identify a corresponding run of the process model

Overview 19 Process Model AlignmentsBreak-the-glass Architecture High-level Deviations Experiments Trace (Event Log)

Conclusions Flexible architecture for controlling break-the-glass Diagnostics on high/low-level deviations Open Issues Assumption: Cost optimal alignment is the most “probable” Define cost function Determine deviation budget 20

Q&A 21