1. An Information Visualization Software System to Manage Resource Access Control Policies Jaime Montemayor, Inventor Thomas Llanso, Inventor

2. Problem Background Complex digital Access Control policies/ rules can be difficult to author, analyze, update, approve, and reverse-engineer. –Access can be a function of many factors –Visualization techniques can help manage complex rule sets Security clearance Physical location Type of workstation Type of user login Role / Group Time of day Operational Need Security Risk

3. Access Visualization Tool (“Ruba”) Visualize policies from many angles Reveal hidden relationships, interactions Useful for experts and non-experts alike

4. Groups and Hierarchy Different Views Answer Different Questions

5. Access Control Matrix Different Views Answer Different Questions

6. Incremental Exploration Different Views Answer Different Questions

7. Technical Applicability Useful anywhere control access required –Networks, virtual networks –Web sites, portals, web services, messaging –Databases, directories, other repositories Useful to different stakeholders –Network, repository, mission owners –System support personnel –System Certifiers –System and Network Accreditors

8. Commercial Applicability Relevant across many industries –Government / Military –Medical –Financial –Legal –Entertainment Can play a role in meeting the spirit of security-related legislation –HIPAA –Graham Leach Bliley Act

9. Commercial Opportunities For technical information contact: Jaime Montemayor, Inventor 443-778-4497 jaime.montemayor@jhuapl.edu Thomas Llanso, Inventor 443-778-6343 thomas.llanso@jhuapl.edu For licensing information contact: Norma Lee Todd, Technology Manager Office of Technology Transfer The Johns Hopkins University Applied Physics Laboratory 11100 Johns Hopkins Road Laurel, MD 20723 443-778-4528 norma.todd@jhuapl.edu www.jhuapl.edu/ott