1. Data and Applications Security Developments and Directions Dr. Bhavani Thuraisingham The University of Texas at Dallas Lecture #5 Assignment #1 on Access Control and Policies February 1, 2006

2. References l Lecture Notes l Text Book for Class l Additional Papers - RBAC: Ravi S. Sandhu, Edward J. Coyne, Hal L. Feinstein, Charles E. Youman: Role-Based Access Control Models. IEEE Computer 29(2): 38-47 (1996)Edward J. CoyneHal L. Feinstein Charles E. Youman IEEE Computer 29 - UCON: Jaehong Park, Ravi S. Sandhu: The UCONABC usage control model. ACM Trans. Inf. Syst. Secur. 7(1): 128-174 (2004)Ravi S. SandhuACM Trans. Inf. Syst. Secur. 7 - DCON: Roshan K. Thomas, Ravi S. Sandhu: Towards a Multi-dimensional Characterization of Dissemination Control. POLICY 2004: 197-200 (IEEE)Ravi S. SandhuPOLICY 2004

3. Problem #1 Consider an example application (e.g., from healthcare, defense, financial) Specify some meaningful policies for this application that address confidentiality, privacy and trust

4. Problem #1 Consider an example application (e.g., from healthcare, defense, financial) Specify some meaningful policies for this application that address confidentiality, privacy and trust

5. Problem #2 l Consider an example application where there is a need for organizations to share data - Example: Defense: Army, Navy, Air Force - Healthcare: Doctor, Hospital, Insurance company l Give meaningful security policies illustrat8ing the need for organizations share data and yet having to enforce the policies - Policies may include confidentiality, privacy and trust

6. Problem #3 l Read the papers on RBAC, UCON and DCON give listed in this unit l For an example application (or applications) specify policies for RBAC, UCON and DCON