trademark

8.0
Granular Access Control
There are two sides to any access control solution. The first is restricting data and
operations from users who should not have access, and the second is granting access
to users who should have access. Picking the right access control strategy can have
a profound impact on how effectively users can leverage a database. To satisfy policy
restrictions, coarse-grained access mechanisms often must restrict data that could
otherwise be shared. Granular access control mechanisms are a tool that can be used to
reduce data restriction without violating policies. The following best practices should be
followed while ensuring granular access control.
8.1 Choose appropriate level of granularity required
8.1.1 Why?
To balance complexity and granularity of access control. The use of fine-grained access
controls requires an increased complexity in data labeling and security attribute
management, while coarse-grained access controls demand data modeling. For
example, database views can be used to protect databases that do not support row-,
column-, or cell-level access controls, but users must then maintain the views.
8.1.2 How?
Oblivious RAM [SSS11] shuffles memory locations after each access. Thus, even a cloud service
provider cannot tell which data is accessed; therefore, the access pattern can be effectively hidden.
8.2 Normalize mutable elements, denormalize
immutable elements
8.2.1 Why?
To design suitable access control mechanisms. Recent advances in database
technology have opened the door to more forms of denormalized data modeling. For
data elements that are more immutable, denormalized models can provide higher
concurrency and lower latency than models that require more joins. Granular access
controls become even more important when using denormalized data models, since
data from many sources and of many types are thrown together in a single bucket.
7.8.2 How?
CLOUD SECURITY ALLIANCE Big Data Working Group Guidance
© Copyright 2016, Cloud Security Alliance. All rights reserved.
43