trademark

8.0 Granular Access Control (cont.)
8.9.2 How?
Ensure that the application does not “change hats” without clearing session data. Defer
to the database’s granular access control mechanism where possible.
8.10 Develop protocols for tracking access restrictions
8.10.1 Why?
To operate access control system as expected. Data privacy policies are often complex and
difficult to implement with 100 accuracy. It is important to review what policies are in place on
a given system, as well as maintaining the capacity to revise policies when deemed necessary.
8.10.2 How?
Protocols for tracking access restrictions come in two forms: those used to encode
policies and those used to audit the instantiations of those policies. Logging and
aggregating audits of policy decisions can provide critical information about what
data users are accessing, what data users are trying to access (unsuccessfully) and
how users are attempting to access the system in an unauthorized manner. Analysis
of those audits is critical to refining policy for both the purposes of increased privacy
and increased sharing. When encoding policies, choose a standard language such as
eXtensible Access Control Markup Language (XACML). This will allow policy creators to
bring in help from a community of tool builders for visualizing, editing, and reasoning
during the encoding process.
CLOUD SECURITY ALLIANCE Big Data Working Group Guidance
© Copyright 2016, Cloud Security Alliance. All rights reserved.
47