Reasoning about Policy Noncompliance

摘要

In this paper, we introduce a tuple notation for noncompliance that represents certification problems when meeting security controls in distributed, multi-component software systems. The security controls are adopted from NIST SP8OO-53 and DoD 8500.2 documents. We derive tuples from component policies and interactions, along with the risks associated with violating the security controls. Tuples can be clustered from different perspectives, reasoned about to target the cause and strength of noncompliance. They can also be mapped to specific security concerns and weaknesses in the multi-component architecture.