By Dmytro Shyrokorad & Oleh Zaritskyi*
Access control policies in information systems are formal rules regulating how subjects (users, processes, systems) are granted, denied, or monitored in accessing system objects (data, services, resources). These policies define who may perform which actions, when, and on what resources, forming the core of mechanisms ensuring confidentiality, integrity, and availability of information according to modern standards (ISO/IEC 27001, NIST SP 800-53).
By establishing permitted operations and access conditions, policies help prevent unauthorized access, support monitoring, and strengthen the overall security posture.
Modern systems employ several access control models with distinct principles and application domains. The most common types include:
Discretionary Access Control (DAC)
Based on the principle that the resource owner decides who may access the resource. Access is granted based on user identity or group membership. DAC offers flexibility and is typical in systems requiring user autonomy but provides limited protection. Common in Windows and UNIX systems.
Mandatory Access Control (MAC)
Access policies are enforced by the system based on pre-defined rules and cannot be changed by users. Each subject and object has a classification level; access is allowed only when levels match according to policy. Common in military, government, and high-security environments.
Role-Based Access Control (RBAC)
Access rights are assigned to roles associated with functions or responsibilities within the organization. Users gain access by assuming roles. RBAC improves scalability, reduces errors, and simplifies management.
Attribute-Based Access Control (ABAC)
Policies are based on attributes of the subject (e.g., position), object (e.g., sensitivity), and context (e.g., time, location). ABAC allows dynamic, flexible control, suitable for distributed and cloud systems.
These models may be used independently or combined, forming hybrid systems tailored to specific needs. However, mixing policies can result in overlapping permissions and increased risk. Assessing whether such access is dangerous requires analyzing multiple factors.
Where does TELEMETRY come into play?
Within the TELEMETRY project, an Access Control Risk Assessment Methodology (ACRAM) is being developed and applied in use-case scenarios. This methodology addresses access control risks, including those arising from user misbehavior or improper configurations.
ACRAM integrates data from telemetry tools with fuzzy logic–based analytics to evaluate access control risk. Fuzzy logic is used due to the high degree of uncertainty and vagueness in describing system states and assessing vulnerabilities.
From a systems analysis perspective, the information system is viewed as a dynamic interaction between subjects and objects, governed by access policies:
A subject (e.g., user or process) interacts with system objects, characterized by trust level and behavioral patterns.
An object (e.g., file, service, IoT device) is described by attributes and potential operations (e.g., read, write, modify).
Access control policies govern these interactions, often via Access Control Lists (ACLs).
Software and hardware vulnerabilities are analyzed based on system architecture, access configurations, and telemetry data collected using tools like WAZUH and SNORT.
Core Stages of Access Control Testing Using Fuzzy Logic
Initial Criteria Selection
Identify key indicators that reflect system conditions and influence risk level. These are grouped and selected through expert evaluation and cybersecurity standard requirements.
Scalability of the Indicator Table
The indicator set is adjusted to match the specific context and characteristics of the system being evaluated.
Risk Level Estimation
Each indicator is assessed using a defined scale, evaluating its current state and associated risk.
Fuzzy Inference-Based Risk Calculation
Indicators are mapped into a rule base using if-then logic. Each rule links factor combinations to a risk level. This forms a knowledge base, with relevant factors chosen by system administrators.
Examples of factors include:
Subject-level: authentication strength, role privileges, behavioral anomalies.
Object-level: vulnerability level, access frequency, data sensitivity.
Interaction-level: network type, attack vector, or anomaly detection.
These factors are processed collectively to assess overall access control risk, accounting for both likelihood and impact of a potential attack. Using the fuzzy rule base, the system computes a unified risk level output.
Practical Implications
The proposed methodology enables administrators to:
Assess actual system state, architecture, and known vulnerabilities;
Track changes in system behavior and access patterns over time;
Adapt access policies dynamically, based on real-time risk evaluations.
By incorporating telemetry data into a structured, scalable risk analysis model, organizations can enhance decision-making and maintain a resilient access control posture, even in complex or distributed environments.
*Dmytro Shyrokorad, Ph.D. in Physics and Mathematics, Associate Professor at the Department of System Analysis and Computational Mathematics, Zaporizhzhia Polytechnic National University, Ukraine. Doctoral researcher with 33 SCOPUS-indexed publications (h-index: 8). His scientific interests include machine learning, data science, and their applications in physical and biological systems.
Oleh Zaritskyi, Doctor of Engineering Sciences, Associate Professor at the Management Technologies Department, Taras Shevchenko National University of Kyiv. Author of over 70 scientific publications in IT, cybersecurity, and AI. Research interests include enterprise information systems, artificial intelligence, expert systems, quantum computing, and machine learning for embedded systems. Extensive experience in managing large-scale enterprise automation and participating in international technology projects.