A Risk Assessment based RBAC using Attack Graphs to Mitigate Insider Threat during UAQ

User Authorization Query in Role Based Access Control allows users to gain permissions without considering the possibility of an insider threat. In this paper, a solution has been proposed by introducing the notion of attack graphs, which is a standard tool for measuring the likelihood of a network being compromised. In our approach, each time a user requests for a set of permissions (i.e., on resources and/or services of the network) the likelihood of the network being compromised with respect to the user is calculated (i.e., by using attack graphs). If the likelihood falls below a preset threshold, then the requested permission will not be granted (i.e., to prevent an insider attack). In some cases, it may so happen that the permission need to be granted. For such cases, a multi-objective optimization model has also been formulated, which generates a set of non-dominated solutions (i.e., pareto solutions). These pareto solutions provide the minimal set of permissions that need to be removed, in order to allow the that particular permission to be granted to the user (i.e., without allowing the likelihood to be above the threshold).