Ensuring software security policies

Access control policies (ACPs) are becoming the new norm for security requirements for businesses to ensure software developers have a clear understanding of security policies.

Greg Hale, ISS Source

Share

There is a new natural language processing tool that businesses or other users can use to ensure software developers have a clear idea of the security policies they need to incorporate into new software products.

It is all about access control policies (ACPs), which are the security requirements that software developers need to bear in mind when developing new software, said researchers from North Carolina State University and IBM Research. In one case, an ACP for a university grading program needs to allow professors to give grades to students, but should not allow students to change the grades.

“These ACPs are important, but are often buried amidst a lengthy list of other requirements that customers give to developers,” said Dr. Tao Xie, an associate professor of computer science at NC State and co-author of a paper on the research. These requirements are in “natural language,” which is the conversational language people use when talking or corresponding via the written word.

Incomplete or inaccurate ACP requirements can crop up if the customer writing the ACP requirements makes a mistake or doesn’t have enough technical know-how to accurately describe a program’s security needs.

A second problem is programmers may misinterpret some ACP requirements, or overlook them entirely.

In collaboration with IBM Research, Xie’s research team has developed a solution that uses a natural language processing program to extract the ACP requirements from a customer’s overall list of requirements and translate it into machine-readable language that computers can understand and enforce.

After extracting the ACPs, they can be run through Access Control Policy Tool (ACPT) — also developed in Xie’s research team in collaboration with the National Institute of Standards and Technology (NIST) — which verifies and tests the ACPs and determines whether the ACP requirements are adequate to meet the security needs of the program.

Once the ACP requirements translate into machine-readable language, they can also incorporate into a policy-enforcement “engine” in the final software product — which ensures programmers cannot overlook ACPs.

“In general, developing a program that understands natural language text is very challenging,” Xie said. “However, ACP requirements in software documents usually follow a certain style, using terms such as ‘cannot be edited’ or ‘does not have the ability to edit.’ Because ACPs tend to use such a limited number of phrases, it is much easier to develop a program that effectively translates natural language texts in this context.”