Has Access Control Become the Weak Link?

IF 2.9 4区计算机科学 Q2 COMPUTER SCIENCE, INFORMATION SYSTEMS

IEEE Security & Privacy Pub Date : 2024-09-13 DOI:10.1109/msec.2024.3427588

Trent Jaeger

引用次数: 0

Abstract

In the early 2000s, computer systems were under threat from a variety of Internet worms. This malware attacked network-facing programs by exploiting their memory errors, hijacking their execution to perform malicious operations and propagate the malware to other systems. One key change that commercial systems adopted to prevent such attacks was in access control enforcement. With the enhanced access control (and other defenses), defenders were able to prevent Internet worm attacks, but a variety of other significant and catastrophic attacks (e.g., ransomware) have emerged since that time. But our access control infrastructure is essentially the same as that used to combat Internet worms. In this column, I want to look more closely at the current state of access control enforcement and where we might go from here.

查看原文本刊更多论文

门禁控制是否已成为薄弱环节？

本世纪初，计算机系统受到各种互联网蠕虫的威胁。这些恶意软件利用面向网络的程序的内存错误进行攻击，劫持程序执行恶意操作，并将恶意软件传播到其他系统。为防止此类攻击，商业系统在访问控制执行方面做出了一项重要改变。通过加强访问控制（和其他防御措施），防御者得以防止互联网蠕虫攻击，但自那时起，又出现了其他各种重大的灾难性攻击（如勒索软件）。但是，我们的访问控制基础架构与用于对付互联网蠕虫的基础架构基本相同。在本专栏中，我想更深入地探讨访问控制执行的现状以及今后的发展方向。

本文章由计算机程序翻译，如有差异，请以英文原文为准。

求助全文

约1分钟内获得全文求助全文

来源期刊

IEEE Security & Privacy 工程技术-计算机：软件工程

CiteScore

4.30

自引率

5.30%

发文量

159

审稿时长

6-12 weeks

期刊介绍： IEEE Security & Privacy’s primary objective is to stimulate and track advances in security, privacy, and dependability and present these advances in a form that can be useful to a broad cross-section of the professional community—ranging from academic researchers to industry practitioners. It provides articles with both a practical and research bent by the top thinkers in the field of security and privacy, along with case studies, surveys, tutorials, columns, and in-depth interviews and podcasts for the information security industry. Through special issues, the magazine explores other timely aspects of privacy in areas such as usable security, the Internet of Things, cloud computing, cryptography, and big data. Other popular topics include software, hardware, network, and systems security, privacy-enhancing technologies, data analytics for security and privacy, wireless/mobile and embedded security, security foundations, security economics, privacy policies, integrated design methods, sociotechnical aspects, and critical infrastructure. In addition, the magazine accepts peer-reviewed articles of wide interest under a general call, and also features regular columns on hot topics and interviews with luminaries in the field.