Sciweavers

Share
PVLDB
2010

PolicyReplay: Misconfiguration-Response Queries for Data Breach Reporting

9 years 11 months ago
PolicyReplay: Misconfiguration-Response Queries for Data Breach Reporting
Recent legislation has increased the requirements of organizations to report data breaches, or unauthorized access to data. While access control policies are used to restrict access to a database, these policies are complex and difficult to configure. As a result, misconfigurations sometimes allow users access to unauthorized data. In this paper, we consider the problem of reporting data breaches after such a misconfiguration is detected. To locate past SQL queries that may have revealed unauthorized information, we introduce the novel idea of a misconfiguration response (MR) query. The MRquery cleanly addresses the challenges of information propagation within the database by replaying the log of operations and returning all logged queries for which the result has changed due to the misconfiguration. A strawman implementation of the MR-query would go back in time and replay all the operations that occurred in the interim, with the correct policy. However, re-executing all operations i...
Daniel Fabbri, Kristen LeFevre, Qiang Zhu
Added 20 May 2011
Updated 20 May 2011
Type Journal
Year 2010
Where PVLDB
Authors Daniel Fabbri, Kristen LeFevre, Qiang Zhu
Comments (0)
books