A Post-Processing Heuristic for the Static Separation of Permissions Problem

The RBAC model eases the administration of complex organizations and supports the implementation of basic security principles such as least privilege and separation of duty (SoD). In this work, we present PP-SSP, a Post-Processing Heuristic for the Static Separation of Permissions Problem. The heuristic has been designed to decouple role discovery from constraint enforcement phase, so that any existing rolemining algorithm can be selected at the beginning, making then the framework flexible and easily adaptable to different mining techniques. We evaluate the heuristic against a number of public datasets, report the results obtained, and discuss its performance in terms of different metrics, showing its efficiency and effectiveness.