An Overview of Risk Estimation Techniques in Risk-based Access Control for the Internet of Things <s> ACCESS CONTROL MODELS <s> This paper presents a new model for, or rather a new way of thinking about adaptive, risk–based access control. Our basic premise is that there is always inherent uncertainty and risk in access control decisions that is best addressed in an explicit way. We illustrate this concept by showing how the rationale of the well–known, Bell–Lapadula model based, Multi–Level Security (MLS) access control model could be used to develop a risk-adaptive access control model. This new model is more like a Fuzzy Logic control system [9] than a traditional access control system and hence the name “Fuzzy MLS”. The long version of this paper is published as an IBM Research Report [3]. <s> BIB001 </s> An Overview of Risk Estimation Techniques in Risk-based Access Control for the Internet of Things <s> ACCESS CONTROL MODELS <s> A statistical method is proposed for quantifying the impact of factors that influence the quality of the estimation of costs for IT-enabled business projects. We call these factors risk drivers as they influence the risk of the misestimation of project costs. The method can effortlessly be transposed for usage on other important IT key performance indicators (KPIs), such as schedule misestimation or functionality underdelivery. We used logistic regression as a modeling technique to estimate the quantitative impact of risk factors. We did so because logistic regression has been applied successfully in fields including medical science, e.g. in perinatal epidemiology, to answer questions that show a striking resemblance to the questions regarding project risk management. In our study we used data from a large organization in the financial services industry to assess the applicability of logistic modeling in quantifying IT risks. With this real-world example we illustrated how to scrutinize the quality and plausibility of the available data. We explained how to deal with factors that cannot be influenced, also called risk factors, by project management before or in the early stage of a project, but can have an influence on the outcome of the estimation process. We demonstrated how to select the risk drivers using logistic regression. Our research has shown that it is possible to properly quantify these risks, even with the help of crude data. We discussed the interpretation of the models found and showed that the findings are helpful in decision making on measures to be taken to identify potential misestimates and thus mitigate IT risks for individual projects. We proposed increasing the auditing process efficiency by using the found cost misestimation models to classify all projects as either risky projects or non-risky projects. We discovered through our analyses that projects must not be overstaffed and the ratio of external developers must be kept small to obtain better cost estimates. Our research showed that business units that report on financial information tend to be risk mitigating, because they have more cost underruns in comparison with business units without reporting; the latter have more cost overruns. We also discovered a maturity mismatch: an increase from CMM level 1 to 2 did not influence the disparity between a cost estimate and its actual if the maturity of the business is not also increased. <s> BIB002 </s> An Overview of Risk Estimation Techniques in Risk-based Access Control for the Internet of Things <s> ACCESS CONTROL MODELS <s> Due to the inherent vulnerabilities of the Internet, security and privacy issues should be considered and addressed before the Internet of Things is widely deployed. This paper mainly analyzes existing authentication and access control methods, and then, it designs a feasible one for the Internet of Things. <s> BIB003 </s> An Overview of Risk Estimation Techniques in Risk-based Access Control for the Internet of Things <s> ACCESS CONTROL MODELS <s> The research is support by National Natural ScienceFoundation of P. R. China ( Grant ::: No.61170065,61373017,61171053,61103195 and 61203217), Peak of Six Major Talent in Jiangsu Province (Grant No.2010DZXX026), the Natural Science Foundation of Jiangsu Province(Grant No.BK2012436 and BK20130882),Scientific & Technological Support Project of Jiangsu ProvinceGrant No. BE2012183 and BE2012755), Natural Science Key Fund for Colleges and Universities in Jiangsu Province (Grant No. ::: 11KJA520001 and 12KJA520002), Scientific Research & Industry Promotion Project for Higher Education InstitutionsJHB2012-7) . <s> BIB004
To ensure confidentiality and integrity of system resources, an access control is used to guarantee that only authorized users granted the appropriate access permissions. There are several access control models which can be divided into two classes; traditional and dynamic access control models BIB003 BIB004 . Traditional access control approaches are based on policies that are static and rigid in nature. These policies are predefined and always give the same outcome regardless of the situation. This static approach fails to adapt to varied and changing conditions when making access decisions in the IoT system BIB001 . There are three main traditional access control models; Discretionary Access Control (DAC), Mandatory Access Control (MAC) and Role-based Access Control (RBAC). On the other hand, dynamic access control approaches are appropriate to the IoT system. This is because they take into consideration not only access policies to make access decisions, but also dynamic contextual features which are estimated in real-time at the time of making the access request. These realtime features can include trust, risk, context, history and operational need BIB002 Ni et al., 2010) . Using the security risk to make the access decision is a promising research point in the IoT. The NIST surveyed different access control models in terms of flexibility as shown in Figure 1 . It showed that Risk Adaptable Access Control (RAdAC) model provides more flexibility in accessing system resources which make it as a suitable model for the IoT.  ).