Abstract
D.Phil. (Computer Science)
Security needs have changed considerably in the past decade as the economics of
computer usage necessitates increased business reliance on computers. As more
individuals need computers to perform their jobs, more detailed security controls are
needed to offset the risk inherent in granting more people access to computer systems.
Traditionally, computer security administrators have been tasked with configuring' ,
security systems by setting controls on the actions of users. This basically entails the
compilation of access rules (contained in security profiles), which state who can access
what resources in what way. The task of building these rules is of considerable
magnitude and is in general not well understood. Adhoc approaches, characterized by
exhaustive interviewing and endless printouts of organizational data repositories, are
usually followed. In the end, too much is left to the discretion of the security
administrators...