A meta-network approach for analysing the information system access vulnerabilities in organizations

Access control is an important aspect of information systems security. The primary concern in access vulnerability research has been the development of secure technologies for subjects to gain access to objects. Very little emphasis is placed on access vulnerabilities that occur due to socio-technical factors. However, a holistic access vulnerability analysis that considers a range of socio-technical factors is required for the implementation of access control principles such as the need-to-know, separation of duties and dual control. This paper describes a research aimed at investigating a meta-network modeling approach to analyze access vulnerabilities that could be mitigated by the application of three access control principles mentioned above. In this research data collected from an organization is instantiated as a meta-network and analyzed using three different metrics. The results suggest that a meta-network model and the chosen metrics are suitable for a holistic analysis of socio-technical information system access vulnerabilities.