Enforcing Risk-Awareness in Access Control Systems: Synthesis, Discussion and Guidelines

Access control is a main security measure for the prevention of loss, disclosure or degradation of sensitive information in business. As such, it has become a source of inspiration for many researchers who have undertaken to conduct studies related to that subject. More specifically, risk management in access control is a topic that captivates information and communication technology scientists. Several approaches are defined in literature that can be classified into two main trends: some researchers discuss risk management based on user access, while some other consider policies expression when assessing the risk. In this paper, we study the thematic of enforcing risk awareness/management in access control systems. We review, classify and present a comprehensive synthesis of scientific articles that deal specifically with risk management in access control. We mainly discuss risk management approaches that deal with access control policy expressions and conformity.