Acumen: Analysing the Impact of Organisational Change on Users’ Access Entitlements

Planned organisational changes are frequent occurrences in large enterprises due to the dynamicity of employees’ roles, evolution of teams, units and divisions as a result of mergers, demergers, and general restructuring. To safeguard system security and employees’ productivity, it is paramount for system administrators to keep track and remediate all users’ changing access needs. This paper studies the impact of (planned) organisational changes on the access privileges of employees in line with access control policies. Our solution, Acumen, uses binary decision diagrams (BDDs) to encode XACML policies via a Boolean function conversion, and performs semantic interpretation of organisational changes for analysis over the BDDs. The BDD structure is versatile, enabling succinct representation as well as effective and efficient symbolic operations and visualisation. We demonstrate the efficacy of Acumen with two data sets via a series of case studies on: a) a commonly used benchmark access control policy data in the literature; and b) a proprietary data set containing planned organisational changes in a large real-world financial institution with a dynamic business environment. The empirically results show Acumen to be effective and efficient.