Towards an Access-Control Metamodel for Web Content Management Systems
Out-of-the-box Web Content Management Systems (WCMSs) are the tool of choice for the development of millions of enterprise web sites but also the basis of many web applications that reuse WCMS for important tasks like user registration and authentication. This widespread use highlights the importance of their security, as WCMSs may manage sensitive information whose disclosure could lead to monetary and reputation losses. However, little attention has been brought to the analysis of how developers use the content protection mechanisms provided by WCMSs, in particular, Access-control (AC). Indeed, once configured, knowing if the AC policy provides the required protection is a complex task as the specificities of each WCMS need to be mastered. To tackle this problem, we propose here a metamodel tailored to the representation of WCMS AC policies, easing the analysis and manipulation tasks by abstracting from vendor-specific details.
KeywordsSecurity Policy Reputation Loss Role Role Model Query Language Authenticate Role
- 1.Drupal Open-source CMS (2013), http://drupal.org/
- 3.Gauthier, F., Letarte, D., Lavoie, T., Merlo, E.: Extraction and comprehension of moodle’s access control model: A case study. In: PST, pp. 44–51. IEEE (2011)Google Scholar
- 6.Sandhu, R., Ferraiolo, D., Kuhn, R.: The NIST model for role-based access control: towards a unified standard. In: Proceedings of the Fifth ACM Workshop on Role-Based Access Control, RBAC 2000, pp. 47–63. ACM (2000)Google Scholar