Let the Right One in: Discovering and Mitigating Permission Gaps

Abstract

Permissions that are granted but unused, or permission gaps, are needless risks to systems and should be removed expeditiously. More insidiously, granted permissions may not always be revoked when they are no longer required. In practice, identifying permission gaps can be hard since another reference point besides granted permissions is usually unavailable. Therefore, we argue that permission gaps often must be estimated. We propose DeGap, a framework that uses standard system logs as a reference point and a common logic for estimating the gaps in various services. DeGap identified potentially overly relaxed SSH server configurations, incorrect permissions on sensitive files, and dormant user groups. Just discovering permission gaps may be insufficient; administrators need to know how they can be fixed. DeGap can also identify changes to service configurations towards reducing permission gaps.