Robust access control is a cornerstone of secure software, systems, and networks. An access control mechanism is as effective as the policy it enforces. However, authoring effective policies that satisfy desired properties such as the principle of least privilege is a challenging task even for experienced administrators. In this paper, we set out to address this pain point by proposing Restricter , which automatically tightens each (permit) policy rule of a policy with respect to an access log, which captures some already exercised access requests and their corresponding access decisions ( i.e. , allow or deny). Restricter achieves policy tightening by reducing the number of access requests permitted by a policy rule without sacrificing the functionality of the underlying system it is regulating. We implement Restricter for Amazon’s Cedar policy language and demonstrate its effectiveness through two realistic case studies.

In this paper, we revisit the problem of TLS version downgrade, with a specific focus on enterprise software, which are applications that play direct roles in the daily operations of an organization, including remote desktop, email, and VPN clients. Although TLS version downgrade is a classic problem, previous studies have mostly focused on its manifestations in browser applications. However, as TLS continues to gain prominence in other application scenarios, it is crucial to also investigate the implementation and deployment of TLS in other mission-critical appliances that depend upon TLS for their corresponding security guarantees. To this end, we identified and tested 217 enterprise software on 4 mainstream operating systems (OSes) for how they implement and deploy TLS downgrade defenses. We carefully designed a series of experiments to determine whether a client-side enterprise software is vulnerable to downgrade attacks. Results of our experiments paint the enterprise software ecosystem in a positive light, as only 8 enterprise client applications exhibit some vulnerabilities to TLS version downgrade due to missing protection mechanisms. Given the availability and low costs of standardized downgrade defenses, we champion their adoption by software vendors to put an end to the threat of TLS version downgrade. Finally, as various industries are moving away from legacy versions of TLS, it is also time for enterprise software vendors to rethink the necessity and merits of supporting old TLS versions in their products.

In the context of connecting to enterprise Wi-Fi, previous works show that relying on human users to manually configure or enforce server authentication often leads to insecure outcomes. Consequently, many user credentials can potentially be stolen by the so-called "Evil-Twin'' (ET) attack. To ease the burden of human users, various easy-to-use Wi-Fi configurators have been released and deployed. In this work, we investigate whether such configurators can indeed protect users from variants of the ET attack. To our surprise, the results of our investigation show that all configurators considered in the study suffer from certain weaknesses due to their design, implementation, or deployment practices. Notable findings include a series of design flaws in the new trust-on-first-use (TOFU) configurator on Android (available since version 12), which can be exploited in tandem to achieve a stealthy ET attack. Moreover, we found that 2 open-source Android Wi-Fi configurators fail to properly enforce server authentication under specific situations. The cause of these could be partly attributed to the complexity stemmed from certificate name matching as well as the limitations of the Android API. Last but not least, we found that a commercial configurator not only allows insecure Wi-Fi configurations to be deployed, but also the covert injection of certificates on the user device to facilitate interception of other TLS traffic, posing yet another hidden security and privacy threat to its users. All in all, this study shows that despite years of research on the topic, developing a user-friendly yet reliable Wi-Fi configurator remains an elusive goal, and thus the threat of ET attacks continues to be relevant. As such, it is time to rethink whether the complexity of the standard certificate chain validation is actually good for enterprise Wi-Fi.