Identify Fine-Grained Security Profile

Once we have uncovered the conditions using the process and guidance provided above, we are ready to define our fine-grained security profile. Table 6-1 illustrates a fine-grained version of our security profile that includes the addition of the appropriate subject (actor) and the conditions, both explicitly stated and derived (these are explicitly spelled out as derived), for each “verb object” exercise that was discussed earlier.

Obviously, this list would be substantial as we worked through every use case, but just working on this simple use case gives us plenty to work with. We can build a candidate DBV security policy design for this use case by taking on the task in the following order:

1. Identify DBV factors based on business or system conditions.