On the Safety of Enterprise Policy Deployment

Enterprise policy management is challenging and errorprone. Compared to existing work that focused on analyzing misconfigurations, our work is the first to address the issues that arose during policy deployment, i.e., effecting policy changes. In this paper, we demonstrate that naive approaches to policy deployment can easily create security vulnerabilities, such as granting access of sensitive resources to unprivileged users or temporarily allowing malicious traffic to critical network infrastructure. To systematically solve this problem, we formally define secure and insecure intermediate states, and further propose an efficient algorithm to find a deployment procedure without insecure intermediate states. We implemented and evaluated our algorithm on Group Policy framework, while only harnessing existing support and requiring no modification to the current infrastructure. Our evaluation shows that our solution addsminimal overhead to the overall deployment time while provably eliminating insecure intermediate states.