The purpose of this page is to collate, analyse and formulate the research base for my thesis. I intend to use Artificial Intelligence tools, as well as traditional methods, in this endeavour.
- Xusheng Xiao; Amit Paradkar; Suresh Thummalapenta & Tao Xie
Abstract: Access Control Policies (ACP) specify which principals such as users have access to which resources. Ensuring the correctness and consistency of ACPs is crucial to prevent security vulnerabilities. However, in practice, ACPs are commonly written in Natural Language (NL) and buried in large documents such as requirements documents, not amenable for automated techniques to check for correctness and consistency. It is tedious to manually extract ACPs from these NL documents and validate NL functional requirements such as use cases against ACPs for detecting inconsistencies. To address these issues, we propose an approach, called Text2Policy, to automatically extract ACPs from NL software documents and resource-access information from NL scenario-based functional requirements. We conducted three evaluations on the collected ACP sentences from publicly available sources along with use cases from both open source and proprietary projects. The results show that Text2Policy effectively identifies ACP sentences with the precision of 88.7 % and the recall of 89.4%, extracts ACP rules with the accuracy of 86.3%, and extracts action steps with the accuracy of 81.9%.
- Xusheng Xiao; Amit Paradkar & Tao Xie
Abstract: As one of the most fundamental security mechanisms of resources, Access Control Policies (ACP) specify which principals such as users or processes have access to which resources. Ensuring the correct specification and enforcement of ACPs is crucial to prevent security vulnerabilities. However, in practice, ACPs are commonly written in Natural Language (NL) and buried in large documents such as requirements documents, not directly checkable for correctness. It is very tedious and error-prone to manually identify and extract ACPs from these NL documents, and validate NL functional requirements such as use cases against ACPs for detecting inconsistencies. To address these issues, we propose a novel approach, called Text2Policy, that automatically extractsACPsfrom NLdocumentsandextractsaction steps from NL scenario-based functional requirements (such as use cases). From the extracted ACPs, Text2Policy automatically generates checkable ACPs in specification languages such as XACML. From the extracted action steps, Text2Policy automatically derives access control requests that can be validated against specified or extracted ACPs to detectinconsistencies. ToassesstheeffectivenessofText2Policy, we conductthreeevaluationsonthecollected ACP sentences from 18sources and37use cases from anopensource project called iTrust (including 448 use-case sentences). The results show that Text2Policy effectively extracts ACPs from NL documents and action steps from use cases for detecting issues in the use cases
- Jose Rouillard & Jean Caelen
Abstract: While seeking a document or information, “some are looking for the ocean and some others for a grain of sand” [5]. We have developed the Halpin1 system to implement our multimodal conversational model for information retrieval. This dialogue-oriented interface allows the access to the INRIA’s2 database, on the internet, in a natural language (NL) way, and gives its oral responses via usual browsers. The results of the first experiments show that the Halpin system provides some interesting dialogues (in particular with the beginners), according to the user’s goals and skills, that leads to information retrieval success, while searches with the original user interface (traditional web form) failed.
- A. Fantechi; S. Gnesi; G. Lami & A. Maccari
Abstract: Use Cases are an effective technique to express Functional Requirements of a system in a very simple and easy-to-learn way. Use Cases are mainly composed of Natural Language (NL) sentences and the use of NL to describe the behavior of a system is always a critical point, due to the inherent ambiguities originating from the different possible interpretations of NL sentences. We discuss in this paper the application of analysis techniques based on a linguistic approach to detect, within requirements documents, defects related to such inherent ambiguity. Starting from the proposed analysis techniques we will define some metrics that will be used to perform a quality evaluation of requirements documents. Some available automatic tools supporting the linguistic analysis of NL requirements have been used to evaluate an industrial Use Cases document according to the defined metrics. A discussion on the application of linguistic analysis techniques to support semantic analysis of Use Cases is also reported.
- Talbot, Shane & Woodward, Andrew
Abstract: A security policy which includes the appropriate phases of implementation, enforcement, auditing and review is vital to protecting an organisations information security. This paper examined the information security policy of a government organisation in response to a number of perceived shortcomings. The specific issues identified relating to the organisations security policy as a result of this investigation were as follows: a culture of ignoring policies, minimal awareness of policies, minimal policy enforcement, policy updating and review ad hoc at best, policy framework, lengthy policy development and approval process, no compliance program, no formal non-compliance reporting and an apparent inconsistent enforcement across the whole of the organisation. In response to these identified issues, the following recommendations were made to improve the information security of the organisation: changing the organisations culture, creating an awareness mechanism for policies, improving the organisations culture, create an ICT policy awareness programme, review and re-write existing policies, policy enforcement, policy compliance, policy noncompliance reporting, policy updating and review, improve the policy development and approval process, policy compliance checking and uniform policy enforcement. Whilst it is also likely that a lack of governance contributed to these issues, this aspect was not addressed in this paper. It is hoped that timely implementation of the remedies presented here will increase the organisations information security.
- Pirc, Janez
Abstract: The diploma thesis describes the development and deployment of three security policies for a company with more than thousand employees and several locations throughout Slovenia. The thesis begins with a detailed description of the company’s environment and the perception of security – related problems. After that, the fundamental characteristics of information security and security policies are reviewed. A special focus is given on the meaning of effectiveness and deployment of security policies in a company’s practice. In this sense, the possible reasons and consequences of an unsuccessful deployment are also presented, followed by a review of two international standards dealing with security policies. In the last part of the thesis, the core ideas of proposed security policies are explained together with their relation to existing documentation in the company. Additionally, we include a short discussion on more restrictive rules, which would probably make the policy less efficient. A step by step description of the necessary activities for deploying the security policies and additions to the existing documentation is given at the end.
- J. Myšiak
Abstract: Scientific policy aid, especially in environmental management facing complex choices involving divergent beliefs and interests / values, has evolved into a number of distinct fields such as Decision Support Systems (DSS), Expert Systems (ES), Integrated Modelling and Assessment, Risk Analysis. While the approaches pursued by these systems are different, they are all focused on sustainable development and improvement of decision making involving intractable, elusive and ill-structured problems. Computer-aided policy support is expected to explore multiple perspectives of the problem at hand; enhance decision makers ’ insight into the problems drivers and policy outcomes; and facilitate communication and knowledge transfer between the actors involved in or affected by the decision. In this context computer systems play a crucial role as catalysts of interdisciplinary research and promoters of scientific policy advice. Applied policy research, however, seems to be losing its appeal mainly due to the persistent lack of successful implementation. There are different reasons for which policy makers do not embrace scientific policy recommendation, including the systems ’ failure to address the changing context of the problems; system complexity; highly demanding user interfaces not geared to users ’ skills; the low transparency of the systems ’ operation (‘black box ’ technology); cognitive obstacles, such as an aversion among senior executives to DSS technology; ignoring the broader organisational and institutional context. In this paper we explore recent trends leading to a new generation of policy support systems [Beynon et al.]
- Luay A. Wahsheh; Daniel Conte De Leon & Jim Alves-Foss
Abstract: Verified and validated security policies are essential components of high assurance computer systems. The design and implementation of security policies are fundamental processes in the development, deployment, and maintenance of such systems. In this paper, we introduce an expert system that helps with the design and implementation of security policies. We show how Prolog is used to verify system correctness with respect to policies using a theorem prover. Managing and visualizing information in high assurance computer systems are challenging tasks. To simplify these tasks, we show how a graph-based visualization tool is used to validate policies and provide system security managers with a process that enables policy reviews and visualizes interactions between the system’s entities. The tool provides not only a representation of the formal model, but also its execution. The introduced executable model is a formal specification and knowledge representation method.
- Woods, D; Agrafiotis, I; Nurse, JRC & Creese, S
Abstract: Policy discussions often assume that wider adoption of cyber insurance will promote information security best practice. However, this depends on the process that applicants need to go through to apply for cyber insurance. A typical process would require an applicant to fill out a proposal form, which is a self-assessed questionnaire. In this paper, we examine 24 proposal forms, offered by insurers based in the UK and the US, to determine which security controls are present in the forms. Our aim is to establish whether the collection of security controls mentioned in the analysed forms corresponds to the controls defined in ISO/IEC 27002 and the CIS Critical Security Controls; these two control sets are generally held to be best practice. This work contains a novel research direction as we are the first to systematically analyse cyber insurance proposal forms. Our contributions include evidence regarding the assumption that the insurance industry will promote security best practice. To address the problem of adverse selection, we suggest the number of controls that proposal forms should include to be in alignment with the two information security frameworks. Finally, we discuss the incentives that could lead to this disparity between insurance practice and information security best practice, emphasising the importance of information security economics in studying cyber insurance.
- Alkahtani, Hend K.
Abstract: The focus of the research is to improve the security of information systems in Saudi Arabian knowledge-intensive organisations by raising the awareness level among all types of information system users. This is achieved by developing a culturally aware information security framework that requires the involvement of all types of information system user. Saudi Arabia has a unique culture that affects the security of information systems and, hence, the development of this information security framework. The research uses Princess Nora bint Abdul Rahman University (PNU), the largest all female university in Saudi Arabia, as a case study. The level of information security awareness among employees at Saudi Arabia Universities was tested. Surveys and interviews were conducted to gather data related to the information security system and its uses. It was found that most employees in Saudi Arabian organisations and universities are not involved in the development of any information security policy and, therefore, they are not fully aware of the importance of the security of information. The purpose of this study is to develop a cultural aware information security framework that does involve all types of employees contributing to the development of information security policy. The framework, consists of nine steps that were adapted, modified and arranged differently from the international best practice standard ISO 27K framework to fit the unique culture in Saudi Arabia. An additional step has been added to the framework to define and gather knowledge about the organisations population to justify its fit into the segregated working environment of many Saudi Arabian institutions. Part of the research objective is to educate employees to use this information security framework in order to help them recognise and report threats and risks they may encounter during their work, and therefore improve the overall level of information security awareness. The developed information security framework is a collection of ISO 27k best practice steps, re-ordered, and with the addition of one new step to enable the framework to fit the situation in Saudi Arabian segregation working environments.
- Alrabiah, Abdullah Abdulrahman A.
Abstract: With the widespread of electronic (e) services, provided by different organizations at the internal Intranet level, the business Extranet level, and the public Internet level, information security (s) readiness of organizations is becoming of increasing importance for establishing a common and safe environment for such services. This thesis aims at providing s-readiness indicators for organizations with Intranet services, open to the external environment. These indicators represent protection levels against possible risks, and provide directions for future improvements. The work uses the STOPE (Strategy, Technology, Organization, People and Environment) comprehensive framework of technology utilization, together with the ISO (International Organization for Standardization) standard ISO 17799 concerned with information security management, to illustrate the information security problem. The security risks and their associated protection controls are shown to be related to: technology with respect to access, information systems, operations, and communications; organization with respect to assets, security violation incidents, business continuity, and internal and external issues; people with respect to human resources; and environment with respect to physical and legal issues. In addition, the importance of an information security strategy or policy is also emphasized. Based on the above, the work develops a STOPE mathematical model for the assessment of the information security state in organizations. The model provides a set of integrated indicators for the STOPE domains, at the various levels of ISO 17799. The levels of the model start at measuring the use of each of the “133” ISO security controls, and move up to measuring the achievement of ISO “39” security objectives, measuring compliance with ISO main parts, measuring the security state of each of the STOPE domains, and finally reaching up to an indicator that assesses sreadiness. Higher level indicators integrate the indicators of the lower ones; with the value of each indicator based not only on its level of protection against certain risks, but also on the weight of importance of its related issues. For the use of the above STOPE model for practical s-readiness assessment; a questionnaire, based on the model is developed. The questionnaire is used for the investigation of the security state of ten Saudi organizations working in different fields including: Banking; Military; Government; and IT Companies For each organization, the results obtained provide indicators associated with the various domains of the STOPE model, and with its different levels described above. The indicators provide a comprehensive picture of the strengths and the weaknesses of information security in these organizations; and this helps them in their future effort toward future information security improvement. The work would be useful to all organizations concerned with improving their s-readiness and providing e-services, compatible with international standards. It would also give researchers a comprehensive evaluation base upon which future improvements can be based. A special website (www.STOPEview.com) has been developed to encourage the use of the model, and its associated questionnaire, by organizations, for self information security assessment.
- Verma, Rohit & Ruj, Sushmita
Abstract: Security-as-a-service is an emerging area in cloud computing. Traditionally, security approaches are service provider-centric and provider-driven. In this paper, we propose a model for security-as-a-service using “crowdsourcing”. Though crowdsourcing has been used to provide specific security services like browser security, detecting phishing attacks, detecting cybersecurity threats, there has been no work which provides a unified framework to provide different types of security verification. Dispersed computing power of devices is used to perform security verifications. This is done by subscribers in a collaborative way, using their idle resources, in exchange of certain incentives. Our architecture guarantees anonymity of users who request service and the crowd who contribute in verification by using virtualization concepts and virtual machines. Moreover, we propose an approach for managing these security verification jobs, subscribers in a fault tolerant manner. To the best of our knowledge, we are the first to propose a unified security-as-a-service framework using crowdsourcing, thus introducing a new research problem. We discuss a number of applications, challenges and problems of crowdsourcing in security verification.
- Rastogi, Rahul
Abstract: In today’s world, information and the associated Information Technology are critical assets for many organizations. Any information security breach, or compromise of these assets, can lead to serious implications for organizations that are heavily dependent on these assets. For such organizations, information security becomes vital. Organizations deploy an information security infrastructure for protecting their information assets. This infrastructure consists of policies and controls. Organizations also create an information security management system for managing information security in the organization. While some of the policies and controls are of a purely technical nature, many depend upon the actions of end-users. However, end-users are known to exhibit both compliant and noncompliant behaviours in respect of these information security policies and controls in the organization. Non-compliant information security behaviours of end-users have the potential to lead to information security breaches. Non-compliance thus needs to be controlled. The discipline of information security and its management have evolved over the years. However, the discipline has retained the technology-driven nature of its origin. In this context, the discipline has failed to adequately appreciate the role played by the end-users and the complexities of their behaviour, as it relates to information security policies and controls. The pervasive information security management philosophy is that of treating end-users as the enemy. Compliance is sought to be achieved through awareness programs, rewards, punishments and evermore strict policies and controls. This has led to a bureaucratic information security management approach. The philosophy of treating end-users as the enemy has had an adverse impact on information security in the organization. It can be said that rather than curbing non-compliance by end-users, the present-day bureaucratic approach to information security management has contributed to non-compliance. This thesis calls this the end-user crisis. This research aims at resolving this crisis by identifying an improved approach to information security management in the organization. This research has applied the service management approach to information security management. The resultant Information Security Service Management (ISSM) views end-users as assets and resources, and not as enemies. The central idea of ISSM is that the end-user is to be treated as a customer, whose needs are to be satisfied. This research presents ISSM.
- Li, Yanhuang; Cuppens-Boulahia, Nora; Crom, Jean-Michel; Cuppens, Frédéric; FREY, Vincent & Ji, Xiaoshu
Abstract: The interaction between different applications and services requires expressing their security properties. This is typically defined as security policies, which aim at specifying the diverse privileges of different actors. Today similarity measure for comparing security policies becomes a crucial technique in a variety of scenarios, such as finding the cloud service providers which satisfy client’s security concerns. Existing approaches cover from semantic to numerical dimensions and the main work focuses mainly on XACML policies. However, few efforts have been made to extend the measure approach to multiple policy models and apply it to concrete scenarios. In this paper, we propose a generic and light-weight method to compare and evaluate security policies belonging to different models. Our technique enables client to quickly locate service providers with potentially similar policies. Comparing with other works, our approach takes policy elements’ logic relationships into account and the experiment and implementation demonstrate the efficiency and accuracy of our approach.
- Stephen S. Yau; Yisheng Yao; Zhaoji Chen & Luping Zhu
Abstract: A major advantage of service-based computing technology is the ability to enable rapid formation of large-scale distributed systems by composing massively available services to achieve the system goals, regardless of the programming languages and platforms used to develop and run these services. In these large-scale service-based systems, various capabilities are provided by different organizations and interconnected by various types of networks, including wireless (infrastructure or ad hoc) and wired networks. For these systems which often involve multiple organizations, high confidence and adaptability are of prime concern to ensure that users can use these systems anywhere, any time, through various devices, knowing that their confidentiality and privacy are well protected under various situations. In this paper, an adaptable security framework for large-scale service-based systems is presented. It includes a core ontology and a logic-based situation-aware security specification language for specifying dynamic security policies for service-based systems, an approach to policy conflict detection and resolution, and tools for generating and deploying security agents to enforce security policies. With this framework, various parties of large-scale service-based systems can rapidly specify, update, verify, and enforce security policies in service-based systems to meet their security requirements under various situations.