Cyber insurance of information systems: Security and privacy cyber insurance contracts for ICT and helathcare organizations

Nowadays, more-and-more aspects of our daily activities are digitalized. Data and assets in the cyber-space, both for individuals and organizations, must be safeguarded. Thus, the insurance sector must face the challenge of digital transformation in the 5G era with the right set of tools. In this paper, we present CyberSure-an insurance framework for information systems. CyberSure investigates the interplay between certification, risk management, and insurance of cyber processes. It promotes continuous monitoring as the new building block for cyber insurance in order to overcome the current obstacles of identifying in real-time contractual violations by the insured party and receiving early warning notifications prior the violation. Lightweight monitoring modules capture the status of the operating components and send data to the CyberSure backend system which performs the core decision making. Therefore, an insured system is certified dynamically, with the risk and insurance perspectives being evaluated at runtime as the system operation evolves. As new data become available, the risk management and the insurance policies are adjusted and fine-tuned. When an incident occurs, the insurance company possesses adequate information to assess the situation fast, estimate accurately the level of a potential loss, and decrease the required period for compensating the insured customer. The framework is applied in the ICT and healthcare domains, assessing the system of medium-size organizations. GDPR implications are also considered with the overall setting being effective and scalable

Could the Outsourcing of Incident Response Management provide a Blueprint for Managing Other Cloud Security Requirements?

Postprin

Observations and simulation of intense convection embedded in a warm conveyor belt – how ambient vertical wind shear determines the dynamical impact

Warm conveyor belts (WCBs) are dynamically important, strongly ascending and mostly stratiform cloud-forming airstreams in extratropical cyclones. Despite the predominantly stratiform character of the WCB\u27s large-scale cloud band, convective clouds can be embedded in it. This embedded convection leads to a heterogeneously structured cloud band with locally enhanced hydrometeor content, intense surface precipitation and substantial amounts of graupel in the middle troposhere. Recent studies showed that embedded convection forms dynamically relevant quasi-horizontal potential vorticity (PV) dipoles in the upper troposphere. Thereby one pole can reach strongly negative PV values associated with inertial or symmetric instability near the upper-level PV waveguide, where it can interact with and modify the upper-level jet. This study analyses the characteristics of embedded convection in the WCB of cyclone Sanchez based on WCB online trajectories from a convection-permitting simulation and airborne radar observations during the North Atlantic Waveguide and Downstream Impact EXperiment (NAWDEX) field campaign (IOPs 10 and 11). In the first part, we present the radar reflectivity structure of the WCB and corroborate its heterogeneous cloud structure and the occurrence of embedded convection. Radar observations in three different sub-regions of the WCB cloud band reveal the differing intensity of its embedded convection, which is qualitatively confirmed by the ascent rates of the online WCB trajectories. The detailed ascent behaviour of the WCB trajectories reveals that very intense convection with ascent rates of 600 hPa in 30–60 min occurs, in addition to comparatively moderate convection with slower ascent velocities as reported in previous case studies. In the second part of this study, a systematic Lagrangian composite analysis based on online trajectories for two sub-categories of WCB-embedded convection – moderate and intense convection – is performed. Composites of the cloud and precipitation structure confirm the large influence of embedded convection: Intense convection produces locally very intense surface precipitation with peak values exceeding 6 mm in 15 minutes and large amounts of graupel of up to 2.8 g kg$^{−1}$ in the middle troposphere (compared to 3.9 mm and 1.0 g kg$^{−2}$ for the moderate convective WCB sub-category). In the upper troposphere, both convective WCB trajectory sub-categories form a small-scale and weak PV dipole, with one pole reaching weakly negative PV values. However, for this WCB case study – in contrast to previous case studies reporting convective PV dipoles in the WCB ascent region with the negative PV pole near the upper-level jet – the negative PV pole is located east of the convective ascent region, i.e., away from the upper-level jet. Moreover, the PV dipole formed by the intense convective WCB trajectories is weaker and has a smaller horizontal and vertical extent compared to a previous NAWDEX case study of WCB-embedded convection, despite faster ascent rates in this case. The absence of a strong upper-level jet and the weak vertical shear of the ambient wind in cyclone Sanchez are accountable for the weak diabatic PV modification in the upper troposphere. This implies that the strength of embedded convection alone is not a reliable measure for the effect of embedded convection on upper-level PV modification and its impact on the upper-level jet. Instead, the profile of vertical wind shear and the alignment of embedded convection with a strong upper-level jet play a key role for the formation of coherent negative PV features near the jet. Finally, these results highlight the large case-to-case variability of embedded convection not only in terms of frequency and intensity of embedded convection in WCBs but also in terms of its dynamical implications

Certifying Services in Cloud: The Case for a Hybrid, Incremental and Multi-layer Approach

The use of clouds raises significant security concerns for the services they provide. Addressing these concerns requires novel models of cloud service certification based on multiple forms of evidence including testing and monitoring data, and trusted computing proofs. CUMULUS is a novel infrastructure for realising such certification models

Viewpoint | Personal Data and the Internet of Things: It is time to care about digital provenance

The Internet of Things promises a connected environment reacting to and addressing our every need, but based on the assumption that all of our movements and words can be recorded and analysed to achieve this end. Ubiquitous surveillance is also a precondition for most dystopian societies, both real and fictional. How our personal data is processed and consumed in an ever more connected world must imperatively be made transparent, and more effective technical solutions than those currently on offer, to manage personal data must urgently be investigated.Comment: 3 pages, 0 figures, preprint for Communication of the AC