Self protecting data for de-perimeterised information sharing

The emergence of high-speed networks, Grid Computing, Service-Oriented Architectures, and an ever increasing ambient connection to mobile Internet has enabled an underpinning infrastructure for the development of dynamically formed, collaborative working groups known as Virtual Organisations (VOs). VOs provide strong motivation for investigation into the infrastructure, and in particular the security necessary to protect the information and resources shared within a VO, both while resident on local machines and when allowed to move beyond the secure boundary of a local organisational network perimeter and into the realm of the distributed VO. Traditional access control systems are perimeter- centric, meaning they apply the controls to both internal and external requests for access to information within or at the perimeter of their information system. • This paper presents the initial results of the JISC funded SPIDER project, being led by Cardiff University. Through case based example, the research investigates the limitations to granularity and persistent control over information when using the perimeter- centric approach in a collaborative working environment

Towards information sharing in virtual organisations: The development of an icon-based information control model

Today, innovation in information communication technology has encouraged contribution among different fields to tackle large-scale scientific problems or introduce novel inventories that, in both cases, demand extensive sharing of information among collaborating organisations in order to achieve the overall goal. Sharing information across different physical organisations, working as a single virtual organisation, raises a number of information security issues that limit the effectiveness, dynamism, and potential of collaborative working. Although extensive research has been conducted to provide secure information-sharing solutions within a single organisation, little research has investigated multi- organizational information-sharing environments where information requires to be protected but there are variations in information security needs and, in some cases, conflicts in applied information security controls. A key obstacle, the majority of research conducted in this area has overlooked, is not only the ability to govern remote access of users from one organisation to sensitive information stored in another organisation, but also having persistent control over owned information even after access has been granted and the information is either disseminated electronically, transformed into paper format, or even shared verbally. In addition, research was tailored to meet only specific research needs and address particular issues. Therefore, there is a lack of comprehensive, systematic approaches for controls on information usage shared electronically, regardless of specific circumstances. This paper aims to present a novel information control model that could keep information self-protected in dynamic collaborative environments by communicating information security needs along with the exchanged information using an Information Labelling Scheme. Based on SPIDER solution and Protective Commons, this scheme uses nine labelling icons (reflecting the protection type and level) associated with different information security controls (representing the information security mechanisms used to provide the protection). The model is demonstrated in the Microsoft Word 2007 application and a prototype has been developed as a plug-in software named Information Labelling Palette. It displays the nine self-explanatory icons in order for an information owner/user to label any information range within a single document using any icon. This consequently enforces the information security controls associated with the selected icon only into that particular range of electronic information, and secondly, communicates the information security needs to the recipient in a human-readable format, which would help keep recipients informed about how this information should be managed if printed out or shared verbally. Finally, the wide range of information security controls used in this proposed solution makes it widely applicable to meet the considerable diversity of organisations’ information security needs. Furthermore, it is believed to lay a solid foundation for future work in the area of information access control and control policy enforcement in collaborative environments

Under the corporate radar: examining insider business cybercrime victimization through an application of routine activities theory

Cybercrime is recognized as one of the top threats to UK economic security. On a daily basis, the computer networks of businesses suffer security breaches. A less explored dimension of this problem is cybercrimes committed by insiders. This paper provides a criminological analysis of corporate insider victimization. It begins by presenting reviews of insider criminal threats and routine activities theory as applied to cybercrime. Analysis of the nationally representative Cardiff University UK Business Cybercrime Survey then informs statistical models that predict the likelihood of businesses suffering insider cyber victimization, using routine activities and guardianship measures as predictors

Information security requirements in patient-centred healthcare supporting systems

Enabling Patient-Centred (PC) care in modern healthcare requires the flow of medical information with the patient between different healthcare providers as they follow the patient's treatment plan. However, PC care threatens the stability of the balance of information security in the support systems since legacy systems fall short of attaining a security balance when sharing their information due to compromises made between its availability, integrity, and confidentiality. Results show that the main reason for this is that information security implementation in discrete legacy systems focused mainly on information confidentiality and integrity leaving availability a challenge in collaboration. Through an empirical study using domain analysis, observations, and interviews, this paper identifies a need for six information security requirements in legacy systems to cope with this situation in order to attain the security balance in systems supporting PC care implementation in modern healthcare

Cloud security - An approach with modern cryptographic solutions

The term “cloud computing” has been in the spotlights of IT specialists due to its potential of transforming computer industry. Unfortunately, there are still some challenges to be resolved and the security aspects in the cloud based computing environment remain at the core of interest. The goal of our work is to identify the main security issues of cloud computing and to present approaches to secure clouds. Our research also focuses on data and storage security layers. As a result, we found out that the protection of cloud data lies in cloud cryptography. Thus, this thesis reviews the new cryptographic techniques used to protect and process encrypted data in a remote cloud storage. In this thesis we are proposing a cryptographic scheme which uses fingerprint scanning for user authentication and AES technique of 128/192/256 bit cipher key for encryption and decryption of user's data. AES provides higher data security compared to other encryption techniques like DES and Blowfish. Our scheme is used in DropBoxCrypt application. DropBoxCrypt is a data encryption-decryption application developed for Android mobile devices which can be used for browsing, exporting and opening encrypted data stored in cloud storage

Business to Business Data Sharing using Trusted Computing

Businesses and Governments are seeking new ways to improve their products and services, make them cost effective and take advantage of global sourcing options. This has been largely enabled by fast, stable communication networks sharing vast volumes of data to facilitate delivery of services to customers. Sharing has led to concerns over data protection and the risks the data faces in the new open business models called Digital Business Networks. Sharing data with partners to meet business objectives requires trust from both parties. Trust is difficult to build which is why organisations use a number of different methods to establish trust such as contracts, audits, etc. These have inherent issues which cannot easily be addressed. The current security landscape of controls, countermeasures and mitigation strategies have not changed significantly therefore new ways are being sought to deliver improved security. This need is increasing as organisations move towards new open de-perimeterised seamless business process models. Trusted Computing using a Trusted Platform Module claims to offer higher security for platforms leading to better data assurance and lower risk levels as well as protecting platforms from malicious code. This paper seeks to establish if Trusted Computing can offer lower risks and greater data assurance against platforms attacks when compared with current controls. A detailed risk assessment was performed of risks to data on current platforms, and then a further comparator assessment was performed assuming Trusted Computing Trusted Platform Modules (TPM) controls were deployed. This comparison suggests that Trusted Computing does indeed reduce the platform risks to data by up to 67%. However, due to the low adoption of the Trusted Computing TPM technology today, there are currently few applications using this new technology. This is expected to change as leading manufacturers of processor chips develop integrated functions within their processors, which will facilitate more applications to use the TPM in the medium to long term. There are other challenges which need to be overcome before TPM usage becomes common place. This includes a Public Key Infrastructure with certificate authorities aiding the use of the TPM. Deployment of TPM will need to extend from mainly laptops today to servers before organisations can use them for their critical data. The microprocessor manufacturers will also need to improve on isolation technologies to support commonly used virtualisation solutions. Operating system and application vendors will also need a standard method for software hash checks support proving the integrity of software. Trusted Computing with TPM offers a great step forward in protecting data from platform attacks as the current protection mechanisms have not changed significantly over recent years and in the author’s opinion are largely not effective against today’s attack methods. The technology needs to mature on many fronts before applications are developed and organisations gain the confidence to use it. However in the author’s opinion it is simply a matter of time before the required enablers are in place to allow wide spread adoption

Data-centric security : towards a utopian model for protecting corporate data on mobile devices

Data-centric security is significant in understanding, assessing and mitigating the various risks and impacts of sharing information outside corporate boundaries. Information generally leaves corporate boundaries through mobile devices. Mobile devices continue to evolve as multi-functional tools for everyday life, surpassing their initial intended use. This added capability and increasingly extensive use of mobile devices does not come without a degree of risk - hence the need to guard and protect information as it exists beyond the corporate boundaries and throughout its lifecycle. Literature on existing models crafted to protect data, rather than infrastructure in which the data resides, is reviewed. Technologies that organisations have implemented to adopt the data-centric model are studied. A utopian model that takes into account the shortcomings of existing technologies and deficiencies of common theories is proposed. Two sets of qualitative studies are reported; the first is a preliminary online survey to assess the ubiquity of mobile devices and extent of technology adoption towards implementation of data-centric model; and the second comprises of a focus survey and expert interviews pertaining on technologies that organisations have implemented to adopt the data-centric model. The latter study revealed insufficient data at the time of writing for the results to be statistically significant; however; indicative trends supported the assertions documented in the literature review. The question that this research answers is whether or not current technology implementations designed to mitigate risks from mobile devices, actually address business requirements. This research question, answered through these two sets qualitative studies, discovered inconsistencies between the technology implementations and business requirements. The thesis concludes by proposing a realistic model, based on the outcome of the qualitative study, which bridges the gap between the technology implementations and business requirements. Future work which could perhaps be conducted in light of the findings and the comments from this research is also considered

Secure Data Sharing and Collaboration in the Cloud

Cloud technology can be leveraged to enable data-sharing capabilities, which can benefit the user through greater productivity and efficiency. However, the Cloud is susceptible to many privacy and security vulnerabilities, which hinders the progress and widescale adoption of data sharing for the purposes of collaboration. Thus, there is a strong demand for data owners to not only ensure that their data is kept private and secure in the Cloud, but to also have a degree of control over their own data contents once they are shared with data consumers. Specifically, the main issues for data sharing in the Cloud include key management, security attacks, and data-owner access control. In terms of key management, it is vital that data must first be encrypted before storage in the Cloud, to prevent privacy and security breaches. However, the management of encryption keys is a great challenge. The sharing of keys with data consumers has proven to be ineffective, especially when considering data-consumer revocation. Security attacks may also prevent the widescale usage of the Cloud for data-sharing purposes. Common security attacks include insider attacks, collusion attacks, and man-in-the-middle attacks. In terms of access control, authorised data consumers could do anything they wish with an owner's data, including sending it to their peers and colleagues without the data owner's knowledge. Throughout this thesis, we investigate ways in which to address these issues. We first propose a key partitioning technique that aims to address the key management problem. We deploy this technique in a number of scenarios, such as remote healthcare management. We also develop secure data-sharing protocols that aim to mitigate and prevent security attacks on the Cloud. Finally, we focus on giving the data owner greater control, by developing a self-controlled software object called SafeProtect

Secure and efficient storage of multimedia: content in public cloud environments using joint compression and encryption

The Cloud Computing is a paradigm still with many unexplored areas ranging from the technological component to the de nition of new business models, but that is revolutionizing the way we design, implement and manage the entire infrastructure of information technology. The Infrastructure as a Service is the delivery of computing infrastructure, typically a virtual data center, along with a set of APIs that allow applications, in an automatic way, can control the resources they wish to use. The choice of the service provider and how it applies to their business model may lead to higher or lower cost in the operation and maintenance of applications near the suppliers. In this sense, this work proposed to carry out a literature review on the topic of Cloud Computing, secure storage and transmission of multimedia content, using lossless compression, in public cloud environments, and implement this system by building an application that manages data in public cloud environments (dropbox and meocloud). An application was built during this dissertation that meets the objectives set. This system provides the user a wide range of functions of data management in public cloud environments, for that the user only have to login to the system with his/her credentials, after performing the login, through the Oauth 1.0 protocol (authorization protocol) is generated an access token, this token is generated only with the consent of the user and allows the application to get access to data/user les without having to use credentials. With this token the framework can now operate and unlock the full potential of its functions. With this application is also available to the user functions of compression and encryption so that user can make the most of his/her cloud storage system securely. The compression function works using the compression algorithm LZMA being only necessary for the user to choose the les to be compressed. Relatively to encryption it will be used the encryption algorithm AES (Advanced Encryption Standard) that works with a 128 bit symmetric key de ned by user. We build the research into two distinct and complementary parts: The rst part consists of the theoretical foundation and the second part is the development of computer application where the data is managed, compressed, stored, transmitted in various environments of cloud computing. The theoretical framework is organized into two chapters, chapter 2 - Background on Cloud Storage and chapter 3 - Data compression. Sought through theoretical foundation demonstrate the relevance of the research, convey some of the pertinent theories and input whenever possible, research in the area. The second part of the work was devoted to the development of the application in cloud environment. We showed how we generated the application, presented the features, advantages, and safety standards for the data. Finally, we re ect on the results, according to the theoretical framework made in the rst part and platform development. We think that the work obtained is positive and that ts the goals we set ourselves to achieve. This research has some limitations, we believe that the time for completion was scarce and the implementation of the platform could bene t from the implementation of other features.In future research it would be appropriate to continue the project expanding the capabilities of the application, test the operation with other users and make comparative tests.A Computação em nuvem é um paradigma ainda com muitas áreas por explorar que vão desde a componente tecnológica à definição de novos modelos de negócio, mas que está a revolucionar a forma como projetamos, implementamos e gerimos toda a infraestrutura da tecnologia da informação. A Infraestrutura como Serviço representa a disponibilização da infraestrutura computacional, tipicamente um datacenter virtual, juntamente com um conjunto de APls que permitirá que aplicações, de forma automática, possam controlar os recursos que pretendem utilizar_ A escolha do fornecedor de serviços e a forma como este aplica o seu modelo de negócio poderão determinar um maior ou menor custo na operacionalização e manutenção das aplicações junto dos fornecedores. Neste sentido, esta dissertação propôs· se efetuar uma revisão bibliográfica sobre a temática da Computação em nuvem, a transmissão e o armazenamento seguro de conteúdos multimédia, utilizando a compressão sem perdas, em ambientes em nuvem públicos, e implementar um sistema deste tipo através da construção de uma aplicação que faz a gestão dos dados em ambientes de nuvem pública (dropbox e meocloud). Foi construída uma aplicação no decorrer desta dissertação que vai de encontro aos objectivos definidos. Este sistema fornece ao utilizador uma variada gama de funções de gestão de dados em ambientes de nuvem pública, para isso o utilizador tem apenas que realizar o login no sistema com as suas credenciais, após a realização de login, através do protocolo Oauth 1.0 (protocolo de autorização) é gerado um token de acesso, este token só é gerado com o consentimento do utilizador e permite que a aplicação tenha acesso aos dados / ficheiros do utilizador ~em que seja necessário utilizar as credenciais. Com este token a aplicação pode agora operar e disponibilizar todo o potencial das suas funções. Com esta aplicação é também disponibilizado ao utilizador funções de compressão e encriptação de modo a que possa usufruir ao máximo do seu sistema de armazenamento cloud com segurança. A função de compressão funciona utilizando o algoritmo de compressão LZMA sendo apenas necessário que o utilizador escolha os ficheiros a comprimir. Relativamente à cifragem utilizamos o algoritmo AES (Advanced Encryption Standard) que funciona com uma chave simétrica de 128bits definida pelo utilizador. Alicerçámos a investigação em duas partes distintas e complementares: a primeira parte é composta pela fundamentação teórica e a segunda parte consiste no desenvolvimento da aplicação informática em que os dados são geridos, comprimidos, armazenados, transmitidos em vários ambientes de computação em nuvem. A fundamentação teórica encontra-se organizada em dois capítulos, o capítulo 2 - "Background on Cloud Storage" e o capítulo 3 "Data Compression", Procurámos, através da fundamentação teórica, demonstrar a pertinência da investigação. transmitir algumas das teorias pertinentes e introduzir, sempre que possível, investigações existentes na área. A segunda parte do trabalho foi dedicada ao desenvolvimento da aplicação em ambiente "cloud". Evidenciámos o modo como gerámos a aplicação, apresentámos as funcionalidades, as vantagens. Por fim, refletimos sobre os resultados , de acordo com o enquadramento teórico efetuado na primeira parte e o desenvolvimento da plataforma. Pensamos que o trabalho obtido é positivo e que se enquadra nos objetivos que nos propusemos atingir. Este trabalho de investigação apresenta algumas limitações, consideramos que o tempo para a sua execução foi escasso e a implementação da plataforma poderia beneficiar com a implementação de outras funcionalidades. Em investigações futuras seria pertinente dar continuidade ao projeto ampliando as potencialidades da aplicação, testar o funcionamento com outros utilizadores e efetuar testes comparativos.Fundação para a Ciência e a Tecnologia (FCT