Contrôle d'accès versus Contrôle de flots

National audienceTraditionnellement, une politique de sécurité est mise en oeuvre par un mécanisme de contrôle des accès des sujets sur les objets du système: un sujet peut lire l'information contenue dans un objet si la politique autorise ce sujet à accéder à cet objet. Une politique induit des flots d'information: si un sujet s a le droit de lire un objet o, alors toute l'information que peut un jour contenir o est accessible à s. De même, si un sujet s a le droit de modifier un objet o, alors toute l'information qui peut être portée à la connaissance de s peut se propager dans le système par le biais de o. Alors qu'une politique spécifie des autorisations sur les contenus, sa mise en oeuvre contrôle les accès aux objets sans connaître leur contenu courant. Nous nous proposons dans ce travail d'étudier formellement les politiques de sécurité sous l'angle des flots d'information qu'elles induisent. Pour les politiques dont on ne peut pas montrer que tous les flots induits sont autorisés, nous définissons un mécanisme permettant de détecter les flux illégaux. Nous présentons aussi l'implémentation de ce mécanisme de détection

Cyber security: current challenges

International audienceLa numérisation de notre société a radicalement changé la manière dont les systèmes informatiques sont utilisés, une grande partie de la population étant connectée en permanence à Internet. Nous sommes ainsi exposés en permanence à des attaques pouvant entraîner des dommages considérables. La sécurité numérique est ainsi devenue une préoccupation majeure pour tous. Dans ce contexte, cet exposé donne un aperçu des domaines de recherche en sécurité numérique. La première étape de la sécurité consiste à identifier les menaces et à définir un modèle d'attaquant correspondant. Des mécanismes de protection et de détection doivent ensuite être conçus pour lutter contre ces menaces. Un mécanisme essentiel est la cryptographie. Cependant, bien que les primitives et les protocoles cryptographiques soient des éléments fondamentaux de la sécurité, des services de sécurité supplémentaires sont nécessaires, tels que l'authentification et le contrôle d'accès. Ces services de sécurité, généralement fournis par le système d'exploitation ou les périphériques réseau, peuvent eux-mêmes être attaqués et parfois contournés. Par conséquent, les activités entreprises sur le système d'information sont supervisées afin de détecter toute violation de la politique de sécurité. Enfin, comme les attaques peuvent se propager extrêmement rapidement, le système doit réagir automatiquement ou au moins se reconfigurer pour éviter de propager les attaques. Tous ces mécanismes de sécurité doivent être soigneusement intégrés dans les applications critiques pour la sécurité. Ces applications comprennent les systèmes informatiques traditionnels, mais aussi les systèmes industriels et, bien sûr, les nouvelles infrastructures distribuées (cloud, IoT). [Vidéo en ligne]</a

A influência da cultura organizacional na gestão de projetos Ágeis : caso de estudo

Mestrado em Gestão de ProjetosAs metodologias ágeis têm vindo a despertar cada vez mais o interesse, por parte das empresas que atualmente atuam em mercados cada vez mais competitivos, exigentes, imprevisíveis e que estão em constante mutação. Para competir e sobreviver às condições de contingência num determinado contexto empresarial e num determinado ambiente operacional, uma organização deverá ser rápida, eficiente e altamente flexível à mudança. As práticas e os métodos ágeis são o caminho utilizado por muitas organizações para introduzirem modificações complexas, evolutivas e duradouras para ganhar agilidade organizacional e, assim, obter uma ferramenta poderosa para ultrapassar concorrentes, num mercado dinâmico e imprevisível. Requer escalabilidade, adaptação, localização e adoção numa organização. A literatura tem demonstrado que a transformação da cultura organizacional é necessária para o processo de transformação ágil. Através de um caso de estudo procurou-se identificar as barreias e os desafios que uma organização possui para transformar a sua cultura organizacional numa cultura ágil. Este estudo mostra que esta mudança cultural acontece através das pessoas, com o apoio da administração e com a transmissão dos valores e princípios ágeis. Os resultados obtidos demonstram que o mindset, a comunicação, a estrutura e a dimensão da empresa são as barreiras e os desafios encontrados nesta transformação.Agile methodologies are increasingly encouraging interest from companies that are currently operating in more competitive, demanding, unpredictable and ever-changing markets. To compete and survive contingency conditions in a given business context and operating environment, an organization must be fast, efficient, and highly flexible to change. Agile practices and methods are the path many organizations use to make complex, evolutionary, and lasting modifications to gain organizational agility and thus gain a powerful tool for overcoming competitors in a dynamic and unpredictable marketplace. It requires scalability, adaptation, localization and adoption in an organization. The literature has shown that the alteration of organizational culture is necessary for the agile transformation process. Through a case study we sought to identify the barriers and challenges that an organization must transform its organizational culture into an agile culture. This study shows that this cultural change happens through people, with the support of management and the transmission of agile values and principles. The results show that the mindset, communication, structure and size of the company are the barriers and challenges encountered in this transformation.info:eu-repo/semantics/publishedVersio

: Défis actuels et axes de recherche à l'Inria

International audienceCe document est un résumé de la version anglaise du livre blanc d'Inria sur la cybersécurité, qui aété coordonné par Steve Kremer, Ludovic Mé, Didier Rémy et Vincent Roca. La rédaction repose sur la contribution de nombreux scientifiques d'Inria et de ses partenaires. Le livre blanc s'adresse à un large public et a été écrit pour permettre différents niveaux de lecture. Son premier objectif est de présenter l'analyse d'Inria sur les défis en cybersécurité en matière de recherche. À cette fin, il inclut un aperçu général des sujets de recherche académique en cybersécurité et une cartographie des recherches existantes sur la cybersécurité chez Inria. Il comprend aussi des présentations techniques des différents domaines de la cybersécurité et une description détaillée du travail effectué au sein des équipes-projets communes entre Inria et ses partenaires académiques susceptibles d'intéresser des experts en cybersécurité ou toute personne cherchant des informations détaillées sur un sujet particulier. Il se termine par des recommandations générales. Dans ce résumé en français, nous nous concentrons sur les parties générales et stratégiques au détriment des parties techniques et de la cartographie détaillée des recherches menées

Optimality Clue for Graph Coloring Problem

In this paper, we present a new approach which qualifies or not a solution found by a heuristic as a potential optimal solution. Our approach is based on the following observation: for a minimization problem, the number of admissible solutions decreases with the value of the objective function. For the Graph Coloring Problem (GCP), we confirm this observation and present a new way to prove optimality. This proof is based on the counting of the number of different k-colorings and the number of independent sets of a given graph G. Exact solutions counting problems are difficult problems (\#P-complete). However, we show that, using only randomized heuristics, it is possible to define an estimation of the upper bound of the number of k-colorings. This estimate has been calibrated on a large benchmark of graph instances for which the exact number of optimal k-colorings is known. Our approach, called optimality clue, build a sample of k-colorings of a given graph by running many times one randomized heuristic on the same graph instance. We use the evolutionary algorithm HEAD [Moalic et Gondran, 2018], which is one of the most efficient heuristic for GCP. Optimality clue matches with the standard definition of optimality on a wide number of instances of DIMACS and RBCII benchmarks where the optimality is known. Then, we show the clue of optimality for another set of graph instances. Optimality Metaheuristics Near-optimal

The near-atomic cryoEM structure of a flexible filamentous plant virus shows homology of its coat protein with nucleoproteins of animal viruses

Abstract Flexible filamentous viruses include economically important plant pathogens. Their viral particles contain several hundred copies of a helically arrayed coat protein (CP) protecting a (+)ssRNA. We describe here a structure at 3.9 Å resolution, from electron cryomicroscopy, of Pepino mosaic virus (PepMV), a representative of the genus Potexvirus (family Alphaflexiviridae). Our results allow modeling of the CP and its interactions with viral RNA. The overall fold of PepMV CP resembles that of nucleoproteins (NPs) from the genus Phlebovirus (family Bunyaviridae), a group of enveloped (-)ssRNA viruses. The main difference between potexvirus CP and phlebovirus NP is in their C-terminal extensions, which appear to determine the characteristics of the distinct multimeric assemblies -a flexuous, helical rod or a loose ribonucleoprotein. The homology suggests gene transfer between eukaryotic (+) and (-)ssRNA viruses

The influence of personality and ability on undergraduate teamwork and team performance

The ability to work effectively on a team is highly valued by employers, and collaboration among students can lead to intrinsic motivation, increased persistence, and greater transferability of skills. Moreover, innovation often arises from multidisciplinary teamwork. The influence of personality and ability on undergraduate teamwork and performance is not comprehensively understood. An investigation was undertaken to explore correlations between team outcomes, personality measures and ability in an undergraduate population. Team outcomes included various self-, peer- and instructor ratings of skills, performance, and experience. Personality measures and ability involved the Five-Factor Model personality traits and GPA. Personality, GPA, and teamwork survey data, as well as instructor evaluations were collected from upper division team project courses in engineering, business, political science, and industrial design at a large public university. Characteristics of a multidisciplinary student team project were briefly examined. Personality, in terms of extraversion scores, was positively correlated with instructors’ assessment of team performance in terms of oral and written presentation scores, which is consistent with prior research. Other correlations to instructor-, students’ self- and peer-ratings were revealed and merit further study. The findings in this study can be used to understand important influences on successful teamwork, teamwork instruction and intervention and to understand the design of effective curricula in this area moving forward

Liability in Software Engineering: Overview of the LISE Approach and Illustration on a Case Study

© ACM – 2010. This is the authors' pre-version of the work. It is posted here by permission of ACM for your personal use. Not for redistribution. The definitive version was published in the Proceedings of the 32nd ACM/IEEE international Conference on Software Engineering (ICSE'10) - Volume 1 – 978-1-60558-719-6/10/05 – (May 2-8 – 2010) http://doi.acm.org/10.1145/1806799.1806823LISE is a multidisciplinary project involving lawyers and computer scientists with the aim to put forward a set of methods and tools to (1) define software liability in a precise and unambiguous way and (2) establish such liability in case of incident. This report provides an overview of the overall approach taken in the project based on a case study. The case study illustrates a situation where, in order to reduce legal uncertainties, the parties to a contract wish to include in the agreement specific clauses to define as precisely as possible the share of liabilities between them for the main types of failures of the system

Origin and ascent history of unusually crystal-rich alkaline basaltic magmas from the western Pannonian Basin

The last eruptions of the monogenetic Bakony-Balaton Highland Volcanic Field (western Pannonian Basin, Hungary) produced unusually crystal- and xenolith-rich alkaline basalts which are unique among the alkaline basalts of the Carpathian- Pannonian Region. Similar alkaline basalts are only rarely known in other volcanic fields of the world. These special basaltic magmas fed the eruptions of two closely located volcanic centres: the Bondoró-hegy and the Füzes-tó scoria cone. Their uncommon enrichment in diverse crystals produced unique rock textures and modified original magma compositions (13.1-14.2 wt.% MgO, 459-657 ppm Cr, 455-564 ppm Ni contents). Detailed mineral-scale textural and chemical analyses revealed that the Bondoró-hegy and Füzes-tó alkaline basaltic magmas have a complex ascent history, and that most of their minerals (~30 vol.% of the rocks) represent foreign crystals derived from different levels of the underlying lithosphere. The most abundant xenocrysts, olivine, orthopyroxene, clinopyroxene and spinel, were incorporated from different regions and rock types of the subcontinental lithospheric mantle. Megacrysts of clinopyroxene and spinel could have originated from pegmatitic veins / sills which probably represent magmas crystallized near the crust-mantle boundary. Green clinopyroxene xenocrysts could have been derived from lower crustal mafic granulites. Minerals that crystallized in situ from the alkaline basaltic melts (olivine with Cr-spinel inclusions, clinopyroxene, plagioclase, Fe-Ti oxides) are only represented by microphenocrysts and overgrowths on the foreign crystals. The vast amount of peridotitic (most common) and mafic granulitic materials indicates a highly effective interaction between the ascending magmas and wall rocks at lithospheric mantle and lower crustal levels. However, fragments from the middle and upper crust are absent from the studied basalts, suggesting a change in the style (and possibly rate) of magma ascent in the crust. These xenocryst- and xenolith-rich basalts yield divers tools for estimating magma ascent rate that is important for hazard forecasting in monogenetic volcanic fields. According to the estimated ascent rates, the Bondoró-hegy and Füzes-tó alkaline basaltic magmas could have reached the surface within hours to few days, similarly to the estimates for other eruptive centres in the Pannonian Basin which were fed by "normal" (crystal- and xenolith-poor) alkaline basalts