Organizational Security Requirements Research Articles

Trends in Interpretation of EU Data Protection Authorities of Cybersecurity Requirements Under the GDPR

One of the main legal requirements for the adopting the GDPR was the technical and organizational security requirements, alongside the transparency and purpose limitation principles. The wide wording mentioned by the GDPR in terms of state-of-the-art security measures has given rise to a series of interpretations both in literature and by the data controllers and data processors. The manner in which national data protection authorities interpret this wording on a case-by-case basis is a good indicator in terms of interpretation, as the authorities look into the specific use case requiring preventive security measures. Thus, this research paper brings additional clarity in the interpretation of this legal requirement in terms of the risks and damages considered relevant for the specific data breach or lack of proper legal requirement implementation, given publicly available information in this respect. Further, the research paper highlights the number of use cases analyzed by different national data protection authorities and the views of each national data protection authority.

Contemporaneous Update and Enforcement of ABAC Policies.

Access control policies are dynamic in nature, and therefore require frequent updates to synchronize with the latest organizational security requirements. As these updates are handled, it is important that all user access requests be answered contemporaneously and correctly without any interruption or delay. In this paper, considering the context of Attribute Based Access Control (ABAC), we propose an approach that is capable of immediately materializing any update to the policy and ensuring that it is taken into account for any subsequent access requests. One possibility is to update the policy based on the incoming changes through ABAC policy mining techniques. However, it turns out that no existing mining approach can offer correct enforcement of policies when access requests are entertained during the updates. We provide a formal proof for this surprising result and then propose an approach called δwOP that does not suffer from this problem. Essentially, δwOP keeps track of the needed information from updates and uses this in conjunction with the existing ABAC policy rules to make access decisions. We present the complexity analysis as well as a comprehensive experimental evaluation to demonstrate the efficacy of the proposed approach for different types of changes.

Automated Synthesis of Distributed Network Access Controls: A Formal Framework with Refinement

Due to the extensive use of network services and emerging security threats, enterprise networks deploy varieties of security devices for controlling resource access based on organizational security requirements. These requirements need fine-grained access control rules based on heterogeneous isolation patterns like access denial, trusted communication, and payload inspection. Organizations are also seeking for usable and optimal security configurations that can harden the network security within enterprise budget constraints. In order to design a security architecture, i.e., the distribution of security devices along with their security policies, that satisfies the organizational security requirements as well as the business constraints, it is required to analyze various alternative security architectures considering placements of network security devices in the network and the corresponding access controls. In this paper, we present an automated formal framework for synthesizing network security configurations. The main design alternatives include different kinds of isolation patterns for network traffic flows. The framework takes security requirements and business constraints along with the network topology as inputs. Then, it synthesizes cost-effective security configurations satisfying the constraints and provides placements of different security devices, optimally distributed in the network, according to the given network topology. In addition, we provide a hypothesis testing-based security architecture refinement mechanism that explores various security design alternatives using ConfigSynth and improves the security architecture by systematically increasing the security requirements. We demonstrate the execution of ConfigSynth and the refinement mechanism using case studies. Finally, we evaluate their scalability using simulated experiments.

Smart Placement of Security Devices in Cloud Data Center Network

The extensive use of cloud services and newly-evolved security threats have made most cloud service providers deploy a variety of security devices such as firewalls, Internet Protocol Security, and intrusion detection systems to control resource access based on the security requirements of the data center. Therefore, security requirements are becoming more fine-grained where the control of access depends on heterogeneous partition levels like filtering network traffic, Internet Protocol Security encryption-based traffic forwarding, and payload inspection. However, today, cloud service providers are looking to systematically harden security by incorporating multiple security devices in the network in a cost-effective way. This requires evaluating several alternative security architectures to satisfy both organizational security requirements and business constraints. In this paper, we present an automated framework to synthesize data center security configurations by exploring various security design alternatives to provide better in-depth defense for the cloud infrastructure. The main design alternatives use different patterns of isolation for different segments of the cloud infrastructure. In this work, we take a dummy data center topology, cloud service provider security (connectivity and isolation) requirements and business constraints (usability and cost) as input ,and synthesize a correct and optimal data center security strategy by way of determining the optimal placement of different security devices in the data center.

The role of classification of information in controlling data proliferation in end-user personal computer environment

The widespread use of personal computers in the corporate environment has resulted in distribution of data processing throughout organizations with unpredictable effects on data security and necessitating a total re-evaluation of organizational security requirements. This paper proposes classification of business information combined with relevant control measures as a means of managing data proliferation. A number of methods for classification of information are discussed.