The document summarizes some of the computer security research activities at University College Cork. It discusses three areas: user-centered security, business-centered security, and federated security. For each area, it provides examples of research projects that aim to advance foundational security results by considering practical applications. It also discusses related teaching activities.

1. Academic Perspective
Some Security Activities at University College Cork
Simon Foley
Department of Computer Science,
University College Cork, Ireland
www.cs.ucc.ie/~s.foley

2. Overview of Computer Security Activities
User Centered
Security
Advance foundational results in security by
Business Centered considering the application of security in practice.
Security
Federated Security
Research
¢ Security policy models and mechanisms
¢ Federated and distributed systems security
¢ Security risk management and governance
Teaching
¢ Computer security (undergraduate)
¢ Network security & Mobile systems security (postgraduate)
¢ Final year BSc and taught MSc projects in Security.
2 / 15

3. User Centered
Security
Business Centered
Security
Federated Security
User Centered Security
3 / 15

4. Security Policy Requirements Elicitation
User Centered
Security
Policy elicitation often driven by technical concerns.
Business Centered
Security
¢ Technical policies designed by technical people.
Federated Security
¢ Based on the system artifacts with which users interact:
groups, roles, transactions, etc.
Should consider needs of individuals and their relationships.
¢ Balance individuals’ requirements [eg, Multilateral Security].
¢ Include human issues.
How can we address this?
4 / 15

6. Trust Management Policy Elicitation
User Centered
Security
Use qualitative analysis methods from social sciences to elicit trust
Business Centered management policy for photograph sharing.
Security
Federated Security ¢ Explore user-experience through semi-structured interviews.
¢ Qualitative analysis elicits policy requirements.
¢ Model the result in a Bayesian Network.
User requirements more complex
than basic access controls.
[S.N. Foley, V.M. Rooney. Qualitative Analysis for Trust Management. International Security Protocols Workshop,
Cambridge, 2009. Springer LNCS.]
6 / 15

7. User Centered
Security
Business Centered
Security
Federated Security
Business Centered Security
7 / 15

8. Managing Security
User Centered
Security
Siloed security driven by technical concerns.
Business Centered
Security
¢ Technical mechanisms designed by technical people.
Federated Security
¢ Based on the system artifacts: groups, roles, transactions, etc.
Should align security with business strategy.
¢ Secure critical business processes, not just technologies
¢ Security threats are inevitable, need to manage the risk.
8 / 15

10. Security Risk Management
User Centered
Security Use Enterprise Risk Management (ERM) to manage (operational)
Business Centered risks related to security:
Security
Federated Security
¢ security mechanisms as controls that mitigate known risks in
meeting objectives of business process,
¢ tests that audit efficacy of risk mitigation.
Security as an ongoing process:
¢ measure, prioritize, mitigate,
¢ security risk metrics and aggregation.
[S.N. Foley. Security Risk Management using Internal Controls, Proceedings of ACM Workshop on Information
Security Governance (held at ACM-CCS), 2009;
S.N. Foley, H.B. Moss. A Risk-Metric Framework for Enterprise Risk Management, IBM Journal of Research and
Development, to appear 2010.]
10 / 15

11. Risk Management of Network Access Controls
User Centered
Security
Security controls should be compliant with best practice.
Business Centered
Security ¢ 1.2.1.a Verify that inbound and outbound traffic is limited to
Federated Security that which is necessary for the cardholder data. [PCI-DSS]
Semantic configuration models facilitate automated reasoning:
¢ Analysis of n-tier network for shadowing, redundancy, etc.
¢ Encode catalogues of best practice [PCI-DSS, NIST-800-41,
NIST-800-44, RFC-3330, RFC-1918].
¢ Autonomic configuration based on catalogue search.
[W.M. Fitzgerald, S.N. Foley, M O’Foghlu. Network Access Control Interoperation using Semantic Web Techniques, In
Proceedings of 6th International Workshop on Security in Information Systems, (WOSIS 2008), June 2008;
S.N. Foley and W.M. Fitzgerald. An Approach to Autonomic Security Policy Configuration using Semantic Threat
Graphs. IFIP WG 11.3 Working Conference on Data and Applications Security 2009. Springer LNCS 5645.]
11 / 15

12. User Centered
Security
Business Centered
Security
Federated Security
Federated Security
12 / 15

13. Security Policy
User Centered
Security
Centralized policy, closed system.
Business Centered
Security ¢ Centralized authority, controlled by administrator.
Federated Security
¢ Principle of no privilege.
¢ Opportunity to subvert administrator usually small.
Decentralized policy, open system.
¢ Decentralized authority across multiple stakeholders.
¢ Principle of flexible privilege
¢ Opportunity to subvert stakeholder intentions?
13 / 15

15. Secure Coalitions
User Centered
Security Federation as coalition of principals/federations.
Business Centered
Security ¢ coalition policy govern actions,
Federated Security
¢ coalition formation governed by participants,
¢ policy decentralized/distributed across PKI,
¢ principal of governed flexible privilege.
In the absence of a centralized authority,
the actions of a malicious principal/coalition
should not be able to circumvent policy.
[ S.N. Foley and H. Zhou, Authorisation Subterfuge by Delegation in Decentralised Networks In Proceedings of
International Security Protocols Workshop, Cambridge UK 2005. Springer Verlag LNCS;
H. Zhou and S.N. Foley, A Framework for Establishing Decentralized Secure Coalitions. IEEE Computer Security
Foundations, 2006.]
15 / 15