I recently published, along with HPL colleagues, new papers in the space of Cloud, Cloud assurance and compliance and privacy:
• Marco Casassa Mont, Kieran McCorry, Nick Papanikolaou, Siani Pearson “Security and Privacy Governance In Cloud Computing via SLAs and a policy orchestration service”, Frank Leymann, Ivan Ivanov, Marten van Sinderen and Tony Shan (eds.), Proc. Closer 2012, Portugal, SciTePress, April 2012.
• Nick Papanikolaou, Siani Pearson, Marco Casassa Mont and Ryan Ko, “Automating Compliance for Cloud Computing Services”, Frank Leymann, Ivan Ivanov, Marten van Sinderen and Tony Shan (eds.), Proc. Closer 2012, Portugal, SciTePress, April 2012.
In particular I believe that safe information sharing in the cloud is a key aspect to further enable adoption of cloud solutions by the industry.
For example, this will be the case in next generation supply-chain scenarios and federated Security Operation Centres (SOCs), operating in the cloud and/or involving entities that use services in the cloud.
Key requirements include providing mechanisms for safe sharing, assurance, risk assessment and compliance. An area to further explore and research ...
--- Posted by Marco Casassa Mont (here and here) ---
--- NOTE: use this mirror blog if you prefer posting on an external blog site ---
--- NOTE: my original HP blog can be found here ---
Showing posts with label privacy. Show all posts
Showing posts with label privacy. Show all posts
Friday, June 1, 2012
Monday, May 30, 2011
Focusing on the Cloud and the Intersection of Cloud with Security
An area I am interested in spending more R&D time is the Cloud and the intersection of the Cloud with Security.
In particular I am interested exploring and contributing in the space of “Cloud middleware”. Some initial questions:
Which “middleware” services can be provided in the cloud to support various Cloud applications and services?
Which identity maangemet, security and privacy capabilities need to be in place?
How ensure accountability and assurance?
How to exploit recent Identity and Security Analytics capabilities, developed by HP Labs, in that space
I am currently gathering various information and documents in this space, related to business opportunities, current solution offering and technological approaches.
Any input and links to publicly available information are really welcome.
--- Posted by Marco Casassa Mont (here and here) ---
--- NOTE: use this mirror blog if you prefer posting on an external blog site ---
--- NOTE: my original HP blog can be found here ---
In particular I am interested exploring and contributing in the space of “Cloud middleware”. Some initial questions:
Which “middleware” services can be provided in the cloud to support various Cloud applications and services?
Which identity maangemet, security and privacy capabilities need to be in place?
How ensure accountability and assurance?
How to exploit recent Identity and Security Analytics capabilities, developed by HP Labs, in that space
I am currently gathering various information and documents in this space, related to business opportunities, current solution offering and technological approaches.
Any input and links to publicly available information are really welcome.
--- Posted by Marco Casassa Mont (here and here) ---
--- NOTE: use this mirror blog if you prefer posting on an external blog site ---
--- NOTE: my original HP blog can be found here ---
Thursday, March 11, 2010
The First EnCoRe Technical Architecture for the Management of Consent and Revocation is Available Online
The first EnCoRe Technical Architecture for the explicit management of consent and revocation on personal data has been published and is available online:
“This document is a formal deliverable of the EnCoRe project. It contains the definition of the EnCoRe Technical Architecture for the first realized Case Study: an Enhanced Employee Data Scenario. It also describes that scenario – specifically the use, by employees of an organisation, of a Web2.0-style service for work-related and personal purposes – and its related requirements regarding consent management. These requirements were gathered and defined by legal and social science research within the EnCoRe project, and were influenced by its concept formalisation research.
The scope of the EnCoRe Technical Architecture for this first Case Study encompasses all the technical functions required for the management (including capture and revocation) and enforcement of individuals’ consents that are pertinent to the Case Study‟s scenario. The technical architecture is the block-level design of the necessary technical system, at the level of functional blocks (i.e., software and service components) and the data flows between them and to/from humans, other technical systems, compliance and other business processes and regulatory environments. Its goal is to provide the basis for an EnCoRe reference implementation that validates the approach and the technology. To that end this document’s approach is to start with contextual information and overviews, and incrementally refine the level of detail. Most of this detail is contained within Appendices.”
--- Posted by Marco Casassa Mont (here and here) ---
--- NOTE: use this mirror blog if you prefer posting on an external blog site ---
--- NOTE: my original HP blog can be found here ---
“This document is a formal deliverable of the EnCoRe project. It contains the definition of the EnCoRe Technical Architecture for the first realized Case Study: an Enhanced Employee Data Scenario. It also describes that scenario – specifically the use, by employees of an organisation, of a Web2.0-style service for work-related and personal purposes – and its related requirements regarding consent management. These requirements were gathered and defined by legal and social science research within the EnCoRe project, and were influenced by its concept formalisation research.
The scope of the EnCoRe Technical Architecture for this first Case Study encompasses all the technical functions required for the management (including capture and revocation) and enforcement of individuals’ consents that are pertinent to the Case Study‟s scenario. The technical architecture is the block-level design of the necessary technical system, at the level of functional blocks (i.e., software and service components) and the data flows between them and to/from humans, other technical systems, compliance and other business processes and regulatory environments. Its goal is to provide the basis for an EnCoRe reference implementation that validates the approach and the technology. To that end this document’s approach is to start with contextual information and overviews, and incrementally refine the level of detail. Most of this detail is contained within Appendices.”
--- Posted by Marco Casassa Mont (here and here) ---
--- NOTE: use this mirror blog if you prefer posting on an external blog site ---
--- NOTE: my original HP blog can be found here ---
Friday, November 27, 2009
New HP Labs Technical Report - Extending XACML Access Control Architecture for Allowing Preference-Based Authorisation
A new HP Labs Technical Report has been recently released: “Extending XACML Access Control Architecture for Allowing Preference-Based Authorisation” (Authors: Kounga, Gina; Casassa Mont, Marco; Bramhall, Pete):
“Data protection regulations, such as the UK Data Protection Act, require organisations to process personal data according to the conditions consented by the data subjects. Such conditions can be expressed with data items or preferences collected from data subjects and stored in data repositories. Then, enforcing consent requires the policy decision point (PDP) to return authorization decisions based on access control policies and preferences. However, as security good practice requires using different entities for making authorisation decisions and accessing data, the PDP cannot return privacy-aware authorisation decisions if no solution is defined which allows the PDP to identify whether access requests fulfil the consented conditions without accessing the preferences. Existing standards do not solve this issue and previously proposed solutions transfer the decision making to the policy enforcement point. In this paper, we propose a solution that extends the eXtensible Access Control Markup Language standard and improves privacy-aware access control.”
--- Posted by Marco Casassa Mont (here and here) ---
--- NOTE: my original HP blog can be found here ---
“Data protection regulations, such as the UK Data Protection Act, require organisations to process personal data according to the conditions consented by the data subjects. Such conditions can be expressed with data items or preferences collected from data subjects and stored in data repositories. Then, enforcing consent requires the policy decision point (PDP) to return authorization decisions based on access control policies and preferences. However, as security good practice requires using different entities for making authorisation decisions and accessing data, the PDP cannot return privacy-aware authorisation decisions if no solution is defined which allows the PDP to identify whether access requests fulfil the consented conditions without accessing the preferences. Existing standards do not solve this issue and previously proposed solutions transfer the decision making to the policy enforcement point. In this paper, we propose a solution that extends the eXtensible Access Control Markup Language standard and improves privacy-aware access control.”
--- Posted by Marco Casassa Mont (here and here) ---
--- NOTE: my original HP blog can be found here ---
Friday, October 9, 2009
Research on Security and Identity Management
The time has come to update the topic (and focus) of this blog.
In the last few years my R&D work and research at HP Labs has been involving a variety of aspects, including security, identity management and privacy.
Most of my posts have actually been reflecting this – hence my decision to update my blog. Hope this will further increase the community of people that are interested and follow my blog.
--- Posted by Marco Casassa Mont (here and here) ---
--- NOTE: my original HP blog can be found here ---
In the last few years my R&D work and research at HP Labs has been involving a variety of aspects, including security, identity management and privacy.
Most of my posts have actually been reflecting this – hence my decision to update my blog. Hope this will further increase the community of people that are interested and follow my blog.
--- Posted by Marco Casassa Mont (here and here) ---
--- NOTE: my original HP blog can be found here ---
Monday, September 28, 2009
Workshop on Access Control (and Privacy) Application Scenarios
Please consider submitting a position paper at the W3C Workshop on Access Control (and Privacy) Application Scenarios, by October 23rd:
http://www.w3.org/2009/policy-ws/cfp.html
"W3C invites people to participate in a Workshop on Access Control Application Scenarios on 17-18 November 2009 in Luxembourg. This Workshop is intended to explore evolving application scenarios for access control technologies, such as XACML. Results from a number of recent European research projects in the grid, cloud computing, and privacy areas show overlapping use cases for these technologies that extend beyond classical intra-enterprise applications. The Workshop, co-financed by the European Commission 7th framework program via the PrimeLife project, is free of charge and open to anyone, subject to review of their statement of interest and space availability.
The workshop is intended to discuss issues around access control in very wide sense, encompassing conditions and rules derived from the fact of accessing information. Topics that might serve as appropriate discussion points for position papers include, but are not limited to:
The workshop will examine experiences and recent research results in these areas, their need for agreed semantics, the need for extensions to existing access control languages, and perhaps for radically new approaches.
Position papers are due 23 October. See the call for participation for more information."
--- Posted by Marco Casassa Mont (here and here) ---
--- NOTE: use this mirror blog if you prefer posting on an external blog site ---
--- NOTE: my original HP blog can be found here ---
http://www.w3.org/2009/policy-ws/cfp.html
"W3C invites people to participate in a Workshop on Access Control Application Scenarios on 17-18 November 2009 in Luxembourg. This Workshop is intended to explore evolving application scenarios for access control technologies, such as XACML. Results from a number of recent European research projects in the grid, cloud computing, and privacy areas show overlapping use cases for these technologies that extend beyond classical intra-enterprise applications. The Workshop, co-financed by the European Commission 7th framework program via the PrimeLife project, is free of charge and open to anyone, subject to review of their statement of interest and space availability.
The workshop is intended to discuss issues around access control in very wide sense, encompassing conditions and rules derived from the fact of accessing information. Topics that might serve as appropriate discussion points for position papers include, but are not limited to:
- interaction between access control and privacy policies
- language extensions to connect access control languages to novel types of credentials
- large-scale cloud and grid computing use cases for access control technologies
- policy management
- mechanisms for controlling progressive disclosure of information by user agents and servers
- the emerging role of trust delegation and supportive mechanisms in cloud computing, grid, and Web use cases
- mechanisms for richer user control over downstream data controllers
The workshop will examine experiences and recent research results in these areas, their need for agreed semantics, the need for extensions to existing access control languages, and perhaps for radically new approaches.
Position papers are due 23 October. See the call for participation for more information."
--- Posted by Marco Casassa Mont (here and here) ---
--- NOTE: use this mirror blog if you prefer posting on an external blog site ---
--- NOTE: my original HP blog can be found here ---
Thursday, December 11, 2008
EU Commission has set an Advisory Panel to revise EU Data Protection Directive
As highlighted in this article, you might be interest in knowing that the European Commission has set an Advisory Panel, including executives from Google and Intel, to help revising the European Union laws on Data Protection:
"The aim of the group is to identify issues and challenges raised by new technologies. We are not reviewing the main data protection laws at present, but this could be a first step," said European Commission spokesman Michele Cercone. He added that the executives were chosen in a private capacity, rather than as representatives of their companies."
--- NOTE: my original HP blog can be found here ---
"The aim of the group is to identify issues and challenges raised by new technologies. We are not reviewing the main data protection laws at present, but this could be a first step," said European Commission spokesman Michele Cercone. He added that the executives were chosen in a private capacity, rather than as representatives of their companies."
--- NOTE: my original HP blog can be found here ---
Monday, December 1, 2008
A Fine Balance 2008: Privacy Technologies in Action
On November, 27th I attended the UK “A Fine Balance 2008: Privacy Technologies in Action” event. It provided different and interesting perspectives (from the technological, social and legislative angles) on privacy. Presentations are soon going to be made available online:
“Following the success of the 2006 and 2007 Fine Balance events, four of the government's Knowledge Transfer Networks present the third in this series of independent forums that are already helping industry, government and academia achieve a balance between ensuring privacy and enjoying the benefits of new technology.”
--- NOTE: my original HP blog can be found here ---
“Following the success of the 2006 and 2007 Fine Balance events, four of the government's Knowledge Transfer Networks present the third in this series of independent forums that are already helping industry, government and academia achieve a balance between ensuring privacy and enjoying the benefits of new technology.”
--- NOTE: my original HP blog can be found here ---
Tuesday, October 28, 2008
Top 5 Mistakes of Privacy Awareness Programs?
Jay Cline, in an interesting article called “Opinion: Top 5 Mistakes of Privacy Awareness Programs”, lists the top five shortcuts that many large corporations take when dealing with privacy awareness programs:
- Doing separate training for privacy, security, records management and code of ethics
- Equating "campaign" with "program"
- Equating "awareness" with "training"
- Using one or two communications channels
- No measurement
Have a look.
--- NOTE: my original HP blog can be found here ---
Wednesday, October 22, 2008
PrivacyOS: Thematic Network for Privacy Protection
PrivacyOS (Privacy Open Space) is “a thematic network for privacy protection infrastructure within the current European Commission´s ICT Policy Support Programme. The Project has started at the beginning of June 2008 and brings together industry, SMEs, Government, Academia and Civil Society to foster development and deployment of privacy infrastructures for Europe.”
More details can be found here.
Last week I attended the first PrivacyOS Conference (Strasbourg, 13-15 October 2008). It has been very interesting and stimulating, considering the heterogeneous background of the audience, their presentations and subsequent discussions. I would encourage the members of this community to attend in the future (the next conference is going to happen in April 2009).
In this context, I gave a presentation on "Enabling Privacy-aware Information Lifecycle Management in Enterprises", describing work done at HP Labs and in the EU PRIME project (Framework VI), in the space of “Management of Parametric Privacy Obligation Policies”.
--- NOTE: my original HP blog can be found here ---
More details can be found here.
Last week I attended the first PrivacyOS Conference (Strasbourg, 13-15 October 2008). It has been very interesting and stimulating, considering the heterogeneous background of the audience, their presentations and subsequent discussions. I would encourage the members of this community to attend in the future (the next conference is going to happen in April 2009).
In this context, I gave a presentation on "Enabling Privacy-aware Information Lifecycle Management in Enterprises", describing work done at HP Labs and in the EU PRIME project (Framework VI), in the space of “Management of Parametric Privacy Obligation Policies”.
--- NOTE: my original HP blog can be found here ---
Tuesday, October 21, 2008
Online Dialog on Health Information Technology and Privacy
As highlighted by this article, called “OMB sponsors online discussion of privacy issues”:
“The Office of Management and Budget has asked the National Academy of Public Administration to hold a public discussion this month of health care privacy issues through an interactive Web site.”
This online dialog will take place the week of October, 27, at: http://www.thenationaldialogue.org/.
--- NOTE: my original HP blog can be found here ---
“The Office of Management and Budget has asked the National Academy of Public Administration to hold a public discussion this month of health care privacy issues through an interactive Web site.”
This online dialog will take place the week of October, 27, at: http://www.thenationaldialogue.org/.
--- NOTE: my original HP blog can be found here ---
Friday, September 19, 2008
Announcing EnCoRe (Ensuring Consent and Revocation): a new UK IT Collaborative Project
A new UK IT collaborative project has been officially announced: EnCoRe – Ensuring Consent and Revocation (some initial press releases: here and here):
“As more and more personal information flows from individuals to organisations when they interact online, people are becoming more and more concerned that they can not effectively control what this information is used for, with which other organisations it is shared, and where it is stored. They may have given their consent, often in vague terms and implicitly, for its use, sharing and storage, but they have no real control over the specifics of these, nor the ability to revoke their consent and be sure that their wish is respected. In summary, they are not able to control where their personal information flows to, and this makes them uneasy about interacting online.
The overall vision of this project is to make giving consent as reliable and easy as turning on a tap, and revoking that consent as reliable and easy as turning it off again.”
This £3.6m project consortium is multi-disciplinary, spanning across a number of IT and social science specialisms. The project partners are Hewlett-Packard Laboratories, HW Communications, QinetiQ, the London School of Economics, the Ethox Centre of the University of Oxford and the University of Warwick.
The EnCoRe project runs from June 2008 to November 2011. It receives funding from the UK Government’s Technology Strategy Board, Economic & Social Research Council and Engineering & Physical Sciences Research Council.
--- NOTE: my original HP blog can be found here ---
“As more and more personal information flows from individuals to organisations when they interact online, people are becoming more and more concerned that they can not effectively control what this information is used for, with which other organisations it is shared, and where it is stored. They may have given their consent, often in vague terms and implicitly, for its use, sharing and storage, but they have no real control over the specifics of these, nor the ability to revoke their consent and be sure that their wish is respected. In summary, they are not able to control where their personal information flows to, and this makes them uneasy about interacting online.
The overall vision of this project is to make giving consent as reliable and easy as turning on a tap, and revoking that consent as reliable and easy as turning it off again.”
This £3.6m project consortium is multi-disciplinary, spanning across a number of IT and social science specialisms. The project partners are Hewlett-Packard Laboratories, HW Communications, QinetiQ, the London School of Economics, the Ethox Centre of the University of Oxford and the University of Warwick.
The EnCoRe project runs from June 2008 to November 2011. It receives funding from the UK Government’s Technology Strategy Board, Economic & Social Research Council and Engineering & Physical Sciences Research Council.
--- NOTE: my original HP blog can be found here ---
Saturday, August 2, 2008
Firefox and 50 add-ons for Private and Secure Web Surfing
A recent article by Laura Milligan, called “50 Firefox add-ons to achieve private and secure web surfing” provides a comprehensive list of add-ons for Firefox to achieve degreees of security and privacy whilst surfing the web:
“Firefox is generally considered a secure web browser, but if you’re interested in keeping your activity on certain websites private or giving yourself extra protection against phishing, hackers and viruses, you may want to consider beefing up your Firefox’s security in general. Thankfully, there are lots of options available that make achieving privacy and security online as easy as downloading a simple add-on or application that was designed just for Firefox users.”
This article classifies these 50 add-ons (and provides links for each of them) in the following categories: Secrecy and Encryption; add-ons that beef-up security; cookies; testing your system; passwords; protect your privacy online.
Have you had any direct experience using these add-ons? Are they up to their promises?
--- NOTE: my original HP blog can be found here ---
“Firefox is generally considered a secure web browser, but if you’re interested in keeping your activity on certain websites private or giving yourself extra protection against phishing, hackers and viruses, you may want to consider beefing up your Firefox’s security in general. Thankfully, there are lots of options available that make achieving privacy and security online as easy as downloading a simple add-on or application that was designed just for Firefox users.”
This article classifies these 50 add-ons (and provides links for each of them) in the following categories: Secrecy and Encryption; add-ons that beef-up security; cookies; testing your system; passwords; protect your privacy online.
Have you had any direct experience using these add-ons? Are they up to their promises?
--- NOTE: my original HP blog can be found here ---
Friday, June 20, 2008
DoD and Funding Research into Information Sharing
As reported by this article, the US Defence Department (DoD) is going to fund research on information sharing:
"The Defense Department has awarded $7.5 million to six universities for a five-year research program to help solve the problem of sharing sensitive information while ensuring privacy and security.
The failure of intelligence and law enforcement organizations to share information was one of the problems that contributed to the terrorist attacks of Sept. 11, 2001, according to the commission that studied the attacks. But connecting the dots has proved to be a knotty problem for organizations built on secrecy and control. …”
--- NOTE: my original HP blog can be found here ---
"The Defense Department has awarded $7.5 million to six universities for a five-year research program to help solve the problem of sharing sensitive information while ensuring privacy and security.
The failure of intelligence and law enforcement organizations to share information was one of the problems that contributed to the terrorist attacks of Sept. 11, 2001, according to the commission that studied the attacks. But connecting the dots has proved to be a knotty problem for organizations built on secrecy and control. …”
--- NOTE: my original HP blog can be found here ---
Thursday, May 22, 2008
Phorm Spoiler Launched by a Privacy Group
As reported in this article, a privacy group (The Anti-Phorm Group) has launched a “Phorm Spoiler”, to deal with the fact that ISPs and Phorm Advertising Services are increasingly collecting personal data and profiles based un users’ surfing behaviours. An Anti-Phorm application is available for download online:
“The AntiPhorm group - which describes itself as "a loose conglomeration of concerned individuals comprised of artists, programmers and designers" - says it wants to prevent ISPs from profiting from their customers' personal surfing habits. …
To throw Phorm off the scent, the team has developed an application called AntiPhormLite that sits in the background, visiting random sites. "It connects to the web and intelligently simulates natural surfing behaviour across thousands of customisable topics," the site claims.”
--- NOTE: my original HP blog can be found here ---
“The AntiPhorm group - which describes itself as "a loose conglomeration of concerned individuals comprised of artists, programmers and designers" - says it wants to prevent ISPs from profiting from their customers' personal surfing habits. …
To throw Phorm off the scent, the team has developed an application called AntiPhormLite that sits in the background, visiting random sites. "It connects to the web and intelligently simulates natural surfing behaviour across thousands of customisable topics," the site claims.”
--- NOTE: my original HP blog can be found here ---
Tuesday, April 29, 2008
Are Patients’ Medical Records at Risk?
I found a recent Wall Street Journal’s article, called “Are your Medical Record at Risk” (by Sarah Rubenstein), very interesting. It provides good insights about the trade-offs adopted by the Healthcare industry when considering privacy against Quality Care:
“When it comes to protecting the privacy of patients' computerized information, the main threat the health-care industry faces isn't from hackers, but from itself …”.
This article focuses on the US reality – but some of the points it raises can be of concern also in other countries …
--- NOTE: my original HP blog can be found here ---
“When it comes to protecting the privacy of patients' computerized information, the main threat the health-care industry faces isn't from hackers, but from itself …”.
This article focuses on the US reality – but some of the points it raises can be of concern also in other countries …
--- NOTE: my original HP blog can be found here ---
Wednesday, March 5, 2008
National Security vs. Privacy?
This article provides an overview of a recent survey conducted by Quest Software involving 474 employees of federal, state, local and municipal agencies:
“At least according to a survey conducted in January by Quest Software among 474 employees of federal, state, local and municipal agencies, 53% considered national security more important than personal privacy. Only 33.8% felt that personal privacy concerns were more important than national security. 15% of the federal respondents came from DHS, DOJ and HHS …
The survey indicates that although most government IT professionals (69%) believe that identity management is “very important” to their organization or agency, even more overwhelmingly believe its importance will increase (72%) in the next five years. A large majority of government IT professionals report that their organization or agency has complied with the following steps: secured information systems (76%), secured personnel information (72%), and secured access to facilities (75%).”
This article also reports these interesting comments by Paul Garver, Quest Software vice president:
“I would expect this type of finding if we had a large Defense Department audience, but our audience was mostly civilian agencies. A large part of the government’s position deals with national trust and security. This finding is a result of the focus on national security by so many civilian agencies.”
The final part of the article provides the highlights of the survey …
--- NOTE: my original HP blog can be found here ---
“At least according to a survey conducted in January by Quest Software among 474 employees of federal, state, local and municipal agencies, 53% considered national security more important than personal privacy. Only 33.8% felt that personal privacy concerns were more important than national security. 15% of the federal respondents came from DHS, DOJ and HHS …
The survey indicates that although most government IT professionals (69%) believe that identity management is “very important” to their organization or agency, even more overwhelmingly believe its importance will increase (72%) in the next five years. A large majority of government IT professionals report that their organization or agency has complied with the following steps: secured information systems (76%), secured personnel information (72%), and secured access to facilities (75%).”
This article also reports these interesting comments by Paul Garver, Quest Software vice president:
“I would expect this type of finding if we had a large Defense Department audience, but our audience was mostly civilian agencies. A large part of the government’s position deals with national trust and security. This finding is a result of the focus on national security by so many civilian agencies.”
The final part of the article provides the highlights of the survey …
--- NOTE: my original HP blog can be found here ---
Monday, February 4, 2008
Announcing TrustBus 2008
The Call for Papers of 5th International Conference on Trust, Privacy and Security in Digital Business (TrustBus’08) is now available, online.
This conference aims at providing an international forum for researchers and practitioners to exchange information regarding advancements in the state of the art and practice of trust and privacy in digital business.
The submission deadline is March, 3rd. TrustBus 2008 is interested in papers, work-in-progress reports, and industrial experiences describing advances in all areas of digital business applications related to trust and privacy, including, but not limited to:
- Anonymity and pseudonymity in business transactions
- Common practice, legal and regulatory issues
- Delivery technologies and scheduling protocols
- Economics of Information Systems Security
- Enterprise management and consumer protection
- Intellectual property and digital rights management
- Languages for description of services and contracts
- Models for access control and authentication
- New cryptographic building-blocks for e-business applications
- PKI & PMI
- P2P transactions and scenarios
- Reliability and security of content and data
- Reputation in services provision
- Security and Privacy models for Pervasive Information Systems
- Shopping, trading, and contract management tools
- Transactional Models
- Usability of security technologies and services
- Business architectures and underlying infrastructures
- Cryptographic protocols
- Design of businesses models with security requirements
- Electronic cash, wallets and pay-per-view systems
- Identity and Trust Management
- Intrusion detection and information filtering
- Management of privacy & confidentiality
- Multimedia web services
- Online transaction processing
- Public administration, governmental services
- Real-time Internet E-Services
- Reliable auction, e-procurement and negotiation technology
- Secure process integration and management
- Security Policies
- Smartcard technology
- Trust and privacy issues in mobile commerce environments
--- NOTE: my original HP blog can be found here ---
This conference aims at providing an international forum for researchers and practitioners to exchange information regarding advancements in the state of the art and practice of trust and privacy in digital business.
The submission deadline is March, 3rd. TrustBus 2008 is interested in papers, work-in-progress reports, and industrial experiences describing advances in all areas of digital business applications related to trust and privacy, including, but not limited to:
- Anonymity and pseudonymity in business transactions
- Common practice, legal and regulatory issues
- Delivery technologies and scheduling protocols
- Economics of Information Systems Security
- Enterprise management and consumer protection
- Intellectual property and digital rights management
- Languages for description of services and contracts
- Models for access control and authentication
- New cryptographic building-blocks for e-business applications
- PKI & PMI
- P2P transactions and scenarios
- Reliability and security of content and data
- Reputation in services provision
- Security and Privacy models for Pervasive Information Systems
- Shopping, trading, and contract management tools
- Transactional Models
- Usability of security technologies and services
- Business architectures and underlying infrastructures
- Cryptographic protocols
- Design of businesses models with security requirements
- Electronic cash, wallets and pay-per-view systems
- Identity and Trust Management
- Intrusion detection and information filtering
- Management of privacy & confidentiality
- Multimedia web services
- Online transaction processing
- Public administration, governmental services
- Real-time Internet E-Services
- Reliable auction, e-procurement and negotiation technology
- Secure process integration and management
- Security Policies
- Smartcard technology
- Trust and privacy issues in mobile commerce environments
--- NOTE: my original HP blog can be found here ---
Monday, January 28, 2008
What are the actual ID Card plans in UK?
An interesting article by Telegraph.co.uk highlights some of the “confusion” that exists in current UK plans for ID cards:
“The future of the Government's identity card scheme is in confusion as it emerged that plans for a national fingerprint database may be quietly dropped.
At the same time, it appears that ministers are considering introducing a compulsory ID scheme by stealth, with plans that would require young people to obtain a card before being granted a driving licence.
The proposals were disclosed in two leaked Home Office documents and expose the lack of agreement within the Government over the extent to which ministers should continue with the commitment to ID cards. …”
More details can be found in the Telegraph’s article.
--- NOTE: my original HP blog can be found here ---
“The future of the Government's identity card scheme is in confusion as it emerged that plans for a national fingerprint database may be quietly dropped.
At the same time, it appears that ministers are considering introducing a compulsory ID scheme by stealth, with plans that would require young people to obtain a card before being granted a driving licence.
The proposals were disclosed in two leaked Home Office documents and expose the lack of agreement within the Government over the extent to which ministers should continue with the commitment to ID cards. …”
More details can be found in the Telegraph’s article.
--- NOTE: my original HP blog can be found here ---
Friday, January 25, 2008
Article on Identity Governance Framework (IGF) published by SOX Compliance Journal
As already announced in Phil Hunt’s blog, an article has recently been published by the SOX Compliance Journal about how Identity Governance Framework can help to address Privacy and SOX Compliance aspects.
This article is called “Identity Governance Framework: Liberty Alliance’s Initiative Addressing Privacy and SOX” and its authors are: Phil Hunt (Oracle) and Marco Casassa Mont (HP Labs).
As pointed out by Phil, “this article is a good introduction to the problems of privacy and compliance as it relates to personal information and how IGF is intended to make the compliance of applications and the businesses that deploy them much easier to achieve.”
More information about the Liberty Alliance’s Identity Governance Framework initiative can be found here.
--- NOTE: my original HP blog can be found here ---
This article is called “Identity Governance Framework: Liberty Alliance’s Initiative Addressing Privacy and SOX” and its authors are: Phil Hunt (Oracle) and Marco Casassa Mont (HP Labs).
As pointed out by Phil, “this article is a good introduction to the problems of privacy and compliance as it relates to personal information and how IGF is intended to make the compliance of applications and the businesses that deploy them much easier to achieve.”
More information about the Liberty Alliance’s Identity Governance Framework initiative can be found here.
--- NOTE: my original HP blog can be found here ---
Subscribe to:
Posts (Atom)