On Big Data for Security and Analytics Technologies

I found an interesting report, by Enterprise Strategy Group, called “The Evolution of Big Data Security Analytics Technology” providing an overview of the market landscape.  In my view, two key areas are open to research and innovation:

 

·         Real-time big data security analytics

·         Asymmetric big data security analytics

From a security perspective, whilst an increasing number of new tools, solutions and frameworks are emerging in these areas, there are a few key challenges that need to be addressed.  They relate to the quality and effectiveness of big data analytics: how to make sense of big (security) data and provide meaningful insights in order to identify new threats and security issues; how to capture this knowledge into repeatable and simplified capabilities that can be used by a wide range of stakeholders.

 

These are going to be key R&D aspects to be addressed in the future, in addition to the well-known big data issues i.e. dealing with velocity, volume and variety of data.

 

In particular HP and HP Labs are in a unique position to make progress here, also thanks to opportunity to leverage key HP assets in the space of security and big data management i.e. HP ArcSight, HP Vertica and HP Autonomy.  

 

 

 

--- Posted by Marco Casassa Mont (here and here)  ---

--- NOTE:  use this mirror blog if you prefer posting on an external blog site  ---

--- NOTE:  my original HP blog can be found here  ---

 

 

My Tweets of the Week (22-26 July 2013)

My tweets of the week (22-26 July 2013) at https://twitter.com/MCasassaMont:

 

·         The open source job market is booming - http://www.infoworld.com/t/information-technology-careers/the-open-source-job-market-booming-223463 … #in

·         Three different roads to the 3-nanometer chip - http://www.theregister.co.uk/2013/07/25/proposed_semiconductor_transistor_possibilities/ … #in

·         With big data comes big responsibility - http://www.ft.com/cms/s/0/1c3e27ee-8b2f-11e2-8fcf-00144feabdc0.html#axzz2a58CgPqZ … #in

·         “Big Data” Is Not “Big Data” Unless It Gives You Actionable Insight - http://searchengineland.com/big-data-is-not-big-data-unless-it-gives-you-actionable-insight-167225 … #in

·         Loose lips trouble CISOs - http://www.scmagazineuk.com/loose-lips-trouble-cisos/article/304467/ … #in

·         Researchers spot new breed of infected Android apps in the wild - http://www.infoworld.com/t/android/researchers-spot-new-breed-of-infected-android-apps-in-the-wild-223400 … #in

·         Graph analysis will make big data even bigger - http://www.infoworld.com/d/big-data/graph-analysis-will-make-big-data-even-bigger-223420 … #in

·         CFOs Ignore Big Data at Their Peril - http://online.wsj.com/article/SB10001424127887323419604578571684135006800.html … #in

·         Competing businesses encouraged to share incident data as the attackers do - http://www.scmagazineuk.com/competing-businesses-encouraged-to-share-incident-data-as-the-attackers-do/article/304122/ … #in

·         FTSE 350 companies demonstrate very poor security manners - http://www.scmagazineuk.com/ftse-350-companies-demonstrate-very-poor-security-manners/article/304195/ … #in

·         Stop 80 percent of malicious attacks now - http://www.infoworld.com/d/security/stop-80-percent-of-malicious-attacks-now-223213 … #in

·         SDN 101: Software-defined networking explained in 10 easy steps - http://www.infoworld.com/slideshow/111753/sdn-101-software-defined-networking-explained-in-10-easy-steps-223225 … #in

·         Big Data Security Analytics: It Takes a Village - http://www.networkworld.com/community/node/83299 … #in

·         Software employment rises 45% in 10 years, as angst in engineering grows - http://www.computerworld.com/s/article/9240854/Software_employment_rises_45_in_10_years_as_angst_in_engineering_grows … #in

·         Happy birthday, OpenStack! Now change - http://www.networkworld.com/news/2013/072213-openstack-272063.html?hpg1=bn … #in

·         True tales of (mostly) white-hat hacking - http://www.infoworld.com/d/security/true-tales-of-mostly-white-hat-hacking-222831 … #in

·         Five Roles You Need on Your Big Data Team - http://blogs.hbr.org/cs/2013/07/five_roles_you_need_on_your_bi.html … #in

·         SIM card DES flaw could affect up to 500 million users - http://www.scmagazineuk.com/  #in

·         Are we in an enterprise startup bubble? - http://www.infoworld.com/t/startups/are-we-in-enterprise-startup-bubble-223138 … #in

 

--- Posted by Marco Casassa Mont (here and here)  ---

--- NOTE:  use this mirror blog if you prefer posting on an external blog site  ---

--- NOTE:  my original HP blog can be found here  ---

 

On Big Data for Security

I am currently focusing my R&D work in the space of “Big Data for Security”.

This is a fascinating area and, currently, a green field.

 

How to effectively leverage huge amount of collected IT information (ranging from IT logs to application and service information as well as external intelligence)  to identify new security threats, issues and provide valuable information to organisations to mitigate current and foreseeable risks?

 

HP already has core assets in the security and “Big Data” space: HP ArcSight suite (SIEM solution for event logging, storage and correlation); HP Vertica (highly parallelised, columnar database solution for storage and analytics of structured big data) and HP Autonomy (storage, indexing and retrieval of massive amount of unstructured data).

 

I am currently exploring how these capabilities could be fully leveraged in the context of big data for security, in particular in a few security verticals and types of critical security data. In addition, I am interested in exploring how the massive amount of required computation and analytics can be performed by adopting innovative solutions in the cloud (private and hybrid cloud).

 

I am looking for public use cases, case studies and requirements in this space, in particular for analytics based on big security data and anecdotes on how “big data” has been helping to address security issues.

 

 

--- Posted by Marco Casassa Mont (here and here)  ---

--- NOTE:  use this mirror blog if you prefer posting on an external blog site  ---

--- NOTE:  my original HP blog can be found here  ---

 

HP Introduces Intelligent Security Solutions to Drive Innovation and Reduce Risk

HP announced additions to its security solutions portfolio that enable enterprises to assess, transform, optimize and manage their security environments to proactively protect what matters. Details are available online, here.


“Cloud, mobility and big data initiatives are helping organizations solve pressing challenges, while driving accelerated innovation, enhanced agility and improved financial management. However, these initiatives also can introduce big security concerns.

According to new research conducted on behalf of HP, concerns around understanding security requirements for cloud services as well as how to secure and consume big data are top of mind for nearly two-thirds of business and technology executives. Half of those surveyed are concerned about mobile data loss or theft. In addition, more than half of respondents admitted that their organizations spend more time and money on reactive measures than on proactive risk management.(1)

A reactive, perimeter-based approach to security is no longer sufficient. Enterprises need proactive, intelligent security solutions that span traditional and hybrid delivery models, and address the challenges brought on by these new shifts in IT.

“Cybersecurity threats are growing exponentially, and without a proactive information risk management strategy, enterprise growth, innovation and efficiencies are hindered,” said George Kadifa, executive vice president, Software, HP.

“HP helps clients protect what matters most to their organizations by delivering intelligent security solutions that prioritize security resources to help identify threats earlier and enable a faster response time,” said Mike Nefkens, acting executive vice president, Enterprise Services, HP.”



--- Posted by Marco Casassa Mont (here and here) ---

--- NOTE: use this mirror blog if you prefer posting on an external blog site ---

--- NOTE: my original HP blog can be found here ---

Focusing on the Cloud and the Intersection of Cloud with Security

An area I am interested in spending more R&D time is the Cloud and the intersection of the Cloud with Security.

In particular I am interested exploring and contributing in the space of “Cloud middleware”. Some initial questions:

Which “middleware” services can be provided in the cloud to support various Cloud applications and services?
Which identity maangemet, security and privacy capabilities need to be in place?
How ensure accountability and assurance?
How to exploit recent Identity and Security Analytics capabilities, developed by HP Labs, in that space

I am currently gathering various information and documents in this space, related to business opportunities, current solution offering and technological approaches.

Any input and links to publicly available information are really welcome.

--- Posted by Marco Casassa Mont (here and here) ---

--- NOTE: use this mirror blog if you prefer posting on an external blog site ---

--- NOTE: my original HP blog can be found here ---

Article: What CIOs need, how CISOs should deliver

An interesting article has been published by “ComputerWorlds UK” called “What CIOs need, how CISOs should deliver” and posted by Dan Turner, CTO, Vistorm (HP Company).

Our work at HP Labs on Security Analytics has been mentioned:

“My colleagues at HP Labs are looking to go further with their research into ‘Security Analytics’. Through the use of economic and mathematical techniques combined with predictive modelling, the research claims that it’s possible to measure the effectiveness of an organisation’s security controls and therefore guide better investment by understanding the trade-offs. Needless to say, it makes for interesting reading and this will certainly be an area to watch.”

--- Posted by Marco Casassa Mont (here and here) ---

--- NOTE: use this mirror blog if you prefer posting on an external blog site ---

--- NOTE: my original HP blog can be found here ---

Update - Keynote Speaker at IEEE i-Society 2010

As mentioned in a previous blog post of mine, I have been invited to be a Keynote speakers at IEEE i-Society 2010, the International Conference on Information Society.

Thanks to those people that sent me their input and suggestions. I kept into account the input and feedback in the speech abstract that I sent to the organisers:

“We are living in interesting times. New trends affect the information society (organisations and people), such as: increased availability of services in the cloud; the adoption of web 2.0 and social networking for personal and business purposes; pervasive mobile computing; the consumerization of the enterprise.

Along with many new opportunities for people and organisations, we are also assisting to the raise of new security and privacy threats and an increased role played by the organised cybercrime.

People and organisations are going to be more and more impacted by these trends and threats. Organisations need to better understand the dynamic threat environment they are fighting against and where to effectively make their security investments. More assurance and trust is required on the Internet.

This keynote discusses these trends, briefly analyses emerging threats and provides an overview of the organised cybercrime ecosystem. It highlights a few needs and research opportunities in key areas, including: automation of security lifecycle management, economics of security, security analytics, trusted virtualisation, identity assurance and privacy management. Related work done by HP Labs in this space - in collaboration with the UK research community - is presented and discussed.”


--- Posted by Marco Casassa Mont (here and here) ---

--- NOTE: use this mirror blog if you prefer posting on an external blog site ---

--- NOTE: my original HP blog can be found here ---

New MS Research paper: "So Long, And No Thanks for the Externalities: The Rational Rejection of Security Advice by Users"

An interesting paper, "So Long, And No Thanks for the Externalities: The Rational Rejection of Security Advice by Users", has been recently published by Cormac Herley (MS Research) exploring the reasons why often users reject security advices:

"It is often suggested that users are hopelessly lazy and unmotivated on security questions. They chose weak passwords, ignore security warnings, and are oblivious to certificates errors. We argue that users' rejection of the security advice they receive is entirely rational from an economic perspective. The advice offers to shield them from the direct costs of attacks, but burdens them with far greater indirect costs in the form of effort.
Looking at various examples of security advice we Find that the advice is complex and growing, but the benefit is largely speculative or moot. For example, much of the advice concerning passwords is outdated and does little to address actual treats, and fully 100% of certificate error warnings appear to be false positives. Further, if users spent even a minute a day reading URLs to avoid phishing, the cost (in terms of user time) would be two orders of magnitude greater than all phishing losses.
Thus we find that most security advice simply offers a poor cost-benefit tradeoff to users and is rejected. Security advice is a daily burden, applied to the whole population, while an upper bound on the benefit is the harm suffered by the fraction that become victims annually. When that fraction is small, designing security advice that is beneficial is very hard. For example, it makes little sense to burden all users with a daily task to spare 0.01% of them a modest annual pain."

--- Posted by Marco Casassa Mont (here and here) ---

--- NOTE: my original HP blog can be found here ---

Research on Security and Identity Management

The time has come to update the topic (and focus) of this blog.

In the last few years my R&D work and research at HP Labs has been involving a variety of aspects, including security, identity management and privacy.

Most of my posts have actually been reflecting this – hence my decision to update my blog. Hope this will further increase the community of people that are interested and follow my blog.

--- Posted by Marco Casassa Mont (here and here) ---

--- NOTE: my original HP blog can be found here ---

Firefox and 50 add-ons for Private and Secure Web Surfing

A recent article by Laura Milligan, called “50 Firefox add-ons to achieve private and secure web surfing” provides a comprehensive list of add-ons for Firefox to achieve degreees of security and privacy whilst surfing the web:

“Firefox is generally considered a secure web browser, but if you’re interested in keeping your activity on certain websites private or giving yourself extra protection against phishing, hackers and viruses, you may want to consider beefing up your Firefox’s security in general. Thankfully, there are lots of options available that make achieving privacy and security online as easy as downloading a simple add-on or application that was designed just for Firefox users.”

This article classifies these 50 add-ons (and provides links for each of them) in the following categories: Secrecy and Encryption; add-ons that beef-up security; cookies; testing your system; passwords; protect your privacy online.

Have you had any direct experience using these add-ons? Are they up to their promises?

--- NOTE: my original HP blog can be found here ---

DoD and Funding Research into Information Sharing

As reported by this article, the US Defence Department (DoD) is going to fund research on information sharing:

"The Defense Department has awarded $7.5 million to six universities for a five-year research program to help solve the problem of sharing sensitive information while ensuring privacy and security.

The failure of intelligence and law enforcement organizations to share information was one of the problems that contributed to the terrorist attacks of Sept. 11, 2001, according to the commission that studied the attacks. But connecting the dots has proved to be a knotty problem for organizations built on secrecy and control. …”

--- NOTE: my original HP blog can be found here ---

Announcing TrustBus 2008

The Call for Papers of 5th International Conference on Trust, Privacy and Security in Digital Business (TrustBus’08) is now available, online.

This conference aims at providing an international forum for researchers and practitioners to exchange information regarding advancements in the state of the art and practice of trust and privacy in digital business.

The submission deadline is March, 3rd. TrustBus 2008 is interested in papers, work-in-progress reports, and industrial experiences describing advances in all areas of digital business applications related to trust and privacy, including, but not limited to:

- Anonymity and pseudonymity in business transactions
- Common practice, legal and regulatory issues
- Delivery technologies and scheduling protocols
- Economics of Information Systems Security
- Enterprise management and consumer protection
- Intellectual property and digital rights management
- Languages for description of services and contracts
- Models for access control and authentication
- New cryptographic building-blocks for e-business applications
- PKI & PMI
- P2P transactions and scenarios
- Reliability and security of content and data
- Reputation in services provision
- Security and Privacy models for Pervasive Information Systems
- Shopping, trading, and contract management tools
- Transactional Models
- Usability of security technologies and services
- Business architectures and underlying infrastructures
- Cryptographic protocols
- Design of businesses models with security requirements
- Electronic cash, wallets and pay-per-view systems
- Identity and Trust Management
- Intrusion detection and information filtering
- Management of privacy & confidentiality
- Multimedia web services
- Online transaction processing
- Public administration, governmental services
- Real-time Internet E-Services
- Reliable auction, e-procurement and negotiation technology
- Secure process integration and management
- Security Policies
- Smartcard technology
- Trust and privacy issues in mobile commerce environments

--- NOTE: my original HP blog can be found here ---

Is the Increase in Security Failures and Privacy Breaches Often Due to Wrongsourcing?

This is the point made by Claudiu Popa, Informatica’s president, as reported by this article:

“Toronto-based Informatica Security Research estimates that the vast majority of issues involving the security and privacy of data, identity theft breaches, compliance failures and other information risk issues are due to poor strategic planning and IT governance.

Informatica’s president, Claudiu Popa is a recognized information risk consultant who sees the issue as a management problem: “we have seen a general trend in North America where we often talk to companies that opt to force their internal IT departments to also manage security. Many organizations fail to realize that security management is not a core competency that neatly fits within IT governance activities. In fact, as companies scramble to achieve compliance with numerous standards and legislation, they often mismanage their operations and impact productivity. It makes no sense to in-source activities that are complex, expensive and often mismanaged instead of hiring qualified experts to get the job done. The flip side of what I call ‘wrong-sourcing’ is that organizations too often choose to outsource their core capabilities. This is backwards and executives should revisit their business objectives."”

--- NOTE: my original HP blog can be found here ---

HP’s Security Handbook

The HP’s Security Handbook is available online (2006 edition):

“The HP Security handbook provides a view into all the different threads of security that HP works in. Much of the content is focused on the three pillars of our security strategy: Identity Management, Proactive Security Management and Trusted Infrastructures. The handbook also describes how Governance issues fit into our security strategy and provides an insight into the security research work done by HP Labs.”

In particular, the Identity Management community might be interested in having a look at the section on Identity Management.

--- NOTE: my original HP blog can be found here ---

New ENISA Position Paper: Security Issues and Recommendations for Online Social Networks

ENISA has recently released a position paper, called “Security Issues and Recommendations for Online Social Networks” (available online, here) – Editor: Giles Hogben (ENISA):

“This paper aims to provide a useful introduction to security issues in the area of Social Networking, highlight the most important threats and make recommendations for action and best practices to reduce the security risks to users.”

Specifically, it focuses on the following threats and recommendations:

• Principal Threats: privacy related threats, information security threats, identity related threats and social threats);
• Recommendations and Countermeasures: government policy recommendations, provider and corporate policy recommendations, technical recommendations, research and standardisation recommendations.
  
  “This paper is aimed at corporate and political decision-makers as well as Social Network application-providers. It also seeks to raise awareness among political and corporate decision-makers of the legal and social implications of new developments in Social Networking technologies. In particular, the findings should have important implications for education and data protection policy.”

--- NOTE: my original HP blog can be found here ---

Call for Papers: IEEE Workshop Policy 2008 (2-4 June 2008, NY)

The call for papers for Policy 2008 is now available online:

“POLICY 2008 is the 9th in a series of successful workshops, which since 1999 have provided a forum for discussion and collaboration between researchers, developers, and users of policy-based systems. This year, in addition to the latest research results from the communities working in any area of policy-based management and computing, we encourage contributions on policy-based techniques in support of all types of wireless networks: cellular, Wi-Fi, Mobile Ad Hoc, hybrids, etc.
Policy 2008 aims to bring together researchers and practitioners working on policy-based systems across a wide range of application areas including networking, privacy and security management, storage area networking, enterprise systems, and the Web.”

Topics of interest are classified in the following categories:

• Policy models and Languages
• Policy Applications
• Policies in Wireless Networks

Identity management, privacy and security are key topics of this workshop. Please consider submitting a paper.

More information about call for papers, Organising Committee and Program Committee is available online.

--- NOTE: my original HP blog can be found here ---

The Open Group: Whitepaper on “Information Security Strategy” - Version 1.0

The Open Group has announced that their Information Security Strategy white paper is now published on The Open Group's online bookstore (a free PDF version is available on the Web). It is about a “Framework for Information-Centric Security Governance”:

“This White Paper proposes a new framework for ensuring enterprise-level information security that reflects current realities of enterprise, network, and information sharing and access. … It was developed by the Security Forum in collaboration with the Cyberspace Law Committee, Business Law Section, of the American Bar Association, who are also publishing it.”

This document is a high-level, strategic-oriented white paper but it should be of interest to the Identity Management community. After all, identity is a “special kind” of information …

--- NOTE: my original HP blog can be found here ---

Call for Papers: 23rd International Information Security Conference – SEC 2008

The Call for Papers for SEC 2008 (Milan, Italy – September, 8-10, 2008), is now available online:

“The conference seeks submissions from academia, industry, and government presenting novel research on all theoretical and practical aspects of computer security, as well as case studies and implementation experiences. Papers should have practical relevance to the construction, evaluation, application, or operation of secure systems. Theoretical papers must make convincing argument for the practical significance of the results.”

In particular, topics of relevance include topics in the “Identity Management” area:

• Access control
• Electronic frauds
• Anonymity
• Accounting and Audit
• Smartcards
• Data and application security
• Risk analysis and risk management
• Data protection
• Privacy-enhancing technology
• Trust management
• Trust models

Paper submissions are due by January 10, 2008. More details about Important Dates and Committees are also available online.

--- NOTE: my original HP blog can be found here ---

Announcing PLING: the W3C Policy Languages Interest Group

I am proud to announce the creation of the W3C Policy Languages Interest Group (PLING). Roberto Iannella (Research Scientist, NICTA, Australia) and I (Marco Casassa Mont, Senior Researcher, HP Labs, UK) are going to be the co-Chairs. Thomas Roessler and Rigo Wenning (W3C) are the initial Team Contacts:

“The Policy Languages Interest Group, part of the Privacy Activity, is a forum for W3C Members and non-Members to discuss interoperability questions that arise when different policy languages are used in integrated use cases, along with related requirements and needs”.

I would like to encourage people that have interests in the area of policy languages, interoperability, privacy, etc. to engage and share their experience, requirements, use cases and open issues. A PLING Mailing list is available.

The PLING Charter provides information about PLING mission, scope, deliverables, participation, communication and obligations. The proceedings of this Interest Group (mailing list archives, minutes, etc.) are going to be publicly visible.

The mission of this interest group is the following:

“The Policy Languages Interest Group is a forum for W3C Members and the public to discuss interoperability issues - along with related requirements and needs - that arise when using a variety of policy languages where there is a need to compute results across these multiple languages. The Interest Group follows up on the October 2006 W3C Privacy Workshop, and addresses areas of work identified as a key common interest of participants. An important function of the Interest Group is information sharing within and between application communities. …”

The scope of PLING is:

“The Policy Languages Interest Group is designed as a forum to support researchers, developers, solution providers, and users of policy languages such as XACML (eXtensible Access Control Markup Language), the IETF's Common Policy framework and related work, and P3P (W3C's Platform for Privacy Preferences Project). It provides a forum to enable broader collaboration, through use of email discussion, scheduled IRC topic chats, Wikis, and Weblog tools.

The group will primarily focus on policy languages that are already specified and broadly address the privacy, access control, and obligation management areas; it is not expected to engage in the design of new policy or rule languages. The Interest Group will work towards identifying obstacles to a joint deployment of such languages, and suggest requirements and technological enablers that may help overcome such obstacles.”

More information will follow.

--- NOTE: my original HP blog can be found here ---

Lots of Warnings about “Enterprise Web 2.0” Risks – What about Identity 2.0?

A recent article by Robert Mullins, called “Enterprises warned to approach Web 2.0 with caution”, says:

“Danny Allan of IBM had just finished his primer on potential security risks of Web 2.0 applications when enterprise software developers filing out were overheard telling each other, “That was scary!” and “Now I’m depressed.” Allan says he didn’t mean to scare, but to educate. “The lesson is not to run away but to prepare,” said Allan, director of security research at Watchfire, an IBM-owned security firm”

This is also consistent with what HP SPIDynamics said sometimes ago, in particular about security risks and issues with Enterprise Web 2.0 (see here and here).

In a previous post of mine, called “Web 2.0/Ajax “Submission Throttling” and Privacy Concerns” I also highlighted a (simple) example of a potential Web 2.0 privacy threat (ok, this was primarily from a B2C perspective, but this could also apply to enterprise and federated IdM contexts …). I am sure this is just the tip of the iceberg …

I would be interested in knowing what the outcome of a similar risk/security/threat analysis/assessment would *specifically* be for “Identity 2.0”-based solutions (including Liberty Alliance, of course …) – in B2C, Enterprise and federated IdM contexts.

I believe there will be interesting findings, from a privacy and data security perspective, in particular when dealing with personal and confidential information.

--- NOTE: my original HP blog can be found here ---