I have been invited to give a presentation at the coming Conference at the Centre for Cybercrime and Computer Security, 15 March 2011, Newcastle.
I will be giving a presentation on “Risk Exposure to Social Networks in Enterprises”.
This is a great opportunity to network with experts in this area and to share thoughts about related HP Labs R&D activities that we have been carrying out in Bristol, UK.
Please consider attending.
--- Posted by Marco Casassa Mont (here and here) ---
--- NOTE: use this mirror blog if you prefer posting on an external blog site ---
--- NOTE: my original HP blog can be found here ---
Wednesday, March 9, 2011
Security and Identity Analytics
I have got a paper accepted at the coming IEEE Policy 2011 Symposium.
This paper is based on a recent HPL Technical Report I published, on “Risk Assessment and Decision Support for Security Policies and Related Enterprise Operational Processes”.
Looking forward at presenting this work.
Interestingly, this paper describes work that we did jointly with a major HP customer, in the space of Security Analytics and Identity Access Management.
This work de-risked Security Analytics in this area: it is now one of the Security Analytics capabilities offered as a service by HP Information Security.
--- Posted by Marco Casassa Mont (here and here) ---
--- NOTE: use this mirror blog if you prefer posting on an external blog site ---
--- NOTE: my original HP blog can be found here ---
This paper is based on a recent HPL Technical Report I published, on “Risk Assessment and Decision Support for Security Policies and Related Enterprise Operational Processes”.
Looking forward at presenting this work.
Interestingly, this paper describes work that we did jointly with a major HP customer, in the space of Security Analytics and Identity Access Management.
This work de-risked Security Analytics in this area: it is now one of the Security Analytics capabilities offered as a service by HP Information Security.
--- Posted by Marco Casassa Mont (here and here) ---
--- NOTE: use this mirror blog if you prefer posting on an external blog site ---
--- NOTE: my original HP blog can be found here ---
UK Cyber Security Challenge 2011
I have been involved (as part of the HP Labs team) in the recent final of the UK Cyber Security Challenge 2011.
It has been a very interesting experience observing and engaging with the various participants. Very good fun.
I would really encourage the readers to engage in the coming editions.
--- Posted by Marco Casassa Mont (here and here) ---
--- NOTE: use this mirror blog if you prefer posting on an external blog site ---
--- NOTE: my original HP blog can be found here ---
It has been a very interesting experience observing and engaging with the various participants. Very good fun.
I would really encourage the readers to engage in the coming editions.
--- Posted by Marco Casassa Mont (here and here) ---
--- NOTE: use this mirror blog if you prefer posting on an external blog site ---
--- NOTE: my original HP blog can be found here ---
On the value of being part of Conference Program Committees
In the last years I have been invited to be part of many Program Committees of conferences and workshops. Just in the last month I had to deal with paper reviews for MobiSec 2011 and SECRYPT 2011.
Some statistics: based on my experience, I would say that only 25-30% of the papers that I review are usually worth their publication, because of the innovation and new insights they provide.
Nevertheless, I believe this is a great opportunity to stay in touch and up-to-date with key R&D topics. In my case, in the space of security, privacy, IAM and risk management.
--- Posted by Marco Casassa Mont (here and here) ---
--- NOTE: use this mirror blog if you prefer posting on an external blog site ---
--- NOTE: my original HP blog can be found here ---
Some statistics: based on my experience, I would say that only 25-30% of the papers that I review are usually worth their publication, because of the innovation and new insights they provide.
Nevertheless, I believe this is a great opportunity to stay in touch and up-to-date with key R&D topics. In my case, in the space of security, privacy, IAM and risk management.
--- Posted by Marco Casassa Mont (here and here) ---
--- NOTE: use this mirror blog if you prefer posting on an external blog site ---
--- NOTE: my original HP blog can be found here ---
Making good progress in the UK EnCoRe Project
The UK collaborative EnCoRe project is making good progress towards achieving a key set of objectives.
I have been deeply involved in finalising the new version of the EnCoRe Architecture that will support the coming case studies and (hopefully) a pilot with a major UK company. It will be soon publicly released.
We are currently working on an “EnCoRe System Framework” that will enable grounding this architecture at the system, compliance and regulatory levels – to enable the above mentioned case studies and pilot.
--- Posted by Marco Casassa Mont (here and here) ---
--- NOTE: use this mirror blog if you prefer posting on an external blog site ---
--- NOTE: my original HP blog can be found here ---
I have been deeply involved in finalising the new version of the EnCoRe Architecture that will support the coming case studies and (hopefully) a pilot with a major UK company. It will be soon publicly released.
We are currently working on an “EnCoRe System Framework” that will enable grounding this architecture at the system, compliance and regulatory levels – to enable the above mentioned case studies and pilot.
--- Posted by Marco Casassa Mont (here and here) ---
--- NOTE: use this mirror blog if you prefer posting on an external blog site ---
--- NOTE: my original HP blog can be found here ---
Thursday, February 3, 2011
New HP Labs Report: Risk Assessment and Decision Support for Security Policies and Related Enterprise Operational Processes
We recently published a new HPL Technical Report illustrating the practical usage of Security Analytics in a case study involving one of our major customers:
“Marco Casassa Mont, Richard Brown - Risk Assessment and Decision Support for Security Policies and Related Enterprise Operational Processes”
The paper abstract follows:
“This paper presents and discusses our work to provide organizations with risk assessment and decision support capabilities when dealing with their strategic security policies. Traditional work in the policy management space primarily focuses on technical languages and frameworks to manage and enforce operational policies. These contributions are important but they do not address strategic decision makers’ needs and questions such as: What business and security risks is my organization exposed to, due to the current security policies and related operational processes? How effectively are these policies enforced at the operational level? What is the impact of changing them? We aim at providing strategic decision support in this space by using a rigorous and scientific methodology (and tools) which leverages modeling and simulation techniques. This methodology helps organizations to assess their risk exposure. It factors in policy implementation at the operational level along with relevant threats, processes, interactions and people behaviors. It provides “what-if” analysis by illustrating the consequences of making policy changes and investments. We briefly introduce our methodology and tools and then ground the discussion by illustrating how this approach has been successfully used in a real case study with one of our major customers. This case study focused on the organization’s access management processes and related policies: it helped to inform strategic security policies and support changes of current access management processes. Additional work is planned in this space to further validate our approach and build template solutions for different types of organizational policies and processes.”
--- Posted by Marco Casassa Mont (here and here) ---
--- NOTE: use this mirror blog if you prefer posting on an external blog site ---
--- NOTE: my original HP blog can be found here ---
“Marco Casassa Mont, Richard Brown - Risk Assessment and Decision Support for Security Policies and Related Enterprise Operational Processes”
The paper abstract follows:
“This paper presents and discusses our work to provide organizations with risk assessment and decision support capabilities when dealing with their strategic security policies. Traditional work in the policy management space primarily focuses on technical languages and frameworks to manage and enforce operational policies. These contributions are important but they do not address strategic decision makers’ needs and questions such as: What business and security risks is my organization exposed to, due to the current security policies and related operational processes? How effectively are these policies enforced at the operational level? What is the impact of changing them? We aim at providing strategic decision support in this space by using a rigorous and scientific methodology (and tools) which leverages modeling and simulation techniques. This methodology helps organizations to assess their risk exposure. It factors in policy implementation at the operational level along with relevant threats, processes, interactions and people behaviors. It provides “what-if” analysis by illustrating the consequences of making policy changes and investments. We briefly introduce our methodology and tools and then ground the discussion by illustrating how this approach has been successfully used in a real case study with one of our major customers. This case study focused on the organization’s access management processes and related policies: it helped to inform strategic security policies and support changes of current access management processes. Additional work is planned in this space to further validate our approach and build template solutions for different types of organizational policies and processes.”
--- Posted by Marco Casassa Mont (here and here) ---
--- NOTE: use this mirror blog if you prefer posting on an external blog site ---
--- NOTE: my original HP blog can be found here ---
New IEEE Computer Article - Using Modelling and Simulation to Evaluate Enterprises’ Risk Exposure to Social Networks
In collaboration with Penn State University, we recently published an IEEE Computer article (Research Feature) illustrating how Security Analytics can help to evaluate risks in the context of Social Networking:
“Anna Squicciarini, Sathya Dev Rajasekaran, Marco Casassa Mont – Using Modelling and Simulation to Evaluate Enterprises’ Risk Exposure to Social Networks”
The abstract follows:
“An analytic methodology involving modeling and simulation could help decision makers determine how their employees' use of social networks impacts their organization, identify how to mitigate potential risks, and evaluate the financial and organizational implications of doing so.”
--- Posted by Marco Casassa Mont (here and here) ---
--- NOTE: use this mirror blog if you prefer posting on an external blog site ---
--- NOTE: my original HP blog can be found here ---
“Anna Squicciarini, Sathya Dev Rajasekaran, Marco Casassa Mont – Using Modelling and Simulation to Evaluate Enterprises’ Risk Exposure to Social Networks”
The abstract follows:
“An analytic methodology involving modeling and simulation could help decision makers determine how their employees' use of social networks impacts their organization, identify how to mitigate potential risks, and evaluate the financial and organizational implications of doing so.”
--- Posted by Marco Casassa Mont (here and here) ---
--- NOTE: use this mirror blog if you prefer posting on an external blog site ---
--- NOTE: my original HP blog can be found here ---
UK Cyber Security Challenge
The UK Cyber Security Challenge has been recently announced:
“The Cyber Security Challenge is a series of national online games and competitions that will test the cyber security abilities of individuals and teams from every walk of life. It is designed to excite and inspire anyone considering a career in the cyber security industry.”
Please consider getting involved. Read here why you should to.
--- Posted by Marco Casassa Mont (here and here) ---
--- NOTE: use this mirror blog if you prefer posting on an external blog site ---
--- NOTE: my original HP blog can be found here ---
“The Cyber Security Challenge is a series of national online games and competitions that will test the cyber security abilities of individuals and teams from every walk of life. It is designed to excite and inspire anyone considering a career in the cyber security industry.”
Please consider getting involved. Read here why you should to.
--- Posted by Marco Casassa Mont (here and here) ---
--- NOTE: use this mirror blog if you prefer posting on an external blog site ---
--- NOTE: my original HP blog can be found here ---
Submissions to 8th International Conference TrustBus 2011
Please consider submitting a paper to the 8th International Conference on Trust, Privacy and Security in Digital Business - TrustBus 2011
The submission deadline is 27 February 2011. The Call for Papers is available online:
“The advances in the Information and Communication Technologies (ICT) have raised new opportunities for the implementation of novel applications and the provision of high quality services over global networks. The aim is to utilise this ‘information society era’ for improving the quality of life for all citizens, disseminating knowledge, strengthening social cohesion, generating earnings and finally ensuring that organisations and public bodies remain competitive in the global electronic marketplace. Unfortunately, such a rapid technological evolution cannot be problem free. Concerns are raised regarding the "lack of trust" in electronic procedures and the extent to which "information security" and "user privacy" can be ensured. In answer to these concerns, the 8th International Conference on Trust, Privacy and Security in Digital Business (TrustBus '11) will provide an international forum for researchers and practitioners to exchange information regarding advancements in the state of the art and practice of trust and privacy in digital business. TrustBus '11 will bring together researchers from different disciplines, developers, and users all interested in the critical success factors of digital business systems.”
--- Posted by Marco Casassa Mont (here and here) ---
--- NOTE: use this mirror blog if you prefer posting on an external blog site ---
--- NOTE: my original HP blog can be found here ---
The submission deadline is 27 February 2011. The Call for Papers is available online:
“The advances in the Information and Communication Technologies (ICT) have raised new opportunities for the implementation of novel applications and the provision of high quality services over global networks. The aim is to utilise this ‘information society era’ for improving the quality of life for all citizens, disseminating knowledge, strengthening social cohesion, generating earnings and finally ensuring that organisations and public bodies remain competitive in the global electronic marketplace. Unfortunately, such a rapid technological evolution cannot be problem free. Concerns are raised regarding the "lack of trust" in electronic procedures and the extent to which "information security" and "user privacy" can be ensured. In answer to these concerns, the 8th International Conference on Trust, Privacy and Security in Digital Business (TrustBus '11) will provide an international forum for researchers and practitioners to exchange information regarding advancements in the state of the art and practice of trust and privacy in digital business. TrustBus '11 will bring together researchers from different disciplines, developers, and users all interested in the critical success factors of digital business systems.”
--- Posted by Marco Casassa Mont (here and here) ---
--- NOTE: use this mirror blog if you prefer posting on an external blog site ---
--- NOTE: my original HP blog can be found here ---
Thursday, December 16, 2010
On the Benefits of Combining Security Analytics with SIEM Solutions
In previous posts of mine I discussed the importance of Security Information and Event Management (SIEM) solutions in providing organisations with compliance and assurance capabilities, hence improving organisation’s situational awareness.
I often referred to these solutions as based on a bottom-up approach, i.e. starting from the collection of data, correlations and subsequent deductions of alarms, trends and analysis of organisation’s risk exposure.
In other posts I compared and contrasted this approach against the top-down approach provided by Security analytics (in particular in the IAM space – “HP Labs Identity Analytics – What is this all about?”), where models and simulations are used to provide strategic decision support. These models need to be grounded by using empirical data.
I actually believe that these two approaches can be combined to get greater benefits:
I often referred to these solutions as based on a bottom-up approach, i.e. starting from the collection of data, correlations and subsequent deductions of alarms, trends and analysis of organisation’s risk exposure.
In other posts I compared and contrasted this approach against the top-down approach provided by Security analytics (in particular in the IAM space – “HP Labs Identity Analytics – What is this all about?”), where models and simulations are used to provide strategic decision support. These models need to be grounded by using empirical data.
I actually believe that these two approaches can be combined to get greater benefits:
- A key part of Security Analytics activities, is to identify the most relevant parameters, measures and metrics relevant to assess risks, provide suitable decision support and what-if analysis. Now, this information can be used to drive the configuration of SIEM solutions, by recommending which measures and metrics to focus on and their impact in enabling risk assessment and deductions;
- SIEM solutions can collect, aggregate and process large amounts of data. This capability can be used to provide up-to-date empirical data to fuel Security Analytics models;
- Finally, Security Analytics can be used to provide strategic decision support in the area of event and incident management, situational awareness compliance. By modelling and simulating processes related to the collection and manipulation of data, correlation of information, deduction, incident and change management, it is possible to explore the presence of potential weaknesses, faults and check for the appropriateness of the allocated resources. This would help to inform security policies and investments
Related to the third point, Security Analytics can enable the exploration of questions such as: “Are the current SIEM investments and related processes appropriate?”; “Am I focusing on the collection of the relevant data? Are my processes adequate to detect and handle specific threats?”; “What are the consequences of changing some of the processes/investing more in specific solutions and resources?”
I indeed believe that an interesting R&D area to work on is exploring how to leverage and combine these two approaches.
--- Posted by Marco Casassa Mont (here and here) ---
--- NOTE: use this mirror blog if you prefer posting on an external blog site ---
--- NOTE: my original HP blog can be found here ---
HP Information Security, Security Analytics and IAM
As mentioned in a previous post, HP Information Security has been recently launched.
Security Analytics is one of the new services provided in the context of Business Ready Security Innovation.
Aspects of the work done by HP Labs in the space of Identity Analytics - i.e. applying Security Analytics to the Identity and Access Management space - have been factored in this service:
“By combining our research and practical experience in information security, we are able to offer repeatable, short-term engagements that help you address the people, process, policy, and technology involved in your security management. These engagements cover two key areas:
Security Analytics is one of the new services provided in the context of Business Ready Security Innovation.
Aspects of the work done by HP Labs in the space of Identity Analytics - i.e. applying Security Analytics to the Identity and Access Management space - have been factored in this service:
“By combining our research and practical experience in information security, we are able to offer repeatable, short-term engagements that help you address the people, process, policy, and technology involved in your security management. These engagements cover two key areas:
- Vulnerability and threat management (VTM)
- Identity and access management (IAM)
Through these consultations, we’ll explore your (VTM or IAM) system, with prediction and “what-if” capabilities, get a shared multi-stakeholder understanding of the business and security trade-offs, and give you the analytics you need for justified decision-making.”
--- Posted by Marco Casassa Mont (here and here) ---
--- NOTE: use this mirror blog if you prefer posting on an external blog site ---
--- NOTE: my original HP blog can be found here ---
Launch of HP Information Security and Security Innovation.
HP Information Security has been recently launched. It includes security consulting, security technology, security outsourcing and security innovation.
Some more details about HP Information Security’s “Security Innovation”:
“Together with HP Labs, we lead the market for security innovation, helping you gain competitive advantage and improve service quality through the innovative application of technology.
HP Information Security solutions offer you innovations that are business ready—that we know will deliver significant financial and operational benefits to help move your business forward. Thanks to our unique pedigree in innovation, we’re able to identify future information security issues and create resolutions today. That way, our solutions can spend months being tested and improved before they are ever needed by you.
We're driving information security innovation every day through initiatives like our Chief Information Security Officer (CISO) Club, Information Security Leaders event and our security benchmark research projects.
In conjunction with HP Labs and our clients, we use our insight to deliver relevant research and development that can then be fully incubated across a variety of clients before it is deemed Business Ready Security Innovation. Examples include:
Some more details about HP Information Security’s “Security Innovation”:
“Together with HP Labs, we lead the market for security innovation, helping you gain competitive advantage and improve service quality through the innovative application of technology.
HP Information Security solutions offer you innovations that are business ready—that we know will deliver significant financial and operational benefits to help move your business forward. Thanks to our unique pedigree in innovation, we’re able to identify future information security issues and create resolutions today. That way, our solutions can spend months being tested and improved before they are ever needed by you.
We're driving information security innovation every day through initiatives like our Chief Information Security Officer (CISO) Club, Information Security Leaders event and our security benchmark research projects.
In conjunction with HP Labs and our clients, we use our insight to deliver relevant research and development that can then be fully incubated across a variety of clients before it is deemed Business Ready Security Innovation. Examples include:
--- Posted by Marco Casassa Mont (here and here) ---
--- NOTE: use this mirror blog if you prefer posting on an external blog site ---
--- NOTE: my original HP blog can be found here ---
Digital Risk Report – Managing Digital Risks: Trends, Issues and Implications
Produced by Lloyd's and HP labs, this report suggests that companies are facing a wide range of sophisticated attacks: http://www.lloyds.com/News-and-Insight/360-Risk-Insight/Digital-Risk
“With technology changing rapidly and increasingly sophisticated attackers adapting quickly to the new digital environment, the cyber threats facing business are becoming more complex and growing every day. Companies need to take action now to tackle this threat and make digital risk a board-level concern.”
--- Posted by Marco Casassa Mont (here and here) ---
--- NOTE: use this mirror blog if you prefer posting on an external blog site ---
--- NOTE: my original HP blog can be found here ---
“With technology changing rapidly and increasingly sophisticated attackers adapting quickly to the new digital environment, the cyber threats facing business are becoming more complex and growing every day. Companies need to take action now to tackle this threat and make digital risk a board-level concern.”
--- Posted by Marco Casassa Mont (here and here) ---
--- NOTE: use this mirror blog if you prefer posting on an external blog site ---
--- NOTE: my original HP blog can be found here ---
Wednesday, November 17, 2010
HP G-Cloud Demonstrator (by HP Labs)
The G-Cloud Theatre is a room designed to demonstrate systems management in a mission-critical environment.
The 'G' in G-Cloud stands for "government" and the demonstration in the theatre shows how a cloud hosting many virtual services could automatically resist even a sophisticated security attack intended to destabilise core data and programs (or generally cause mayhem).
A video footage is available at: http://www.youtube.com/watch?v=zMsWaEqQcbI
--- Posted by Marco Casassa Mont (here and here) ---
--- NOTE: use this mirror blog if you prefer posting on an external blog site ---
--- NOTE: my original HP blog can be found here ---
The 'G' in G-Cloud stands for "government" and the demonstration in the theatre shows how a cloud hosting many virtual services could automatically resist even a sophisticated security attack intended to destabilise core data and programs (or generally cause mayhem).
A video footage is available at: http://www.youtube.com/watch?v=zMsWaEqQcbI
--- Posted by Marco Casassa Mont (here and here) ---
--- NOTE: use this mirror blog if you prefer posting on an external blog site ---
--- NOTE: my original HP blog can be found here ---
Analysis of state-of-the-art of Event Management/SIEM Solutions
I am interested in public documentation providing reviews of the state-of-the-art in the Event Management/SIEM Solutions.
In particular I am looking at how the following critical aspects are supported:
In particular I am looking at how the following critical aspects are supported:
- Scalability: how these solutions scale in case of complex organisation, supply-chains and future utilisation of IT infrastructure/services in the cloud;
- Comprehensiveness of the type of data that can actually be gathered and stored
- Support for unstructured event data: how is unstructured data managed by these systems and processed;
- Type of supported data mining, correlations and deductions;
- How cultural and human behaviours are factored in/taken into account by the event management system;
- How compliance, governance and incident management processes are affected by introducing these solutions
I am interested in exploring how HPL Security Analytics can be of help, in investigating different investment options and provide strategic decision support.
The above information would be extremely valuable to build grounded models and related simulations.
--- Posted by Marco Casassa Mont (here and here) ---
--- NOTE: use this mirror blog if you prefer posting on an external blog site ---
--- NOTE: my original HP blog can be found here ---
Subscribe to:
Posts (Atom)