Gernot Goluch

Information Security Fortification by Ontological Mapping of the ISO/IEC 27001 Standard

This paper introduces an ontology-based framework to improve the preparation of ISO/IEC 27001 audits, and to strengthen the security state of the company respectively. Building on extensive previous work on security ontologies, we elaborate on how ISO/IEC 27001 artifacts can be integrated into this ontology. A basic introduction to security ontologies is given first. Specific examples show how certain ISO/IEC 27001 requirements are to be integrated into the ontology; moreover, our rule-based engine is used to query the knowledge base to check whether specific security requirements are fulfilled. The aim of this paper is to explain how security ontologies can be used for a tool to support the ISO/IEC 27001 certification, providing pivotal information for the preparation of audits and the creation and maintenance of security guidelines and policies.

A secure architecture for the pseudonymization of medical data

As aging and very expensive programs put more pressure on health and social care systems, an increase in the need for electronic healthcare records can be observed, because they promise massive savings and better clinical quality. However, patients and commissioners for data protection have legitimate concerns about the privacy and confidentiality of the stored data. Although the concept of pseudonymization allows an association with a patient only under specified and controlled circumstances, existing approaches have major vulnerabilities. This paper provides a new architecture for the pseudonymization of medical data that combines primary and secondary use in one system and thus provides a solution to vulnerabilities of existing approaches

Integration of an Ontological Information Security Concept in Risk Aware Business Process Management

The ability to prevent risks as well as to appropriately counteract occurring threats has increasingly become a crucial success factor. Traditional business process management provides concepts for the economical optimization of processes, while risk management focuses on the design of robust business processes. While aiming at the same goal, namely the improvement of business, the approaches how to reach this vary, due to a different understanding of improvement Following this, optimizing recommendations of business process management and risk management may be contradictory. Therefore, we proposed a unified method, integrating both points of views to enable risk-aware business process management and optimization. In this paper, we briefly describe the ROPE (risk-oriented process evaluation) methodology and the security ontology concept, which provides a solid knowledge base for an applicable and holistic company specific IT security approach. This heavy-weight ontology provides structured knowledge regarding the relations between threats, safeguards, and assets, which are crucial for modeling processes in ROPE. We show how the integration of the security ontologys knowledge base enhances the applicability of the ROPE methodology leading to improved risk-aware business process management.

XML security - A comparative literature review

Since the turn of the millenium, working groups of the W3C have been concentrating on the development of XML-based security standards, which are paraphrased as XML security. XML security consists of three recommendations: XML (digital) signature, XML encryption and XML key management specification (XKMS), all of them published by the W3C. By means of a review of the available literature the authors draw several conclusions about the status quo of XML security. Furthermore, the current state and focuses of research as well as the existing challenges are derived. Trends to different application areas - e.g. use of XML security for mobile computing - are also outlined. Based on this information the analyzed results are discussed and a future outlook is predicted.

Ontological Mapping of Common Criteria’s Security Assurance Requirements

The Common Criteria (CC) for Information Technology Security Evaluation provides comprehensive guidelines for the evaluation and certification of IT security regarding data security and data privacy. Due to the very complex and time-consuming certification process a lot of companies abstain from a CC certification. We created the CC Ontology tool, which is based on an ontological representation of the CC catalog, to support the evaluator at the certification process. Tasks such as the planning of an evaluation process, the review of relevant documents or the creating of reports are supported by the CC Ontology tool. With the development of this tool we reduce the time and costs needed to complete a certification.

Extension of a Methodology for Risk-Aware Business Process Modeling and Simulation Enabling Process-Oriented Incident Handling Support

Increasingly, companies face the challenges to perform their business processes effectively as well as efficiently and to simultaneously assure the continuity of these processes. As the majority of companies rely on IT, it is essential to establish effective incident handling. In this paper, we introduce new extensions of the risk-aware business process management framework ROPE (risk-oriented process evaluation) in order to support the improvement of the management and execution of business processes. We further discuss the advantages of those extensions and how they can support the implementation of standards and best-practices such as the NIST SP800-61 (Computer Security Incident Handling Guide).

Semantic storage: a report on performance and flexibility

Desktop search tools are becoming more popular. They have to deal with increasing amounts of locally stored data. Another approach is to analyze the semantic relationship between collected data in order to preprocess the data semantically. The goal is to allow searches based on relationships between various objects instead of focusing on the name of objects. We introduce a database architecture based on an existing software prototype, which is capable of meeting the various demands for a semantic information manager. We describe the use of an association table which stores the relationships between events. It enables adding or removing data items easily without the need for schema modifications. Existing optimization techniques of RDBMS can still be used.

A research agenda for Autonomous Business Process Management

Fast changing requirements, regarding different types of resources such as personnel or IT-systems, require companies to adapt their business processes in a very agile but yet sophisticated way. Most of todays companies fail in accomplishing this goal because of too static business process analysis and management approaches. The autonomous business process management methodology presented in this paper enables companies to self-adapt to changing requirements as they happen, using emerging technologies and concepts, such as RFID, nanotechnology or autonomous computing

Major Challenges in Structuring and Institutionalizing CERT-Communication

This paper describes an approach to the definition of requirements for CERT-Communication in a changing environment. CERTs play an outstanding role for the detection, analysis and mitigation of vulnerabilities, threats and cyber-attacks in a multistakeholder cyberspace on which society relies more and more. Furthermore CERTs are a very valuable backbone for national and regional (e.g. European Union) cyber strategies and their role is partly defined in national and European legislation. It can be difficult to bring these obligations in line with the current primarily informal communication channels of CERTs that rely on person to person trust. This paper is devoted to the question of which kind of communication requirements have to be fulfilled to best use and support the work of CERTs in this complex environment.

CASSIS - Computer-based Academy for Security and Safety in Information Systems

Information technologies and society are highly interwoven nowadays, but in both, the private and business sector, users are often not aware of security issues or lack proper security skills. The branch of information technology security is growing constantly but attacks against the vocational sector as well as the personal sector still cause great losses each day. Considering that the end-user is the weakest link of the security chain we aim to raise awareness, regarding IT security, and train and educate IT security skills by establishing a European-wide initiative and framework