Insider threats: the major challenge to security risk management

Security risk management is by definition, a subjective and complex exercise and it takes time to perform properly. Human resources are fundamental assets for any organization, and as any other asset, they have inherent vulnerabilities that need to be handled, i.e. managed and assessed. However, the nature that characterize the human behavior and the organizational environment where they develop their work turn these task extremely difficult, hard to accomplish and prone to errors. Assuming security as a cost, organizations are usually focused on the efficiency of the security mechanisms implemented that enable them to protect against external attacks, disregarding the insider risks, which are much more difficult to assess. All these demands an interdisciplinary approach in order to combine technical solutions with psychology approaches in order to understand the organizational staff and detect any changes in their behaviors and characteristics. This paper intends to discuss some methodological challenges to evaluate the insider threats and its impacts, and integrate them in a security risk framework, that was defined according to the security standard ISO/IEC_JTC1, to support the security risk management process.

Design of a case-based reasoner for information security in military organizations

Information security is concerned with the protection of information, which can be stored, processed or transmitted within critical information systems of the organizations, against loss of confidentiality, integrity or availability. Protection measures to prevent these problems result through the implementation of controls at several dimensions: technical, administrative or physical. A vital objective for military organizations is to ensure superiority in contexts of information warfare and competitive intelligence. Therefore, the problem of information security in military organizations has been a topic of intensive work at both national and transnational levels, and extensive conceptual and standardization work is being produced. A current effort is therefore to develop automated decision support systems to assist military decision makers, at different levels in the command chain, to provide suitable control measures that can effectively deal with potential attacks and, at the same time, prevent, detect and contain vulnerabilities targeted at their information systems. The concept and processes of the Case-Based Reasoning (CBR) methodology outstandingly resembles classical military processes and doctrine, in particular the analysis of “lessons learned” and definition of “modes of action”. Therefore, the present paper addresses the modeling and design of a CBR system with two key objectives: to support an effective response in context of information security for military organizations; to allow for scenario planning and analysis for training and auditing processes.

Preschool education in Brazil: does public supply crowd out private enrollment?

Expanding access to preschool education is a particularly important policy issue in developing countries, where enrollment rates are generally much lower, and where private institutions constitute a much larger share of the formal preschool sector, than in developed countries. This paper examines if an expansion in the supply of public preschool crowds-out private enrollment using rich data for municipalities in Brazil from 2000 to 2006, where federal transfers to local governments change discontinuously with given population thresholds. Results from a regression-discontinuity design reveal that larger federal transfers lead to a significant expansion of local public preschool services, but show no evidence of crowding-out of private enrollment, nor of negative impacts on the quality of private providers. This finding is consistent with a theory in which households differ in willingness-to-pay for preschool services, and private suppliers optimally adjust prices in response to an expansion of lower-quality, free-of-charge public supply. In the context of the model, the absence of crowding-out effects of more public preschool providers can be rationalized by the existence of relatively large differences in willingness-to-pay for preschool services across different demand segments. Our theoretical and empirical findings therefore suggest that in developing country settings characterized by relatively high income inequality, an expansion in public preschool supply will likely significantly increase enrollment among the poorest segments of society, and need not have adverse effects on the quantity or quality of local private supply.

A inovação, as marcas próprias e o private label no setor do calçado em Portugal

O sector do calçado português apresenta excelentes indicadores económicos e um desempenho competitivo assinalável. Os últimos quatro anos foram particularmente fortes, tendo Portugal atingido o 11º lugar entre os 15 maiores exportadores mundiais, com o segundo preço mais elevado por par de sapato vendido, superado apenas pela Itália. O artigo analisa o tipo de inovação realizada pelas empresas consideradas inovadoras dentro do sector do calçado em Portugal, de acordo com o manual de Oslo, e analisa a evolução que as empresas fizeram ao passarem de um regime dominado pelo private label para o desenvolvimento de produtos, de coleções e de marcas próprias. A pesquisa foi de natureza qualitativa, envolvendo sete empresas com inovação, sendo realizado estudos de caso através de entrevistas semi-estruturadas, análise de documentos e visitas às empresas e aos seus processos produtivos e de criação. Os resultados obtidos na investigação evidenciam uma relação entre os indicadores económicos e de desempenho e a existência de determinadas categorias de inovação. Evidencia ainda a relação existente entre o regime de produção e os indicadores económicos das empresas.

ADSNARK: Nearly practical and privacy-preserving proofs on authenticated data

We study the problem of privacy-preserving proofs on authenticated data, where a party receives data from a trusted source and is requested to prove computations over the data to third parties in a correct and private way, i.e., the third party learns no information on the data but is still assured that the claimed proof is valid. Our work particularly focuses on the challenging requirement that the third party should be able to verify the validity with respect to the specific data authenticated by the source — even without having access to that source. This problem is motivated by various scenarios emerging from several application areas such as wearable computing, smart metering, or general business-to-business interactions. Furthermore, these applications also demand any meaningful solution to satisfy additional properties related to usability and scalability. In this paper, we formalize the above three-party model, discuss concrete application scenarios, and then we design, build, and evaluate ADSNARK, a nearly practical system for proving arbitrary computations over authenticated data in a privacy-preserving manner. ADSNARK improves significantly over state-of-the-art solutions for this model. For instance, compared to corresponding solutions based on Pinocchio (Oakland’13), ADSNARK achieves up to 25× improvement in proof-computation time and a 20× reduction in prover storage space.

Do pré-escolar para o 1º ano do ensino básico: "A Voz da Criança"

Dissertação de mestrado em Educação da Infância (área de especialização em Supervisão e Pedagogia da Infância)