Information flow analysis using data-dependent logical propositions

Dissertação para obtenção do Grau de Mestre em Engenharia Informática

A type system for value-dependent information flow analysis

Information systems are widespread and used by anyone with computing devices as well as corporations and governments. It is often the case that security leaks are introduced during the development of an application. Reasons for these security bugs are multiple but among them one can easily identify that it is very hard to define and enforce relevant security policies in modern software. This is because modern applications often rely on container sharing and multi-tenancy where, for instance, data can be stored in the same physical space but is logically mapped into different security compartments or data structures. In turn, these security compartments, to which data is classified into in security policies, can also be dynamic and depend on runtime data. In this thesis we introduce and develop the novel notion of dependent information flow types, and focus on the problem of ensuring data confidentiality in data-centric software. Dependent information flow types fit within the standard framework of dependent type theory, but, unlike usual dependent types, crucially allow the security level of a type, rather than just the structural data type itself, to depend on runtime values. Our dependent function and dependent sum information flow types provide a direct, natural and elegant way to express and enforce fine grained security policies on programs. Namely programs that manipulate structured data types in which the security level of a structure field may depend on values dynamically stored in other fields The main contribution of this work is an efficient analysis that allows programmers to verify, during the development phase, whether programs have information leaks, that is, it verifies whether programs protect the confidentiality of the information they manipulate. As such, we also implemented a prototype typechecker that can be found at http://ctp.di.fct.unl.pt/DIFTprototype/.

Gestão de bloco operatório : modelos de gestão e monitorização

RESUMO - A consciência de uma necessidade clara em rentabilizar a capacidade instalada e os meios tecnológicos e humanos disponíveis no Bloco Operatório e face ao imperativo de um cabal desempenho e de uma adequada efectividade nestes serviços levou-nos à realização deste estudo. Objectivos: O trabalho de projecto centrou-se em quatro objectivos concretos: Elaboração de uma grelha de observação de Modelos de Gestão de Bloco Operatório; Observação de seis Modelos de Gestão de Blocos Operatórios em experiências nacionais e in-loco, de acordo com a grelha de observação; Avaliação da qualidade gestionária na amostra seleccionada à luz dos modelos existentes; Criação de uma grelha de indicadores para a monitorização e avaliação do Bloco Operatório. Metodologia: Na elaboração da grelha de observação dos Blocos Operatórios recorremos a um grupo de peritos, à bibliografia disponível e à informação recolhida em entrevistas. Aplicámos a grelha de observação aos seis Blocos Operatórios e analisámos as informações referentes a cada modelo com a finalidade de encontrar os pontos-chave que mais se destacavam em cada um deles. Para a elaboração da grelha de indicadores de monitorização do Bloco Operatório realizámos uma reunião recorrendo à técnica de grupo nominal para encontrar o nível de consenso entre os peritos. Resultados: Criámos uma grelha de observação de Modelos de Gestão de Bloco Operatório que permite comparar as características de gestão. Esta grelha foi aplicada a seis Blocos Operatórios o que permitiu destacar como elementos principais e de diferenciação: o sistema de incentivos implementado; o sistema informático, de comunicação entre os serviços e de débito directo dos gastos; a existência de uma equipa de gestão de Bloco Operatório e de Gestão de Risco; a importância de um planeamento cirúrgico semanal e da existência de um regulamento do Bloco Operatório. Desenhámos um painel de indicadores para uma monitorização do Bloco Operatório, de onde destacamos: tempo médio de paragem por razões técnicas, tempo médio de paragem por razões operacionais, tempo médio por equipa e tempo médio por procedimento. Considerações finais: Os Blocos Operatórios devem ponderar a existência das componentes mais importantes dos Modelos, bem como recolher exaustivamente indicadores de monitorização. A investigação futura deverá debruçar-se sobre a relação entre os indicadores de monitorização e os Modelos de Gestão, recorrendo à técnicas de benchmarking. -------------------ABSTRACT - This study was driven by the need to optimise available capacity, technology and human resources in the Operating Room and to address the corresponding goals of adequate performance and effectiveness. Objectives: This project focuses on four specific objectives: development of an observation grid of operating room management models; in-loco observation and documentation of six national operating room, according to the grid; assess the quality of management in the selected sample relative to existing management models; create a set of indicators for monitoring and evaluating operating rooms. Methodology: The design of the observation grid was based on experts’ consultation, a literature survey and information gathered in various interviews. The observation grid was applied to six operating rooms and the information for each management model was analysed in order to find its key characteristics. We used the Nominal Group Technique in order to develop a set of indicators for monitoring and evaluating operating rooms. Results: An observation grid was created for operating rooms management models, which allowed comparing management characteristics. This grid was applied to six operating rooms allowing disentangle its main features and differentiating characteristics: implementation of incentive systems; IT systems including information flow between services; inventory and expense management; existence of a management team and effective risk management; importance of weekly planning and regulations. We designed a set control indicators, whose major characteristics are the following: the average down time due to technical reasons, the average down time due to operational reasons, the average time per team and the average time per procedure. Final Conclusions: Operating rooms should consider the most relevant characteristics of management models and collect exhaustive information on control indicators. Future research should be devoted to assessing the operating room performance according to management models, using control indicators and benchmarking techniques.

Business planning in nonprofit: laying the ground for customer relationship management in Instituto de Empreendedorismo Social

A Work Project, presented as part of the requirements for the Award of a Masters Degree in Management from the NOVA – School of Business and Economics

Three essays in risky behaviors

A PhD Dissertation, presented as part of the requirements for the Degree of Doctor of Philosophy from the NOVA - School of Business and Economics

Reactive hybrid knowledge bases

Hybrid knowledge bases are knowledge bases that combine ontologies with non-monotonic rules, allowing to join the best of both open world ontologies and close world rules. Ontologies shape a good mechanism to share knowledge on theWeb that can be understood by both humans and machines, on the other hand rules can be used, e.g., to encode legal laws or to do a mapping between sources of information. Taking into account the dynamics present today on the Web, it is important for these hybrid knowledge bases to capture all these dynamics and thus adapt themselves. To achieve that, it is necessary to create mechanisms capable of monitoring the information flow present on theWeb. Up to today, there are no such mechanisms that allow for monitoring events and performing modifications of hybrid knowledge bases autonomously. The goal of this thesis is then to create a system that combine these hybrid knowledge bases with reactive rules, aiming to monitor events and perform actions over a knowledge base. To achieve this goal, a reactive system for the SemanticWeb is be developed in a logic-programming based approach accompanied with a language for heterogeneous rule base evolution having as its basis RIF Production Rule Dialect, which is a standard for exchanging rules over theWeb.

Satisfação dos utilizadores de sistemas de informação e documentação de enfermagem em suporte eletrónico no Centro Hospitalar Lisboa Norte, E.P.E.

RESUMO - Os registos de enfermagem no Centro Hospitalar Lisboa Norte, E.P.E. (CHLN) são feitos em suporte de papel ou através de sistemas de informação (SI) próprios de cada serviço, com a utilização de várias aplicações como o Alert, Picis, etc. Esta diversidade gera alguns constrangimentos em termos de fluxo de informação, em virtude da falta de interoperabilidade dos respetivos sistemas. Esta realidade pode ter impactos na área da qualidade e segurança do utente, com a possibilidade de ocorrência de erros e/ou eventos adversos. Podem ainda ser notórios na área da privacidade e confidencialidade dos dados clínicos, na tomada de decisão, na gestão clínica e financeira e na produção de informação útil para a investigação científica. No CHLN está em curso a implementação de um SI capaz de dar resposta aos registos de enfermagem, integrados num registo de saúde eletrónico focado no utente que obedece à metodologia do processo de enfermagem e utiliza a linguagem codificada da Classificação Internacional para a Prática de Enfermagem (CIPE). Com o desenvolvimento desta investigação, devidamente autorizada pelo Conselho de Administração do CHLN, pretendeu-se dar resposta à pergunta de partida:  Estarão os enfermeiros, utilizadores do Desktop de Enfermagem do CHLN, satisfeitos com esse sistema de informação? Com esse propósito, foi elaborada uma abordagem exploratória com recurso a pesquisa bibliográfica sobre os sistemas de informação de enfermagem e a sua avaliação, com base no “Modelo de Sucesso dos Sistemas de Informação de DeLone e McLean”, tendo sido desenvolvido um estudo de caso com uma abordagem quantitativa, mediante a aplicação de um inquérito por questionário aos 262 enfermeiros do CHLN, nos serviços onde já utilizavam o referido SI, entre maio e junho de 2014, com uma taxa de resposta de 84%. Os resultados da aplicação do questionário, objeto de análise estatística univariada e bivariada com recurso a procedimentos descritivos e inferenciais, visando a produção de sínteses dirigidas aos objetivos do estudo, permitiram caracterizar o nível de satisfação dos enfermeiros, enquanto utilizadores do “desktop de enfermagem”, suportados por Tecnologias de Informação e Comunicação. Na escala utilizada (de 1 a 5), o nível médio de satisfação global (2,78) foi ligeiramente inferior ao seu ponto médio (3). No entanto, a maioria dos inquiridos (81,5%) não pretende abandonar o SI que utilizam. Os resultados obtidos permitem demonstrar que a satisfação dos enfermeiros face à implementação e utilização do SIE se trata de uma estratégia bem sucedida do CHLN, ainda que haja áreas onde foram evidenciados menores níveis de satisfação, tais como a “velocidade de processamento”, o “equipamento informático” e o “apoio técnico”, que podem ser alvo de uma maior atenção e reflexão pela gestão de topo, numa estratégia de melhoria contínua da qualidade, com importantes benefícios para a governação da instituição, para os profissionais e para os utentes, no futuro.

Geography of the Information Society

All every day activities take place in space. And it is upon this that all information and knowledge revolve. The latter are the key elements in the organisation of territories. Their creation, use and distribution should therefore occur in a balanced way throughout the whole territory in order to allow all individuals to participate in an egalitarian society, in which the flow of knowledge can take precedence over the flow of interests. The information society depends, to a large extent, on the technological capacity to disseminate information and, consequently, the knowledge throughout territory, thereby creating conditions which allow a more balanced development, from the both the social and economic points of view thus avoiding the existence of info-exclusion territories. Internet should therefore be considered more than a mere technology, given that its importance goes well beyond the frontiers of culture and society. It is already a part of daily life and of the new forms of thinking and transmitting information, thus making it a basic necessity essential, for a full socio-economic development. Its role as a platform of creation and distribution of content is regarded as an indispensable element for education in today’s society, since it makes information a much more easily acquired benefit.”…in the same way that the new technologies of generation and distribution of energy allowed factories and large companies to establish themselves as the organisational bases of industrial society, so the internet today constitutes the technological base of the organisational form that characterises the Information Era: the network” (CASTELLS, 2004:15). The changes taking place today in regional and urban structures are increasingly more evident due to a combination of factors such as faster means of transport, more efficient telecommunications and other cheaper and more advanced technologies of information and knowledge. Although their impact on society is obvious, society itself also has a strong influence on the evolution of these technologies. And although physical distance has lost much of the responsibility it had towards explaining particular phenomena of the economy and of society, other aspects such as telecommunications, new forms of mobility, the networks of innovation, the internet, cyberspace, etc., have become more important, and are the subject of study and profound analysis. The science of geographical information, allows, in a much more rigorous way, the analysis of problems thus integrating in a much more balanced way, the concepts of place, of space and of time. Among the traditional disciplines that have already found their place in this process of research and analysis, we can give special attention to a geography of new spaces, which, while not being a geography of ‘innovation’, nor of the ‘Internet’, nor even ‘virtual’, which can be defined as one of the ‘Information Society’, encompassing not only the technological aspects but also including a socio-economic approach. According to the last European statistical data, Portugal shows a deficit in terms of information and knowledge dissemination among its European partners. Some of the causes are very well identified - low levels of scholarship, weak investments on innovation and R&D (both private and public sector) - but others seem to be hidden behind socio-economical and technological factors. So, the justification of Portugal as the case study appeared naturally, on a difficult quest to find the major causes to territorial asymmetries. The substantial amount of data needed for this work was very difficult to obtain and for the islands of Madeira and Azores was insufficient, so only Continental Portugal was considered for this study. In an effort to understand the various aspects of the Geography of the Information Society and bearing in mind the increasing generalised use of information technologies together with the range of technologies available for the dissemination of information, it is important to: (i) Reflect on the geography of the new socio-technological spaces. (ii) Evaluate the potential for the dissemination of information and knowledge through the selection of variables that allow us to determine the dynamic of a given territory or region; (iii) Define a Geography of the Information Society in Continental Portugal.

Information Society in Croatia, Landsc@pes of Knowledge for Development

Sabbatical Studies Report

Does direct cash flow presentation help in predicting future operating cash flow?

A Work Project, presented as part of the requirements for the Award of a Masters Degree in Finance from the NOVA – School of Business and Economics

Does direct cash flow presentation help in predicting future operating cash flow?

Research literature and regulators are unconditional in pointing the disclosure of operating cash flow through direct method a section of unique information. Besides the intuitive facet, it is also consistent in forecasting future operating cash flows and a cohesive piece to financial statement puzzle. Bearing this in mind, I produce an analysis on the usefulness and predictive ability on the disclosure of gross cash receipts and payments over the disclosure of reconciliation between net income and accruals for two markets with special features, Portugal and Spain. Results validate the usefulness of direct method format in predicting future operating cash flow. Key