Ensuring Mobile Device Security and Compliance at the Workplace

End users urgently request using mobile devices at their workplace. They know these devices from their private life and appreciate functionality and usability, and want to benefit from these advantages at work as well. Limitations and restrictions would not be accepted by them. On the contrary, companies are obliged to employ substantial organizational and technical measures to ensure data security and compliance when allowing to use mobile devices at the workplace. So far, only individual arrangements have been presented addressing single issues in ensuring data security and compliance. However, companies need to follow a comprehensive set of measures addressing all relevant aspects of data security and compliance in order to play it safe. Thus, in this paper at first technical architectures for using mobile devices in enterprise IT are reviewed. Thereafter a set of compliance rules is presented and, as major contribution, technical measures are explained that enable a company to integrate mobile devices into enterprise IT while still complying with these rules comprehensively. Depending on the company context, one or more of the technical architectures have to be chosen impacting the specific technical measures for compliance as elaborated in this paper. Altogether this paper, for the first time, correlates technical architectures for using mobile devices at the workplace with technical measures to assure data security and compliance according to a comprehensive set of rules.

BYOD Bring Your Own Device

Using modern devices like smartphones and tablets offers a wide variety of advantages; this has made them very popular as consumer devices in private life. Using them in the workplace is also popular. However, who wants to carry around and handle two devices; one for personal use, and one for work-related tasks? That is why “dual use”, using one single device for private and business applications, may represent a proper solution. The result is “Bring Your Own Device,” or BYOD, which describes the circumstance in which users make their own personal devices available for company use. For companies, this brings some opportunities and risks. We describe and discuss organizational issues, technical approaches, and solutions.

Architecture of Large-Scale Systems

In this paper various techniques in relation to large-scale systems are presented. At first, explanation of large-scale systems and differences from traditional systems are given. Next, possible specifications and requirements on hardware and software are listed. Finally, examples of large-scale systems are presented.

Event Monitoring Web Services for Heterogeneous Information Systems

Heterogeneity has to be taken into account when integrating a set of existing information sources into a distributed information system that are nowadays often based on Service- Oriented Architectures (SOA). This is also particularly applicable to distributed services such as event monitoring, which are useful in the context of Event Driven Architectures (EDA) and Complex Event Processing (CEP). Web services deal with this heterogeneity at a technical level, also providing little support for event processing. Our central thesis is that such a fully generic solution cannot provide complete support for event monitoring; instead, source specific semantics such as certain event types or support for certain event monitoring techniques have to be taken into account. Our core result is the design of a configurable event monitoring (Web) service that allows us to trade genericity for the exploitation of source specific characteristics. It thus delivers results for the areas of SOA, Web services, CEP and EDA.

Secure Web Service Clients on Mobile Devices

Enterprise apps on mobile devices typically need to communicate with other system components by consuming web services. Since most of the current mobile device platforms (such as Android) do not provide built-in features for consuming SOAP services, extensions have to be designed. Additionally in order to accommodate the typical enhanced security requirements of enterprise apps, it is important to be able to deal with SOAP web service security extensions on client side. In this article we show that neither the built-in SOAP capabilities for Android web service clients are sufficient for enterprise apps nor are the necessary security features supported by the platform as is. After discussing different existing extensions making Android devices SOAP capable we explain why none of them is really satisfactory in an enterprise context. Then we present our own solution which accommodates not only SOAP but also the WS-Security features on top of SOAP. Our solution heavily relies on code generation in order to keep the flexibility benefits of SOAP on one hand while still keeping the development effort manageable for software development. Our approach provides a good foundation for the implementation of other SOAP extensions apart from security on the Android platform as well. In addition our solution based on the gSOAP framework may be used for other mobile platforms in a similar manner.

OSGi in Cloud Environments

This paper deals with the combination of OSGi and cloud computing. Both technologies are mainly placed in the field of distributed computing. Therefore, it is discussed how different approaches from different institutions work. In addition, the approaches are compared to each other.

Event Monitoring Based On Web Services for Heterogeneous Event Sources

This article discusses event monitoring options for heterogeneous event sources as they are given in nowadays heterogeneous distributed information systems. It follows the central assumption, that a fully generic event monitoring solution cannot provide complete support for event monitoring; instead, event source specific semantics such as certain event types or support for certain event monitoring techniques have to be taken into account. Following from this, the core result of the work presented here is the extension of a configurable event monitoring (Web) service for a variety of event sources. A service approach allows us to trade genericity for the exploitation of source specific characteristics. It thus delivers results for the areas of SOA, Web services, CEP and EDA.

Ontologies for Complex Event Processing

In this paper, five ontologies are described, which include the event concepts. The paper provides an overview and comparison of existing event models. The main criteria for comparison are that there should be possibilities to model events with stretch in the time and location and participation of objects; however, there are other factors that should be taken into account as well. The paper also shows an example of using ontologies in complex event processing.

Shopping Cart System: Load Balancing and Fault Tolerance in the OSGi Service Platform

The main purpose of this paper was to find a simple solution for load balancing and fault tolerance in OSGi. The challenge was to implement a highly available web application such as a shopping cart system with load balancing and fault tolerance, without having to change the core of OSGi.

Graja - Autobewerter für Java-Programme

In diesem Bericht wird der Autobewerter Graja für Java-Programme vorgestellt. Wir geben einen Überblick über die unterstützten Bewertungsmethoden sowie die beteiligten Nutzerrollen. Wir gehen auf technische Einzelheiten und Randbedingungen der in Graja eingesetzten Bewertungsmethoden ein und zeigen die Einbindung von Graja in eine technische Gesamtarchitektur. An einem durchgehenden Beispiel stellen wir die Struktur einer Programmieraufgabe sowie die von Graja unterstützten Feedback-Möglichkeiten dar. Informationen zum bisherigen Einsatz des Graders runden den Bericht ab.

Ein Ansatz zur methoden- und werkzeuggestützten Anforderungs- und Systemspezifikation auf der Grundlage objektorientierter Modellierungs- und Simulationstechniken

Vorgestellt wird ein Ansatz zur objektorientierten Modellierung, Simulation und Animation von Informationssystemen. Es wird ein Vorgehensmodell dargestellt, mit dem unter Verwendung des beschriebenen Ansatzes Anforderungs- oder Systemspezifikationen von Rechnergestützten Informationssystemen erstellt werden können. Der Ansatz basiert auf einem Metamodell zur Beschreibung Rechnergestützter Informationssysteme und verfügt über eine rechnergestützte Modellierungsumgebung. Anhand eines Projektes zur Entwicklung einer Anforderungsspezifikation für ein rechnergestütztes Pflegedokumentations- und -kommunikationssystems wird der Einsatz der Methode beispielhaft illustriert.

Prototypische Integration automatisierter Programmbewertung in das LMS Moodle

Der Beitrag erläutert die prototypische Integration automatisierter Programmbewertung in das LMS Moodle.Beschrieben wird die Grader-unabhängige Schnittstelle Grappa und die Moodle-Integration.

Grading mit Grappa - Ein Werkstattbericht

„Grappa“ ist eine Middleware, die auf die Anbindung verschiedener Autobewerter an verschiedene E-Learning-Frontends respektive Lernmanagementsysteme (LMS) spezialisiert ist. Ein Prototyp befindet sich seit mehreren Semestern an der Hochschule Hannover mit dem LMS „moodle“ und dem Backend „aSQLg“ im Einsatz und wird regelmäßig evaluiert. Dieser Beitrag stellt den aktuellen Entwicklungsstand von Grappa nach diversen Neu- und Weiterentwicklungen vor. Nach einem Bericht über zuletzt gesammelte Erfahrungen mit der genannten Kombination von Systemen stellen wir wesentliche Neuerungen der moodle-Plugins, welche der Steuerung von Grappa aus moodle heraus dienen, vor. Anschließend stellen wir eine Erweiterung der bisherigen Architektur in Form eines neuentwickelten Grappa-php-Clients zur effizienteren Anbindung von LMS vor. Weiterhin berichten wir über die Anbindung eines weiteren Autobewerters „Graja“ für Programmieraufgaben in Java. Der Bericht zeigt, dass bereits wichtige Schritte für eine einheitliche Darstellung automatisierter Programmbewertung in LMS mit unterschiedlichen Autobewertern für die Studierenden absolviert sind. Die praktischen Erfahrungen zeigen aber auch, dass sowohl bei jeder der Systemkomponenten individuell, wie auch in deren Zusammenspiel via Grappa noch weitere Entwicklungsarbeiten erforderlich sind, um die Akzeptanz und Nutzung bei Studierenden sowie Lehrenden weiter zu steigern.

Studie zur Web-Server-Sicherheit von Unternehmen aus Hannover und Umgebung

Der vorliegende Artikel beschreibt die Ergebnisse einer Studie zur Sicherheit von Web-Servern niedersächsischer Unternehmen aus dem Raum Hannover. Untersucht wurden vier Unternehmensgruppen, die sich aus Mitgliedern von Unternehmensverbänden und berufsständischen Körperschaften zusammensetzen. Insgesamt werden mehr als 1800 Unternehmen betrachtet. Als Indikator für die IT-Sicherheit wurden vier Sicherheitslücken herangezogen, die leicht überprüft werden können, ohne die Web-Server in ihrem Betrieb zu beeinträchtigen. Die Ergebnisse sind ernüchternd: Viele Unternehmen setzen keine Verschlüsselung ein oder die Web-Server-Software ist nicht auf dem neusten Stand. Bei ungefähr jedem dritten Unternehmen, welches Verschlüsselung einsetzt, enthält die Software seit mehr als einem Jahr bekannte Schwachstellen und sollte umgehend aktualisiert werden. Dies zeigt, dass das IT-Sicherheitsmanagement in vielen Unternehmen mangelhaft ist.

Probabilistic Evaluation of Three-Dimensional Reconstructions from X-Ray Images Spanning a Limited Angle

An important part of computed tomography is the calculation of a three-dimensional reconstruction of an object from series of X-ray images. Unfortunately, some applications do not provide sufficient X-ray images. Then, the reconstructed objects no longer truly represent the original. Inside of the volumes, the accuracy seems to vary unpredictably. In this paper, we introduce a novel method to evaluate any reconstruction, voxel by voxel. The evaluation is based on a sophisticated probabilistic handling of the measured X-rays, as well as the inclusion of a priori knowledge about the materials that the object receiving the X-ray examination consists of. For each voxel, the proposed method outputs a numerical value that represents the probability of existence of a predefined material at the position of the voxel while doing X-ray. Such a probabilistic quality measure was lacking so far. In our experiment, false reconstructed areas get detected by their low probability. In exact reconstructed areas, a high probability predominates. Receiver Operating Characteristics not only confirm the reliability of our quality measure but also demonstrate that existing methods are less suitable for evaluating a reconstruction.