From 'Security for Privacy' to 'Privacy for Security'

This article envisions the use of context-awareness to improve single sign-on solutions (SSO) for mobile users. The attribute-based SSO is expected to increase users' perceived ease of use of the system and service providers' authentication security of the application. From these two features we derive two value propositions for a new business model for mobile platforms. The business model can be considered as an instantiation of the privacy-friendly business model pattern presented in our previous work, reinforcing our claim that privacy-friendly value propositions are possible and can be used to obtain a competitive advantage.

Software Security Design and Testing

Elektroninen kaupankäynti ja pankkipalvelut ovat herättäneet toiminnan jatkuvuuden kannalta erittäin kriittisen kysymyksen siitä, kuinka näitä palveluja pystytään suojaamaan järjestäytynyttä rikollisuutta ja erilaisia hyväksikäyttöjä vastaan.

A cyber security architecture for military networks using a cognitive network approach

Cyber security is one of the main topics that are discussed around the world today. The threat is real, and it is unlikely to diminish. People, business, governments, and even armed forces are networked in a way or another. Thus, the cyber threat is also facing military networking. On the other hand, the concept of Network Centric Warfare sets high requirements for military tactical data communications and security. A challenging networking environment and cyber threats force us to consider new approaches to build security on the military communication systems. The purpose of this thesis is to develop a cyber security architecture for military networks, and to evaluate the designed architecture. The architecture is described as a technical functionality. As a new approach, the thesis introduces Cognitive Networks (CN) which are a theoretical concept to build more intelligent, dynamic and even secure communication networks. The cognitive networks are capable of observe the networking environment, make decisions for optimal performance and adapt its system parameter according to the decisions. As a result, the thesis presents a five-layer cyber security architecture that consists of security elements controlled by a cognitive process. The proposed architecture includes the infrastructure, services and application layers that are managed and controlled by the cognitive and management layers. The architecture defines the tasks of the security elements at a functional level without introducing any new protocols or algorithms. For evaluating two separated method were used. The first method is based on the SABSA framework that uses a layered approach to analyze overall security of an organization. The second method was a scenario based method in which a risk severity level is calculated. The evaluation results show that the proposed architecture fulfills the security requirements at least at a high level. However, the evaluation of the proposed architecture proved to be very challenging. Thus, the evaluation results must be considered very critically. The thesis proves the cognitive networks are a promising approach, and they provide lots of benefits when designing a cyber security architecture for the tactical military networks. However, many implementation problems exist, and several details must be considered and studied during the future work.

Controlling Irregular Migration in Canada: Reconciling Security Concerns with Human Rights Protection

International human rights law, international humanitarian law, international refugee law and international criminal law: each chapter of this corpus stands as a fundamental defense against assaults on our common humanity… The very power of these rules lies in the fact that they protect even the most vulnerable, and bind even the most powerful. No one stands so high as to be above the reach of their authority. No one falls so low as to be below the guard of their protection. Sergio Vieira de Mello, United Nations General Assembly, November 2002.

Security and Securities in English Commercial Law

Paul Latimer, Associate Professor, Department of Business Law and Taxation. Faculty of Business and Economics, Monash University. Présentation dans le cadre du cycle de conférences organisé par le CRDP intitulé « Le droit à la sécurité ... la sécurité par le droit ».

Le Canada et l’article 1F de la Convention relative au statut des réfugiés : une application large en réponse aux menaces à la sécurité nationale

En 1951, le droit international des réfugiés voyait le jour avec la Convention relative au statut des réfugiés. Cette convention ainsi que son Protocole stipulent la définition contemporaine de cette notion et les obligations de l'État d'accueil à l’égard des réfugiés mais y prévoit aussi une exception. En effet, les rédacteurs de la Convention de 1951, percevant que certains bourreaux tenteraient d'user de ce mécanisme pour échapper à des poursuites en trouvant refuge à l'étranger, y ont intégré une dérogation à la définition de réfugié qui a pris la forme d’une clause d'exclusion. Celle-ci permet à tout État ayant adhéré à cet instrument de refuser d'accueillir sur son territoire les individus à l'origine des plus grands crimes internationaux et nationaux. Le Canada, en ratifiant la Convention de 1951 et son Protocole en 1969, a incorporé dans sa législation nationale cette clause d'exclusion dans l'article 98 de la Loi sur l'immigration et la protection des réfugiés. Le présent mémoire porte sur l'application de cette clause d'exclusion en droit canadien. Nous proposons une analyse de l'application de cette disposition en droit interne. L’objectif général est de montrer que les cours de justice favorisent une interprétation trop large de la clause d’exclusion, dénaturant ainsi son statut de règle d’exception. En effet, cette interprétation jurisprudentielle a pour conséquence d’attribuer un poids prépondérant à la sécurité nationale aux dépens du caractère humanitaire qui imprègne le droit d’asile depuis ses origines.

New Standards of Justice: Uncovering Motivations for Mexico’s Recent Judicial Reforms amid a Security Crisis

From the introduction: Mexico is in a state of siege. In recent years, organized crime and drug-related violence have escalated dramatically, taking innocent lives and leaving the country mired in bloodshed. The Mexican government, under the leadership of President Felipe Calderón, has responded in part by significantly extending the reach of its security operations, deploying thousands of federal police officers and military troops to combat the activities of drug cartels, and collaborating with the United States on an extensive regional security plan known as the Mérida Initiative. In the midst of the security crisis, however, the government has somewhat paradoxically adopted judicial reforms that protect human rights and civil liberties rather than erode them, specifically the presumption of innocence standard in criminal proceedings and the implementation of oral trials. Assuming that the new laws on the books will be applied in practice, these reforms represent an important commitment on the part of the government to uphold human rights and civil liberties. This is in stark contrast to the infamous judicial reforms in Colombia—the institutionalization of anonymous or “faceless” prosecutions in special courts—implemented after a surge in leftist and cartel brutality, and the murders of several prominent public and judicial officials in the 1980s.

1st Kassel Student Workshop on Security in Distributed Systems

With this document, we provide a compilation of in-depth discussions on some of the most current security issues in distributed systems. The six contributions have been collected and presented at the 1st Kassel Student Workshop on Security in Distributed Systems (KaSWoSDS’08). We are pleased to present a collection of papers not only shedding light on the theoretical aspects of their topics, but also being accompanied with elaborate practical examples. In Chapter 1, Stephan Opfer discusses Viruses, one of the oldest threats to system security. For years there has been an arms race between virus producers and anti-virus software providers, with no end in sight. Stefan Triller demonstrates how malicious code can be injected in a target process using a buffer overflow in Chapter 2. Websites usually store their data and user information in data bases. Like buffer overflows, the possibilities of performing SQL injection attacks targeting such data bases are left open by unwary programmers. Stephan Scheuermann gives us a deeper insight into the mechanisms behind such attacks in Chapter 3. Cross-site scripting (XSS) is a method to insert malicious code into websites viewed by other users. Michael Blumenstein explains this issue in Chapter 4. Code can be injected in other websites via XSS attacks in order to spy out data of internet users, spoofing subsumes all methods that directly involve taking on a false identity. In Chapter 5, Till Amma shows us different ways how this can be done and how it is prevented. Last but not least, cryptographic methods are used to encode confidential data in a way that even if it got in the wrong hands, the culprits cannot decode it. Over the centuries, many different ciphers have been developed, applied, and finally broken. Ilhan Glogic sketches this history in Chapter 6.

Global Optimization Algorithms and their Application to Distributed Systems

In this report, we discuss the application of global optimization and Evolutionary Computation to distributed systems. We therefore selected and classified many publications, giving an insight into the wide variety of optimization problems which arise in distributed systems. Some interesting approaches from different areas will be discussed in greater detail with the use of illustrative examples.

Conceptual information systems discussed through an IT-security tool

Conceptual Information Systems are based on a formalization of the concept of "concept" as it is discussed in traditional philosophical logic. This formalization supports a human-centered approach to the development of Information Systems. We discuss this approach by means of an implemented Conceptual Information System for supporting IT security management in companies and organizations.

INFO2009 Group 6 - Data Security & the Data Protection Act

Content related to the second INFO2009 assignment for Group 6's radio interview on data security and the DPA

INFO2009 Group 21 - A Poster and set of Resources on Computer Security

This contains a poster advertising the resources. The resource is a profile folder on five topics, as well as a website, a quiz, and an interactive game.

Privacy and Security - background grey literature online

Background reading for coursework to prepare a technical report as part of the orientation phase. These items are business documents (i.e. grey literature) which might be read as a prelude or complement to finding information in peer reviewed academic publications. grey literature links and articles to be used in preparation of technical report. See also overview guidance document for this assignment http://www.edshare.soton.ac.uk/8017/

INFO2009 Group 17 - Team Scopophobia - Security

This is the INFO2009 project for group 17 Our topic is Security. Our resource is a website that contains links to different questionnaires we created to help educate people in various subtopics of Security

INFO2009 Educational Resources: Security

Contains visually-appealing and informative "infographics" containing descriptions of common security vulnerabilities and general information about security. Suitable for use in a blog post or printed out and on the wall in an educational area. Also contains video podcasts demonstrating common security exploits in realistic web systems, and offering practical advice on fixing them. Created by "Am and the Raging Otters".