Auditoría de sistemas al cumplimiento de los requerimientos 7, 8, 9 de la norma PCIDSS aplicada a Coral Hipermercado, Racar plaza con corte a Junio de 2015

Coral Hipermercado GO es una empresa dedicada a la comercialización de diversos productos de consumo masivo. Debido a la demanda que mantienen y el nivel de transacciones que realizan en ventas diariamente,

Cryptographic public key length prediction

In the late 1900s, suitable key lengths were determined by cryptographers who considered four main features based on implementation, expected lifespan and associated security. By 2010, recommendations are aimed at governmental and commercial institutions, which take into consideration practical implementations that provide data security. By aggregating the key length predictive data since 1985, we notice that while the figures proposed between 1990 and 2010 increase linearly, those proposed for 2010 to 2050 do not. This motivates us to re-think the factors used as a basis for key length predictions and we initiate this re-evaluation in this paper. Focusing first on implementation, we clarify the meaning of Moore’s Law by going back to his original papers and commentary. We then focus on the period 2010-2015, when non-linearity appears, and test Moore’s Law based on three different hardware platforms. Our conclusion is that current assumptions about Moore’s law are still reasonable and that non-linearity is likely to be caused by other factors which we will investigate in future work.

Active engagement with stigmatised communities through digital ethnography

Conducting research in the rapidly evolving fields constituting the digital social sciences raises challenging ethical and technical issues, especially when the subject matter includes activities of stigmatised populations. Our study of a dark-web drug-use community provides a case example of ‘how to’ conduct studies in digital environments where sensitive and illicit activities are discussed. In this paper we present the workflow from our digital ethnography and consider the consequences of particular choices of action upon knowledge production. Key considerations that our workflow responded to include adapting to volatile field-sites, researcher safety in digital environments, data security and encryption, and ethical-legal challenges. We anticipate that this workflow may assist other researchers to emulate, test and adapt our approach to the diverse range of illicit studies online. In this paper we argue that active engagement with stigmatised communities through multi-sited digital ethnography can complement and augment the findings of digital trace analyses.

Les enjeux juridiques concernant les nouveaux modèles d’affaires basés sur la commercialisation des données

Cet essai est présenté en tant que mémoire de maîtrise dans le cadre du programme de droit des technologies de l’information. Ce mémoire traite de différents modèles d’affaires qui ont pour caractéristique commune de commercialiser les données dans le contexte des technologies de l’information. Les pratiques commerciales observées sont peu connues et l’un des objectifs est d’informer le lecteur quant au fonctionnement de ces pratiques. Dans le but de bien situer les enjeux, cet essai discutera d’abord des concepts théoriques de vie privée et de protection des renseignements personnels. Une fois ce survol tracé, les pratiques de « data brokerage », de « cloud computing » et des solutions « analytics » seront décortiquées. Au cours de cette description, les enjeux juridiques soulevés par chaque aspect de la pratique en question seront étudiés. Enfin, le dernier chapitre de cet essai sera réservé à deux enjeux, soit le rôle du consentement et la sécurité des données, qui ne relèvent pas d’une pratique commerciale spécifique, mais qui sont avant tout des conséquences directes de l’évolution des technologies de l’information.

Les enjeux juridiques concernant les nouveaux modèles d’affaires basés sur la commercialisation des données

Cet essai est présenté en tant que mémoire de maîtrise dans le cadre du programme de droit des technologies de l’information. Ce mémoire traite de différents modèles d’affaires qui ont pour caractéristique commune de commercialiser les données dans le contexte des technologies de l’information. Les pratiques commerciales observées sont peu connues et l’un des objectifs est d’informer le lecteur quant au fonctionnement de ces pratiques. Dans le but de bien situer les enjeux, cet essai discutera d’abord des concepts théoriques de vie privée et de protection des renseignements personnels. Une fois ce survol tracé, les pratiques de « data brokerage », de « cloud computing » et des solutions « analytics » seront décortiquées. Au cours de cette description, les enjeux juridiques soulevés par chaque aspect de la pratique en question seront étudiés. Enfin, le dernier chapitre de cet essai sera réservé à deux enjeux, soit le rôle du consentement et la sécurité des données, qui ne relèvent pas d’une pratique commerciale spécifique, mais qui sont avant tout des conséquences directes de l’évolution des technologies de l’information.

Privacy matters: issues within mechatronics

As mechatronic devices and components become increasingly integrated with and within wider systems concepts such as Cyber-Physical Systems and the Internet of Things, designer engineers are faced with new sets of challenges in areas such as privacy. The paper looks at the current, and potential future, of privacy legislation, regulations and standards and considers how these are likely to impact on the way in which mechatronics is perceived and viewed. The emphasis is not therefore on technical issues, though these are brought into consideration where relevant, but on the soft, or human centred, issues associated with achieving user privacy.

Simplificação de processos com cartão de cidadão

Na sociedade moderna, o uso de novas tecnologias e das correspondentes aplicações informáticas, levanta diversas questões, sendo, sem dúvida a mais importante, a segurança dos utilizadores e dos sistemas. A implementação de novos processos fazendo uso dos meios informáticos disponíveis permite o aumento da produtividade e a sua simplificação sem perder a fiabilidade, através da desmaterialização, desburocratização, acessibilidade, rapidez de execução, comodidade e segurança. A introdução do cartão de cidadão com todas a sua potencialidade contribui para a implementação dos processos acima referidos, os quais acompanharam a evolução do quadro legislativo nacional e europeu. Contudo verificam-se algumas lacunas, devido à sua imaturidade, sendo o seu desenvolvimento um processo ainda em curso. Com o presente trabalho pretende-se criar uma solução aberta a várias aplicações, que permite a optimização de processos através da sua simplificação, com recurso à assinatura digital, autenticação e uso de dados pessoais, tendo em atenção a legislação vigente, o actual cartão de cidadão e os requisitos de segurança. ABSTRACT: ln modern society, the increasing application of information technologies have arisen several questions, being the private and sensitive data security the most important. Today new informatics processes have come to increase productivity using faster and simplified mechanisms, keeping reliability and security. The introduction in Portugal, of the new citizen card is a great example of the above mentioned, in accordance with the National and European legislation. Nevertheless, being recently adopted, it stills vulnerable and therefore is in constant update and revision. The purpose of this thesis is the creation of an open solution to other new applications, aiming a simplification and optimization of citizen card. Seeking the maximum security, it is utilized digital signature, authentication and personal details, always according to the legislation in effect.

Understanding data flow and security requirements in wireless Body Area Networks for healthcare

The Body Area Network (BAN) is an emerging technology that focuses on monitoring physiological data in, on and around the human body. BAN technology permits wearable and implanted sensors to collect vital data about the human body and transmit it to other nodes via low-energy communication. In this paper, we investigate interactions in terms of data flows between parties involved in BANs under four different scenarios targeting outdoor and indoor medical environments: hospital, home, emergency and open areas. Based on these scenarios, we identify data flow requirements between BAN elements such as sensors and control units (CUs) and parties involved in BANs such as the patient, doctors, nurses and relatives. Identified requirements are used to generate BAN data flow models. Petri Nets (PNs) are used as the formal modelling language. We check the validity of the models and compare them with the existing related work. Finally, using the models, we identify communication and security requirements based on the most common active and passive attack scenarios.

Enforcing RFID data visibility restrictions using XACML security policies

Radio Frequency Identification (RFID) technology allows automatic data capture from tagged objects moving in a supply chain. This data can be very useful if it is used to answer traceability queries, however it is distributed across many different repositories, owned by different companies. © 2012 IEEE.

Novel information sharing syntax for data sharing between police and community partners, using role-based security.

The exchange of information between the police and community partners forms a central aspect of effective community service provision. In the context of policing, a robust and timely communications mechanism is required between police agencies and community partner domains, including: Primary healthcare (such as a Family Physician or a General Practitioner); Secondary healthcare (such as hospitals); Social Services; Education; and Fire and Rescue services. Investigations into high-profile cases such as the Victoria Climbié murder in 2000, the murders of Holly Wells and Jessica Chapman in 2002, and, more recently, the death of baby Peter Connelly through child abuse in 2007, highlight the requirement for a robust information-sharing framework. This paper presents a novel syntax that supports information-sharing requests, within strict data-sharing policy definitions. Such requests may form the basis for any information-sharing agreement that can exist between the police and their community partners. It defines a role-based architecture, with partner domains, with a syntax for the effective and efficient information sharing, using SPoC (Single Point-of-Contact) agents to control in-formation exchange. The application of policy definitions using rules within these SPoCs is inspired by network firewall rules and thus define information exchange permissions. These rules can be imple-mented by software filtering agents that act as information gateways between partner domains. Roles are exposed from each domain to give the rights to exchange information as defined within the policy definition. This work involves collaboration with the Scottish Police, as part of the Scottish Institute for Policing Research (SIPR), and aims to improve the safety of individuals by reducing risks to the community using enhanced information-sharing mechanisms.

Risk adjustment for hospital use using social security data: cross sectional small area analysis

Objectives: To identify demographic and socioeconomic determinants of need for acute hospital treatment at small area level. To establish whether there is a relation between poverty and use of inpatient services. To devise a risk adjustment formula for distributing public funds for hospital services using, as far as possible, variables that can be updated between censuses. Design: Cross sectional analysis. Spatial interactive modelling was used to quantify the proximity of the population to health service facilities. Two stage weighted least squares regression was used to model use against supply of hospital and community services and a wide range of potential needs drivers including health, socioeconomic census variables, uptake of income support and family credit, and religious denomination. Setting: Northern Ireland. Main outcome measure: Intensity of use of inpatient services. Results: After endogeneity of supply and use was taken into account, a statistical model was produced that predicted use based on five variables: income support, family credit, elderly people living alone, all ages standardised mortality ratio, and low birth weight. The main effect of the formula produced is to move resources from urban to rural areas. Conclusions: This work has produced a population risk adjustment formula for acute hospital treatment in which four of the five variables can be updated annually rather than relying on census derived data. Inclusion of the social security data makes a substantial difference to the model and to the results produced by the formula.

Swarm scheduling approaches for work-flow applications with security constraints in distributed data-intensive computing environments

The scheduling problem in distributed data-intensive computing environments has become an active research topic due to the tremendous growth in grid and cloud computing environments. As an innovative distributed intelligent paradigm, swarm intelligence provides a novel approach to solving these potentially intractable problems. In this paper, we formulate the scheduling problem for work-flow applications with security constraints in distributed data-intensive computing environments and present a novel security constraint model. Several meta-heuristic adaptations to the particle swarm optimization algorithm are introduced to deal with the formulation of efficient schedules. A variable neighborhood particle swarm optimization algorithm is compared with a multi-start particle swarm optimization and multi-start genetic algorithm. Experimental results illustrate that population based meta-heuristics approaches usually provide a good balance between global exploration and local exploitation and their feasibility and effectiveness for scheduling work-flow applications. © 2010 Elsevier Inc. All rights reserved.