Reducing the Incidence of Unintended, Human-Caused Information Flows in Enterprise Systems

Atkinson C, Barth F, Gerbig R, Freiling F, Schinzel S, Hadasch F, Mädche A, Müller B (2012)

Publication Type: Conference contribution, Original article

Publication year: 2012

Publisher: IEEE Digital Library

Edited Volumes: Proceedings of the 2012 IEEE 16th International Enterprise Distributed Object Computing Conference Workshops, EDOCW 2012

City/Town: Bejing, China

Pages Range: 11-18

Conference Proceedings Title: Third International Workshop on Models and Model-driven Methods for Service Engineering (3M4SE 2012)

Event location: Beijing, China CN

DOI: 10.1109/EDOCW.2012.12

Abstract

Research in enterprise system security has largely focused on the development of theoretical models capable of demonstrating mathematically that they possess desired security properties. However, recent results confirm that many of these models cannot be applied in practice because of the unpredictability of human participants' behavior in business processes. Moreover, while malicious attacks remain a significant problem, the majority of user-caused information leaks in Enterprise Systems are unintentional (or have many unintentional components) and could potentially be prohibited if explicitly recognized and appropriately modeled. In this paper we argue that approaches for achieving information flow security in enterprises need to combine process and policy understandability with usability of the enforcement mechanisms. We present a modeling approach that allows security policies to be formulated in such a way that (1) they are aligned to the business processes executed in an enterprise, (2) are understandable by all relevant stakeholders, and (3) can be semi-automatically transformed into run-time enforcement mechanisms. © 2012 IEEE.

Authors with CRIS profile

Felix Freiling Lehrstuhl für Informatik 1 (IT-Sicherheitsinfrastrukturen) Sebastian Schinzel Lehrstuhl für Informatik 1 (IT-Sicherheitsinfrastrukturen)

Involved external institutions

Universität Mannheim DE Germany (DE)

How to cite

APA:

Atkinson, C., Barth, F., Gerbig, R., Freiling, F., Schinzel, S., Hadasch, F.,... Müller, B. (2012). Reducing the Incidence of Unintended, Human-Caused Information Flows in Enterprise Systems. In Third International Workshop on Models and Model-driven Methods for Service Engineering (3M4SE 2012) (pp. 11-18). Beijing, China, CN: Bejing, China: IEEE Digital Library.

MLA:

Atkinson, Colin, et al. "Reducing the Incidence of Unintended, Human-Caused Information Flows in Enterprise Systems." Proceedings of the EDOC Workshops, 3M4SE, Beijing, China Bejing, China: IEEE Digital Library, 2012. 11-18.

BibTeX: Download