Security Policies ..

Source: Maria Leitner,Stefanie Rinderle-Ma, and Juergen Mangler. Responsibility-driven Design and Development of Process-aware Security Policies. in Sixth International Conference on Availability, Reliability and Security. 2011.

** all information below is quoted directly from the source paper, non of this is in my own words **

Security policies are a set of principles that control which subject is allowed to access which object within an information systems. In PAIS, however, security policies require a more detailed definition due to the multi-faceted characteristics of such systems. Specifically, security policies in PAIS might relate to access control, control flow, information flow, data integrity, and availability.

Security aspects in security polices:
Structural Aspect: denotes a set of data objects and tasks, and how they occur in a process model.
- Responsibilities: We define a responsibility r to be a piece of data or interrelated tasks from the point of a certain role.
Operational Aspect: denotes constraints on this data objects and tasks, for example during process execution. I.e. under which circumstances something is allowed.
- Permissions: define which operations (execute, monitor) are allowed for which security objects (process execution, process model change, service selection).

 

What is a secure Workflow

Source: P. C. K. Hung and K. Karlapalem, “A secure workflow model,” in Proc. of AISC on ACSW frontiers 2003 - Volume 21.    Australian Computer Society, Inc., 2003, pp. 33–41.

** all information below is quoted directly from the source paper, non of this is in my own words **

Definition 1:    A secure workflow is a computer supported business process that is capable to against security threats and further satisfies the security requirements defined by the workflow modeler.

Definition 2: A secure Workflow Management System (WFMS) is a workflow management system that can specify, manage and execute a secure workflow.

==========

In a secure workflow model, there are three layers for a secure state: Workflow, Data and Control:

Workflow:
Availability in the workflow layer is: “For every task there must be at least one agent who is able to execute the task.”

Integrity and Authorization in the work- flow layer is: “An agent can only execute the assigned task if and only if the privilege “execute” is granted. The secure workflow has to revoke the privilege from an agent if the task has completed execution.”

Data:
Integrity and Authorization in the data layer is: “An agent can only access a document with a specific privilege if and only if the document access privilege is granted to the agent and also it is needed to access the document with the privilege during the task execution. The secure workflow has to revoke the document access privilege from an agent if the document access privilege is no longer needed.”

==========

To ensure the property of authorization:
The secure workflow model assigns the task to an agent if and only if the agent can execute the task.

To ensure the properties of integrity and authorization, the secure workflow model:
- Grants the task to the assigned agent for execution if and only if the set of input events is generated, the task is not started and all the dependent tasks are completed in the relevant session.
- Revokes the task from the assigned agent if and only if the set of output events is generated and all the granted privileges for documents are revoked in the session.
- Grants the document access privilege to the agent for execution if and only if it is authorized by the task’s TAC in the session.
- Revokes the document access privilege from the agent if and only if the document access privilege or task is completed in the session.
- (an agent can) generate the event for a task if and only if it is authorized in the session.

Dimensions of trust

Trust is both and emotional and logical act. Emotionally, it is where you expose your vulnerabilities to people, but believing they will not take advantage of your openness. Logically, it is where you have assessed the probabilities of gain and loss, calculating expected utility based on hard performance data, and concluded that the person in question will behave in a predictable manner. In practice, trust is a bit of both. I trust you because I have experienced your trustworthiness and because I have faith in human nature.
We feel trust. Emotions associated with trust include companionship, friendship, love, agreement, relaxation, comfort.
There are a number of different ways we can define trust. Here are the dimensions of trust and consequent definitions.

Predictability

It is a normal part of the human condition to be constantly forecasting ahead. We build internal models of the world based both on our experiences and what others tell us, and then use these to guess what will happen next. This allows us to spot and prepare for threats and also make plans to achieve our longer-term goals.
The greatest unpredictability is at 50%; a reliable enemy can be preferable to an unpredictable friend, as at least we know where we are with them.

Definition 1: Trust means being able to predict what other people will do and what situations will occur. If we can surround ourselves with people we trust, then we can create a safe present and an even better future.

Value exchange

Most of what we do with other people is based around exchange, which is the basis for all businesses as well as simple relationships. At its simplest, it is exchange of goods. I will swap you two sheep for one cow. It is easy to calculate the value in such material bargaining. Things get more complex when less tangible forces come into play. A parent exchanges attention for love. A company exchanges not only pay but good working conditions for the intellectual and manual efforts of its workforce.
Value exchange works because we each value things differently. If I have a whole flock of sheep but no milk, then I can do business with a person who has a herd of cows but no clothes. This principle of reciprocity is what binds societies together.
Trust in value exchange occurs when we do not know fully whether what we are receiving is what we expect. When we buy a car, don’t want to be sold a ringer which the seller knows is faulty. When I get advice in business, I want it to be based on facts, not wild opinions.

Definition 2: Trust means making an exchange with someone when you do not have full knowledge about them, their intent and the things they are offering to you.

Delayed reciprocity

Exchange is not just about an immediate swapping of cows and sheep or hugs and kisses. What makes companies and societies really work is that something is given now, but the return is paid back some time in the future. The advantage of this is that we can create a more flexible environment, where you can get what you need when you need it, rather than having to save up for it.
Trust now becomes particularly important, because otherwise we are giving something for nothing. The delay we have placed in the reciprocal arrangement adds a high level of uncertainty which we need to mitigate through trust.
What is often called the ‘golden rule’ is a simple formula for creating trust. ‘Do unto others as you would have them do unto you.’ It sets up the dynamic for my giving you something now with the hope of getting back some unspecified thing in the indeterminate future.

Definition 3: Trust means giving something now with an expectation that it will be repaid, possibly in some unspecified way at some unspecified time in the future.

Exposed vulnerabilities

When we trust other people, we may not only be giving them something in hope of getting something else back in the future, we may also be exposing ourselves in a way that they can take advantage of our vulnerabilities. If I buy a car from you and I do not know a good price, you can lie to me so you get a better bargain. If I tell you in confidence about the problems I am having with work, you could use this to further your own career at my expense.
Although the threat of retribution or projected feelings of guilt can counteract your temptation to abuse my exposed vulnerabilities, if you succumb I still get hurt and may still end up with the shorter stick. For our transaction to complete successfully, I must be able to trust that such agonies will not come to pass.

Definition 4: Trust means enabling other people to take advantage of your vulnerabilities—but expecting that they will not do this.

Trust if you do it well, other people will give you the earth. If you betray them, they will hunt you to the ends of the earth.

The Challenge of Conceptualizing Trust and Distrust ..

Resource: D. H. McKnight and N. L. Chervany. Trust and distrust definitions: One bite at a time. In R. Falcone, M. P. Singh, and Y.-H. Tan, editors, Trust in Cyber-societies, volume 2246 of Lecture Notes in Computer Science, pages 27–54. Springer, 2000.

An analysis of the word trust in three unabridged dictionaries (Websters, Random House, and Oxford) showed that trust had far more definitions (9, 24, and 18, respectively) than did the terms cooperation (3, 2, 6), confidence (6, 8, 13), and predictable (1, 2, 1). On average, trust had 17.0 definitions, while the others had an average of 4.7. Trust had close to as many definitions as did the very vague terms ‘love’ and ‘like.’ Hence, trust is by nature hard to narrow down to one specific definition because of the richness of meanings the term conveys in everyday usage.

It is hard to follow and difficult to compare with each other because the term trust is defined in a multitude of different ways. Trust has not only been described as an “elusive” concept [103: 130], but the state of trust definitions has been called a “conceptual confusion” [50: 975], a “confusing potpourri” [86: 625], and even a “conceptual morass” [3: 1, 10: 473].

“ ... trust is a term with many meanings.” – Oliver Williamson
“ Trust is itself a term for a clustering of meanings.” – Harrison White

92% of the definitions that involved trustee characteristics fell within these four categories:

• Benevolence means caring and being motivated to act in one’s interest rather than acting opportunistically [34].
• Integrity means making good faith agreements, telling the truth, and fulfilling promises [9].
• Competence means having the ability or power to do for one what one needs done [3].
• Predictability means trustee actions (good or bad) that are consistent enough to be forecasted in a given situation.

 

points about trust

a centralized approach may raise privacy issues that have to be considered in the system design.

Trust reflects the expectation one actor has about another’s future behavior to perform given activities dependably, securely, and reliably based on experiences collected from previous interactions.

Trust reflects an expectation and, therefore, cannot be expressed objectively. It is influenced by subjective perceptions of the involved actors.

Trust is context dependent and is basically valid within a particular scope only, such as the type of an activity or the membership in a certain team.

Trust relies on previous interactions, i.e., from well-proven previous behavior a prediction of the future is inferred.

Among strangers, trust is understandably much more difficult to build

Source: P. Resnick, K. Kuwabara, R. Zeckhauser, and E. Friedman. Reputation systems. Commun. ACM, 43:45–48, December 2000.

Among strangers, trust is understandably much more difficult to build.
Strangers lack known past histories or the prospect of future interaction, and they are not subject to a network of informed individuals who would punish bad and reward good behavior. In some sense, a stranger’s good name is not at stake. Given these factors, the temptation to “hit and run” outweighs the incentive to cooperate, since the future casts no shadow.

As a solution to the ubiquitous problem of trust in new short-term relationships on the Internet, reputa- tion systems have immediate appeal; the participants themselves create a safe community. Unfortunately, these systems face complex challenges, many of which yield no easy solutions.

Reputation systems are the worst way of building trust on the Internet, except for all those other ways that have been tried from time-to-time.

Trust and Risk

source: D. M. Rousseau, S. B. Sitkin, R. S. Burt, and C. Camerer. Not so different after all: A cross-discipline view of trust. In ACADEMY OF MANAGEMENT REVIEW, volume 23, pages 393–404, 1998.

Across disciplines, there is agreement on the conditions that must exist for trust to arise. Risk is one condition considered essential in psychologi- cal, sociological, and economic conceptualiza- tions of trust (Coleman, 1990; Rotter, 1967; William- son, 1993). Risk is the perceived probability of loss, as interpreted by a decision maker (Chiles & Mc- Mackin, 1996; MacCrimmon & Wehrung, 1986). The path-dependent connection between trust and risk taking arises from a reciprocal relationship: risk creates an opportunity for trust, which leads to risk taking. Moreover, risk taking buttresses a sense of trust when the expected behavior mate- rializes (Coleman, 1990; Das & Teng, this issue). Trust would not be needed if actions could be undertaken with complete certainty and no risk (Lewis & Weigert, 1985). Uncertainty regarding whether the other intends to and will act appro- priately is the source of risk.