Adaptive Information Security

IoT security is a very hot buzzword these days when it comes to new research directions. Unfortunately, it is very ill defined and it is not always clear which, if any, new problem needs to be tackled in that area. This talk will offer a brief overview of what IoT is (or not) as well as of IoT security. It will offer a generic framework to think about it and highlight a couple of new interesting research threads.

In Big Data environments, information is made available as huge data sets or streams, collected and analyzed at different locations, asynchronously and under the responsibility of different authorities. It has become common for such data to be de-normalized, replicated and shuffled in other to boost performance of Big Data applications. Intuition suggests that such Big Data techniques may also boost security risks; for example they may:
increase leakage risk by increasing the value for the attacker per unit of information leaked; or increase intrusion risk, making injection attacks (i.e. attacks aimed at poisoning data for subverting the outcome of analytics) more effective per unit of poisoned information injected. However, no clear methodology is currently available for quantifying the impact of these boosters. This talk will discuss a (semi-)quantitative technique for computing Big Data leakage risk estimates, in order to meaningfully compare them with the quantifiable benefits of semantic enrichment. Also, it will discuss a model and a toolkit for protecting data streams based on the idea of dynamic filters, incrementally built based on the applicable Access Control policy and on the analytics to be performed.