a solution model and tool for supporting the negotiation of security decisions in e-business...

1

A Solution Model and Tool for Supporting the Negotiation of Security

Decisions in

E-Business Collaborations

Presented by Ashish Joshi Master of Business Consulting

2

Security in E business

• In today’s world people are using web services more and more with the increase in the enabling technologies

• The security related questions are also increasing and E business has become a driving factor behind many security initiatives

• There are lots of security related challenges that an organization has to face to realize the scope of the use of E business

• Also in the collaboration of B2B business, the security of interactions between two companies has to be maintained with high priority

• A very good example of this security challenge is the E partnering companies, who have to share, compare and negotiate their individual security requirements

• The ability to negotiate security contracts is a very important aspect for trustworthy and flexible Business to Business web services interactions

Sources: A Solution Model and Tool for Supporting the Negotiation of Security Decisions in E-Business Collaborations Jason R. C. Nurse and Jane E. SinclairAn Evaluation of BOF4WSS and the Security Negotiations Model and Tool used to Support it Jason R. C. Nurse and Jane E. Sinclairhttp://icsa.cs.up.ac.za/issa/2009/Proceedings/Full/36_Paper.pdf, a frame work for Web services Security Policy negotiations

http://icsa.cs.up.ac.za/issa/2009/Proceedings/Full/36_Paper.pdf

3

Business Oriented Framework for enhancing Web Services –security for e Business

• Emphasizes on a detailed cross enterprise development methodology to ensure the secured and trusted interactions between two collaborating e Business

• This framework helps to reach the agreed security levels between the companies and to develop the cooperation required to work together

• This framework encompasses technologies, processes, policies and strategies to create a multilayered security solution

• Provide a framework for security policy negotiation system that can be used to negotiate a security contract

• A very good example of this security challenge is the E partnering companies, who have to share, compare and negotiate their individual security requirements

Source: An Evaluation of BOF4WSS and the Security Negotiations Model and Tool used to Support it Jason R. C. Nurse and Jane E. Sinclair

4

Security actions and Requirements

• This work focuses specifically on the negotiation of security actions and requirements

• The security action is defined as any high level way in which a company handles a risk it faces

• The security requirement is a high to medium level desire to mitigate a risk

• Problems faced by the companies in the transition stage of individually accomplished requirements elicitation stage to the subsequent negotiation stage

• These problems include: Understanding other companies security documentation Understanding the motivation behind security actions requirements Matching and comparing of security actions which signifies the same situation Compiling motivating security actions to apply to the foreseen business scenario

• The solution model and tool for the security negotiation is created considering the above mentioned difficulties

• Aims to streamline the negotiation task and to ease the transition phase for both the companies


5

BOF4WSS Framework

The BOF4WSS framework consists of nine phases

Requirement Elicitation

Negotiations

Agreements

Analysis/Architectural

Agreements

System Design

Agreements

Development & Testing

Maintenance


6

The Requirement Elicitation Phase

This phase is to determine the requirements for the expected web service business scenario

each company largely works by itself and analyses the internal business objectives, constraints, relevant laws, security policies and so on

Involves gathering relevant knowledge about the process domain and what influences it and then analyzing and modeling of current processes

Then there should be a modeling of new processes and at last actual requirement determination


7

The Negotiation Phase

teams consisting of project managers, business and system analysts, domain experts and IT security professional from each company meet

bring together their requirements from the requirement elicitation stage for discussions and negotiations

inputs are used to map an agreed path for the business requirements as per the varying expectations of the companies towards the security

Discussion and negotiation on functional and quality requirements, Security actions and requirements


8

The Agreement Phase

legal contract is made between the companies to cement the understanding of the requirements

followed by a construct called Interaction security strategy

The ISS defines high level, cross enterprise security directives to guide the interaction


9

The Analysis Architectural Phase

This phase aims at defining the conceptual business process model

for the interactions

Creates a blue print for the high to medium level

process flow and respective security

architectures


10

The Agreement Phase

BOF4WSS advises another –agreement for a more intensive

legal contract

Detailed requirement and expectations of

the companies involved

Workflow model of the agreement phase


11

The System -Design Phase

The design phase aims to define the conceptual model from the architectural phase

The identification of the relevant WS standards

Trade off analysis of their use and the actual application standards where appropriate


12

The Agreements (for QoS) Phase

This is the agreement phase that focuses on the agreements at the Qualities of service level

this agreement is to specify the mutual understanding of the priorities, responsibilities, and guarantees expected by each business


13

The Development & Testing Phase

In this phase the actual development, implementation, deployment and testing of services and system is carried out

carried out by the companies individually however joint interactions are appreciated for testing and system verification to previously established requirements


14

The Maintenance Phase

After the development of the multilayered security solution the upkeep and maintenance becomes the crucial task

This phase involves functional enhancement and also continued updating and enforcement of security measures both in developed systems and ISS


15

Supporting BOF4WSS and the transition between its phases

The Stage Transition Problem

•The stage transition problem was analysed by inteviewing the security professional

• This analysis relates to the problem faced by the companies using BOF4WSS framework during Requirement elicitation and negotiation stages

• Three main aspects were concluded out of this analysis:

1. Understanding the security actions document of the company before the negotiation can take place. This problem relates to the semantic issue

2. Understanding the motivation behind other companies’ security actions and requirements to determine exactly why that security desire existed

3. Comparison of companies security actions and requirements to match the implicit or explicit security actions of the companies which targeted the same situation and risks

Source: A Solution Model and Tool for Supporting the Negotiation of Security Decisions in E-Business Collaborations Jason R. C. Nurse and Jane E. Sinclair

16

The Solution Model

in depth analysis of the security actions and requirements particularly in the risk management field to derive to some critical factors like motivation behind a security action

Ontology design is used to provide a common understanding of the security actions and risk management based on the analysis from security action analysis

formal language is used at the end of requirement elicitation which would allow the automation so that the encoded data could be processed by machine. For language definition purpose an XML based language is preferred

This catalogue contains an updatable extensive listing of security risks which can be used by companies as a common input to their risk management processes


17

Security action specification and comparison system (SASaCS)

• SASaCS is the software implementation of the Solution model

• It contains the necessary elements for the presentation, negotiation, sharing, comparison and negotiation of security actions between comoanies in B2B Web services

• After the companies complete their risk management activities and have compiled their individual security actions the compiled data is transferred to SASaCS tool

• The three features of this system are:

1. Data entry interface

2. Comparison system report output

3. The encoding system (XML language)


18

Security action specification and comparison system (SASaCS)

Security action data entry assuming two companies Supplier and Buyer


19

Security action Report Output


20

The Language

• The encoding of the Data is done by presenting the XML based language

• XML is markup language that is used to encode data in a format that is readable for machines and human both

• In this case the language is called Security Actions Definitions Markup Language (SADML)

• This language was structured to represent the information captured in the ontology

<needs Base xmlns="urn:risksx-schema" ... ><mitigationActions><mitigationAction><name>Risk action for auditing/logging...</name><details>Auditing/logging of interactions...</details><risks>+ <risk id="GR1">+ <risk id="GR2">+ <risk id="GR3"></risks><lawAndRegRefs><lawAndRegRef idref="LR22"><relationToRiskAction>SOX Act was key to this mitigationdecision based on...</relationToRiskAction></lawAndRegRef></lawAndRegRefs>+ <securityPolicyRefs>+ <securityRequirementRefs></mitigationAction></mitigationActions>+ <acceptanceActions><transferenceActions /> <avoidanceActions /> + <lawsAndRegs>+ <securityPolicies>+ <securityRequirements></needsBase>

21

Evaluation

• First area of investigation was whether the framework BOF4WSS is an applicable, practical proposal which would enhance the security and trust between the organizations

• Second whether, the solution model and tool provides a viable solution to support transition between requirement elicitation and negotiation phases

• Compatibility of SASCS and ontology and to assess the use of SASCS in the negotiation process using the BOF4WSS framework

• For First two investigation a qualitative research strategy was chosen in which digitally recorded, semi structured interviews were employed in order to gather the insightful data for the analysis

• The interviewees consisted of security professionals with good experience

• To evaluate the compatibility two risk management approaches were chosen i.e. CORAS and EBIOS

• CORAS is a method for conducting a security risk analysis and provides a customized language

• EBIOS has a methodological approach and provides a consistent view of Information system security

Source: A Solution Model and Tool for Supporting the Negotiation of Security Decisions in E-Business Collaborations Jason R. C. Nurse and Jane E. SinclairAn Evaluation of BOF4WSS and the Security Negotiations Model and Tool used to Support it Jason R. C. Nurse and Jane E. Sinclair

22

Findings and Conclusion

Framework Analysis

• With the help of this framework companies consider all the factors

• Help an inexperienced person and create a level of visibility and ability to audit

• Interviewees gave a positive feedback on the matter of trust

• This framework get the companies together to interact, collaborate, and discuss and plan interactions security

• BOF4WSS would be beneficial for the small and medium sized companies seeking to build long term partnerships

• The frameworks detailed guidance would be quite useful because there might be a lack of expertise and experience


23


Solution Model Analysis

• The professionals interviewed observed the transition problem as severe and viewed them as serious issues in projects

• Companies are not aware of the motivation behind the security actions and the inexperience of the negotiator in the negotiation process

• Enhance trust and existing relationship since the companies are required to share detailed information on related risks and security actions

• Experienced security professionals supported for the viability of the solution model in aiding the transition between requirement elicitation and negotiations phases of BOF4WSS


24


Analysis on SASaCS Software

• SASaCS proved to be compatible solution since it was able to capture most of the information output from CORAS and EBIOS

• The core concept such as risks, security, security actions, risk treatment and security requirements were covered

• In the ontology and therefore in SASaCS based on the investigation, it was concluded that security actions primary originated to handle risks

• This was disproved by EBIOS as a security action could be created to directly address constraints, regulations, or security rules and policies

• In the ontology and tool, laws and regulation, security and business policies and security budgets were defined as prime factors which motivated a risks treatment

• Mapping evaluation however showed that here were various other aspects which influenced and by themselves lead to the creation of security actions


Presented by Ashish Joshi Master of Business Consulting

25

Thanks for Your Kind Attention

a solution model and tool for supporting the negotiation of security decisions in e-business...

Documents

security of interactions

security challenge

security contracts

security initiatives

security actions requirements

security negotiations

sinclair security actions

motivating security