SciTePress - Affiliation Profile

FONDAZIONE BRUNO KESSLER, Italy

Context (please use complete words only)

Field

Sort by

15 Papers

Multi-Stakeholder Cybersecurity Risk Assessment for Data Protection

Topics: Risk Assessment; Personal Data Protection for Information Systems

Authors: Majid Mollaeefar ¹ , Alberto Siena ² and Silvio Ranise ²

Affiliations: ¹ Security and Trust, Fondazione Bruno Kessler, Trento, Italy, DIBRIS, University of Genova, Genova, Italy , ² Security and Trust, Fondazione Bruno Kessler, Trento, Italy

Digital Object Identifier: 10.5220/0009822703490356

Proceedings of SECRYPT 2020, ISBN: 978-989-758-446-6

Quick Abstract

To ensure the effectiveness of the adopted security measures and minimize the impact of security issues on the rights and freedom of individuals, the General Data Protection Regulation (GDPR) requires to carry out a Data Processing Impact Assessment (DPIA). Such an assessment differs from traditional risk analyses in which the actor carrying out the evaluation is also the one interested in reducing its risk. Conflicts may thus arise between the need of protecting data subjects rights and organizations that shall provide adequate security measures while struggling with various types of constraints (e.g., budget). To alleviate this problem, we introduce the Multi-Stakeholder Risk Trade-off Analysis Problem, (MSRToAP) and propose an automated technique to solve their instances. We then show how this can help data controllers make more informed decisions about which security mechanisms allow for a better trade-off between their requirements and those of the data subjects. For concreteness, we illustrate the proposed on a simple yet realistic use case scenario.

Multi-view Data Capture using Edge-synchronised Mobiles

Topics: Entertainment Imaging Applications; Mobile Imaging; Mobile Vision

Authors: Matteo Bortolon , Paul Chippendale , Stefano Messelodi and Fabio Poiesi

Affiliation: Fondazione Bruno Kessler, Trento, Italy

Digital Object Identifier: 10.5220/0008971807300740

Proceedings of VISAPP 2020, ISBN: 978-989-758-402-2

Quick Abstract

Multi-view data capture permits free-viewpoint video (FVV) content creation. To this end, several users must capture video streams, calibrated in both time and pose, framing the same object/scene, from different viewpoints. New-generation network architectures (e.g. 5G) promise lower latency and larger bandwidth connections supported by powerful edge computing, properties that seem ideal for reliable FVV capture. We have explored this possibility, aiming to remove the need for bespoke synchronisation hardware when capturing a scene from multiple viewpoints, making it possible through off-the-shelf mobiles. We propose a novel and scalable data capture architecture that exploits edge resources to synchronise and harvest frame captures. We have designed an edge computing unit that supervises the relaying of timing triggers to and from multiple mobiles, in addition to synchronising frame harvesting. We empirically show the benefits of our edge computing unit by analysing latencies and show the quality of 3D reconstruction outputs against an alternative and popular centralised solution based on Unity3D.

A Tool-assisted Methodology for the Data Protection Impact Assessment

Topics: Personal Data Protection for Information Systems; Data Protection; Privacy; Security and Privacy Policies

Authors: Salimeh Dashti ¹ and Silvio Ranise ²

Affiliations: ¹ Security and Trust-Fondazione Bruno Kessler, Trento, Italy, DIBRIS-University of Genoa, Genoa and Italy , ² Security and Trust-Fondazione Bruno Kessler, Trento and Italy

Digital Object Identifier: 10.5220/0007932202760283

Proceedings of SECRYPT 2019, ISBN: 978-989-758-378-0

Quick Abstract

We propose a pragmatic methodology to the Data Protection Impact Assessment (DPIA) based on a tool capable of assisting users during crucial activities such as data processing specification and risk analysis. Previous work on compliance checking and our experience in developing a DPIA methodology for the Public Administration of the province of Trento in Italy are the basis of this work.

Related Ontology Subjects/Areas/Topics (6)

Data and Application Security and Privacy		Information and Systems Security		Privacy
Data Protection		Personal Data Protection for Information Systems		Security and Privacy Policies

A Wizard-based Approach for Secure Code Generation of Single Sign-On and Access Delegation Solutions for Mobile Native Apps

Topics: Identity Management; Security and Privacy in Mobile Systems; Security Protocols

Authors: Amir Sharif ¹ , Roberto Carbone ² , Silvio Ranise ² and Giada Sciarretta ²

Affiliations: ¹ Fondazione Bruno Kessler, Trento, Italy, DIBRIS- University of Genoa, Genoa and Italy , ² Fondazione Bruno Kessler, Trento and Italy

Digital Object Identifier: 10.5220/0007930502680275

Proceedings of SECRYPT 2019, ISBN: 978-989-758-378-0

Quick Abstract

Many available mobile applications (apps) have poorly implemented Single Sign-On and Access Delegation solutions leading to serious security issues. This could be caused by inexperienced developers who prioritize the implementation of core functionalities and/or misunderstand security critical parts. The situation is even worse in complex API scenarios where the app interacts with several providers. To address these problems, we propose a novel wizard-based approach that guides developers to integrate multiple third-party Identity Management (IdM) providers in their apps, by (i) “enforcing” the usage of best practices for native apps, (ii) avoiding the need to download several SDKs and understanding their online documentations (a list of known IdM providers with their configuration information is embedded within our approach), and (iii) automatically generating the code to enable the communication with the different IdM providers. The effectiveness of the proposed approach has been assessed by implementing an Android Studio plugin and using it to integrate several IdM providers, such as OKTA, Auth0, Microsoft, and Google.

Related Ontology Subjects/Areas/Topics (5)

Data and Application Security and Privacy		Information and Systems Security		Security Protocols
Identity Management		Security and Privacy in Mobile Systems

Learning from Others’ Mistakes: An Analysis of Cyber-security Incidents

Topics: Security, Privacy and Risk; Conceptual frameworks and models; Surveys and their quantitative analysis

Authors: Giovanni Abbiati ¹ , Silvio Ranise ² , Antonio Schizzerotto ³ and Alberto Siena ²

Affiliations: ¹ Fondazione Rodolfo Debenedetti, Milan, Italy, Fondazione Bruno Kessler, Trento and Italy , ² Fondazione Bruno Kessler, Trento and Italy , ³ University of Trento, Trento, Italy, Fondazione Bruno Kessler, Trento and Italy

Digital Object Identifier: 10.5220/0007721202990306

Proceedings of IoTBDS 2019, ISBN: 978-989-758-369-8

Quick Abstract

Cyber security incidents can have dramatic economic, social and institutional impact. The task of providing an adequate cyber-security posture to companies and organisations is far far from trivial and need the collection of information about threats from a wide range of sources. One such a source is history in the form of datasets containing information about past cyber-security incidents including date, size, type of attacks, and industry sector. Unfortunately, there are few publicly available datasets of this kind that are of good quality. The paper reports our initial efforts in building a large datasets of cyber-security incidents that contains around 14,000 entries by merging a collection of four publicly available datasets of different size and provenance. We also perform an analysis of the combined dataset, discuss our findings, and discuss the limitations of the proposed approach.

Security of Mobile Single Sign-On: A Rational Reconstruction of Facebook Login Solution

Topics: Identity Management; Security and Privacy in Mobile Systems; Security Protocols

Authors: Giada Sciarretta ¹ , Alessandro Armando ² , Roberto Carbone ³ and Silvio Ranise ³

Affiliations: ¹ FBK-Irst and University of Trento, Italy , ² FBK-Irst and University of Genova, Italy , ³ FBK-Irst, Italy

Digital Object Identifier: 10.5220/0005969001470158

Proceedings of SECRYPT 2016/ICETE, ISBN: 978-989-758-196-0

Quick Abstract

While there exist many secure authentication and authorization solutions for web applications, their adaptation in the mobile context is a new and open challenge. In this paper, we argue that the lack of a proper reference model for Single Sign-On (SSO) for mobile native applications drives many social network vendors (acting as Identity Providers) to develop their own mobile solution. However, as the implementation details are not well documented, it is difficult to establish the proper security level of these solutions. We thus provide a rational reconstruction of the Facebook SSO flow, including a comparison with the OAuth 2.0 standard and a security analysis obtained testing the Facebook SSO reconstruction against a set of identified SSO attacks. Based on this analysis, we have modified and generalized the Facebook solution proposing a native SSO solution capable of solving the identified vulnerabilities and accommodating any Identity Provider.

Related Ontology Subjects/Areas/Topics (5)

Data and Application Security and Privacy		Information and Systems Security		Security Protocols
Identity Management		Security and Privacy in Mobile Systems

Modeling Authorization Policies for Web Services in Presence of Transitive Dependencies

Topics: Access Control; Organizational Security Policies; Security and Privacy in Web Services

Authors: Worachet Uttha ¹ , Clara Bertolissi ² and Silvio Ranise ³

Affiliations: ¹ LIF and CNRS UMR 7279 & AMU, France , ² LIF, CNRS UMR 7279 & AMU and Fondazione Bruno Kessler, France , ³ Fondazione Bruno Kessler, Italy

Digital Object Identifier: 10.5220/0005548502930300

Proceedings of SECRYPT 2015/ICETE, ISBN: 978-989-758-117-5

Quick Abstract

Access control is a crucial issue for the security of Web Services. Since these are independently designed, implemented, and managed, each with its own access control policy, it is challenging to mediate the access to the information they share. In this context, a particularly difficult case occurs when a service invokes another service to satisfy an initial request, leading to indirect authorization errors. To overcome this problem, we propose a new approach based on a version of ORganization Based Access Control (OrBAC) extended by a delegation graph to keep track of transitive authorization dependencies. We show that Datalog can be used as the specification language of our model. As a byproduct of this, an automated analysis technique for simulating execution scenarios before deployment is proposed. Finally, we show how to implement an enforcement mechanism for our model on top of the XACML architecture. To validate our approach, we present a case study adapted from the literature.

Related Ontology Subjects/Areas/Topics (9)

Access Control	Information and Systems Security	Organizational Security Policies
Data Engineering	Information Assurance	Security and Privacy in Web Services
Databases and Data Security	Internet Technology	Web Information Systems and Technologies

QuESo - A Quality Model for Open Source Software Ecosystems

Topics: Software Quality; Software Metrics; Quality Assurance

Authors: Oscar Franco-Bedoya ¹ , David Ameller ² , Dolors Costal ² and Xavier Franch ²

Affiliations: ¹ Universitat Politècnica de Catalunya and Universidad de Caldas, Spain , ² Universitat Politècnica de Catalunya, Spain

Digital Object Identifier: 10.5220/0004993702090221

Proceedings of ICSOFT-EA 2014/ICSOFT, ISBN: 978-989-758-036-9

Quick Abstract

Open source software has witnessed an exponential growth in the last two decades and it is playing an increasingly important role in many companies and organizations leading to the formation of open source software ecosystems. In this paper we present a quality model that will allow the evaluation of those ecosystems in terms of their relevant quality characteristics such as health or activeness. To design this quality model we started by analysing the quality measures found during the execution of a systematic literature review on open source software ecosystems and, then, we classified and reorganized the set of measures in order to build a solid quality model.

Related Ontology Subjects/Areas/Topics (6)

Quality Assurance		Software Engineering		Software Project Management
Service-Oriented Software Engineering and Management		Software Metrics		Software Quality Management

RISCOSS: Managing Risk and Costs in Open Source Software Adoption

Authors: Manuel Dominguez-Dorado ¹ , Nili Bergida ² , Ron Kenett ² , Dolors Costal ³ , Maria Carmela Annosi ⁴ , Cedric Thomas ⁵ , Kirsten Haaland ⁶ , Claudia Ayala ³ , Fabio Mancinelli ⁷ , Pop Ramsamy ⁸ , Jorge Martín ⁸ , Angelo Susi ⁹ , Daniel Gross ⁹ , Yehuda Blumenfeld ² , Ron Ben-Jacob ¹⁰ , Olivier Bouzereau ⁵ , Stijn Bannier ⁶ , Oscar Franco Bedoya ¹¹ , Nikolas Galanis ¹² , Marc Oriol ¹² , Alberto Siena ¹³ , Mirko Morandini ¹⁴ , Ruediger Glott ⁶ , Lidia López ¹¹ , Xavier Franch ¹¹ and David Ameller ³

Affiliations: ¹ CENATIC - Spanish National Competence Center for the Application of Opensource Technologies, Spain , ² KPA, Israel , ³ UPC, Spain , ⁴ Ericsson, Italy , ⁵ OW2, France , ⁶ UMM, Netherlands , ⁷ XWiki, France , ⁸ CENATIC, Spain , ⁹ Fondazione Bruno Kessler, Italy , ¹⁰ KPA Ltd., Israel , ¹¹ Universitat Politècnica de Catalunya, Spain , ¹² Universitat Politècnica de Catalunya - BarcelonaTech, Spain , ¹³ Center for Scientific and Technological Research FBK-Irst, Italy , ¹⁴ FBK, Italy

Digital Object Identifier: 10.5220/0006144600560077

Proceedings of EPS Vienna 2014, ISBN: 978-989-758-101-4

Quick Abstract

Open Source Software (OSS) has become a strategic asset in software development, and open source communities behind OSS are a key player in the field. By 2016 an estimated 95% of all commercial software packages will include OSS. This extended adoption is yet not avoiding failure rates in OSS projects to be as high as 50%. Inadequate risk management has been identified among the top mistakes to avoid when implementing OSS-based solutions. Understanding, managing and mitigating OSS adoption risks is therefore crucial to avoid potentially significant adverse impact on the business. This chapter introduces the RISCOSS decision support platform. RISCOSS develops a risk managementbased methodology to facilitate the adoption of open source code into mainstream products and services. RISCOSS develops a methodology and a software platform that integrate the whole decision-making chain, from technology criteria to strategic concerns. Using advanced software engineering techniques and risk management methodologies, RISCOSS develops innovative tools and methods to identify, manage and mitigate risks of integrating third-party open source software. RISCOSS is the only platform to deliver a complete solution rather than a piecemeal approach to enable mainstream product developers to safely integrate open source software in their developments. Itself an open source project, RISCOSS is open to third party contributions to help the platform grow in functionalities and make the transition to a fully marketable product or service. The platform will be validated against a collection of use cases coming from different types of organizations and emergent small OSS products.

Managing Risk in Open Source Software Adoption

Topics: Model-Driven Engineering; Requirements Elicitation and Specification; Risk Management

Authors: Xavier Franch ¹ , Angelo Susi ² , Maria C. Annosi ³ , Claudia Ayala ¹ , Ruediger Glott ⁴ , Daniel Gross ² , Ron Kenett ⁵ , Fabio Mancinelli ⁶ , Pop Ramsamy ⁷ , Cedric Thomas ⁸ , David Ameller ⁹ , Stijn Bannier ⁴ , Nili Bergida ⁵ , Yehuda Blumenfeld ⁵ , Olivier Bouzereau ⁸ , Dolors Costal ⁹ , Manuel Dominguez ⁷ , Kirsten Haaland ⁴ , Lidia Lopez ⁹ , Mirko Morandini ² and Alberto Siena ¹⁰

Affiliations: ¹ Universitat Politècnica de Catalunya (UPC) and, Spain , ² Fondazione Bruno Kessler (FBK), Italy , ³ Ericsson Telecomunicazioni, Italy , ⁴ University of Maastricht (UMM), Netherlands , ⁵ KPA Ltd., Israel , ⁶ XWiki SAS, France , ⁷ CENATIC, Spain , ⁸ OW2, France , ⁹ Universitat Politècnica de Catalunya (UPC), Spain , ¹⁰ FBK, Italy

Digital Object Identifier: 10.5220/0004592802580264

Proceedings of ICSOFT-EA 2013/ICSOFT, ISBN: 978-989-8565-68-6

Quick Abstract

Related Ontology Subjects/Areas/Topics (10)

Applications	Operational Research	Software Engineering
Cross-Feeding between Data and Software Engineering	Requirements Elicitation and Specification	Software Engineering Methods and Techniques
Methodologies and Technologies	Risk Management	Software Project Management
Model-Driven Engineering

Topic(s):

Title:
ISBN:
Year:
Acronym:
Subject:

Title:
Author:
Affiliation:
Subject:

Name:
Affiliation:
Country:
Conference:
Subject:

Name:
Country:
Subject:

Affiliation

Filter listed results, by