Elevating the Discussion on Security Management: The Data Centric Paradigm

Abstract

Corporate decision makers have normally been Security-conscious enterprises understand that disconnected from the details of the security management managing Information Technology (IT) Security Risk is infrastructures of their organizations. The management of the critical element of their business resilience strategy. security resources has traditionally been the domain of a Lack of proper IT security controls places the entire small group of skilled and technically savvy professionals, enterprise at great risk. In the current business landscape, who report to the executive team. As threats become more IT security mechanisms are not (directly or indirectly) prevalent, attackers get smarter and the infrastructure correlated to business objectives. This lack of a direct link required to secure corporate assets become more complex, makes it is difficult to determine the right level of IT the communication gap between the decision makers and security to be employed by an organization and near the implementers has widened. The risk of impossible to justify investment levels in IT security misinterpretation of corporate strategy into technical safe controls. controls also increases with the above-mentioned trends.In parallel to this phenomenon, it can be observed that In this paper, we articulate a paradigm for managing business and technology factors are making traditional enterprise security called the Data Centric Security Model paradigms of computer security obsolete:(DCSM), which puts IT policy making in the hands of the corporate executives, so that security decisions can be * Integration or federation opens enterprises to their directly executed without the diluting effect of partners and to attacks and fraud originating from interpretation at different levels of the infrastructure and their networks. with the benefit of seeing direct correlation between business objective and security mechanism. Our articulation * Resource sharing, componentization and of the DCSM vision is a starting point for discussion and virtualization reduce barriers that once protected provides a rich platform for research into Business-Driven applications from each other. Security Management. * Provisioning engines and centralized directories (e.g.

A Data-Centric Approach for Privacy-Aware Business Process Enablement

“…These issues will be investigated in the context of the European project Primelife. Recent interest in moving towards data-oriented architectures [25] and other work in data centric security management [26] may influence future work.…”

A Security Risk Assessment Model for Business Process Deployment in the Cloud

“…Different levels of security needs are usually expressed on process data objects ( [16], [17]). As business processes are mainly task-centric (typically a task represents a web service call), we need to relate these data-centric security needs to the tasks of the business process.…”

An experimental study on the measurement of data sensitivity

“…Loss or exposure of data, especially highly sensitive data, can cause a great deal of damage, both tangible and intangible, to the enterprise. Data-centric security has been proposed to provide fine-grained security to important and sensitive data [2]. The concept has gained much enthusiasm among security researchers and practitioners alike, but it has not fully materialized into a practical security system, mostly because enterprises do not have a clear idea of where their sensitive data resides [3].…”