Data and Applications Security Developments and Directions Dr

Data and Applications Security Developments and Directions Dr. Bhavani Thuraisingham The University of Texas at Dallas Introduction to the Course August 20, 2010

Objective of the Unit l This unit provides an overview of the course. The course describes concepts, developments, challenges, and directions in data and applications security. Topics include - database security, distributed data management security, object security, data warehouse security, data mining for security applications, privacy, secure semantic web, secure digital libraries, secure knowledge management and secure sensor information management, biometrics

Outline of the Unit l Outline of Course l Course Work l Course Rules l Contact l Appendix

Outline of the Course l Unit #1: Introduction to Data and Applications l Part I: Background - Unit #2: Data Management - Unit #3: Information Security - Unit #4: Information Management l Part II: Discretionary Security - Unit #5: Concepts - Unit #6: Policy Enforcement l Part III: Mandatory Security - Unit #7: Concepts - Unit #8: Architectures

Outline of the Course (Continued) l Part IV: Secure Relational Data Management - Unit #9: Data Model - Unit #10: Functions - Unit #11: Prototypes and Products l Part V: Inference Problem - Unit #12: Concepts - Unit #13: Constraint Processing - Unit #14: Conceptual Structures l Part VI: Secure Distributed Data Management - Unit #15: Secure Distributed data management - Unit #16: Secure Heterogeneous Data Integration - Unit #17: Secure Federated Data Management

Outline of the Course (Continued) l Part VII: Secure Object Data Management - Unit #18: Secure Object Management Unit #19: Secure Distributed Objects and Modeling Applications Unit #20: Secure Multimedia Systems l Part VIII: Data Warehousing, Data Mining and Security - Unit #21: Secure Data Warehousing Unit #22: Data Mining for Security Applications Unit #23: Privacy l Part IX: Secure Information Management - Unit #24: Secure Digital Libraries Unit #25: Secure Semantic Web (web services, XML security) Unit #26: Secure Information and Knowledge Management

Outline of the Course (Continued) l Part X: Emerging Technologies - Unit #27: Secure Dependable Data Management - Unit #28: Secure Sensor and Wireless Data Management - Unit #29: Other Emerging Technologies l Unit #30 Conclusion to the Course l Guest Lectures Some guest lectures may be included l Some other topics l Review for finals

Course Work (November 26 is a holiday) l Three term papers; each worth 9 points (October 22, November 5 or 12, November 19) l Two exams each worth 15 points Exam #1 (October 22), Exam #2 (December 3); Any two hour period between 12: 30 and 3: 15 l Programming project worth 15 points Due day; the day of the final exam (December 3) l Four homework assignments each worth 7 points Due dates: will be announced (September 17, October 8, October 29, November 12) l Total 100 points l Course Book: Database and Applications Security: Integration Data Management and Information Security, Bhavani Thuraisingham, CRC Press, 2005 l Will also include papers as reading material -

Some Topics for Papers l XML Security l Inference Problem l Privacy l Secure Biometrics l Intrusion Detection l E-Commerce Security l Secure Sensor Information Management l Secure Distributed Systems l Secure Semantic Web l Secure Data Warehousing l Insider Threat Analysis l Secure Multimedia Systems

Term Papers: Example Format l Abstract l Introduction l Background on the Topic l Survey of various techniques, designs etc, l Analyze the techniques, designs etc. and give your opinions l Directions for further work l Summary and Conclusions l References

Term Papers: Example Format - II l Abstract l Introduction l Background on the Topic and Related Work l Discuss strengths and weaknesses of your work and others’ work l Give your own design l Directions for further work l Summary and Conclusions l References

Project Report Format l Overview of the Project l Design of the System l Input/Output l Future Enhancements l References

Some Project Topics l Quivery Modification on XML Documents l Access control for web systems l Intrusion detection system l Access control for multimedia systems - E. g. , access control for image, video l Role-based access control system l Access control for object systems l Secure data warehouse

Course Rules l Course attendance is mandatory; unless permission is obtained from instructor for missing a class with a valid reason (documentation needed for medical emergency for student or a close family member – e. g. , spouse, parent, child). Attendance will be collected every lecture. 5 points will be deducted out of 100 for each lecture missed without approval. l Each student will work individually l Late assignments will not be accepted. All assignments have to be turned in just after the lecture on the due date l No make up exams unless student can produce a medical certificate or give evidence of close family emergency l Copying material from other sources will not be permitted unless the source is properly referenced l Any student who plagiarizes from other sources will be reported to the appropriate UTD authroities

Contact l For more information please contact - Dr. Bhavani Thuraisingham - Professor of Computer Science and - Director of Cyber Security Research Center Erik Jonsson School of Engineering and Computer Science EC 31, The University of Texas at Dallas Richardson, TX 75080 - Phone: 972 -883 -4738 - Fax: 972 -883 -2399 - Email: bhavani. thuraisingham@utdallas. edu - URL: http: //www. utdallas. edu/~bxt 043000/

Papers to Read for Exam #1 l http: //csrc. utdallas. edu/University_of_Bristol_August_5_2010. pdf l Design and Implementation of a Database Inference Controller, Data and Knowledge Engineering Journal, December 1993 (North Holland), Vol. 11, No. 3 (co-authors: W. Ford, M. Collins, J. O'Keeffe); (Article reprinted by the MITRE Journal, 1994). l Security Constraint Processing in a Multilevel Secure Distributed Database Management System, IEEE Transactions on Knowledge and Data Engineering, April 1995 (co-author: W. Ford). l The Use of Conceptual Structures to Handle the Inference Problem, Proceedings of the 5 th IFIP WG 11. 3 Conference on Database Security, Shepherdstown, VA. , November 1991 (Also published by North Holland, 1992)

Papers to Read for Exam #1 l http: //csrc. utdallas. edu/University_of_Bristol_August_5_2010. pdf l Design and Implementation of a Query Processor for a Trusted Distributed database management system, Journal of Systems and Software 1993 l Bhavani M. Thuraisingham: Mandatory Security in Object. Oriented Database Systems. OOPSLA 1989: 203 -210 (ACM) l Hybrid Model to Detect Malicious Executables, ICC 2007 (Masud, Khan and Thuraisingham)

Paper to Read for Exam #1 l Rakesh Agrawal, Ramakrishnan Srikant: Privacy-Preserving Data Mining. SIGMOD Conference 2000: 439 -450 l RBAC: Ravi S. Sandhu, Edward J. Coyne, Hal L. Feinstein, Charles E. Youman: Role-Based Access Control Models. IEEE Computer 29(2): 38 -47 (1996) l UCON: Jaehong Park, Ravi S. Sandhu: The UCONABC usage control model. ACM Trans. Inf. Syst. Secur. 7(1): 128 -174 (2004) - first 20 pages l DCON: Roshan K. Thomas, Ravi S. Sandhu: Towards a Multidimensional Characterization of Dissemination Control. POLICY 2004: 197 -200 (IEEE)