Search

In the original publication of the article, the author name in the seventh reference in the reference section has been misspelled. Now the same has been provided in this correction. © 2020, Springer Nature B.V.

Managing access to resources is one of the security mechanisms used for protecting the organization's assets from unauthorized usage, and thus potential data leaks. Thus, keeping access control policies up to date is a crucial task for any organization. However, the access control policy update process usually requires direct interaction of security specialists, which have knowledge and experience in counteracting abuse of privileges. Therefore, in this paper, we consider access control policies update using collaborative knowledge in the latest cyber activities. We describe the correlation between security policies and security reports using ontology for cybersecurity. Finally, we present a framework that enables access control policies update within the Cloud infrastructure offered by Amazon using Cyber Threat Intelligence.

In this paper, I present the problem of scientific change as an explanatory problem, that is, as a philosophical problem concerning what logical forms of explanation we should employ in order to understand the major conceptual ruptures throughout the history of science. I distinguish between two logical forms of explanation: (a) empirical-scientific and (b) normative explanations. Based on this distinction, I distinguish between the scientific and the liberal versions of naturalism concerning the issue of scientific change. I argue in favor of the latter by showing that normative explanations are indispensable in order to fully understand scientific change. I also argue that we can defend scientific rationality without violating the naturalistic framework which is dominant in contemporary analytic philosophy. I conclude that endorsing scientific realism within a naturalistic framework is the only option for preserving scientific rationality. © The Author(s) 2021.

McDowell’s ‘naturalism of second nature’ is one of the most important at-tempts to defend liberal naturalism in contemporary Anglo-American philosophy. Liberal naturalism stands as an umbrella term for philosophical accounts which place normative entities within the realm of nature. McDowell’s attempt to form an account which leaves room for normativity in nature is based on the distinction between ‘first’ and ‘second’ nature. In the present paper I shall attempt to shed light on McDowell’s notions of ‘first’ and ‘second’ nature and thereby provide an account about the status of normativity which is McDowellian in spirit. However, I suggest that human sciences offer an even more acute challenge to the conceptions of nature that aspire to be liberal naturalist, and I argue that McDowell’s account needs to be completed with a further conceptual distinction in order to cope with the challenge of human sciences. In particular, I argue that we should distin-guish between the notions of explanatory reduction and normative eliminability. © 2020, Edizioni ETS. All rights reserved.

Part 2: Full Papers; International audience; Annotations obtained by Cultural Heritage institutions from the crowd need to be automatically assessed for their quality. Machine learning using graph kernels is an effective technique to use structural information in datasets to make predictions. We employ the Weisfeiler-Lehman graph kernel for RDF to make predictions about the quality of crowdsourced annotations in Steve.museum dataset, which is modelled and enriched as RDF. Our results indicate that we could predict quality of crowdsourced annotations with an accuracy of 75 %. We also employ the kernel to understand which features from the RDF graph are relevant to make predictions about different categories of quality.

In the literature, the validity of theories or models for trust is usually based on intuition and common sense. Theories and models are not often verified experimentally. The research reported here contributes results of experiments on the dynamics of trust over time depending on positive or negative experiences. In previous research a number of dynamic properties for such trust dynamics were identified, but not verified empirically. As a continuation of this work, now these properties have been verified in an experimental setting. The outcomes of the experiment (involving a substantial number of 238 subjects) are discussed and related to the previously formulated dynamic properties.

The Cloud infrastructure service providers currently provision basic virtualized computing resources as on demand and dynamic services but there is no common framework in existence that allows the seamless provisioning of even these basic services across multiple cloud service providers, although this is not due to any inherent incompatibility or proprietary nature of the foundation technologies on which these cloud platforms are built. We present a solution idea which aims to provide a dynamic and service oriented provisioning of secure virtual private networks on top of multiple cloud infrastructure service providers. This solution leverages the benefits of peer to peer overlay networks, i.e., the flexibility and scalability to handle the churn of nodes joining and leaving the VPNs and can adapt the topology of the VPN as per the requirements of the applications utilizing its intercloud secure communication framework.

International audience; The analysis of security incidents and frauds has shown that several vulnerabilities of IT systems are due to loopholes in the policies and procedures adopted by organizations as well as in their structure. Organizations have thus to address security and dependability issues by analyzing their organizational setting. In this paper, we present a methodology to support the deployment of Security & Dependability patterns according to their position in the Enterprise Architecture and the underlying system infrastructures. The methodology discriminates the pattern deployment process between recommendations and guidelines. Recommendations concretize the deployment with refined software and/or hardware related patterns, whereas guidelines specify the organizational patterns in terms of the system-to-be, proposing human-resource and/or policy solutions. To make the discussion more concrete, we illustrate the framework with a case study on an emergency scenario within a remote healthcare system.

In this paper we study probable innocence, a notion of probabilistic anonymity provided by protocols such as Crowds. The authors of Crowds, Reiter and Rubin, gave a definition of probable innocence which later has been interpreted by other authors in terms of the probability of the users from the point of view of the observer. This formalization however does not seem to correspond exactly to the property that Reiter and Rubin have shown for Crowds, the latter, in fact, is independent from the probability of the users.We take the point of view that anonymity should be a concept depending only on the protocol, and should abstract from the probabilities of the users. For strong anonymity, this abstraction leads to a concept known as conditional anonymity. The main goal of this paper is to establish a notion which is to probable innocence as conditional anonymity is to strong anonymity. We show that our definition, while being more general, corresponds exactly to the property that Reiter and Rubin have shown for Crowds, under specific conditions. We also show that in the particular case that the users have uniform probabilities we obtain a property similar to the definition of probable innocence given by Halpern and O’Neill.

The last years have seen a number of proposals to incorporate Security Engineering into mainstream Software Requirements Engineering. However, capturing trust and security requirements at an organizational level (as opposed to a design level) is still an open problem.This paper presents a formal framework for modeling and analyzing security and trust requirements. It extends the Tropos methodology, an agent-oriented software engineering methodology. The key intuition is that in modeling security and trust, we need to distinguish between the actors that manipulate resources, accomplish goals or execute tasks, and actors that own the resources or the goals. To analyze an organization and its information systems, we proceed in two steps. First, we built a trust model, determining the trust relationships among actors, and then we give a functional model, where we analyze the actual delegations against the trust model, checking whether an actor that offers a service is authorized to have it. The formal framework allows for the automatic verification of security and trust requirements by using a suitable delegation logic that can be mechanized within Datalog. To make the discussion more concrete, we illustrate the proposal with a Health Care case study.