Ensuring software security policies

Access control policies (ACPs) are becoming the new norm for security requirements for businesses to ensure software developers have a clear understanding of security policies.

12/11/2012


ISS SourceThere is a new natural language processing tool that businesses or other users can use to ensure software developers have a clear idea of the security policies they need to incorporate into new software products.

It is all about access control policies (ACPs), which are the security requirements that software developers need to bear in mind when developing new software, said researchers from North Carolina State University and IBM Research. In one case, an ACP for a university grading program needs to allow professors to give grades to students, but should not allow students to change the grades.

“These ACPs are important, but are often buried amidst a lengthy list of other requirements that customers give to developers,” said Dr. Tao Xie, an associate professor of computer science at NC State and co-author of a paper on the research. These requirements are in “natural language,” which is the conversational language people use when talking or corresponding via the written word.

Incomplete or inaccurate ACP requirements can crop up if the customer writing the ACP requirements makes a mistake or doesn’t have enough technical know-how to accurately describe a program’s security needs.

A second problem is programmers may misinterpret some ACP requirements, or overlook them entirely.

In collaboration with IBM Research, Xie’s research team has developed a solution that uses a natural language processing program to extract the ACP requirements from a customer’s overall list of requirements and translate it into machine-readable language that computers can understand and enforce.

After extracting the ACPs, they can be run through Access Control Policy Tool (ACPT) — also developed in Xie’s research team in collaboration with the National Institute of Standards and Technology (NIST) — which verifies and tests the ACPs and determines whether the ACP requirements are adequate to meet the security needs of the program.

Once the ACP requirements translate into machine-readable language, they can also incorporate into a policy-enforcement “engine” in the final software product — which ensures programmers cannot overlook ACPs.

“In general, developing a program that understands natural language text is very challenging,” Xie said. “However, ACP requirements in software documents usually follow a certain style, using terms such as ‘cannot be edited’ or ‘does not have the ability to edit.’ Because ACPs tend to use such a limited number of phrases, it is much easier to develop a program that effectively translates natural language texts in this context.”



No comments
The Engineers' Choice Awards highlight some of the best new control, instrumentation and automation products as chosen by...
The System Integrator Giants program lists the top 100 system integrators among companies listed in CFE Media's Global System Integrator Database.
The Engineering Leaders Under 40 program identifies and gives recognition to young engineers who...
This eGuide illustrates solutions, applications and benefits of machine vision systems.
Learn how to increase device reliability in harsh environments and decrease unplanned system downtime.
This eGuide contains a series of articles and videos that considers theoretical and practical; immediate needs and a look into the future.
Salary and career survey: Benchmarks and advice; Designing controls; Remote data collection, historians; Control valve advances; Hannover Messe; Control Engineering International
System integration: Best practices and technologies to help; Virtualization virtues; Cyber security advice; Motor system efficiency, savings; Product exclusives; Road to Hannover
Collaborative robotics: How to improve safety, return on investment; Industrial Internet of Things, Industrie 4.0: World views; High-performance HMI, Information Integration: OPC and OMG
This article collection contains several articles on the Industrial Internet of Things (IIoT) and how it is transforming manufacturing.
PLCs, robots, and the quest for a single controller; how OEE is key to automation solutions.

Find and connect with the most suitable service provider for your unique application. Start searching the Global System Integrator Database Now!

Getting to the bottom of subsea repairs: Older pipelines need more attention, and operators need a repair strategy; OTC preview; Offshore production difficult - and crucial
Digital oilfields: Integrated HMI/SCADA systems enable smarter data acquisition; Real-world impact of simulation; Electric actuator technology prospers in production fields
Special report: U.S. natural gas; LNG transport technologies evolve to meet market demand; Understanding new methane regulations; Predictive maintenance for gas pipeline compressors
click me