Ensuring software security policies

Access control policies (ACPs) are becoming the new norm for security requirements for businesses to ensure software developers have a clear understanding of security policies.

12/11/2012


ISS SourceThere is a new natural language processing tool that businesses or other users can use to ensure software developers have a clear idea of the security policies they need to incorporate into new software products.

It is all about access control policies (ACPs), which are the security requirements that software developers need to bear in mind when developing new software, said researchers from North Carolina State University and IBM Research. In one case, an ACP for a university grading program needs to allow professors to give grades to students, but should not allow students to change the grades.

“These ACPs are important, but are often buried amidst a lengthy list of other requirements that customers give to developers,” said Dr. Tao Xie, an associate professor of computer science at NC State and co-author of a paper on the research. These requirements are in “natural language,” which is the conversational language people use when talking or corresponding via the written word.

Incomplete or inaccurate ACP requirements can crop up if the customer writing the ACP requirements makes a mistake or doesn’t have enough technical know-how to accurately describe a program’s security needs.

A second problem is programmers may misinterpret some ACP requirements, or overlook them entirely.

In collaboration with IBM Research, Xie’s research team has developed a solution that uses a natural language processing program to extract the ACP requirements from a customer’s overall list of requirements and translate it into machine-readable language that computers can understand and enforce.

After extracting the ACPs, they can be run through Access Control Policy Tool (ACPT) — also developed in Xie’s research team in collaboration with the National Institute of Standards and Technology (NIST) — which verifies and tests the ACPs and determines whether the ACP requirements are adequate to meet the security needs of the program.

Once the ACP requirements translate into machine-readable language, they can also incorporate into a policy-enforcement “engine” in the final software product — which ensures programmers cannot overlook ACPs.

“In general, developing a program that understands natural language text is very challenging,” Xie said. “However, ACP requirements in software documents usually follow a certain style, using terms such as ‘cannot be edited’ or ‘does not have the ability to edit.’ Because ACPs tend to use such a limited number of phrases, it is much easier to develop a program that effectively translates natural language texts in this context.”



No comments
The Engineers' Choice Awards highlight some of the best new control, instrumentation and automation products as chosen by...
The System Integrator Giants program lists the top 100 system integrators among companies listed in CFE Media's Global System Integrator Database.
The Engineering Leaders Under 40 program identifies and gives recognition to young engineers who...
This eGuide illustrates solutions, applications and benefits of machine vision systems.
Learn how to increase device reliability in harsh environments and decrease unplanned system downtime.
This eGuide contains a series of articles and videos that considers theoretical and practical; immediate needs and a look into the future.
Save energy with automation; Process control system upgrades; Dispelling controll myths; Time-sensitive networking; Control system integration; Road to IANA
Additive manufacturing advancements; Machine vision enhances robotics; Fieldbus evolution; Process safety; Advice from System Integrators of the Year; Road to IANA
Salary and career survey: Benchmarks and advice; Designing controls; Remote data collection, historians; Control valve advances; Hannover Messe; Control Engineering International
This article collection contains several articles on the Industrial Internet of Things (IIoT) and how it is transforming manufacturing.

Find and connect with the most suitable service provider for your unique application. Start searching the Global System Integrator Database Now!

The digital oilfield: Utilizing Big Data can yield big savings; Virtualization a real solution; Tracking SIS performance
Getting to the bottom of subsea repairs: Older pipelines need more attention, and operators need a repair strategy; OTC preview; Offshore production difficult - and crucial
Digital oilfields: Integrated HMI/SCADA systems enable smarter data acquisition; Real-world impact of simulation; Electric actuator technology prospers in production fields
click me