Keynote Lectures

Abstract
In the United States alone well over a million organizations have become so dependent on cyberspace that their vital interests are now vulnerable to attack, accidents, and design failures that may compromise those interests. Many experts believe the situation is getting worse; that new vulnerabilities are being pumped into cyberspace, and that the bad guys are coming up with more sophisticated and scalable attacks faster than the good guys are coming up with improved defenses. The technical R&D pipelines do not show much promise for generating solutions that will provide discernable, measureable, readily and massively scalable improvements in cyber security for enormous populations of users. Nor is there much expectation that a broadly operational engineering science of cyber security, nor a set of voluntary standards and calls for information sharing, nor a set of government laws and enforcing institutions, will achieve this end any time soon.
Cyberspace is thus an environment where all dependent organizations are vulnerable and at risk. Even NSA admits to its inability to guarantee its own information security. But not all users are equally vulnerable. There are a multitude of products, procedures, standards, and policies that, if appropriately used, can make some users safer and more secure than others in cyberspace. But it takes knowledgeable people to bring these possibilities to bear, and to sustain and update their use. However, many organizations cannot or will not invest in many or any full time cyber security employees. Since millions of organizations worldwide are largely responsible for their own cyber security, this implies a huge workforce need and shortfall. Many organizations may be dependent on personnel who are not full time cyber security professionals to perform security functions or to be able and knowledgeable enough to obtain needed training, products, and services from outside their organizations.
A premise of this presentation is that the primary bearer of risk when things go wrong in cyberspace is the organization that has become so dependent on computer-communications systems, not the hardware and software in the computer-communications systems. There are an enormous number and variety of such organizations in national, state, and local governments, in the business and educational sectors, and arguably has come to include most of the organizations that have a payroll, engage in on-line transactions, have their intellectual property and other vital information on computers, or are otherwise strongly reliant on their presence on the worldwide web. They have many different forms of dependencies and risk tolerances. Their customers and the users of their products and services make up extended organizations of dependencies and risk.
It will be useful to distinguish need, demand, and supply in the context of the cyber security workforce. Following [NRC 2013]: “Need is the number (and skill mix) of cybersecurity workers that are required to provide satisfactory cybersecurity (a judgment that will vary according to who makes the assessment).  Demand is expressed by the desired capabilities stated in job descriptions, the number of such positions that are created and filled, and the salaries offered to those who have those abilities. Demand will fall short of national or societal need to the extent that cybersecurity is a public good—that is, organizations will invest to meet their own requirements but not necessarily to achieve societally desirable overall requirements.  Demand can also fall short of an organization’s own needs if (1) the organization lacks the required resources or (2) an organization underestimates the threats it faces.  Supply is the number of available qualified workers willing to fill positions, and is a function of the visibility and attractiveness of cybersecurity occupations, the availability of appropriate training and education, and (as in all fields) the overall labor market in which potential workers respond to salary and other signals about demand.”

Abstract

Currently, many data centers are adopting Cloud Computing technology to achieve high performance and scalability for their applications while maintaining low costs. Service provisioning in the Cloud is based on a set of predefined non-functional properties specified and negotiated by means of Service Level Agreements (SLAs). Cloud workloads are dynamic and change constantly. Thus, in order to reduce steady human interactions, self-manageable Cloud techniques are required to comply with the agreed customers’ SLAs.  In this talk we discuss flexible and reliable management of SLAs, which is of paramount importance for both, Cloud providers and consumers. Further, we discuss novel approaches for the assessment of the virtualization costs by discussing a real live example from the area of high performance computing. Both SLA management and systematic assessment of virtualization costs lead to new democratic processes  that go far beyond traditional resource allocation.

Abstract

Computer science and information system communities discuss the term „model“ in different ways, depending on which fundamentals they build upon. From there, requirements are derived which must be supported by concepts helping to transform modelling methods into modelling tools. 

A lifecycle that assists this transformation process and which was developed in the Open Models Laboratory - www.omilab.org - is presented. It encompasses the phases create, design, formalize, develop and deploy.

Towards an Open Models Community it is essential to have in addition a common platform where models can be freely developed, managed and shared. This environment is available at the Open Models Laboratory. 

Experiences from community work on more than 20 Best Practices – www.omilab.org/booklet - realised using the  OMiLab lifecycle will be shown.

Abstract

The huge quantity of information, talks, posts, and papers available on the web cannot be ignored by companies. Being aware in near-real time of hot topics and opinions about a product or a topic is strategic for taking better decisions. Unfortunately, this information is totally or partially unstructured, thus it is difficult to be exploited. Most of the commercial solutions are "closed" applications and most of the services are one-shot projects rather than stable monitoring systems that enable a limited exploitation of the information. Practitioners often refer to this family of tools as Opinion Mining software, Sentiment Analysis Software, or Brand Reputation Software. Many companies would prefer a solution that could be integrated in the enterprise information systems and that could be considered as yet another data flow to be included in the Business Intelligence platform and to be queried with the traditional tools that are well-known to the users.

Social business intelligence is the discipline of combining corporate data with user-generated content to let decision-makers improve their business based on the trends perceived from the environment. Setting up a Social BI architecture requires contributions by several areas of computer science such as Information Retrieval, Text Mining, Database, Ontology and Artificial Intelligence The keynote will describe the features of a Social BI architecture, it will survey the research issues related to it and it will go into details about database and big data issues that would allow to create BI like capabilities.

Abstract

The huge quantity of information, talks, posts, and papers available on the web cannot be ignored by companies. Being aware in near-real time of hot topics and opinions about a product or a topic is strategic for taking better decisions. Unfortunately, this information is totally or partially unstructured, thus it is difficult to be exploited. Most of the commercial solutions are "closed" applications and most of the services are one-shot projects rather than stable monitoring systems that enable a limited exploitation of the information. Practitioners often refer to this family of tools as Opinion Mining software, Sentiment Analysis Software, or Brand Reputation Software. Many companies would prefer a solution that could be integrated in the enterprise information systems and that could be considered as yet another data flow to be included in the Business Intelligence platform and to be queried with the traditional tools that are well-known to the users.

Social business intelligence is the discipline of combining corporate data with user-generated content to let decision-makers improve their business based on the trends perceived from the environment. Setting up a Social BI architecture requires contributions by several areas of computer science such as Information Retrieval, Text Mining, Database, Ontology and Artificial Intelligence The keynote will describe the features of a Social BI architecture, it will survey the research issues related to it and it will go into details about database and big data issues that would allow to create BI like capabilities.

Abstract

Social Engineering has long been a very effective means of attacking information systems. The term knowledge worker has been coined by Peter Drucker more than 50 years ago and still describes very well the basic characteristics of many employees. Today, with current hypes such as BYOD (bring your own device) and public cloud services, young professionals expect to use the same technology both in their private life and while working. In global companies teams are no longer geographically co-located but staffed globally just-in-time. The decrease in personal interaction combined with the plethora of tools used (E-Mail, IM, Skype, Dropbox, Linked-In, Lync, etc.) create new opportunities for attackers. As recent attacks on companies such as the New York Times, RSA or Apple have shown, targeted spear-phishing attacks are an effective evolution of social engineering attacks. When combined with zero-day-exploits they become a dangerous weapon, often used by advanced persistent threats. In this talk we will explore some attack vectors and possible steps to mitigate the risk.