How Good Is a Security Policy against Real Breaches? A HIPAA Case Study

Abstract

The version in the Kent Academic Repository may differ from the final published version. Users are advised to check http://kar.kent.ac.uk for the status of the paper. Users should always cite the published version of record.

Comodo : Collaborative monitoring of commitment delegations

“…Apart from the e-commerce domain, our distributed monitoring and diagnosis process can be adopted in safety-critical domains such as intrusion detection (Geib & Goldman, 2001) and other crime detection (Jarvis et al, 2005) by integrating it with additional AI-based methods. Commitments and additional normative representations can be combined with ontologies and semantic reasoning to provide additional expert capabilities to agents (Kafalı et al, 2017b;Xu et al, 2011).…”

“…• We have demonstrated the working of COMODO on one case study from e-commerce, which constitutes a threat to external validity. Other works on normative models explore emergency healthcare (Kafalı et al, , 2017a, and security and privacy (Barth et al, 2006;Kafalı et al, 2017b). Exploring norm delegations in such settings would provide valuable insight to our distributed diagnosis procedure.…”

“…Such explanations would enable human users to understand what has transcribed during a transaction and help introspection about the exception situation. Intelligent agents equipped with such expert capabilities have potential implications on several important domains regarding all phases of distributed exception handling (Kafalı et al, 2017b;Soeanu et al, 2016;Sun et al, 2012;Vasconcelos et al, 2009;Xu et al, 2011), e.g., planning, monitoring, conflict resolution, semantic reasoning, and diagnosis. While we have applied the diagnosis procedure on an e-commerce case study, its generic nature enables deployment in application areas including emergency healthcare, Internet of Things and smart environments, and security and privacy in the context of sociotechnical systems.…”

Çorba: crowdsourcing to obtain requirements from regulations and breaches

“…We adopt norms [3,18,24,42,48] to formalize regulations and breaches (as violations of norms). Norms (here, deontic norms including commitments, authorizations, and prohibitions) provide a compact, yet expressive formalization.…”

Guest Editors’ Introduction

“…This is even more critical in systems where the security or privacy of an individual depends on what others do, like in social media, where any of your friends can post information about you , which is completely out of your control. Recent studies (Kafalı et al 2017b) demonstrate the impact of human error in breaches, and formally analyze how well existing regulations account for such breaches via AI techniques such as semantic similarity and domain ontologies. Automating the extraction of information from valuable artifacts such as breach reports would help such analysis, since breach reports not only capture examples that the software and its users should avoid, but also describe actions to prevent, detect, and recover from future breaches.…”