Securing information flows: A metadata framework

Abstract

Recently, risk-based information trading has emerged as a new paradigm for securely sharing information across traditional organizational boundaries. In this paradigm, the risk of sharing information between organizations is characterized using expected losses (due, for example, to (un)intended information disclosure) and billed to a recipient. However, within risk-based information trading systems, quantifying the risks associated with sharing information is a non-trivial task, particularly when risk calculations depend on a number of factors. In this paper we introduce a data-centric metadata framework that extends risk-based information trading approaches by allowing one or more domains to exchange sensitive information based on metadata evaluated against internal risk assessments of the domains. We present a use case of our metadata framework using a coalition military scenario, wherein information flows can be controlled and regulated by our framework whilst allowing sufficiently high-quality tactical information to be disseminated 1 •

A Comparative Study of the Approach Provided for Preventing the Data Leakage

“…There is a need of DLP solution that will allow secure sharing of confidential information in companies [34].…”

“…Two algorithms are used to describe the system: Boyer Moore (BM Algorithm) [34] is used to search exact sensitive strings exposed to whitespace attack and Smith Waterman (SW) sequential alignment algorithm [35] is used to detect modified string attacks.…”

A Comparative Evaluation of Data Leakage/Loss Prevention Systems (DLPS)

“…There is a need of DLP solution that will allow secure sharing of confidential information in companies [17].…”

“…Two algorithms are used to describe the system: Boyer Moore (BM Algorithm) [17] is used to search exact sensitive strings exposed to whitespace attack and Smith Waterman (SW) sequential alignment algorithm [18] is used to detect modified string attacks.…”

A metadata calculus for secure information sharing

“…In [5,14,22,23], while risk is estimated based on the object metadata [24], the actual formulas or examples use static credentials (e.g., the security clearance or category set) of the shared object and the recipient, rather than a dynamic value of the shared object. Further, they do not provide solutions to either deduce the metadata or estimate the value of new or derived objects.…”