Big Data Analytics Are we at risk? Dr. Csilla Farkas Director Center for Information Assurance Engineering (CIAE) Department of Computer Science and Engineering University of South Carolina, Columbia 1

Who is Impacted by Cyber Attacks? 2

3

4

Risk Assessment Business Policy Decision Communication between technical and administrative employees Internal vs. external resources Legal and regulatory requirements Developing security capabilities Cost Security level 0 %100% Optimal level of security at a minimum cost Security Investment Cost of Breaches 5

Understanding Cyber Security Risk Cyber Security Threats Extortion Hacks Attacks That Change or Manipulate Data Attacks That Change or Manipulate Data Chip-and-PIN Innovations The Rise of the IoT Zombie Botnet More Backdoors Source: Wired, biggest-security-threats-well-face-in-2016/ biggest-security-threats-well-face-in-2016/

Security Objectives Confidentiality: prevent/detect/deter improper disclosure of information Integrity: prevent/detect/deter improper modification of information Availability: prevent/detect/deter improper denial of access to services 7

Independent from system and network Database Management System (DBMS) is responsible for protecting data items Main database types: – Enterprise – Statistical Traditional Data Security 8

Sensitive Data Inherently sensitive From a sensitive source Declared sensitive Part of a sensitive attribute or record In relation to previously disclosed information 9

Types of Disclosures Exact data Range of data Negative results Existence Probable values SSN:

Access Control Mechanisms Cryptography Security through Views Stored Procedures Grant and Revoke Query modification 11

Goal Goal: provide aggregate information about groups of individuals  E.g., average grade point of students Security risk Security risk: specific information about a particular individual  E.g., grade point of student John Smith Statistical Databases 12

Statistical Data Protection Query restriction Data perturbation Output perturbation ? ? 13

Database Inference Attacks General Purpose Database: Non-confidential data + Metadata  Undesired Inferences Web Enabled Data: Non-confidential data + Metadata (data and application semantics) + Computational Power + Connectivity  Undesired Inferences 14

Source: / / What is Big Data? 15

Big Data Characteristics Big Data Characteristics Volume – Simple SQL analytics (data warehouse) – Complex analytics (clustering, trend detection, etc.) Variety – Enterprise data: spreadsheets, documents, web pages – Public data Velocity – Live database – Fast growth Hadoop 16

Big Data Security Access Control – Distributed, massively parallel processing – Data at rest, in transit, during processing Inference control – Discovery – Sensitive metadata – Use of discovered knowledge 17

Inference Example Latanya Sweeney, Director of Data Privacy Lab, Harvard Only You, Your Doctor, and Many Others May Know, Technology Science, September 29,

Data Matching Source: L. Sweeney, 19

Present: Big Data Inferences Private ? Ontology Data Integration and Inferences Web Data Secure ? 20

Future: Research Challenges Security for raw data Security for raw data – Flexible access control – Data removal – Data quality Security for metadata Security for metadata – Protection need of novel, new concept – Metadata guided attacks Cross-context attacks Cross-context attacks – Correlate data across multiple contexts SemanticWebTechnologies 21

Usability and Visualization Facebook Gmail Online Banking 22

Questions? 23

National Center of Academic Excellence in Information Assurance Education Information Assurance Education Information Assurance Research Information Assurance Research 24

OUTREACH EDUCATION RESEARCH CIAE Mission 25

OUTREACH EDUCATION RESEARCH External funding Peer-reviewed publications Ph.D. graduates CIAE Mission 26

CIAE Mission OUTREACH EDUCATION IA courses IA specialization Applied Computing Graduate IA Certificate RESEARCH 27

CIAE Mission OUTREACH Collaborations Academia Government Industry EDUCATION RESEARCH 28

Center for Information Assurance Engineering Csilla Farkas Center for Information Assurance Engineering Csilla Farkas