1. Online Compliance Monitoring of Service Landscapes
Jan Martijn van der Werf and Eric Verbeek

2. PoSecCo Policy and Security Configuration Management
IT business service offerings are increasingly realized by the compo­sition of in-house and outsourced subservices, partly for functional aspects, partly for infrastructure such as bandwidth or storage.
Service providers need to tackle a multitude of security requirements stemming from different sources, e.g., laws and regulations, customers, suppliers, or internal risk analysis.
Typical requirements demand the protection of cross-­organizational communication channels or access control for all elements of the service landscape, starting from business services down to lower layers of system architectures. All of these requirements need to be met in a shared, partly outsourced and continuously changing environment.
Challenges faced by IT service providers are manifold, e.g.:
Are the security requirements of new customers met by the current security concept and by current suppliers?
What are the most efficient and cost­-beneficial security controls to meet the requirements?
Is the current system landscape still in sync with the designed security concept, or did a change during operations jeopardize the security concept?
How to improve the transparency for auditors, customers and service provider internal staff, and how to optimize audit activities?
Today, many of these challenges are addressed by manual, paper-based and as such labor-intensive, and error-prone processes. They may result in in-secure and non-compliant systems and decrease profitability.
The PoSecCo project aimed at improving the security and compliance level of IT service providers, while lowering the costs caused by the management of security requirements, policies and configurations.
As such, PoSecCo aimed to relieve the IT service provider of the burden to trade-­off security and profitability goals, a prerequisite for the adoption of future, service-based applications which rely on a large num ber of provider-consumer relationships on all architectural layers.
/ department of mathematics and computer science

3. PoSecCo: Example CDN = Content Delivery Network
/ department of mathematics and computer science

4. PoSecCo: Golden Configuration
CDN = Content Delivery Network
/ department of mathematics and computer science

5. PoSecCo: Example CDN = Content Delivery Network
/ department of mathematics and computer science

6. PoSecCo: Positioning CDN = Content Delivery Network
/ department of mathematics and computer science

7. Process Mining CDN = Content Delivery Network
/ department of mathematics and computer science

8. Process Mining: Event Logs
CDN = Content Delivery Network
/ department of mathematics and computer science

9. Process Mining: Positioning
CDN = Content Delivery Network
/ department of mathematics and computer science

10. PoSecCo en process mining
Policy and Security Configuration Management
IT business service offerings are increasingly realized by the compo­sition of in-house and outsourced subservices, partly for functional aspects, partly for infrastructure such as bandwidth or storage.
Service providers need to tackle a multitude of security requirements stemming from different sources, e.g., laws and regulations, customers, suppliers, or internal risk analysis.
Typical requirements demand the protection of cross-­organizational communication channels or access control for all elements of the service landscape, starting from business services down to lower layers of system architectures. All of these requirements need to be met in a shared, partly outsourced and continuously changing environment.
Challenges faced by IT service providers are manifold, e.g.:
Are the security requirements of new customers met by the current security concept and by current suppliers?
What are the most efficient and cost­-beneficial security controls to meet the requirements?
Is the current system landscape still in sync with the designed security concept, or did a change during operations jeopardize the security concept?
How to improve the transparency for auditors, customers and service provider internal staff, and how to optimize audit activities?
Today, many of these challenges are addressed by manual, paper-based and as such labor-intensive, and error-prone processes. They may result in in-secure and non-compliant systems and decrease profitability.
The PoSecCo project aimed at improving the security and compliance level of IT service providers, while lowering the costs caused by the management of security requirements, policies and configurations.
As such, PoSecCo aimed to relieve the IT service provider of the burden to trade-­off security and profitability goals, a prerequisite for the adoption of future, service-based applications which rely on a large num ber of provider-consumer relationships on all architectural layers.
/ department of mathematics and computer science

11. Process mining in PoSecCo
/ department of mathematics and computer science

12. PoSecCo: Ontology! / department of mathematics and computer science

13. Ontology model of an event log
/ department of mathematics and computer science

14. Ontology example of an event log
/ department of mathematics and computer science

15. Semantic Process mining in PoSecCo
Association Rules
Query ontology
/ department of mathematics and computer science

16. An example Application admin Database admin
/ department of mathematics and computer science

17. Event log from system landscape
/ department of mathematics and computer science

18. Associating roles to users
/ department of mathematics and computer science

19. Checking appropriate roles
SWRL Expression:
/ department of mathematics and computer science

20. Open world assumption SWRL Expression:
Hank is a manager, but the reasoner assumes that he can still be an application manager, even though this fact is not yet in the ontology
/ department of mathematics and computer science

21. Open world assumption SWRL Expression: Two queries on the ontology:
Query: All events
Difference: All events for which the expression holds
Result = Query / Difference
/ department of mathematics and computer science

22. Associating traces to files
/ department of mathematics and computer science

23. Associating users to accessed files
/ department of mathematics and computer science

24. Associating users to accessed files
/ department of mathematics and computer science

25. Associating files to DB or APP
/ department of mathematics and computer science

26. Segregation of duty constraint
/ department of mathematics and computer science

27. Deployment of ProM in PoSecCo
/ department of mathematics and computer science

28. Result of checking the SoD constraint
/ department of mathematics and computer science

29. Conclusions Semantic process mining Online monitoring of rules
Convert event log to ontology
Hook up to existing ontology
Query resulting ontology
Online monitoring of rules
Not fast, not cheap
ProM Nightly Builds, PoSecCo package
/ department of mathematics and computer science