Stopping the Next Enron with Data Integrity

Professor Marianne Winslett, University of Illinois at Urbana-Champaign, and Advanced Digital Sciences Center, Singapore talked today in the famous room N101 at the Australian National University in Canberra, on "Records Retention: Addressing Insider Threats to Data Integrity". She contrasted the run on the banks during the 1930s stock market crash with the recent stability of recent economic problems. She then pointed out that Enron executives falsified their corporate records, but largely got away with it and the Sarbanes-Oxley Act (SOX) introduced to combat this.

Professor Winslett showed examples of email messages between Enron executives openly arranging the fraud and suggested that people at the top feel invulnerable. SOX requires detailed records to be kept which, if done, would assist prosecution. The same applications built for SOX compliance are also being used for health providers to meet record keeping requirements.

Professor Winslett argued that IT researchers could help make compliance with laws like SOX more efficient and effective. The main treat is undetected tampering with records. Practice suggests that most fraudsters do not systematically plan in advance. So a system which prevents undetectable changes and has regular audits will be able to detect fraud. For email and documents a copy can be made. For databases which can be changed there is a "regret interval" where the database could be changed between copies are taken.

Professor Winslett discussed the use of write once, read many file stores. These are still vulnerable to attacks, such as by changing the date, restoring an old backup, or altering an index to the data.

Professor Winslett discussed the use of temporal database which keep time stamped copies of the data. Hash functions can be used to speed up integrity checks. An implementation using a modified version of the Berkeley DB showed a 10% penalty. A less severe "audit helper" function would only impose only a 1% overhead.

Professor Winslett pointed out that a trustworthy system does not protect against fake business transactions, such as fake purchase orders.

It seems to me that with increasing use of B2B it should be simpler to detect gross fraud by one company. Assuming organisations are no colluding, it would be difficult for the transactions are with legitimate organisations are legitimate, it will be difficult for one organisation to fake its internal records for long, as these would not match what was going in and out. Combined with logging of large transactions and a random sample of smaller ones, this should be enough to deter and detect gross fraud, at a cost far lower than full logging.

Ultimately we need trustworthy people. A simple solution is to have a copy of the company's records outside the control of the company executive. One way is to have IT and records management staff who are instilled with a sense of professionalism backed up law. Another would be to have the auditors take a real time copy of the records, on their own systems outside the control of the company.

ps: After this talk I attended a discussion of how to provide a repository of learning modules. Many of the issues were similar: how do we record in a relai9ble way recorded what is done over time. How can we say reliably who did what, when?

Records Retention: Addressing Insider Threats to Data Integrity

Professor Marianne Winslett, University of Illinois at Urbana-Champaign, and Advanced Digital Sciences Center, Singapore will speak on "Records Retention: Addressing Insider Threats to Data Integrity" at University of Sydney 15 March and the Australian National University in Canberra, 16 March 2011. I have encouraged my e-records students to attend.

ANU College of Engineering and Computer Science
Title: *Records Retention: Addressing Insider Threats to Data Integrity*

Venue: CSIT Building, N101 seminar room
Time: 10:30-12
Date: Wednesday 16 March 2011

Speaker:
Marianne Winslett
University of Illinois at Urbana-Champaign, and
Advanced Digital Sciences Center, Singapore

Abstract:
Inaccurate financial statements from major companies, dead people who still vote in elections, world-class gymnasts with uncertain birth dates: insiders often have the power and ability to make inappropriate changes to the content of electronic records. As electronic records
replace paper records, it becomes easy to make such alterations without leaving behind evidence that can be used to detect the changes and determine who made them. The US Sarbanes-Oxley Act is perhaps the most
(in)famous law that addresse are these problems, but it is just one of many regulations that require long-term high-integrity retention of electronic records, all with the goal of ensuring that societal trust in business and government at reasonable cost.

In this talk, we will discuss some of the technical challenges posed by the need for "tamper-proof" retention of records. We will describe how
industry has responded to these challenges, the security weaknesses in current product offerings, and the role that researchers and government can play in addressing these weaknesses. We will give an overview of research progress to date and describe the major open research problems in this area.

Bio:
Marianne Winslett has been a professor in the Department of Computer Science at the University of Illinois since 1987. She is an ACM Fellow and the recipient of a Presidential Young Investigator Award from the US National Science Foundation. She is the former vice-chair of ACM SIGMOD and has served on the editorial boards of ACM Transactions on the Web, ACM Transactions on Database Systems, IEEE Transactions on Knowledge and Data Engineering, ACM Transactions on Information and Systems Security, and the Very Large Data Bases Journal. She has received two best paper awards for research on managing regulatory compliance data (VLDB, SSS), one best paper award for research on analyzing browser extensions to detect security vulnerabilities (Usenix Security), and one for keyword search (ICDE). Her PhD is from Stanford University.

Liquid Journals: Rethinking knowledge dissemination

Fabio Casati, University of Trento, will give a free seminar on "Rethinking knowledge dissemination: Liquid Knowledge, Science Mashups, and other Research Trends", hosted by the CSIRO ICT Centre, in the famous Room N101, Computer Science and Information Technology Building at the Australian National University in Canberra, 11am, 22 November 2010:

Seminar Announcement

ICT Centre, Acton
CSIRO

Date: Monday, 22 November 2010
Time: 1100--1200
Venue: Room N101, CSIT Building [Building 108]

Speaker: Fabio Casati

Title: Rethinking knowledge dissemination: Liquid Knowledge, Science Mashups, and other Research Trends at the University of Trento

Abstract:

The way scientific knowledge is created, disseminated, searched, consumed, and evaluated has been essentially the same for centuries, largely oblivious to the Web revolution. Despite technology, today it is very hard to find knowledge of interest - harder than it is to find interesting web pages - despite a HUGE effort done by the community in filtering it (e.g., via peer review) and in evaluating it (via metrics of dubious effectiveness, such as citation count). The growing community of researchers and exploding number of publication venues makes it even more difficult to navigate the sea of information.

This talk will describe Liquid Journals, which are a way to find, consume, create, and share interesting and relevant scientific knowledge.

They are based on a few key intuitions. The first is that scientific knowledge is not communicated (only) via isolated scientific papers, linked to each other via citations. Rather, it is exists in different kinds (data, experiments, ideas,...), it is communicated in different forms (papers, talks, blogs), it evolves almost continuously over time, and it is connected in a knowledge network (papers describe experiments that are built over datasets, all based on ideas inspired from other talks or blogs). The second intuition is that the network which would be so useful to navigate in the sea of scientific knowledge is not objective, but is rather subjective. Whether a paper is inspired from another, or whether a person contributed to a paper may be proven facts or may be opinions, which may also take different forms. The third intuition is that we can use the power of the community as editors to help us select knowledge among a sea of information, rather than leaving this role to a selected few. The fourth intuition is that editors and the community of readers can create knowledge. This is a huge potential that is currently untapped for various social and technical reasons, but that can be used to service the scientific community.

This talk will present the main ideas behind liquid journals and other liquid and collaborative knowledge dissemination models, and then focus on the services and social computing side, describing the IT infrastructure that enables each of us to provide, create, consume, and share scientific knowledge.

The talk will also provide an overview of other research done in Trento, and specifically on end-user mashups, process compliance, and social well-being.

Biography:

Fabio Casati is Professor of Computer Science at the University of Trento. He got his PhD from the Politecnico di Milano and then worked for over 7 years in Hewlett- Packard USA, where he was technical lead for the research program on business process intelligence. Fabio has also contributed (as software and data architect) to the development of several HP commercial products and solutions in the area of web services and business process management. In Trento, he is leading or participating to five FP7 projects, is active in many industry-funded projects, both local and international, and has over 30 patents. His passions are now in social informatics, or, informatics at the service of the community. His latest efforts are on prevention of non-communicable diseases, on remote and real-time healthcare, on collaborative programming, and on models for scientific disseminations that can help scientists work in a more efficient way.

Stack iPads for Library e-Book Display

According to Gizmodo, architects Clarke Hopkins Clarke have suggested stacking hundreds of Apple iPads on a library wall to display iBooks. A wall of iPads in a library is an intriguing idea, but would cost twenty times as much as some alternatives. There are much more affordable and environmentally efficient ways to build a video wall to display e-Books.

Many libraries now use large flat panel displays. These can be used to show book details. The latest of these displays used LED backlit LCD panels, which use less power than old plasma screens. One computer can drive many displays, making the setup much cheaper. A video projector can also be used to make a wall size display which can show one large image, or well as many small ones. At the Australian National University's famous " CSIT building N101 seminar room" I have used the full wall display for presentations. Three high resolution projectors cover one wall of the room and a computer with three video interfaces knits these into one large desktop. The wall has also been used for video art display. The wall can display cinema style video, or when the room is needed for other purposes, simply switched off.

An Apple iPad has an area of about 0.05m² and costs about US$500. The Dell G2410 24-inch LED LCD monitor has an area of 0.23m² and costs about US$300. Allowing for the extra computer hardware to drive a video wall, the LCD screens would cost about US$500 each. These would cost the same as the iPads, but because the iPads are much smaller the wall would cost five times as much.

The wall depicted by Clarke Hopkins Clarke has thirty columns of iPads, ten high, or 300 in total. The wall would cover 15m² and the iPads would cost US$150,000. The same wall area would require about 66 LCD screens and cost US$33,000. Using video projectors would cost about US$7,000.