NDLI: How good is a security policy against real breaches?: a HIPAA case study

Please wait, while we are loading the content...

Semantically enhanced software traceability using deep learning techniques

Analyzing APIs documentation and code to detect directive defects

Clone refactoring with lambda expressions

Supporting software developers with a holistic recommender system

Software development waste

Classifying developers into core and peripheral: an empirical study on count and network metrics

Search-driven string constraint solving for vulnerability detection

ZenIDS: introspective intrusion detection for PHP applications

Efficient detection of thread safety violations via coverage-guided generation of concurrent tests

Making malory behave maliciously: targeted fuzzing of android execution environments

LibD: scalable and precise third-party library detection in android markets

Performance diagnosis for inefficient loops

Learning syntactic program transformations from examples

Exploring API embedding for API usages and applications

SPAIN: security patch analysis for binaries towards understanding the pain and pills

Glacier: transitive class immutability for Java

How good is a security policy against real breaches?: a HIPAA case study

RADAR: a lightweight tool for requirements and architecture decision analysis

An empirical study on mutation, statement and branch coverage fault revelation that avoids the unreliable clean program assumption

Syntactic and semantic differencing for combinatorial models of test designs

Automated transplantation and differential testing for clones

What causes my test alarm?: automatic cause analysis for test alarms in system and integration testing

Symbolic model extraction for web application verification

Fuzzy fine-grained code-history analysis

Can latent topics in source code predict missing architectural tactics?

An unsupervised approach for discovering relevant tutorial fragments for APIs

Characterizing and detecting anti-patterns in the logging code

Recommending and localizing change requests for mobile apps based on user reviews

Becoming agile: a grounded theory of agile transitions in practice

Decoding the representation of code in the brain: an fMRI study of code review and expertise

A guided genetic algorithm for automated crash reproduction

Statically checking web API requests in JavaScript

RClassify: classifying race conditions in web applications via deterministic replay

A SEALANT for inter-app security holes in android

Analysis and testing of notifications in Android wear applications

How do developers fix cross-project correlated bugs?: a case study on the GitHub scientific python ecosystem

Precise condition synthesis for program repair

Unsupervised software-specific morphological forms inference from informal discussions

Travioli: a dynamic analysis for detecting data-structure traversals

Challenges for static analysis of Java reflection: literature review and empirical study

Adaptive coverage and operational profile-based testing for reliability improvement

PEoPL: projectional editing of product lines

Evaluating and improving fault localization

Balancing soundness and efficiency for practical testing of configurable systems

Code defenders: crowdsourcing effective tests and subtle mutants with a mutation testing game

UML diagram refinement (focusing on class- and use case diagrams)

To type or not to type: quantifying detectable bugs in JavaScript

Detecting user story information in developer-client conversations to generate extractive summaries

Automated refactoring of legacy Java software to default methods

Machine learning-based detection of open source license exceptions

From diversity by numbers to diversity as process: supporting inclusiveness in software development teams with brainstorming

Understanding the impressions, motivations, and barriers of one time code contributors to FLOSS projects: a survey

Stochastic optimization of program obfuscation

On cross-stack configuration errors

Repairing event race errors by controlling nondeterminism

An efficient, robust, and scalable approach for analyzing interacting android apps

Adaptive unpacking of Android apps

Feedback-based debugging

Heuristically matching solution spaces of arithmetic formulas to efficiently reuse solutions

ProEva: runtime proactive performance evaluation based on continuous-time markov chains

Machine-learning-guided selectively unsound static analysis

Do developers read compiler error messages?

Automatic text input generation for mobile testing

Optimizing test placement for module-level regression testing

The evolution of continuous experimentation in software product development: from data to a data-driven organization at scale

A general framework for dynamic stub injection

A test-suite diagnosability metric for spectrum-based fault localization approaches

Learning to prioritize test programs for compiler testing

How good is a security policy against real breaches?: a HIPAA case study

Content Provider	ACM Digital Library
Author	Kafali, Özgür Petruso, Megan Williams, Laurie Singh, Munindar P. Jones, Jasmine
Abstract	Policy design is an important part of software development. As security breaches increase in variety, designing a security policy that addresses all potential breaches becomes a nontrivial task. A complete security policy would specify rules to prevent breaches. Systematically determining which, if any, policy clause has been violated by a reported breach is a means for identifying gaps in a policy. Our research goal is to help analysts measure the gaps between security policies and reported breaches by developing a systematic process based on semantic reasoning. We propose Semaver, a framework for determining coverage of breaches by policies via comparison of individual policy clauses and breach descriptions. We represent a security policy as a set of norms. Norms (commitments, authorizations, and prohibitions) describe expected behaviors of users, and formalize who is accountable to whom and for what. A breach corresponds to a norm violation. We develop a semantic similarity metric for pairwise comparison between the norm that represents a policy clause and the norm that has been violated by a reported breach. We use the US Health Insurance Portability and Accountability Act (HIPAA) as a case study. Our investigation of a subset of the breaches reported by the US Department of Health and Human Services (HHS) reveals the gaps between HIPAA and reported breaches, leading to a coverage of 65%. Additionally, our classification of the 1,577 HHS breaches shows that 44% of the breaches are accidental misuses and 56% are malicious misuses. We find that HIPAA's gaps regarding accidental misuses are significantly larger than its gaps regarding malicious misuses.
Starting Page	530
Ending Page	540
Page Count	11
File Format	PDF
ISBN	9781538638682
ISSN	15581225
DOI	10.1109/ICSE.2017.55
Language	English
Publisher	Association for Computing Machinery (ACM)
Publisher Date	2017-05-20
Access Restriction	Subscribed
Subject Keyword	Breach ontology Semantic similarity Social norms Security and privacy breaches
Content Type	Text
Resource Type	Article

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in

HIPAA Privacy, Security, Enforcement, and Breach Notification Standards

HIPAA: privacy, security and the consequences of a breach for dialysis providers.

Anthem Data Breach: How Safe Is Health Information Under HIPAA?

A statistical analysis of disclosed storage security breaches

The importance of mandatory data breach notification to identity crime

Is there a cost to privacy breaches? An event study (2006)

Is there a cost to privacy breaches? An event study (2006)

The Practical Guide to HIPAA Privacy and Security Compliance

Semantic similarity in heterogeneous ontologies

How good is a security policy against real breaches?: a HIPAA case study

Similar Documents

HIPAA Privacy, Security, Enforcement, and Breach Notification Standards

HIPAA: privacy, security and the consequences of a breach for dialysis providers.

Anthem Data Breach: How Safe Is Health Information Under HIPAA?

A statistical analysis of disclosed storage security breaches

The importance of mandatory data breach notification to identity crime

Is there a cost to privacy breaches? An event study (2006)

Is there a cost to privacy breaches? An event study (2006)

The Practical Guide to HIPAA Privacy and Security Compliance

Semantic similarity in heterogeneous ontologies

How good is a security policy against real breaches?: a HIPAA case study