Confidentiality Claws

A better way of security assessment

By John Leyden, 16th November 2001

Customer Success Testimonial: Recovery is Everything

Researchers at Imperial College, London are developing mathematical and programming techniques to better assess the extent that systems prevent the leakage of confidential information.

Typically, models for confidentiality characterise the absence of information flow by trying to establish non-interference between units of a system. It is notoriously difficult to establish such absolutes in a software system.

But better results can be obtained by applying a quantitative estimate of the information flowing through a system - rather than relying on the purely qualitative binary view, Herbert Wiklicky, a lecturer at Imperial College, London, argues.

This approach involves trying to work out the probability of information "leaking" from a system, rather than trying to prove there is no such flow.

According to Wiklicky, this approach allows the definition and investigation of non-interference which is approximate, but able to capture more realistically the security properties of a system. For example, if you can establish that it's highly unlikely that a bank ATM system will leak information, then you establish that the system is secure.

Wiklicky made his comments this week at a colloquium held at Kings College, London.

Imperial College wants to secure a research grant for the work, which looks at the mathematical fundamentals of the problem. Practical applications in assessing insurance risks and in computer security will flow from this work, Wicklicky says. ®