Publications

@inproceedings{Papanikolaou2013,

title = {Cross-Disciplinary Review of the Concept of Accountability},

author = {Nick Papanikolaou and Siani Pearson},

url = {../files/tafc1.pdf},

year  = {2013},

date = {2013-05-01},

booktitle = {Proceedings of the DIMACS/BIC/A4Cloud/CSA International Workshop 

	on Trustworthiness, Accountability and Forensics in the Cloud (TAFC)},

abstract = {In this paper we discuss previous definitions of the concept of ac- 

	countability from the literature. Accountability is a multidimensional, 

	context- dependent concept that is gaining interest as a means of 

	addressing a number of data protection problems, including global 

	legal uncertainty and lack of trust.},

keywords = {},

pubstate = {published},

tppubtype = {inproceedings}

}

@inproceedings{Breaux2013,

title = {Mapping Legal Requirements to IT Controls},

author = {Travis Breaux and David Gordon and Nick Papanikolaou and Siani Pearson},

url = {../files/relaw13.pdf},

year  = {2013},

date = {2013-01-01},

booktitle = {Proceedings of the Sixth International Workshop on Requirements Engineering 

	and Law (RELAW)},

abstract = {Information technology (IT) controls are reusable system requirements 

	that IT managers, administrators and developers use to demonstrate 

	compliance with international standards, such as ISO 27000 standard. 

	As controls are reusable, they tend to cover best practice independently 

	from what specific government laws may require. However, because 

	considerable effort has already been invested by IT companies in 

	linking controls to their existing systems, aligning controls with 

	regulations can yield important savings by avoiding non- compliance 

	or unnecessary redesign. We report the results of a case study to 

	align legal requirements from the U.S. and India that govern healthcare 

	systems with three popular control catalogues: the NIST 800-53, ISO/IEC 

	27002:2009 and the Cloud Security Alliance CCM v1.3, as well as the 

	CCHIT EHR Certification Criteria. The contributions include a repeatable 

	protocol for mapping controls, heuristics to explain the types of 

	mappings that may arise, and guidance for addressing incomplete mappings.},

keywords = {},

pubstate = {published},

tppubtype = {inproceedings}

}

@inproceedings{DanieleCatteddu2013,

title = {Towards a Model of Accountability for Cloud Computing Services},

author = {Daniele Catteddu and Massimo Felici and Giles Hogben and Amy Holcroft and Eleni Kosta and Ronald Leenes and Christopher Millard and Maartje 

	Niezen and David Nu~nez and Nick Papanikolaou and Siani Pearson and Daniel Pradelles and Chris Reed and Chunming Rong and Jean-Claude 

	Royer and Dimitra Stefanatou and Tomasz Wlodarczyk},

url = {../files/tafc2.pdf},

year  = {2013},

date = {2013-01-01},

booktitle = {Proceedings of the DIMACS/BIC/A4Cloud/CSA International Workshop 

	on Trustworthiness, Accountability and Forensics in the Cloud (TAFC)},

abstract = {This paper presents a model of accountability for cloud computing 

	services, based on ongoing work as part of the A4Cloud project1. 

	We define a three-layer model of accountability as a general concept 

	for data governance, distinguishing between accountability attributes, 

	accountability practices, and accountability mechanisms and tools.},

keywords = {},

pubstate = {published},

tppubtype = {inproceedings}

}

@inproceedings{Cleary2012,

title = {EFFECTS+ Clustering of Trust and Security Research Projects, Identifying 

	Results, Impact and Future Research Roadmap Topics},

author = {Frances Cleary and Keith Howker and Fabio Massacci and Nick Wainwright and Nick Papanikolaou and Michele Bezzi and Pedro Soria Rodriguez},

url = {../files/eChallenges_effectsplus.pdf},

year  = {2012},

date = {2012-10-01},

booktitle = {Proceedings of e-Challenges e-2012 Conference},

address = {Lisbon, Portugal},

abstract = {Structured and coordinated clustering increases the effectiveness 

	of R&D project work helping to raise awareness, align approaches 

	and create synergies. The project EFFECTS+ coordinates such clustering 

	and trust and security research project potential impact analysis 

	activities. This provides the wider community with an interest in 

	the trust and security research space the opportunity to participate, 

	contribute to and gain an overall view of current state of the art 

	and active research projects ongoing within the Europe in this domain. 

	This paper will provide you with an overview of the activities completed 

	by EFFECTS+ to date, highlighting the clustering structure and the 

	research project impact analysis completed so far. EFFECTS+ also 

	focuses on the development of a trust and security strategic research 

	agenda for future work. This paper will address the process and structure 

	adopted by EFFECTS+ for the identification and consolidation of such 

	future roadmapping content.},

keywords = {},

pubstate = {published},

tppubtype = {inproceedings}

}

@inproceedings{echallenges2012,

title = {Forming A Vision for Future Internet Research},

author = {Nick Wainwright and Nick Papanikolaou},

url = {../files/eChallenges2012.pdf},

year  = {2012},

date = {2012-10-01},

booktitle = {Proceedings of e-Challenges e-2012 Conference},

address = {Lisbon, Portugal},

abstract = {This paper presents a vision for the Future Internet and its impact 

	on indi- viduals, businesses and society as a whole; the vision presented 

	is based on an ex- tended consultation carried out by the authors 

	within the European Future Internet research community, as part of 

	the work of the Future Internet Assembly (FIA). The core result of 

	this paper is the identification of six research priorities for the 

	future. We also present a scenario related to the London Olympic 

	Games, which is intended to link together the research priorities 

	and related findings.},

keywords = {},

pubstate = {published},

tppubtype = {inproceedings}

}

@inproceedings{Papanikolaou2012e,

title = {Natural Language Processing of Rules and Regulations for Compliance 

	in the Cloud},

author = {Nick Papanikolaou},

url = {../files/DOASVI2012.pdf},

year  = {2012},

date = {2012-09-01},

booktitle = {Proceedings of DOA-SVI 2012},

address = {Rome, Italy},

abstract = {We discuss ongoing work on developing tools and techniques for under- 

	standing natural-language descriptions of security and privacy rules, 

	particularly in the context of cloud computing services. In particular, 

	we present a three-part toolkit for analyzing and processing texts, 

	and enforcing privacy and security rules extracted from those texts. 

	We are interested in developing efficient, accurate technologies 

	to reduce the time spent analyzing and reasoning about new privacy 

	laws and security rules within the enterprise. We describe the tools 

	we have developed for semantic annotation, and also for information 

	extraction - these are specifically intended for analysis of cloud 

	terms of service, and therefore designed to help with self- compliance; 

	however, the techniques involved should be generalizable to other 

	rele- vant texts, esp. rules and regulations for data protection.},

keywords = {},

pubstate = {published},

tppubtype = {inproceedings}

}

@inproceedings{CasassaMont2012,

title = {Security and Privacy Governance In Cloud Computing via SLAs and 

	a Policy Orchestration Service},

author = {Marco Casassa Mont and Kieran McCorry and Nick Papanikolaou and Siani Pearson},

url = {../files/paper-orchestrator.pdf},

year  = {2012},

date = {2012-01-01},

booktitle = {Proceedings of the 2textsuperscriptnd International Conference 

	on Cloud Computing and Services Science (CLOSER 2012)},

publisher = {SciTePress},

abstract = {We present in this paper the novel concept of a policy orchestration 

	service, which is designed to facilitate security and privacy governance 

	in the enterprise, particularly for the case where various services 

	are provided to the enterprise through external suppliers in the 

	cloud. The orchestration service mediates between the enterprises' 

	internal decision support systems (which incorporate core security 

	and privacy recommendations) and the cloud-based service providers, 

	who are assumed to be bound by contractual service level agreements 

	with the enterprise. The function of the orchestration service, which 

	is intended to be accessed as a trusted service in the cloud, is 

	to ensure that applicable security and privacy recommendations are 

	actioned by service providers through adequate monitoring and enforcement 

	mechanisms.},

keywords = {},

pubstate = {published},

tppubtype = {inproceedings}

}

@inproceedings{Papanikolaou2012b,

title = {Automating Compliance for Cloud Computing Services},

author = {Nick Papanikolaou and Siani Pearson and Marco Casassa Mont and Ryan Ko},

url = {../files/paper-nlp.pdf},

year  = {2012},

date = {2012-01-01},

booktitle = {Proceedings of the 2nd International Conference on Cloud Computing 

	and Services Science (CLOSER 2012)},

publisher = {SciTePress},

abstract = {We present an integrated approach for automating service providers' 

	compliance with data protection laws and regulations, business and 

	technical requirements in cloud computing. The techniques we propose 

	in particular include: natural-language analysis (of legislative 

	and regulatory texts, and corporate security rulebooks) and extraction 

	of enforceable rules, use of sticky policies, automated policy enforcement 

	and active monitoring of data, particularly in cloud environments. 

	We discuss ongoing work on developing a software tool for natural-language 

	processing of cloud terms of service and other related policy texts. 

	We also identify opportunities for future software development in 

	the area of cloud computing compliance.},

keywords = {},

pubstate = {published},

tppubtype = {inproceedings}

}

@inproceedings{Papanikolaou2011f,

title = {Automated Understanding of Cloud Terms of Service and SLAs},

author = {Nick Papanikolaou and Siani Pearson and Marco Casassa Mont},

url = {../files/CloudCom2011.pdf},

year  = {2011},

date = {2011-12-01},

booktitle = {Proceedings of The 22nd Hewlett-Packard Colloquium on Information 

	Security},

address = {Royal Holloway, University of London},

abstract = {We argue in favour of a set of particular tools and approaches to 

	help achieve accountability in cloud computing. Our concern is helping 

	cloud providers achieve their security goals and meeting their customers' 

	security and privacy requirements. The techniques we propose in particular 

	include: natural-language analysis (of legislative and regulatory 

	texts, and corporate security rulebooks) and extraction of enforceable 

	rules, use of sticky policies, automated policy enforcement and active 

	monitoring of data, particularly in cloud environments. This is a 

	position paper reporting our initial thinking and current progress.},

keywords = {},

pubstate = {published},

tppubtype = {inproceedings}

}

@inproceedings{Papanikolaou2011e,

title = {Automated Understanding of Cloud Terms of Service and SLAs},

author = {Nick Papanikolaou and Siani Pearson and Marco Casassa Mont},

url = {../files/CloudCom2011.pdf},

year  = {2011},

date = {2011-11-01},

booktitle = {Proceedings of IEEE CloudCom 2011},

address = {Athens, Greece},

abstract = {We argue in favour of a set of particular tools and approaches to 

	help achieve accountability in cloud computing. Our concern is helping 

	cloud providers achieve their security goals and meeting their customers' 

	security and privacy requirements. The techniques we propose in particular 

	include: natural-language analysis (of legislative and regulatory 

	texts, and corporate security rulebooks) and extraction of enforceable 

	rules, use of sticky policies, automated policy enforcement and active 

	monitoring of data, particularly in cloud environments. This is a 

	position paper reporting our initial thinking and current progress.},

keywords = {},

pubstate = {published},

tppubtype = {inproceedings}

}

@inproceedings{Papanikolaou2011d,

title = {Towards Natural-Language Understanding and Automated Enforcement 

	of Privacy Rules and Regulations in the Cloud: Survey and Bibliography},

author = {Nick Papanikolaou and Siani Pearson and Marco Casassa Mont},

url = {../files/STAVEPaperFinal.pdf},

year  = {2011},

date = {2011-01-01},

booktitle = {Proceedings of 1st International Workshop on Security and Trust in 

	Virtualised Environments (STAVE 2011)},

abstract = {In this paper we survey existing work on automatically processing 

	legal, regulatory and other policy texts for the extraction and representation 

	of privacy knowledge and rules. Our objective is to link and apply 

	some of these techniques to policy enforcement and compliance, to 

	provide a core means of achieving and maintaining customer privacy 

	in an enterprise context, particularly where data is stored and processed 

	in cloud data centres. We sketch our thoughts on how this might be 

	done given the many different, but so far strictly distinct from 

	one another, approaches to natural-language analysis of legal and 

	other prescriptive texts, approaches to knowledge extraction, semantic 

	representation, and automated enforcement of privacy rules.},

keywords = {},

pubstate = {published},

tppubtype = {inproceedings}

}

@inproceedings{Agrafiotis2010b,

title = {Defining Consent and Revocation Policies},

author = {Ioannis Agrafiotis and Sadie Creese and Michael Goldsmith and Nick 

	Papanikolaou and Marco Casassa Mont and Siani Pearson},

url = {../files/definingcrpol.pdf},

year  = {2010},

date = {2010-08-01},

booktitle = {Pre-Proceedings of PrimeLife/IFIP Summer School 2010: Privacy and 

	Identity Management for Life},

address = {Helsingborg, Sweden},

abstract = {In this paper we present the notion of a consent and revocation policy, 

	as it has been defined within the context of the EnCoRe project. 

	A consent and revocation policy is different to a privacy policy 

	in that it defines not enterprise practices with regards to personal 

	data, but more specifically, for each item of personal data held 

	by an enterprise, what consent preferences a user may express and 

	to what degree, and in what ways he or she can revoke their personal 

	data. This builds on earlier work on defining the different forms 

	of revocation for personal data, and on formal models of consent 

	and revocation processes.},

keywords = {},

pubstate = {published},

tppubtype = {inproceedings}

}

@inproceedings{Papanikolaou2010d,

title = {EnCoRe: Towards a Holistic Approach to Privacy},

author = {Nick Papanikolaou and Sadie Creese and Michael Goldsmith and Casassa Mont and Siani Pearson},

url = {../files/ieee-secrypt.pdf},

year  = {2010},

date = {2010-07-01},

booktitle = {Proceedings of International Conference on Security and Cryptography 

	(SECRYPT 2010)},

address = {Athens, Greece},

abstract = {Privacy requirements for IT systems and solutions arise from a variety 

	of sources, including legislation, sector-specific regulation, organisational 

	guidelines, social and user expectations. In this paper we present 

	and discuss a holistic approach to the management of privacy - explored 

	in the context of the EnCoRe project - which takes into account the 

	need to deal with these different types of policies, at different 

	levels of abstraction as well as risk assessment methods to assess 

	them based on specific threats, needs and constraints. We discuss 

	examples of privacy requirements and related policies coming from 

	different sources. We then present how a privacy-aware risk assessment 

	approach (which leverages and extends traditional security-driven 

	risk assessment approaches) can be used to analyse these policies, 

	assess their compliance to requirements, identify gaps and mandate 

	the adoption of specific controls. We explain its relevance and implications 

	in an employee data case study, involving the management of privacy 

	consent and revocation. This is work in progress, carried out in 

	the context of the EnCoRe collaborative project.},

keywords = {},

pubstate = {published},

tppubtype = {inproceedings}

}

@inproceedings{Agrafiotis2010,

title = {Applying Formal Methods to Describe Privacy Control Requirements 

	in a Real Scenario: Emerging Ambiguities and Proposed Solutions},

author = {Ioannis Agrafiotis and Sadie Creese and Michael Goldsmith and Nick 

	Papanikolaou},

url = {../files/PrimeLife-Jo.pdf},

year  = {2010},

date = {2010-01-01},

booktitle = {Proceedings of PrimeLife/IFIP Summer School 2010: Privacy and Identity 

	Management for Life, Helsingborg, Sweden},

abstract = {In this paper, we demonstrate how formal methods can be used to unambiguously 

	express privacy requirements. We focus on requirements for consent 

	and revocation controls in a real world case study that has emerged 

	within the EnCoRe project. We analyse the ambiguities and issues 

	that arise when requirements expressed in natural language are transformed 

	into a formal notation, and propose solutions to address these issues. 

	These ambiguities were brought to our attention only through the 

	use of a formal notation, which we have designed specifically for 

	this purpose.},

keywords = {},

pubstate = {published},

tppubtype = {inproceedings}

}

@inproceedings{Agrafiotis2010d,

title = {Applying Formal Methods to Describe Privacy Control Requirements 

	in a Real Scenario: Emerging Ambiguities and Proposed Solutions},

author = {Ioannis Agrafiotis and Sadie Creese and Michael Goldsmith and Nick 

	Papanikolaou},

url = {../files/PrimeLife-Jo.pdf},

year  = {2010},

date = {2010-01-01},

booktitle = {Proceedings of PrimeLife/IFIP Summer School 2010: Privacy and Identity 

	Management for Life, Helsingborg, Sweden},

abstract = {In this paper, we demonstrate how formal methods can be used to unambiguously 

	express privacy requirements. We focus on requirements for consent 

	and revocation controls in a real world case study that has emerged 

	within the EnCoRe project. We analyse the ambiguities and issues 

	that arise when requirements expressed in natural language are transformed 

	into a formal notation, and propose solutions to address these issues. 

	These ambiguities were brought to our attention only through the 

	use of a formal notation, which we have designed specifically for 

	this purpose.},

keywords = {},

pubstate = {published},

tppubtype = {inproceedings}

}

@inproceedings{CasassaMont2010a,

title = {A Conceptual Model for Privacy Policies with Consent and Revocation 

	Requirements},

author = {Marco Casassa Mont and Siani Pearson and Sadie Creese and Michael 

	Goldsmith and Nick Papanikolaou},

url = {../files/PrimeLife-Conceptual.pdf},

year  = {2010},

date = {2010-01-01},

booktitle = {Proceedings of PrimeLife/IFIP Summer School 2010: Privacy and Identity 

	Management for Life},

publisher = {Springer-Verlag},

series = {Lecture Notes in Computer Science},

abstract = {This paper proposes a conceptual model for privacy policies that takes 

	into account privacy requirements arising from different stakeholders, 

	with legal, business and technical backgrounds. Current approaches 

	to privacy management are either high-level, enforcing privacy of 

	personal data using legal compliance, risk and impact assessments, 

	or low-level, focusing on the technical implementation of access 

	controls to personal data held by an enterprise. High-level approaches 

	tend to address privacy as an afterthought in ordinary business practice, 

	and involve ad hoc enforcement practices; low-level approaches often 

	leave out important legal and business considerations focusing solely 

	on technical management of privacy policies. Hence, neither is a 

	panacea and the low level approaches are often not adopted in real 

	environments. Our conceptual model provides a means to express privacy 

	policy requirements as well as users' privacy preferences. It enables 

	structured reasoning regarding containment and implementation between 

	various policies at the high level, and enables easy traceability 

	into the low-level policy implementations. Thus it offers a means 

	to reason about correctness that links low-level privacy management 

	mechanisms to stakeholder requirements, thereby encouraging exploitation 

	of the low-level methods. We also present the notion of a consent 

	and revocation policy. A consent and revocation policy is different 

	to a privacy policy in that it defines not enterprise practices with 

	regards to personal data, but more specifically, for each item of 

	personal data held by an enterprise, what consent preferences a user 

	may express and to what degree, and in what ways he or she 

 

	can revoke their personal data. This builds on earlier work on defining 

	the different forms of revocation for personal data, and on formal 

	models of consent and revocation processes. The work and approach 

	discussed in this paper is currently carried out in the context of 

	the UK collaborative project EnCoRe (Ensuring Consent and Revocation).},

keywords = {},

pubstate = {published},

tppubtype = {inproceedings}

}

@inproceedings{Agrafiotis2009,

title = {Reaching for Informed Revocation: Shutting Off the Tap on Personal 

	Data},

author = {Ioannis Agrafiotis and Sadie Creese and Michael Goldsmith and Nikolaos 

	Papanikolaou},

url = {../files/primelife-revo.pdf},

year  = {2009},

date = {2009-09-01},

booktitle = {Proceedings of Fifth International Summer School on Privacy and Identity 

	Management for Life},

address = {Nice, France},

abstract = {We introduce a revocation model for handling personal data in cyberspace. 

	The model is motivated by a series of workshops undertaken by the 

	EnCoRe project aimed at understanding the control requirements of 

	a variety of data subjects. We observe that there is a lack of understanding 

	of the various technical options available for implementing revocation 

	preferences, and introduce the concept of informed revocation by 

	analogy to Faden and Beauchamp's informed consent. We argue that 

	we can overcome the limitations associated with informed consent 

	via the implementation of EnCoRe technology solutions. Finally, we 

	apply our model and demonstrate its validity to a number of data-handling 

	scenarios which have arisen in the context of the EnCoRe research 

	project. We have found that users tend to alter their default privacy 

	preferences when they are informed of all the different types of 

	revocation available to them.},

keywords = {},

pubstate = {published},

tppubtype = {inproceedings}

}

@inproceedings{Agrafiotis2009b,

title = {Reaching for Informed Revocation: Shutting Off the Tap on Personal 

	Data},

author = {Ioannis Agrafiotis and Sadie Creese and Michael Goldsmith and Nikolaos 

	Papanikolaou},

url = {../files/primelife-revo.pdf},

year  = {2009},

date = {2009-09-01},

booktitle = {Proceedings of Fifth International Summer School on Privacy and Identity 

	Management for Life},

address = {Nice, France},

abstract = {We introduce a revocation model for handling personal data in cyberspace. 

	The model is motivated by a series of workshops undertaken by the 

	EnCoRe project aimed at understanding the control requirements of 

	a variety of data subjects. We observe that there is a lack of understanding 

	of the various technical options available for implementing revocation 

	preferences, and introduce the concept of informed revocation by 

	analogy to Faden and Beauchamp's informed consent. We argue that 

	we can overcome the limitations associated with informed consent 

	via the implementation of EnCoRe technology solutions. Finally, we 

	apply our model and demonstrate its validity to a number of data-handling 

	scenarios which have arisen in the context of the EnCoRe research 

	project. We have found that users tend to alter their default privacy 

	preferences when they are informed of all the different types of 

	revocation available to them.},

keywords = {},

pubstate = {published},

tppubtype = {inproceedings}

}

@inproceedings{Papanikolaou2009b,

title = {Policy Refinement Checking},

author = {Nikolaos Papanikolaou and Sadie Creese and Michael Goldsmith},

url = {../files/polrefc-avocs.pdf},

year  = {2009},

date = {2009-09-01},

booktitle = {Proceedings of Ninth International Workshop on Automated Verification 

	of Critical Systems (AVoCS 09)},

address = {Swansea University},

abstract = {We introduce refinement checking for privacy policies expressed in 

	P3P. Our method involves a translation of privacy policies to a set 

	of process specifications in CSP, which describe how the privacy 

	policy is enforced. The technique is described through an example 

	involving medical data collected by a biobank.},

keywords = {},

pubstate = {published},

tppubtype = {inproceedings}

}