PoSecCo launches its second Empiric Study with the aim to better understand security and compliance processes. The results will be very useful for the consotium to in guaranteeing adequate applicability of project results as well as in confirming the relevance of the main focus of the project.

The survey takes about 10 to 15 minutes to complete and is in English. and is accessible via https://www.soscisurvey.de/posecco2013.

PoSecCo will have a booth at the “Information Security Solutions Europe 2012 (ISSE) ” Event in Brussels from October 23 to 24, 2012

1. Current and future challenges associated with policy and security management in cross-organizational settings,
2. requirements for appropriate tool support for service providers and auditors, and
3. pitfalls experienced with measuring the performance of policy and security management.

• a short summary highlighting the major findings (9 pages, PDF)
• a comprehensive overview about the study participants, questions asked, and results (180 pages, PDF)

147 practitioners and researchers working in the field of policy and security configuration management were surveyed online between December 2011 and March 2012. The main goal of the survey was to check whether the toolset developed within the scope of the PoSecCo project is considered relevant also by individuals beyond the project consortium. The results of the survey clearly indicate that the requirements specified under the guidance of the PoSecCo end-user partners are not only relevant for them but also for a larger group of organizations. The survey participants further reported that they do not feel well supported by software as well as non-software tools when performing the key activities addressed by the PoSecCo toolset. The survey shows that there is considerable potential for increasing the efficiency and effectiveness of policy and security configuration management in practice. The lack of appropriate tool support and the demand for it underline the project’s practical relevance. The results further indicate that auditing IT landscapes spanning across the borders of organizations is among the most challenging issues currently faced in the context of policy and security configuration management and that the importance of addressing it is going to increase within the next years. Heterogeneity of IT landscapes and requirements is considered a factor currently having a particularly strong impact on policy and security configuration management.

• Policy chain and the PoSecCo architecture - H. Plate (SAP)
• Security specification and harmonization - S. Paraboschi (University of Bergamo)
• Policy-based selection and configuration of security controls - A. Lioy (Politecnico di Torino)
• Policy-based audit of security configuration - S.Ponta (SAP)

• security managers
• compliance managers
• system administrators
• internal auditors
• operations managers
• vendor managers
• IT auditors

The first periodic review of PoSecCo (grant agreement no 257129) will take place on Thursday 15 December 2011 in Brussels, in the premises of the European Commission.

The objectives of the review, in particular, are to establish:

· the degree of fulfilment of the project work plan for the relevant period and of the related deliverables;

· the continued relevance of the objectives and breakthrough potential with respect to the scientific and industrial state of the art;

· the resources planned and utilised in relation to the achieved progress, in a manner consistent with the principles of economy, efficiency and effectiveness;

· the management procedures and methods of the project;

· the beneficiaries' contributions and integration within the project;

· the expected potential impact in economic, competition and social terms, and the beneficiaries' plan for the use and dissemination of foreground.

The second workshop of PoSecCo project was held from 11th to 13th of April 2011 in the premises of Crossgate in Munich, Germany. During this workshop, the project results of the first six months were presented. The three-days workshop laid the foundation for a common understanding on the 'Use-case descriptions' of our end-user partners: Crossgate and Deloitte. These use-cases have been validated by interviews with non-project organizations, and provide the basis for a formal, generic description of project requirements. Secondly, during this workshop an advance has been made in creating a descriptive service landscape model that allows to model services on the different architectural levels together with their topology and security-related features.