*Dear Security SCOM members and W3C Colleagues *- we have two requests from Universities (Cornell and Berkeley) regarding studies they are conducting. Please let me know if you have any interest:
The Berkeley CISO/CSO study is described in the att. and the Cornell research is described below.
*
Please remember to dial in* for our monthly meeting this coming Thursday, April 10 at 1pm -
512-225-3050, pc 272373#. (details at the bottom of this email*)
Regards,
Roger
*
Cornell research on scalable data distribution*
Goal: We would like to develop a new generation of powerful, scalable
platform technologies for data distribution and event notification in
settings such as large financial installations. Cornell is one of the
research groups in this area, but we're working with an IBM research group
from Haifa and with the folks that did the ACE/TAO and DDS platforms at
Vanderbilt. Others worldwide are interested in similar topics. So the goal
is really a broad one.
Benefit to the banks: They need these technologies to keep up with the
tsunami of data and the soaring event rates seen in modern trading systems.
Existing solutions are known to be unstable under stress. By catalyzing
research they benefit when solutions find their way into products, companies
are launched, etc. They also hire the students who worked on and with the
research prototype systems.
Risk to the banks: instrumentation from their trading systems could create a
competitive risk -- their competitors are all looking for ways to gain a
small edge, for example in arbitrage situations.
Proposed solution: FSTC works as a neutral third party, collecting the data
sets, designing and executing protocols to anonymize the data, and providing
multiple data sets. End users see data from five banks, not just one, and
have no idea which data corresponds to which bank, not to mention when the
data was collected or other specifics.
The proposed trace: The data set of greatest interest to us at this time
would list groups (corresponding to equity symbols), subscribers
(corresponding to traders) and message rates (data rates, average message
sizes, for example at a minute by minute resolution).
The anonymity plan: we replace true group names with random symbols: IBM
becomes G571
We replace trader workstation IDs with random symbols: 123.75.68.1231 becomes
W1991
We report averages for statistics such as message size, rate, etc.
We remove any indication of the name of the bank from which the trace was
produced, and we eliminate any indication of when it was produced.
Other questions one could raise: Who owns the IP? We are hoping that FSTC
would make these traces public domain and not assert any rights at all. The
view here is that the members gain so much more by ending up with technology
advances that they can buy then they could possibly gain by fussing over
rights associated with access to the traces that the big win outweighs
anything else. Moreover, they WANT to buy these technologies: they want
guarantees of support, help integrating them, etc. A product from IBM or Red
Hat is far more appealing than a situation in which FSTC somehow ends up
"owning" all IP generated in connection with these trace data sets.
Precedent? Yahoo and Google are both releasing all sorts of data sets, with
similar things in mind. But none comes from a trading environment.
*Biography: Professor Ken Birman *(http://www.cs.cornell.edu/ken) is a
researcher at Cornell University, where he heads a team working to develop
new ways of programming distributed systems and new fault-tolerance tools. A
long-time friend of the banking community, Professor Birman founded and led
three companies that sold technologies to Wall Street, and in particular,
developed communication solutions that ran the NYSE and SX systems for more
than a decade. His team invented the first publish-subscribe system, and his
Isis Toolkit was widely used for financial systems fault-tolerance during an
extended period. He has a long record of consulting for major banks, stock
exchanges, the US Dept. of the Treasury, and other government organizations.
With his academic hat on, Professor Birman has authored hundreds of papers,
written several widely used textbooks, and worked with some of the world's
best young researchers to create dozens of innovative software systems, many
of which entered into wide use. FSTC members saw a different element of
Professor Birman's recent work "in action" in a March teleconference call,
during which he ran a demo of his new Live Objects platform. The demo was
captured on DVD, and can be seen at http://liveobjects.cs.cornell.edu.
*______________________
*
**Please join our Monthly FSTC Security Committee Meeting and our
excellent speakers this coming Thursday April 10^th at 1pm. The call-in
number is 512-2250-3050; pass-code: 272373# (See presentation
materials, att.)*
*Our meeting will focus on /Improving the Security of Our Applications.
/*
*Following an intro and overview by/ /Dan Schutzer:/ /
*
· *Robin Bloor from Hurwitz Associates *will speak about a paper
he wrote, and that we recently circulated: /The Anti Virus is Dead --
The Advent of the Graylist Approach. /This generated a good deal of
discussion from our members, so we are pleased that Robin will
personally summarize his observations and the current state of these
technologies.*
*
· *Warren Axelrod, from Bank of America *will extend the
discussion to discuss his presentation, Meaningful Metrics for
Application Security. (Warren's ideas are his own and do not represent
the official position for Bank of America) **
*Remember to register for this year's FSTC Annual Conference in Sonoma,
California. Details on our impressive list of speakers and interactive
panel discussions at www.fstc.org <http://www.fstc.org/> *
--
Roger D. Lang
FSTC Security SCOM
(O) 201-389-3571
(C) 917-538-8041