The conflict between the need of protecting and sharing data is hampering the spread of big data applications. Security and privacy assurance is required to protect data owners, while data access and sharing are fundamental to implement smart big data solutions. In this context, access control systems can assume a central role in balancing data protection and data sharing. However, existing access control solutions are not general and scalable enough to address the software and technological complexity of big data ecosystems, being unable to support such a dynamic and collaborative environment. In this paper, we propose an access control system that enforces access to data in a distributed, multi-party big data environment. It is based on data annotations and secure data transformations performed at ingestion time. We show the feasibility of our approach in the smart city domain using an Apache-based big data engine.

mHealth applications are becoming increasingly widespread since they have the potential to reduce the cost of health care by favoring self-management of chronic diseases or to improve fitness activities. By their very nature, health applications collect and manage health sensitive data, therefore several concerns exist about how privacy, security, and confidentiality are handled. In this paper, we analyze the security issues of mHealth apps from two different perspectives: first, we highlight the security and privacy requirements on health data defined by data protection laws such as the General Data Protection Regulation (GDPR) in the EU, or the Health Insurance Portability and Accountability Act (HIPAA) in US. Then, we consider the security issues from a technological point of view, discussing how the app may protect user data. However, by analyzing a fitness app, we show that, at the moment, none of the well-known practices to protect data is followed, thus often mHealth apps are insecure.

After the NSA surveillance revelations in 2013, people became aware of the lack of privacy with respect to the US government. But are users aware that also apps may spy them, collect and even sell their personal data? From their common behavior during their always-connected every day life, it does not seem so: many people use apps that collect and send their browsing habits to third-parties. An example is the Pokémon GO app, a game that in a few months became a worldwide phenomenon, that in its Privacy policy clearly states that the user allows the app to access his emails, address book, location and other very private personal info. In this work, we examined consumers' attitudes and perceptions regarding their privacy by conducting a survey on 208 participants diverse in age, gender and education. Findings suggest that consumers have very low awareness on privacy issues, and that, when downloading apps, they often fail to read the privacy policy, where it is stated who will gather access to their data and which data will be collected by the app.

Abstract This article describes an approach for the automated verification of mobile systems. Mobile systems are characterized by the explicit notion oflocation(e.g., sites where they run) and the ability to execute at different locations, yielding a number of security issues. To this aim, we formalize mobile systems as Labeled Kripke Structures, encapsulating the notion oflocation netthat describes the hierarchical nesting of the threads constituting the system. Then, we formalize a genericsecurity-policy specification languagethat includes rules for expressing and manipulating the code location. In contrast to many other approaches, our technique supports both access control and information flow specification. We developed a prototype framework for model checking of mobile systems. It works directly on the program code (in contrast to most traditional process-algebraic approaches that can model only limited details of mobile systems) and uses abstraction-refinement techniques, based also on location abstractions, to manage the program state space. We experimented with a number of mobile code benchmarks by verifying various security policies. The experimental results demonstrate the validity of the proposed mobile system modeling and policy specification formalisms and highlight the advantages of the model checking-based approach, which combines the validation of security properties with other checks, such as the validation of buffer overflows.

Rôle-based access control (RBAC) is increasingly attracting attention because it reduces the complexity and cost of security administration by interposing the notion of rôle in the assignment of permissions to users. In this paper, we present a forma