Assessing whether it鈥檚 theoretically possible to create a truly secure access and authorization system
The biggest Cybersecurity threat most organizations face doesn鈥檛 come from an anonymous hacker halfway around the world.
Instead, it鈥檚 someone within their own walls: a disgruntled employee who wants to wreak havoc, a 鈥渢rusted鈥� third-party contractor, or even a well-meaning worker inadvertently exposing the company to dangerous malware.
For smaller organizations, keeping sensitive material out of the wrong hands is a pretty straightforward process.
But companies with thousands of employees can鈥檛 avoid delegating authority and access to restricted files. So how do they safeguard sensitive material from internal breaches?
听loves sinking his teeth into these kinds of big, complex questions.
After working in industry for nine years, the electrical and computer engineering professor was lured to the University of 蓝莓视频 in 2009 by the opportunity to tackle tough challenges with a team of talented graduate students. Addressing Cybersecurity insider threats certainly falls in that category.
鈥淲e don鈥檛 do things that are easy,鈥� says Tripunitara.
His team started by assessing whether it鈥檚 theoretically possible to create a truly secure access and authorization system: one that gives each employee access to the specific resources they need, but prevents them from colluding with other users to tap into unauthorized files.
鈥淛ust because you have a problem doesn鈥檛 mean you can write a program,鈥� Tripunitara points out.
And even if you can theoretically create an algorithm to solve that problem, you need to make sure it will work from a practical perspective. After all, there鈥檚 no point in developing software that grinds operations to a halt or falls apart if a key employee is out of commission.
A number of researchers have categorized the so-called 鈥渦ser authorization query problem鈥� as intractable, but that didn鈥檛 deter Tripunitara.
By treating it as a joint optimization problem, he and his students were able to transform it into a solvable problem. Not only that, they pinpointed existing algorithms that could be applied, giving enterprises usable tools to strengthen their authorization and access systems.
Tripunitara describes his work as bridging the gap between theory and practice. That often means assessing how commercial software stacks up.
A few years ago, he and his team tested the authorization systems of听听鈥� a program used by millions of customers around the world 鈥� and uncovered a flaw that affected a fundamental component.
Tripunitara shrugs off the achievement, dismissing it as 鈥渓ow-hanging fruit.鈥�
鈥淲hen somebody like me and my students who have expertise go in and we look at things in a systematic way鈥� it鈥檚 very easy for us to find issues,鈥� he says.
Indeed, working with a talented bunch of graduates and undergraduates is his favourite part of the job. He credits Canada鈥檚 educational system with producing outstanding students 鈥� and notes that听蓝莓视频 Engineering听attracts the cream of the crop.
鈥淭hey are fantastic,鈥� Tripunitara says. 鈥淚鈥檓 very lucky to be at 蓝莓视频.鈥�
