Text-overlap comparison
This pair was found by matching on title alone (find_title_bucket_dupes.py) — the usual paragraph-embedding similarity search never generated a candidate for it at any threshold. The exhibits below are near-exact word-shingle matches instead — a multi-word verbatim run is the more convincing evidence of shared text than embedding similarity, with the matched span highlighted.
PAPER A
EARLIER¶657-661
GUIDELINES FOR SECURING RFID SYSTEMS 6-14 information on the EPCglobal Guidelines on EPC for Consumer Products and a Frequently Asked Questions document is provided on the EPCglobal Inc Web site at http://www.epcglobalinc.org/public/ppsc_guide/. The Center for Democracy and Technology drafted Privacy Best Practices for Deployment of RFID Technology77 as a stakeholder response to privacy challenges posed when personally identifiable information is involved. 6.8 Summary Privacy considerations are interrelated with security considerations. A key objective of any RFID security program is to identify risks and controls for safeguarding PII. An organization implementing a security and privacy program for an RFID system should consult its privacy officer and legal counsel throughout the information system development life cycle. A privacy program may protect different types of personal information. Some information is personally identifiable, meaning that someone can use it to identify a particular individual. Other information may not be personally identifiable, but individuals may still consider it private even in settings where they are anonymous. For example, an individual anonymously traveling on a public bus may not want other passengers to know what items are in her handbag. Information that is not PII typically is not subject to legal requirements, but many people may still consider this information personal and worthy of safeguards. Therefore, organizations may still choose to implement privacy controls voluntarily to safeguard information its customers, business partners, employees, and other stakeholders consider personal.
LATER¶13-17
Research Methodology – Multi-Agent Approach The methodology is to present the combination of RFID and MAS approach. Three agents will be performing the tasks to analyze the problems of privacy and security for RFID and to provide solutions for the proposed problems using five phase multi-agent life cycle models. The goal of the first agent is to organize the system in PCM. The second agent will be defining the policies to conduct risk assessment and the third agent will do the verification and validation part to conduct a comprehensive set of tests to verify functionality in response to the inputs. Seclusion and Security Considerations Seclude considerations are interrelated with security considerations. A key objective of any RFID security program is to identify risks and controls for safeguarding personally identifiable Specialty Journal of Psychology and Management, 2015, Vol, 1 (1): 10-16 13 information. An organization implementing a security and privacy program for an RFID system should consult its privacy officer and legal counsel throughout the information system development life cycle. Solutions for RFID Problems Using Five Phase Multi-Agent Life Cycle Models In order to support the business processes it automates the RFID systems should be highly customized. In spite of that, organizations can be benefited when using RFID technology. It gives a description of a set of recommended security practices that can help organizations manage RFID risks to a satisfactory level. RFID security controls should be incorporated throughout the entire life cycle – from policy development to operations in order to be effective. The five-phase multi agent life cycle helps organization to determine the most appropriate actions to take at each point in the development of the RFID system.
EARLIER¶657-661
GUIDELINES FOR SECURING RFID SYSTEMS 6-14 information on the EPCglobal Guidelines on EPC for Consumer Products and a Frequently Asked Questions document is provided on the EPCglobal Inc Web site at http://www.epcglobalinc.org/public/ppsc_guide/. The Center for Democracy and Technology drafted Privacy Best Practices for Deployment of RFID Technology77 as a stakeholder response to privacy challenges posed when personally identifiable information is involved. 6.8 Summary Privacy considerations are interrelated with security considerations. A key objective of any RFID security program is to identify risks and controls for safeguarding PII. An organization implementing a security and privacy program for an RFID system should consult its privacy officer and legal counsel throughout the information system development life cycle. A privacy program may protect different types of personal information. Some information is personally identifiable, meaning that someone can use it to identify a particular individual. Other information may not be personally identifiable, but individuals may still consider it private even in settings where they are anonymous. For example, an individual anonymously traveling on a public bus may not want other passengers to know what items are in her handbag. Information that is not PII typically is not subject to legal requirements, but many people may still consider this information personal and worthy of safeguards. Therefore, organizations may still choose to implement privacy controls voluntarily to safeguard information its customers, business partners, employees, and other stakeholders consider personal.
LATER¶14-18
The goal of the first agent is to organize the system in PCM. The second agent will be defining the policies to conduct risk assessment and the third agent will do the verification and validation part to conduct a comprehensive set of tests to verify functionality in response to the inputs. Seclusion and Security Considerations Seclude considerations are interrelated with security considerations. A key objective of any RFID security program is to identify risks and controls for safeguarding personally identifiable Specialty Journal of Psychology and Management, 2015, Vol, 1 (1): 10-16 13 information. An organization implementing a security and privacy program for an RFID system should consult its privacy officer and legal counsel throughout the information system development life cycle. Solutions for RFID Problems Using Five Phase Multi-Agent Life Cycle Models In order to support the business processes it automates the RFID systems should be highly customized. In spite of that, organizations can be benefited when using RFID technology. It gives a description of a set of recommended security practices that can help organizations manage RFID risks to a satisfactory level. RFID security controls should be incorporated throughout the entire life cycle – from policy development to operations in order to be effective. The five-phase multi agent life cycle helps organization to determine the most appropriate actions to take at each point in the development of the RFID system. Proposed System Life Cycle Phases The phases of the life cycles of MAS are as follows. Phase 1: Initiation The initiation phase covers the tasks that an organization should perform before it starts to design its multi agent RFID system. This includes conducting a risk assessment and developing policy and requirements with which the RFID system must abide by. Figure 2 illustrates the multiagent process of RFID risk assessment.
EARLIER¶663-667
The Federal CIO Council developed a list of privacy control families that provide a reference framework for those integrating privacy principles into RFID systems. In some cases, controls can serve to enhance both security and privacy. In other cases, the privacy controls complement security controls. Since RFID implementations are typically highly customized, the privacy controls listed are not always applicable or may not be effective for all RFID systems. 77 Center for Democracy and Technology, "CDT Working Group on RFID: Privacy Best Practices for Deployment of RFID Technology," Interim Draft, May 1, 2006, http://www.cdt.org/privacy/20060501rfid-best-practices.php. SECTION 7: RECOMMENDED PRACTICES 7-1 7. Recommended Practices As explained in Sections 2 through 5, there are numerous ways to implement and configure RFID systems to support a wide variety of applications. RFID systems typically must be highly customized to support the business processes they automate; no one-size-fits-all approach will work across implementations. Nevertheless, organizations can benefit from following some general principles when using RFID technology. This section describes a set of recommended security practices that can help organizations manage RFID risks to an acceptable level. To be most effective, RFID security controls should be incorporated throughout the entire life cycle – from policy development to operations. This section references a five-phase life cycle to help organizations determine the most appropriate actions to take at each point in the development of the RFID system. The life cycle is based on a model introduced in NIST Special Publication 800-64, Security Considerations in the Information System Development Life Cycle. Organizations may follow a project management methodology or life cycle model that does not directly map to the phases presented here, but the types of tasks and their sequencing are probably similar. The phases of the life cycle are as follows: Phase 1: Initiation. This phase covers the tasks that an organization should perform before it starts to design its RFID system. These tasks include conducting a risk assessment and developing policy and requirements with which the RFID system must comply.
LATER¶15-19
Seclusion and Security Considerations Seclude considerations are interrelated with security considerations. A key objective of any RFID security program is to identify risks and controls for safeguarding personally identifiable Specialty Journal of Psychology and Management, 2015, Vol, 1 (1): 10-16 13 information. An organization implementing a security and privacy program for an RFID system should consult its privacy officer and legal counsel throughout the information system development life cycle. Solutions for RFID Problems Using Five Phase Multi-Agent Life Cycle Models In order to support the business processes it automates the RFID systems should be highly customized. In spite of that, organizations can be benefited when using RFID technology. It gives a description of a set of recommended security practices that can help organizations manage RFID risks to a satisfactory level. RFID security controls should be incorporated throughout the entire life cycle – from policy development to operations in order to be effective. The five-phase multi agent life cycle helps organization to determine the most appropriate actions to take at each point in the development of the RFID system. Proposed System Life Cycle Phases The phases of the life cycles of MAS are as follows. Phase 1: Initiation The initiation phase covers the tasks that an organization should perform before it starts to design its multi agent RFID system. This includes conducting a risk assessment and developing policy and requirements with which the RFID system must abide by. Figure 2 illustrates the multiagent process of RFID risk assessment. Phase 2: Acquisition/Development This phase is split into two sub-phases: Planning and design and Procurement. Planning and Design In this sub-phase, RFID network architects specify the standards with which the RFID system must follow with the agent, the network infrastructure that will support the system, and the technical characteristics of the RFID system, including the types of tag and readers that will be deployed.
EARLIER¶664-668
77 Center for Democracy and Technology, "CDT Working Group on RFID: Privacy Best Practices for Deployment of RFID Technology," Interim Draft, May 1, 2006, http://www.cdt.org/privacy/20060501rfid-best-practices.php. SECTION 7: RECOMMENDED PRACTICES 7-1 7. Recommended Practices As explained in Sections 2 through 5, there are numerous ways to implement and configure RFID systems to support a wide variety of applications. RFID systems typically must be highly customized to support the business processes they automate; no one-size-fits-all approach will work across implementations. Nevertheless, organizations can benefit from following some general principles when using RFID technology. This section describes a set of recommended security practices that can help organizations manage RFID risks to an acceptable level. To be most effective, RFID security controls should be incorporated throughout the entire life cycle – from policy development to operations. This section references a five-phase life cycle to help organizations determine the most appropriate actions to take at each point in the development of the RFID system. The life cycle is based on a model introduced in NIST Special Publication 800-64, Security Considerations in the Information System Development Life Cycle. Organizations may follow a project management methodology or life cycle model that does not directly map to the phases presented here, but the types of tasks and their sequencing are probably similar. The phases of the life cycle are as follows: Phase 1: Initiation. This phase covers the tasks that an organization should perform before it starts to design its RFID system. These tasks include conducting a risk assessment and developing policy and requirements with which the RFID system must comply. Phase 2: Acquisition/Development. For the purposes of this guide, the acquisition/development phase is split into two sub-phases: – Phase 2a: Planning and Design. In this phase, RFID network architects specify the
LATER¶15-19
Seclusion and Security Considerations Seclude considerations are interrelated with security considerations. A key objective of any RFID security program is to identify risks and controls for safeguarding personally identifiable Specialty Journal of Psychology and Management, 2015, Vol, 1 (1): 10-16 13 information. An organization implementing a security and privacy program for an RFID system should consult its privacy officer and legal counsel throughout the information system development life cycle. Solutions for RFID Problems Using Five Phase Multi-Agent Life Cycle Models In order to support the business processes it automates the RFID systems should be highly customized. In spite of that, organizations can be benefited when using RFID technology. It gives a description of a set of recommended security practices that can help organizations manage RFID risks to a satisfactory level. RFID security controls should be incorporated throughout the entire life cycle – from policy development to operations in order to be effective. The five-phase multi agent life cycle helps organization to determine the most appropriate actions to take at each point in the development of the RFID system. Proposed System Life Cycle Phases The phases of the life cycles of MAS are as follows. Phase 1: Initiation The initiation phase covers the tasks that an organization should perform before it starts to design its multi agent RFID system. This includes conducting a risk assessment and developing policy and requirements with which the RFID system must abide by. Figure 2 illustrates the multiagent process of RFID risk assessment. Phase 2: Acquisition/Development This phase is split into two sub-phases: Planning and design and Procurement. Planning and Design In this sub-phase, RFID network architects specify the standards with which the RFID system must follow with the agent, the network infrastructure that will support the system, and the technical characteristics of the RFID system, including the types of tag and readers that will be deployed.
EARLIER¶56-60
Privacy regulations and guidance are often complex and change over time. Organizations planning, implementing, or managing an RFID system should always consult with the organization’s privacy officer, legal counsel, and chief information officer. When securing an RFID system, organizations should select security controls that are compatible with the RFID technologies they currently deploy or purchase new RFID technologies that support the necessary controls. To be most effective, RFID security controls should be incorporated throughout the entire life cycle of RFID systems—from policy development and design to operations and retirement. However, many RFID products support only a fraction of the possible protection mechanisms. Tags, in particular, have very limited computing capabilities. Most tags supporting asset management applications do not support authentication, access control, or encryption techniques commonly found in other business IT systems. RFID standards specify security features including passwords to protect access to certain tag commands and memory, but the level of security offered differs across these standards. Vendors also offer proprietary security features, including proprietary extensions to standards-based technologies, but they are not always compatible with other components of the system. Careful planning and procurement is necessary to ensure an organization’s RFID system meets its security objectives. GUIDELINES FOR SECURING RFID SYSTEMS ES-4 This page has been left blank intentionally. SECTION 1: INTRODUCTION 1-1 1. Introduction 1.1 Authority The National Institute of Standards and Technology (NIST) developed this document in furtherance of its statutory responsibilities under the Federal Information Security Management Act (FISMA) of 2002, Public Law 107-347. NIST is responsible for developing standards and guidelines, including minimum requirements, for providing adequate information security for all agency operations and assets; but such standards and guidelines shall not apply to national security systems. This guideline is consistent with the requirements of the Office of Management and Budget (OMB) Circular A-130, Section 8b(3), “Securing Agency Information Systems,” as analyzed in A-130, Appendix IV: Analysis of Key Sections. Supplemental information is provided in A-130, Appendix III.
LATER¶15-19
Seclusion and Security Considerations Seclude considerations are interrelated with security considerations. A key objective of any RFID security program is to identify risks and controls for safeguarding personally identifiable Specialty Journal of Psychology and Management, 2015, Vol, 1 (1): 10-16 13 information. An organization implementing a security and privacy program for an RFID system should consult its privacy officer and legal counsel throughout the information system development life cycle. Solutions for RFID Problems Using Five Phase Multi-Agent Life Cycle Models In order to support the business processes it automates the RFID systems should be highly customized. In spite of that, organizations can be benefited when using RFID technology. It gives a description of a set of recommended security practices that can help organizations manage RFID risks to a satisfactory level. RFID security controls should be incorporated throughout the entire life cycle – from policy development to operations in order to be effective. The five-phase multi agent life cycle helps organization to determine the most appropriate actions to take at each point in the development of the RFID system. Proposed System Life Cycle Phases The phases of the life cycles of MAS are as follows. Phase 1: Initiation The initiation phase covers the tasks that an organization should perform before it starts to design its multi agent RFID system. This includes conducting a risk assessment and developing policy and requirements with which the RFID system must abide by. Figure 2 illustrates the multiagent process of RFID risk assessment. Phase 2: Acquisition/Development This phase is split into two sub-phases: Planning and design and Procurement. Planning and Design In this sub-phase, RFID network architects specify the standards with which the RFID system must follow with the agent, the network infrastructure that will support the system, and the technical characteristics of the RFID system, including the types of tag and readers that will be deployed.
EARLIER¶664-668
77 Center for Democracy and Technology, "CDT Working Group on RFID: Privacy Best Practices for Deployment of RFID Technology," Interim Draft, May 1, 2006, http://www.cdt.org/privacy/20060501rfid-best-practices.php. SECTION 7: RECOMMENDED PRACTICES 7-1 7. Recommended Practices As explained in Sections 2 through 5, there are numerous ways to implement and configure RFID systems to support a wide variety of applications. RFID systems typically must be highly customized to support the business processes they automate; no one-size-fits-all approach will work across implementations. Nevertheless, organizations can benefit from following some general principles when using RFID technology. This section describes a set of recommended security practices that can help organizations manage RFID risks to an acceptable level. To be most effective, RFID security controls should be incorporated throughout the entire life cycle – from policy development to operations. This section references a five-phase life cycle to help organizations determine the most appropriate actions to take at each point in the development of the RFID system. The life cycle is based on a model introduced in NIST Special Publication 800-64, Security Considerations in the Information System Development Life Cycle. Organizations may follow a project management methodology or life cycle model that does not directly map to the phases presented here, but the types of tasks and their sequencing are probably similar. The phases of the life cycle are as follows: Phase 1: Initiation. This phase covers the tasks that an organization should perform before it starts to design its RFID system. These tasks include conducting a risk assessment and developing policy and requirements with which the RFID system must comply. Phase 2: Acquisition/Development. For the purposes of this guide, the acquisition/development phase is split into two sub-phases: – Phase 2a: Planning and Design. In this phase, RFID network architects specify the
LATER¶15-19
Seclusion and Security Considerations Seclude considerations are interrelated with security considerations. A key objective of any RFID security program is to identify risks and controls for safeguarding personally identifiable Specialty Journal of Psychology and Management, 2015, Vol, 1 (1): 10-16 13 information. An organization implementing a security and privacy program for an RFID system should consult its privacy officer and legal counsel throughout the information system development life cycle. Solutions for RFID Problems Using Five Phase Multi-Agent Life Cycle Models In order to support the business processes it automates the RFID systems should be highly customized. In spite of that, organizations can be benefited when using RFID technology. It gives a description of a set of recommended security practices that can help organizations manage RFID risks to a satisfactory level. RFID security controls should be incorporated throughout the entire life cycle – from policy development to operations in order to be effective. The five-phase multi agent life cycle helps organization to determine the most appropriate actions to take at each point in the development of the RFID system. Proposed System Life Cycle Phases The phases of the life cycles of MAS are as follows. Phase 1: Initiation The initiation phase covers the tasks that an organization should perform before it starts to design its multi agent RFID system. This includes conducting a risk assessment and developing policy and requirements with which the RFID system must abide by. Figure 2 illustrates the multiagent process of RFID risk assessment. Phase 2: Acquisition/Development This phase is split into two sub-phases: Planning and design and Procurement. Planning and Design In this sub-phase, RFID network architects specify the standards with which the RFID system must follow with the agent, the network infrastructure that will support the system, and the technical characteristics of the RFID system, including the types of tag and readers that will be deployed.
EARLIER¶665-669
SECTION 7: RECOMMENDED PRACTICES 7-1 7. Recommended Practices As explained in Sections 2 through 5, there are numerous ways to implement and configure RFID systems to support a wide variety of applications. RFID systems typically must be highly customized to support the business processes they automate; no one-size-fits-all approach will work across implementations. Nevertheless, organizations can benefit from following some general principles when using RFID technology. This section describes a set of recommended security practices that can help organizations manage RFID risks to an acceptable level. To be most effective, RFID security controls should be incorporated throughout the entire life cycle – from policy development to operations. This section references a five-phase life cycle to help organizations determine the most appropriate actions to take at each point in the development of the RFID system. The life cycle is based on a model introduced in NIST Special Publication 800-64, Security Considerations in the Information System Development Life Cycle. Organizations may follow a project management methodology or life cycle model that does not directly map to the phases presented here, but the types of tasks and their sequencing are probably similar. The phases of the life cycle are as follows: Phase 1: Initiation. This phase covers the tasks that an organization should perform before it starts to design its RFID system. These tasks include conducting a risk assessment and developing policy and requirements with which the RFID system must comply. Phase 2: Acquisition/Development. For the purposes of this guide, the acquisition/development phase is split into two sub-phases: – Phase 2a: Planning and Design. In this phase, RFID network architects specify the standards with which the RFID system must comply, the network infrastructure that will support the system, and the technical characteristics of the RFID system, including the types of tag and readers that will be deployed. This phase should also include site surveys of the facilities and relevant IT infrastructure.
LATER¶16-20
Specialty Journal of Psychology and Management, 2015, Vol, 1 (1): 10-16 13 information. An organization implementing a security and privacy program for an RFID system should consult its privacy officer and legal counsel throughout the information system development life cycle. Solutions for RFID Problems Using Five Phase Multi-Agent Life Cycle Models In order to support the business processes it automates the RFID systems should be highly customized. In spite of that, organizations can be benefited when using RFID technology. It gives a description of a set of recommended security practices that can help organizations manage RFID risks to a satisfactory level. RFID security controls should be incorporated throughout the entire life cycle – from policy development to operations in order to be effective. The five-phase multi agent life cycle helps organization to determine the most appropriate actions to take at each point in the development of the RFID system. Proposed System Life Cycle Phases The phases of the life cycles of MAS are as follows. Phase 1: Initiation The initiation phase covers the tasks that an organization should perform before it starts to design its multi agent RFID system. This includes conducting a risk assessment and developing policy and requirements with which the RFID system must abide by. Figure 2 illustrates the multiagent process of RFID risk assessment. Phase 2: Acquisition/Development This phase is split into two sub-phases: Planning and design and Procurement. Planning and Design In this sub-phase, RFID network architects specify the standards with which the RFID system must follow with the agent, the network infrastructure that will support the system, and the technical characteristics of the RFID system, including the types of tag and readers that will be deployed. Procurement In this sub-phase, the organization specifies the RFID components that must be purchased, the feature sets and protocols they must support the agent software, and any standards on which they must be based.
EARLIER¶665-669
SECTION 7: RECOMMENDED PRACTICES 7-1 7. Recommended Practices As explained in Sections 2 through 5, there are numerous ways to implement and configure RFID systems to support a wide variety of applications. RFID systems typically must be highly customized to support the business processes they automate; no one-size-fits-all approach will work across implementations. Nevertheless, organizations can benefit from following some general principles when using RFID technology. This section describes a set of recommended security practices that can help organizations manage RFID risks to an acceptable level. To be most effective, RFID security controls should be incorporated throughout the entire life cycle – from policy development to operations. This section references a five-phase life cycle to help organizations determine the most appropriate actions to take at each point in the development of the RFID system. The life cycle is based on a model introduced in NIST Special Publication 800-64, Security Considerations in the Information System Development Life Cycle. Organizations may follow a project management methodology or life cycle model that does not directly map to the phases presented here, but the types of tasks and their sequencing are probably similar. The phases of the life cycle are as follows: Phase 1: Initiation. This phase covers the tasks that an organization should perform before it starts to design its RFID system. These tasks include conducting a risk assessment and developing policy and requirements with which the RFID system must comply. Phase 2: Acquisition/Development. For the purposes of this guide, the acquisition/development phase is split into two sub-phases: – Phase 2a: Planning and Design. In this phase, RFID network architects specify the standards with which the RFID system must comply, the network infrastructure that will support the system, and the technical characteristics of the RFID system, including the types of tag and readers that will be deployed. This phase should also include site surveys of the facilities and relevant IT infrastructure.
LATER¶16-20
Specialty Journal of Psychology and Management, 2015, Vol, 1 (1): 10-16 13 information. An organization implementing a security and privacy program for an RFID system should consult its privacy officer and legal counsel throughout the information system development life cycle. Solutions for RFID Problems Using Five Phase Multi-Agent Life Cycle Models In order to support the business processes it automates the RFID systems should be highly customized. In spite of that, organizations can be benefited when using RFID technology. It gives a description of a set of recommended security practices that can help organizations manage RFID risks to a satisfactory level. RFID security controls should be incorporated throughout the entire life cycle – from policy development to operations in order to be effective. The five-phase multi agent life cycle helps organization to determine the most appropriate actions to take at each point in the development of the RFID system. Proposed System Life Cycle Phases The phases of the life cycles of MAS are as follows. Phase 1: Initiation The initiation phase covers the tasks that an organization should perform before it starts to design its multi agent RFID system. This includes conducting a risk assessment and developing policy and requirements with which the RFID system must abide by. Figure 2 illustrates the multiagent process of RFID risk assessment. Phase 2: Acquisition/Development This phase is split into two sub-phases: Planning and design and Procurement. Planning and Design In this sub-phase, RFID network architects specify the standards with which the RFID system must follow with the agent, the network infrastructure that will support the system, and the technical characteristics of the RFID system, including the types of tag and readers that will be deployed. Procurement In this sub-phase, the organization specifies the RFID components that must be purchased, the feature sets and protocols they must support the agent software, and any standards on which they must be based.
EARLIER¶666-671
To be most effective, RFID security controls should be incorporated throughout the entire life cycle – from policy development to operations. This section references a five-phase life cycle to help organizations determine the most appropriate actions to take at each point in the development of the RFID system. The life cycle is based on a model introduced in NIST Special Publication 800-64, Security Considerations in the Information System Development Life Cycle. Organizations may follow a project management methodology or life cycle model that does not directly map to the phases presented here, but the types of tasks and their sequencing are probably similar. The phases of the life cycle are as follows: Phase 1: Initiation. This phase covers the tasks that an organization should perform before it starts to design its RFID system. These tasks include conducting a risk assessment and developing policy and requirements with which the RFID system must comply. Phase 2: Acquisition/Development. For the purposes of this guide, the acquisition/development phase is split into two sub-phases: – Phase 2a: Planning and Design. In this phase, RFID network architects specify the standards with which the RFID system must comply, the network infrastructure that will support the system, and the technical characteristics of the RFID system, including the types of tag and readers that will be deployed. This phase should also include site surveys of the facilities and relevant IT infrastructure. – Phase 2b: Procurement. In this phase, the organization specifies the RFID components that must be purchased, the feature sets and protocols they must support, and any standards on which they must be based. Phase 3: Implementation. In this phase, procured equipment is configured to meet operational and security requirements, RFID data is integrated with legacy enterprise systems, and staff are trained in the proper use and maintenance of the system.
LATER¶17-21
Solutions for RFID Problems Using Five Phase Multi-Agent Life Cycle Models In order to support the business processes it automates the RFID systems should be highly customized. In spite of that, organizations can be benefited when using RFID technology. It gives a description of a set of recommended security practices that can help organizations manage RFID risks to a satisfactory level. RFID security controls should be incorporated throughout the entire life cycle – from policy development to operations in order to be effective. The five-phase multi agent life cycle helps organization to determine the most appropriate actions to take at each point in the development of the RFID system. Proposed System Life Cycle Phases The phases of the life cycles of MAS are as follows. Phase 1: Initiation The initiation phase covers the tasks that an organization should perform before it starts to design its multi agent RFID system. This includes conducting a risk assessment and developing policy and requirements with which the RFID system must abide by. Figure 2 illustrates the multiagent process of RFID risk assessment. Phase 2: Acquisition/Development This phase is split into two sub-phases: Planning and design and Procurement. Planning and Design In this sub-phase, RFID network architects specify the standards with which the RFID system must follow with the agent, the network infrastructure that will support the system, and the technical characteristics of the RFID system, including the types of tag and readers that will be deployed. Procurement In this sub-phase, the organization specifies the RFID components that must be purchased, the feature sets and protocols they must support the agent software, and any standards on which they must be based. Phase 3: Implementation In this phase, procured equipment is configured to meet operational and security requirements, RFID data is integrated with legacy enterprise systems.
EARLIER¶667-671
Phase 1: Initiation. This phase covers the tasks that an organization should perform before it starts to design its RFID system. These tasks include conducting a risk assessment and developing policy and requirements with which the RFID system must comply. Phase 2: Acquisition/Development. For the purposes of this guide, the acquisition/development phase is split into two sub-phases: – Phase 2a: Planning and Design. In this phase, RFID network architects specify the standards with which the RFID system must comply, the network infrastructure that will support the system, and the technical characteristics of the RFID system, including the types of tag and readers that will be deployed. This phase should also include site surveys of the facilities and relevant IT infrastructure. – Phase 2b: Procurement. In this phase, the organization specifies the RFID components that must be purchased, the feature sets and protocols they must support, and any standards on which they must be based. Phase 3: Implementation. In this phase, procured equipment is configured to meet operational and security requirements, RFID data is integrated with legacy enterprise systems, and staff are trained in the proper use and maintenance of the system.
LATER¶17-21
Solutions for RFID Problems Using Five Phase Multi-Agent Life Cycle Models In order to support the business processes it automates the RFID systems should be highly customized. In spite of that, organizations can be benefited when using RFID technology. It gives a description of a set of recommended security practices that can help organizations manage RFID risks to a satisfactory level. RFID security controls should be incorporated throughout the entire life cycle – from policy development to operations in order to be effective. The five-phase multi agent life cycle helps organization to determine the most appropriate actions to take at each point in the development of the RFID system. Proposed System Life Cycle Phases The phases of the life cycles of MAS are as follows. Phase 1: Initiation The initiation phase covers the tasks that an organization should perform before it starts to design its multi agent RFID system. This includes conducting a risk assessment and developing policy and requirements with which the RFID system must abide by. Figure 2 illustrates the multiagent process of RFID risk assessment. Phase 2: Acquisition/Development This phase is split into two sub-phases: Planning and design and Procurement. Planning and Design In this sub-phase, RFID network architects specify the standards with which the RFID system must follow with the agent, the network infrastructure that will support the system, and the technical characteristics of the RFID system, including the types of tag and readers that will be deployed. Procurement In this sub-phase, the organization specifies the RFID components that must be purchased, the feature sets and protocols they must support the agent software, and any standards on which they must be based. Phase 3: Implementation In this phase, procured equipment is configured to meet operational and security requirements, RFID data is integrated with legacy enterprise systems.
EARLIER¶668-672
Phase 2: Acquisition/Development. For the purposes of this guide, the acquisition/development phase is split into two sub-phases: – Phase 2a: Planning and Design. In this phase, RFID network architects specify the standards with which the RFID system must comply, the network infrastructure that will support the system, and the technical characteristics of the RFID system, including the types of tag and readers that will be deployed. This phase should also include site surveys of the facilities and relevant IT infrastructure. – Phase 2b: Procurement. In this phase, the organization specifies the RFID components that must be purchased, the feature sets and protocols they must support, and any standards on which they must be based. Phase 3: Implementation. In this phase, procured equipment is configured to meet operational and security requirements, RFID data is integrated with legacy enterprise systems, and staff are trained in the proper use and maintenance of the system. Phase 4: Operations/Maintenance. This phase includes security-related tasks that an organization should perform on an ongoing basis once the RFID system is operational, including conducting periodic security assessments, applying security-related software patches, and reviewing RFID event logs.
LATER¶18-22
Proposed System Life Cycle Phases The phases of the life cycles of MAS are as follows. Phase 1: Initiation The initiation phase covers the tasks that an organization should perform before it starts to design its multi agent RFID system. This includes conducting a risk assessment and developing policy and requirements with which the RFID system must abide by. Figure 2 illustrates the multiagent process of RFID risk assessment. Phase 2: Acquisition/Development This phase is split into two sub-phases: Planning and design and Procurement. Planning and Design In this sub-phase, RFID network architects specify the standards with which the RFID system must follow with the agent, the network infrastructure that will support the system, and the technical characteristics of the RFID system, including the types of tag and readers that will be deployed. Procurement In this sub-phase, the organization specifies the RFID components that must be purchased, the feature sets and protocols they must support the agent software, and any standards on which they must be based. Phase 3: Implementation In this phase, procured equipment is configured to meet operational and security requirements, RFID data is integrated with legacy enterprise systems. Specialty Journal of Psychology and Management, 2015, Vol, 1 (1): 10-16 14 Phase 4: Operations/Maintenance This phase includes security-related tasks that an organization should perform on an ongoing basis once the RFID system is operational, including conducting periodic security assessments, applying security-related software patches, and reviewing RFID event logs.
EARLIER¶668-673
Phase 2: Acquisition/Development. For the purposes of this guide, the acquisition/development phase is split into two sub-phases: – Phase 2a: Planning and Design. In this phase, RFID network architects specify the standards with which the RFID system must comply, the network infrastructure that will support the system, and the technical characteristics of the RFID system, including the types of tag and readers that will be deployed. This phase should also include site surveys of the facilities and relevant IT infrastructure. – Phase 2b: Procurement. In this phase, the organization specifies the RFID components that must be purchased, the feature sets and protocols they must support, and any standards on which they must be based. Phase 3: Implementation. In this phase, procured equipment is configured to meet operational and security requirements, RFID data is integrated with legacy enterprise systems, and staff are trained in the proper use and maintenance of the system. Phase 4: Operations/Maintenance. This phase includes security-related tasks that an organization should perform on an ongoing basis once the RFID system is operational, including conducting periodic security assessments, applying security-related software patches, and reviewing RFID event logs. Phase 5: Disposition. This phase encompasses tasks that occur when a system or its components have been retired, perhaps as a result of a significant upgrade. These tasks include preserving information to meet legal requirements and disabling or destroying tags and other components when they are taken out of service.
LATER¶18-23
Proposed System Life Cycle Phases The phases of the life cycles of MAS are as follows. Phase 1: Initiation The initiation phase covers the tasks that an organization should perform before it starts to design its multi agent RFID system. This includes conducting a risk assessment and developing policy and requirements with which the RFID system must abide by. Figure 2 illustrates the multiagent process of RFID risk assessment. Phase 2: Acquisition/Development This phase is split into two sub-phases: Planning and design and Procurement. Planning and Design In this sub-phase, RFID network architects specify the standards with which the RFID system must follow with the agent, the network infrastructure that will support the system, and the technical characteristics of the RFID system, including the types of tag and readers that will be deployed. Procurement In this sub-phase, the organization specifies the RFID components that must be purchased, the feature sets and protocols they must support the agent software, and any standards on which they must be based. Phase 3: Implementation In this phase, procured equipment is configured to meet operational and security requirements, RFID data is integrated with legacy enterprise systems. Specialty Journal of Psychology and Management, 2015, Vol, 1 (1): 10-16 14 Phase 4: Operations/Maintenance This phase includes security-related tasks that an organization should perform on an ongoing basis once the RFID system is operational, including conducting periodic security assessments, applying security-related software patches, and reviewing RFID event logs. Phase 5: Disposition This phase encompasses tasks that occur when a system or its components have been retired, perhaps as a result of a significant upgrade. These tasks include preserving information to meet legal requirements and disabling or destroying tags and other components when they are taken out of service. Case Study: Project Chain Management of Hazardous Materials
EARLIER¶670-675
– Phase 2b: Procurement. In this phase, the organization specifies the RFID components that must be purchased, the feature sets and protocols they must support, and any standards on which they must be based. Phase 3: Implementation. In this phase, procured equipment is configured to meet operational and security requirements, RFID data is integrated with legacy enterprise systems, and staff are trained in the proper use and maintenance of the system. Phase 4: Operations/Maintenance. This phase includes security-related tasks that an organization should perform on an ongoing basis once the RFID system is operational, including conducting periodic security assessments, applying security-related software patches, and reviewing RFID event logs. Phase 5: Disposition. This phase encompasses tasks that occur when a system or its components have been retired, perhaps as a result of a significant upgrade. These tasks include preserving information to meet legal requirements and disabling or destroying tags and other components when they are taken out of service. The practices presented in this section are provided in tables corresponding to the life cycle phases. Each practice is accompanied by a brief explanation of the rationale for its inclusion and is rated as “recommended” or “should consider.” Organizations are strongly encouraged to adopt the “recommended” practices. Failure to implement them significantly increases the risk of an RFID security GUIDELINES FOR SECURING RFID SYSTEMS 7-2 failure. Organizations should also examine each of the “should consider” practices to determine their applicability to the target environment. A “should consider” practice should be rejected only if it is infeasible or if the reduction in risk from its implementation does not justify its cost.
LATER¶20-25
Procurement In this sub-phase, the organization specifies the RFID components that must be purchased, the feature sets and protocols they must support the agent software, and any standards on which they must be based. Phase 3: Implementation In this phase, procured equipment is configured to meet operational and security requirements, RFID data is integrated with legacy enterprise systems. Specialty Journal of Psychology and Management, 2015, Vol, 1 (1): 10-16 14 Phase 4: Operations/Maintenance This phase includes security-related tasks that an organization should perform on an ongoing basis once the RFID system is operational, including conducting periodic security assessments, applying security-related software patches, and reviewing RFID event logs. Phase 5: Disposition This phase encompasses tasks that occur when a system or its components have been retired, perhaps as a result of a significant upgrade. These tasks include preserving information to meet legal requirements and disabling or destroying tags and other components when they are taken out of service. Case Study: Project Chain Management of Hazardous Materials Radionuclide Transportation Agency (RTA) oversees the movement of radioactive research materials between production facilities, national laboratories, military installations, and other relevant locations. The RTA oversight of the supply chain for these materials involves many of the same issues as in most any other supply chain. The agency wants to know who is in possession of what quantity of materials at any given time. It also wants to locate materials at a site quickly, without having to search through numerous containers to find them.(Garfinkel and Rosenberg, 2005). Bar code technology does not provide that capability. Some of RTA’s requirements are more unique. For instance, much of the transported radionuclide material must be closely monitored because extreme temperatures or excessive vibration can make it useless for its intended applications. Consequently, RTA wants temperature and vibration sensors to continuously measure environmental conditions and record readings on the tag. Additionally, the handling of RTAregulated materials is a homeland and national security issue.(Matta and Koonce, 2009) If the materials were to fall into unauthorized hands, they could endanger the public welfare. Initiation Phase Risk assessment is done by the learning agent, which identified a number of concerns, the most significant of which were as follows: 1) An agent could identify and target a vehicle containing RTA-regulated material. 2) An adversary can eavesdrop on tag transactions to learn the characteristics of the material, which could help determine whether it is worth stealing. 3) It could damage or disable a tag, making it easier to steal material without detection. 4) It could alter sensor or manifest data stored on the tag in an effort to undermine the business processes for which the material is being used.
EARLIER¶848-852
Table 8-1. CRC Risk Management Strategy Risk Mitigation Approach Exploitation of “backdoor" to IT network • Stationary readers kept away from windows and exterior walls Radio interference with diagnostic sensors and equipment • 13.56 MHz frequency selected to minimize interference with other devices SECTION 8: CASE STUDIES 8.2 Case Study #2: Supply Chain Management of Hazardous Materials The Radionuclide Transportation Agency (RTA) oversees the movement of radioactive research materials between production facilities, national laboratories, military installations, and other relevant locations. The RTA oversight of the supply chain for these materials involves many of the same issues as in most any other supply chain. The agency wants to know who is in possession of what quantity of materials at any given time. It also wants to locate materials at a site quickly, without having to search through numerous containers to find them. Bar code technology does not provide that capability. Some of RTA’s requirements are more unique. For instance, much of the transported radionuclide material must be closely monitored because extreme temperatures or excessive vibration can make it useless for its intended applications. Consequently, RTA wants temperature and vibration sensors to continuously measure environmental conditions and record readings on the tag. Additionally, the handling of RTA-regulated materials is a homeland and national security issue. If the materials were to fall into unauthorized hands, they could endanger the public welfare. 8.2.1 Phase 1: Initiation The project team began with a risk assessment, which identified a number of concerns, the most significant of which were as follows:
LATER¶22-26
Specialty Journal of Psychology and Management, 2015, Vol, 1 (1): 10-16 14 Phase 4: Operations/Maintenance This phase includes security-related tasks that an organization should perform on an ongoing basis once the RFID system is operational, including conducting periodic security assessments, applying security-related software patches, and reviewing RFID event logs. Phase 5: Disposition This phase encompasses tasks that occur when a system or its components have been retired, perhaps as a result of a significant upgrade. These tasks include preserving information to meet legal requirements and disabling or destroying tags and other components when they are taken out of service. Case Study: Project Chain Management of Hazardous Materials Radionuclide Transportation Agency (RTA) oversees the movement of radioactive research materials between production facilities, national laboratories, military installations, and other relevant locations. The RTA oversight of the supply chain for these materials involves many of the same issues as in most any other supply chain. The agency wants to know who is in possession of what quantity of materials at any given time. It also wants to locate materials at a site quickly, without having to search through numerous containers to find them.(Garfinkel and Rosenberg, 2005). Bar code technology does not provide that capability. Some of RTA’s requirements are more unique. For instance, much of the transported radionuclide material must be closely monitored because extreme temperatures or excessive vibration can make it useless for its intended applications. Consequently, RTA wants temperature and vibration sensors to continuously measure environmental conditions and record readings on the tag. Additionally, the handling of RTAregulated materials is a homeland and national security issue.(Matta and Koonce, 2009) If the materials were to fall into unauthorized hands, they could endanger the public welfare. Initiation Phase Risk assessment is done by the learning agent, which identified a number of concerns, the most significant of which were as follows: 1) An agent could identify and target a vehicle containing RTA-regulated material. 2) An adversary can eavesdrop on tag transactions to learn the characteristics of the material, which could help determine whether it is worth stealing. 3) It could damage or disable a tag, making it easier to steal material without detection. 4) It could alter sensor or manifest data stored on the tag in an effort to undermine the business processes for which the material is being used. Figure 3. Phases of Agent Life Cycle 5) The radiation from readers could accidentally cause combustion of collocated volatile materials when several of them are operating concurrently in close proximity. To help address the risks, RTA established a policy that required that tagged items only be identifiable during
EARLIER¶848-853
Table 8-1. CRC Risk Management Strategy Risk Mitigation Approach Exploitation of “backdoor" to IT network • Stationary readers kept away from windows and exterior walls Radio interference with diagnostic sensors and equipment • 13.56 MHz frequency selected to minimize interference with other devices SECTION 8: CASE STUDIES 8.2 Case Study #2: Supply Chain Management of Hazardous Materials The Radionuclide Transportation Agency (RTA) oversees the movement of radioactive research materials between production facilities, national laboratories, military installations, and other relevant locations. The RTA oversight of the supply chain for these materials involves many of the same issues as in most any other supply chain. The agency wants to know who is in possession of what quantity of materials at any given time. It also wants to locate materials at a site quickly, without having to search through numerous containers to find them. Bar code technology does not provide that capability. Some of RTA’s requirements are more unique. For instance, much of the transported radionuclide material must be closely monitored because extreme temperatures or excessive vibration can make it useless for its intended applications. Consequently, RTA wants temperature and vibration sensors to continuously measure environmental conditions and record readings on the tag. Additionally, the handling of RTA-regulated materials is a homeland and national security issue. If the materials were to fall into unauthorized hands, they could endanger the public welfare. 8.2.1 Phase 1: Initiation The project team began with a risk assessment, which identified a number of concerns, the most significant of which were as follows: An adversary could identify and target a vehicle containing RTA-regulated material. An adversary could eavesdrop on tag transactions to learn the characteristics of the material, which
LATER¶22-26
Specialty Journal of Psychology and Management, 2015, Vol, 1 (1): 10-16 14 Phase 4: Operations/Maintenance This phase includes security-related tasks that an organization should perform on an ongoing basis once the RFID system is operational, including conducting periodic security assessments, applying security-related software patches, and reviewing RFID event logs. Phase 5: Disposition This phase encompasses tasks that occur when a system or its components have been retired, perhaps as a result of a significant upgrade. These tasks include preserving information to meet legal requirements and disabling or destroying tags and other components when they are taken out of service. Case Study: Project Chain Management of Hazardous Materials Radionuclide Transportation Agency (RTA) oversees the movement of radioactive research materials between production facilities, national laboratories, military installations, and other relevant locations. The RTA oversight of the supply chain for these materials involves many of the same issues as in most any other supply chain. The agency wants to know who is in possession of what quantity of materials at any given time. It also wants to locate materials at a site quickly, without having to search through numerous containers to find them.(Garfinkel and Rosenberg, 2005). Bar code technology does not provide that capability. Some of RTA’s requirements are more unique. For instance, much of the transported radionuclide material must be closely monitored because extreme temperatures or excessive vibration can make it useless for its intended applications. Consequently, RTA wants temperature and vibration sensors to continuously measure environmental conditions and record readings on the tag. Additionally, the handling of RTAregulated materials is a homeland and national security issue.(Matta and Koonce, 2009) If the materials were to fall into unauthorized hands, they could endanger the public welfare. Initiation Phase Risk assessment is done by the learning agent, which identified a number of concerns, the most significant of which were as follows: 1) An agent could identify and target a vehicle containing RTA-regulated material. 2) An adversary can eavesdrop on tag transactions to learn the characteristics of the material, which could help determine whether it is worth stealing. 3) It could damage or disable a tag, making it easier to steal material without detection. 4) It could alter sensor or manifest data stored on the tag in an effort to undermine the business processes for which the material is being used. Figure 3. Phases of Agent Life Cycle 5) The radiation from readers could accidentally cause combustion of collocated volatile materials when several of them are operating concurrently in close proximity. To help address the risks, RTA established a policy that required that tagged items only be identifiable during
EARLIER¶849-853
Radio interference with diagnostic sensors and equipment • 13.56 MHz frequency selected to minimize interference with other devices SECTION 8: CASE STUDIES 8.2 Case Study #2: Supply Chain Management of Hazardous Materials The Radionuclide Transportation Agency (RTA) oversees the movement of radioactive research materials between production facilities, national laboratories, military installations, and other relevant locations. The RTA oversight of the supply chain for these materials involves many of the same issues as in most any other supply chain. The agency wants to know who is in possession of what quantity of materials at any given time. It also wants to locate materials at a site quickly, without having to search through numerous containers to find them. Bar code technology does not provide that capability. Some of RTA’s requirements are more unique. For instance, much of the transported radionuclide material must be closely monitored because extreme temperatures or excessive vibration can make it useless for its intended applications. Consequently, RTA wants temperature and vibration sensors to continuously measure environmental conditions and record readings on the tag. Additionally, the handling of RTA-regulated materials is a homeland and national security issue. If the materials were to fall into unauthorized hands, they could endanger the public welfare. 8.2.1 Phase 1: Initiation The project team began with a risk assessment, which identified a number of concerns, the most significant of which were as follows: An adversary could identify and target a vehicle containing RTA-regulated material. An adversary could eavesdrop on tag transactions to learn the characteristics of the material, which
LATER¶22-26
Specialty Journal of Psychology and Management, 2015, Vol, 1 (1): 10-16 14 Phase 4: Operations/Maintenance This phase includes security-related tasks that an organization should perform on an ongoing basis once the RFID system is operational, including conducting periodic security assessments, applying security-related software patches, and reviewing RFID event logs. Phase 5: Disposition This phase encompasses tasks that occur when a system or its components have been retired, perhaps as a result of a significant upgrade. These tasks include preserving information to meet legal requirements and disabling or destroying tags and other components when they are taken out of service. Case Study: Project Chain Management of Hazardous Materials Radionuclide Transportation Agency (RTA) oversees the movement of radioactive research materials between production facilities, national laboratories, military installations, and other relevant locations. The RTA oversight of the supply chain for these materials involves many of the same issues as in most any other supply chain. The agency wants to know who is in possession of what quantity of materials at any given time. It also wants to locate materials at a site quickly, without having to search through numerous containers to find them.(Garfinkel and Rosenberg, 2005). Bar code technology does not provide that capability. Some of RTA’s requirements are more unique. For instance, much of the transported radionuclide material must be closely monitored because extreme temperatures or excessive vibration can make it useless for its intended applications. Consequently, RTA wants temperature and vibration sensors to continuously measure environmental conditions and record readings on the tag. Additionally, the handling of RTAregulated materials is a homeland and national security issue.(Matta and Koonce, 2009) If the materials were to fall into unauthorized hands, they could endanger the public welfare. Initiation Phase Risk assessment is done by the learning agent, which identified a number of concerns, the most significant of which were as follows: 1) An agent could identify and target a vehicle containing RTA-regulated material. 2) An adversary can eavesdrop on tag transactions to learn the characteristics of the material, which could help determine whether it is worth stealing. 3) It could damage or disable a tag, making it easier to steal material without detection. 4) It could alter sensor or manifest data stored on the tag in an effort to undermine the business processes for which the material is being used. Figure 3. Phases of Agent Life Cycle 5) The radiation from readers could accidentally cause combustion of collocated volatile materials when several of them are operating concurrently in close proximity. To help address the risks, RTA established a policy that required that tagged items only be identifiable during
EARLIER¶850-854
8.2 Case Study #2: Supply Chain Management of Hazardous Materials The Radionuclide Transportation Agency (RTA) oversees the movement of radioactive research materials between production facilities, national laboratories, military installations, and other relevant locations. The RTA oversight of the supply chain for these materials involves many of the same issues as in most any other supply chain. The agency wants to know who is in possession of what quantity of materials at any given time. It also wants to locate materials at a site quickly, without having to search through numerous containers to find them. Bar code technology does not provide that capability. Some of RTA’s requirements are more unique. For instance, much of the transported radionuclide material must be closely monitored because extreme temperatures or excessive vibration can make it useless for its intended applications. Consequently, RTA wants temperature and vibration sensors to continuously measure environmental conditions and record readings on the tag. Additionally, the handling of RTA-regulated materials is a homeland and national security issue. If the materials were to fall into unauthorized hands, they could endanger the public welfare. 8.2.1 Phase 1: Initiation The project team began with a risk assessment, which identified a number of concerns, the most significant of which were as follows: An adversary could identify and target a vehicle containing RTA-regulated material. An adversary could eavesdrop on tag transactions to learn the characteristics of the material, which could help determine whether it is worth stealing. An adversary could damage or disable a tag, making it easier to steal material without detection. An adversary could alter sensor or manifest data stored on the tag in an effort to undermine the
LATER¶23-27
Phase 5: Disposition This phase encompasses tasks that occur when a system or its components have been retired, perhaps as a result of a significant upgrade. These tasks include preserving information to meet legal requirements and disabling or destroying tags and other components when they are taken out of service. Case Study: Project Chain Management of Hazardous Materials Radionuclide Transportation Agency (RTA) oversees the movement of radioactive research materials between production facilities, national laboratories, military installations, and other relevant locations. The RTA oversight of the supply chain for these materials involves many of the same issues as in most any other supply chain. The agency wants to know who is in possession of what quantity of materials at any given time. It also wants to locate materials at a site quickly, without having to search through numerous containers to find them.(Garfinkel and Rosenberg, 2005). Bar code technology does not provide that capability. Some of RTA’s requirements are more unique. For instance, much of the transported radionuclide material must be closely monitored because extreme temperatures or excessive vibration can make it useless for its intended applications. Consequently, RTA wants temperature and vibration sensors to continuously measure environmental conditions and record readings on the tag. Additionally, the handling of RTAregulated materials is a homeland and national security issue.(Matta and Koonce, 2009) If the materials were to fall into unauthorized hands, they could endanger the public welfare. Initiation Phase Risk assessment is done by the learning agent, which identified a number of concerns, the most significant of which were as follows: 1) An agent could identify and target a vehicle containing RTA-regulated material. 2) An adversary can eavesdrop on tag transactions to learn the characteristics of the material, which could help determine whether it is worth stealing. 3) It could damage or disable a tag, making it easier to steal material without detection. 4) It could alter sensor or manifest data stored on the tag in an effort to undermine the business processes for which the material is being used. Figure 3. Phases of Agent Life Cycle 5) The radiation from readers could accidentally cause combustion of collocated volatile materials when several of them are operating concurrently in close proximity. To help address the risks, RTA established a policy that required that tagged items only be identifiable during Specialty Journal of Psychology and Management, 2015, Vol, 1 (1): 10-16 15 embarkation, debarkation, and storage, but not during transport. The policy further stated that “tagreader communication should be authenticated whenever technically feasible with commercial-offthe-shelf systems.” (Mangina, 2003) Acquisition/Development Phase
EARLIER¶851-857
Some of RTA’s requirements are more unique. For instance, much of the transported radionuclide material must be closely monitored because extreme temperatures or excessive vibration can make it useless for its intended applications. Consequently, RTA wants temperature and vibration sensors to continuously measure environmental conditions and record readings on the tag. Additionally, the handling of RTA-regulated materials is a homeland and national security issue. If the materials were to fall into unauthorized hands, they could endanger the public welfare. 8.2.1 Phase 1: Initiation The project team began with a risk assessment, which identified a number of concerns, the most significant of which were as follows: An adversary could identify and target a vehicle containing RTA-regulated material. An adversary could eavesdrop on tag transactions to learn the characteristics of the material, which could help determine whether it is worth stealing. An adversary could damage or disable a tag, making it easier to steal material without detection. An adversary could alter sensor or manifest data stored on the tag in an effort to undermine the business processes for which the material is being used. The radiation from readers could accidentally cause combustion of collocated volatile materials when several of them are operating concurrently in close proximity. To help address the risks, RTA established a policy that required that tagged items only be identifiable during embarkation, debarkation, and storage, but not during transport. The policy further stated that tagreader communication should be authenticated whenever technically feasible with commercial-off-theshelf systems. The RTA conducted a privacy assessment that identified that the system would handle PII due to the need to associate materials with particular individuals, although most such information was already contained in existing logs. The agency updated its privacy disclosure statement for employees and contractors to account for the new technology. Finally, it required that all personnel involved in handling of the tagged materials be provided RFID security and privacy awareness training. The agency already had a HERF policy, but everyone agreed the introduction of the RFID system would require the agency to revisit the efficacy of these HERF-related controls. GUIDELINES FOR SECURING RFID SYSTEMS 8-6 8.2.2 Phase 2: Acquisition/Development The acquisition/development phase focused on the planning and design of the RFID system. The nature of the supply chain was such that tagged items would be located at numerous facilities, including future facilities not yet known at time the design was created. However, some general parameters were known. For instance, readers would need to read tags from distances up to 10 meters, and this capability is typically only found in active tags.
LATER¶23-27
Phase 5: Disposition This phase encompasses tasks that occur when a system or its components have been retired, perhaps as a result of a significant upgrade. These tasks include preserving information to meet legal requirements and disabling or destroying tags and other components when they are taken out of service. Case Study: Project Chain Management of Hazardous Materials Radionuclide Transportation Agency (RTA) oversees the movement of radioactive research materials between production facilities, national laboratories, military installations, and other relevant locations. The RTA oversight of the supply chain for these materials involves many of the same issues as in most any other supply chain. The agency wants to know who is in possession of what quantity of materials at any given time. It also wants to locate materials at a site quickly, without having to search through numerous containers to find them.(Garfinkel and Rosenberg, 2005). Bar code technology does not provide that capability. Some of RTA’s requirements are more unique. For instance, much of the transported radionuclide material must be closely monitored because extreme temperatures or excessive vibration can make it useless for its intended applications. Consequently, RTA wants temperature and vibration sensors to continuously measure environmental conditions and record readings on the tag. Additionally, the handling of RTAregulated materials is a homeland and national security issue.(Matta and Koonce, 2009) If the materials were to fall into unauthorized hands, they could endanger the public welfare. Initiation Phase Risk assessment is done by the learning agent, which identified a number of concerns, the most significant of which were as follows: 1) An agent could identify and target a vehicle containing RTA-regulated material. 2) An adversary can eavesdrop on tag transactions to learn the characteristics of the material, which could help determine whether it is worth stealing. 3) It could damage or disable a tag, making it easier to steal material without detection. 4) It could alter sensor or manifest data stored on the tag in an effort to undermine the business processes for which the material is being used. Figure 3. Phases of Agent Life Cycle 5) The radiation from readers could accidentally cause combustion of collocated volatile materials when several of them are operating concurrently in close proximity. To help address the risks, RTA established a policy that required that tagged items only be identifiable during Specialty Journal of Psychology and Management, 2015, Vol, 1 (1): 10-16 15 embarkation, debarkation, and storage, but not during transport. The policy further stated that “tagreader communication should be authenticated whenever technically feasible with commercial-offthe-shelf systems.” (Mangina, 2003) Acquisition/Development Phase
EARLIER¶853-858
An adversary could identify and target a vehicle containing RTA-regulated material. An adversary could eavesdrop on tag transactions to learn the characteristics of the material, which could help determine whether it is worth stealing. An adversary could damage or disable a tag, making it easier to steal material without detection. An adversary could alter sensor or manifest data stored on the tag in an effort to undermine the business processes for which the material is being used. The radiation from readers could accidentally cause combustion of collocated volatile materials when several of them are operating concurrently in close proximity. To help address the risks, RTA established a policy that required that tagged items only be identifiable during embarkation, debarkation, and storage, but not during transport. The policy further stated that tagreader communication should be authenticated whenever technically feasible with commercial-off-theshelf systems. The RTA conducted a privacy assessment that identified that the system would handle PII due to the need to associate materials with particular individuals, although most such information was already contained in existing logs. The agency updated its privacy disclosure statement for employees and contractors to account for the new technology. Finally, it required that all personnel involved in handling of the tagged materials be provided RFID security and privacy awareness training. The agency already had a HERF policy, but everyone agreed the introduction of the RFID system would require the agency to revisit the efficacy of these HERF-related controls. GUIDELINES FOR SECURING RFID SYSTEMS 8-6 8.2.2 Phase 2: Acquisition/Development The acquisition/development phase focused on the planning and design of the RFID system. The nature of the supply chain was such that tagged items would be located at numerous facilities, including future facilities not yet known at time the design was created. However, some general parameters were known. For instance, readers would need to read tags from distances up to 10 meters, and this capability is typically only found in active tags. The design team spent a significant amount of time on how to mitigate risks associated with the RF link between the readers and the tags. It determined that the risk of eavesdropping and rogue RFID transactions could be within acceptable levels if adversaries were located at least 100 meters from the storage area.90 The few facilities that could not maintain a perimeter of that distance would rely on bar code technology, which RTA understood would significantly increase labor costs at these sites relative to those using RFID because people would need to be hired to scan items and open containers to inventory their contents.
LATER¶24-28
Radionuclide Transportation Agency (RTA) oversees the movement of radioactive research materials between production facilities, national laboratories, military installations, and other relevant locations. The RTA oversight of the supply chain for these materials involves many of the same issues as in most any other supply chain. The agency wants to know who is in possession of what quantity of materials at any given time. It also wants to locate materials at a site quickly, without having to search through numerous containers to find them.(Garfinkel and Rosenberg, 2005). Bar code technology does not provide that capability. Some of RTA’s requirements are more unique. For instance, much of the transported radionuclide material must be closely monitored because extreme temperatures or excessive vibration can make it useless for its intended applications. Consequently, RTA wants temperature and vibration sensors to continuously measure environmental conditions and record readings on the tag. Additionally, the handling of RTAregulated materials is a homeland and national security issue.(Matta and Koonce, 2009) If the materials were to fall into unauthorized hands, they could endanger the public welfare. Initiation Phase Risk assessment is done by the learning agent, which identified a number of concerns, the most significant of which were as follows: 1) An agent could identify and target a vehicle containing RTA-regulated material. 2) An adversary can eavesdrop on tag transactions to learn the characteristics of the material, which could help determine whether it is worth stealing. 3) It could damage or disable a tag, making it easier to steal material without detection. 4) It could alter sensor or manifest data stored on the tag in an effort to undermine the business processes for which the material is being used. Figure 3. Phases of Agent Life Cycle 5) The radiation from readers could accidentally cause combustion of collocated volatile materials when several of them are operating concurrently in close proximity. To help address the risks, RTA established a policy that required that tagged items only be identifiable during Specialty Journal of Psychology and Management, 2015, Vol, 1 (1): 10-16 15 embarkation, debarkation, and storage, but not during transport. The policy further stated that “tagreader communication should be authenticated whenever technically feasible with commercial-offthe-shelf systems.” (Mangina, 2003) Acquisition/Development Phase The acquisition/development phase focused the learning agent on the planning and design of the RFID system. The nature of the project chain was such that tagged items would be located at numerous facilities, including future facilities not yet known at time the design was created. However, some general parameters were known. For instance, readers would need to read tags from distances up to 10 meters, and this capability is typically only found in active tags. To address the requirement of preventing readings during transport, the team specified agent mechanisms for shielding containers and vehicles. The shielding would prevent adversaries from determining that items inside a vehicle were tagged, thereby reducing the risk of targeting. In the case of shielded transport vehicles, tags could be read when they were removed from the vehicle at debarkation.
EARLIER¶854-858
could help determine whether it is worth stealing. An adversary could damage or disable a tag, making it easier to steal material without detection. An adversary could alter sensor or manifest data stored on the tag in an effort to undermine the business processes for which the material is being used. The radiation from readers could accidentally cause combustion of collocated volatile materials when several of them are operating concurrently in close proximity. To help address the risks, RTA established a policy that required that tagged items only be identifiable during embarkation, debarkation, and storage, but not during transport. The policy further stated that tagreader communication should be authenticated whenever technically feasible with commercial-off-theshelf systems. The RTA conducted a privacy assessment that identified that the system would handle PII due to the need to associate materials with particular individuals, although most such information was already contained in existing logs. The agency updated its privacy disclosure statement for employees and contractors to account for the new technology. Finally, it required that all personnel involved in handling of the tagged materials be provided RFID security and privacy awareness training. The agency already had a HERF policy, but everyone agreed the introduction of the RFID system would require the agency to revisit the efficacy of these HERF-related controls. GUIDELINES FOR SECURING RFID SYSTEMS 8-6 8.2.2 Phase 2: Acquisition/Development The acquisition/development phase focused on the planning and design of the RFID system. The nature of the supply chain was such that tagged items would be located at numerous facilities, including future facilities not yet known at time the design was created. However, some general parameters were known. For instance, readers would need to read tags from distances up to 10 meters, and this capability is typically only found in active tags. The design team spent a significant amount of time on how to mitigate risks associated with the RF link between the readers and the tags. It determined that the risk of eavesdropping and rogue RFID transactions could be within acceptable levels if adversaries were located at least 100 meters from the storage area.90 The few facilities that could not maintain a perimeter of that distance would rely on bar code technology, which RTA understood would significantly increase labor costs at these sites relative to those using RFID because people would need to be hired to scan items and open containers to inventory their contents.
LATER¶25-29
Initiation Phase Risk assessment is done by the learning agent, which identified a number of concerns, the most significant of which were as follows: 1) An agent could identify and target a vehicle containing RTA-regulated material. 2) An adversary can eavesdrop on tag transactions to learn the characteristics of the material, which could help determine whether it is worth stealing. 3) It could damage or disable a tag, making it easier to steal material without detection. 4) It could alter sensor or manifest data stored on the tag in an effort to undermine the business processes for which the material is being used. Figure 3. Phases of Agent Life Cycle 5) The radiation from readers could accidentally cause combustion of collocated volatile materials when several of them are operating concurrently in close proximity. To help address the risks, RTA established a policy that required that tagged items only be identifiable during Specialty Journal of Psychology and Management, 2015, Vol, 1 (1): 10-16 15 embarkation, debarkation, and storage, but not during transport. The policy further stated that “tagreader communication should be authenticated whenever technically feasible with commercial-offthe-shelf systems.” (Mangina, 2003) Acquisition/Development Phase The acquisition/development phase focused the learning agent on the planning and design of the RFID system. The nature of the project chain was such that tagged items would be located at numerous facilities, including future facilities not yet known at time the design was created. However, some general parameters were known. For instance, readers would need to read tags from distances up to 10 meters, and this capability is typically only found in active tags. To address the requirement of preventing readings during transport, the team specified agent mechanisms for shielding containers and vehicles. The shielding would prevent adversaries from determining that items inside a vehicle were tagged, thereby reducing the risk of targeting. In the case of shielded transport vehicles, tags could be read when they were removed from the vehicle at debarkation. Many vehicles were shielded prior to the RFID program to prevent harmful radiation from escaping the vehicle. When vehicles were not shielded, tarp-like shielding could be placed around containers within the vehicle and then easily removed when they leave the vehicle. While some users would benefit from the convenience of reading tags from outside the vehicle, the risk this introduced outweighed any potential advantage it offered. The tags were also password-protected using a proprietary technology to prevent unauthorized parties from reading or writing to the tags (Wooldridge and Kinny, 2000). Because custody of the tags moved from one organization to another, the RTA decided to host a central password database that could be remotely accessed by the RFID middleware of each participating organization.
EARLIER¶855-859
business processes for which the material is being used. The radiation from readers could accidentally cause combustion of collocated volatile materials when several of them are operating concurrently in close proximity. To help address the risks, RTA established a policy that required that tagged items only be identifiable during embarkation, debarkation, and storage, but not during transport. The policy further stated that tagreader communication should be authenticated whenever technically feasible with commercial-off-theshelf systems. The RTA conducted a privacy assessment that identified that the system would handle PII due to the need to associate materials with particular individuals, although most such information was already contained in existing logs. The agency updated its privacy disclosure statement for employees and contractors to account for the new technology. Finally, it required that all personnel involved in handling of the tagged materials be provided RFID security and privacy awareness training. The agency already had a HERF policy, but everyone agreed the introduction of the RFID system would require the agency to revisit the efficacy of these HERF-related controls. GUIDELINES FOR SECURING RFID SYSTEMS 8-6 8.2.2 Phase 2: Acquisition/Development The acquisition/development phase focused on the planning and design of the RFID system. The nature of the supply chain was such that tagged items would be located at numerous facilities, including future facilities not yet known at time the design was created. However, some general parameters were known. For instance, readers would need to read tags from distances up to 10 meters, and this capability is typically only found in active tags. The design team spent a significant amount of time on how to mitigate risks associated with the RF link between the readers and the tags. It determined that the risk of eavesdropping and rogue RFID transactions could be within acceptable levels if adversaries were located at least 100 meters from the storage area.90 The few facilities that could not maintain a perimeter of that distance would rely on bar code technology, which RTA understood would significantly increase labor costs at these sites relative to those using RFID because people would need to be hired to scan items and open containers to inventory their contents. To address the requirement of preventing readings during transport, the design team specified mechanisms for shielding containers and vehicles. The shielding would prevent adversaries from determining that items inside a vehicle were tagged, thereby reducing the risk of targeting. In the case of shielded transport vehicles, tags could be read when they were removed from the vehicle at debarkation. Many vehicles were shielded prior to the RFID program to prevent harmful radiation from escaping the vehicle. When vehicles were not shielded, tarp-like shielding could be placed around containers within the vehicle and then easily removed when they leave the vehicle. While some users would benefit from the convenience of reading tags from outside the vehicle, the risk this introduced outweighed any potential advantage it offered. Indeed, the primary objectives of the RFID system were to identify the facility at which a radionuclide sample was located and to quickly find items once stored, neither of which necessitated readings when the item was in transport.
LATER¶26-30
Figure 3. Phases of Agent Life Cycle 5) The radiation from readers could accidentally cause combustion of collocated volatile materials when several of them are operating concurrently in close proximity. To help address the risks, RTA established a policy that required that tagged items only be identifiable during Specialty Journal of Psychology and Management, 2015, Vol, 1 (1): 10-16 15 embarkation, debarkation, and storage, but not during transport. The policy further stated that “tagreader communication should be authenticated whenever technically feasible with commercial-offthe-shelf systems.” (Mangina, 2003) Acquisition/Development Phase The acquisition/development phase focused the learning agent on the planning and design of the RFID system. The nature of the project chain was such that tagged items would be located at numerous facilities, including future facilities not yet known at time the design was created. However, some general parameters were known. For instance, readers would need to read tags from distances up to 10 meters, and this capability is typically only found in active tags. To address the requirement of preventing readings during transport, the team specified agent mechanisms for shielding containers and vehicles. The shielding would prevent adversaries from determining that items inside a vehicle were tagged, thereby reducing the risk of targeting. In the case of shielded transport vehicles, tags could be read when they were removed from the vehicle at debarkation. Many vehicles were shielded prior to the RFID program to prevent harmful radiation from escaping the vehicle. When vehicles were not shielded, tarp-like shielding could be placed around containers within the vehicle and then easily removed when they leave the vehicle. While some users would benefit from the convenience of reading tags from outside the vehicle, the risk this introduced outweighed any potential advantage it offered. The tags were also password-protected using a proprietary technology to prevent unauthorized parties from reading or writing to the tags (Wooldridge and Kinny, 2000). Because custody of the tags moved from one organization to another, the RTA decided to host a central password database that could be remotely accessed by the RFID middleware of each participating organization. Implementation Phase This phase was pointed directly ahead given the panoptic planning in the previous phase. The initial task was to conduct a pilot test of the system to identify potential problems before they adversely impacted the full supply chain. The test exercise uncovered several interoperability issues with RTAnet devices. In particular, some of the readers did not work properly with the middleware because an undocumented feature conflicted with the settings RTA selected for its equipment.
EARLIER¶857-861
GUIDELINES FOR SECURING RFID SYSTEMS 8-6 8.2.2 Phase 2: Acquisition/Development The acquisition/development phase focused on the planning and design of the RFID system. The nature of the supply chain was such that tagged items would be located at numerous facilities, including future facilities not yet known at time the design was created. However, some general parameters were known. For instance, readers would need to read tags from distances up to 10 meters, and this capability is typically only found in active tags. The design team spent a significant amount of time on how to mitigate risks associated with the RF link between the readers and the tags. It determined that the risk of eavesdropping and rogue RFID transactions could be within acceptable levels if adversaries were located at least 100 meters from the storage area.90 The few facilities that could not maintain a perimeter of that distance would rely on bar code technology, which RTA understood would significantly increase labor costs at these sites relative to those using RFID because people would need to be hired to scan items and open containers to inventory their contents. To address the requirement of preventing readings during transport, the design team specified mechanisms for shielding containers and vehicles. The shielding would prevent adversaries from determining that items inside a vehicle were tagged, thereby reducing the risk of targeting. In the case of shielded transport vehicles, tags could be read when they were removed from the vehicle at debarkation. Many vehicles were shielded prior to the RFID program to prevent harmful radiation from escaping the vehicle. When vehicles were not shielded, tarp-like shielding could be placed around containers within the vehicle and then easily removed when they leave the vehicle. While some users would benefit from the convenience of reading tags from outside the vehicle, the risk this introduced outweighed any potential advantage it offered. Indeed, the primary objectives of the RFID system were to identify the facility at which a radionuclide sample was located and to quickly find items once stored, neither of which necessitated readings when the item was in transport. The tags were also password-protected using a proprietary technology to prevent unauthorized parties from reading or writing to the tags. Because custody of the tags moved from one organization to another, the RTA decided to host a central password database that could be remotely accessed by the RFID middleware of each participating organization. To limit access to the central database to business partners, it was placed on a VPN called RTAnet to which each of the partner organizations connected. The VPN isolates the RFID activity from public networks, thereby making it difficult for an outside adversary to perform a successful attack. The team also had to tackle the HERF risk. Although the probability was small that readers would cause combustion of volatile materials stored near radionuclide material, the devastating consequences of its realization still made it a significant concern. The primary mechanism was to use an HF system because it would be less likely to cause combustion than higher frequency UHF and microwave technology. New guidelines also required a separation of five meters between fuel and tagged items unless the volatile materials were shielded.
LATER¶26-31
Figure 3. Phases of Agent Life Cycle 5) The radiation from readers could accidentally cause combustion of collocated volatile materials when several of them are operating concurrently in close proximity. To help address the risks, RTA established a policy that required that tagged items only be identifiable during Specialty Journal of Psychology and Management, 2015, Vol, 1 (1): 10-16 15 embarkation, debarkation, and storage, but not during transport. The policy further stated that “tagreader communication should be authenticated whenever technically feasible with commercial-offthe-shelf systems.” (Mangina, 2003) Acquisition/Development Phase The acquisition/development phase focused the learning agent on the planning and design of the RFID system. The nature of the project chain was such that tagged items would be located at numerous facilities, including future facilities not yet known at time the design was created. However, some general parameters were known. For instance, readers would need to read tags from distances up to 10 meters, and this capability is typically only found in active tags. To address the requirement of preventing readings during transport, the team specified agent mechanisms for shielding containers and vehicles. The shielding would prevent adversaries from determining that items inside a vehicle were tagged, thereby reducing the risk of targeting. In the case of shielded transport vehicles, tags could be read when they were removed from the vehicle at debarkation. Many vehicles were shielded prior to the RFID program to prevent harmful radiation from escaping the vehicle. When vehicles were not shielded, tarp-like shielding could be placed around containers within the vehicle and then easily removed when they leave the vehicle. While some users would benefit from the convenience of reading tags from outside the vehicle, the risk this introduced outweighed any potential advantage it offered. The tags were also password-protected using a proprietary technology to prevent unauthorized parties from reading or writing to the tags (Wooldridge and Kinny, 2000). Because custody of the tags moved from one organization to another, the RTA decided to host a central password database that could be remotely accessed by the RFID middleware of each participating organization. Implementation Phase This phase was pointed directly ahead given the panoptic planning in the previous phase. The initial task was to conduct a pilot test of the system to identify potential problems before they adversely impacted the full supply chain. The test exercise uncovered several interoperability issues with RTAnet devices. In particular, some of the readers did not work properly with the middleware because an undocumented feature conflicted with the settings RTA selected for its equipment. 5.4 Operations/Maintenance Phase The RTA was able to obtain regulatory information rapidly as soon as the system was fully operational, this reduced the labor time required to support the program.
EARLIER¶858-862
The design team spent a significant amount of time on how to mitigate risks associated with the RF link between the readers and the tags. It determined that the risk of eavesdropping and rogue RFID transactions could be within acceptable levels if adversaries were located at least 100 meters from the storage area.90 The few facilities that could not maintain a perimeter of that distance would rely on bar code technology, which RTA understood would significantly increase labor costs at these sites relative to those using RFID because people would need to be hired to scan items and open containers to inventory their contents. To address the requirement of preventing readings during transport, the design team specified mechanisms for shielding containers and vehicles. The shielding would prevent adversaries from determining that items inside a vehicle were tagged, thereby reducing the risk of targeting. In the case of shielded transport vehicles, tags could be read when they were removed from the vehicle at debarkation. Many vehicles were shielded prior to the RFID program to prevent harmful radiation from escaping the vehicle. When vehicles were not shielded, tarp-like shielding could be placed around containers within the vehicle and then easily removed when they leave the vehicle. While some users would benefit from the convenience of reading tags from outside the vehicle, the risk this introduced outweighed any potential advantage it offered. Indeed, the primary objectives of the RFID system were to identify the facility at which a radionuclide sample was located and to quickly find items once stored, neither of which necessitated readings when the item was in transport. The tags were also password-protected using a proprietary technology to prevent unauthorized parties from reading or writing to the tags. Because custody of the tags moved from one organization to another, the RTA decided to host a central password database that could be remotely accessed by the RFID middleware of each participating organization. To limit access to the central database to business partners, it was placed on a VPN called RTAnet to which each of the partner organizations connected. The VPN isolates the RFID activity from public networks, thereby making it difficult for an outside adversary to perform a successful attack. The team also had to tackle the HERF risk. Although the probability was small that readers would cause combustion of volatile materials stored near radionuclide material, the devastating consequences of its realization still made it a significant concern. The primary mechanism was to use an HF system because it would be less likely to cause combustion than higher frequency UHF and microwave technology. New guidelines also required a separation of five meters between fuel and tagged items unless the volatile materials were shielded. 8.2.3 Phase 3: Implementation The implementation phase was straightforward, given the extensive planning in the previous phase. The first task was to conduct a pilot test of the system to identify potential problems before they adversely impacted the full supply chain. The test exercise uncovered several interoperability issues with RTAnet
LATER¶27-31
Specialty Journal of Psychology and Management, 2015, Vol, 1 (1): 10-16 15 embarkation, debarkation, and storage, but not during transport. The policy further stated that “tagreader communication should be authenticated whenever technically feasible with commercial-offthe-shelf systems.” (Mangina, 2003) Acquisition/Development Phase The acquisition/development phase focused the learning agent on the planning and design of the RFID system. The nature of the project chain was such that tagged items would be located at numerous facilities, including future facilities not yet known at time the design was created. However, some general parameters were known. For instance, readers would need to read tags from distances up to 10 meters, and this capability is typically only found in active tags. To address the requirement of preventing readings during transport, the team specified agent mechanisms for shielding containers and vehicles. The shielding would prevent adversaries from determining that items inside a vehicle were tagged, thereby reducing the risk of targeting. In the case of shielded transport vehicles, tags could be read when they were removed from the vehicle at debarkation. Many vehicles were shielded prior to the RFID program to prevent harmful radiation from escaping the vehicle. When vehicles were not shielded, tarp-like shielding could be placed around containers within the vehicle and then easily removed when they leave the vehicle. While some users would benefit from the convenience of reading tags from outside the vehicle, the risk this introduced outweighed any potential advantage it offered. The tags were also password-protected using a proprietary technology to prevent unauthorized parties from reading or writing to the tags (Wooldridge and Kinny, 2000). Because custody of the tags moved from one organization to another, the RTA decided to host a central password database that could be remotely accessed by the RFID middleware of each participating organization. Implementation Phase This phase was pointed directly ahead given the panoptic planning in the previous phase. The initial task was to conduct a pilot test of the system to identify potential problems before they adversely impacted the full supply chain. The test exercise uncovered several interoperability issues with RTAnet devices. In particular, some of the readers did not work properly with the middleware because an undocumented feature conflicted with the settings RTA selected for its equipment. 5.4 Operations/Maintenance Phase The RTA was able to obtain regulatory information rapidly as soon as the system was fully operational, this reduced the labor time required to support the program.
EARLIER¶858-862
The design team spent a significant amount of time on how to mitigate risks associated with the RF link between the readers and the tags. It determined that the risk of eavesdropping and rogue RFID transactions could be within acceptable levels if adversaries were located at least 100 meters from the storage area.90 The few facilities that could not maintain a perimeter of that distance would rely on bar code technology, which RTA understood would significantly increase labor costs at these sites relative to those using RFID because people would need to be hired to scan items and open containers to inventory their contents. To address the requirement of preventing readings during transport, the design team specified mechanisms for shielding containers and vehicles. The shielding would prevent adversaries from determining that items inside a vehicle were tagged, thereby reducing the risk of targeting. In the case of shielded transport vehicles, tags could be read when they were removed from the vehicle at debarkation. Many vehicles were shielded prior to the RFID program to prevent harmful radiation from escaping the vehicle. When vehicles were not shielded, tarp-like shielding could be placed around containers within the vehicle and then easily removed when they leave the vehicle. While some users would benefit from the convenience of reading tags from outside the vehicle, the risk this introduced outweighed any potential advantage it offered. Indeed, the primary objectives of the RFID system were to identify the facility at which a radionuclide sample was located and to quickly find items once stored, neither of which necessitated readings when the item was in transport. The tags were also password-protected using a proprietary technology to prevent unauthorized parties from reading or writing to the tags. Because custody of the tags moved from one organization to another, the RTA decided to host a central password database that could be remotely accessed by the RFID middleware of each participating organization. To limit access to the central database to business partners, it was placed on a VPN called RTAnet to which each of the partner organizations connected. The VPN isolates the RFID activity from public networks, thereby making it difficult for an outside adversary to perform a successful attack. The team also had to tackle the HERF risk. Although the probability was small that readers would cause combustion of volatile materials stored near radionuclide material, the devastating consequences of its realization still made it a significant concern. The primary mechanism was to use an HF system because it would be less likely to cause combustion than higher frequency UHF and microwave technology. New guidelines also required a separation of five meters between fuel and tagged items unless the volatile materials were shielded. 8.2.3 Phase 3: Implementation The implementation phase was straightforward, given the extensive planning in the previous phase. The first task was to conduct a pilot test of the system to identify potential problems before they adversely impacted the full supply chain. The test exercise uncovered several interoperability issues with RTAnet
LATER¶27-31
Specialty Journal of Psychology and Management, 2015, Vol, 1 (1): 10-16 15 embarkation, debarkation, and storage, but not during transport. The policy further stated that “tagreader communication should be authenticated whenever technically feasible with commercial-offthe-shelf systems.” (Mangina, 2003) Acquisition/Development Phase The acquisition/development phase focused the learning agent on the planning and design of the RFID system. The nature of the project chain was such that tagged items would be located at numerous facilities, including future facilities not yet known at time the design was created. However, some general parameters were known. For instance, readers would need to read tags from distances up to 10 meters, and this capability is typically only found in active tags. To address the requirement of preventing readings during transport, the team specified agent mechanisms for shielding containers and vehicles. The shielding would prevent adversaries from determining that items inside a vehicle were tagged, thereby reducing the risk of targeting. In the case of shielded transport vehicles, tags could be read when they were removed from the vehicle at debarkation. Many vehicles were shielded prior to the RFID program to prevent harmful radiation from escaping the vehicle. When vehicles were not shielded, tarp-like shielding could be placed around containers within the vehicle and then easily removed when they leave the vehicle. While some users would benefit from the convenience of reading tags from outside the vehicle, the risk this introduced outweighed any potential advantage it offered. The tags were also password-protected using a proprietary technology to prevent unauthorized parties from reading or writing to the tags (Wooldridge and Kinny, 2000). Because custody of the tags moved from one organization to another, the RTA decided to host a central password database that could be remotely accessed by the RFID middleware of each participating organization. Implementation Phase This phase was pointed directly ahead given the panoptic planning in the previous phase. The initial task was to conduct a pilot test of the system to identify potential problems before they adversely impacted the full supply chain. The test exercise uncovered several interoperability issues with RTAnet devices. In particular, some of the readers did not work properly with the middleware because an undocumented feature conflicted with the settings RTA selected for its equipment. 5.4 Operations/Maintenance Phase The RTA was able to obtain regulatory information rapidly as soon as the system was fully operational, this reduced the labor time required to support the program.
EARLIER¶860-864
The tags were also password-protected using a proprietary technology to prevent unauthorized parties from reading or writing to the tags. Because custody of the tags moved from one organization to another, the RTA decided to host a central password database that could be remotely accessed by the RFID middleware of each participating organization. To limit access to the central database to business partners, it was placed on a VPN called RTAnet to which each of the partner organizations connected. The VPN isolates the RFID activity from public networks, thereby making it difficult for an outside adversary to perform a successful attack. The team also had to tackle the HERF risk. Although the probability was small that readers would cause combustion of volatile materials stored near radionuclide material, the devastating consequences of its realization still made it a significant concern. The primary mechanism was to use an HF system because it would be less likely to cause combustion than higher frequency UHF and microwave technology. New guidelines also required a separation of five meters between fuel and tagged items unless the volatile materials were shielded. 8.2.3 Phase 3: Implementation The implementation phase was straightforward, given the extensive planning in the previous phase. The first task was to conduct a pilot test of the system to identify potential problems before they adversely impacted the full supply chain. The test exercise uncovered several interoperability issues with RTAnet 90 The risk was determined by field tests to be acceptable because the 100 meter distance was shown to prevent eavesdropping of tag to reader communications. SECTION 8: CASE STUDIES 8-7 devices. In particular, some of the readers did not work properly with the middleware because an undocumented feature conflicted with the settings RTA selected for its equipment. The vendor issued a patch to its software that solved the problem.
LATER¶28-32
The acquisition/development phase focused the learning agent on the planning and design of the RFID system. The nature of the project chain was such that tagged items would be located at numerous facilities, including future facilities not yet known at time the design was created. However, some general parameters were known. For instance, readers would need to read tags from distances up to 10 meters, and this capability is typically only found in active tags. To address the requirement of preventing readings during transport, the team specified agent mechanisms for shielding containers and vehicles. The shielding would prevent adversaries from determining that items inside a vehicle were tagged, thereby reducing the risk of targeting. In the case of shielded transport vehicles, tags could be read when they were removed from the vehicle at debarkation. Many vehicles were shielded prior to the RFID program to prevent harmful radiation from escaping the vehicle. When vehicles were not shielded, tarp-like shielding could be placed around containers within the vehicle and then easily removed when they leave the vehicle. While some users would benefit from the convenience of reading tags from outside the vehicle, the risk this introduced outweighed any potential advantage it offered. The tags were also password-protected using a proprietary technology to prevent unauthorized parties from reading or writing to the tags (Wooldridge and Kinny, 2000). Because custody of the tags moved from one organization to another, the RTA decided to host a central password database that could be remotely accessed by the RFID middleware of each participating organization. Implementation Phase This phase was pointed directly ahead given the panoptic planning in the previous phase. The initial task was to conduct a pilot test of the system to identify potential problems before they adversely impacted the full supply chain. The test exercise uncovered several interoperability issues with RTAnet devices. In particular, some of the readers did not work properly with the middleware because an undocumented feature conflicted with the settings RTA selected for its equipment. 5.4 Operations/Maintenance Phase The RTA was able to obtain regulatory information rapidly as soon as the system was fully operational, this reduced the labor time required to support the program. Disposition Phase RTA has not actively faced up disposition issues. It plans to impart skills to participating organizations to retire their RFID systems as they would any other system holding data that RTA deems sensitive. In most cases this involves using disk wiping utilities to delete sensitive files. With regard to tag disposition, RTA’s position is that organizations are free to recycle tags so long as they clear sensor and manifest data before affixing a tag to a new item.
EARLIER¶862-866
8.2.3 Phase 3: Implementation The implementation phase was straightforward, given the extensive planning in the previous phase. The first task was to conduct a pilot test of the system to identify potential problems before they adversely impacted the full supply chain. The test exercise uncovered several interoperability issues with RTAnet 90 The risk was determined by field tests to be acceptable because the 100 meter distance was shown to prevent eavesdropping of tag to reader communications. SECTION 8: CASE STUDIES 8-7 devices. In particular, some of the readers did not work properly with the middleware because an undocumented feature conflicted with the settings RTA selected for its equipment. The vendor issued a patch to its software that solved the problem. 8.2.4 Phase 4: Operations/Maintenance Once the system was fully operational, the RTA was able to obtain regulatory information more quickly than before, which reduced the labor time required to support the program. Suppliers and consumers of the regulated materials also decreased their paperwork. They also were able to better match supply of materials with demand for them, since authorized organizations could retrieve information about the quantities present at each site. The operations phase also included security monitoring. All participating organizations signed a MOU that covered sharing of information pertaining to possible intrusions or security exploits and proper management of PII. The MOU also included a provision that prohibited participating organizations from using PII for any purpose not explicitly stated in the MOU. This close cooperation enabled one of the suppliers and a national laboratory to recognize a recurring attack pattern across facilities that might otherwise have been ignored.
LATER¶28-32
The acquisition/development phase focused the learning agent on the planning and design of the RFID system. The nature of the project chain was such that tagged items would be located at numerous facilities, including future facilities not yet known at time the design was created. However, some general parameters were known. For instance, readers would need to read tags from distances up to 10 meters, and this capability is typically only found in active tags. To address the requirement of preventing readings during transport, the team specified agent mechanisms for shielding containers and vehicles. The shielding would prevent adversaries from determining that items inside a vehicle were tagged, thereby reducing the risk of targeting. In the case of shielded transport vehicles, tags could be read when they were removed from the vehicle at debarkation. Many vehicles were shielded prior to the RFID program to prevent harmful radiation from escaping the vehicle. When vehicles were not shielded, tarp-like shielding could be placed around containers within the vehicle and then easily removed when they leave the vehicle. While some users would benefit from the convenience of reading tags from outside the vehicle, the risk this introduced outweighed any potential advantage it offered. The tags were also password-protected using a proprietary technology to prevent unauthorized parties from reading or writing to the tags (Wooldridge and Kinny, 2000). Because custody of the tags moved from one organization to another, the RTA decided to host a central password database that could be remotely accessed by the RFID middleware of each participating organization. Implementation Phase This phase was pointed directly ahead given the panoptic planning in the previous phase. The initial task was to conduct a pilot test of the system to identify potential problems before they adversely impacted the full supply chain. The test exercise uncovered several interoperability issues with RTAnet devices. In particular, some of the readers did not work properly with the middleware because an undocumented feature conflicted with the settings RTA selected for its equipment. 5.4 Operations/Maintenance Phase The RTA was able to obtain regulatory information rapidly as soon as the system was fully operational, this reduced the labor time required to support the program. Disposition Phase RTA has not actively faced up disposition issues. It plans to impart skills to participating organizations to retire their RFID systems as they would any other system holding data that RTA deems sensitive. In most cases this involves using disk wiping utilities to delete sensitive files. With regard to tag disposition, RTA’s position is that organizations are free to recycle tags so long as they clear sensor and manifest data before affixing a tag to a new item.
EARLIER¶865-869
8.2.4 Phase 4: Operations/Maintenance Once the system was fully operational, the RTA was able to obtain regulatory information more quickly than before, which reduced the labor time required to support the program. Suppliers and consumers of the regulated materials also decreased their paperwork. They also were able to better match supply of materials with demand for them, since authorized organizations could retrieve information about the quantities present at each site. The operations phase also included security monitoring. All participating organizations signed a MOU that covered sharing of information pertaining to possible intrusions or security exploits and proper management of PII. The MOU also included a provision that prohibited participating organizations from using PII for any purpose not explicitly stated in the MOU. This close cooperation enabled one of the suppliers and a national laboratory to recognize a recurring attack pattern across facilities that might otherwise have been ignored. 8.2.5 Phase 5: Disposition As a new program, RTA has not actively confronted disposition issues. It plans to instruct participating organizations to retire their RFID systems as they would any other system holding data that RTA deems sensitive. In most cases this involves using disk wiping utilities to delete sensitive files. With regard to tag disposition, RTA’s position is that organizations are free to recycle tags so long as they clear sensor and manifest data before affixing a tag to a new item. 8.2.6 Summary and Evaluation The RTA RFID initiative allowed the agency to exercise more effective oversight of the transportation of radionuclide material while also reducing the regulatory compliance cost of impacted organizations. Some important security concerns had been raised, particularly with regards to the possibility that an adversary might use the RFID tags as targeting devices. Early identification of these risks allowed them to be managed during each stage of the systems. A listing of the main risks and the corresponding mitigation approach is presented in Table 8-2. Table 8-2. RTA Risk Management Strategy Risk Mitigation Approach Targeting of transport vehicles • Shielding of vehicles and containers to prevent electromagnetic emissions
LATER¶30-34
Implementation Phase This phase was pointed directly ahead given the panoptic planning in the previous phase. The initial task was to conduct a pilot test of the system to identify potential problems before they adversely impacted the full supply chain. The test exercise uncovered several interoperability issues with RTAnet devices. In particular, some of the readers did not work properly with the middleware because an undocumented feature conflicted with the settings RTA selected for its equipment. 5.4 Operations/Maintenance Phase The RTA was able to obtain regulatory information rapidly as soon as the system was fully operational, this reduced the labor time required to support the program. Disposition Phase RTA has not actively faced up disposition issues. It plans to impart skills to participating organizations to retire their RFID systems as they would any other system holding data that RTA deems sensitive. In most cases this involves using disk wiping utilities to delete sensitive files. With regard to tag disposition, RTA’s position is that organizations are free to recycle tags so long as they clear sensor and manifest data before affixing a tag to a new item. Conclusion Agent approach to a system provides better response times as well as quicker notification processing. MAS do have an increasingly important role to play in Project Management because they significantly enhance our ability to model, design and build complex distributed management software systems. As the RFID technology is becoming cheaper, it is sure that it will be implemented in everyday life soon. We proposed a Multi-Agent RFID process in PCM with the help of system life cycle phases. Each phase has its own agent which will work independently on its merit and provide a solution. This solution can help project managers to take immediate decisions, when responding to an emergency situation. The research team proposed the use of MAS to provide a complementary result to hardware system in order to integrate it in different management systems. Furthermore, RFID operating standards do not exist for global operation, which would make tracing and tracking Specialty Journal of Psychology and Management, 2015, Vol, 1 (1): 10-16 16 difficult for both import and export goods. As future work we plan to continue the research which needs to be carried with the help of MAS before RFID can realize its full implementation.