Mary Ellen Zurko
in the cusp of research and development; research with practical impact, or "version 0" development. Over two decades of work
in user-centered security, in research, early product prototyping, and product development. Experience across the entire lifecycle
of software products, from technology transfer, to initial product definition and delivery, to mature product maintenance.
Software Group, Littleton, MA
Architecture for LotusLive Cloud Offerings
2007 to present
architect for LotusLive brand of Software as a Service collaboration offerings. Defined and delivered security features, value
proposition and test approach in file sharing, social networking, instant messaging, emeetings and other collaboration services
and their infrastructure. Worked with components entirely developed within the team, integrated from other parts of IBM, and
components from acquisitions. Led engineers in design and implemention of security features, protocols, integration, and deployment.
Created security quality processes and goals. Engaged in customer presentations and discussions. Set direction and plans for
security features based on customer, market, and business needs. Drove security partner relations. Authored whitepapers on
LotusLive security. Set priorities and trade offs around security requirements. Addressed potential vulnerabilities, including
Web 2.0 and social networking vulnerabilities, phishing, and spam. Created and led community of cross cutting security experts
that functions as decision making body. Outstanding Technical Achievement Award for Security Leadership for LotusLive.
leader through patent invention and direction. Master Inventor (recognizing mentorship, engagement in the Intellectual Property
process, and patenting). Lead of Security Patent Review Board for IBM Software Group, determining direction of patent inventions
from North America. Four patents issued. 31 patent applications filed over 9 years.
Architecture and Strategy for Workplace, Portal and Collaboration Software (WPLC, aka Lotus) division
September 2004 to
strategy definition and execution as part of the WPLC CTO office. Special projects on user-centered security, antispam, content
protection, digital rights management, code security in Java/Eclipse, data leak prevention, security as a system quality and
software as a service. Experience working with partner companies and all internal stake holders of software products, including
business development, product management, acquisition teams, sales, support and services. Successful technology transfer of
security research into product. Defined security architecture and plans for Connections 2.0, IBM's social networking product.
Introduced vulnerability discovery and tracking processes to Workplace, Connections, and other IBM products.
Patent Innovation Architect and Brand Lead, and Patent Review Board Chair. Operational responsibility for the processing of
over 1/5 of IBM SWG North America patent disclosures, with strategic oversight of over 1/2. Cooperation with intellectual
property lawyers internationally. Approximately 12 patent applications filed. Awards for patent disclosure quality, Master
Inventor, and lead of WPLC Master Inventor selection team. Defined patent strategy Led team identifying top issued patents
mentoring across geographies and diversity categories.
products Security Architect
October 2001 to September 2004
Security Architect for all of Lotus Workplace Collaboration Services and Workplace Managed Client. Defined security goals,
requirements, and architecture of Lotus Workplace Messaging v1.0, Lotus Workplace v1.1, Lotus Workplace v2.0 and IBM Lotus
Managed Client and Workplace 2.5 products, including the areas of authentication, network protection, authorization, active
content, encryption, anti-spam. Team lead of Workplace Infrastructure Security team (11 members, spanning US and India). Security
architect responsibilities spanned entire development team. Founder and Chair of Lotus Security Working Group. Lotus representative
on many corporate security and privacy task forces. Responsible for selecting Lotus funded security and privacy research and
technology transfer of the results. Steering committee of IBM Massachusetts Women’s diversity organization and co-chair
of survey subgroup.
Associates, Westford, MA
June 1998 to October 2001
team lead responsible for iNotes Web Access. Defined, designed and implemented active content filter for malicious mail dynamic content. Architected
and led design of support of encrypted mail. Security Group team member responsible for active content security for client
agents (Workstation Execution Control Lists) and authorization (ACLs) in Lotus Notes/Domino.
facilitator, architect and implementer on Jonah project, a freeware reference code base for PKIX, a public-key infrastructure IETF standard. Designed
and developed core policy modules, certificate cutting code, certificate revocation lists, and registration authority enrollment.
Two IBM awards for teamwork, at the division and SWG levels.
Open Group Research Institute, Cambridge, MA
Senior Research Fellow
August 1994 to June 1998
Leader of Adage, a user-centered authorization research project. Directly responsible for proposals that led to approximately
$2 million in contracts for related work (including Pledge, a follow-on project to deploy Adage in the DoD’s Next Generation
Information Infrastructure). Security consultant for many more successful contracts. Led and mentored teams staffed up to
11 engineers. Produced initial high level Adage architecture, designed and helped implement graphical user interface and authorization
policy language, specified mapping from authorization language to underlying engine data structures. Led design of deployment
enhancements under Pledge, including access control on authorization information and expanded query facilities. Wrote high
and low level design of Map, a prototype of rule-based authorization engine for a DCE Web server. Implemented server-side
management of rules and related structures and client side management function through a proxy interface. Designed model for
trust relationships between authorization service and authentication and attribute sources, including amount of trust, type
of trust, and distrust. Designed, administered, and documented results and recommendations of contextual inquiry and formal
member of the DCE Web project that designed and implemented World Wide Web servers, browsers, and gateways that took advantage
of DCE security and naming. Designed and implemented access control list manager and callbacks, and toolkit/server integration
of initial prototype.
Equipment Corporation, Littleton, MA
Distributed Processing Engineering
September 1992 to August 1994
leader for first GUI tool on Digital’s DCE platforms (a Visual DCE ACL Editor). Created and designed the product, coded the UI (in Visual
C++), ran usability tests. Shared project leader responsibilities for DCE Client for Windows. Technical lead in researching
graphical DCE management tools, and in integration with other management tools at Digital and with Windows/NT.
adopter of Visual C++ v1.0. Taught classes in Visual C++ to other members of my organization.
for testing first port of OSF DCE to OpenVMS.
Equipment Corporation, Littleton, MA
Secure Systems Group
June 1986 to August 1990
Mail, May 1990 to August 1990
and implemented new user interface to PEMail prototype.
Secure Virtual Machine Monitor, June 1986 to April 1990
leader of design and implementation of user interface, and of design and development of user interface tests and testing process.
Designed look and feel of confirmation displays for secure-attention commands, and untrusted command support (patented). Implemented
command processing infrastructure. Designed reference monitor for subjects.
of full system functional specification. General resource for usability, security, and product functionality, both inside
this group and to other organizations (customers, NCSC (aka NSA)).
Prime, Framingham, MA
CAD/CAM User Interface Group
1984 to June 1986
end user interface of Prime’s first internally developed CAD/CAM product, PrimeDesign (including menus, windows, and
advanced graphics). Designed application programmer’s interface to the user interface modules. Designed and implemented
menu manager, message manager, and help system.
Equipment Corporation, Nashua, NH
Office Automation Performance Evaluation
June 1982 to November 1984
resource utilization, bottlenecks, and code. Set performance goals, ran workloads, and proposed enhancements for office automation
products. Created group’s first study of user perceived performance.
Institute of Technology
Master of Science, Computer Science, August 1992
-- Technology Strategy, Engineering Risk/Benefit Analysis, Distributed Algorithms, Object-Oriented Databases, Knowledge-Based
Systems, Programming Languages, Theory of Computation.
of Science, Computer Science, June 1982
“To Market, To Market: Human-Centered Security and LotusLive”, Security and Privacy Usability Technology Transfer: Emerging Research Workshop, 2010.
Security Dialogs for Improved Security Behavior of Users”, INTERACT 2009.
Recommenders for Discretionary Access Control”, Web 2.0 Security and Privacy 2009 (W2SP).
“User-Centered Security: Stepping Up To The Grand Challenge”, Invited Essay and keynote speech, proceedings of Annual Computer Security Applications
Conference (ACSAC), December 2005. Follow up invited talks at MIT, WPI, Nokia Research, University of Newcastle, Carleton
Security in Collaborative Applications: A Notes/Domino Perspective”, chapter of Security and Usability: Designing Secure Systems That People Can Use, O’Reilly, 2005.
“Did You Ever Have to Make Up Your Mind? What Notes Users Do When Faced With a Security Decision”, Proceedings of Annual Computer Security Applications Conference (ACSAC), December 2002.
Considerations in Web Security”, invited paper to International Workshop on Certification and Security in E-Services
and IBM Technical Report, 2002.
Influence Through Citation Index Comparisons and Preliminary Case Studies”, invited paper and panelist, proceedings
of New Security Paradigms Workshop, 2001.
Experience Implementing PKIX Freeware”, Proceedings of Usenix Security Symposium, August 1999.
User-Centered, Modular Authorization Service Built on an RBAC Foundation”, Proceedings of the IEEE Computer Society
Symposium on Security and Privacy, May 1999.
of Duty in Role-based Environments”, Proceedings of IEEE Computer Security Foundations Workshop, June 1997.
Security”, Proceedings of New Security Paradigms Workshop, September 1996 (also in NSPW Highlights of the First Five
1.0 and HTTP 1.1 specifications in the IETF HTTP working group (acknowledged contributor).
“The DCE Web Project: Providing Authorization and Other Distributed Services to the World Wide Web,” Poster paper for the Second International World-Wide Web Conference, October 1994.
are the Foundations of Computer Security?,” Proceedings of IEEE Computer Security Foundations Workshop, June 1993 (Panel
Support for Inter-Domain Use”, Proceedings of 5th IEEE Computer Security Foundations Workshop, June 1992.
User Attribute Service Supporting Least Privilege in Distributed Applications”, MIT Master’s Thesis, August 1992.
Retrospective on the VAX VMM Security Kernel”, IEEE Transactions on Software Engineering, Vol. 17, No. 11, November
VMM Security Kernel for the VAX Architecture”, Proceedings of the IEEE Computer Society Symposium on Research in Security
and Privacy, May 1990 (Best Paper award).
and Patent Applications
for protecting a computing system from harmful active content in documents
for instant message to telephone speech and back
of protecting a computing system from harmful active content in documents
of trusted-path commands
trusted commands in trusted and untrusted environments
for executing trusted-path commands
31 patent applications
filed while at IBM
Posts, Talks and Awards
Security: From Grand Challenge to Technology Transfer”, invited talk, MIT’s Lincoln Laboratory, September 2011.
Security Context: User Interface Guidelines” short talk, Workshop on Usable Security Indicator Conventions (WUSIC),
Invited panelist, “Obstacles to Adopting UX Indicators as Conventions/Standards”, WUSIC co-chair. SOUPS 2011.
Are All Watchers On This Bus: Can Social Network Transparency Substitute for Traditional Business Oversight?”, lightning
talk, SOUPS 2011.
in Development: Perspectives from Lotus and LotusLive”, invited talk, Software and Usable Security Aligned for Good
Engineering Workshop, April 2011.
at Lotusphere, the IBM Collaboration Service division's top customer event, 2011, 2010, 2007 - 2003. “Trusting Your
Data to IBM LotusLive and IBM LotusLive Notes” in 2011. “Lotus Brings Security to the Cloud with IBM LotusLive”
in 2010. "New Java Security Standards in the IBM Lotus Notes 8 Client" at 2007.
Introduction to Usable Security”, tutorial, ACSAC 2010.
& Privacy Usability Technology Transfer: Emerging Research Workshop, creator and co-chair, SOUPS 2010.
Notes Security” whitepaper, 2010.
iNotes Security” whitepaper, 2010.
of W3C Web Security Context (WSC) working group, October 2006 – August 2010. Produced the W3C Recommendation Web Security Context: User Interface Guidelines. Invited talk on standards and usable security at Usability, Psychology and Security, 2008. Discussion
session on standardizing usable security at SOUPS 2007.
committee member for Symposium On Usable Privacy and Security (SOUPS), 2010 – present. Paper chair, 2005. Program committee
member from inception to the present.
Engage Security” whitepaper, 2009.
Meetings Security” whitepaper, 2009.
Panelist, “Usability meets access control: challenges and research opportunities”. SACMAT 2009.
of discussion session, “Technology transfer of successful usable security research into product”, SOUPS 2009.
panelist at RSA on the topic of Usable Security, 2008.
organizer and moderator, “Usable Cryptography: Manifest Destiny or Oxymoron?”, Financial Cryptography 2008.
co-chair of WWW2007.
Panelist, Security Issues, speaking on "Authentication, Trust, and Risk in Web-based Business", WWW2006.
Committee, W3C Workshop on Transparency and Usability of Web Authentication, 2005.
“Usability of Security Administration vs. Usability of End-User Security”, Panel speaker, SOUPS 2005.
“Web Security – why is it so darn hard?”, Keynote, AusWeb 2004.
of IW3C2, (2008 – present), member (1997 to present). Program chair of WWW10 (WWW2001). Ecommerce
and security vice chair for WWW8 and WWW9 and WWW2002. Industrial Track Vice Chair WWW2003. Program committee member for WWW4,
WWW5, and WWW6 and WWW2003. Invited member of Security Panel for WWW4 and WWW3. Organized and chaired Security BOF for WWW2.
“Security Evaluation and Assurance Lessons from Business, Marketing, and HCI”, Panel speaker on The Relationshop of System and Product Specifications and Evaluation,
Applied Computer Security Associates (ACSA) Fellow; steering committee for Annual Computer Security Applications
Conference and sister conferences, 2004 – present.
Commerce Research special issue on Electronic Commerce, Security, and Privacy, Volume 5, Number 1, January 2005, co-editor.
Women to Watch 2004 award from Mass High Tech.
of NRC panel assessing the National Institute of Standards and Technology Measurement and Standards Laboratories, 2000 –2005.
Co-author of 2001 and 2002 reports. Chair of security sub-panel, 2003 - 4.
of Springer's International Journal of Information Security (IJIS) (2000 – 2006).
chair for New Security Paradigms Workshop, 2000. Vice chair ’99. Program chair ‘97 and ‘98. Program committee
member 2001 – 2003. Steering committee 1997 – present.
Panel: What’s Missing in Web Services Security?, W3C/OASIS forum on Web Services Security, 2002.
Networks Special Issue on XML, co-editor, 2002.
committee member and reviewer, Annual Computer Security Applications Conference (ACSAC), 2000 – 2003.
Vice Chair, Symposium on Applications and the Internet (SAINT), 2001.
Committee of IFIP Workshop on Internet Technologies, Applications, and Societal Impact (2002).
of IFIP Working Group 6.4 on Internet Applications Engineering (2000 – 2004).
contributor to and Associate Editor of Cipher, the electronic newsletter of the IEEE Computer Society’s Technical Committee
on Security and Privacy (1997 to 2001).
Getting Involved in Technical Standards Organizations, Grace Hopper Celebration of Women in Computing, 2000.
of NRC panel on Library of Congress Information Technology Strategy (1999). Co-author of results.
of W3C P3P Preferences Interchange Language Working Group (1998 - 1999).
talk at Digital Commerce Society of Boston, “Oh Jonah, He lived in a whale, Or, How IBM decided to win in ecommerce
by embracing standards and donating code”.
committee member for Agent Systems and Applications/Mobile Agents, ’99 – ‘00. Program committee member of
HICCS ‘98 and WETICE ‘98 agents session.
committee member for IEEE Symposium on Security and Privacy 96 - 98
speaker at the Fourth Computer Misuse and Anomaly Detection (CMAD) workshop on the topic of New Ideas in CMAD (1997).
lectures on Authorization and the DCE Web to the Stanford Distributed Libraries Group and on DCE and DCE Web at W3C (1996).
committee representative to W3C and member of W3C security working group (1997 – 1998).
Issues On The Web”, Tutorial at for the Third International World-Wide Web Conference, April 1995.