CERIAS Security Seminar Podcast: Recent Episodes
CERIAS <webmaster@cerias.purdue.edu>
Problem: Cyber threat information is rarely codified and never connected to actual infrastructure that needs cyber protections since infrastructure is also not codified.Solution: Infrastructure Expression (IX) – Five use cases for the IX tools with methods using graph theoretics and machine learning will be presented. A full scenario on recent malware binary analysis will be presented highlighting applicability to infrastructure, creation of context specific indicators, cyber observables, and courses of actions for better cyber defenses. Background: The Idaho National Laboratory (INL) has been creating tools, methods and cyber defense capabilities using Structured Threat Information Expression (STIX) and graph database technology since 2015. INL's internal Laboratory Directed Research and Development (LDRD) project – IX - created the first codified infrastructure models in STIX. INL has open sourced these tools and uses advanced graph and machine learning methods and techniques to support critical infrastructure cyber defenses for many USG sponsors and stakeholders. About the speaker: Rita Foster is recognized nationally for research leadership in control system cyber security, briefing numerous committees in the United States Senate and House, appointed by cabinet level secretaries to serve on advisory councils and is frequently requested to provide analysis on emerging threats and impacts to critical infrastructure. She currently leads the innovation development for the infrastructure security areas: identifying research gaps that align to our agile and resilient strategies, creating partnerships, building proposals, and analyzing risk components for cyber-physical infrastructure security. These partnerships include asset owner utilities, technology providers, DOE, DHS, DOD and other government entities. Her efforts resulted in research proposals awarded ranging from creation of automated response mitigating cyber threats, applying machine learning to firmware and malware binary code, impact analysis with physics-based modeling, asset owner consumable threat analysis and characterizations of vulnerabilities and exploits in various control systems and components. She has over 33 years of experience in computer integration focusing on control systems applications, real-time simulations and for critical life safety related applications.Her current role at INL includes over 18 years of experience in cyber security of critical infrastructure identifying research gaps aligned with strategic direction, creating partnerships,providing capstone analysis, and thought leadership in areas of protection and defense in the energy sector. She has mentored over 50 interns ranging from high schoolers to Ph.D. candidates using her project data and tools for dissertations. She provides outreach and education to a wide range of stakeholders and has participated in numerous exercises to identify gaps in roles and responsibilities between private industry and government. She has managed multi-discipline teams bringing together controls system engineers, network engineers, cyber security researchers and subject matter experts for infrastructure security. She has served as the technical lead providing initial direction and requirements for programs essential to INL's success. Her early career at INL included over 15 years of experience in independent verification and validation of large military networks for performance and security, validating of physics-based code for nuclear repositories, programming real time training simulators for nuclear operations, programming life safety systems for nuclear repositories, validated energy transmission and distribution systems and integrated divergent control systems creating supervisory control and data acquisition platforms. Prior to INL, she obtained over 8 years of experience in computer operations,programming, and data networking.
Software Supply Chain is emerging as one of the biggest issues that enterprises are facing these days. SolarWinds, Kaseya, 3CX, the examples are way too many. These attacks rapidly multiplied in 2022.In this presentation, we will discuss the trending of software supply chain issues, the federal mandates in the form of executive orders that are impacting this space, emerging best practices and what is the fundamental tech stack to manage these issues, and lastly, what does a good supply chain security program looks like.Dr. Singh will also briefly discuss his journey from being a student at Purdue (MS, Computer Science) to his current role as Chief Information Security Officer of Alkami Technology. About the speaker: Anand is a seasoned cybersecurity executive with over 25 years of experience managing technology, security, privacy, and risk teams in a variety of verticals. His career spans Financial Services, Retail, Healthcare, Manufacturing, eCommerce, Cloud, and SaaS companies. These include UnitedHealth Group, Target Corporation, Alkami Technology, Caliber Home Loans, and PTC.He is currently the Chief Information Security Officer (CISO) at Alkami Technology. Alkami's solutions enable financial institutions to outsmart the competition by providing the nation's best Cloud, SaaS, and PI centric digital banking platform. Alkami's mission is to be the gold standard in digital banking. More than 400 FIs and 15 million end users use Alkami's solutions. Anand is also a seasoned Board director with tenures at DaVinci Academy, CISO XC, and Dallas CISO Summit. Anand holds NACD.DC, CISM, and CISSP certifications. He has a PhD in Computer Science from University of Minnesota, MS in Computer Science from Purdue University, and B.Tech. in Computer Science and Engineering from Indian Institute of Technology. Anand is a proud boilermaker and is deeply attached to Purdue's mission and its goals.
Human identity recognition is one of the key mechanisms of ensuring proper asset and information access to individuals. It became an established authentication practice for government, consumer, financial and recreational institutions in modern society. Biometrics are also increasingly used in a cybersecurity context to mitigate vulnerabilities and to ensure protection against an unauthorized access. However, with the rise of the technological advancements, such as AI and deep learning, more and more capabilities exist to infer private information of individuals and to use aggregate data mining for commercial or other purposes. This lecture will discuss how deep learning methods can enhance biometric recognition accuracy in a variety of settings: unimodal and multi-modal systems, social behavioral biometrics, and risk assessment. The lecture will further focus on risks of privacy and ethical considerations, with discussing cancellability and de-identification as two of the mechanisms to mitigate the privacy concerns. About the speaker: Prof. Gavrilova holds Full Professor with Tenure appointment at the Department of Computer Science, University of Calgary, Canada. Prof. Gavrilova research interests lie in the areas of machine intelligence, biometric recognition, image processing and GIS. Prof. Gavrilova publication list includes over 150 journal and conference papers, edited special issues, books and book chapters, including World Scientific Bestseller of the Month (2007) – "Image Pattern Recognition: Synthesis and Analysis in Biometric," Springer book (2009) "Computational Intelligence: A Geometry-Based Approach" and IGI book (2013) "Multimodal Biometrics and Intelligent Image Processing for Security Systems". She has received support from CFI, NSERC, GEOIDE, MITACS, PIMS, Alberta Ingenuity, NATO and other funding agencies. She is an Editor-in-Chief of Transactions on Computational Sciences Springer Verlag Journal series and on Editorial board of seven journals.
The roots of software piracy were propelled by the fledgling game market of the 1980's where the PC game supply chains were brittle and copying floppy disks was really easy. This talk will walk through the history and evolution anti-cracking controls as video games moved from bedroom game development to a 220 billion dollar industry. About the speaker: Kelly FitzGerald is an Product Security Architect at the RTX CODE Center where she focuses on factory and supply chain cybersecurity and threat intelligence. Kelly comes to RTX after 15 years at Symantec/Veritas where she worked in Product Security Vulnerability Management while doing research in medical device vulnerabilities. Kelly lives with her husband, kind golden retriever and sassy black cat in San Diego, CA. In her spare time she creates bad art, manipulates the memory of single player games and watches way too much educational YouTube.
Information Flow Tracking (IFT) is a useful tool to reason about security of a system. It can be applied at different levels of abstraction - starting from operating system all the way to gate-level circuits through various representations of software and hardware. In this talk, we will focus on IFT at the register transfer level (RTL) representation of hardware and discuss how IFT can be applied to find various types of RTL security vulnerabilities. We will discuss an inductive formulation of the problem based on leakage alert and propagation alert that offers a scalable solution and micro-architecture-level design insights compared to more traditional formulations. We will end the talk by outlining some of the research challenges that we need to address to push the boundary further. About the speaker: Dr. Sayak Ray is a Security Researcher at Intel Corporation. His area of research includes tools and automation for security validation, security challenges in FPGA, heterogeneous computing and data center networking. Dr. Ray regularly publishes at design automation conferences and journals. He has served on technical program committees of various conferences such as DAC and ICCAD. Before joining Intel in 2016, he was a Post-doctoral Research Associate at Princeton University. Dr. Ray obtained his PhD from UC Berkeley in 2013.
"What Do We Owe One Another In Cybersecurity?" As the cybersecurity ecosystem evolves, we understand more about how interconnected we are: the ripple effects from breaches, the fact that supply chains aren't discrete lines but rather a web, and that mapping our vulnerabilities is harder than we thought. In this session, Wendy Nather will talk about the concept of civic duty on the Internet — not just sporadic charity efforts or "nice to have" information sharing, but the social norms and obligations we should face together if we want a sustainable world of technology. Shared risk requires shared defense. About the speaker: Wendy Nather leads the Advisory CISO team at Cisco. She was previously the Research Director at the Retail ISAC, and Research Director of the Information Security Practice at 451 Research. Wendy led IT security for the EMEA region of the investment banking division of Swiss Bank Corporation (now UBS), and served as CISO of the Texas Education Agency. She was inducted into the Infosecurity Europe Hall of Fame in 2021. Wendy serves on the advisory board for Sightline Security. She is a Senior Fellow at the Atlantic Council's Cyber Statecraft Initiative, as well as a Senior Cybersecurity Fellow at the Robert Strauss Center for International Security and Law at the University of Texas at Austin.
For 35 years, the Internet has been bedeviled by attackers. For about as long, defenders have tried deploying various defenses; these have often been of limited utility. We look back at what has happened, focusing on the explicit or (more often) implicit assumptions behind the defenses, and why these assumptions were or were not correct. About the speaker: Steven M. Bellovin is the Percy K. and Vida L. W. Hudson Professor of Computer Science at Columbia University, member of the Cybersecurity and Privacy Center of the university's Data Science Institute, and an affiliate faculty member at Columbia Law School. Bellovin does research on security and privacy and on related public policy issues. In his copious spare professional time, he does some work on the history of cryptography. He joined the faculty in 2005 after many years at Bell Labs and AT&T Labs Research, where he was an AT&T Fellow. He received a BA degree from Columbia University, and an MS and PhD in Computer Science from the University of North Carolina at Chapel Hill. While a graduate student, he helped create Netnews; for this, he and the other perpetrators were given the 1995 Usenix Lifetime Achievement Award (The Flame). He has also received the 2007 NIST/NSA National Computer Systems Security Award and has been elected to the Cybersecurity Hall of Fame. Bellovin has served as Chief Technologist of the Federal Trade Commission and as the Technology Scholar at the Privacy and Civil Liberties Oversight Board. He is a member of the National Academy of Engineering and has served on the Computer Science and Telecommunications Board of the National Academies of Sciences, Engineering, and Medicine. In the past, he has been a member of the Department of Homeland Security's Science and Technology Advisory Committee, and the Technical Guidelines Development Committee of the Election Assistance Commission.Bellovin is the author of Thinking Security and the co-author of Firewalls and Internet Security: Repelling the Wily Hacker, and holds a number of patents on cryptographic and network protocols. He has served on many National Research Council study committees, including those on information systems trustworthiness, the privacy implications of authentication technologies, and cybersecurity research needs; he was also a member of the information technology subcommittee of an NRC study group on science versus terrorism. He was a member of the Internet Architecture Board from 1996-2002; he was co-director of the Security Area of the IETF from 2002 through 2004.More details may be found at http://www.cs.columbia.edu/~smb/informal-bio.html.
Endpoint security controls have traditionally relied on detecting malicious activity to protect devices from intrusions. But attackers often change their techniques so quickly that detection patterns must be adapted, resulting in a detection lag. Some of this limitation can be solved by using hardware-based process isolation, which isolates risky endpoint tasks from the user's data and critical parts of the operating system. One of the most interesting data sources the HP Threat Research team uses to track malware trends and behaviors are isolation traces, since they can give us an insight into techniques that have bypassed detection controls. In this presentation, we provide an overview of captured attack techniques that are currently seen in the wild. We will elaborate how attackers try to bypass email security and how users are lured to infected websites to download malware. Finally, we will share advice on how to protect against such attacks and what to look out for. About the speaker: Patrick is a malware analyst at HP with interests in a wide range of security areas. He already focused on cyber security during his studies, where he developed a particular interest in malware analysis. After graduation, he worked on a scientific project at the university and built a dynamic malware analysis system for code similarity clustering. He gained further experience in incident response and threat intelligence at a Swiss bank. Since 2021, Patrick works as a malware analayst on HP's Threat Research team. He conducts analyses of new threats, using the results to improve HP's security products and shares them with the community.
The use of sophisticated digital systems to control complex physical components in real-time has grown at a rapid pace. These applications range from traditional stand-alone systems to highly-networked cyber-physical systems (CPS), spanning a diverse array of software architectures and control models. Examples include city-wide traffic control, robotics, medical systems, autonomous vehicular travel, green buildings, physical manipulation of nano-structures, and space exploration. Since all these applications interact directly with the physical world and often have humans in the loop, we must ensure their robustness, security, and physical safety. Obviously, the correctness of these real-time systems and CPS depends not only on the effects or results they produce, but also on the time at which these results are produced. For instance, in a CPS consisting of a multitude of vehicles and communication components with the goal to avoid collisions and reduce traffic congestions, formal safety verification and response time analysis are essential to the certification and use of such systems. This seminar introduces two key elements for building robust real-time systems: regularity-based virtualization and functional reactive programming.Real-time resource partitioning (RP) divides hardware resources (processors, cores, and other components) into temporal partitions and allocates these partitions as virtual resources (physical resources at a fraction of their service rates) to application tasks. RP can be a layer in the OS or firmware directly interfacing the hardware, and is a key enabling technology for virtualization and cloud computing. Open, virtualized real-time systems make it easy to securely add and remove software applications as well as to increase resource utilization and reduce implementation cost when compared to systems which physically assign distinct computing resources to run different applications. The first part of this talk will describe ways based on the Regularity-based Resource Partition Model (RRP) to maintain the schedulability of real-time tasks as if they were scheduled on dedicated physical resources and increase the utilization of the physical multi-resources.The benefits of using the functional (reactive) programming (FRP) over the imperative programming style found in languages such as C/C++ and Java for implementing embedded and real-time software are several. The functional programming paradigm allows the programmer to intuitively describe safety-critical behaviors of the system and connect its components, thus lowering the chance of introducing bugs in the design phase, resulting in a robust and secure implementation. Its stateless nature of execution does not require the use of synchronization primitives like mutexes and semaphores, thus reducing the complexity in programming on parallel and multi-core platforms. Hence, FRP can potentially transform the way we implement next-generation real-time systems and CPS. However, accurate response time analysis of FRP-based controllers remains a largely unexplored problem. The second part of this talk will explore a framework for accurate response time analysis, scheduling, and verification of embedded controllers implemented in FRP. About the speaker: Dr. Albert Cheng, a U.S. Department of State Fulbright Specialist (2019-2024), is a full professor and former interim associate chair of computer science and a full professor of electrical and computer engineering at the University of Houston in Houston, Texas. He was a visiting professor at Rice University and the City University of Hong Kong. He received the B.A. degree with highest honors in computer science, graduating Phi Beta Kappa, the M.S. degree in computer science with a minor in electrical engineering, and the Ph.D. degree in computer science, all from The University of Texas at Austin, Austin, Texas.Prof. Cheng is a Distinguished Member and Speaker of the ACM, an Honorary Member of the Institute for Systems and Technologies of Information, Control and Communication, and a Fellow of the Institute of Physics. An author of over 270 publications, Prof. Cheng is an Associate Editor of the IEEE Transactions on Knowledge and Data Engineering (TKDE) and the ACM Computing Surveys (CSUR). His research interests center on the design, specification, analysis, optimization, formal verification, scheduling, and implementation of embedded and real-time systems, real-time virtualization, cyber-physical systems/Internet of things, real-time machine learning, knowledge-based systems, functional reactive systems, and security.He received the 2015 University of Houston's Lifetime Faculty Award for Mentoring Undergraduate Research. He implemented in C the first model checker, co-invented by ACM Turing Award winner E. Allen Emerson, augmented with semantics-based analysis for rule-based expert systems. He authored the popular textbook Real-Time Systems: Scheduling, Analysis, and Verification. Prof. Cheng is the Founder and CEO of AMKC Informatics, LLC.Speaker's website:Professor Albert M. K. Cheng's Homepage (uh.edu)
This talk will discuss how we engineer trust among agents, humans, and algorithms to develop solutions to significant practical problems, including Trustworthy AI in multiple applications, Resilience in systems, and a framework for Artificial Conscience to control AI, which we extend to system security. Trustworthiness of AI solutions is emerging as a must for the best use of AI. Using our trust system, we have developed metrics for acceptance, explainability, and fairness of AI solutions having humans in the loop. Furthermore, we introduce the concept of Trustability, which captures the probability of a system keeping the required QoS performance under a specific attack tree. Finally, we present our framework for Artificial Conscience, where AI algorithms are controlled by agents who negotiate with each other using our trust engine to output a solution with maximum" Artificial Feeling." This framework can be easily implemented in any AI system where multiple metrics are involved, including system security scenarios. About the speaker: Arjan Durresi is a Professor of Computer Science at Indiana University Purdue University in Indianapolis, Indiana. He has published over 100 papers in journals, over 220 articles in conference proceedings, and twelve book chapters. His research interests include Trust Engineering, System Security, Trustworthy Artificial Intelligence, AI Control, Network Architectures and Protocols, and Quantum Computing. NSF, USD, states, universities, and industry sources funded his research. He was named among the top 2% of scientists on Stanford's list in September 2021and updated in October 2022.
Examines Chinese views on the importance of information as the new currency of international power, and discusses how the PLA's restructuring supports PLA efforts at planning for future "informationized local wars." About the speaker: Dean Cheng is a non-resident Senior Fellow with the Potomac Institute for Policy Studies and a Senior Advisor with the US Institute of Peace. He recently retired from the Heritage Foundation as the Senior Research Fellow for Chinese political and security affairs. He specializes in Chinese military and foreign policy, and has written extensively on Chinese military doctrine, technological implications of its space program, and "dual use" issues associated with China's industrial and scientific infrastructure. He is the author of "Cyber Dragon: Inside China's Information Warfare and Cyber Operations."
People face increasing dangers from cyber enemies. At the same time, cyber pros are suffering from stress, burnout and “hamster wheel”syndrome. They experience many difficulties every day in easily protecting people and companies from danger.
There is a different option. Cyber pros have the opportunity of better work-life balance, more rewarding careers and achieving their personal missions to better protect people and companies – by making cybersecurity as reliable as electricity.
How? The same way as other business functions do – with curiosity,critical thinking, system thinking and industrial-strength design thinking. The same way business innovation created products that delight us in daily life.The same way music, sports and cooking bring us joy. The same way military battles are won. It takes learning to think counter intuitively and to change.
But there’s a twist, business innovators have education,method and coaching at the individual, team and organizational levels.
Compared to other business functions, cyber pros are setup to fail. The support system for cyber pros is missing!
The good news is, it’s readily fixable! That starts with putting people in the center of cybersecurity – empowering cyber pros to more easily protect people from danger, accelerating authentic Zero Trust and making cybersecurity as reliable as electricity.
Join us to learn and map-out your action plan.
Data deidentification aims to provide data owners with edible cake: to allow them to freely use, share, store and publicly release sensitive record data without risking the privacy of any of the individuals in the data set. And, surprisingly, given some constraints, that’s not impossible to do. However, the behavior of a deidentification algorithm depends on the distribution of the data itself.
Privacy research often treats data as a black box---omitting formal data-dependent utility analysis, evaluating over simple homogeneous test data, and using simple aggregate performance metrics. As a result, there’s less work formally exploring detailed algorithm interactions with realistic data contexts. This can result in tangible equity and bias harms when these technologies are deployed; this is true even of deidentification techniques such as cell-suppression which have been in widespread use for decades. At worst, diverse subpopulations can be unintentionally erased from the deidentified data.
Successful engineering requires understanding both the properties of the machine and how it responds to its running environment. In this talk I’ll provide a basic outline of distribution properties such as feature correlations, diverse subpopulations, deterministic edit constraints, and feature space qualities (cardinality, ordinality), that may impact algorithm behavior in real world contexts. I’ll then use new (publicly available) tools from the National Institute of Standards and Technology to show unprecedentedly detailed performance analysis for a spectrum of recent and historic deidentification techniques on diverse community benchmark data. We’ll combine the two and consider a few basic rules that help explain the behavior of different techniques in terms of data distribution properties. But we’re very far from explaining everything—I’ll describe some potential next steps on the path to well-engineered data privacy technology that I hope future research will explore. A path I hope some CERIAS members might join us on later this year.
This talk will be accessible to anyone who’s interested—no background in statistics, data, or recognition of any of the above jargon is required.
Business executives leverage cybersecurity programs to understand residual risk. That helps them make informed decisions to mitigate risk to an acceptable level. This session provides guidance to improve program maturity in stages.
Maturity Level 1. Minimal Compliance Development of an information security programshould begin with a reputable baseline such as the NIST Cybersecurity Framework.
A framework communicates the minimum controls required to protect an organization. It is also necessary to include control requirements from applicablelaws, regulations and contractual obligations. Compliance with external requirements is also a minimalistic approach when designing a program.
Maturity Level 2. Common Controls Control frameworks provide mid-level guidance and are not intended to be prescriptive. That is by design. This level of maturity addresses common security safeguards that are not specified in the control framework. It is necessary to identify and implement them. Gap analysis: Deploy controls based on proven methodologies such as the 20 CIS Controls.
- Patching
- Penetration testing
- Web application firewall
Establish a risk-based approach for implementing controls.
Maturity Level 3. Risk Management It is necessary to tailor controls to the organization and to adapt to changes in the threat landscape. We discuss 'Threat Landscape and Controls Analysis' and a Risk Register process.
Maturity Level 4. Strong Risk management At this level the organization begins to demonstrate ownership of the cybersecurity program from an operational risk perspective. When management communicates low risk tolerance, that is synonymous with a commitment to strong risk management.
-
The cybersecurity program maintains controls specific to line of business products, services and assets
-
An operational risk management function maintains a risk scenarios inventory and conducts quantitative risk analysis
-
Incident response and business continuity exercises are conducted annually to include senior executives, lines of business leaders, information technology, legal, public relations and critical suppliers
A multi-generational plan can be used to improve program maturity. Strong risk management pays dividends over time with low occurrence of harsh negative events. When incidents do occur, controls are in place to limit business impact.
Students: This is a hybrid event. You are encouraged to attend in-person in STEW G-52 As computing advances are making profound changes in our society, they also expose us to new security threats. While the impact of cyber attacks was often in our digital life in the past, our cyber world is increasingly intertwined with the physical world. Compromised safety-critical systems or critical infrastructures can have life and death implications. In this talk, I will highlight two research directions within my research group. First, on the system security front, I will discuss our efforts to ensure system availability on safety-critical embedded systems. Second, on the cyber-physical security front, I will present our recent work on IoT security. Finally, I will discuss our ongoing work and future directions.
Differential Privacy has become a widely used tool to protect privacy in data science applications. In this talk, I will present two use cases for differential privacy: a) in collection of key-value statistics and b) as a protection against membership inference attacks. Key-value statistics are commonly used to gather information about the use of software products. Yet, the collector may be untrusted, and the data of each user should be protected. There exist a number of differentially private collection methods that perturb the data at the client's site. However, these are very inaccurate. In theory it would also be possible to collect these statistics using secure computations. However, that is too inefficient to even test. We show that a new combination of differentially privacy and secure computation achieves both high accuracy and high efficiency. In the second application, we investigate the theoretical protection of differential privacy against membership inference attacks on neural network models. There exist proofs of theoretical upper bounds that scale with the privacy parameter. We show theoretically and empirically that those bounds do not hold against existing membership inference attacks in a natural deployment. We show that when using existing data sets from different sources on the Internet (instead of the same data set as in lab experiments) and unmodified existing, even no longer state-of-the-art membership inference attacks, the bound does not hold. We provide a theoretical explanation using a model that removes an unrealistic assumption about the training that, namely that it is iid.
Often, policy makers and cybersecurity professionals talk about cybersecurity as if cybersecurity is only important insofar as it benefits or protects other assets or values. For example, it is common to hear people argue that cybersecurity is important because of its role in economic growth, or potential damage military operations. Those arguments are not wrong, but they fail to understand national power, and consequently grossly understate cybersecurity's importance in international politics. Information is a component of national power all on its own, and cybersecurity is an important part of that component. Properly situating information as a component of national power, and cybersecurity in its appropriate place within information will better inform policy and practice. Informational considerations should hold equal weight in national policy, and not be subordinated military or economic concerns. As a component of information power, cybersecurity operates alongside other components of information power, and should cooperate with, and learn from those components of informational power.
Use of Ransomware as a class of malware has exploded in recent years, causing millions in damages to organizations across the world. The damage isn’t slowing down. On the contrary, ransomware as a tool is being adopted by a wide array of perpetrators. This includes nation-states, for cash, and to use the demand for cash to obfuscate activities like espionage and sabotage. Ransomware has become a powerful tool of asset seizure and extortion, being used by criminals, activists, and even sanctioned governments for multiple purposes including use as a weapon of war. The use of ransomware and its close cousin, wiperware, is only accelerating. In this talk, we will examine how the proliferation of ransomware brought us to this point, what it means for current global conflicts, and for the future of cyberwarfare.
Authentication is a critical part to ensure the identity of a legitimate user. During authentication, an individual’s credential is validated with a specific computational technique to determine the association of the user with his/her claimed identity.
In this talk, I will discuss an adaptive multi-factor authentication (A-MFA) framework which uses adaptive selection of multiple modalities at different operating environment so to make authentication strategy unpredictable to hackers. This methodology incorporates a novel approach of calculating trustworthy values of different authentication factors while the computing device being used under different environmental settings. Accordingly, a subset of authentication factors is determined (at triggering events) on the fly thereby leaving no exploitable a priori pattern or clue for adversaries. Such a methodology of adaptive authentication selection can provide legitimacy to user transactions with an added layer of access protection that is not rely on a fixed set of authentication modalities. Robustness of the system is assured by designing the framework in such a way that if any modality data get compromised, the system can still perform flawlessly using other non-compromised modalities. Scalability can also be achieved by adding new and/or improved modalities with existing set of modalities and integrating the operating/configuration parameters for the added modality.
I will highlight what type of evaluation be required for such identity management software to detect possible deep fakes and other forms of faking biometrics. Other attacks on current means of identity validation may become possible. What would be what good figures of merit to be used as response variables? What are good factors over which we would need to test for next-generation identity eco-systems.
References:
· Advances in User Authentication. Dipankar Dasgupta,Arunava Roy, Abhijit Nag. Publisher: Springer-Verlag, Inc., August 2017.
· US Patent #9,912,657: Adaptive Multi-Factor Authentication, Dasgupta, et al., March6, 2018.
There is no one bigger game changer in the world than technology and its uptake in every aspect of our lives including our collective future. Cybersecurity has become the top priority across the board. There is need for informed cybersecurity investments that consider sustainability, responsible data usage, being prepared for any crisis and being resilient. We have to enable a culture of responsible innovation that takes holistic considerations for the people, process and technologies and drive a responsible mindset. We will talk about boundary considerations when it comes to data use, adversary threats, impact on environment, user behaviors and how we can help as cybersecurity professionals. The goal is to build the highways for the future with a holistic approach and principles that enables fearless harnessing of the global compute platform, enabling profound technological growth for the next generation.
Students: This is a hybrid event. You are encouraged to attend in person in STEW 050B (G52)
Common IT based Cyber techniques do not apply to many parts of the aviation industry. The aviation industry has to meet a number of Federal Aviation Regulations and using Industry provided standards show compliance to those regulations, perhaps for the life of the airplane after initial certification. Most all updates to airplanes require a certification activity, thus it takes considerable time to make any system changes. This certification process has been time tested and proved to have the right rigor leading to continued improved safety as the number of flights per day worldwide increases each year. Cyber security being an evolving threat must be considered in all system designs.
Visual misinformation, including fake, manipulated or out-of-context images and videos, is increasingly common on the Internet and social media platforms. Because of visuals’ superior impression, retention, virality and persuasiveness, visual misinformation poses a significant threat to national security, social cohesion, and public health. Yet, we know very little about how users process and judge the authenticity of visuals, and the ways in which platforms and fact-checking agencies could effectively detect and fight against visual misinformation. In this talk, I will report findings from several recent experiments that reveal the characteristics of users most susceptible to visual misinformation, and a few effective technical and social interventions to counter visual misinformation.
Students: This is a hybrid event. You are encouraged to attend in person in STEW 050B (G52)
Space systems provide many critical functions to the military, federal agencies, and infrastructure networks. Space Policy Directive-5 Cybersecurity Principles for Space Systems describes both the cyber threat to space systems and the need for these systems to be secure and resilient against cyber-attacks. Most cyber defenses for space systems rely on the ability to detect the adversary. Reliance on detection is a risky proposition, given that anomaly and threat detection remains an open research challenge for both terrestrial and space systems. Furthermore, cyber defenses for space systems must be implemented in size, weight, and power (SWAP)-constrained, real-time operating environments that cannot tolerate increased latency and other common detrimental side-effects of cyber defenses. To overcome these challenges, we have been researching the use to moving target defenses (MTD) to protect space systems against cyber-attacks. MTDs create dynamic, uncertain environments on space systems and can be used to defeat cyber threats against these systems. Furthermore, MTDs do not require detection of an adversary to mitigate the effects of an attack.
Our multi-stage-stage research approach is as follows:Development of a generalized MTD algorithm: though conceptually simple, implementation of MTD can be complex. The first research phase focused on the development of a generalized MTD algorithm that implements randomization schemes with limited impact to nominal operations and failsafe commands to re-sync devices, if needed. Application of the MTD algorithms to an exemplar: we demonstrated the MTD algorithm on real MIL-STD-1553 hardware using 4 MTD commands Functional experiments: we evaluated the reliability of the MTD algorithms and whether the use of MTD added unacceptable operational overhead. Cyber resilience experimentation and validation: we exposed the hardware and MTD to cyber-attacks to determine the effectiveness of the MTD algorithms at thwarting attacks and thereby increasing resilience to the attacks. Machine learning experiments: we used machine learning models to analyze whether the MTD algorithm introduced vulnerabilities and if the machine learning models could “crack” the MTD algorithm and predict randomization sequences.
The MTD performed well in each of the experiments. Most notably, the cyber resilience experiments showed a 97% reduction in adversarial knowledge. Furthermore, small changes in the MTD algorithm substantially decreased the ability of the machine learning model to decipher randomization sequences.
The mission of the Cybersecurity Assurance and Policy (CAP) Center at Morgan State University is to provide the defense and intelligence community with the knowledge, methodology, solutions, and highly skilled cybersecurity professionals to mitigate penetration and manipulation of our nation’s cyber-physical infrastructure. Internet of Things (IoT) devices permeate all areas of life and work, with unprecedented economic effects. Critical infrastructures in transportation, smart grid, manufacturing, health care, and many others depend on embedded systems for distributed control, tracking, and data collection. While protecting these systems from hacking, intrusion, and physical tampering is paramount, current solutions rely on unsustainable patchwork solutions. Transformative solutions are required to protect systems where the ubiquity of connectivity and heterogeneity of IoT devices exacerbate the attack surface. Our research focuses on the convergence of IoT, 5G, and artificial intelligence in the context of the Zero Trust networks. We will present our security-in-depth approach to provide secure and resilient operation.
With the rapidproliferation of pervasive electronic devices in our lives, the internet ofthings (IoT) has become a reality and its influence on our day to dayactivities is set to further increase with a projected 125 Billion connecteddevices by 2030. However, this poses serious security and privacy issues as wewill no longer have direct control over with whom and what our devicescommunicate. Counterfeit, hacked, or cloned devices acting on a network are asignificant threat. In addition, IoT devices are often low-cost in area,low-power and typically are restricted in both memory and computing power.
This talk will outlinethe challenges in addressing security for resource-constrained IoT devices and discussthe opportunities offered by research solutions proposed at the Centre forSecure Information Technologies (CSIT), Queen’s University Belfast, inproviding effective security for IoT devices. The talk will detail our researchin Physical Unclonable Functions (PUFs), Hardware Trojan detection, Side-channelanalysis and post-quantum cryptography.
The mobile network (e.g., 4G LTE and 5G NR), the only large-scale wireless network infrastructure on par with the Internet, plays a critical role in interconnecting various mobile devices (e.g., smartphones, massive/critical IoT devices) and providing them with ubiquitous network services. In recent years, more users are accessing the Internet through mobile networks; since the first quarter of 2021, mobile devices (excluding tablets) have generated more than 54% of global website traffic. However, the security of the nowadays mobile networked systems is still far from being satisfactory. Unprecedented malicious attacks against mobile devices and the mobile network infrastructure cannot be effectively defended by the current complicated and error-prone design and pose real threats to a large number of users. In this talk, I would like to share with you my research experience in identifying various security vulnerabilities in essential mobile network services using formal and/or empirical approaches and securing billions of mobile users and the infrastructure.
For at least two decades, the U.S. intelligence community and special projects agencies have been exploring the potential of prediction markets and crowd-forecasting platforms to better forecast geopolitical and technical trends. Similarly, a number of prominent corporations, including Google, Ford, Yahoo, Hewlett-Packard, and Eli Lilly, have likewise turned to these tools to predict everything from which product lines will be most profitable to whether a deadline is likely to be met. Yet despite this seeming opportunity, there remains a significant gap: almost nobody has deployed the tools for crowd-forecasting to cybersecurity problems.
We propose to change that paradigm. We believe that a cybersecurity-focused forecasting market can create useful value-added information for decision-makers. To test this hypothesis we have begun a small beta test applying the principles of crowd-forecasting directly to a set of cybersecurity questions.
This talk will provide background on the use of crowd-forecasting for policy and discuss some interim results of the ongoing beta test.
Automated cyber defense tools require the ability to analyze binary applications, detect vulnerabilities and automatically patch or mitigate those vulnerabilities. The insertion of security mechanisms that operate at function boundaries (e.g, control flow mitigation, stack guards)require automated detection of those boundaries. This talk discusses the problem, related research and a new technique that is more accurate than other reported approaches. The presentation also discusses some of the limitations and ramifications of typical approaches compare and present these types of experimental results.
The war Russia has waged on Ukraine has seemed largely kinetic, but the most effective weapons weilded thus far have been consumer technologies. Putin has pursued a hybrid warfare strategy, yet the Ukrainians have fought his mendacious claims with the realities of conflict captured by mobile devices and social media. Bogged down by guerilla fighting in Ukrainian cities, Putin will view offensive cyber action and aggressive information warfare as increasingly appealing options. Richard Clarke, former U.S. National Coordinator for Security, Infrastructure Protection and Counterterrorism, and the nation’s first “Cyber Czar,” will give us an inside look at what the world has learned about the spillover of warfare in an era of advanced cyber threats.
In his latest book, The Fifth Domain: Defending Our Country, Our Companies, and Ourselves in the Age of Cyber Threats, Clarke delves deep into the political and economic calculations of cyber conflict. He also provides concrete steps that can be taken to achieve cyber resilience, during peacetime and amidst international conflict, including building more resistant systems and raising the costs for escalations in cyberspace.
What kind of projects does one get to lead at an applied cybersecurity center within the National Institute of Standards and Technology (NIST)?
This talk will offer insight on the cybersecurity challenges being addressed by projects led by the speaker since he began working at the National Cybersecurity Center of Excellence in 2016. The talk will touch upon the establishment of collaborative team made up of industry, academic, and government members for each project, and discuss how each project leverages a cybersecurity standard or best practice in the functional reference designs built for each project. Throughout each phase of each project, we seek to collaborate, share (document in NIST Special Publication 1800 series practice guides), and advocate for the adoption of our work.
This talk will offer some insight into the evolving series of NIST Special Publications known as practice guides (or 1800 series documents) and how these publications connect with the foundational NIST Special Publications in the 800series that are often used to set Federal government standards in computer security, information security, and cybersecurity while often being voluntarily adopted as guidance and standards by industry. This talk aims to leave enough time to address questions and explore whether the audience has new challenges that should become an NCCoE project in the future. At some point during the lecture, the following terms or phrases will be used: cybersecurity framework (functions, categories, subcategories), privacy framework, risk management framework, security and privacy controls, mitigating cybersecurity and privacy risk.
More than half the stored data in the world resides on hard drives. Yes, a 50+ year old technology is storing our photos, music, research, taxes, and more— and nobody blinks an eye. Given that over one zettabyte of hard drive storage shipped in 2020, this storage media is not going away anytime soon.
We at Backblaze manage over 200,000 hard drives to store over 1.3 Exabytes of data. Since 2013 we have tracked every hard drive we’ve used and each day we record their SMART stats, giving us a unique trove of data that we have regularly analyzed over nearly a decade to learn about hard drives from the inside out. We know how often they fail by model, manufacturer, and size. We can answer the question, do hard drives failure rates follow the bathtub curve? We know how temperature affects hard drives. We can show you how machine learning capabilities could be used to predict hard drive failure. We can even provide a life expectancy forecast for all our hard drives. One more thing, we’ve open-sourced the data so you can do all of this yourself, just for fun.
Precis: The United States encountered digital cyberspace with the gradual rise of digital technology, treating cyberspace as an electromagnetic domain. China encountered cyberspace more swiftly, surpassing several years ago the United States in the number of people connected in cyberspace (now approximately one billion people), treating cyberspace as a domain of human behavior. For the United States, cybersecurity pertains to the protection of information and the systems that depend on information technology. For China, cybersecurity reflects a need to impose acceptable human behavior on this new cyberspace domain. How is China attempting to reshape the international system through this new domain and its own understanding of cybersecurity? This talk will describe the rise of cyberspace and discuss the implications for the United States, its allies, and its partners as they attempt to defend their values and interests in an evolving international system.
The electric power grid is a complex cyber-physical system that forms the lifeline of a modern society. Its reliable and secure operation is of paramount importance to national security and economic well-being. The power grid today is a highly automated network, wherein a variety of communication networks and information systems are interconnected to the physical grid for the purpose of monitoring, protection, control, and market functions. The increased reliance on information and communications technology in the smart gird significantly increases the vulnerabilities, which further underscores the importance of cyber security. As a result, cyber-physical system security of the power grid is a critical area encompassing vulnerability assessment, anomaly detection, and mitigation for substations and the Supervisory Control and Data Acquisition systems. The purpose of this presentation is to provide new concepts and testbed-based methodologies for the integrated cyber-power systems. Future research directions will be discussed.
The Metaverse is coming. What is the Metaverse? A massive, infinitely scalable, shared virtual world where land, buildings, bots, avatars and other property can be bought sold and persist. Think of it as the future convergence of all of today's virtual worlds, interconnected with a single settlement layer for totally interoperable transactions. The Metaverse will be accessible by billions via any web browser, mobile device or virtual reality system. All indications are that the metaverse is destined to become a driving force in how humanity interacts with each other. It will influence education, healthcare, government, commerce, and entertainment.
How big will the Metaverse be? One indicator is the recent announcement by Mark Zuckerberg that he is shifting Facebook to be a Metaverse company. With all the other major players in delivering Metaverse capabilities today this will very quickly become a trillion dollar market. It will also be an incredibly enticing target for the criminal element.
The Metaverse needs the involvement of the security community in ways few are conceptualizing today. This presentation will provide security practitioners with foundational knowledge that will help accelerate the contributions of security professionals to this rapidly developing shared virtual space.
The complexities of and losses from a shoddily created cyberspace substrate continue to hollow the economies and national power of consolidated democracies. As China rises as a strategically focused and digitally aggressive authoritarian giant, it is critical that democratic leaders both understand the reality they face and how an institutional alternative may be created to avoid being weak cyber powers in the future. This presentation offers two models: the ‘Cybered Conflict’ model to lay the foundation explanation for the weakness in national cyber power of democracies, and the ‘Cyber Operational Resilience Alliance (CORA) model to explain how this existentially threatening trend may be turned around through allied action to jointly ensure cyber resilience. Finally the talk will outline very briefly how the CORA model may be used analytically to improve the cyber resilience alliance potential of national cyber strategies, and to identify organizations capable of contributing to more robust collective cyber defenses across sectors and allied democratic nations.
Threat modeling is an extremely valuable tool in the secure software development pipeline. Some studies suggest it has greater impact on security posture than other more widely practiced security activities. There are many different frameworks, models, and methodologies that have been developed in an attempt to make threat modeling easier. Yet, despite these efforts, popular approaches to threat modeling are often still considered too cumbersome, structured, or time consuming to fit with modern DevOps and CI/CD development.
In 2020, a group of 15 security professional released the Threat Modeling Manifesto to formalize decades of combined experience into a declared vision of what threat modeling truly is and what makes it important. Learn from one of these authors about how to break with the complex models and return to the values and principles of what threat modeling should be. Discover how this often-over-looked activity can be implemented in development pipelines and make them more efficient while improving overall security of software. See practical examples of how the manifesto serves as a guide to design a methodology that fits your needs and avoid common pitfalls that often derail this critical activity.
Cyber-physical systems are delivering an increasing portion of the infrastructure services at the heart of our economy and national security, and you don’t have to look far for examples of technology-enabled, industrial control, and the internet-of-things in the core operations of healthcare, food and agriculture, energy, transportation, or manufacturing. Further, one has only to look at the contemporary examples of our systems under stress, such as the JBS and Colonial Pipeline cyber attacks, to understand the fragile risk ecosystem confronting infrastructure owners and operators of cyber-physical systems.
In fact, the title of this talk is purposely a catch-22, meaning that just as infrastructure resilience is inherently dependent on safe and secure cyber-physical systems, so too is the collective work to see cyber and physical security achieve resilience.
As we begin 2022, the cost, sophistication, and lethality of cyber-breaches continues to rise. Threat actors, especially state-sponsored, and criminal enterprises are taking advantage of the expanding cyber-attack surface by using their resources to employ more sophisticated means for discovering target vulnerabilities, automating phishing, and finding new deceptive paths for infiltrating malware. This presentation will explore some of the more compelling trends and threats in the cybers ecosystem, the impact of emerging technologies, and potential strategies for mitigation.
This talk explores over 20 years of building the cybersecurity workforce in the United States with a focus on the evolution, progress made, and challenges ahead.
In June 2021, the GFCE and the World Bank came together to identify pathways to bridge the development community to the cybersecurity capacity building community and create mechanisms by which digital development could see the benefits of incorporating cyber security into their projects and initiatives to achieve more resilient outcomes. This report, Integrating Cyber Security into the Digital Development Agenda, highlights some of the key challenges and benefits of incorporating cybersecurity, digital resilience, and cyber capacity building into the broader development agenda. The report also features several best practices and bridging venues and activities that could facilitate tighter alignment and collaboration between the digital development and cybersecurity capacity building communities and among initiative donors and implementors.https://thegfce.org/wp-content/uploads/2021/11/Integrating-Cybersecurity-into-Digital-Development_compressed.pdf
“Do Criminals Dream of Electric Sheep?” Such issue is no longer a domain of futurologists and science-fiction writers, but a serious question asked by the EUROPOL alarmed by how emerging Information Technologies shape the future of crime and law-enforcement. Apart from its obviously positive effects, the technology also impacts and affects the way criminal offenders, terrorists and rogue governments operate at the stages of know-how gathering, planning, preparation and execution of their attacks. The progress in the development of IT and its accessibility is so unprecedentedly high, that– in order not to lag behind – the law-enforcement and intelligence communities need to research and analyze the further and potential advances (and design the potential preventive measures) promptly. The presentation addresses the problem of a lack of forecasting/analytical approach to the study of an impact of emerging and disruptive technologies on the criminal, terrorist and information warfare landscape. The author aims to deliver the most up-to-date analysis of the threats to come, together with a set of plausible solutions on how to deter and mitigate the risk. The presentation will characterize the dangers posed by the potential abuse of Information Technologies by the criminal/terrorist/state actors. The author will deliver an analysis articulating the key factors implicated in events related to the technology abuse, across all stages of the event. The presentation will cover such areas as e.g.: 1) abuse of the open source information for planning, preparation & execution of the attack; 2) hazards associated with the abuse of wearable devices; 3) use of mobile technologies to profile, select and groom potential activists or extremists or to enable human trafficking and sexual exploitation of children; 4) attacks on Internet of Things networks for targeting specific individual/entity or to create mass-level disruption incl. attacks on critical national infrastructure; 5)hijacking of autonomous vehicles; 6) use of drones (aerial, ground operating, hydroid) for surveillance, as weapons, for drugs delivery, as burglary bots, as tools to disrupt civil aviation or military systems; 7) attacks on IP-enabled medical devices; 8) the use of (semi)autonomous robots; 9) the use of the Artificial Intelligence, machine-learning, deep-learning and reinforcement learning techniques for various criminal/terrorist objectives; 10) abuse of blockchain technologies and crypto-currencies (financing of terrorism, money laundering, bribery, financing of illegal activities, extortion/ransomware); 11)abuse of 3D printing technologies; 12) risk associated with Quantum Computing and 5G telecom networks (increased capabilities of criminal/terrorist/cyber-warfare operations). A special focus will be put on Information Warfare (hybrid and asymmetric threats), where disinformation, misinformation and propaganda are used by nation states in a general scheme of malign foreign influence to disrupt the situation abroad.
Securing industrial networks has never been more crucial, but it's not as simple as just patching legacy computers or installing commercial tools. Responding to cybersecurity incidents in critical infrastructure environments poses unique challenges and requires a very unusual set of skills. This lecture will cover key terminology, operational differences, and technology differences between industrial and enterprise environments. Attendees will leave with an essential understanding of the challenges in the space and the skills they will need to develop to make a difference.
Having a satisfying cybersecurity career can feel elusive, even for a seasoned cybersecurity professional. In this session, we’ll talk about things that all security professionals, of all levels and backgrounds, need to know and do, in order to achieve professional success. We will cover:
The importance of networking, and how to leverage them to achieve your career goals Continuous learning - when, how, and when is it too much? Self-awareness, and why this is the basis for everything you do Managing yourself vs. managing others - when to be a single contributor and when to run a team Handling Security Stress - why does it happen, and what can be done about it Leaving a legacy, what to do if you want to be remembered for more than the immediate job
We introduce password strength information signaling as a novel, yet counter-intuitive, defense mechanism against password cracking attacks. Recent breaches have exposed billions of user passwords to the dangerous threat of offline password cracking attacks. An offline attacker can quickly check millions (or sometimes billions/trillions) of password guesses by comparing their hash value with the stolen hash from a breached authentication server. The attacker is limited only by the resources he is willing to invest. Our key idea is to have the authentication server store a (noisy) signal about the strength of each user password for an offline attacker to find. Surprisingly, we show that the noise distribution for the signal can often be tuned so that a rational (profit-maximizing) attacker will crack fewer passwords. The signaling scheme exploits the fact that password cracking is not a zero-sum game i.e., the attacker's profit is given by the value of the cracked passwords minus the total guessing cost. Thus, a well-defined signaling strategy will encourage the attacker to reduce his guessing costs by cracking fewer passwords. We use an evolutionary algorithm to compute the optimal signaling scheme for the defender. As a proof-of-concept, we evaluate our mechanism on several password datasets and show that it can reduce the total number of cracked passwords by up to 12% (resp. 5%) of all users in defending against offline (resp. online) attacks. Joint work with Wenjie Bai and Ben Harsha
Understanding the evolution of attacker motivations, and the impact to managing risk in enterprise environments is a key to successfully building cyber security programs in today’s IT enterprise. Over the last decade both attacks, and attacker motivations have evolved dramatically. From Hacktivism to Nation State Actors, from Identity Theft Rings to Ransomware-as-a-Service, the motivations, timing, determination, and discipline of attackers has changed dramatically. This presentation will discuss this evolution from early cyber espionage and hacktivism to evolving nation state threats and how motivations drive behavior and risk decision making in enterprise cyber security programs.
Beyond End-to-End Encryption (BE2EE) technology can protect your data in-transit and at-rest in a consistent way: NUTS may help define this new category. Last year, we presented the technology of NUTS (https://ceri.as/nuts2020). This year, we demonstrate NUTS in action with our Beta version. See secure objects move around in cyberspace without a central reference monitor in a transport agnostic way. The demo will show practical use cases that NUTS enables. The global pandemic drastically altered our way of life and Work-From-Home presents technical challenges that reveal the structural weaknesses of our largest systems. Adversarial threats are now more common place and large outages are frequent. We believe NUTS shows a new path towards a more resilient operating environment for our data. We strongly recommend viewing last year’s presentation (https://ceri.as/nuts2020)to better understand the background and approach of the tech. Joining us for this session will be COL (Ret) Robert Banks, USA, PhD. who served as Deputy Director, Current Operations of U.S. Cyber Command with his insights and comments on this technology. Dr. Banks retired from the U.S. Army after a distinguished 37-yearcareer. His previous services include Chief of Operations of the Army Global Network Operation & Security Center, Command of the largest Army Helicopter Battalion of 64 Chinooks covering 8 states, and providing significant contributions at the Joint Staff Cyberspace Division, National Counterintelligence Security Center, Army Defense Industrial Base, Asymmetric Warfare Office - Electronic Warfare, National Guard Bureau, and Co-Chaired the Smart Grid Interoperability Panel, while supporting the Tri-County Electric Cooperative. He holds numerous advanced degrees including a PhD in Information Technology from George Mason University specializing in Hybrid Security Risk Assessment Models. Additionally, he holds the following certifications: CISSP, PSDGP, ITILv3, AWS-CCP, AZURE-AI.
This talk covers the state of the Art and Practice in Cybersecurity Metrics. The history ranges from the 1970s through the present. Topics include, but are not limited to: Control Objectives, the Orange Book, the Common Criteria, Systems Security Engineering Capability Maturity Model, Common Vulnerability Enumeration, National Vulnerability Database, NIST Pubs such as the Performance Measurement Guide for Information Security, Threat Intelligence Protocols, Exemplar studies such as the Verizon Data Breach Incident Report, Industry Best Practice and Regulatory Assessments, Security Incident and Event Management, Security Analytics, Security Scorecards.
Anecdotally, most cybersecurity curricula is based on the technical aspects of protecting, defending, and responding to cyber attacks. While these courses establish a solid foundation in the technical aspects of cybersecurity, what is often missing is establishing a foundation in cybersecurity law. Every individual who puts their hands on a keyboard operates within an uncertain ethical and legal framework. What we do not need is the type of education to produce more lawyers, but rather the type of education to produce more legal-savvy technical workers. Today’s tech workers are exposed to more personal information as well as intellectual property – both targets in cyber attacks. They are expected to protect critical infrastructure and design with security “built in.” Yet, we do a poor job teaching the legal requirements as well as limitations imposed by law on building in privacy protections. For the past four years, the speaker has taught Cybersecurity Law & Policy to several hundred computer science and engineering students as well as those from business, architecture, technology management, and government policy. I began this course by conducting a data analytics exercise on the NIST NICE Framework to determine what work roles require legal training. The results were quite surprising as even very technical roles such as Threat Analysis and System Architecture require knowledge of laws, policies,and ethics as they relate to cybersecurity and privacy as well as knowledge of investigations. The feedback from graduating students who take on cybersecurity roles is that they are uniquely qualified to understand the necessity of compliance within their respective roles. This presentation will discuss the basis for legal education as well as a roadmap for how to incorporate such legal education within a cybersecurity curriculum to build the workforce necessary for the current cybersecurity environment.
In this session we will talk about applying appropriate security controls to Software as a Service (SaaS) offerings. While it may seem like the SaaS vendors have most of the responsibility for securing these platforms, there are still a number of threats that customers need to worry about themselves. During the session we will walk through various types of SaaS solutions, including a few new surprising categories, and will then talk about the nuances of the Shared Responsibility Model (SRM). We will dive into how to assess the threats to our data, users, and connected systems related to the deployment of SaaS solutions by taking a Threat Modeling approach to the problem. Once we’ve compiled our list of risks we will then talk through practical counter measures that can be implemented to mitigate or reduce risk. The session will then wrap up with a discussion of some existing security tooling that can be considered to further strengthen the defenses around these SaaS solutions today.
This session provides practical cybersecurity assessment advice. It details the end-to-end process including: scoping, 9 steps to develop work papers, scheduling, on-site assessment, report preparation and presentation.
The first assessment example leverages the NIST Cybersecurity Framework to ensure coverage across security domains. Sample scoping questions will be provided, along with tips and examples to add controls based on business processes, insider threat, privacy and fraud.
This session also addresses follow-on assessments. Attendees are encouraged to evaluate lines of business and to take deep dives into critical functions. Tips and examples are provided to leverage best practices, creating specific testing procedures.
Rather than repeating the same assessment year-over-year, the scoping methodology is risk opportunistic. There is focus on areas that have not been evaluated recently and areas that may require enhanced controls due to presence of valuable data. Albert Einstein’s quote applies here “the definition of insanity is doing something over and over again and expecting different results”.
The session will briefly walk through the assessment report framework, providing tips along the way.
The assessment presentation phase includes a slide deck framework covering: the threat landscape, assessment methodology, high and moderate-high findings, a Strengths, Weaknesses, Opportunities and Threats (SWOT) slide and next steps.
During the height of the pandemic, it’s estimated that digital transformation advanced by as much as seven years, opening the door for hybrid and remote working solutions to thrive. But, the increase in remote work also revealed new threats to devices and applications. In this session, we will discuss: • The post-COVID world and “Zero Trust” • Trusted software becoming less trustworthy • The surprising ways ransomware launches • Identifying Web/SSL VPN vulnerabilities in firewalls • Application of AI and ML in cybersecurity • Countermeasures used to combat these issues
Rapid progress in machine learning, computer vision and graphics leads to successive democratization of media manipulation capabilities. While convincing photo and video manipulation used to require substantial time and skill, modern editors bring (semi-) automated tools that can be used by everyone. Some of the most recent examples include manipulation of human faces, e.g., by their replacement or semantic manipulation (expression, age, etc.). At the same time, dissemination of fake news and misinformation campaigns are picking up speed which challenges trust in the society. Our media distribution platforms lack content integrity features as they were designed and optimized for the quality of (human) experience with strict bandwidth / storage constraints. Such an approach fails to recognize an increasing role of automated analysis by machine learning models, e.g, strong lossy compression applied to media assets removes imperceptible statistical traces indicative of content manipulation and is often referred to as media "laundering" process. In this talk, we explore end-to-end optimization of photo acquisition and distribution pipelines for media authentication. We show that feedback from forensic analysis can be used to optimize upstream components like the camera ISP or lossy compression codecs to support media authentication on the receiving end. Modern machine learning tools allow us to discover new approaches to the problem with surprising connections to other fields like information hiding, computational photography, lossy compression and machine learning security. To enable this line of work, we are currently developing a Tensorflow-based open source toolbox for modeling and optimization of various imaging applications (https://github.com/pkorus/neural-imaging).
The Diem blockchain, which was initiated in 2018 by Facebook, includes a novel programming language called Move for implementingsmart contracts. The correctness of Move programs is especially important because the blockchain will host large amounts of assets, those assets are managed by smart contracts, and because there is a history of large losses on other blockchains because of bugs in smart contracts. The Move language is designed to be as safe as we can make it, and it is accompanied by a formal specification and automatic verification tool, called the Move Prover. A project to specify and formally verify as many important properties of the Move standard library is now well underway. This talk will be about the goals of the project and the most interesting insights we've had as of the time of the presentation. The entire blockchain implementation, including the Move language, virtual machine, the Move Prover, and near-final various Move modules are available on http://github.com/libra
Cyberattacks on critical infrastructure such as power plants, dams, and chemical facilities are increasing in both intensity and sophistication, with attackers actively exploiting the cultural divide between the engineers who design and run these facilities and the cybersecurity people who protect them. At Rose-Hulman, we are building a multidisciplinary Critical Infrastructure Laboratory to bring these groups together with the goal of educating the next generation on the difficulties of designing and securing facilities vital to our national and economic security.
Since the inception of computer/data/cyber/network securitysome fifty years ago, one recurring question has beset our industry: “How do wesecure it?” By its very nature, that question has propagated as a harmful meme,by implying that a binary deterministic answer is available, or even possible. This talk examines security through a non-deterministiclens, applying probabilistic and analogue functions to discover new approachesto defending anthro-cyber-kinetic systems.
This talk covers the key lessons learned and root causes from the biggest mega-breaches and the 9,000+ reported breaches over the past 15 years. By analyzing the histories, stories, and deep dives of breaches such as those at Target, JPMorganChase, OPM, Yahoo, Equifax, Facebook, Marriott, Capital One, and the SolarWinds hack, I will also lay the groundwork for a roadmap to recovery based on the root causes.
Quantum technology will be transformational. When applied, quantum has the power to dramatically improve our society, as well as cause major disruptions on the national security and economic security fronts. This presentation will provide an overview of the fundamentals of quantum technology, to include the three major branches of quantum technology development: quantum computing, quantum sensing, and quantum networking. We will discuss use cases for each and explore where the technology stands today, its commercialization and hardware engineering challenges, and potential pathways for a quantum future.
Social Engineering is employed in 97% of cybersecurity attacks. This makes social engineering penetration testing an important aspect of cybersecurity. Social engineering penetration testing is a specialized area requiring skills and abilities substantially different from other types of penetration testing. Training for social engineering penetration testing as well as understanding what skills, abilities, and personalities make for good social engineers is not well developed. This mixed methods study uses surveys and interviews conducted with social engineering pen testers to examine their pathways into the field, what personality traits contribute to success, what skills and abilities are necessary and what challenges these professionals commonly face. The results are used to make recommendations for training.
Federated learning is an emerging machine learning paradigm to enable many clients (e.g., smartphones, IoT devices, and edge devices) to collaboratively learn a model, with help of a server, without sharing their raw local data. Due to its communication efficiency and potential promise of protecting private or proprietary user data, and in light of emerging privacy regulations such as GDPR, federated learning has become a central playground for innovation. However, due to its distributed nature, federated learning is vulnerable to malicious clients. In this talk, we will discuss local model poisoning attacks to federated learning, in which malicious clients send carefully crafted local models or their updates to the server to corrupt the global model. Moreover, we will discuss our work on building federated learning methods that are secure against a bounded number of malicious clients.
Good research has scientific principles driving it. Analysts begin research with a goal in mind and at the same time, they need their research to have a solid foundation. This talk will cover common goals in cybersecurity research and also discuss common pitfalls that can undermine the results of the research. The talk will include many examples illustrating the principles.
Machine Learning appears to have made impressive progress on many tasks including image classification, machine translation, autonomous vehicle control, playing complex games including chess, Go, and Atari video games, and more. This has led to much breathless popular press coverage of Artificial Intelligence, and has elevated deep learning to an almost magical status in the eyes of the public. ML, especially of the deep learning sort, is not magic, however. ML has become so popular that its application, though often poorly understood and partially motivated by hype, is exploding. In my view, this is not necessarily a good thing. I am concerned with the systematic risk invoked by adopting ML in a haphazard fashion. Our research at the Berryville Institute of Machine Learning (BIIML) is focused on understanding and categorizing security engineering risks introduced by ML at the design level. Though the idea of addressing security risk in ML is not a new one, most previous work has focused on either particular attacks against running ML systems (a kind of dynamic analysis) or on operational security issues surrounding ML. This talk focuses on the results of an architectural risk analysis (sometimes called a threat model) of ML systems in general. A list of the top five (of 78 known) ML security risks will be presented.
There is no doubt that cybersecurity has risen up the agenda in terms of visibility and importance. Everybody wants it. But do they really know what they want? What does cybersecurity include, and to what extent do qualifications and certifications that claim to cover it actually do so? This talk examines what cybersecurity means in terms of the contributing topics, and in particular how these topics can end up looking substantially different depending upon what source we use as our reference point. The discussion then proceeds to examine how this has knock-on impacts in terms of the qualifications and certifications that may be held by our current and future workforce. All are labelled as ‘cybersecurity’, but to what extent are they covering it, and how can those that need support tell the difference?
While users are responsible for initiating 90%+ of losses, it is not their fault. The entire system is what enables the losses, and the entire system must be designed to prevent them. Drawing lessons from safety science, counterterrorism, and accounting, this presentation details how to expect and stop user initiated loss.
In this talk, we explore security and privacy related to meta-learning, a learning paradigm aiming to learn 'cross-task' knowledge instead of 'single-task' knowledge. For privacy perspective, we conjecture that meta-learning plays an important role in future federated learning and look into federated meta-learning systems with differential privacy design for task privacy protection. For security perspective, we explore anomaly detection for machine learning models. Particularly, we explore poisoning attacks on machine learning models in which poisoning training samples are the anomaly. Inspired from that poisoning samples degrade trained models through overfitting, we exploit meta-training to counteract overfitting, thus enhancing model robustness.
Data brokers are the major players in the market of collecting, selling, and sharing online user information. Although their practices have raised tremendous privacy concerns, their data collection and sharing activities are still under the veil. The growth of adverse cybersecurity incidents toward the data brokers has led the regulators, including California and Vermont, to require the data brokers to register and disclose their activities. This paper analyzes the leaked information on the dark web to analyze the data sharing and collection activities among the data brokers. In specific, we cluster the data brokers based on their data collection activities given by their product description to quantify the activity proximity. Next, we empirically examine how activity proximity leads to co-occurrence on the leaked information in the dark web. We further discuss the deterrence effect of the data broker registration on information leakage. Our study contributes to cybersecurity assurance and risk assessment literature by unveiling the shadowy data-collecting and data-sharing market.
Modern cybercrimes are responsible for $400B dollars of losses on an annual basis. Headlines appear regularly announcing major breaches. Yet few people and businesses understand what happened in such incidents and how to avoid being a victim themselves. The security industry does provide analyses of breach statistics, but effective preventative measures can be lost in the numbers. Virtually all breaches result from technology failure combined with people failure.
This presentation will look at actual recent cybercrimes in order to document what happened and what could have prevented that incident. Who carried out the breach? What did they do? What was taken? How could it have been stopped? What was the story behind the breach? Attack types include ransomware, business email compromise, intellectual property theft and breach of Personally Identifiable Information. By being more familiar with current successful threats and breaches you will:
· Be able to avoid high risk activities, if possible
· Be able to be better prepared to stop such an attack against you or your organization
· Be able to optimize security spending and resources for actual attack patterns
This presentation is designed for both security professionals and business professionals who want to better secure their assets and processes against the increasing number of cyber criminals.
The nature of cybersecurity and modern life is such that we feel pressured to run just to keep up, this leaves us no time to look back and reflect on how we got where we are as an industry and field of study, nor to learn about the people who led the way.
In this presentation we will dig into the stories of some of the people who were foundational in the field we know call cybersecurity, some well-known, others obscure.
The software development process, or software supply chain, is quite complex and involves a number of independent actors. Due to this ever-growing complexity has led to various software supply chain compromises: from XCodeGhost injecting malware on millions of apps, to the highly-publicized SolarWinds Compromise. In this talk, Santiago will introduce various research challenges, as well as attempts from both Open Source and Industry --- such as SigStore, CoSign and in-toto --- to protect millions of users across the globe.
A discussion about where we are in the commercial SDN/NFV world today and where we are headed. What are the next generation threats beyond where we are today and how software definability may be a asset in the defender’s toolkit. Also looking at the intersection point between SDN/NFV and AI/ML. How this changes the defense calculus and alters the attack surface. What capabilities we need to develop in the practitioner, consumer and defender worlds.
In a growing interdependent market place,it is nearly impossible to develop every part or component in house. Electronics are nearly entirely manufactured offshore. Concerns have risen about the trust worthiness of electronics that may contain extra or potentially malicious functionality. Traditional supply chain risk management only deals with the suppliers ability to deliver a product on time and within budget. Cyber aspects focus on the trustworthiness of the product that was delivered. Those vendor that they themselves are procuring products, such as test systems,subtractive or additive manufacturing, are now concerned that the products they are producing are affected by Cyber Supply Chain Risk Management (C-SCRM).
Join Caroline Wong, Cobalt.io's head of Security and People, for a unique perspective on the role of humans in cybersecurity.
Self-determination is the key to human thriving; it's also the enemy of both dictatorships and monopolies. It's no coincidence that commercial imperatives of tech monopolies create the infrastructure for political oppression. The public-private-partnership from hell looks like this: companies install surveillance and other system of control to extract higher rents from their customers and ward off competitors. Then states seize that surveillance and control apparatus to gain and consolidate power. That's the bad news. The good news is that it means that those of us fighting dictatorships have natural allegiances with those fighting monopolies -- and vice versa.
In December 2020, FireEye discovered a supply chain attack against the SolarWinds Orion network management system. The impact of this event has caused the cybersecurity community to reevaluate how we think about threats coming from the software supply chain. At Lawrence Livermore National Laboratory we have been developing software assurance tools for many years to automate the analysis of software to enable asset owners and operators to make sound decisions about the software in their environments. In this presentation, I will describe this effort, talk about some of our tools, and discuss ways to mitigate future supply chain attacks.
Over fifty years, I’ve led a lot of security projects that I thought would change the world. Many of them crashed and burned at great cost in money and reputation. There were some common threads including reliance on government claims about the market and on minimal secure systems built from scratch. This talk will describe some failures, some lessons learned the hard way, and how they paid off.
The Internet of Things (IoT) is the notion that nearly everything we use, from gym shorts to streetlights, will soon be connected to the Internet. Industry and financial analysts have predicted that the number of Internet-enabled devices will increase from 11 billion to upwards of 25 billion in coming years. Regardless of the number, the end result looks to be a mind-boggling explosion in Internet connected stuff. Yet, there has been relatively little attention paid to how we should go about regulating smart devices, and still less about how cybersecurity should be enhanced. Similarly, now that everything from refrigerators to stock exchanges can be connected to a ubiquitous Internet, how can we better safeguard privacy across networks and borders? This talk will explore these issues by pulling from the recently published book, ‘The Internet of Things: What Everyone Needs to Know.’ Our discussion will also be couched by the findings of a recent report for the Indiana Executive Council on Cybersecurity entitled, ‘State of Hoosier Cybersecurity 2020.’
Modern end-user computing platforms such as smartphones (e.g., Android and iOS)and smart home systems (e.g., SmartThings and NEST) provide programmable interfaces for third-party integration, enabling expressive and popular functionality that is often manifested in applications, or apps. Thus, for the last decade, designing security systems to analyze apps for vulnerabilities or unwanted behavior has been a major focus within the security community. This approach has continued well into the smart home, with researchers developing systems inspired by lessons from Android security to inspect IoT apps developed for popular platforms such as SmartThings. However, emerging characteristics of smart home ecosystems indicate that IoTapps may not represent automation in real homes, and may even be unavailable in the near future. That is, while API misuse by third-party developers is an important problem, the approach of analyzing/instrumenting IoT apps may not offer an effective or sustainable solution. In this talk, I will describe the challenges for research in the backdrop of the unsuitability of IoTapps for practical security analysis, and motivate three alternate research directions. First, I will describe the need to develop an alternative artifact for security analysis that is representative of automation usage in the wild. To this end, I will introduce Helion, a system that uses statistical language modeling to generate natural home automation scenarios, i.e., realistic event sequences that are closely aligned with the real home automation usage in end-user homes,which can be used for security or safety analysis. Second, I will illustrate the need to improve the security of mobile companion apps, which often form the weakest link in smart home deployments, and the important position of security analysis/compliance tools in ensuring the development of secure companion apps. To this end, I will present the mSE framework, which automatically and rigorously evaluates static program analysis-based security systems using mutation testing. Our work on mSE (and its successor, MASC) culminated in the discovery of critical security flaws in popular tools such as FlowDroid, CryptoGuard, Argus, and Coverity that affect the reliability and soundness of their analysis. Finally, I will conclude the talk by describing our current efforts to build system-level defenses into IoT platforms that are agnostic to IoTapps, i.e., independent of their visibility or mutability, thereby potentially providing a lasting solution to API misuse by third-party developers.
Traditionally, security and privacy research focused mostly on technical mechanisms and was based on the naive assumptions that Alice and Bob were capable, attentive, and willing to jump through any number of hoops to communicate securely. However, about 20 years ago that started to change when a seminal paper asked "Why Johnny Can't Encrypt" and called for usability evaluations and usable design strategies for security. Today a substantial body of interdisciplinary literature exists on usability evaluations and design strategies for both security and privacy. Nonetheless, it is still difficult for most people to encrypt their email, manage their passwords, and configure their social network privacy settings. In this talk I will highlight some of the lessons learned from the past 20 years of usable privacy and security research, and explore where the field might be headed.
The threat of cyber attacks is a growing concern across the world, leading to an increasing need for sophisticated cyber defense techniques that leverage the defender’s “home field advantage". We designed the Tularosa Study to understand how defensive deception, both cyber and psychological, affects cyber attackers. Over 130 professional red teamers participated in a network penetration test over two days in which both the presence of and explicit mention of deceptive defensive techniques were controlled. To our knowledge, this represents the largest study of its kind ever conducted on a skilled red team population. The design was conducted with a battery of questionnaires (e.g., experience, personality, etc.) and cognitive tasks (e.g., fluid intelligence, working memory, etc.), allowing for the characterization of a “typical” red teamer, as well as physiological measures (e.g., galvanic skin response, heart rate, etc.) to be correlated with the cyber events. Preliminary results support a new finding that the combination of the presence of deception and the true information that deception is present has the greatest effect on cyber attackers, when compared to a control condition in which no deception was used.
Special Panel Immediately following Dr. Ferguson-Walter's seminar, join CERIAS for a unique opportunity to hear six professionals from NSA -- including two Purdue alumni -- who will share their careers and experiences as cybersecurity researchers and practitioners. The panelists will describe opportunities for students and graduates, and answer questions from the audience about their work and life at NSA. [Note: Only US citizens are able to work at the NSA.]
Topic: What is it like to work at the National Security Agency (NSA)
Register in advance for this webinar:
https://purdue-edu.zoom.us/webinar/register/WN_mRCKeiU9TbqNJNxcogddsA
After registering, you will receive a confirmation email containing information about joining the webinar.
Eric Bryant is currently serving as a Director of Cybersecurity Operations in the NSA/CSS Cybersecurity Operations Center (NCSOC). In this capacity, he is responsible for leading a diverse team working around the clock to prevent and eradicate cybersecurity threats to the nation. He also serves as NSA’s Academic Liaison to Purdue University, where he graduated with a degree in computer science and is an alumni of CERIAS.
Dr. Josiah Dykstra is a Technical Fellow and Senior Executive in the Cybersecurity Collaboration Center of the National Security Agency. He holds a Ph.D. in computer science and previously served at NSA as a cyber operator and researcher. Dr. Dykstra is interested in cybersecurity science and how humans intersect with technology. He is the author of numerous peer-reviewed research papers and one book. Dr. Kimberly Ferguson-Walter is a Senior Research Scientist with NSA’s Laboratory for Advanced Cybersecurity Research where her research focuses on the intersection of computer security, artificial intelligence, and human behavior. She has been focused on adaptive cybersecurity at the NSA for the past ten years and is the lead for the Research Directorate’s deception for cyber-defense effort. She has a Ph.D. in computer science and is currently on joint-duty assignment to the Naval Information Warfare Center Pacific to perform collaborative research and facilitate strategic alignment and technology transfers.
Natalie Janiszewski is a Higher Education Outreach Advocate with NSA's office of Academic Engagement. Natalie brings over 25 years of educational experience to her role at NSA. She is responsible for maintaining strong relationships with academic institutions to influence curriculum and encourage activities in NSA's mission-critical areas: science, technology. engineering, math, intelligence analysis, language and cybersecurity. Natalie taught classes in a graduate program for educational technology. Her passion lies in designing environments that facilitate durable, actionable learning for students.
Joel Klasa graduated from Purdue in May 2020 with a degree in computer science and participated in the NSA co-op program throughout his time at Purdue. Upon graduation, he was hired into a development program at the agency and has a current focus of machine learning and artificial intelligence in cybersecurity.
Dr. Celeste Lyn Paul is a senior researcher and technical leader at the National Security Agency. Her work has focused on a broad range of topics including emerging technologies, human factors in security, and more recently, securing cyberspace in outer space. 5:30pm EDT:
IP address blocklists are a useful source of information about repeat attackers. Such information can be used to prioritize which traffic to divert for deeper inspection (e.g., repeat offender traffic), or which traffic to serve first (e.g., traffic from sources that are not blocklisted). But blocklists also suffer from overspecialization -- each list is geared towards a specific purpose -- and they may be inaccurate due to misclassification or stale information. We propose BLAG, a system that evaluates and aggregates multiple blocklists feeds, producing a more useful, accurate and timely master blocklist, tailored to the specific customer network. BLAG uses a sample of the legitimate sources of the customer network's inbound traffic to evaluate the accuracy of each blocklist over regions of address space. It then leverages recommendation systems to select the most accurate information to aggregate into its master blocklist. Finally, BLAG identifies portions of the master blocklist that can be expanded into larger address regions (e.g. /24 prefixes) to uncover more malicious addresses with minimum collateral damage. Our evaluation of blocklists of various attack types and three ground-truth datasets shows that BLAG achieves high specificity up to 99%, improves recall by up to 114 times compared to competing approaches, and detects attacks up to 13.7 days faster, which makes it a promising approach for blocklist generation.
Although performance of blocklists can be improved, they need to be used carefully. Blocklists can potentially lead to unjust blocking to legitimate users due to IP address reuse, where more users could be blocked than intended. IP addresses can be reused either at the same time (Network Address Translation) or over time (dynamic addressing). We present two new techniques to identify reused addresses. We built a crawler using the BitTorrent Distributed Hash Table to detect NATed addresses and use the RIPE Atlas measurement logs to detect dynamically allocated address spaces. We then analyze 151 publicly available IPv4 blocklists to show the implications of reused addresses and find that 53--60% of blocklists contain reused addresses having about 30.6K--45.1K listings of reused addresses. We also find that reused addresses can potentially affect as many as 78 legitimate users for as many as 44 days.
“Wouldn’t it be great if we could download anything, explore anything and build anything without the annoying feeling that you are going to get hacked?”
This was a question from my kids, who are currently in elementary school. Have you experienced similar questions from kids and adults alike? Computing is becoming such an integral part of our lives, wouldn’t it be great to use compute resources fully for all aspects of our lives. This includes work, education, healthcare and finance; be creative and innovate without the constant fear of backlash? This is what we mean by fearless computing: where we investigate how the very design of compute has security and privacy features built into the design of the platform. We will also explore how through education and awareness we can help nurture the freedom of thought and innovation to not only protect ourselves but create a cyber talent that builds the next generation systems and solutions. Join us for a discussion on the technology and solutions that helps us work towards our vision for fearless computing.
The last time you gave to a favorite charity, did you think about their cybersecurity? Do you sit on the board of a nonprofit? Are nonprofits using your cybersecurity solutions? The “wild” of the Internet and continually evolving threat landscape force nonprofits to defend themselves against intrusion and cyber-attacks. Breaking down the myths and assumptions about nonprofits' cybersecurity, this session spotlights approaches and exciting results from local nonprofit organizations of all sizes. Join us with your favorite nonprofit in mind and walk away with new information about this overlook business sector and why it matters.
Can objects be truly secured independently without resorting to a massive central reference monitor? It's a great question and we will discuss a solution to it called NUTS. During this talk, we’ll take data structures, message protocols and applied cryptography and toss them into the cauldron of reality, sprinkle in some DNA and data management to brew up some Security at the Data Perimeter towards crafting Data as the Endpoint. It sounds like a bad witch’s brew of epic proportions but once we cast the spell, you will see the integration of many CS/CISSP concepts you’ve learned over the years and new ways to use it. Our goal is to make sure that the private individual has the best applied cryptographic technologies at their disposal for free in an unobtrusive way. By the way, a nut is the only secure data structure we know of that can help mitigate insider threats in a purely cryptographic way independent of reference monitors. We’ll also show you how the NUTS Ecosystem can provide Alice with a ransom-ware resistant ‘hot’ system at home using just 2 computers.
MITRE ATT&CK® seems to be the“next big thing”. Every time I hear about it I can’t help but wonder, “how doyou prevent all these attacks in the first place? Shouldn’t that be the endgame?” To that end, I set out to map all the recommended “Mitigations” for allthe “Techniques” detailed in ATT&CK to see how many are already addressedby what is required in the Payment Card Industry Data Security Standard (PCIDSS). My hypothesis was all of them. The results were interesting and a little surprising, and I’m still trying to figure out how to best use the results and subsequently ATT&CK itself. I will present my findings in the briefing andhopefully generate a discussion about what to do with the results.
Users of social networks are having their accounts subverted. Threat actors are gaining unauthorized access to large numbers of accounts and inserting links to suspicious websites. Shared command-and-control infrastructure is used across 70+ different social networks, suggesting a coordinated campaign to drive user traffic. The actors behind this campaign, and the end goal for driving user traffic, remains uncertain. The campaign remains active with changing indicators. The fact that this campaign spans so many different social networks makes determining the scope of the overall problem difficult. Using Goodreads as an example, we detail how the attack is constructed.
Researchers from academia and industry have identifiedinteresting threat vectors against machine learning systems. These threatsexploit intrinsic vulnerabilities in the system, or vulnerabilities that arisenaturally from how the system works rather than being the result of a specificimplementation flaw. In this talk, I present recent results in threats tomachine learning systems from academia and industry, including some of our ownresearch at Riverside Research. Knowing about these threats is only half thebattle, however. We must determine how to transition both the understandinggained by developing attacks and specific defenses into practice to ensure thesecurity of fielded systems. In this talk I leverage my experience working onstandards committees to present an approach for leveraging machine learningprotection requirements on systems that use machine learning.
CERIAS 2020 Annual Security Symposium Virtual Event https://ceri.as/symp Closing Keynote Panel Discussion - “Global Challenges in Security and Privacy Policy:elections, pandemics, and biometric technologies”
Panelists: - Michel Beaudouin-Lafon, Vice Chair, ACM Technology Policy Council; Member, ACM Europe Council, Professor of Computer Science, Université Paris-Sud
-
James Hendler, Chair, US Technology Policy Committee, Professor of Computer, Web and Cognitive Sciences, Rensselaer Polytechnic Institute
-
Barbara Simons, Past President, ACM and ACM 2019 Policy Award Winner, Board of Advisors, US Election Assistance Commission, Chair, Board of Directors, Verified Voting
Moderated by: Lorraine Kisselburgh, Chair, ACM Technology Policy Council, AdvisoryBoard and 2018 Resident Scholar, Electronic Privacy Information Center, Purdue University
The TCB has been very precisely defined since 1979, but in practice its implementation and application in today modern software stack is very blurry. This talk describes a very common application and how to consider its associated TCB, after explosive the problems it will propose an alternative to better release and execute software with unbreakable guarantee.
The payments ecosystem is evolving fast and making sure the cardholder’s digital payment experience is frictionless, smooth and secure has never been more important. With approval rates for digital payments at 82% compared to 97% for in-person payments, and globally digital transaction fraud currently four times higher than in-store expected to increase 68% by 2022, intelligence matters more than ever. As more transactions move to the digital world, particularly after COVID-19, on an ever-increasing array of devices, the need to keep up is vital.
To help issuers’ real-time decisioning, increasing approval quality, improving the cardholder experience and reducing fraud, Mastercard leverages the power of proprietary data, sophisticated modelling and machine learning, combined with Mastercard’s global insights and analytics to process thousands of data points and delivers authentication assessment to the cardholder’s bank real-time during the payment to help the bank make an informed and robust decision.
Protection against HEMP (High-Altitude Electromagnetic Pulse) and GMD (Geomagnetic Disturbance in a CME/Coronal Mass Ejection context) is a nascent science. Until recently, these have only been the concern of Department of Defense insiders, over-the-top “preppers”, and physics aficionados. Due to current events and an increasing reliance of all facets of 1st world civilization upon ICT (Information & Communications Technology), the discussion of EMP and GMD protections is moving into the mainstream. Lifeline Data Centers, LLC is nearing completion of an 84,000 square foot fully EMP & GMD-protected data center & SCIF facility in Ft. Wayne, Indiana. Mr. Banta will discuss the basic physics of HEMP and GMD, the threats posed by both, and the extreme and expensive challenges of mitigating the effects of both in a data center setting. Mr. Banta presents from the perspective of designer/architect, primary financier, constructor, and owner/operator of such a facility.
We face an existential threat of permanent damage to critical physical components in our national infrastructure as a result of their poor resilience against cybersecurity attack. A Programmable Logic Controller (PLC) commonly provides the control system for such components, e.g., bulk power generators. Our proof-of-concept implementation dramatically mitigates threats to such cyber-physical systems (CPS) by specifically leveraging what NIST 800-160 calls “highly assured, kernel-based operating systems in Programmable Logic Controllers”.
We dramatically reduce the attack surface visible to potential attackers to be ~1% of the total compared to competing approaches. Our demonstration refactors the common CPS architectural approach to data and cooperating processes into hierarchically ordered security domains using the widely available OpenPLC project code base. The GEMSOS security kernel verifiably enforces traditional integrity mandatory access control (MAC) policy on all cross-domain flows. GEMSOS is designed for wide-spread delivery as a Reusable Trusted Device, providing the reference monitor for secure single-board, multi-board, and System-on-a-Chip systems.
Only a processing component in the highest integrity domain can directly send/receive control signals, enforcing “safe region” operating constraints to prevent physical damage. This very small attack surface protects the critical physical components, making the overall CPS resilient to skilled adversaries’ attacks, even though much larger lower integrity software running in other domains on the same Trusted Device hardware and network infrastructure may be thoroughly compromised. We make available our restructured OpenPLC source to encourage control system manufacturers to deliver verifiable PLC products to, as NIST puts it, “achieve a high degree of system integrity and availability” for control systems. UC Davis is using our demonstration on GEMSOS in their Computer Security Lab, today.
From compliance in the classroom to compliance on the street, important lessons that every cybersecurity professional should know. We’ll cover proven approaches for compliance and risk assessment for a variety of industries, and present specific scenarios and strategies for addressing real challenges facing organizations with PCI, HITRUST, FedRAMP, CMMC and Privacy. Below are some of the examples that we will cover.
Scope creep (All) Setting deadlines and addressing missing evidence (All) Building out compensating controls (PCI) Conflict of Interest (FedRAMP) Internal Organizational Politics (Risk Assessment) Defensive Interviewees(All) Ethics and Responsible Reporting (All)
Cyber security data in many ways mimics the behavior of organic systems. Individuals or groups compete for limited resources using a variety of strategies, the most effective of which are re-used and refined in later ‘generations’. Traditionally this behavior has made detection of malware very difficult because 1) recognition systems are often built on exact matching to a pattern that can only be ‘learned’ after a malicious entity reveals itself and 2) the enormous volume and variation in benign code is an overwhelming source of previously unseen entities that often confound detectors. In addition, the enormous volume of malware artifacts is overwhelming anyone trying to categorize and characterize new additions to the many malware repositories as so much of the processing is done by hand. To turn the tables of complexity on the attackers, we have developed a method for mapping the sequence of behaviors that make up a malicious artifact to strings of text and analyze these strings using modified bioinformatics algorithms. Bioinformatics algorithms optimize the alignment between text strings even in the presence of mismatches, insertions or deletions and do not require an a priori definition of the patterns one is seeking. Nor do they require any type of exact matching. This allows the data itself to suggest meaningful patterns that are conserved between binaries. These patterns can be used to identify zero-day malware and can help to automate the curation and characterization of large quantities of suspected malware. I will talk about our MLSTONES capabilities as an innovative and effective way of detecting and characterizing most types of malware artifacts. I’ll also discuss how these capabilities can be used on other types of cyber security data.
The last 5 years have seen a marked shift inhow companies view cyber threat intelligence (CTI) as a building block of theirsecurity strategy, but there still is a lot of confusion about how to build aprogram that provides utility. At its core CTI aims to provide informationabout motivations, methods and characteristics of attackers. In today’s rapidlyevolving threat landscape having timely access to CTI can be of significantvalue to security analysts. By looking beyond your own four walls organizationscan take faster mitigation action and also reduce their attack surface. AddingCTI to enterprise security programs can be an effective strategy to go from areactive to a proactive response. But the value of CTI is constrained by theability of enterprise security operations to contextualize, manage and actionupon it. This presentation will cover some fundamental CTI concepts, real worldchallenges in operationalizing it, and some easy ways to try it out foryourself.
Takeaways for the audience: 1. Overview of CTI concepts, frameworks,standards, and how they fit in the enterprise security model. 2. Clearer understanding of CTI data modelsand how they integrate with detection, protection and incident responseprocesses. 3. Practical ways to accelerate securityoperations and heighten defenses using CTI.
QoSient and a DHS independent SOC have been working together on an innovative pilot program called “Elimination of Unmonitored Space” (EUS) that strives to detect and respond to internal cyber threats through pervasive network sensing and sense-making in an enterprise network. Modeled after the NSA’s Integrated Active Cyber Defense (IACD) architecture and the US DoD CENTAUR / Acropolis programs, the effort has developed a strategy for scalable development and deployment of new predictive cyber security analytics. In this presentation, we will present our approach to developing comprehensive network sensing at the endpoint and how centralized / regionalized analytic systems can manage the data and analytics needed to develop operational site-specific predictive analytics. We believe that the shift to remote computing will push the need for awareness and predictive analytics at the endpoint and a new approach for cyber defense.
The adoption of advanced data technologies is one of the defining characteristics of the connected world. From ML to AI, we are getting a smarter, more personal world. The dystopic view is that not only Big Brother but many parties can monitor, control and manipulate us. What are the implications for trust? The need for privacy-enforcing technologies is now, not after the ghost is in the machine. What will you learn from attending? · How machine learning & AI play into conversations around trust and privacy · A framework to bring us into the future when it comes to privacy · What each of us can do now to further protect our privacy
Q & A: https://www.cerias.purdue.edu/site/blog/post/summary_of_july_15th_2020_purdue_seminar_on_control_system_cyber_security/ Critical infrastructures such as electric power, oil/gas, water/wastewater,pipelines, transportation, and manufacturing utilize process control and safetysystems to monitor, control, and assure safe operating conditions. Controlsystems consist of Internet protocol (IP) networks and HMIs to provide operatorinput and big data analytics. These systems have been designed with cybersecurity and authentication. However, what makes control systems unique are thecontrol system devices such process sensors, actuators, drives, power supplies,etc. that have no cyber security or authentication and are a direct threat topersonnel and equipment safety. Control system cyber security impacts are real.There have been more than 1,250 actual control system cyber incidents with morethan 1,500 deaths and more than $70Billion in direct damage. There is a need toget the computer scientists/network engineers that understand networks and thedomain engineers that understand the physical processes to work together orthere is no hope in securing the critical infrastructures.
Digital Transformation has fundamentally affected the conduct of elections since 2000. This webinar shares the perspective of a former senior Federal official who worked to help secure US elections against foreign interference during a 30+ year career in the US Government and who now works as a Chief Information Security Officer for a leading global cyber and network security company. This presentation will provide both background knowledge applicable to a general audience as well as advice and recommendations for government officials and their partners who are charged with carrying out elections. Topics covered in this webinar include: · Identifying key challenges in electoral integrity, especially the importance of public perception and voter confidence.Explore why and how securing elections differs from classic’ information security in its complexity and solutions. · Describing the “perfect storm” of colliding factors in the 2020 elections. We faceCOVID-19 related challenges ranging from public health concerns to added complexity and cost—and a pivot to mass mail-in voting is likely to both require process and technology changes and put stress on some of the most fragile parts of the existing election infrastructure. The expected surge of mail-in paper ballots in 2020 doesn’t make cybersecurity irrelevant;if anything, it heightens its importance. Dealing with these challenges is a risk management problem; so the webinar will provide recommendations on ‘doing with less’ – ranging from which parts of the problem to address first to how to harness the power of IT and leverage partnerships.
Using semi-supervised learning, I propose an anomaly-based network intrusion detection system (NIDS) to detect and classify anomalous and/or malicious traffic. With this proposed machine learning approach, we detect botnet traffic and distinguish it from the normal and background traffic in the IPv4 flow datasets. I evaluate the prediction performance results for the flow-based NIDS algorithms. I show an improvement in detection accuracy and reduction in error rates, when compared with signature-based NIDS and previous studies.
Cyberattacks are increasing in frequency, severity, and sophistication. Target systems are becoming increasingly complex with a multitude of subtle dependencies. Designs and implementations continue to exhibit flaws that could be avoided with well-known computer-science and engineering techniques. Cybersecurity technology is advancing, but too slowly to keep pace with the threat. In short, cybersecurity is losing the escalation battle with cyberattack. The results include mounting damages in the hundreds of billions of dollars, erosion of trust in conducting business and collaboration in cyberspace, and risk of a series of catastrophic events that could cause crippling damage to companies and even entire countries. Cyberspace is unsafe and is becoming less safe every day. The cybersecurity discipline has created useful technology against aspects of the expansive space of possible cyberattacks. Through many real-life engagements between cyber-attackers and defenders, both sides have learned a great deal about how to design attacks and defenses. It is now time to begin abstracting and codifying this knowledge into principles of cybersecurity engineering. Such principles offer an opportunity to multiply the effectiveness of existing technology and mature the discipline so that new knowledge has a solid foundation on which to build. * * Based on "Engineering Trustworthy Systems: A Principled Approach to Cybersecurity, CACM, June 2019.
Cyber security resources remain limited. Organizations that attempt to broadly protect their data from all cyber threats tend to inefficiently invest these resources, making them slower to adapt to the changing trends and techniques of cyber threats. – Carnegie Mellon. This talk will discuss some of the basic principles of Cyber threat intelligence, and how proactive collection of information can enable an enterprise to protect its most critical assets. We will then dive into the main focus of this talk, operationalizing data in order to understand cyber criminals motivation and capabilities in order to tailor preventive controls meant to address threats your organization faces. “If you know the enemy and yourself, you need not fear the result of a hundred battles. If you know yourself but not the enemy, for every victory gained you will also suffer a defeat. If you know neither the enemy nor yourself, you will succumb in every battle.” - Sun Tzu
Know yourself: Learn your environment (people, processes, technology). Know your adversary: Learn your adversaries motivations (motive and targeted data) and capabilities (attack methods, TTP’S and resources). Prioritize protection of your most critical assets and operations.
Work in the public sector differs from that in the private sector in ways that on the one hand present challenges unique to public sector work but also sometimes produce unexpected rewards also unique to public sector work. Mr. Coffing will share some of his experiences gained over the last eighteen months leading cybersecurity for the nation’s third largest municipality as well as over the course of a 25+ year career in information technology and cyber security.
As more Personally Identifiable Information is collected, stored or created, the specter of customer privacy issues are looming large. Privacy and Security methodologies are starting to be dictated by those in State houses, Congress and Supra-regional governments. Enterprises need to take a long hard look at the information they are capturing and how they secure it to determine whether the potential value outweighs the potential risk.
- How do your current Security and Privacy practices match up against upcoming laws in Europe, US other parts of the world?
- Are you prepared to deal with new laws with huge fines? What about Private Right of Action?
- Are you anticipating what is coming down the road? Takeaways:
- Understand the implications of new laws are as well as your risks
- Understand how to comply with upcoming laws
- Understand how contracts and data flow will be impacted
- Ways to drive your organization to implement
- How can this be beneficial for you personally
In late 2016, the Mirai Botnet launched the largest DDoSattacks ever recorded. Learn about the teams of researchers racing the stop theattacks, and the criminal groups who were competing to launch ever largerattacks. The presenter will discuss roles played by educational institutions aswell as the impact to the IoT landscape.
Empirical digital forensics examines real-world digital storage media to develop theories about it. We have built a library of real-world data from 4000 copies of secondary-storage devices including purchased ones. One project looked at patterns of malware to determine where they were most likely to appear. A recent project examined software versions, including malicious ones, and tried to distinguish normal software evolution from abnormal. Other projects rated the value of files and artifacts using novel criteria to enable focusing of investigations. They then used file and artifact similarities to build models of social networks from the data.
How does an organization know which security controls, applications, or programs to implement, when everything is a threat and every system is vulnerable? Looking at cybersecurity through a risk management lens is one way of reducing the noise of the threat environment. This presentation will discuss why having a Cyber Risk Management (CRM) program is a critical piece to an effective cybersecurity program. This presentation discuss the various Cyber Risk Management frameworks, the building blocks of an effective CRM program, regulatory & standards bodies driving cyber-risk management, metrics, CRM life cycle, and finally, how CRM fits into the overall Enterprise Risk Management program. At the end of the presentation the attendees will have the building blocks to start building a Cyber Risk Management program in their organizations. Additionally, this presentation will look at a few case studies through the cyber risk lens and how a CRM program would have aided in identifying those issues and risks.
The upcoming smart transportation systems which consist of connected autonomous vehicles, are poised to transform our everyday life. The sustainability and growth of these systemsto their full potential will significantly depend on the robustness of these systems against securityand privacy threats. Unfortunately, the communication protocols employed in these systems lackmainstream network security capabilities due to energy constraints of the deployed platforms andbandwidth constraints of the communication medium. In this talk, I will present the results of myefforts in anatomizing the two vital communication protocols employed in the smart transportation:(1) vehicle-to-everything (V2X) communication protocol which is utilized to facilitate wirelesscommunication among connected vehicles, and (2) controller area network (CAN) protocol whichis utilized within an autonomous vehicle to enable real-time control of critical automotivecomponents including brakes. For each of these two protocols, I will first describe the inquisitiveapproach which led to the discovery of the new security vulnerabilities. Then, through theexperiments on real-world systems, I will demonstrate how these vulnerabilities can be exploitedto launch malicious attacks which evade the state-of-the-art defense mechanisms employed inthese systems. I will conclude the talk by discussing novel countermeasures which are requiredto mitigate these fundamental vulnerabilities and prevent their exploitation.
Our reliance on Cyber-Physical Systems (CPS) is growing. As CPS infrastructure becomes exposed to the contested world through networks, CPS security becomes much more important. In a CPS, the cyber components manage the physical components. We propose that the overall goal for CPS resiliency is to have the physical systems behave properly regardless of fault and disruption. Our approach to CPS resiliency focuses on the physical components. Specifically, the inertia of the physical components provide a natural but limited resilience, and is capable of tolerating short-term disruption without affecting the health and safety of the CPS. This and the fact CPS have a large difference between physical and cyber time scales, enables a unique approach to CPS resiliency. This talk will present our approach of engineering the cyber components to be brittle against attack, which consequently forces cyber attacks and related disruptions to be short-lived and within tolerance of the physical system’s inertia.
A long-standing challenge in analyzing information leaks within mobile apps is to automatically identify the code operating on sensitive data. With all existing solutions relying on System APIs (e.g., IMEI, GPS location) or features of user interfaces (UI), the content from app servers, like user’s Facebook profile, payment history, fall through the crack. In this talk, I will introduce ClueFinder, a novel semantics-driven solution for automatic discovery of sensitive user data, including those from the server side. ClueFinder utilizes natural language processing (NLP) to automatically locate the program elements (variables, methods, etc.) of interest, and then performs a learning-based program structure analysis to accurately identify those indeed carrying sensitive content. Using this new technique, we analyzed over 400k popular apps, an unprecedented scale for this type of research. Our findings brings to light the pervasiveness of information leaks, and the channels through which the leaks happen, including unintentional over-sharing across libraries and aggressive data acquisition behaviors.
Imagine a world where data is currency. A world where the majority of the data is owned and traded by 6 international data barons who are constantly at war with each other. In this world, rogue AI persecutes whole segments of the population while nations become Petri dishes for mind control. Most people move about daily life oblivious to the knowledge that someone is controlling them, telling them where to go, what to buy, and even how to vote. If you object, millions of cameras track you and pick you out of a crowd where you are intercepted by the authorities and taken off to be reprogrammed. Sound like the Minority Report? The Matrix? Black Mirror? Welcome to 2020.
The data revolution and convergence are making the industrial revolution look like a blip on the radar when it comes to change. Join me as we discuss complex issues surrounding ethics in a new world. Who gets to collect and control data? How is AI influenced by data reflecting undesirable human behavior? Should we influence that data to reflect the values we aspire to? If so, who gets to decide the value system? What is the line between advertising and social engineering and is it eroding the concepts of free will and democracy? Is anyone even thinking about this? These are the ethical questions that are being decided (or not decided) today that will shape your tomorrow.
Distinguished social psychologist Geert Hofstede observed the “dominance of technology over culture is an illusion. The software of the machines may be globalized, but the software of the minds that use them is not.” The role of culture in the thought process is so prevalent, yet unstated, that many cultural beliefs and biases are accepted as truths. These cultural beliefs and biases are commonly infused into behavioral norms identifying behaviors that can be observed. While historically,these observations have taken place in the physical realm, this talk discusses the findings of cultural markers in the cyber realm. Dr. Sample presents and discusses recent interdisciplinary, evidence-based research using culture-based models of various cyber actors (attackers, defenders and victims)to explain observations in cybersecurity behaviors. These studies were performed over the past several years using public data found in the Zone-H archives. The mining of the Zone-H archives with over 10 million records of raw data allowed for research into behaviors, choices and reasons. By using Hofstede’s cultural framework to define culture along with some basic inferential statistics, specific digital identifiers were associated with cultural dimensions, allowing for more accurate modeling of cyber actors based on cultural values. The results supported Nisbett’s observation that people “think the way they do because of the nature of the societies they live in”. The discussion centers on the six dimensions of culture, the values associated with each dimension and examples of those values in cyber space. The six cultural dimensions measure views on values of self-determination, collectivism, aggression,nurturing, uncertain outcomes, holism, instant gratification, and levels of societal openness. The behavioral traits that associate with the cultural values are behavioral traits that are consistent with cyber behaviors.
Cellular technologies enable a wide array of critical services, from personal communication, autonomous vehicles and telemedicine to critical infrastructures, such as smart grid electricity distribution. Unfortunately, security and user privacy for such complex networks are often considered as afterthoughts. These lead to inadequate security evaluation early on the development cycle that fails to identify missing security and privacy guarantees in protocol designs. To make matters worse, unsafe practices and operational oversights stemming from poor input sanitization and unvetted simplification of complex protocol interactions further contribute to the deviation of deployments from designs. In this talk, I will highlight how my research addresses these problems by developing principled techniques for analyzing design specifications and deployments of complex cellular network protocols.
I will first present a new adversarial reasoning technique combining the capabilities of a symbolic model checker and a cryptographic protocol verifier that enabled us to identify 20+ new vulnerabilities in 4G and 5G cellular network design specifications. I will then discuss three new side-channel attacks in 4G and 5G networks uncovered with our dedicated probabilistic reasoning technique. Next, I will talk about a fuzzing technique which is more effective than the state-of-the-art in reasoning about syntactic and semantic correctness of an implementation when binary instrumentation is not realizable and direct feedback on code coverage information is missing. Finally, I will conclude with a discussion on challenges in adapting and scaling our current approaches for a holistic analysis of 5G and next-generation cellular networks, and IoT systems.
The Virtual Reality (VR) market could surpass $ 40 Billion by 2020. The U.S. Military recently closed a deal worth $ 480 Million for the Microsoft HoloLens Mixed Reality (MR) device. Oculus has already released the first immersive VR system that is mobile with no wires and no need for a high-end gaming PC for $399. While these are exciting times, an important question needs to be investigated: Are we ensuring the security and privacy of these systems? In this talk I will present various experiments and findings we conducted in our lab related to the security and forensics of consumer grade immersive VR systems. I will show you how we are able to move people in physical spaces without their knowledge or consent, as well as other attacks that we coined and implemented related to immersive VR. Furthermore, we will also explore the forensic artifacts these systems produce.
In this talk, we’ll explore how internet scan data layered with different open-source tools can start to make sense of what is publicly exposed and potentially a threat. Predominantly, we’ll focus on three investigations: 1. how to find attacker infrastructure, using IOCs from MITRE and Web Application Logs 2. how to identify trends in common misconfigurations and vulnerabilities 3. how to find assets related to your organization Throughout the talk, we’ll identify and use risk indicators to find relevant exposed devices. We’ll also touch on historical trends that relate to different types of attacks, security risks that have surfaced in the past year, and what some of the challenges are in identifying rouge assets in the haystack of internet data.
Trustworthy operation of industrial control systems depends on secure and real-time codeexecution on the embedded programmable logic controllers (PLCs). The controllers monitorand control the critical infrastructures, such as electric power grids and healthcare platforms,and continuously report back the system status to human operators. This talk is about Zeus, acontactless embedded controller security monitor solution that will ensure its execution controlflow integrity. Zeus leverages the electromagnetic emission by the PLC circuitry during theexecution of the controller programs. Zeus’s contactless execution tracking enables non-intrusive monitoring of security-critical controllers with tight real-time constraints. Thosedevices often cannot tolerate the cost and performance overhead that comes with additionaltraditional hardware or software monitoring modules. Furthermore, Zeus provides an airgapbetween the monitor (trusted computing base) and the target (potentially compromised) PLC.This eliminates the possibility of the monitor infection by the same attack vectors.
Zeus monitors for control low integrity of the PLC program execution. Zeus monitors thecommunications between the human- machine interface and the PLC and captures the controllogic binary uploads to the PLC. Zeus exercises its feasible execution paths, and fingerprintstheir emissions using an external electromagnetic sensor. Zeus trains a neural network forlegitimate PLC execution and uses it at runtime to identify the control flow based on PLC’selectromagnetic emissions. Zeus was implemented on a commercial Allen Bradley PLC, which iswidely used in industry, and evaluated it on real-world control program executions. Zeus wasable to distinguish between different legitimate and malicious executions with 98.9% accuracyand with zero overhead on PLC execution by design.
Smartspeakers, such as Amazon Echo, have been adopted by millions of users. However,the privacy impacts of smart speakers have not been well examined. We investigatethe privacy leakage of smart speakers under an encrypted traffic analysisattack, referred to as voice command fingerprinting. In this attack, anadversary eavesdrops encrypted voice traffic from and to a smart speaker andinfers which voice command a user says without decrypting encrypted traffic. Wedesign our attacks based on neural networks and collect two large-scaledatasets on Amazon Echo and Google Home by using an automatic traffic crawler. Ourexperimental results show disturbing privacy concerns. Specifically, comparedto 1% accuracy with random guessing, an attacker can infer 92% voice commandscorrectly on Amazon Echo and 99% voice commands correctly on Google Home. Wealso propose a defense to preserve user privacy against this attack with minimallatency and bandwidth overhead. Our simulations show that the proposed defensecan reduce attack accuracy to 1% if an attacker trains neural networks withoriginal traffic and 32% if an attacker adapts and trains neural networks withobfuscated traffic.
Most social platforms offer mechanisms allowing users to delete their posts, and a significant fraction of users exercise this right to be forgotten. However, ironically, users’ attempt to reduce attention to sensitive posts via deletion, in practice, attracts unwanted attention from stalkers specifically to those (deleted) posts. Thus, deletions may leave users more vulnerable to attacks on their privacy in general. Users hoping to make their posts forgotten face a “damned if I do, damned if I don’t” dilemma. In this talk, we will look into two new proposed deletion mechanisms that provide privacy for the deletion of users. In the first approach, in the form of intermittent withdrawals, we present, Lethe, a novel solution to this problem of (really) forgetting the forgotten. If the next-generation social platforms are willing to give up the uninterrupted availability of non-deleted posts by a very small fraction, Lethe provides privacy to the deleted posts over long durations. Furthermore, we introduce Deceptive Deletion, a new decoy mechanism that minimizes the adversarial advantage. Our mechanism creates a two-player min-max game between, an adversary that seeks to classify damaging content among the deleted posts, and a challenger that employs decoy deletions to masquerade real damaging deletions.
We evaluate the systems using the Twitter data samples and show that in the presence of a strong adversary our systems protect the privacy of the users' deletions.
Anyone in this business knows how fun and exciting hacking can be, but also the emotional and physical toll it can take. Mental health is a longstanding dirty secret in the infosec community, and we are just now learning how to talk about it. The wear and tear of everyday stress combined with an 'always on' aspect of an operational environment creates a perfect storm for burning out. While stress can have a negative impact on job performance, my primary concern is on the health and safety of infosec professionals themselves. Not only does stress have short term effects on cognitive abilities and performance, but recurrent acute stress can have long term effects on health (mental and physical) as well as burnout and turnover. There are many sources of stress in infosec operations, some of which can be managed while others are simply the nature of the job. Activities that require long periods of vigilance and creativity will deplete cognitive resources and increase fatigue. Some of these activities have unpredictable results that can increase frustration. Other times, external factors unrelated to the activity itself may introduce new sources of stress that are not normally present. A certain level of stress is to be expected in these operations because they are considerably difficult, have a high risk vs. reward trade-off, and require a significant amount of knowledge and skill. But, how much stress can you take on and still be a happy hacker? In this talk I will discuss why infosec is so stressful, how this stress affects you and your network, and some things you can do about it. I will also discuss lessons learned from my research study of tactical cyber operations that studied fatigue, frustration, and cognitive workload in operators.
The Internet of Things (IOT) is a potential massive market. However, the deployment of IOT brings forth many challenges across the dimensions of the business side (efficient supply chain) as well as the technical side (secure deployment). In order for the IOT promise to deliver massive volume, the marketplace must have secure, efficient, and effective ways to deploy and secure billions of devices in the market. The security threats to end points and devices has never been greater and will continue to evolve. Join us for a talk on how Intel and the industry are working together to deliver fast, secure, zero-touch, late binding onboarding for any device to any cloud in a safe and secure manner to advance the Internet of Things.
Cryptocurrencies are the latest in a series of market bubbles that demonstrate irrational exuberance. In this lecture, Mitch Parker, CISO of IU Health, will go over previous market bubbles, and compare and contrast the differences between the security controls in two peer to peer exchange methods, the current US federal banking system, and Bitcoin. Through this, Mitch will demonstrate the need to have security built into both the technical and non-technical controls of a financial system, and that the power of the system is not just based upon backing by a central bank, but by the series of controls and measures used by the central bank and accounting standards to provide customers the assurance that they are protected.
GDPR/ NYDFS/ CCPA and other State, Federal and Supra-regional regulations coming online quickly. Governments are driving Security, Privacy & Compliance throughout the world. Since there is not an overriding set of Federal laws such as GLBA, many organizations in the US are unprepared for the upcoming deluge of regulations. Gain an understanding of what is coming and learn ways that you can help future organizations cope with and plan for a “50 States” strategy in an uncertain future. As well as prepare yourself for an uncertain future.
Sure, you may know how to subnet a class "C" network into 64 different networks, but how about where to go to learn about technology that has yet to make it into a textbook? Or to find your next job? Or just somewhere where you can commensurate with someone who understands what you mean when you say, "That APT left the MSSP DOA!" This presentation will outline the OSINT and TTP's cyber security practitioners use in industry to connect, build, and maintain networks, with an eye towards how Boilermakers who are CERIAS about cybersecurity can do the same.
The global impact resulting from the distribution of doctored digital photographs has reached an epidemic proportion. These digitally altered photos are distributed through social media, news outlets, traditional web resources and are making their way into the mainstream media. The impact of these photos can dramatically change the way people think, act, react, believe and can ultimately cause harm. At the simplest level they represent visual fraud.
During this presentation, I will convey real examples along with the resulting impacts that have already occurred.
Most importantly, I will demonstrate a new methodology rooted in the dark art of steganography that can actively identify these fraudulent photos and even trace their origins back to their creators.
Nation-state adversaries have shown the ability to disrupt critical infrastructure through cyber-attacks targeting systems of networked, embedded computers. This knowledge raises concern that space systems could face similar threats. This project will research and develop moving target defense algorithms that will add cyber resilience to space systems by improving their ability to withstand cyber-attacks. Most proposed cyber resilience solutions focus on or require detection of threats before mitigative actions can be taken, a significant technical challenge. Our novel approach avoids this requirement while creating informational asymmetry that favors defenders over attackers. We hypothesize that moving target defenses (MTD) can create dynamic, uncertain environments on space systems and be used to defeat cyber threats against these systems. Many proposed solutions focus on or require detection (e.g. anomaly detection, AI, data analytics) before mitigative actions can be taken, a significant technical challenge. We propose a novel approach that avoids this requirement while creating informational asymmetry that favors defenders over attackers.
Consider a scenario where a group of agents, each receiving partially informative private signals, aim to learn the true underlying state of the world that explains their collective observations. These agents might represent a group of individuals interacting over a social network, a team of autonomous robots tasked with detection, or even a network of processors trying to collectively solve a statistical inference problem. To enable such agents to identify the truth from a finite set of hypotheses, we propose a distributed learning rule that differs fundamentally from existing approaches, in that it does not employ any form of ``belief-averaging". Instead, agents update their beliefs based on a min-rule. Under standard assumptions on the observation model and the network structure, we establish that each agent learns the truth asymptotically almost surely. As our main contribution, we prove that with probability 1, each false hypothesis is ruled out by every agent exponentially fast, at a network-independent rate that strictly improves upon existing rates. We then consider a scenario where certain agents do not behave as expected, and deliberately try to spread misinformation. Capturing such misbehavior via the Byzantine adversary model, we develop a computationally-efficient variant of our learning rule that provably allows every regular agent to learn the truth exponentially fast with probability 1.
While made famous for the work that was done on the physical plastic cards many of carry around in our wallets, Mastercard is thinking way beyond those cards for the future.
We’ll walk through how Mastercard deploys its assets creating simple, safe and secure experiences for customers whether it is for payments or their identities.
This session provides observations regarding the process of moving the datacenter assets of a Top100 bank fully into the cloud. The Golden Rules providing security and assurance will be described. The gotchas, surprises, lessons learned, and resulting strategic changes are presented to raise awareness and prevent future mistakes by attendees.
Despite over 50 years of intensive research and experimentation, we still are plagued with systems that are fragile, compromised, and impossible to fully trust. There is near-daily news of compromises and losses, from criminals, nation-state actors, and vandals. The cyber ecosystem we have developed and upon which society is increasingly reliant appears to develop (or have exposed) a new vulnerability as soon as a current one is patched, and old problems keep being introduced.
Why do we have such problems? I contend it is traceable to one root cause: we don't understand what cyber security really is. Without good definitions we cannot formulate good metrics. With the absence of good metrics we can't really tell whether we are spending our money and time on useful approaches. Furthermore, the only metrics available to most decision-makers is based simply on cost and speed -- neither of which reflects security or safety.
This talk explores this idea in more depth, and should be understandable to non-specialists. I include discussion of some open research problems that -- if successfully addressed -- would lead to improvement of our cyber ecosystem.
As more disciplines leverage computational and data-driven modeling, the security of campus cyberinfrastructure is becoming increasingly important in order to protect intellectual property and secure a competitive advantage for researchers. Funded by the NSF Cybersecurity Innovation for Cyberinfrastructure (CICI) program, the Purdue Live Security Analyzer (PULSAR) project aims to enhance the cybersecurity of Purdue’s campus cyberinfrastructure by developing a cyber attack detection and response capability for the Purdue campus research network. Goals of the project include enabling domain scientists to conduct research with heightened security requirements, enhancing cybersecurity research by making large volumes of production network traffic data available to researchers, and supporting cybersecurity education by engaging undergraduate students in the deployment and operation of advanced cyberinfrastructure. The implementation of PULSAR was led by a team of Purdue undergraduate students alongside mentors from ITaP Security and Policy and Research Computing. Implementation details of the project will be discussed along with information regarding generation of anonymized network traffic datasets.
Learn about common attacks against online accounts, ways to protect your accounts against malicious actors, and the next generation of Identity standards and application architecture.
Recent reports on how side-channel attacks can be used to obtain secret information stored in Cache memories and how current processors that rely on speculative execution of code aids in these side-channel attacks have caught the attention of everyone. Names such as Spectre and Meltdown describe how a well-resourced attacker can discover secret information such as passwords and cyber keys. Since these attacks are applicable most to current processors, made by Intel, AMD and ARM; almost all computing devices (servers, desktops, laptops, cell phones) are vulnerable to such attaches.
Several software and some hardware solutions have been suggested and deployed by major vendors; however, most solutions incur performance penalties. In this talk, I will provide an introduction to the architectural features that expose processors to side-channel attacks. I will present some available solutions as well some of our own ideas.
I will briefly discuss other research on Cybersecurity at UNT
Within recent years, secure comparison protocols have been proposed using binary decomposition and properties of algebraic fields. These protocols have become increasingly efficient, but their performance has seemingly reached a plateau. We propose a new approach to this problem that transforms the comparison function into comparing specialized summations and takes advantage of dynamically switching domains of secret shares and asymmetric computations for intermediate calculations among the participating parties. As a consequence, according to our analysis, communication and computation costs have been brought to a very low and efficient level. Particularly, the communication costs have been considerably reduced both in order as well as the dominating term’s order of magnitude. In addition, we propose a secure protocol under the malicious setting which maintains our transformation and is more efficient than the existing work for common domain sizes.
In this talk the concept of Cyber Physical Human Systems security in the context of aviation systems will be introduced. The talk will also cover the proposed security framework involving the detecting and responding to the attacks. In addition, the talk will describe the results of vulnerability assessment experiments from Aviations Cyber-Physical Systems pespective and the simulation experiments conducted for
several attacks in the context of Internet of Things (IoT).
Most sophisticated cyber attack follow the well-known cyber kill chain. The first step of the cyber kill chain is the reconnaissance phase where attacker probe the network in search of weakness, misconfiguration, vulnerabilities, and identify potential targets before the actual attack start. To this end, the attacker need to collect important information about the characteristics of each devices (i.e., hardware, operating system, applications), the network topology, the different subnet, firewall rules, access control, privilege, the communication protocol at each layer, and the machine learning algorithm on each IoBT devices. The attacker reconnaissance can be summarized by an attack graph in which the node represent vulnerable IoBT devices and the edge show their associated vulnerabilities. This work investigates cyber deception as a complex game in which each player has three concurrent and interdependent objectives. Each players imperfectly monitor (partial observation) other players’ action to find out each player’s identity, strategies, payoff, available information, capability, and to continuously predict their intent. Each player strategically select to which players to hide particular information (e.g., camouflage). Each player judiciously manipulate other players’ perception (e.g., decoy) based on his observed action, estimated capability, and predicted intent. This work examines from the defender’s perspective several deception game on an attack graph. The defender goal is to stop the attacker early in the cyber kill chain and prevents the subsequent more dangerous phases.
Nowadays more and more data are gathered for detecting and preventing cyber attacks. Unique to the cyber security applications, learning models face active adversaries that try to deceive learning models and avoid being detected. Hence future datasets and the training data no longer follow the same distribution. The existence of such adversarial samples motivates the development of robust and resilient adversarial learning techniques. Game theory offers a suitable framework to model the conflict between adversaries and defender. We develop a game theoretic framework to model the sequential actions of the adversaries and the defender, allowing players to maximize their own utilities. For supervised learning tasks, our adversarial support vector machine has a conservative decision boundary, whereas our robust deep neural network plays a random strategy inspired by the mixed equilibrium strategy. One the other hand, in real practice, labeling the data instances often requires costly and time-consuming human expertise and becomes a significant bottleneck. We develop a novel grid based adversarial clustering algorithm, to understand adversaries' behavior from a large number of unlabeled instances. Our adversarial clustering algorithm is able to identify the normal regions inside mixed clusters, and to draw defensive walls around the center of the normal objects utilizing game theoretic ideas. Our algorithm also identifies sub-clusters of adversarial samples and the overlapping areas within mixed clusters, and identify outliers which may be
potential anomalies.
ARM possessors are being widely used on mobile devices and smart IoT devices. Despite the best efforts, an operating system is too hard to be absolutely secured on both x86 and ARM platforms. We addresse the problem of executing an unmodified application in a compromised OS for ARM platforms. Existing protection mechanisms mainly focus on x86 platform, utilizing SGX of Intel Processors or a hypervisor which is running below an operating system. However, SGX is not available for ARM platform, and hypervisor is an overkill for embedded or IoT settings. We descript how to achieve the security goals on ARM Cortex-A processors using ARM specific designs. We also discuss the threats of side-channels and possible mitigations.
Information, not just data, is key to today’s security challenges. To solve these security challenges requires not only advancing computer science and big data analytics but requires new analysis and decision-making environments that enable reliable, decisions from trustable, understandable information. These environments are successful when they effectively couple human decision making with advanced, guided analytics in human-computer collaborative discourse and decision making (HCCD). Our HCCD approach builds upon visual analytics, traceable information, and human-guided analytics and machine learning and focuses on empowering the decision maker through interactive visual analytic environments where non-digital human expertise and experience can be combined with state-of-the-art and transparent analytical techniques. When we combine this approach with real-world application-driven research, not only does the pace of scientific innovation accelerate, but impactful change occurs. I’ll describe how we have applied these techniques to homeland and community security, resiliency,public safety and disaster management.
In application environments like international military coalitions or multi-party relief work in a disaster zone, passing secure messages using a Delay Tolerant Network (DTN) is challenging because the existing public-private key cryptographic approaches may not be always accessible across different groups due to the unavailability of Public Key Infrastructure (PKI). In addition, connectivity may be intermittent so finding reliable routes is also difficult. Thus, instead of sending a complete message in a single packet, fragmenting the message, and sending the fragments via multiple nodes can help achieve better security and reliability when multiple groups are involved. Therefore, encrypting messages before fragmentation and then sending both the data fragments and the key fragments (needed for decryption) provide much higher security. Keys are also fragmented as sending the key in a single packet can hamper security if it is forwarded to some corrupt nodes who may try to tamper or drop it. In this talk, I will discuss a scheme to provide improved security by generating multiple key-shares and data fragments, and disseminating them via some intermediate nodes. In this fragmentation process, we also create a few redundant blocks to guarantee higher data arrival rate at the destination when the message drop rate is high like in a DTN environment. The performance evaluation when compared to the closely related scheme like Multiparty Encryption shows the improvement on minimizing the number of compromised messages as well as reduced bandwidth consumption in the network.
One of the reasons we care about information security is protecting privacy, and satisfying requirements of privacy law. But what exactly is meant by privacy? Is security sufficient to provide privacy? This talk looks at some background on data privacy, and techniques for privacy protection including anonymity and
differential privacy.
Caller ID spoofing forges the authentic caller identity, thus making the call appear to originate from another user. In this paper, we propose CEIVE (Callee-only inference and verification), an effective and practical defense against caller ID spoofing. It is a victim callee only solution without requiring additional infrastructure support or changes on telephony systems. We implement CEIVE on Android phones and test it with all top four US mobile carriers, one landline and two small carriers. It shows 100% accuracy in almost all tested spoofing scenarios except one special, targeted attack case.
Access control systems are known to be vulnerable to anomalies in security policies, such as inconsistency. Android Security model is no exception. This talk presents a new approach aiming to unveil Android inconsistent access controls enforced across multiple instances of the same resource. To address the complex nature of Android security checks (e.g., semantic similarity of syntactically different enforcements), the presented approach detects inconsistencies through modeling and normalizing diverse checks. The talk further presents application results of the approach, including the discovery of actual exploits.
How do you assess the cybersecurity status of public and private organization in a State? The NIST has a comprehensive framework for assessing cybersecurity but for small companies with limited expertise or funding, this process is not possible to reasonably complete. Indiana Governor’s Executive Council on Cybersecurity and Purdue University collaborated in conducting a Cybersecurity Scorecard Pilot to aid the improvements in cybersecurity across their state. The Cybersecurity Scorecard included several targeted objectives:
Enable non-cybersecurity experts to confidently learn, self-assess, and initiate cybersecurity improvement. Enable public and private executives to identify systemic cybersecurity issues Provide a means of comparing preparedness across public and private critical infrastructure and key resource sectors within the state. Utilize standards and measurements that support “apples to apples” comparison.
Presentation will describe Indiana’s Cybersecurity Scorecard’s development process, pilot launch, and initial findings.
Threat intelligence is interested in the entire kill chain from tools to victims. Chief among these interests are the threat actors themselves who carry out attacks and campaigns. Many different schemes exist on how to classify differet types of threat actors in order to more easily describe and understand them. This presentation focuses on the nation-state and cybercriminal classes of threat actors, how they differ, and how they overlap. Real world examples are provided to illustrate new and different ways of thinking about threat actors.
This talk will explore the enormous threat landscape presented by the IoT ecosystem and examine the state of IoT security with a bit of humor. We will look at everything from individual devices, to conceptual challenges, as well as potential solutions to the most challenging security question we have ever had to answer.
During system call execution, it is common for operating system kernels to read userspace memory multiple times (multi-reads). A critical bug may exist if the fetched userspace memory is subject to change across these reads, i.e., a race condition, which is known as a double-fetch bug. Prior works have attempted to detect these bugs both statically and dynamically. However, due to their improper assumptions and imprecise definitions regarding double-fetch bugs, their multiread detection is inherently limited and suffers from significant false positives and false negatives. For example, their approach is unable to support device emulation, inter-procedural analysis, loop handling, etc. More importantly, they completely leave the task of finding real double-fetch bugs from the haystack of multireads to manual verification, which is expensive if possible at all.
In this paper, we first present a formal and precise definition of double-fetch bugs and then implement a static analysis system— DEADLINE—to automatically detect double-fetch bugs in OS kernels. DEADLINE uses static program analysis techniques to systematically find multi-reads throughout the kernel and employs specialized symbolic checking to vet each multi-read for double-fetch bugs. We apply DEADLINE to Linux and FreeBSD kernels and find 23 new bugs in Linux and one new bug in FreeBSD. We further propose four generic strategies to patch and prevent double-fetch bugs based on our study and the discussion with kernel maintainers.
Hygiene - it's good for your body and it's good for your computer/network. We will explore the simplicity of cyber hygiene and the insider/outsider threats that take advantage of poor hygiene. It is all a matter of focus and attention to threat actors. In addition, we will introduce you to the Cyber Center for Education and Innovation, Home of the National Cryptologic Museum (CCEI-NCM). This is a unique national value proposition to bring together cybersecurity education and invite collaboration. CCEI-NCM's core mission is to broaden cyber threat awareness, understand cybersecurity best practices with educational outreach, and to enhance operational cybersecurity workforce development in support of our nation's critical infrastructure sectors.
Cyber security for increasingly mobile clients is an increasing and never ending challenge. Companies of the future are adopting agile systems and cross-functional processes to respond to these challenges.
The Linux Audit system is widely used as a causality tracking system in real-world deployments for problem diagnosis and forensic analysis. However, it has poor performance. We perform a comprehensive analysis on the Linux Audit system and find that it suffers from high runtime and storage overheads due to the large volume of redundant events. To address these shortcomings, we propose an in-kernel cache-based online log-reduction system to enable high-performance audit logging. It features a multi-layer caching scheme distributed in various kernel data structures, and uses the caches to detect and suppress redundant events. Our technique is designed to reduce the runtime overhead caused by transferring, processing, and writing logs, as well as the space overhead caused by storing them on disk. Compared to existing log reduction techniques that first generate the huge raw logs before reduction, our technique avoids generating redundant events at the first place. Our experimental results of the prototype KCAL (Kernel-supported Cost-effective Audit Logging) on one-month real-world workloads show that KCAL can reduce the runtime overhead from 40+% to 15-%, and reduce space consumption by 90% on average. KCAL achieves such a large reduction with 4% CPU consumption on average, whereas a state-of-the-art user space log-reduction technique has to occupy a processor with 95+% CPU consumption all the time.
Millions of people spend their day chatting away on their cellphones, ordering groceries from Amazon’s Alexa, making calendar appointments with Apple’s Siri, or posting on Facebook about the last concert they attended. Sharing our personal information via social media platforms or providing it to third party companies has become so common place in our routines that it begs the question, “What, if anything, in our personal lives is really private?” As we grow more comfortable using modern technology to streamline and stay connected, are we risking our right to a reasonable expectation of privacy, a protection garnered by the Fourth Amendment of the U.S. Constitution?
Modern innovation has presented the judiciary with unique challenges, as the court balances the legitimate interests of government and the people. We will explore the dynamics of Carpenter v. United States, United States v. Miller, and Smith v. Maryland, and the recent developments surrounding the Golden State Killer and the Arkansas murder case involving Amazon’s Alexa.
US cybersecurity experts determined that Russian hacking group Dragonfly targeted the United States and European utilities with a cyber espionage campaign from 2015 – 2017. This government sponsored group was able to successfully infiltrate core control systems. Cold War espionage methodologies such as “sleeper cells” are now being executed in the cyber domain. Industrial firms including power and water providers have proven to be susceptible to attacks and disruptions that could be used during a significant geopolitical conflict. Antiquated industrial control devices now connected to the internet make utilities in even the most advanced countries susceptible to everyone from hacktivists to cyber criminals to nation states. In these times, the question has shifted from “can they?” to “when will they?”. Using Indiana’s groundbreaking cybersecurity exercise Crit-Ex as an example, we explore exactly how vulnerable of utilities really are and how insights into incident response and resiliancy are discovered through complex training and exercises.
The field of Information Security is broad with many career paths. The high demands and low supply for security expertise is constantly in the news. How do we fix this? Many people are either intimidated by security or do not realize that their expertise and talent would be a perfect fit for the security industry even if they are in a different field. This talk will bridge that gap and help identify the opportunities available to you. Common questions will be answered such as how to get started, what resources should be utilized, and what exactly does a career in Information Security look like. This presentation will turn the traditional career approach upside down and utilize the “hacker mindset” to our advantage to accelerate our careers, create opportunities, and position ourselves to be successful.
Embedded systems are used in every aspect of modern life. The Internet of Things is comprised of millions of these interconnected systems many of which are low cost bare-metal systems, executing without an operating system. These systems rarely employ security protections. Their development assumptions of unrestricted access to all memory and instructions and constraints on runtime, energy, and memory makes applying protections particularly challenging. I will present recent two recent techniques EPOXY (IEEE S&P 2017) and ACES (USENIX Security 2018), that harden bare-metal systems against memory corruption attacks.
EPOXY is an LLVM based embedded compiler that uses a novel technique, called privilege overlaying, wherein operations requiring privileged execution are identified and only these operations execute in privileged mode. This provides the foundation on which code-integrity, adapted control-flow hijacking defenses, and protections for sensitive IO are applied. EPOXY also employs fine-grained randomization schemes, that work within the constraints of bare-metal systems to provide further protection against control-flow and data corruption attacks. These defenses prevent code injection attacks and ROP attacks from scaling across large sets of devices. EPOXY’s evaluation on case study applications shows that EPOXY has, on average, a 1.8% increase in execution time and a 0.5% increase in energy usage.
ACES is another LLVM-based compiler that automatically infers and enforces inter-component isolation on bare-metal systems, thus applying the principle of least privileges. ACES takes a developer-specified compartmentalization policy and then automatically creates an instrumented binary that isolates compartments at runtime, while handling the hardware limitations of bare-metal embedded devices. ACES evaluation shows that ACES’ compartments can have low runtime overheads (13% on our largest test application), while using 59% less Flash, and 84% less RAM than the Mbed uVisor—the current state-of-the-art compartmentalization technique for bare-metal systems. ACES‘ compartments protect the integrity of privileged data, provide control-flow integrity between compartments.
The field of cyber engineering is relatively new as compared to other engineering disciplines such as software, mechanical, and systems. However, as we consistently hear and read about, cyber has rapidly become all-encompassing for every industry, including the Department of Defense. Specifically for DoD and weapons systems, the application of cyber engineering and cyber solutions must account for the entirety of the system life cycle. This requires a cyber test and evaluation strategy be defined from the start of a program and applied throughout the system life cycle, or system “V”. This presentation will discuss the cyber requirements and directives as levied by the Department of Defense and how this affects program test and evaluation strategies and implementation across DoD programs.
As more and more Personally Identifiable data is collected or created, the specter of customer privacy issues are looming large. Enterprises need to take a long hard look at the information they are capturing and determine whether the potential value outweighs the potential risk. How do your current Privacy practices match up against upcoming laws soon to Europe? Are you prepared to deal with new laws that with fines up to 4% of global revenue? If not, how do you start? Are you prepared to deal with companies using your data like Facebook, Google, Cambridge Analytica with or without your approval? Takeaways:
What does your data mean to you and others? Understand what the implications of new laws are as well as your risks Understand how to comply with upcoming laws Understand the technology at issue Understand how contracts and dataflow will be impacted How can this be beneficial for you personally
Over the last three decades, several anonymous communication (AC) protocols have been proposed towards improving users' privacy over the internet. Among those, the Tor protocol has been particularly successful. Thanks to its low communication latency and low bandwidth overhead, Tor today is employed by millions of users worldwide. Nevertheless, its anonymity is known to be broken in the presence of global adversaries. AC protocols like the dining cryptographers network provide anonymity even in the presence of global adversaries at the expense of bandwidth overhead, while others such as the mixing network designs improve anonymity at the expense of higher latency. In this work, we investigate the fundamental constraints of anonymous communication (AC) protocols. We analyze the relationship between bandwidth overhead, latency overhead, and sender anonymity or recipient anonymity against the global passive (network-level) adversary. We confirm the trilemma that an AC protocol can only achieve two out of the following three properties: strong anonymity (i.e., anonymity up to a negligible chance), low bandwidth overhead, and low latency overhead. We further study anonymity against a stronger global passive adversary that can additionally passively compromise some of the AC protocol nodes. For a given number of compromised nodes, we derive necessary constraints between bandwidth and latency overhead whose violation make it impossible for an AC protocol to achieve strong anonymity. We analyze prominent AC protocols from the literature and depict to which extent those satisfy our necessary constraints. Our fundamental necessary constraints offer a guideline not only for improving existing AC systems but also for designing novel AC protocols with non-traditional bandwidth and latency overhead choices.
Security is often implemented through bolt-on assessments including periodic testing that only happens once in a release or even annually. Manual security processes can no longer keep up in today's fast paced world of agile development, devops and constant vulnerabilities. DevSecOps, or Security as Code, is an approach that allows security staff to multiply resources and increase agility and speed. Executed properly it also provides the audit trail necessary to demonstrate control even in the most rigorous regulatory environments. This session will explore this approach in the context of regulated medical device software. We'll explore the integration of Software Composition Analysis (3rd Party Open Source Libraries), Static Source Code Analysis, Dynamic Testing along with automated verification leveraged to reduce the risk of security failures in development and post-market/production operations.
The Ripple credit network has emerged as the payment backbone with indisputable advantages for financial institutions and the remittance industry. Ripple’s market capitalization is currently third only to Bitcoin and Ethereum. Its path-based IOweYou (IOU) settlements across different currencies conceptually distinguishes the Ripple blockchain from the cryptocurrencies (such as Bitcoin) and makes it highly suitable to an orthogonal yet vast set of applications in the remittance world and beyond.
In this talk, I present our recent study of the structure and evolution of the Ripple network since its inception, and our research results regarding its vulnerability to attacks that harm the IOU credit of its wallets. We find that about 13M USD are at risk in the current Ripple network due to inappropriate configuration of the rippling flag on credit links that paves the way to undesired redistribution of credit across those links. Although the Ripple network has grown around a few highly connected hub (gateway) wallets that make the core of the network and provide high liquidity to users, such credit link distribution results in a user base of around 112,000 wallets that can be financially alienated by as few as 10 highly connected gateway wallets. Indeed, today about 4.9M USD cannot be withdrawn by their owners from the Ripple network due to PayRoutes, a gateway tagged as faulty by the Ripple community. Finally, we observe that stale exchange offers pose a real problem, and exchanges (market makers) have not always been vigilant about periodically updating their exchange offers according to current real-world exchange rates. For example, stale offers were used by 84 Ripple wallets to gain more than 4.5M USD from mid-July to mid-August 2017. Our findings should prompt the Ripple community to improve the health of the network by educating its users on increasing their connectivity, and by appropriately maintaining the credit limits, rippling flags, and exchange offers on their IOU credit links.
C++ relies on object type information for dynamic dispatch and casting. The association of type information to an object is implemented via the virtual table pointer, which is stored in the object itself. As C++ has neither memory nor type safety, adversaries may therefore overwrite an object’s type. If the corrupted type is used for dynamic dispatch, the attacker has hijacked the application’s control flow. This vulnerability is widespread and commonly exploited. Firefox, Chrome, and other major C++ applications are network facing, commonly attacked, and make significant use of dynamic dispatch. Control- Flow Integrity (CFI) is the state of the art policy for efficient mitigation of control-flow hijacking attacks. CFI mechanisms determine statically (i.e., at compile time) the set of functions that are valid at a given call site, based on C++ semantics. We propose an orthogonal policy, Object Type Integrity (OTI), that dynamically tracks object types. Consequently, instead of allowing a set of targets for each dynamic dispatch on an object, only the single, correct target for the object’s type is allowed. To show the efficacy of OTI, we present CFIXX, which enforces OTI. CFIXX enforces OTI by dynamically tracking the type of each object and enforcing its integrity against arbitrary writes. CFIXX has minimal overhead on CPU bound applica- tions such as SPEC CPU2006 — 4.98%. On key applications like Chromium, CFIXX has negligible overhead on JavaScript benchmarks: 2.03% on Octane, 1.99% on Kraken, and 2.80% on JetStream. We show that CFIXX can be deployed in conjunction with CFI, providing a significant security improvement.
Cryptocurrencies have exploded in popularity in the last few years. These cryptographic systems aim to provide freedom from government-backed fiat currencies. This presentation examines the traditional and novel risks to cryptocurrency systems. Special attention is paid to documented attacks on cryptocurrency infrastructure, criminal use of cryptocurrencies, and the policies affecting cryptocurrency systems.
The purpose of this presentation is to show that successful retrocomputing projects and groups which currently exist follow patterns we can use to help low-resource and industrial organizations that need to secure their devices. Can retrocomputing breathe new life into older technology to help secure the enterprise?
Trusted computing is the key component in achieving confidentiality and integrity in modern cloud environments. Commodity trusted hardware such as Intel SGX and ARM Trustzone allow programs to execute and store sensitive data in secure memory regions. It is envisioned that these systems will enable important applications from trusted data analytics and Private Information Retrieval (PIR) in the cloud to content protection and secure financial services in mobile settings.
This talk deals with the security aspects of SGX programs in accessing a key system resource, files. Our focus would be on concrete attacks against existing SGX filesystem implementations through well-known side-channels, as well as the design and implementation of an oblivious filesystem to thwart aforementioned attacks.
Our solution, Obliviate, mitigates this threat using ORAM, a cryptographic primitive which enables secure data access even when the attacker can observe all memory interactions. We show that a naive implementation of ORAM within SGX opens vulnerability to other attacks and induces a degree of overhead. Therefore, Obliviate develops a secure implementation of ORAM using CMOV, an x86-based instruction, and employs other SGX-specific optimizations. We show that Obliviate can secure all filesystem interactions while providing a performance improvement of 6 − 8× over a baseline scheme. Potential use-cases of Obliviate include real-world cloud applications such as web servers, databases and personal cloud storage. This work will appear in NDSS 2018.
Eli Lilly’s Threat Intelligence team (CTI) was officially established in July of 2016 tasked with several key objectives that would need to be met for the overall Security organization to be successful. This talk is going to cover the CTI team’s journey over the past year, where they started from, how they got the start, the current state, as well as the future direction of the Threat Intelligence program. This will not be a deep technical talk, but rather a process-based talk covering a wide variety of topics including some of the following: Governance CISO Sponsorship Value of Previous Consulting Help Types of Intelligence Value Driven by the CTI Team Criteria for Selecting a Threat Intelligence Feed and TIP Vendor Hunting Framework TIP Integration(s)
The public health sector cannot deliver efficient and safe patient care without digital interconnectivity among devices. If the healthcare system is connected, but insecure, the interconnectivity could betray patient safety, subjecting patients to uncalculated and unnecessary risks with insurmountable costs, including death. Our nation must realize the dangers imposed on patients due to the reliance on interconnectivity amongst devices and information systems. Healthcare delivery organizations are often seen and titled as safe places, places for healing, and places we trust. These entities are a repository for our most sacred personal information as well as a harbor for some of the most technologically advanced equipment; thus they have become easy targets for threat actors. Real cases of protected health information theft, ransomware, and targeted nation-state hacking prove that our nation’s healthcare systems, data, devices, and reputation are vulnerable. This presentation aims at depicting the current state of cybersecurity in healthcare delivery organizations as well as at understanding the main threats organizations face, discussion the ecosystem, industry-specific pitfalls, and the patient health attack model.
Software is an essential component to the operation of business information systems, cyber physical systems, and various personal devices. Despite increased awareness and concern about software security threats, current state of the art of software engineering practices are inadequate: new categories of security weaknesses are commonly reported. Challenges that hinder development of secure software start with difficulty of identifying threats and estimating risks. Practices such as incremental software development also pose challenges to software security. This talk discusses through a set of examples how empirical research can help to advance the state of the art of secure software engineering.
Password leaks have become an unfortunately common occurrence, with billions of records leaked in the past few years. In this work we develop and economic model to help predict how many user passwords such an attacker will crack after such a breach. Our analysis indicates that currently deployed key stretching mechanisms such as PBKDF2 and BCRYPT provide insufficient protection for user passwords. In particular, our analysis shows that a rational attacker will crack 100% of passwords chosen from a Zipf’s law distribution and that Zipf’s Law accurately models the distribution of most user passwords. This dismal claim holds even if PBKDF2 is used with 100,000 hash iterations (10 times greater than NIST’s minimum recommendation). On a positive note our analysis demonstrates that memory hard functions (MHFs) such as SCRYPT or Argon2i can significantly reduce the damage of an offline attack. Based on our analysis we advocate that password hashing standards should be updated to require the use of memory hard functions for password hashing and disallow the use of non-memory hard functions such as BCRYPT or PBKDF2.
Penetration testing, or "Ethical Hacking", is the practice of testing systems, environments, and even employees in the manner of a real-world hacker. As news of security breaches and wide-spread hacks increase, companies are increasingly pursuing penetration testing services. This talk will discuss what penetration testing is and different approaches that vendors bring to it, why penetration testing is so important to a security program, and how penetration tests are implemented to simulate real-world attacks.
Security technology has long been relegated as part of the IT stack, but the consistent stream of attacks on our government, corporations, and individuals alike have shown that the relationship between security technology and the business needs to be reconsidered. As we look at events such as manipulating news on Facebook, Equifax, WannaCry, NotPeta, and Uber, how do we engage a wider audience to be part of the conversation of understanding the challenges and solutions? What are the mechanisms that will stop companies from hiding the security gaps and events from investors, employees, and customers? This discussion will use current use cases intended to stimulate a dialogue on how we, as current and future leaders in cyber security, can better understand the broader risks and opportunities so that we can educate and inform on how to get ahead of the adversary.
Intrusive online advertising has given birth to the trend of ad-blockers. Initially dismissed by the online advertising industry as inconsequential, ad-blockers have evolved from a mere plugin tool on browsers to full-fledged platforms that derive benefits from certifying quality of advertisers and reducing disutility of users from intrusive activities such as user tracking. However, are ad-blocking platforms the optimal solution to improving user experience online? There is no clear answer. User experience advocates term this as yet another way to target users online. Industry advocates accuse ad-blockers of using an extortion-based business model, built on fleecing advertisers. Through our game theoretic model, we inform policy-makers on this problem and establish the optimal pricing policy for such ad-blocking platforms. In addition, we theorize the socially optimal pricing policies of advertising supported content platforms and establish how such platforms should price participation from users, given the obvious disutility of advertising they are exposed to.
Internet users around the world are facing censorship. To access blocked websites, they use circumvention services that most commonly consist VPN-like proxies. The censors, in turn, try to block such proxies, creating a sort of cat-and-mouse game. Refraction networking takes a different approach by placing refracting routers inside ISP networks. By spending a special signal, a user can ask a router to refract any connection that transits the ISP to another, blocked destination, in a process that is undetectable by the censor. To prevent such connections, the censor would need to block all traffic from reaching that ISP, which considerably raises the cost of censorship.
I will discuss the design of refraction networking and how it achieves the properties above. I will also discuss the results of our a pilot deployment of refraction networking two ISPs handling an aggregate of nearly 100 Mbps traffic, which provided censorship circumvention to 50,000 users in a country with heavy Internet censorship. I will close by discussing some future research issues in the space.
Rebroadcast from the original Oct. 30 talk.WEST LAFAYETTE, Ind. — Mikhail Atallah, distinguished professor of computer science and a professor of electrical and computer engineering (courtesy), has been chosen as the 2017 Arden L. Bement Jr. Award recipient. One of Purdue University's top three research honors, the Bement Award is the most prestigious award the university bestows in pure and applied science and engineering.
Atallah is being honored for his significant contributions in the design and implementation of efficient processing and security protections for computer-based technologies.
“Dr. Atallah’s world-renowned work in algorithms, access hierarchies and information security combines deep theoretical approaches with solutions-based efficient designs to address the most challenging computer processing and security issues,” said Suresh Garimella, Purdue's executive vice president for research and partnerships and the Goodson Distinguished Professor of Mechanical Engineering, in announcing the winner. “His highly creative and innovative ideas and fresh viewpoints have had a major impact on the fields of distributed computing and cyber security.”
Atallah will deliver the Arden L. Bement Jr. Distinguished Lecture on Oct. 30 in Stewart Center's Fowler Hall. The 1:30 p.m. lecture is free and open to the public.
Among his accomplishments, Atallah settled longstanding open problems in data structuring for range-minimum queries and in data filtering with running-max filters. He designed an influential and award-winning technique for key management in access hierarchies and developed a divide-and-conquer technique to parallelize sequential algorithms, resulting in numerous optimal algorithms for solving complex geometric and combinatorial problems.
Atallah co-founded Arxan Technologies Inc., to commercialize a software protection technology developed jointly with his doctoral student Hoi Chang. Used in more than 500 million computing devices today, the technology consists of injecting self-protective mechanisms in software that make it harder to hack.
Atallah came to Purdue as an assistant professor of computer science in 1982 after earning a doctorate at Johns Hopkins University. He was named a full professor in 1989 and has been a distinguished professor since 2004. He is affiliated with the Center for Education and Research in Information Assurance and Security (CERIAS) and has a courtesy appointment in the School of Electrical and Computer Engineering.
He is a fellow of both the Association for Computing Machinery and IEEE (Institute of Electrical and Electronics Engineers). His work on key management received the 2015 CCS Test of Time Award. He was the 2016 recipient of the Purdue Sigma Xi Faculty Research Award, and the 2013 recipient of the Purdue Outstanding Commercialization Award. He has lectured frequently around the nation and the world as a keynote and invited speaker and has served on editorial boards of top journals and on program committees of top conferences and workshops.
The Arden L. Bement Jr. Award was established in 2015 by Purdue professor emeritus Arden Bement and his wife, Mrs. Louise Bement. The Bement Award recognizes Purdue faculty for outstanding and widely recognized contributions in the areas of pure and applied science and engineering.
Winners of the Bement Award are nominated by colleagues, recommended by a faculty committee and named by the university president. Recipients receive a cash award and a small support grant for their university scholarly activities.
The Department of Defense has mandated a risk management rather than risk avoidance approach in Cybersecurity. All Department of Defense programs are being directed to the Risk Management Framework (RMF) process. No Cyber system can be 100% secure. RMF mandates that we clearly determine the "value" of assets, such as information and intellectual property, and design systems to properly protect those assets. The commercial domain embraces the mantra that an organization should not spend more to protect the asset than the asset is worth. This presentation will provide an overview of RMF as applied to a specific publically available case study and highlight that utilizing commercial best practices can reduce cost of delivered systems to DoD.
Protocols satisfying Local Differential Privacy (LDP) enable parties to collect aggregate information about a population while protecting each user’s privacy, without relying on a trusted third party. LDP protocols (such as Google’s RAPPOR) have been deployed in real-world scenarios. In these protocols, a user encodes his private information and perturbs the encoded value locally before sending it to an aggregator, who combines values that users contribute to infer statistics about the population. In this paper, we introduce a framework that generalizes several LDP protocols proposed in the literature. Our framework yields a simple and fast aggregation algorithm, whose accuracy can be precisely analyzed. Our in-depth analysis enables us to choose optimal parameters, resulting in two new protocols (i.e., Optimized Unary Encoding and Optimized Local Hashing) that provide better utility than protocols previously proposed. We present precise conditions for when each proposed protocol should be used, and perform experiments that demonstrate the advantage of our proposed protocols.
In the last few years breaches at organizations like Yahoo!, Dropbox, Lastpass, AshleyMadison and Adult FriendFinder have exposed billions of user passwords to offline brute-force attacks. Password hashing algorithms are a critical last line of defense against an offline attacker who has stolen password hash values from an authentication server. An attacker who has stolen a user's password hash value can attempt to crack each user's password offline by comparing the hashes of likely password guesses with the stolen hash value. Because the attacker can check each guess offline it is no longer possible to lockout the adversary after several incorrect guesses. The attacker is limited only by the cost of computing the hash function. Offline attacks are increasingly commonplace and dangerous due to weak password selection and improved cracking hardware such as a GPU, Field Programmable Gate Array (FPGA) or an Application Specific Integrated Circuit (ASIC).
A secure password hashing algorithm should have the properties that (1) it can be computed quickly (e.g., at most one second) on a personal computer, (2) it is prohibitively expensive for an attacker to compute the function millions or billions of times to crack the user's password even if the attacker uses customized hardware. The first property ensures that the password hashing algorithm does not introduce an intolerably long delay for the user during authentication, and the second property ensures that an offline attacker will fail to crack most user passwords. Memory hard functions (MHFs), functions whose computation require a large amount of memory, are a promising cryptographic primitive to enable the design of a password hashing algorithm achieving both goals.
The talk will introduce and motivate the notion of memory hard functions and survey recent advances in the theory of MHFs. These results include (1) an attack on the Argon2i MHF, winner of the password hashing competition, which could reduce an amortized costs for a password attacker, (2) security lower bound for SCRYPT MHF and (3) construction of the first provably secure data-independent memory hard function.
The proliferation of wearable devices, e.g., smartwatches and activity trackers, with embedded sensors has already shown its great potential on monitoring and inferring human daily activities. In this talk, I will present a serious security breach of wearable devices in the context of divulging secret information (i.e., key entries) while people accessing key-based security systems. Existing methods of obtaining such secret information relies on installations of dedicated hardware (e.g., video camera or fake keypad), or training with labeled data from body sensors, which restrict use cases in practical adversary scenarios. I will show that a wearable device can be exploited to discriminate mm-level distances and directions of the user’s fine-grained hand movements, which enable attackers to reproduce the trajectories of the user’s hand and further to recover the secret key entries.
A vulnerability comes out and you need to know if you are vulnerable so you open up your vulnerability scanner and scan your systems to understand what you need to patch but what is that scanner doing to determine you are vulnerable. This talk will describe what that vulnerability scanner is doing and how we at Tenable write local, remote, and malware checks.
Unmanned airborne systems (UAS) provide a wide range of capabilities in areas such as agriculture, environmental monitoring, disaster relief, delivery of goods, media & communications and surveillance. While these systems are producing numerous benefits today they also can be used in manners that enable a broad range of security concerns. This talk will introduce the some of the technical challenges concerning the use of UAS, and approaches for counter UAS (C-UAS). SRC’s Silent Archer ™ system Counter-UAS System will also be introduced.
This first portion of the presentation will explore the emerging cyber threats facing the industrial control systems network environments with a focused look at the Power & Utility industry. It will then discuss the challenges faces advanced technical testing (i.e., Attack & Penetration Testing and Red Teaming) within this environment. The first section concludes with a discussion of current testing approaches and in the face of the above challenges, why testing remains an important capability in this space. The second portion of the presentation will present a proposed approach for performing Advanced Testing Services in this environment as well as discussing the legal and security implications of testing in this environment.
Current and recent events make it clear that cybersecurity requires defense in depth. Software development is both an early opportunity to begin the defense, and the source of many commonly exploited security vulnerabilities. Preventing coding errors and eliminating security flaws during development is an effective way to reduce security risks. This presentation promotes awareness among software practitioners of the how and why to do secure code development and software assurance, covering: · Software Assurance Definitions · Software Assurance Threat · Software Assurance Guidance and Regulations · Secure Coding Activities · Classic Vulnerability Examples
We have spent so much time focusing on Red and the images of security ninjas leaping off tall walls with laptops and grappling tools that the role of “blue” has been left in the dark…it’s underrated, nobody wants to do the job and typically it’s under appreciated and the unloved discipline…it’s time to change that. The focus on red has done nothing to help the industry protect our charges, we are still failing to protect those around us and we’re still watching helplessly while companies lose all the data we’re meant to protect…so time to change the focus. This talk will go through what’s happening in the industry to force this line of thinking, what WE need to do as an industry and where we have to take the concepts of communication and collaboration…We’ll look at several scenario’s and technologies that are helping reshape security and generally throw the crystal ball out to the future and help everyone understand that change needs to happen...
Operating system level auditing is one of the most important forensics techniques. With operating system level audit systems, e.g., the Linux audit system, investigators can generate attack causal graphs by analyzing the causal relationships between the logged events. However, traditional techniques usually generate large and inaccrute causal graphs. This is because applications are not aware of the existence of the OS level audit systems, and can not provide its own context information. To solve this problem, we propose MPI (short for Multiple Perspective attack Investigation), a semantics aware program annotation and instrumentation technique to partition process executions based on the application specific high level task structures. It converts current applications to be provenance-aware, generates execution partitions with rich semantic information and provides multiple perspectives of an attack. We develop a prototype and integrate it with three different provenance systems: the Linux Audit system, ProTracer and the LPM-HiFi system. The evaluation results show that our technique generates simple and accurate attack graphs with rich high-level semantics and has much lower space and time overheads.
In a provenance-aware system, mechanisms gather and report metadata that describes the history of each object being processed on the system, allowing users to understand how data objects came to exist in their present state. However, little attention has been given to securing provenance-aware systems. Provenance itself is a ripe attack vector, and its authenticity and integrity must be guaranteed before it can be put to use. In this talk, I will detail our efforts to bring trustworthy data provenance to computing systems. These efforts have led to the design and implementation of a provenance-aware operating system anchored in trusted hardware, and a mechanism that leverages the confinement properties provided by Mandatory Access Controls to perform efficient policy-based provenance collection. Using these architectures, I will demonstrate that provenance is an invaluable tool for combating critical security threats including data exfiltration, SQL injection, and even binary exploitation. By addressing key security and performance challenges, this work paves the way for the further proliferation of provenance capabilities.
As we push computers to “the edge” building an increasingly complex world of interconnected systems and devices, security and privacy continue to dominate the national conversation. The Defense Science Board in its 2017 report, Task Force on Cyber Defense, provides a sobering assessment of the current vulnerabilities in the U.S. critical infrastructure and the systems that support the mission essential operations and assets in the public and private sectors.
“…The Task Force notes that the cyber threat to U.S. critical infrastructure is outpacing efforts to reduce pervasive vulnerabilities, so that for the next decade at least the United States must lean significantly on deterrence to address the cyber threat posed by the most capable U.S. adversaries. It is clear that a more proactive and systematic approach to U.S. cyber deterrence is urgently needed…”
There is an urgent need to further strengthen the underlying systems, component products, and services that we depend on in every sector of the critical infrastructure—ensuring those systems, components, and services are sufficiently trustworthy and provide the necessary resilience to support the economic and national security interests of the United States. NIST Special Publication 800-53 (Revision 5) responds to the call by the Defense Science Board by embarking on a proactive and systemic approach to develop and make available to a broad base of public and private sector organizations, a comprehensive set of safeguarding measures for all types of systems, including general purpose computing systems, cyber-physical systems, cloud and mobile systems, industrial/process control systems, and IoT devices. Those safeguarding measures include security and privacy controls to protect the critical and essential operations and assets of organizations and the personal privacy of individuals. The ultimate objective is to make the systems we depend on more penetration resistant to attacks; limit the damage from attacks when they occur; and make the systems resilient and survivable.
Users routinely type sensitive data such as passwords, credit card numbers, and even SSN into their mobile phone apps and browsers. Rich functionality combined with weak security mechanisms makes protecting users’ data a challenging. In this talk, I will present a few case studies of applying information flow security to protecting users’ data in Android, the Chromium browser, and the IFTTT framework. For these systems, we show that dynamic coarse-grained taint tracking, even though it allows implicit flows, can be retrofitted into existing systems to defend users’ data from common attacks. I will explain the challenges in striking a balance between preserving key functionality of legacy systems and ensuring formally provable security guarantees and discuss how different modeling techniques affect noninterference proofs.
Applications written in C/C++ are prone to memory corruption, which allows attackers to extract secrets or gain control of the system. With the rise of strong control-flow hijacking defenses, non-control data attacks have become the dominant threat. As vulnerabilities like HeartBleed have shown, such attacks are equally devastating.
Data Confidentiality and Integrity (DCI) is a low-overhead non-control-data protection mechanism for systems software. DCI augments the C/C++ programming languages with annotations, allowing the programmer to protect selected data types. The DCI compiler and runtime system prevent illegal reads (confidentiality) and writes (integrity) to instances of these types. The programmer selects types that contain security critical information such as passwords, cryptographic keys, or identification tokens. Protecting only this critical data greatly reduces performance overhead relative to complete memory safety.
Our prototype implementation of DCI, DataShield, shows the applicability and efficiency of our approach. For SPEC CPU2006, the performance overhead is at most 16.34%. For our case studies, we instrumented mbedTLS, astar, and libquantum to show that our annotation approach is prac- tical. The overhead of our SSL/TLS server is 35.7% with critical data structures protected at all times. Our security evaluation shows DataShield mitigates a recently discovered vulnerability in mbedTLS.
After a series of recent high profile information security breach incidents, the role of Chief Information Officers, particularly their role in information security risk management, has been in a heated debate among practitioners. However, little is known in academic literature about how a CIOs’ risk aversion level affects the effectiveness of information security management. Using reported information security breach incidents during 2003-2015, this study examines how a CIO’s risk aversion level is associated to the possibility of information security incidents. In addition, we investigate the moderating effect of CEOs’ risk aversion level and whether the CIO is on the board on the aforementioned effect. Our preliminary results show that a CIO’s risk aversion level is significantly associated with a lower likelihood of information security breaches. We further document that such association varies depending on types of security breaches.
Whether it is a spear phishing attack, social engineering, or malware specifically tailored to obtain online banking credentials, hundreds of thousands of dollars are at risk to fund transfer fraud and other cyber-crime. Beyond the financial consequences of these cyber-attacks, entities face an increasingly complex array of legal obligations and issues in the aftermath of one of these events. This presentation will give an overview of trends in cyber-crime, legal issues that may arise from these events, how responses to the events affect potential liability, and how the law allocates responsibility between parties involved.
Malicious payload injection attacks have been a serious threat to software for decades. Unfortunately, protection against these attacks remains challenging due to the ever increasing diversity and sophistication of payload injection and triggering mechanisms used by adversaries.
In this talk, I will present A2C, a system that provides general protection against payload injection attacks. A2C is based on the observation that payloads are highly fragile and thus any mutation would likely break their functionalities. A2C mutates inputs from untrusted sources. Malicious payloads that reside in these inputs are hence mutated and broken. To assure that the program continues to function correctly when benign inputs are provided, A2C divides the state space into exploitable and post-exploitable sub-spaces, where the latter is much larger than the former, and decodes the mutated values only when they are transmitted from the former to the latter. A2C does not rely on any knowledge of malicious payloads or their injection and triggering mechanisms. Hence, its protection is general. We evaluate A2C with 30 real-world applications, including apache on a real-world work-load, and our results show that A2C effectively prevents a variety of payload injection attacks on these programs with reasonably low overhead.
In this talk, we will leverage the framework of game theory to understand the effects of decentralized decision-making on the robustness and security of large-scale networked systems.
In the first part of this talk, we will consider a setting where each node in the network is an independent decision maker who wants to protect itself, and the probability of attack on a node is a function of the security investment by the node and its immediate neighbors in the network. Accordingly, the security investment of a node depends on its position in the network and its perception of attack probability. We will investigate the impact of certain empirically established behavioral biases, that affect how users perceive probabilities of risky outcomes, on the security investment decisions of the nodes. We will further characterize the structures of networks that maximize and minimize the expected fraction of nodes that are successfully attacked at the Nash equilibrium of the game, respectively.
In the second part of the talk, we will consider a setting where each decision maker is responsible for defending multiple nodes in the network, and strategic attacker(s) launch multi-stage attacks that spread through the network. We will show that the problem of computing the best response for a defender can be formulated as a convex optimization problem. We will then illustrate the application of this framework in problems that arise in networked cyber-physical systems.
Large corporations evolve over time. The technology they produce, the services they provide, the working practices and the IT that supports are changing at an ever increasing rate. From its formation in 1906, Rolls-Royce has been synonymous will high quality engineering and currently develops power systems to propel commercial airliners to Luxury Yachts. The company strives to maintain its market leading position through considerable investment in R&D and the Intellectual Property and engineering ‘know-how’ developed needs to be kept secure in Cyber Space.
The threat landscape is changing significantly; complexity and rate of attacks is ever increasing, and the network defender does not have enough resources (people, technology, intelligence, and context) to make informed decisions. The need for network defenders to develop and create proactive threat intelligence is on the rise. Network deception may provide analysts the ability to collect raw intelligence about threat actors as they reveal their Tools, Tactics, and Procedures (TTP). This increased understanding of the latest cyber-attacks would enable cyber defenders to better support and defend the network, thereby increasing the cost to the adversary by making it more difficult to successfully attack an enterprise. This talk will discuss our deception framework, we have created a live, unpredictable, and adaptable Deception Environment leveraging virtualization/cloud technology, software defined networking, introspection and analytics. The environment not only provides the means to identify and contain the threat, but also facilitates the ability to study, understand, and develop protections against sophisticated adversaries. By leveraging actionable data, in real-time or after a sustained engagement, the Deception Environment may be easily modified to interact with and change the perception of the adversary on-the-fly. This ability to change what and where the attacker is on the network, as well as change and modify the content of the adversary on exfiltration and infiltration, is the defining novelty of our Deception Environment.
BGP enables as a network of networks, and is also a network of trust. The most clear instantiation of that trust is the updating of router tables based on unsubstantiated announcements. The positive result of this trust is that the network can be extremely responsive to failures, and recover quickly. Yet the very trust that enables resilience creates risks from behavior lacking either technical competence or benevolence. Threats to the control plane have included political interference, misguided network configurations, and other mischief. Our goal is to look at solutions that treat BGP as an economic political artifact that embeds trust, and change the game in BGP defense.
One step is to classify route updates along a continuum of trust, exploring new algorithms that will give a measure of integrity assurance to BGP updates. We have explored the application of machine learning techniques with the variety of data available (technical, rates of change, economic, and geopolitical) as network topology is changed via BGP updates in order to generate probabilistic (not only cryptographic) trust indicators for those changes. With this understanding, we develop technologies that embed economic incentives that have immediate value to the adopting party and also have second order system-wide security properties.
In this talk I begin with the definition of the problem as economic, describe empirical work in macro-economics of security, and close with the description of an example solution called Bongo.’
Cybersecurity threats are constantly evolving and becoming more sophisticated. This has been observed through advanced spear phishing campaigns, increase in ransomware families/variants and the use of IoT devices for DDOS attacks. As well, the tactics, techniques and procedures (TTPs) utilize by bad actors are evolving with the technology and seemingly staying one step ahead of security technologies. This presentation will look at some of the trends from the past year and look at the emerging cyber threats for 2017 and beyond.
Differential privacy aims at learning information about the population as a whole, while protecting the privacy of each individual. With its quantifiable privacy and utility guarantees, differential privacy is becoming standard in the field of privacy-preserving data analysis. On the other hand, most cryptographic systems for their privacy properties rely on a stronger notion of indistinguishability, where an adversary should not be able to (non-negligibly) distinguish between two scenarios. Nevertheless, there exists some cryptographic system scenarios for which the notion of indistinguishability is known to be impossible to achieve. It is natural to ask if one can define differential privacy-motivated privacy notions to accurately quantify the privacy loss in those scenarios. In this talk, we will study two such scenarios.
Our first scenario will consider (non-)uniform randomness employed in cryptographic primitives. It is well-known that indistinguishability-based definitions of cryptographic primitives are impossible to realize in systems where parties only have access to non-extractable sources of randomness. I will demonstrate that it is, nevertheless, possible to quantify this secrecy (or privacy) loss due to some non-extractable sources (such as the Santha-Vazirani sources) using a generalization of indistinguishability inspired by differential privacy.
Our second scenario will capture privacy properties of anonymous communication networks (e.g., Tor). In particular, I will present our AnoA framework that relies on a novel relaxation of differential privacy to enables a unified quantitative analysis of properties such as sender anonymity, sender unlinkability, and relationship anonymity.
Processor caches and memory chips are hardware components used by all software programs on a computer system. They are designed, and thereafter fine-tuned over the years, for better performance and power efficiency, but not for strong isolation between mutually distrustful software programs. However, modern computing paradigm has been shifting towards resource sharing without full trust: In multi-tenant public clouds, virtual machines controlled by different customers are scheduled to run on the same cloud servers; in mobile devices, untrusted third-party apps, though isolated using sandboxes, share the same devices with sensitive apps. Our research question is whether sharing of memory resources will introduce new security threats to these systems.
In this talk, we highlight a type of security threats that we call cache-memory attacks. These attacks are possible due to insufficient isolation in hardware memory resources (e.g., various levels of caches, memory controllers, buses and chips, etc.) that are shared between malevolent and sensitive software programs. We coin cache-memory attacks as the umbrella terms of side-channel attacks (i.e., confidentiality attacks), row-hammer attacks (i.e., integrity attacks) and resource contention attacks (i.e., availability attacks). We will discuss the root vulnerabilities of these attacks and their exploitation in the context of clouds and mobile devices. We will also cover some defense techniques against these attacks that we have developed over the past few years.
Over the past decade, the Advanced Persistent Threat (APT) has risen to forefront of cybersecurity threats. APTs are a major contributor to the billions of dollars lost by corporations around the world annually. The threat is significant enough that the Navy Cyber Power 2020 plan identified them as a “must mitigate” threat in order to ensure the security of its warfighting network. This presentation and its related research applies the science of Natural Language Processing Open Source Intelligence in order to build an open source Ontology in the APT domain.
Configuration is the glue for logically integrating cyber infrastructure components to satisfy end-to-end requirements on security and functionality. Every component has a finite number of configuration variables that are set to definite values. It is well-documented that configuration errors are responsible for 50%-80% of infrastructure vulnerabilities and downtime and it can take months to set up and adapt infrastructure. This is because the large conceptual gap between requirement and configuration is manually bridged. This talk presents a Science of Configuration to automatically bridge this gap. The Science is embodied in the Distributed Assured and Dynamic Configuration (DADC) suite of tools for requirement specification, configuration synthesis, repair, vendor-specific adaptation, visualization, emulation, verification, distributed configuration, in-band configuration, reconfiguration planning and moving-target defense. DADC leverages modern SMT solvers that can solve a million constraints in a million variables in seconds, and group communication protocols that provide total-ordering message delivery guarantees. We will sketch a new application of DADC to cloud configuration.
The paper will briefly review the achievements of natural language information assurance and security, a Purdue-native innovative stand of research and applications, from NL watermarking and tamperproofing to deception detection, anonymization and now to implicit meaning, conceptual defaults, computational humor, and robotic intelligence and security. I will also briefly show a new acquisition and processing resource at https://engineering.purdue.edu/~ost/.
A typical computer user today manages passwords for many different online accounts. Users struggle with this task ---often forgetting their passwords or adopting insecure practices, such as using the same passwords for multiple accounts and selecting weak passwords. Before we can design good password management schemes it is necessary to address a fundamental question: How can we quantify the usability or security of a password management scheme? In this talk we will introduce quantitative usability and security models. Notably, our user model, which is based on research on human memory about spaced rehearsal, allows us to analyze the usability of a large family of password management schemes while experimentally validating only the common user model underlying all of them. We argue that these quantitative models can guide the development of usable and secure password management schemes. In support of our argument we present Shared Cues, a simple password management scheme in which the user can generate many strong passwords after memorizing a few randomly generated stories. Our password management schemes are precisely specified and publishable: the security proofs hold even if the adversary knows the scheme and has extensive background knowledge about the user (hobbies, birthdate, etc.).
This talk is based on joint work with Manuel Blum and Anupam Datta
References: http://arxiv.org/abs/1302.5122 http://arxiv.org/pdf/1410.1490v1.pdf
Failing to properly isolate components in the same address space has resulted in a substantial amount of vulnerabilities. Enforcing the least privilege principle for memory accesses can selectively isolate software components to restrict attack surface and prevent unintended cross-component memory corruption. However, the boundaries and interactions between software components are hard to reason about and existing approaches have failed to stop attackers from exploiting vulnerabilities caused by poor isolation. We present the secure memory views (SMV) model: a practical and efficient model for secure and selective memory isolation in monolithic multithreaded applications. SMV is a third generation privilege separation technique that offers explicit access control of memory and allows concurrent threads within the same process to partially share or fully isolate their memory space in a controlled and parallel manner following application requirements. An evaluation of our prototype in the Linux kernel (TCB < 1,800 LOC) shows negligible runtime performance overhead in real-world applications including Cherokee web server (< 0.69%), Apache httpd web server (< 0.93%), and Mozilla Firefox web browser (< 1.89%) with at most 12 LOC changes.
Communications Security, Computer Security, Information Security, Information Assurance, Information Operations, Cyber Security: through a 35-year career at the National Security Agency, and now with the non-profit Center for Internet Security, Tony has been a participant, observer, and shaper of the world we now call Cyber Security. Since he?s never had another job (or some might say, never had a real job), through the lens of his career he will share his observations about the evolution of Cyber Security from a de facto government monopoly focused on national security and technology, to an issue that touches every one of us, in every aspect of our lives. Beyond the bumper stickers and rah-rah of Public-Private-Partnership, he?ll also describe the new models of cooperation between government and industry that we need for success.
Cyber-liability insurance has grown from a niche product into a multi-billion-dollar market in less than a decade. It has also become a negotiating point in technology-related contracts and a buzzword for corporate boards. In this seminar, we will discuss how this new insurance market has developed -- surveying the spectrum of “cyber” insurance products and outlining what events these products are (and are not) intended to cover. We will also discuss underwriting problems (information asymmetry, correlated losses, etc.) and how these underwriting problems are causing insurers to increasingly dictate security practices and behavior. Finally, we will discuss the future of cyber-liability insurance and how a major event could shift the market’s focus or even lead to government intervention.
Over the last seven years we have been observing a tremendous growth of crypto-currencies such as Bitcoin and IOU credit networks such as Ripple. Their decentralized and pseudonymous nature, ability to perform transactions across the globe in a matter of seconds, and potential to monetize everything regardless of jurisdiction have been pivotal to their success so far. Despite some major hiccups, their market capitalization is increasing steadily over the years. It is now believed that, in the form of the blockchain technology and the internet of value, these concepts are here to stay.
In this talk, I will first present some of our recent and ongoing efforts to improve the privacy of these inherently distributed systems. I will define the concept of peer-to-peer mixing, present an efficient P2P mixing protocol, and instantiate it in Bitcoin and Ripple. In the latter half of the talk, I will present an innovation application for these payment systems. In particular, I will present a novel Bitcoin-based smart contact for non-disclosure agreement (NDA) among mutually distrusting partners that monetarily penalizes malicious disclosures of the confidential documents.
In this presentation the speaker will give an introduction to the GM product cybersecurity organization and the efforts that is being undertaken by this organization to drive a better product cybersecurity posture. Many various interesting aspects will be discussed in the presentation, e.g., vehicle cybersecurity ecosystem, connected vehicle attack surfaces, external industry/academia collaborations, security vulnerability disclosure program, challenges for the automotive industry, future research directions, and automotive cybersecurity talents, etc. Come and join up for a very informative session!
I will be discussing Improving Outcomes with Services. Including a deep dive into Advanced Threat Analytics and how Cisco Active Threat Analytics (ATA) integrates deep expertise with cutting-edge technology, leading intelligence, and advanced analytics to detect and investigate threats with great speed, accuracy, and focus. There will be talks and examples of Proactive Threat Hunting: Activities involving seeking out malicious activity not identified by traditional alerting mechanisms. Hunting methods are documented in a living play-book that is continuously updated as threats and malicious campaigns evolve. Our expert investigators monitor customer networks 24x7 from our global network of state-of-the-art security operations centers, providing constant vigilance and in-depth analysis as a comprehensive security solution.
Current general-purpose CPUs are multicores, offering multiple computing units within a single chip. The performance of programs on these architectures, however, does not necessarily increase proportionally with the number of cores. Designing concurrent programs to exploit these multicores emphasizes the need for achieving efficient synchronization among threads of computation. When there are several threads that conflict on the same data, the threads will need to coordinate their actions for ensuring correct program behaviour. Traditional techniques for synchronization are based on locking that provides threads with exclusive access to shared data. Coarse-grained locking typically forces threads to access large amounts of data sequentially and, thus, does not fully exploit hardware concurrency. Program-specific fine-grained locking or non-blocking (i.e., not using locks) synchronization, on the other hand, is a dark art to most programmers and trusted to the wisdom of a few computing experts. Thus, it is appealing to seek a middle ground between these two extremes: a synchronization mechanism that relieves the programmer of the overhead of reasoning about data conflicts that may arise from concurrent operations without severely limiting the program’s performance. The Transactional Memory (TM) abstraction is proposed as such a mechanism: it intends to combine an easy-to-use programming interface with an efficient utilization of the concurrent-computing abilities provided by multicore architectures. TM allows the programmer to speculatively execute sequences of shared-memory operations as atomic transactions with all-or-nothing semantics: the transaction can either commit, in which case it appears as executed sequentially, or abort, in which case its update operations do not take effect. Thus, the programmer can design software having only sequential semantics in mind and let TM take care, at run-time, of resolving the conflicts in concurrent executions. It is important that the intermediate state witnessed by each transaction be "safe"; if it is not consistent with any sequential execution, then the application may experience a fatal irrecoverable error or enter an infinite loop. In this talk, we focus on implementing safe TM implementations and the inherent complexities associated with them.
Applications are only as secure as the network architecture and operating systems in which they operate. It is only a matter of time before services, networks, or applications are targeted by bad actors even if they are not directly exposed to the public Internet. In this seminar we will discuss some of the patterns seen in secure application development and the anti-patterns that should be avoided. Then we will examine how to best implement these practices both as an individual and within organizations throughout the software development lifecycle.
In this work we present a simple, yet effective and practical, scheme to improve the security of stored password hashes, rendering their cracking detectable and insuperable at the same time. We utilize a machine-dependent function, such as a physically unclonable function (PUF) or a hardware security module (HSM) at the authentication server to prevent off-site password discovery as well as a deception mechanism to alert administrators of such attempts. Our scheme can be easily integrated with legacy systems without the need for any additional servers, changing the structure of the hashed password file or any client modifications. When using the scheme the structure of the hashed passwords file, etc/shadow or etc/master.passwd, will appear no different than in the traditional scheme. However, when an attacker exfiltrates the hashed passwords file and tries to crack it, the only passwords she will get are the ErsatzPasswords— the “fake passwords”. When an attempt to login using these ErsatzPasswords is detected an alarm is triggered. Even with an adversary who knows about the scheme, cracking cannot be launched without physical access to the authentication server. The scheme also includes a secure backup mechanism in the event of a failure of the hardware dependent function. ErsatzPassword is flexible by design, enabling the proposed scheme to be integrated to existing authentication systems without changes to user experience. The proposed scheme is integrated into the pam_unix module as well as two client/server authentication schemes: LDAP authentication and the Pythia PRF Service [Everspaugh et al. 2015]. The core library to support ErsatzPassword in C and Python required 255 and 103 lines of code, respectively. The integration of ErsatzPassword for each explored authentication systems required less than 100 lines of code. Experimental evaluation of ErsatzPassword shows an increase of authentication latency in the order of 100 ms, which may be acceptable for end user experience. A framework for implementing ErsatzPassword using the Trusted Platform Module (TPM) provides a greater sense of machine-dependent functionality to resist offline attacks.
Annual Symposium 2016 Tech Talk Kelley Misata, Ph.D. Candidate, Interdisciplinary Information Security - Purdue University
Dickie George spent 41 years working for the National Security Agency as a cryptographer. As a member of the Intelligence Community, you learn to live as a target. However the world has changed – communications systems, the internet, on-line life (banking, shopping, social life) – the set of targets, the type of information that is sought, and the adversary have all changed significantly. We’ll discuss those changes, how they impact us all, and how today’s cyber professionals need to address this threat to protect government, industry, and individuals.
A credit network models trust between agents in a distributed environment and enables payments between arbitrary pairs of agents. With their flexible design and robustness against intrusion, credit networks form the basis of several Sybil-tolerant social networks, spam-resistant communication protocols, and payment systems.
In the first half of the talk, we introduce the concept of credit network and its application in the currently deployed Ripple payment system. We further characterize the privacy issues in Ripple as the result of clustering heuristics to group wallets based on observations on the publicly available Ripple network graph. In the second half of the talk, we show PrivPay, the first provably secure privacy-preserving payment protocol for credit networks. The distinguishing feature of PrivPay is the computation of the maximal credit between two agents without revealing any information about the credit network, the transaction or the agents themselves. Finally, we present our results on privacy-preserving payments on a distributed credit network, where each agent locally stores its own financial information.
Several newly emerged wireless technologies (e.g., Internet-of-Things)---extensively backed by the tech industry---are being widely adopted and have resulted in a proliferation of diverse smart appliances and gadgets (e.g., smart thermostat, wearables, smartphones), which has ensuingly shaped our modern digital life. These technologies utilize several communication protocols that usually have stringent requirements stated in their specifications or standards, which their implementations are expected to comply with. Noncompliance exhibited by an implementation can cause interoperability issues, inconsistent behavior, or even security vulnerabilities.
Automatically detecting whether a protocol implementation is noncompliant with a given property is a long-standing and challenging problem. Moreover, lack of robustness in a protocol implementation to malicious attacks---exploiting subtle vulnerabilities in the implementation---mounted by the compromised nodes in an adversarial environment can limit the practical utility of the implementation by impairing the performance of the protocol and can even have detrimental effects on the availability of the network.
Given the stake associated with these wireless technologies, the requirement to ensure secure and reliable operations of the protocol implementations calls for pre-deployment measures. In this talk, I will focus on fortifying these emerging technologies along two dimensions. I will first present an automated framework that enables a developer to check whether a protocol implementation violates its desired properties derived from its specifications and standards.
Finally, I will present an automated adversarial testing platform to help developers find malicious attacks that impair the performance of their protocol implementations.
Using the Internet is a risky venture: cybercriminals could be lurking behind any email or in any web page, just waiting to compromise your machine. Practicing and researching cybersecurity is about minimizing that risk. Unfortunately, modern cybercriminals don't compromise machines just because they can - they do it to make money or steal data. Likewise, the risks that end users care about aren't measured in vulnerabilities discovered or hosts compromised, they care about losing hard earned money, embarrassing pictures, or simply a night of their free time because they had to remove malware from the family computer. Cybersecurity research should minimize the chance of successful attacks by maximizing the number of vulnerabilities patched or infiltrations thwarted. However, these technical goals are fundamentally intermediate goals: the ultimate goal of cybersecurity is to minimize the amount of harm that comes to users, which is a quantity denominated in dollars lost, days spent recovering from attacks, or data lost to attackers. By quantifying the harm of these attacks in these meaningful quantities, we can focus defenses and mitigations on the attacks that cause the most harm to the Internet's users.
This presentation will highlight recent results that improve our understanding the true cost of cybercrime. I'll also show how these results can lead to actionable insights into which attacks we should be spending our finite effort combating. I'll cover losses due to affiliate fraud, measured in profits lost, both by the platforms and legitimate marketers. I'll also cover losses incurred due to typosquatting: while typosquatting is perpetrated by thousands upon thousands of domains, the harm caused is not clear. We use a model which quantifies how many visitors legitimate sites lose and how much time end users waste when they visit these sites. Finally, I'll showcase a tool which quantifies the value of a user's private data (their account logins), which can motivate better security behavior through a personalized warning regarding how much their account might be worth to cybercriminals.
Recent concerns about government surveillance have focused attention on secure communication tools for the masses. The security properties of these tools receive more attention than their usability properties. This talk will cover our recent effort to design a usable secure webmail system. We have conducted a number of studies to analyze existing tools and our own systems to determine whether these tools are usable by the masses to communicate securely.
Most recently, to determine whether secure email is ready for grassroots adoption, we conducted a laboratory user study that recruits pairs of novice users to install and use several of the latest systems to exchange secure messages. We will discuss both quantitative and qualitative results from 25 pairs of novice users as they use Pwm, Tutanota, and Virtru. Participants report being more at ease with this type of study and better able to cope with mistakes since both participants are “on the same page”. We find that users prefer integrated solutions over depot-based solutions, and that tutorials are important in helping first-time users. Hiding the details of how a secure email system provides security can lead to a lack of trust in the system. Participants expressed a desire to use secure email, but few wanted to use it regularly and most were unsure of when they might use it.
Private information retrieval (PIR) is a way for clients to query a remote database without the database holder learning the clients' query terms or the responses they generate. Compelling applications for PIR abound in the cryptographic and privacy research literature, yet existing PIR techniques are notoriously inefficient. Consequently, no such PIR-based application to date has seen real-world at-scale deployment. In this talk, I will discuss some ongoing research that unifies "batch query" and "batch coding" techniques to help address PIR's efficiency problem. The new approach exploits the connection between 'ramp secret sharing schemes' and multi-server, information-theoretically secure PIR (IT-PIR) protocols, thereby enabling clients to fetch several records from an IT-PIR database for only a fraction the cost of fetching a single record using the standard approach. The approach is highly tuneable, and I will briefly discuss interesting asymptotic phenomenon that arise with extremal settings of the various tuning knobs.
Traditional approaches to securing systems tend to be fixed and mostly non adaptive. The Policy that defines the security posture is in some sense "hardcoded". In this talk, we focus on approaches to securing systems using approaches that have declarative policies that factor in dynamically evolving context. The approach is grounded in W3C standard representation formats for knowledge and formal logic. We show instances of this approach in two different network settings -- mobile devices and intrusion detection.
User authentication and identity management are the first-gate defense and access protection for cyber systems. Authentication failures, including post-authentication attacks, have caused constant system breaches and resulted in serious economic and social consequences to governments, enterprises, and individuals.
Passwords or smartcards have issues related to true identity, loss/theft, interoperability, cross-system password vulnerability, and post-authentication attacks. It is frustrating to memorize passwords and painful when one cannot log into a system because of forgetting the password. Due to biometrics' memorization-free, identity-binding and loss-resistant properties, assisted with widely-deployed built-in biometric sensors in mobile devices, biometric authentication is becoming more feasible and very attractive. However, biometrics technology introduces its own challenges. One serious problem is that biometric templates are hard to replace once compromised. In addition, biometrics may disclose a user's sensitive information (e.g., race, gender, even health condition), thus creating user privacy concerns.
A demo at Black Hat USA 2015 has alerted the public: fingerprints stored on smartphones can be stolen--remotely and at a large scale. The lost biometrics cannot be revoked and the individual's biometric identity becomes permanently void. A most recent event ``iPhone Error 53" has shocked the real world, and both angered and worried end customers: the iPhones of thousands of iPhone 6 users were killed after their iPhones' touch ID home buttons were repaired (by any third party), which was caused by touch IDs' irrevocability due to the physical binding of fingerprint touch ID with the home button.
In this talk, we will present a new biometric authentication method --Biometric Capsule which can address the aforementioned issues. Unlike existing biometric authentication methods, Bio-Capsule (BC) is a template derived from the secure fusion of a user's biometrics and that of a Reference Subject (RS). The RS is simply a physical object, e.g., a doll, or an artificial one, e.g., an image. Theoretical analysis and experiments have shown that the BC mechanism is solid and efficient. BC is replaceable, non-invertible (thus, preserving privacy), and resilient.
Which song will Smith listen to next? Which restaurant will Alice go to tomorrow? Which product will John click next? These applications have in common the prediction of user trajectories that are in a constant state of flux but subject to hidden constraints (e.g. geographical location, the links of a website). What users are doing now may be unrelated to what they will be doing in an hour from now. In this talk I introduce the difficulties associated with predicting user trajectories, more specifically how the concepts of non-stationary, transiency, and time-heterogeneity make this task challenging. Mindful of these difficulties I introduce Tribeflow, a general method that can perform next product recommendation, next song recommendation, next location prediction, and general arbitrary-length user trajectory prediction without domain-specific knowledge. Extensive simulations on large and small datasets show TribeFlow to be more accurate and up to 413x faster than top state-of-the-art competitors.
The Indiana Information Sharing and Analysis Center (IN-ISAC) is an entity developed by the State of Indiana and key partners to mitigate cybersecurity risks for the State of Indiana. The IN-ISAC will accomplish this through sharing threat information and collaborating with the public, private industry, local government and other governmental agencies.
Modern Cryptography provides algorithmic solutions to securely compute over the private data of mutually distrustful parties. These solutions require algorithmic or physical building blocks such as computational hardness assumptions, trusted hardware, correlated private randomness and noisy channels. A fundamental limitation of these solutions is that their security necessarily hinges on the assumption that these underlying building blocks are free of any imperfection. Over the last decade, however, this assumption has been repeatedly proven false in the real world, often rendering these solutions completely insecure.
This raises the following important question: “Can secure computation be based on imperfect building blocks?”
My research provides algorithmic solutions that resolve this question in the affirmative.
Technological advances and novel applications, such as sensors, cyber-physical systems, smart mobile devices, cloud systems, data analytics, and social networks, are making possible to capture, and to quickly process and analyze huge amounts of data from which to extract information critical for security-related tasks. In the area of cyber security, such tasks include user authentication, access control, anomaly detection, user monitoring, and protection from insider threat. By analyzing and integrating data collected on the Internet and Web one can identify connections and relationships among individuals that may in turn help with homeland protection. By collecting and mining data concerning user travels and disease outbreaks one can predict disease spreading across geographical areas. And those are just a few examples; there are certainly many other domains where data technologies can play a major role in enhancing security. The use of data for security tasks is however raising major privacy concerns. Collected data, even if anonymized by removing identifiers such as names or social security numbers, when linked with other data may lead to re-identify the individuals to which specific data items are related to. Also, as organizations, such as governmental agencies, often need to collaborate on security tasks, data sets are exchanged across different organizations, resulting in these data sets being available to many different parties. Apart from the use of data for analytics, security tasks such as authentication and access control may require detailed information about users. An example is multi-factor authentication that may require, in addition to a password or a certificate, user biometrics. Recently proposed continuous authentication techniques extend access control system. This information if misused or stolen can lead to privacy breaches. It would then seem that in order to achieve security we must give up privacy. However this may not be necessarily the case. Recent advances in cryptography are making possible to work on encrypted data – for example for performing analytics on encrypted data. However much more needs to be done as the specific data privacy techniques to use heavily depend on the specific use of data and the security tasks at hand. Also current techniques are not still able to meet the efficiency requirement for use with big data sets. In this talk we will discuss methods and techniques to make this reconciliation possible and identify research directions.
The computer science community has had a growing research focus in Privacy over the last decade. Much of this has really focused on confidentiality: Anonymization, computing on encrypted data, access control policy, etc. This talk will look at a variety of research results in this area, including “weaker” approaches than the absolutes typically considered in the security community, and how they all come down to the same basic concept of providing confidentiality.
Privacy is much more complex. People are often willing to allow use of their data – but not just for anything. This talk will look at such other privacy issues, such as harm to individuals and society from the fear of disclosure or misuse of private data. The talk will conclude with ideas for new research directions in privacy.
Threat-driven security is a systematic system-level approach that is driven by a clear understanding of the security need – it is not arbitrary application of security technologies based on their perceived effectiveness or hype. Using this systematic approach, the strength of a protection is easily gauged through simple identification of the weakest link in the design. This presentation will review our approach to identifying security vulnerabilities, determining viable mitigations, and developing a threat tree that leads to a robust threat-driven protection.
Making conflicting statements to others, or equivocation, is a simple yet remarkably powerful tool of malicious participants in distributed systems of all kinds. In distributed computing protocols, equivocation leads to Byzantine faults and fairness issues. In this talk, I will cover my recent work towards preventing or penalizing equivocations in decentralized Systems.
In the first half of the talk, we study how the resilience of asynchronous distributed computing tasks such as Byzantine agreement and multiparty computation can be improved using an increment-only counter that implements non-equivocation, a mechanism to restrict a corrupted party from making conflicting statements to different (honest) parties. In the second half of the talk, we show how equivocation can be monetarily disincentivized by the use of crypto-currencies such as Bitcoin. To this end, we have designed completely decentralized non-equivocation (smart) contracts, which make it possible to penalize an equivocating party by the loss of its money.
Females are significantly less likely to pursue tech-focused careers, and have significantly lower self-efficacy in technical domains. Despite initiatives to increase female participation in STEM majors, the percentage of females pursuing college degrees in computer and information science actually decreased between 2004 and 2012 in the United States. Towards the ultimate goal of increasing female representation in the cyber workforce, it is important to spark and nurture females’ engagement and self-efficacy during formative years in middle and high school. As a first step, we need to define and measure cybersecurity engagement and self-efficacy. In this talk, I will discuss my work in the area of cybersecurity engagement and self-efficacy measurement by introducing the Cybersecurity Engagement and Self-Efficacy Scale. I present results from a pilot study of 34 participants (ages 13 – 17) that tracked growth in cybersecurity engagement and self-efficacy across three time points. Overall, females initially demonstrated significantly lower cybersecurity engagement and self-efficacy relative to males. However, over the course of five days of hands-on learning and simulated cyber-attack, female participants demonstrated significantly greater growth over time and the gender-based gaps in cybersecurity engagement and self-efficacy disappeared. This suggests that informal, activity-based learning experiences are crucial for reducing gender-based gaps in cyber-related domains and may serve as a starting point for promoting female participation, pursuit, and persistence in applied cybersecurity.
In many envisioned drone-based applications, drones will communicate with many different smart objects, such as sensors and embedded devices. Securing such communications requires an effective and efficient encryption key establishment protocol. However, the design of such a protocol must take into account constrained resources of smart objects and the mobility of drones. In this paper, a secure communication protocol between drones and smart objects is presented. To support the required security functions, such as authenticated key agreement, non-repudiation, and user revocation, we propose an efficient Certificateless Signcryption Tag Key Encapsulation Mechanism (eCLSC-TKEM). eCLSC-TKEM reduces the time required to establish a shared key between a drone and a smart object by minimizing the computational overhead at the smart object. Also, our protocol improves drone's efficiency by utilizing dual channels which allows many smart objects to concurrently execute eCLSC-TKEM. We evaluate our protocol on commercially available devices, namely AR.Drone2.0 and TelosB, by using a parking management testbed. Our experimental results show that our protocol is much more efficient than other protocols.
Is it possible for Alice to compute a result and for Bob to be convinced of its correctness without having to reexecute the computation? What if the computation is performed over sensitive data that Bob is not allowed to see due to privacy concerns? Recent work on proof-based verifiable computation has brought these goals much closer to practicality. In this talk, I will present two implemented systems that incorporate verifiable computation in order to build realistic applications. The first, Pantry, enables a user to outsource a general-purpose computation to a potentially faulty cloud provider and yet verify that the computation was performed correctly. Unlike prior efforts, Pantry allows verifiable computations to operate on remotely-stored data, opening the way to a wide variety of uses such as MapReduce jobs and database queries.
The second system, VerDP, aims to resolve the conflict in many research studies between the verifiability of the results and the privacy of the study participants. VerDP accepts queries over sensitive data that are written in a domain-specific language and processes them only if a) it can certify that the result will not compromise individuals’ privacy, and if b) it can prove the integrity of the result to the public. Experimental evaluation shows that VerDP can successfully process several types of useful queries, and that the cost of generating and verifying the proofs is practical.
Secure multiparty computation (MPC) and differential privacy are two notions of privacy that deal respectively with how and what functions can be privately computed. In this talk, I will first give an overview of MPC and differential privacy. Then, I will show how to build a two party differentially private secure protocol in the presence of semi-honest and malicious adversaries.
Computing a differentially private function using secure function evaluation prevents private information leakage both in the process, and from information present in the function output. However, the very secrecy provided by secure function evaluation poses new challenges if any of the parties are malicious. We then relax the utility requirement of computational differential privacy to reduce computational cost, still giving security with rational adversaries. Finally, we provide a modified two-party computational differential privacy definition and show correctness and security guarantees in the rational setting.
This presentation is a detailed case study of the Authur Pendragon cyber threat that occurred at The University of Alabama on September 21, 2014. The Authur Pendragon threat instigated mass fear, social media hyperactivity, and rumor mongering, all of which reached beyond The University of Alabama campus. A timeline of the event, which includes social media posts, official University responses, and mass media coverage, are presented followed by an analysis of the case from a socio-psychological and communications perspective using Social Attachment Model and Theory of Proximity. Recommendations for managing University cyber threats and rumor mongering are discussed.
Privacy has been a hot issue since early 2000s, in particular with the rise of social network and data outsourcing. Data privacy is a big concern in data outsourcing because it involves sharing personal data with third parties. In this talk, I will give an introduction to data privacy on topics such as privacy standards, data anonymization techniques, and data anonymization usage in data outsourcing and data mining. Then, I will present our work in data mining using anonymized data. We propose a data publisher-third party decision tree learning method for outsourced private data. The privacy model is anatomization/fragmentation: the third party sees data values, but the link between sensitive and identifying information is encrypted with a key known only to data publisher. Data publishers have limited processing and storage capability. Both sensitive and identifying information thus are stored on the third parties. The approach presented also retains most processing at the third parties, and data publisher-side processing is amortized over predictions made by the data publishers. Experiments on various datasets show that the method produces decision trees approaching the accuracy of a non-private decision tree, while substantially reducing the data publisher's computing resource requirements.
Private record linkage protocols allow multiple parties to exchange matching records, which refer to the same entities or have similar values, while keeping the non-matching ones secret. Conventional protocols are based on computationally expensive cryptographic primitives and therefore do not scale. To address these scalability issues, hybrid protocols have been recently proposed that combine differential privacy techniques with secure multiparty computation techniques. However, a drawback of such protocols is that they disclose to the parties both the matching records and the differentially private synopses of the datasets involved in the linkage. Consequently, differential privacy is no longer always satisfied. To address this issue, we propose a novel framework, which separates the private synopses from the matching records. The two parties do not access the synopses directly, but still use them to efficiently link records. We theoretically prove the security of our framework. In addition, we have developed a simple but effective strategy for releasing private synopses. Extensive experimental results show that our framework is superior to the existing methods in terms of both recall rate and efficiency.
Mobile malware is a growing menace, even though many Cybersecurity practitioners don’t fully grasp the situation. This presentation will address the Five W’s of mobile malware, namely: Who is developing it? Who is being affected by it? What exactly is it? When does it get dropped on mobile devices and when does it execute on mobile devices? Where are botnet operations that harvest mobile devices most prevalent? Why is mobile malware developed in the first place? This high-level presentation will stimulate thoughtful discussions and commensurate actions amongst Cybersecurity professionals who are tasked with defending their organization’s people, data and infrastructure.
Currently cyberinfrastructures are facing increasingly stealthy attacks that implant malicious payloads under the cover of benign programs. Existing attack detection approaches based on statistical learning methods may generate misleading decision boundaries when processing noisy data with such a mixture of benign and malicious behaviors. On the other hand, attack detection based on formal program analysis may lack completeness or adaptivity when modeling attack behaviors. In light of these limitations, we have developed LEAPS, an attack detection system based on supervised statistical learning to classify benign and malicious system events. Furthermore, we leverage control flow graphs inferred from the system event logs to enable automatic pruning of the training data, which leads to a more accurate classification model when applied to the testing data. Our extensive evaluation shows that, compared with pure statistical learning models, LEAPS achieves consistently higher accuracy when detecting real-world camouflaged attacks with benign program cover-up.
Low signal-to-noise data processing algorithms for improved detection, tracking, discrimination and situational threat assessment are a key research challenge. As sensor technologies progress, the number of pixels will increase significantly. This will result in increased resolution, which could improve object discrimination, but unfortunately, will also result in a significant increase in the number of potential targets to track. Many tracking techniques, like multi-hypothesis trackers, suffer from a combinatorial explosion as the number of potential targets increase. As the resolution increases, the phenomenology applied towards detection algorithms also changes. For low resolution sensors, blob tracking is the norm. For higher resolution data, additional information may be employed in the detection and classification steps. The most challenging scenarios are those where the targets cannot be fully resolved, yet must be tracked and distinguished for neighboring closely spaced objects. Tracking vehicles in an urban environment is an example of such a challenging scenario. This report evaluates several potential tracking algorithms for large-scale tracking in an urban environment. The algorithms considered are: random sample consensus (RANSAC), Markov chain Monte Carlo data association (MCMCDA), tracklet inference from factor graphs, and a proximity tracker. Each algorithm was tested on a combination of real and simulated data and evaluated against a common set of metrics.
In cyber-attack analysis, it is often highly desirable to understand the meaning of an unknown file or network message in the absence of their consumer (i.e. the program that parses and understands the file/message). For example, a malware may stealthily collect information from a victim machine, store them as a file and later send it to a remote server. P2C is a novel technique that can parse and understand unknown files and network messages. Given a file/message that was generated in the past without the presence of any monitoring techniques, and a set of potential producers of the file/message, P2C systematically explores the execution paths in the producers without requiring any inputs. In the meantime, it tries to transform a producer execution to a consumer execution that closely resembles the ideal consumer execution that can parse the given unknown file/message. In particular, when a write operation is encountered in the original execution, P2C performs the opposite read operation on the unknown file/message and patches the original execution with the loaded value. In order to handle correlations between data fields in the file/message, P2C follows a trial-and-error approach to look for the correct transformation until the file/message can be parsed and the meaning of their fields can be disclosed. Our experiments on a set of real world applications demonstrate P2C is highly effective.
While smartphones and mobile apps have been an essential part of our lives, privacy is a serious concern. Previous mobile privacy related research efforts have largely focused on predefined known sources managed by smartphones. Sensitive user inputs through UI (User Interface), another information source that may contain a lot of sensitive information, have been mostly neglected.
This talk examines the possibility of scalably detecting sensitive user inputs from mobile apps. In particular, SUPOR, a novel static analysis tool that automatically examines the UIs to identify sensitive user inputs containing critical user data, such as user credentials, finance, and medical data, is designed and implemented. SUPOR enables existing privacy analysis approaches to be applied on sensitive user inputs as well. To demonstrate the usefulness of SUPOR, we build a system that detects privacy disclosures of sensitive user inputs by combining SUPOR with off-the-shelf static taint analysis. We apply the system to 16,000 popular Android apps, and conduct a measurement study on the privacy disclosures. SUPOR achieves an average precision of 97.3% and an average recall of 97.3% for sensitive user input identification. SUPOR finds 355 apps with privacy disclosures and the false positive rate is 8.7%. We discover interesting cases related to national ID, username/password, credit card and health information.
Network transport protocols, like TCP, underlie the vast majority of Internet communication, from email to web browsing to instant messaging to file transfer. Despite their importance, these protocols are difficult to implement correctly, leading to a long string of bugs and vulnerabilities dating back to 1985.
In this talk we present a new method for finding attacks in unmodified transport protocol implementations using the specification of the protocol state machine to reduce the search space of possible attacks. Such reduction is obtained by applying malicious actions to all packets of the same type observed in the same state instead of applying them to individual packets. Our method requires knowledge of the packet formats and protocol state machine. We demonstrate our approach by developing SNAKE, a tool that automatically finds performance and resource exhaustion attacks on unmodified transport protocol implementations. SNAKE utilizes virtualization to run unmodified implementations in their intended environments and network emulation to create the network topology. SNAKE was able to find 9 attacks on 2 transport protocols, 5 of which we believe to be unknown in the literature. This work was awarded best paper in DSN 2015.
For years, legal wiretapping was straightforward: the officer doing the intercept connected a tape recorder or the like to a single pair of wires. By the 1990s, though, the changing structure of telecommunications — there was no longer just “Ma Bell” to talk to — and new technologies such as ISDN and cellular telephony made executing a wiretap more complicated for law enforcement. Simple technologies would no longer suffice. In response, Congress passed the Communications Assistance for Law Enforcement Act (CALEA), which mandated a standardized lawful intercept interface on all local phone switches. Technology has continued to progress, and in the face of new forms of communication — Skype, voice chat during multi-player online games, many forms of instant messaging, etc.— law enforcement is again experiencing problems. The FBI has called this “Going Dark”: their loss of access to suspects’ communication. According to news reports, they want changes to the wiretap laws to require a CALEA -like interface in Internet software.
CALEA , though, has its own issues: it is complex software specifically intended to create a security hole — eavesdropping capability — in the already-complex environment of a phone switch. It has unfortunately made wiretapping easier for everyone, not just law enforcement. Congress failed to heed experts’ warnings of the danger posed by this mandated vulnerability, but time has proven the experts right. The so-called “Athens Affair”, where someone used the built-in lawful intercept mechanism to listen to the cell phone calls of high Greek officials, including the Prime Minister, is but one example. In an earlier work, we showed why extending CALEA to the Internet would create very serious problems, including the security problems it has visited on the phone system.
This talk explores the viability and implications of an alternative method for addressing law enforcement’s need to access communications: legalized hacking of target devices through existing vulnerabilities in end-user software and platforms.
"Increasing robustness and resilience: assessing disruptions and dependencies in analysis of System-of-Systems alternatives"
Researchers: Prof. Daniel Delaurentis, Karen Marais, Navindran Davendralingam, Zhemei Fang, Cesare Guariniello, Payuna Uday
"PD3: Policy–based Distributed Data Dissemination"
Researchers: Rohit Ranchal, Denis Ulybyshev, Pelin Angin, Prof. Bharat Bhargava
Secure Multiparty Computation offers cryptographically strong guarantees on the secrecy of data used in collaborative computing among untrusted parties. It has many important applications ranging from peer-to-peer secure auction to privacy-preserving data mining. In this talk, I will present my experience in building efficient secure computation protocols. I will also share my vision on how to blend modern cryptography and programming languages research to solve interesting cyber-security problems.
Rebecca will provide a brief discussion of the general consideration of what “privacy” and “personal information” really are, in addition to important factors when making privacy risk assessment. She will also discuss some of her work and research in recent years involving medical devices, smart meters, geo location, and a wide host of other Internet of Things and Big Data scenarios. Long with this will be discussion of the need to be able to identify privacy risks that accompany the use of new and evolving technologies, and then determine the best controls to use to mitigate them. This is intended to be an interactive and thought provoking session. Rebecca will also a copy of her new book, "Data Privacy for the Smart Grid" (http://www.crcpress.com/product/isbn/9781466573376), published by CRC Press, to an attendee.
Location-based social networks (LBSNs) feature location-based friend discovery services attracting hundreds of millions of active users world-wide. While leading LBSN providers claim the well-protection of their users’ location privacy, in this talk we show for the first time through real world attacks that these claims do not hold after summarizing the existing practices from the industry. In our identified attacks, a malicious individual with the capability of no more than a regular LBSN user can easily break most LBSNs by manipulating location information fed to LBSN client apps and running them as location oracles. I will further talk about the development of an automated user location tracking system based on the proposed attack and its test on leading LBSNs including Wechat, Skout, and Momo. Real-world experiments on 30 volunteers and the defense approaches will also be discussed. These findings serve as a critical security reminder of the current LBSNs pertaining to a vast number of users.
We will discuss how the known practives and inspirations of the past can enlighten our path forward into the uncertain seas of Big Data, Clouds and Things that absorb data and even talk back. Privacy engineering as a set of methodologies and cross disciplinary field of inquiry is another theme that I will present and students and attendees can grow.
Mobile application vetting is pivotal to preserve the integrity of mobile platforms. Existing frameworks typically rely on virtual environments which are easily detected by malware. Advanced malware can avoid detection within existing vetting processes by limiting its functionality within the virtual environment. Virtual Android Malware Detection and Analysis (VAMDA) is a multi-tiered malware analysis platform with extensive detection and analysis capabilities. Malware is analyzed within a modified emulator, a virtualized ARM environment and instrumented physical phone. VAMDA utilizes extensive logging capabilities and can be used for automatic report generation based upon a set of observable metrics as well as an extensible tool for Mobile security analysts.
Research on new technologies to help security analysts defend networks and systems from attacks has unique challenges --- the ad-hoc nature of attacks and their mitigation makes formal modeling elusive; the diverse threat scenarios of organizations makes a one-size-fit-all solution unlikely; and the lack of data and production deployment to test research prototypes makes evaluation extremely difficult.
In this talk I will describe the unique approaches we have been taking to address this problem. Since algorithms and tools that arise from this research are intended to help the tasks performed by human analysts, it becomes a pre-requisite for researchers to first understand how analysts do their jobs, and identify the key obstacles and bottlenecks for performance. I will explain how we designed/built the SnIPS system for intrusion analysis by eliciting expert knowledge through ad-hoc interviews, and the formulation of a customized Dempster-Shafer theory to capture how humans deal with the inherent uncertainty in this reasoning process. I then explain how this led us to eventually adopt an anthropological approach to address this research challenge.
Anthropology is a social science well known for its long-term participant observation method in which researchers spend substantial amounts of time living/working together with the subjects of study, as participant observers who take part in the daily lives and challenges of those they study, giving them a more empathic perspective understanding of their views, practices, and challenges. I will use the examples in my past eight years' research to explain why this type of ethnographic fieldwork is crucial and could be a very effective method to extract the "tacit knowledge" embodied in the practices of security analysts. Joining the "community of practice" of security operations will enable researchers to access the tacit knowledge, make it explicit, subject it to systematic analysis and modeling, and yield algorithms that execute the knowledge in an automated fashion. I will also talk about "unexpected findings" we are still deriving from on-going anthropological fieldwork at multiple security operations centers.
Installing security-relevant software updates is one of the best computer protection mechanisms available to end users. Unfortunately, users frequently decide not to install future updates, regardless of whether they are important for security, after negative experiences with past updates. This means that even non-security updates (such as user interface changes) can impact the decisions users make about installing future security updates. As many as 70% of computers worldwide are running old versions of Java, a common target of attack. In this presentation I will talk about my research into why users choose to not update their software, and what can be done about it. I report on a multi-factor study where we investigated why users choose to not update software. We interviewed users and analysed the logs on their computers. We found that the default automatic update behaviour of Windows did not always match users' intentions, sometimes causing users to be more secure than they intended, sometimes less. Non-security components of updates, such as user interface changes, also impacted users' willingness to update software.
Data collected by organizations and agencies are a key resource in today's information age. The use of sophisticated data mining techniques makes it possible to extract relevant knowledge that can then be used for a variety of purposes, such as research, developing innovative technologies and services, intelligence and counterterrorism operations, and providing inputs to public policy making. However the disclosure of those data poses serious threats to individual privacy.
In this talk, we will present the evolvement of privacy notions for data publishing and analysis, leading to our proposed membership privacy framework, which formalizes the intuition that privacy means that the adversary cannot significantly increasing its ability to conclude that an entity is in the input dataset. We show that several recently proposed privacy notions, including differential privacy, are instantiations of the membership privacy framework, and that the framework provides a principled approach to developing new privacy notions under which better utility can be achieved than what is possible under differential privacy.
Programs are full of bugs, leading to vulnerabilities. We'll discuss power and limitations of code-pointer integrity (CPI), a strong but practical security policy that enforces memory safety for all code pointers, protecting against any form of control-flow hijack attack (e. g., ROP or JOP).
Systems code is often written in low-level languages like C/C++, which offer many benefits but also delegate memory management to programmers. This invites memory safety bugs that attackers can exploit to divert control flow and compromise the system. Deployed defence mechanisms (e. g., ASLR, DEP) are incomplete, and stronger defence mechanisms (e. g., CFI) often have high overhead and limited guarantees (and are therefore not generally deployed).
In this talk we discuss code-pointer integrity (CPI), a strong security policy that guarantees the integrity of all code pointers in a program (e.g., function pointers, saved return addresses) and thereby prevents all control-flow hijack attacks, including return-oriented programming and jump-oriented programming. We also introduce code-pointer separation (CPS), a relaxation of CPI with better performance properties. Both CPI and CPS offer substantially better security-to-overhead ratios than the state of the art, they are practical (we protect a complete FreeBSD system and over 100 packages like apache and postgresql), effective (prevent all attacks in the RIPE benchmark), and efficient, resulting in very low to negligible performance overhead.
Individuals have the privacy expectation that organizations (e.g., bank, hospital) that collect personal information from them will not share these personal information with mischievous parties. To prevent unauthorized disclosure of personal information by organizations, US federal government has put forward privacy legislation like HIPAA and GLBA. Violation of these privacy regulations can bring down heavy financial penalties for the organization. To maintain compliance with all the relevant privacy regulations, organizations collect day-to-day privacy events in an audit log which is periodically checked for compliance.
The audit logs capturing the privacy sensitive events tend to be large and due to the cost-effectiveness of cloud infrastructures, outsourcing the audit log storage to a third party cloud service provider is now a viable option for organizations. As the audit logs can possibly contain customers' sensitive personal information, protecting confidentiality of the audit log data from the cloud service provider and other malicious parties should be a major objective for the organization. One possibility is to encrypt the audit logs before uploading it in the cloud storage. However, encrypting the audit log with any semantically secure encryption scheme might prohibit the organization from automatically check compliance of the audit log. Theoretical solutions like fully homomorphic encryption is not practically viable in this scenario. In this talk, I will present two very simple audit log encryption schemes that reveal enough information so that the organization can run an automatic compliance checking algorithm over the encrypted log. With empirical evaluation we demonstrate that, our enhanced compliance checking algorithm incurs low to moderate overheads for our cryptographic schemes, relative to a baseline without encryption.
The “pay-as-you-go” cloud computing model has strong potential for efficiently supporting big data analysis jobs expressed via data-flow languages such as Pig Latin. Due to security concerns — in particular leakage of data — government and enterprise institutions are however reluctant to moving data and corresponding computations to public clouds. In this talk we will discuss Crypsis, a system that allows execution of MapReduce-style data analysis jobs directly on encrypted data. Crypsis transforms data analysis scripts written in Pig Latin so that they can be executed on encrypted data. Crypsis to that end employs existing practical partially homomorphic encryption (PHE) schemes, and adopts a global perspective in that it can perform partial computations on the client side when PHE alone would fail.
Cloud computing is a key technology for storing, managing and analyzing big data. However, such large, complex, and growing data, typically collected from various data sources, such as sensors and social media, can often contain personally identifiable information (PII) and thus the organization collecting the big data may want to protect their outsourced data from the cloud. In this talk, we will discuss current research towards development of efficient and effective privacy-enhancing (PE) techniques for management and analysis of big data in cloud computing. In particular, we will discuss initial approaches to address two important PE applications: (i) privacy-preserving data management and (ii) privacy-preserving data analysis under the cloud environment. Additionally, we will discuss research issues that still need to be addressed to develop comprehensive solutions to the problem of effective and efficient privacy-preserving use of data.
The Building Security in Maturity Model V (BSIMM-V) is an industry-driven maturity model dedicated to software security, which specifies a set of activities designed to foster an improved security posture within the organization. This research explores the firm characteristics and approaches to information risk of the participating BSIMM-V firms, primarily through text mining techniques. The objective of this research is to determine if there are any significant associations or relationships between firm characteristics, the activities identified by the BSIMM –V model, and reported information security incidents.
This presentation will discuss how program analysis can be used in security applications. Three sample applications will be discussed: binary transformation that can mutate and instrument off-the-shelf commodity binary executables, memory forensics that can extract critical information from memory images, and reverse engineering technique that can expose hidden behaivor of software. All these applications are driven by program analysis.
A great deal of discussion about privacy focuses on the technical details of metadata, data in motion, data at rest, etc -- details which are designed to obscure the basic discussion rather than to illuminate.
In this talk we'll look at some of the philosophical questions regarding privacy and what they may mean in modern terms.
In my talk I will be describing new techniques developed at RSA Labs to analyze massive log data commonly collected by large enterprises to detect and identify suspicious activity. Unlike common signature-based detection mechanisms used today, our approach leverages behavior patterns that persist across different infection vectors, and is thus more resilient to attacker evasion. Moreover, our techniques are unique in their ability to detect stealthy campaigns in which only a single host sporadically communicates with malicious sites controlled by attackers. Through effective data reduction and algorithms inspired from the graph-theoretic belief propagation model we identify the most suspicious domains contacted by hosts in an organization in different stages of an APT campaign (e.g., initial delivery, infection, command-and-control, etc.).
We demonstrate the effectiveness of our techniques against two datasets. The first, a public dataset made available by Los Alamos National Laboratory includes the simulations of APT campaigns overlaid on their DNS traffic. We successfully detect 94% of the campaigns with only a 1% false positive rate. We then apply the techniques to 38TB of web proxy logs collected by a large enterprise to discover hundreds of malicious domains that had bypassed other installed security tools.
Network Operations Center and Security Operations Center (NOC / SOC) teams have complex and challenging cognitive tasks that are crucial to the IT health of the organization, but existing tools and metrics do not support this range of tasks. To enhance their key tasks, namely situation awareness, incident response, prevention and knowledge sharing, it is critical to understand how people, tools and information sharing co-function in a NOC environment, and what limits their performance--from low-level analysts to their managers and team leads responsible for translating this NOC/SOC value to others in the organization. Beginning at RSA 2014, our research team began to explore how to improve the information available and displayed to NOC / SOC analysts, team leads, and managers. Our interviews and information display usability efforts are focused on recognizing and reducing the gaps that limit NOC/SOC effectiveness and integration with the rest of the organization.
The two recurring themes that address the needs of lower- and higher-level analysts, and their managers were: 1) Analysts need to effectively turn data visualizations into usable presentations to increase network situation awareness, and 2) SOC leads and managers need tools and metrics to effectively communicate the status of the organization’s network assets, team operations and company’s incident response preparedness to the rest of the organization. Besides standard training, analysts are required to engage in the development of expertise and acquiring skills necessary to perform required tasks. Transfer of organizational knowledge to novice analysts efficiently is a vital process to maximize the organization’s capabilities at all times. In preliminary interviews, network managers and team leads stated that they are unaware of tools that will allow them to document work procedures and cases to be used as a resource for novice analysts. They express frustration from the need of their continuous involvement in operational level tasks that interrupt their managerial tasks.
The Healthcare Industry; Rapid Growth, Increased Risk Why the Healthcare Industry is behind the curve on Security and Privacy How the Trust Factor affects Adoption of Technology Innovation Healthcare Data is Valuable and Criminals are starting to realize it Critical Healthcare Compliance and Security Issues Simplified Security and Compliance Solutions that Fit the Way Healthcare operates
Graphics Processing Units (GPUs) have evolved from very specialized, idiosyncratic hardware intended to execute specialized graphics workloads to semi-autonomous "supercomputers" that can be programmed easily using common programming languages and powerful, portable APIs. GPUs also form the basis for an emerging threat, GPU malware, which offloads important aspects of malicious computations onto the GPU. The benefits of executing malicious computations on the GPU include abundant compute power, a large amount of semi-non-volatile memory, and perhaps most importantly, isolation from host-based security measures. While memory analysis offers powerful tools to detect and analyze traditional host-based malware, there are essentially no equivalent tools for analyzing GPU malware. Furthermore, existing general-purpose tools for debugging GPU applications are completely ineffective if a large number of conditions are not established before a GPU application is executed, all of which will certainly be violated by weaponized GPU malware. This talk explores GPU malware in detail, identifies why it's hard to analyze, and also discusses measures that can easily employed to make analysis even more difficult. A primary motivation for this research is the 2015 DFRWS Digital Forensics Challenge, under development by Dr. Richard, the aim of which is to increase interest in GPU malware analysis and foster the development of powerful tools to analyze and combat this threat.
Throughout the world, companies are finding that data breaches have become as common as a cold but far more expensive to treat. With the exception of Germany, companies had to spend more on their investigations, notification and response when their sensitive and confidential information was lost or stolen. As revealed in the 2014 Cost of Data Breach Study: Global Analysis, sponsored by IBM, the average cost to a company was $3.5 million in US dollars and 15 percent more than what it cost last year.
Will these costs continue to escalate? Are there preventive measures and controls that will make a company more resilient and effective in reducing the costs? Nine years of research about data breaches has made us smarter about solutions.
Critical to controlling costs is keeping customers from leaving. The research reveals that reputation and the loss of customer loyalty does the most damage to the bottom line. In the aftermath of a breach, companies find they must spend heavily to regain their brand image and acquire new customers. Our report also shows that certain industries, such as pharmaceutical companies, financial services and healthcare, experience a high customer turnover. In the aftermath of a data breach, these companies need to be especially focused on the concerns of their customers.
As a preventive measure, companies should consider having an incident response and crisis management plan in place. Efficient response to the breach and containment of the damage has been shown to reduce the cost of breach significantly. Other measures include having a CISO in charge and involving the company’s business continuity management team in dealing with the breach.
In most countries, the primary root cause of the data breach is a malicious insider or criminal attack. It is also the most costly. In this year’s study, we asked companies represented in this research what worries them most about security incidents, what investments they are making in security and the existence of a security strategy.
An interesting finding is the important role cyber insurance can play in not only managing the risk of a data breach but in improving the security posture of the company. While it has been suggested that having insurance encourages companies to slack off on security, our research suggests the opposite. Those companies with good security practices are more likely to purchase insurance.
Global companies also are worried about malicious code and sustained probes, which have increased more than other threats. Companies estimate that they will be dealing with an average of 17 malicious codes each month and 12 sustained probes each month. Unauthorized access incidents have mainly stayed the same and companies estimate they will be dealing with an average of 10 such incidents each month.
When asked about the level of investment in their organizations’ security strategy and mission, on average respondents would like to see it doubled from what they think will be spent—an average of $7 million to what they would like to spend—an average of $14 million. This may be a tough sell in many companies. However, our cost of data breach research can help IT security executives make the case that a strong security posture can result in a financially stronger company.
There are various forms and types of intelligence but this topic isn’t about how smart you are. It is about how smart you are in figuring out the risks and various impacts against your organization. How do you use digital forensics to determine an adversary within the network. Starting with a small primer on the tradecraft of intelligence the discussion covers how threat intelligence to information enterprises is impacted on the tactical, operational, and strategic level.
Periodic Mobile Forensics (PMF) is a MITRE research project investigating user behavioral measurement on mobile devices by applying both traditional and mobile forensics processes. We applied our research to an enterprise mobile infrastructure, where we utilize a mobile on-device agent named TractorBeam. This agent periodically collects changed storage locations from each device to allow for later image reconstruction and analysis. We collaborated with Purdue University to perform a three-month experiment where we evaluated TractorBeam's operation in a simulated operational setting to identify masquerading users (i.e., users operating the devices other than the enterprise designated mobile device user). We surmised that even if a masquerading user on an enterprise mobile device lacked malicious intent; this masquerader would still be undesirable to the enterprise. On campus, we provided a set of human-subject volunteers the following: preconfigured mobile devices with cellular voice and data plans, also with the TractorBeam agent pre-installed; a simple acceptable use policy; and deceptive project background information to stimulate normal behavior. As a result of the experiment, we collected enough data to successfully reconstruct 821 forensic images, extract over 1 million audit events, and perform masquerading user analysis. This presentation describes PMF and characterizes the collected experiment corpus, the extracted audit events, and the performance of TractorBeam throughout the protocol. Then our approach for advanced masquerading detection will be discussed.
Memory corruption (e.g., buffer overflows, random writes, memory allocation bugs, or uncontrolled format strings) is one of the oldest and most exploited problems in computer science. These problems are here to stay as low-level languages like C or C++ continue to trade safety for potential performance. A small set of all proposed solutions (e.g., Address Space Layout Randomization, Data Execution Prevention, and stack canaries) is applied in practice but real exploits show that all currently deployed protections can be defeated. The problems of current protection mechanisms call for novel approaches towards software protection that fulfill the following properties: low overhead for high security guarantees, no changes to the original source code, and compatibility to existing libraries and binaries (including a partial migration strategy).
We present a security policy that deterministically protects software against control-flow hijack attacks. Our mechanism uses both a user-space virtualization system (building on binary translation) to support legacy code and a compiler-based framework to enforce the integrity of all code pointers at runtime. Such a system controls the execution of all code in user-space, extracts information from all loaded components, and enforces a strong security policy for the executed software with low overhead. We show possible pitfalls and limitations and discuss future extensions and optimizations.
State-of-the-art memory forensics involves signature-based scanning of memory images to uncover data structure instances of interest to investigators. A largely unaddressed challenge is that investigators may not be able to interpret the content of data structure fields, even with a deep understanding of the data structure’s syntax and semantics. For example, an investigator may know that a buffer field is holding a photo image, but still cannot display (and hence understand) the image. We call this the data structure content reverse engineering challenge. In this talk, we present DSCRETE, a system that enables automatic interpretation and rendering of in-memory data structure contents. DSCRETE is based on the observation that the application in which a data structure is defined usually contains interpretation and rendering logic to generate human-understandable output for that data structure. Hence DSCRETE aims to identify and reuse such logic in the program’s binary and create a “scanner+renderer” tool for scanning and rendering instances of the data structure in a memory image. We will show that DSCRETE is able to recover a variety of application data — e.g., images, figures, screenshots, user accounts, and formatted files and messages — with high accuracy. The raw contents of such data would otherwise be unfathomable to human investigators.
In our ever connected society, security has become an essential component for all facets of life. Businesses, government, academics, and individually, all facets have a need to protect and secure technology. Over the past 5-10 years, the demand for cyber security professionals has significantly increased. According to the Bureau of Labor Statistics, employment for Cyber Security Specialists is expected to increase much faster than the average career over the course of the next 10 years. Despite the growing demand, women represent an alarmingly low percentage. This can be demonstrated in nearly any university’s technology courses. Cyber security especially is highly male-dominated. Research shows that having a balance of male and female perspectives facilitates diverse and creative innovation and problem solving, within the ever changing realm of cyber security. The NSF SFS funded Broadening Participation of Women in Cybersecurity Project, which aims to build a movement towards diversifying Cyber Security. The program put on the Women in Cyber Security Conference (WiCyS), in Nashville, TN, April 11-12. I will discuss my experience at this conference. I will also discuss takeaways from this conference, and important information for anyone interested in pursuing a career in this ever evolving and highly demanded field.
Considering that most consumers do not read Privacy Policies and Terms of Service agreements before accepting them, considerable informational asymmetry exists between consumers and cloud service providers regarding the collection and processing of personal information online. One potential method for reducing this informational asymmetry is the application of informed consent to online environments. Informed consent online will mean upholding principles such as disclosure, competence, comprehension, voluntariness, and agreement. Comprehension and voluntariness are arguably the hardest principles to achieve under current Internet business models and consumer behavior patterns. In this talk I will present the results of an extensive, two-part privacy survey that assessed knowledge and opinions concerning comprehension and voluntariness in online consent agreements. Results expose comprehension gaps with respect to the contents of consent agreements as well as the background knowledge that would be necessary to understand the significance of the terms within the documents. In addition, our survey results highlight the coercive nature of the online consent process and suggest ways for better facilitating voluntariness in online interactions. We found substantial support for alternative service delivery models concerning privacy and for legislation that would endorse standardized consent agreements. These findings provide thought-provoking information which can be used to guide future efforts aimed at increasing consumer awareness about online privacy issues.
As the field of determined and increasingly sophisticated adversaries multiplies, the confidence in the integrity of deployed computing devices magnifies. Given the ubiquitous connectivity, substantial storage, and accessibility, the increased reliance on computer platforms make them a substantial target for attackers. Over the past decade, malware transitioned from attacking a single program to subverting the OS kernel by means of what is known as a rootkit. While computer systems require patches to fix newly discovered vulnerabilities, undiscovered vulnerabilities potentially remain. Signature-based schemes seek to detect malware with a known signature or digital fingerprint. Signature-less schemes seek to detect anomalies within the computer system by understanding normal behavior. Both architectures are typically built on top of existing solutions or paradigms. Furthermore, these solutions tend to utilize mechanisms that operate within the OS. If the OS becomes compromised, these mechanisms may be vulnerable to deactivation. We propose an approach to designing computer systems that inherently decouples the function of the computer system from its security specification. Instead of preventing and detecting malware attacks by patching code or using signatures (though we can use them as well), our proposed approach focuses on the policy specification of the system and possible graceful degradation of functionality according to the policy as anomalies of security concern are detected. We believe this innovative paradigm uses existing technologies in a novel manner to determine the integrity level of the system. Based on the integrity level, the system may behave differently and/or limit access to data available at a given integrity level.
The desire to compute on sensitive data without revealing it has led to several decades of research in the area of secure multi-party computation. Today, cloud computing serves as a major motivation for the development of secure data processing techniques suitable for use in outsourced environments for computing with private or sensitive data. Despite much attention, most of the available techniques focused on a rather narrow domain of integer arithmetic. In this talk, we describe our work on other types of computation and algorithms suitable for secure computation and outsourcing with the goal of enabling secure and efficient distributed implementation of a general-purpose program. This, in particular, includes a compiler that transforms a program written in C extension, where variables to be protected are marked as private, into its secure distributed implementation suitable for execution in the cloud.
Security research domain has recently witnessed tremendous growth in respect to all aspects of information access and sharing. There has been notable progress in developing successful approaches to tackle the problem of user authentication. Among those approaches, biometric-based authentication firmly established itself as one of the most reliable, efficient, and versatile tools for providing discretionary access control to a secure resource or system. While state-of-the art methods for biometric authentication are becoming increasingly more powerful and better understood, the same unfortunately cannot be said about security of users populating on-line communities or cyberworld. Ensuring safe and secure communication and interaction among users and, respectably, their on-line identities presents unique challenges to academicians, as well as the industry and the public. Despite the fact that those challenges are regularly making headlines in the news, in government reports and in IT security domain, there is a lack of effort to address this urgent problem. The limited efforts that do exists are currently restricted to network security, password protection, encryption, database security and policy-making efforts. However, one of most crucial components for ensuring on-line security ñ the relationship between communication among users and user authentication, has been largely overlooked. This crucial issue requires a systematic study and a targeted effort to develop effective security solutions for cyberworlds, which is the main topic of this proposed talk.
As computing shifts to a service-oriented world, a key need is to deliver an always-on experience to the end-users. However, providing a 24x7x365 available service is challenging because failures are the norm rather than an exception in distributed systems. While there has been significant work to improve server and software reliability, networks have become the new “weakest link” in delivering reliable services. Towards improving network service reliability, my research focuses on (a) studying reliability of datacenter networks, (b) building automated systems for problem inference, and (c) gaining operational experience from real-world deployment of the systems I built.
In this talk, I will answer three key questions on improving service reliability in datacenters:
- What is the service impact due to network failures? What are their root causes?
- How to build geo-distributed cloud services?
- How do we analyze unstructured data from network operators to improve network management?
The outcomes of this work have either undergone a tech-transfer or are being used by multiple business groups inside a large cloud provider.
This talk will examine several technical questions related to the NSA's program that collects data about a substantial fraction of all domestic phone calls. How effective is such a program likely to be in identifying potential terrorists or clearing up false suspicion? How easily can enemies evade the program? Can the program be redesigned to better protect privacy, without losing effectiveness?
As more and more Internet-based attacks arise, organizations are responding by deploying an assortment of security products that generate situational intelligence in the form of logs. These logs often contain high volumes of interesting and useful information about activities in the network, and are among the first data sources that information security specialists consult when they suspect that an attack has taken place. However, security products often come from a patchwork of vendors, and are inconsistently installed and administered. They generate logs whose formats differ widely and that are often incomplete, mutually contradictory, and very large in volume. Hence, although this collected information is useful, it is often dirty.
We present a novel system, Beehive, that attacks the problem of automatically mining and extracting knowledge from the dirty log data produced by a wide variety of security products in a large enterprise. We improve on signature-based approaches to detecting security incidents and instead identify suspicious host behaviors that Beehive reports as potential security incidents. These incidents can then be further analyzed by incident response teams to determine whether a policy violation or attack has occurred. We have evaluated Beehive on the log data collected in a large enterprise, EMC, over a period of two weeks. We compare the incidents identified by Beehive against enterprise Security Operations Center reports, antivirus software alerts, and feedback from enterprise security specialists. We show that Beehive is able to identify malicious events and policy violations which would otherwise go undetected.
Storage and computation outsourcing to cloud servers has become very popular due to the large volume of data that needs to be hosted at cloud servers and the intent to employ servers to perform computational work for clients. However, many clients are still reluctant to do so due to their concern for the confidentiality of the data. In this talk, I will present our work on developing secure protocols to outsource several kinds of computation without leaking the clients' data to the cloud servers, including outsourcing feature extraction of images, generalized matrix multiplication, etc.
Use of graph-structured data models is on the rise -- in graph databases, in representing biological and healthcare data as well as geographical data. In order to secure graph-structured data, and develop cryptographically secure schemes for graph databases, it is essential to formally define and develop suitable collision resistant one-way hashing schemes and show them they are efficient. The widely used Merkle hash technique is not suitable, because graphs may be directed acyclic ones or cyclic ones. In this talk, we will address this problem. In particular, we: (1) discuss the practical and formal security model of hashing schemes for graphs, (2) present the formal security model of perfectly secure hashing schemes, (3) describe constructions of hashing and perfectly secure hashing of graphs, and (4) present performance results for the constructions. We use graph traversal techniques, which are highly efficient for hashing, redaction, and verification of hashes graphs. We have implemented the proposed schemes. Performance analysis on both real and synthetic graph data sets support the viability of our approach.
It was once said that the last time one had full control of their software was right before they released it. This is ever more important as organizations move applications and services into a public cloud to support a mobile lifestyle. Clouds have been described as “a safe and secure private cloud”, “a semi-trusted partner cloud”, or “a wild wild west full and open public cloud”. It’s typically toward the latter in which the industry has been moving. Because of this, one must understand their Attack Surface and threat environment to ensure that they have focused on “building security in” to their application.
The purpose of this study is to identify several areas of forensic interest within the Yahoo! Messenger application, which are of forensic significance. This study focuses on new areas of interest within the file structure of Windows Vista and Windows 7. One of the main issues with this topic is that little research has been previously conducted on the new Windows platforms. Previously conducted research indicates the evidence found on older file structures, such as Windows XP, as well as outdated versions of Yahoo! Messenger. Several differences were found within the Yahoo Messenger’s registry keys and directory structure on Windows Vista and Windows 7 as compared to Windows XP.
Data collected by organizations and agencies are a key resource in today's information age. The use of sophisticated data mining techniques makes it possible to extract relevant knowledge that can then be used for a variety of purposes, such as research, developing innovative technologies and services, intelligence and counter-terrorism operations, and providing inputs to public policy making. However the disclosure of those data poses serious threats to individual privacy. In this talk, we present a novel privacy framework that we call Membership Privacy, which prevents the adversary from significantly increasing its ability to conclude that an entity is in the input dataset. Membership privacy is parameterized by a family of distributions that captures the adversary's prior knowledge. The power and flexibility of the proposed framework lies in the ability to choose different distribution families to instantiate membership privacy. Many privacy notions in the literature are equivalent to membership privacy with interesting distribution families, including differential privacy, differential identifiability, and differential privacy under sampling. The framework also provides a principled approach to developing new privacy notions under which better utility can be achieved than what is possible under differential privacy. This is joint work with Wahbeh Qardaji, Dong Su, Yi Wu, and Weining Yang.
What are Systems of Systems? Why are we interested in them? What about them vex us? These topics will be addressed in this overview talk along with emphasis on the analysis of vulnerabilities in SoS Architectures. Our particular work targets advancements in the modeling and analysis of System of Systems (SoS), in particular to support systems engineering activities associated with architecture design, evolution, and operational assessment. We analyze dynamic impacts of interdependencies and uncertainties inherent in SoS. We envision an analytic workbench (populated by a variety of analytical tools from several sources) that makes these analysis capabilities accessible to “SoS System Engineers” in tackling real SoS problems like Air Transportation and Ballistic Missile Defense.
The DARPA Detection and Computational Analysis of Psychological Signals (DCAPS) program provided initial funding for the Durkheim Project. While DCAPS as a whole addressed PTSD, the Durkheim Project sought to predict military and veteran suicide risk. We developed a clinician's dashboard, which presents suicide risk predictions for the clinician's patients based on analysis of: a) free text portions of VA medical records and, b) opt-in social media postings. Dartmouth's Committee for the Protection of Human Subjects approved our protocol to conduct a Veterans Affairs (VA) medical records study with the White River Junction, Vermont, VA Medical Center. A second protocol has been approved to study opt-in Facebook postings from active duty military personnel and veterans. We have built the software infrastructure to collect these opt-in postings in collaboration with Facebook. A third protocol is currently being developed to support intervention, when high suicide risk is predicted. This talk will describe the Durkheim Project, focusing on privacy issues related to using opt-in social media postings.
The Facebook security team will share how we approach the security challenges involved in protecting the identities of over a billion users on our site. This talk is partly about our culture, and partly on how we take a practical, risk-based approach to security. In the first part of the talk Mark Crosbie will give an overview of our culture, how we think about security and what makes Facebook unique in the industry in this regard. Then Tim Tickel and Four Flynn will give an in-depth look at Facebook's easy to use internal multi-factor authentication deployment. We will discuss our motivations, how our solution works, technical and security trade-offs, deployment problems, and outstanding issues.
In 2011 the National Institute of Standard and Technology (NIST) released a draft of special publication 800-155. This document provides a more detailed description than the Trusted Platform Module (TPM) PC client specification for content that should be measured in the BIOS to provide an adequate Static Root of Trust for Measurement (SRTM). In this talk we look at the implementation of the SRTM from a Dell Latitude E6400 laptop.
I'll discuss a couple ways that an attacker can gain access to the BIOS and demonstrate an exploit we discovered in the BIOS update process that bypasses the signed firmware update and allows an attacker to execute arbitrary code in the context of System Management Mode. This allows an attacker to install a malicious BIOS reflash even in the presence of a signed update requirement.
Next I'll show what happens when an attacker is able to do once he gains access to a system BIOS. I'll show how a 51 byte patch to the SRTM can cause it to provide a forged measurement to the TPM indicating that the BIOS is pristine. If a TPM Quote is used to query the boot state of the system, this TPM-signed falsification will then serve as the root of misplaced trust. We also show how reflashing the BIOS may not necessarily remove this trust-subverting malware.
To fix the un-trustworthy SRTM we apply the technique of "timing-based attestation" to create a custom SRTM that can detect malicious modifications of itself. We call our timing-based attestation system "BIOS Chronomancy" because the extra trust is divined from timing, and we show that it could be incorporated into vendor BIOSes as a stronger root of trust for measurement.
The university environment has unique challenges for information security. Just as corporate networks have exploded in size, services, users, and devices, university networks also have a continually changing and diverse user population, an open network that encourages collaboration, intellectual property that has requirements to be shared as well as protected, and budgetary constraints that reduce services or move data outside of the university. This talk will explore some of these issues.
To hide information within a picture we usually replace the least significant bits. This approach is no longer available if there is only 1 bit/pixel like for Quick Response Codes we meet everyday now. I will talk about theoretical limitation and practical aspects of hiding information in such situations: by generating encoding sequences fulfilling given constraints, for example to enforce resemblance to given picture (grayness of pixel defines probability of using "1" there). If the receiver would know the constraints/picture, we could just use entropy coder for this purpose, but we would like to omit this requirement here. In Kuznetsov-Tsybakov problem only the sender knows simple constraints, but it turns out that we can approach the same channel capacity as if both sides would know them. I will talk about generalizations to statistical constraints and applications for example to picture codes, steganography or lossy compression.
The Identity-Based Internet Protocol (IBIP) Network project is experimenting with a new enterprise oriented network architecture using standard Internet Protocol to encode identity (ID) information into the IP packet by a new edge security device referred to as the IBIP policy enforcement point (PEP). This is a variant of a network admission control process that establishes user and host identities as well as provides optional information on host visibility, organizational affiliation, current role, and trust metric (associated with the user and host endpoints). Our motivation is to increase our security posture by leveraging identity, reducing our threat exposure, enhancing situational understanding of our environment, and simplifying network operations. In addition to authentication, we leverage strong anti-spoofing technology to improve accountability. We reduce our threat surface by “hiding” our client hosts and making all infrastructure devices inaccessible. Any attempt to access a hidden host or infrastructure device results in a policy violation attributable to the user/host that caused the violation and provides enhanced situational awareness of such activities. Our servers can also have a “permissible use” policy that ensures that the server only operates across the network per that policy. Finally, as users log in and servers are added to the network, all dynamic configurations for access control initiated by such changes are automatically carried out without manual intervention, thereby reducing potential vulnerabilities caused by human errors.1
1.Extracted from “Nakamoto, G.; Durst, R.; Growney, C.; Andresen, J.; Ma, J.; Trivedi, N.; Quang, R.; Pisano, D., "Identity-Based Internet Protocol Networking," MILITARY COMMUNICATIONS CONFERENCE, 2012 - MILCOM 2012 , vol., no., pp.1,6, Oct. 29 2012-Nov. 1 2012.
The growing demand for cloud services is driving the need to deliver an always-on and safe user experience in accessing their data and applications. Examples include web search, social networking, email, ecommerce, video streaming, data analytics and even mission-critical services such as power grid control. Such environments are required to be highly available and secure. This is often satisfied by having experts monitoring the system 24x7 to ensure that problems, if any, are resolved within a reasonable time. The need to solve a problem within the minimum time gives rise to a "whatever-it-takes-to-fix-the-problem" attitude amongst experts and produces a constant flow of informal text documenting the debugging steps taken to resolve problems. Understanding the content within this informal text at scale is the key to uncovering big problem trends that will enable us learn from mistakes and improve system design.
In this talk, I will present NetSieve, a system that we built that aims to do automated problem inference from trouble tickets. Specifically, I will show you how statistical natural language processing (NLP) can be combined with knowledge representation, ontology modeling and human-guided learning to automatically analyze natural language text in trouble tickets to infer the problem symptoms, troubleshooting activities and resolution actions. I will further discuss fundamental challenges which arise when extracting meaning from such massive open-domain text corpora. Finally, I will then discuss how we applied NetSieve in a massive data center setting to automatically analyze 10K+ network trouble tickets and how we used these results to improve several key network operations.
Laws and regulations safeguard citizens’ security and privacy. For example, the Health Insurance Portability and Accountability Act of 1996 (HIPAA) governs the security and privacy of electronic health records (EHR) systems. HIPAA violations can result in millions of dollars in penalties for non-compliance. Ensuring EHR systems are legally compliant is challenging for software engineers because the laws and regulations governing EHR systems are written by policymakers with little to no understanding of software engineering. This presentation introduces the field of Regulatory Compliance Software Engineering and discusses a particular research concern within that field: How can we help software engineers seeking to assess whether security and privacy requirements for EHR systems are legally compliant?
In January 2012, MITRE performed a real-time, red team/blue team cyber-wargame experiment. This presented the opportunity to blend cyber-warfare with traditional mission planning and execution, including denial and deception tradecraft. The cyber-wargame was designed to test a dynamic network defense cyber-security platform being researched in The MITRE Corporation’s Innovation Program called Blackjack, and to investigate the utility of using denial and deception to enhance the defense of information in command and control systems.
The Blackjack tool failed to deny the adversary access to real information on the command and control mission system. The adversary had compromised a number of credentials without the computer network defenders’ knowledge, and thereby observed both the real command and control mission system and the fake command and control mission system. However, traditional denial and deception techniques were effective in denying the adversary access to real information on the real command and control mission system, and instead provided the adversary with access to false information on a fake command and control mission system.
Recent advances in DNA sequencing technologies have put ubiquitous availability of whole human genomes within reach. It is no longer hard to imagine the day when everyone will have the means to obtain and store one's own DNA sequence. Widespread and affordable availability of whole genomes immediately opens up important opportunities in a number of health-related fields. In particular, common genomic applications and tests performed in vitro today will soon be conducted computationally, using digitized genomes. New applications will be developed as genome-enabled medicine becomes increasingly preventive and personalized. However, the very same progress also amplifies worrisome privacy concerns, since a genome represents a treasure trove of highly personal and sensitive information. In this talk, we will overview biomedical advances in genomics and discuss associated privacy, ethical, and security challenges. We begin to address genomic privacy by focusing on some important applications: Paternity Tests, Ancestry Testing, Personalized Medicine, and Genetic Compatibility Tests. After carefully analyzing these applications and their privacy requirements, we propose a set of efficient techniques based on private set operations. This allows us to implement, in silico, some operations that are currently performed via in vitro methods, in a secure fashion. Experimental results demonstrate that proposed techniques are both feasible and practical today. Finally, we explore a few alternatives to securely store human genomes and allow authorized parties to run tests in such a way that only the required minimum amount of information is disclosed, and present an Android API framework geared for privacy-preserving genomic testing.
Smart electric meters are meters that can measure electric usage with a pretty high frequency. Smart electric meters pose a substantial threat to the privacy of individuals in their own homes. Combined with a method called non-intrusive load monitors, smart meter data can reveal precise home appliance usage information. An emerging solution to behavior leakage in smart meter measurement data is the use of battery-based load hiding. In this approach, a battery is used to store and supply power to home devices at strategic times to hide appliance loads from smart meters. A few such battery control algorithms have already been studied in the literature. In this talk, we will first consider two well known battery privacy algorithms, Best Effort (BE) and Non-Intrusive Load Leveling (NILL), and demonstrate attacks that recover precise load change information, which can be used to recover appliance behavior information, under both algorithms. We will then introduce a stepping approach to battery privacy algorithms that fundamentally differs from previous approaches by maximizing the error between the load demanded by a home and the external load seen by a smart meter. By design, precise load change recovery attacks are impossible. We also propose mutual-information based measurements to evaluate the privacy of different algorithms. We implement and evaluate four novel algorithms using the stepping approach, and show that under the mutual-information metrics they outperform BE and NILL
Plagiarism is the copying of another party's ideas and passing them off as your own. In the world of smartphone app-markets, this is usually followed by confusion for the buyers (users) and lost sales for the original developer. In some cases, these plagiarized applications act as carriers for malware that can steal your bank details or leak your private information to third-parties. While closed markets such as Apple's AppStore and Windows Marketplace mitigate this problem to some extent through their manual application approval process, open markets such as Google's Android Market, where anyone can publish an application for others to download, are plagued by this problem.
In this talk, I will show how an attacker can launch malware onto a large number of smartphone users by plagiarizing Android applications and by using elements of social engineering to increase the infection rate. Using a dataset of 158,000 smartphone applications' meta-information, I will portray the seriousness of this problem. To this end, we propose three detection schemes that rely on syntactic fingerprinting to detect plagiarized applications under different levels of obfuscation used by the attacker. Experimental analysis of 7,600 smartphone application binaries shows that the proposed schemes detect all instances of plagiarism from a set of real-world malware incidents with 0.5% false positives and scale to millions of applications using only commodity servers.
One of Android's main defense mechanisms against malicious apps is a risk communication mechanism which, before a user installs an app, warns the user about the permissions the app requires, trusting that the user will make the right decision. This approach has been shown to be ineffective as it presents the risk information of each app in a “stand-alone” fashion and in a way that requires too much technical knowledge and time to distill useful information.
We introduce the notion of risk scoring and risk ranking for Android apps, to improve risk communication for Android apps, and identify three desiderata for an effective risk scoring scheme. We propose to use probabilistic generative models for risk scoring schemes, and identify several such models, ranging from the simple Naive Bayes, to advanced hierarchical mixture models. Experimental results conducted using real-world datasets show that probabilistic generative models significantly outperform existing approaches, and that Naive Bayes models give a promising risk scoring approach.
This paper presents a meaning-based method to spam filtering by distinguishing text without content from text with little content from text with normal content, based on the amount of meaning that can be automatically processed in the way humans do. The basic method assumes that a semantic analyzer will be able to produce less output from semantically less grammatical input text than from semantically well-formed text. The method was pilot-tested on a corpus of blog spam. Future improvements, including a method to distinguish semantically unified from semantically disparate text are sketched. The tested method, but even more the projected improvements, will open up the way to taking the spam filtering arms race to a new level very costly to spam producers.
We interact with location-aware devices on a daily basis. Such devices range from GPS-enabled cell-phones and tablets, to navigation systems. Each device can report a multitude of location data to centralized servers. Such location information, commonly referred to as geospatial data, can have tremendous benefits if properly processed and analyzed. If shared, such geo-spatial data can have significant impact for research and other uses. Sharing such information, however, can have significant privacy implications. In this talk, we will focus on the problem of releasing static geo-spatial data in a private manner. In particular, we will explore methods of releasing a synopsis of two-dimensional datasets while satisfying differential privacy.
The key challenge to anonymizing geospatial datasets while satisfying differential privacy is ensuring the utility of anonymized dataset. In particular, there are two types of error that influence the utility of anonymized datasets. The first is the anonymization noise--a direct byproduct of the differential privacy mechanism. The second is a result of the granularity of data release and the nature of the dataset itself. In this talk, we will explore methods of publishing two-dimensional datasets with utility in mind. We will analyze the current state-of-the-art methods and explore alternative grid-based approaches that best balance the two sources of error.
Services like online banking require high confidentiality due to the sensitivity of the data being transfered. As a result, online users have turned to anonymity services which offer identity protection and secure communication in their web transactions. While these services are secure and trustworthy, their popularity has attracted many attacks which result in the identification of the users. In addition, online applications are not developed with the users' anonymity in mind, which opens doors for more vulnerabilities. In this talk, I will present several attacks that anonymous users may not be aware of but which may jeopardize their anonymity.
In this talk, we focus on a class of buffer overflow vulnerabilities that occur due to the "placement new" expression in C++. "Placement new" facilitates placement of an object/array at a specific memory location. When appropriate bounds checking is not in place, object overflows may occur. Such overflows can lead to stack as well as heap/data/bss overflows, which can be exploited by attackers in order to carry out the entire range of attacks associated with buffer overflow. Unfortunately, buffer overflows due to "placement new" have neither been studied in the literature nor been incorporated in any tool designed to detect and/or address buffer overflows. We would describe how the "placement new" expression in C++ can be used to carry out buffer overflow attacks -- on the stack as well as heap/data/bss. We show that overflowing objects and arrays can also be used to carry out virtual table pointer subterfuge, as well as function and variable pointer subterfuge. Moreover, we show how "placement new" can be used to leak sensitive information, and how denial of service attacks can be carried out via memory leakage.
An essential part of security is controlling access. Traditional access control depends on the a person's ability to prove their identity and the access control system's ability to verify their identity. For computer access, a person usually carries some combination of methods to prove their identity (password, token, and/or biometric). What if a thing needs access instead of a person? It is easy enough to embed a secret into software or hardware so a device can identify itself, but how do you ensure the integrity of that data and the identity of the device? This presentation will discuss challenges of ensuring the device is what it claims to be, how the supply chain effects the assurance level of that identity, new technologies that can be used to provide hardware based identity, and other security features than can be enabled by the secure device identity.
Today, the publication of microdata poses a privacy threat. Vast research has striven to define the privacy condition that microdata should satisfy before it is released, and devise algorithms to anonymize the data so as to achieve this condition. Yet, no method proposed to date explicitly bounds the percentage of information an adversary gains after seeing the published data for each sensitive value therein. This paper introduces \beta-likeness, an appropriately robust privacy model for microdata anonymization, along with two anonymization schemes designed therefor, the one based on generalization, and the other based on perturbation. Our model postulates that an adversary's confidence on the likelihood of a certain sensitive-attribute (SA) value should not increase, in relative difference terms, by more than a predefined threshold. Our techniques aim to satisfy a given \beta threshold with little information loss. We experimentally demonstrate that (i) our model provides an effective privacy guarantee in a way that predecessor models cannot, (ii) our generalization scheme is more effective and efficient in its task than methods adapting algorithms for the k-anonymity model, and (iii) our perturbation method outperforms a baseline approach. Moreover, we discuss in detail the resistance of our model and methods to attacks proposed in previous research.
Perceived risk is informed by a myriad of affective assessments, nine of which have been examined rigorously for offline risk decisions. Is the risk voluntarily taken? Is the impact of the risk immediate or delayed? Does the individual understand the implications of the risk? What is the perceived effectiveness of expert systems/judgments? Does the risk appear controllable? Is the risk new or old? Is it commonly encountered or rarely available? Does it impact individuals or communities? How severe are the consequences of risk taking behavior? This research examines how these nine dimensions inform perceived risk and decision-making online. Further, I examine how the determinants of perceived risk are impinged by context and individual awareness.
Android Phones are becoming more pervasive at MITRE's customers without any means of measuring malicious user or application behavior. More sensitive information is becoming accessible on these phones, while users have access to this data even in the most insecure of places. Without an enterprise monitoring strategy for these mobile devices, sponsors do not have the necessary data to determine when a compromise has occurred. This exposure to a user's or a malicious application's actions could leave sensitive data exposed with little recourse. There is a both a breadth and depth of information that can be gained by using physical forensic acquisition techniques against an Android phone. The resulting forensic images can be mostly treated as traditional images and can be subjected to traditional forensics tools and techniques for analysis. The MITRE Innovation Project research project "Detecting Maliciousness Using Periodic Mobile Forensics" addressed the enterprise use case of installed malicious applications. The results of the research will be discussed, as well as experimentation performed using real mobile malware.
In this talk EJ will be speaking about a security development lifecycle necessary to address vulnerabilities in complex systems. The need for software security is clear in today's cyber world. He will be talking about the steps necessary to ensure a high level of assurance in systems to identify, mitigate, and control threats and vulnerabilities. He will be going beyond the traditional software security development lifecycle and bring real world examples. EJ is an engaging speaker so bring your questions.
Over the past two decades, the Internet has become an essential tool in the lives of millions of people. Unfortunately, this success has also attracted cybercriminals who exploit the Internet as a platform for illicit gain. Perhaps the most familiar scam is sending unsolicited advertisements (spam), clogging inboxes and putting people's computers at risk of dangerous malware infections. Understanding the mechanisms and effectiveness of these scams is essential to building effective countermeasures to cybercrime. In this talk, I'll explain the modern spamming landscape and present research that help us better understand how spammers make their money online. One effort uses the technique of botnet infiltration to examine a spam campaign from the point of view of the spammers. Botnet infiltration allows us to measure their operation including the advertisements' effectiveness and the worldwide use of spam filtering techniques. The second effort exploits key information leaks to answer key questions about the modern affiliate marketing-based spam ecosystem, from estimating their worldwide gross revenue, to understanding customer demographics and their most popular products.
Smartphone security research has become very popular in response to the rapid, world-wide adoption of new platforms such as Android and iOS. Smartphones are characterized by their ability run third-party applications, and Android and iOS take this concept to the extreme, offering hundreds of thousands of "apps" through application markets. Thus, smartphone security research has focused on protecting users from apps. In this talk, I will discuss the current state of smartphone research, including efforts in designing new OS protection mechanisms, as well as performing security analysis of real apps. I will offer insight into what works, what has clear limitations, and promising directions for future research.
The detection of malicious activity can occur at many places within an enterprise. One area that is a natural extension of perimeter based approaches is that of internal network monitoring.
This talk will discuss work done to better detect malicious activity on an enterprise by monitoring internal network traffic. The state of the art will be discussed, as well as the limitations inherent in this monitoring approach. Promising results will be discussed as well as methods that were not as effective.
Identifying and removing malicious insiders from a network is a topic of active research. Vehicular ad hoc networks (VANETs) may suffer from insider attacks; that is, an attacker may use authorized vehicles to attack other vehicles. Specifically, attackers may use their vehicles to broadcast specially formed packets that will trigger warnings in target vehicles. This malicious behavior could have a significant detrimental effect on cooperative safety applications (SAs), one of the driving forces behind VANET deployment.
We propose modifications to the intersection collision warning (ICW) SA that enable a certificate authority (CA) to be offline and yet to decide to revoke a vehicle's certificates using retransmitted information that cannot repudiated. Our approach differs from previous proposals in that it is SA specific, and it is resilient to Sybil attacks. We simulate and measure the resources an attacker requires to attack a vehicle using the ICW SA without our modifications and demonstrate that our additions reduce the false positive rate arising from errors in estimated vehicle dynamics.
Deloitte Security & Privacy will present on recent trends in cyber security consulting, including how industry and regulatory trends are driving change to information security practices. The presentation will also include the anatomy of a cyber incident, walking through a real world example of an incident from discovery to remediation.
Why do we implement systems and application with poor security characteristics? This talk looks at the evolution of network security as a consequence of productive change. Specifically, we will look at the challenges imposed by BYOD requirements (particularly on wireless security), the pressure on performance to meet the aggregated traffic loads of cloud/datacenter demands, the emergence of IP-based industrial controls, and a deep look into how the migration from IPv4 to IPv6 will require new network-based approaches for their security.
Long-range research into information assurance and security has seen peaks and valleys over the past three decades, mirroring larger trends including the explosive growth of Internet services and declining technology R&D investment trends. A gulf threatens to develop between the scope and scale of R&D in the private sector, and in the public sector. In particular, rapid iterative advances by commercial and black-hat entities could outstrip government's ability (particularly the US Government's ability) to perform useful basic research and advanced development of innovative tools and algorithms. Yet these malignant trends are occurring at the same time as some very exciting (but unheralded) progress in critical research areas. This talk will examine these trends, explain their context, and discuss significant implications for the field of security research -- and for the advance of trustworthy computing overall.
The recent and new concept of "Cloud Brokers" and Brokerage came to light with the recent release of the GSA Cloud Broker RFI. What does that mean for the cloud professionals of today (skills they need) and the cloud professionals of tomorrow (skills they are going to need).
Differential privacy is a very powerful approach to protecting individual privacy in data-mining; it's also an approach that hasn't seen much application outside academic circles. There's a reason for this: many people aren't quite certain how it works. Uncertainty poses a serious problem when considering the public release of sensitive data.
Intuitively, differentially private data-mining applications protect individuals by injecting noise which "covers up" the impact any individual can have on the query results. In this talk, I will discuss the concrete details of how this is accomplished, exactly what it does and does not guarantee, common mistakes and misconceptions, and give a brief overview of useful differentially privatized data-mining techniques. This talk will be accessible to researchers from all domains; no previous background in statistics or probability theory is assumed.
My goal in this presentation is to offer a short-cut to researchers who would like to apply differential privacy to their work and thus enable a broader adoption of this powerful tool.
Many security professionals look to software on hardrives as the source of compromise. To detect compromises, they use systems to check the hashes of all files on disk, When a machine is compromised, they wipe the hardrive, and assume that the machine in clean. The battlefield between attackers and defenders is moving to the firmware level. This presentation will explore what firmware exists in your computer and how the fight for your systems will be below your operating system and what can be done about this.
The proliferation of social networks, where individuals share private information, has caused, in the last few years, a growth in the volume of sensitive data being stored in these networks. As users subscribe to more services and connect more with their friends, families, and colleagues, the desire to use this information from the networks has increased. Online social interaction has become very popular around the globe and most sociologists agree that this will not fade away. Social network sites gather confidential information from their users (for instance, the social network site PacientsLikeMe collects confidential health information) and, as a result, social network data has begun to be analyzed from a different, specific privacy perspective. Since the individual entities in social networks, besides the attribute values that characterize them, also have relationships with other entities, the risk of disclosure increases. In this talk we present a greedy algorithm for anonymizing a social network and a measure that quantifies the information loss in the anonymization process due to edge generalization.
Group key management (GKM) is a fundamental building block in any secure group communication applications. In fact, successful management of group keys is critical to the security of any cryptosystem. In this talk, I will first give an overview of the traditional GKM approaches and their limitations to support current technological trends and large dynamic systems. Then I will present a new approach to GKM that is expressive and privacy preserving. The talk is based on our work appeared in ICDE 2010, CCS 2011 and CollaborateCom 2011.
There is a long history of supply chain management, from which many related policies, practices, processes, and enabling artifacts have been developed and employed by those business enterprises that acquire hardware and software components from a third party. Traditionally, Supply Chain Risk Management (SCRM) has been the focal point of supply chain practices and has focused on business and contractual issues, although recent efforts have increasingly included engineering expertise for product quality evaluations.
This presentation advocates the introduction of a security assurance dimension to the SCRM process. It does not, however, propose the addition of an independent, parallel track of SCRM process for security assurance evaluation, but rather practical steps for augmenting those SCRM processes that already exist.
Just as is the case in legacy SCRM, the cyber dimension of SCRM is based on assessing and balancing risk vs. cost. The goal is to minimize the added costs associated with improved information assurance by efficiently incorporating relevant practices industry, government, and academia to provide a security assurance dimension into the supply chain process.
SCRM-relevant industry and government practices will be presented in this paper in such a way that supply chain staff can easily make use of them, even without a background in information security. Also, it will be clearly noted when subcontract management, information assurance engineering, or other business or technical expertise may be needed to complement traditional supply chain activities in the pursuit of cyber-based SCRM. Points of discussion common to both hardware and to software component acquisition will include:
- Acquirer business risk
- End customer mission criticality and mission assurance
- Subcontract management
- Supplier secure development assessment
- Supplier management practices for their suppliers
- Supplier business assessment
- Product assessment
Points of discussion peculiar to hardware component acquisition will include: 1. Quality vs. counterfeiting vs. malicious alteration 2. ASICS, FPGAs, and microprocessors 3. Information storage in volatile memory 4. Information storage in non-volatile memory and permanent disk storage
Points of discussion peculiar to software component acquisition will include: 1. COTS, contracted software, open source, and freeware 2. Software pedigree and provenance 3. License management of open source
Assessing the trustworthiness of location data corresponding to individuals is essential in several applications, such as forensic science and epidemic control. To obtain accurate and trustworthy location data, analysts must often gather and correlate information from several independent sources, e.g., physical observation, witness testimony, surveillance footage, etc. However, such information may be fraudulent, its accuracy may be low, and its volume may be insufficient to ensure highly trustworthy data. On the other hand, recent advancements in mobile computing and positioning systems, e.g., GPS-enabled cell phones, highway sensors, etc., bring new and effective technological means to track the location of an individual. Nevertheless, collection and sharing of such data must be done in ways that do not violate an individual’s right to personal privacy.
Previous research efforts acknowledged the importance of assessing location data trustworthiness, but they assume that data is available to the analyst in direct, unperturbed form. However, such an assumption is not realistic, due to the fact that repositories of personal location data must conform to privacy regulations. In this work, we study the challenging problem of refining trustworthiness of location data with the help of large repositories of anonymized information. We show how two important trustworthiness evaluation techniques, namely common pattern analysis and conflict/support analysis, can benefit from the use of anonymized location data. We have implemented a prototype of the proposed privacy-preserving trustworthiness evaluation techniques, and the experimental results demonstrate that using anonymized data can significantly help in improving the accuracy of location trustworthiness assessment.
With the advent of cloud computing, our view of cryptographic protocols has changed dramatically. In this talk, I will give an overview of some of the newer challenges that we face in cloud cryptography and outline some of the techniques used to solve these problems. In particular, a few questions that I will address are:
1) How can we store sensitive data in the cloud, in an encrypted manner, and yet allow controlled access to certain portions of this data? 2) How can we ensure reliability of data across cloud servers that may be connected by only a low-degree communication network, even when some of the servers may become corrupted? 3) How can users authenticate themselves to the cloud in a user-friendly way?
This talk will assume no prior knowledge of cryptography and is based on works that appear at TCC 2012, ICALP 2010 and STOC 2010.
US Government, Department of Defense, and Enterprise computer systems must be trusted to protect data with varying levels of sensitivity / security. Affordability requirements are driving the need to incorporate many diverse commercial software products of unknown quality and pedigree into said systems. While there exist many Static Code Analysis products, the depth, rigor, and coverage of these tools is incomplete and inconsistent. In addition, finding and eliminating computer flaws or weaknesses is not the same as determining true vulnerabilities. Further there is significant cost reduction that can occur if automated support for establishing the case for trust and assurance can be achieved.
The collection of evolving standards known as the OMG Software Assurance (SwA) Ecosystem is supported and endorsed by AFRL, NIST, SEI, OSD/NII, and DHS Cyber Security Division among others. The SwA Ecosystem defines several standard protocols to enable interoperability for tools, services and security researchers in developing, exchanging and utilizing machine-readable content (e.g. vulnerability patterns, enumerations, rules) for security assurance of existing software based systems. This standard-based plug-and-play framework integrates software analysis and data mining tools and facilitates highly automated fact-oriented approach to assurance by providing traceability link between assurance claims and high-fidelity system facts as evidence to justify assurance claims. This presentation will focus on the work funded by AFRL and OSD/NII to addressing the Vulnerability Path Assessment piece of the Ecosystem.
Using validated carving techniques, we show that popular operating systems (\eg Windows, Linux, and OSX) frequently have residual IP packets, Ethernet frames, and associated data structures present in system memory from long-terminated network traffic. Such information is useful for many forensic purposes including establishment of prior connection activity and services used; identification of other systems present on the system's LAN or WLAN; geolocation of the host computer system; and cross-drive analysis. We show that network structures can also be recovered from memory that is persisted onto a mass storage medium during the course of system swapping or hibernation.
We present our network carving techniques, algorithms and tools, and validate these against both purpose-built memory images and a readily available forensic corpora. These techniques are valuable to both forensics tasks, particularly in analyzing mobile devices, and to cyber-security objectives such as malware analysis.
As technological advancements continue to expand the range of information access, issues of privacy and cyber security have risen to the forefront. Technology is only one part of a larger conversation. Looking through a different lens, consider the humans behind the machines. Technology can now be used with unprecedented ease and anonymity as a malicious vehicle to harass, defame and stalk.
This presentation recounts the very personal and in-depth journey of a target of cyberstalking whose efforts to navigate within the system have been met with both successes and failures. Learn the profound impact this journey has had on life online as well as off, catalyzing a shift in perspective from fear to redefining responsible digital citizenship. The conversation will provide new insights into security issues, communication, and business management, as well as the limitations of the systems currently in place.
The future web, and Internet, are undergoing a humanization of their technologies which increasingly make their services more personalized, individualized and transparent. This is jointly fueled by the inexpensive yet easily accessible huge computing and storage capacities in clouds, the adoption of personal, mobile smart devices used across consumer/enterprise interchangeably, and the emergence of personal agents and services attaining personalized perception of the real-world and its control on behalf of the users. In this human/machine convergences, trust is being recognized as potentially playing a huge role in addressing future human/machine security, commerce and social on-line issues. However, trust has been adopted only partially and independently by certain services and not made integral in the fabric of the Internet or the web.
This talk explores the technical and social issues for the establishment of a ubiquitous trust network in the Future Internet. The talk reviews necessary technologies from the Semantic Web, Intercloud, and broader Identity methodologies, and provides a number of use cases for how the Future Internet would benefit from the trust network.
A variety of mechanisms have been used in access control systems to support enterprises' diverse security needs. For example, some enterprises might allow individual users to assign privileges on files that they own, whereas others might require that permissions be granted and revoked by security administrators only; some enterprises wish to operate under closed access policies (where permission is denied unless explicitly granted), whereas others prefer to allow access only if the number of positive authorizations exceeds the number of negative ones. We will explore two frameworks, namely creation time policies and conflict resolution policies, that together allow software vendors to support a wide variety of discretionary access control mechanisms using a single code base.
Many application domains, such as real-time financial analysis, e-healthcare systems, sensor networks, are characterized by continuous data streaming from multiple sources and through intermediate processing by multiple aggregators. Keeping track of data provenance in such highly dynamic context is an important requirement, since data provenance is a key factor in assessing data trustworthiness which is crucial for many applications. Provenance management for streaming data requires addressing several challenges, including the assurance of high processing throughput, low bandwidth consumption, storage efficiency and secure transmission. In this talk, I will discuss a novel approach to securely transmit provenance for streaming data (focusing on sensor network) by embedding provenance into the inter-packet timing domain while addressing the above mentioned issues. As provenance is hidden in another host-medium, our solution can be conceptualized as watermarking technique. However, unlike traditional watermarking approaches, we embed provenance over the inter-packet delays rather than in the sensor data themselves, hence avoiding the problem of data degradation due to watermarking. Provenance is extracted by the data receiver utilizing an optimal threshold-based mechanism which minimizes the probability of provenance decoding errors. The resiliency of the scheme against outside and inside attackers is established through an extensive security analysis. Experiments show that our technique can recover provenance upto a certain level against perturbations to inter-packet timing characteristics.
A discussion about biometrics, performance and error. Learn more about biometric technologies and challenges related to performance.
We introduce Soundcomber, a "sensory malware" for smartphones that uses the microphone to steal private information from phone conversations. Soundcomber is lightweight and stealthy. It uses targeted profiles to locally analyze portions of speech likely to contain information such as credit card numbers. It evades known defenses by transferring small amounts of private data to the malware server utilizing smartphone-specific covert channels. Additionally, we present a general defensive architecture that prevents such sensory malware attacks.
The open nature of the wireless medium leaves wireless communications exposed to interference caused by the concurrent operation of co-located wireless devices over the same frequency bands. While unintentional signal interference is managed at the physical and mac layers using an array of techniques (advanced signal processing, channel coding and error correction, spread spectrum communications, multiple access protocols, etc.), in a hostile environment, wireless communications remain vulnerable to intentional interference attacks typically referred to as jamming. Jamming can take the form of an external attack launched by "foreign" devices that are unaware of the network secrets (e.g., cryptographic credentials) or its protocols. Such external attacks are relatively easy to neutralize through a combination of cryptography-based measures and spreading techniques. In contrast, when jamming attacks are launched from compromised nodes, they are much more sophisticated in nature.
These attacks exploit knowledge of network secrets (e.g., cryptographic keys and pseudo-random spreading codes) and its protocol semantics to maximize their detrimental impact by selectively and adaptively targeting critical data transmissions. In this talk, we discuss the feasibility and impact of selective jamming attacks in the presence of inside adversaries. The attacker's selectivity is considered at different granularities, namely on a per-channel basis and on a per-packet basis. We describe several mitigation methods that do not rely on the existence of shared secrets, but defeat selectivity via a combination of temporary packet hiding and uncoordinated frequency hopping.
Previous research on virtual machine introspection proposed "out-of-box" approach by moving out security tools from the guest operating system. However, compared to the traditional "in-the-box" approach, it remains a challenge to obtain a complete semantic view due to the semantic gap between the guest VM and the hypervisor.
In this paper, we present Process Implanting, a new active VM introspection framework, to narrow the semantic gap by implanting a process from the host into the guest VM and executing it under the cover of an existing running process. With the protection and coordination from the hypervisor, the implanted process can run with a degree of stealthiness and exit gracefully without leaving negative impact on the guest operating system. We have designed and implemented a proof-of-concept prototype on KVM which leverages hardware virtualization. We also propose and demonstrate application scenarios for Process Implanting in the area of VM security.
Learn how organization's proactivly protect against malware that traditional signature-based anti virus solutions miss.
Peer-to-peer real-time communication and media streaming applications optimize their performance by using application-level topology estimation services such as virtual coordinate systems. Virtual coordinate systems allow nodes in a peer-to-peer network to accurately predict latency between arbitrary nodes without the need of performing extensive measurements. However, systems that leverage virtual coordinates as supporting building blocks, are prone to attacks conducted by compromised nodes that aim at disrupting, eavesdropping, or mangling with the underlying communications. Recent research proposed techniques to mitigate basic attacks (inflation, deflation, oscillation) considering a single attack strategy model where attackers perform only one type of attack. In this work we explore supervised machine learning techniques to mitigate more subtle yet highly effective attacks (frog-boiling, network-partition) that are able to bypass existing defenses. We evaluate our techniques on the Vivaldi system against a more complex attack strategy model, where attackers perform sequences of all known attacks against virtual coordinate systems, using both simulations and Internet deployments.
The talk reports on an early stage of on-going research on the application of computational semantic techniques to detect phishing, i. e., mass mailings intended to sweep up personal details for later malicious use by the phishers themselves or their potential customers. Our personal experience as targets of phishing has shown that the texts are getting increasingly polished, plausible, and sophisticated, often making it difficult even for humans to tell phishing from bona fide, if unadvised messages.
In this talk, we will demonstrate, on a few examples, how Ontological Semantic Technology can help to achieve machine natural language understanding that allows the computer to match and, augmented by the best existing technologies, possibly exceed human ability to detect the meaning-based clues pointing to phishing and to reason accordingly. We will also discuss the problem of automatic phishing detection and share our thoughts on applying the most feasible and promising techniques on a large corpus of phishing emails.
Since early 2010 Google, Sony, Epsilon CitiBank, International Monetary Fund, RSA, various law enforcement agencies and many other organizations have been compromised by different attack groups. These groups include hacktivist organizations like Anonymous, Eastern European organized crime and state-sponsored teams referred to as the Advanced Persistent Threat.
Mandiant will draw upon investigations it has conducted over the last eighteen months to:
Illustrate major differences among the attack groups
Describe the tactics attackers use to breach their victims
Outline the investigative approaches required to contain active attack groups
Detail remediation techniques that are most successful at removing attackers from the networks.
The information covered will not be theoretical. All the material will anonymously reference actual cases Mandiant has conducted – some of which have not received media attention to date.
Computer hardware and software that perform real-world functions such as flight control, telecommunications switching, and network routing form a class of systems called embedded systems. These embedded systems have challenges that differ from general purpose computing. The security challenges of embedded systems have become a topic of concern in critical infrastructure such as SmartGrid. This presentation will discuss the embedded systems security challenges and a possible solution, Trusted Computing. Trusted Computing provides a tight coupling of hardware and software for security which can provide significant security enhancements over software only solutions and is highly applicable to embedded systems.
Secret sharing is important in information and network security and has broad applications in the real world. Since an elegant secret sharing mechanism was first proposed by Shamir in 1979 (also Blakley did the similar work then), many schemes have appeared in literature. These schemes deal with either single or multiple secrets and their shares have either the same weight or different weights. Weighted shares mean that different shares have different capabilities in recovering the secret(s) -- a more (less) weighted share needs fewer (more) other shares to recover the secret(s).
In this talk, we will first discuss two primary categories of (representative) methods implementing secret sharing: polynomial based, i.e., Shamir’s scheme, and Chinese Remainder Theorem (CRT) based, i.e., Mignotte's scheme. Then we present a new CRT based weighted multiple secret sharing scheme, based on the identification of a direct relation between the length (i.e., the number of bits) and the weight of shares. The new scheme can also be naturally applied to other cases such as sharing a single secret with same-weight shares and is remarkably simple and easy to implement. Compared to both Shamir's scheme and Mignotte's scheme, the new scheme is more efficient than both schemes in share computation and more efficient than Shamir's scheme (and as efficient as Mignotte's scheme) in secret recovery. One prominent and unique advantage of the new scheme is that it admits non-whole number weights which the existing schemes have not offered. Thus, the sizes of shares can vary distantly in fine-tuned granularity to fit different requirements and constraints of various devices such as sensors, PDAs, cell phones, iPads and to allow the new scheme to apply to broader applications involving wireless/sensor networks and pervasive computing.
The ongoing explosion of data and information throughout the enterprise is undeniable. Sensitive data, whether structured or unstructured, finds itself replicated and dispersed. This creates a challenge for information security professionals to prevent the flow of this information to unauthorized or inappropriate destinations.
The security community has made great progress in protecting this data and information while it is at rest or in use. But ... is there more that can be done?
Companies are now asking, "Who moved my data and where did it go? Was it an appropriate flow from one internal department to another? Was the flow intended for a trusted business partner? Or ... was my data heading for an unknown destination, a competitor or a pool of cybercriminals?"
End point controls, access controls, database monitoring and encryption are all important components of a solid layered security approach. However tools that provide visibility and control over "data in motion" deliver critical capabilities that none of these other components can adequately address. When prioritizing various components or layers of an information security implementation, it has been argued that a solid "data in motion" component can provide 80% of the bang for 20% of the buck (and effort!)
This presentation focuses on methods and techniques in wire speed detection and control of data in motion. The presentation will include:
approaches to detecting simple patterns emphasizing low false positives advances in wire speed pattern matching enabling protection of specific fields or combination of fields in a database policy designs that combine network application controls with content identification and control wire speed blocking that does not require a proxy
Vast resources are devoted to predicting human behavior in domains such as economics, popular culture, and national security, but the quality of such predictions is often poor. Thus, it is tempting to conclude that this inability to make good predictions is a consequence of some fundamental lack of predictability on the part of humans. However, recent work offers evidence that the failure of standard prediction methods does not indicate an absence of human predictability but instead reflects: 1. misunderstandings regarding which features of human dynamics actually possess predictive power 2. the fact that, until recently, it has not been possible to measure these predictive features in real world settings. This talk introduces some of the science behind these basic observations and demonstrates their utility in various case studies. We begin by considering social groups in which individuals are influenced by the behavior of others. Correctly identify and understanding the social forces in these situations can increase the extent to which the outcome of a social process can be predicted in its very early stages. This finding is then leveraged to design prediction methods which outperform existing techniques for predicting social network dynamics. We also look at the analysis of the predictability of adversary behavior in the co-evolutionary "arms races" that exist between attackers and defenders in many domains. Our analysis reveals that conventional wisdom regarding these co-evolving systems is incomplete, and provides insights which enable the development of predictive methods for computer network security.
The abuse of online games by automated programs, known as bots, has grown significantly in recent years. The conventional methods for distinguishing bots from humans, such as CAPTCHAs, are not effective in a gaming context. This talk presents a non-interactive approach based on human observational proofs for continuous game bot detection. HOPs differentiate bots from human players by passively monitoring input actions that are difficult for current bots to perform in a human-like manner. The talk describes a prototype HOP-based game bot defense system that analyzes user-input actions with a cascade-correlation neural network to distinguish bots from humans. The experimental results show that the HOP system is effective in capturing game bots in World of Warcraft, raising the bar against game exploits and forcing attackers to build more complicated bots for detection evasion in the future.
Privacy Preserving Data Publishing (PPDP) is an evolving research field that is targeted at developing anonymization techniques to enable publishing data so that privacy is preserved while data distortion is minimized. Up until recently most of the research on PPDP considered partition-based anonymization models. The approach in such models is to partition the database records into groups and then homogeneously generalize the quasi-identifiers in all records within a group, as a countermeasure against linking attacks. We describe in this talk alternative anonymization models which are not based on partitioning and homogeneous generalization. Such models extend the set of acceptable anonymizations of a given table, whence they allow achieving similar privacy goals with much less information loss. We shall briefly review the basic models of homogeneous anonymization (e.g. k-anonymity and l-diversity) and then define non-homogeneous anonymization, discuss its privacy, describe algorithms and demonstrate the advantage of such anonymizations in reducing the information loss. We shall then discuss the usefulness of those models for data mining purposes. In particular, we will show that the reduced information loss that characterizes such anonymizations translates also to enhanced accuracy when using the anonymized tables to learn classification models.
Based on joint works with Aris Gionis, Arnon Mazza, Mark Last and Sasha Zhmudyak
The number of generic top-level domains in the Internet's Domain Name System has been increasing slowly since 2000. In July 2011 the Internet Corporation for Assigned Names and Numbers (ICANN) approved a long-awaited plan to significantly increase the number of generic top-level domain names. With a specific focus on users of the Extensible Provisioning Protocol (EPP), this presentation will describe the practical challenges faced by participants in the domain name provisioning ecosystem in the face of evolving domain name management requirements.
My late friend Robert Garigue, a pioneer of Information Warfare and one of the most original and visionary corporate Chief Information Security Officer, first described the notion a "semantic attack" as the eventual non plus ultra in the hacking arsenal. Semantic attacks do not target directly the information-carrying or information-bearing portions of a system, but rather those components of the system that give it meaning and value; i.e. the semantic components that help us, among other things, establish and maintain truth and trust. When Garigue first coined the phrase "Hack not system, hack the belief system" many of us misinterpreted this as a cry for addressing the non-electronic non-technological "soft" components of the system, i.e. humans and their decision making cycles. In fact, social engineering, phishing attacks and other forms of internet-based cons are in some sense instances of such cyber-mediated attacks on the "meat computers" we have in our brains. However, reality is fast catching up with Science Fiction, and our decision making whether as citizens in a democracy, consumers, military leaders, politicians, businessmen and even intellectuals, is increasingly depending on Internet-based sources and systems. Our increased use and reliance on search engines, social networks, blogospheres, wikis and other non traditional media, for our daily decision making has made it such that an increased portion of the semantic system is computer-based. How are we to define, evaluate or measure the security of these new cybernetic semantic components? Join me on a highly speculative tour of "Semantic Security" (tm), a new subfield of Computer Security, ripe with lots of low-hanging, easily solvable research problems. Believe me!!
The correlation of information from disparate sources has long been an issue in data fusion research. Traditional data fusion addresses the correlation of information from sources as diverse as single-purpose sensors to all-source multi-media information. Information system vulnerability information is similar in its diversity of sources and content, and in the desire to draw a meaningful conclusion, namely, the security posture of the system under inspection. FuzzyFusion™, a data fusion model that is being applied to the computer network operations domain is presented. This model has been successfully prototyped in an applied research environment and represents a next generation assurance tool for system and network security.
Krannert Auditorium, Purdue University, West Lafayette, IN The interaction of society, law enforcement and telecommunications has evolved over the last 140 years to a successful balance of give and take. Society gives, providing well-defined processes and procedures that allow the government, law enforcement and citizens regulated access to information routinely collected by telecommunications service providers. And society benefits, where its justice systems can effectively use the information in support of criminal investigations and civil dispute resolutions. Internet technology has been designed, developed and deployed without any consideration to this relationship, and the technical and social void that has emerged isactively being exploited, reducing the security of the Internet, and the natural compensatory actions threaten innovation and privacy.
Our presentation discusses how a comprehensive policy regarding Internet communications identifying information (CII), could align the Internet with the existing public private partnerships that have evolved, minimizing the threats to privacy that an Internet ‘wiretapping’ strategy alone could generate.
If you are interested in what cyber-related technologies will be most relevant at the time you graduate, and where many of the cutting-edge jobs will be, then this talk will be of interest. This presentation will be a high level view of where Lockheed Martin and what where we think the government is heading in terms of Cyber security and especially in wireless technologies realm such as Wi-Fi, Cellular, Wi-Max, and Zigbee communications.
This presentation will also discuss the cyber capabilities in Hanover, MD and the new NexGen cyber security center in Gaithersburg. The presentation will lead into how some of our interns contributed to the cyber arena and later were hired and became permanent members of the Lockheed team. We would like the talk to be as interactive as possible to help answer questions from students and graduates on cyber security topics and how Lockheed Martin can help those starting their careers in the cyber security domain.
SHODAN is a computer search engine. But it is unlike any other search engine. While other search engines scour the web for content, SHODAN scans for information about the sites themselves. The result is a search engine that aggregates banners from well-known services. This presentation will focus on the applications of SHODAN to penetration testers, and in particular will detail a number of case studies demonstrating passive vulnerability analysis including default passwords, descriptive banners, and complete pwnage. For penetration testers, SHODAN is a game-changer, and a goldmine of potential vulnerabilities.
The Domain Name System (DNS) is one of the components most critical to Internet functionality. The ubiquity of the DNS necessitates both the accuracy and availability of responses. While the DNS Security Extensions (DNSSEC) add authentication to the DNS, they also increase the complexity of an already complex name resolution system. Many deployments have suffered from server misconfiguration or maintenance neglect which increase the likelihood of name resolution failure for a domain name, even if servers are responsive.
Our research introduces metrics for quantifying DNSSEC availability and evaluates these metrics on production signed DNS zones to show the pervasiveness of misconfiguration. We present methodology for increasing robustness of name resolution in the presence of DNSSEC misconfiguration. In our survey of production signed zones, we observe that nearly one-third of the validation errors detected might be mitigated using the technique proposed in our research.
As part of my talk, I will also demo an online DNS visualization tool designed to assist administrators in identifying critical issues with their DNSSEC deployments.
This is joint work with researchers at UC Davis and Intel Corporation.
This talk will summarize two recent results on JavaScript.
"The Eval that Men Do": Transforming text into executable code with a function such as JavaScript’s eval endows programmers with the ability to extend applications, at any time, and in almost any way they choose. But this expressive power comes at a price. Reasoning about the dynamic behavior of programs that use this features becomes difficult. A better understanding of how eval is used could lead to increased performance and security. I will report on a large-scale study of the use of eval in JavaScript-based web applications. We have recorded the behavior 317 MB of strings given as arguments to 481,844 calls to the eval function. We provide statistics on the nature and content of strings used in eval expressions, as well as their provenance and data obtained by observing their dynamic behavior.
"Flexible Access Control Policies with Delimited Histories and Revocation": Providing security guarantees for software systems built out of untrusted components requires the ability to enforce fine-grained access control policies. This is evident in Web 2.0 applications where JavaScript code from different origins is often combined on a single page, leading to well-known vulnerabilities. We present a security infrastructure which allows users and content providers to specify access control policies over delimited histories and allows for revocation of the history, and reversion to a safe state if a violation is detected. We report on an empirical evaluation in the context of a production browser. We show examples of security policies which prevent real attacks without imposing drastic restrictions on legacy applications. We have evaluated our proposal with two non-trivial policies on 50 of the Alexa top websites with no changes to the legacy JavaScript code. Between 72% and 84% of the sites were fully functional, and only 1 site was rendered non-functional.
There is considerable research being conducted on insider threats directed to developing new technologies. At the same time, existing technology is not being fully utilized because of non-technological issues that pertain to economics and the human dimension. Issues related to how insiders actually behave are critical to ensuring that the best technologies are meeting their intended purpose. In our research, we have investigated accepted models of perceptions of risk and characteristics unique to insider threat, and we have introduced ordinal scales to these models to measure insider perceptions of risk. We have also investigated decision theories, leading to a conclusion that prospect theory, developed by Tversky and Kahneman, may be used to describe the risk-taking behavior of insiders and can be accommodated in our model. Our results indicate that there is an inverse relationship between perceived risk and benefit by insiders and that their behavior cannot be explained well by the models that are based on the traditional methods of engineering risk analysis and expected utility. We discuss the results of validating that model with forty-two senior information security executives from a variety of organizations. We also discuss how the model may be used to identify characteristics of insiders’ perceptions of risk and benefit, their risk-taking behavior and how to frame insider decisions. Finally, we recommend understanding risk of detection and creating a fair working environment to reduce the likelihood of committing criminal acts by insiders.
The Wisebed wireless sensor network testbed provides a federated experimentation facility covering several European universities. For scalable management of access control we have designed and implemented a single-sign-on and attribute-based authentication and authorization infrastructure based on the Shibboleth software, which has been developed by the Internet2 Middleware Initiative. Shibboleth is usually used for protecting browser-based access of web resources. We have designed and implemented an extension to protect web services using the Simple Object Access Protocol. This extension allows both user and machine authentication for web services. As a proof of concept, we implemented a complete reservation system for sensor nodes in the Wisebed test-bed federation. Two different user interfaces based on a web page and an iPhone application have been implemented. Although implemented for Shibboleth, the architecture can be easily adapted to other authentication and authorization infrastructures.
Research in computer security has historically advocated Design for Security, the principle that security must be proactively integrated into the design of a system. While examples exist in the research literature of systems that have been designed for security, there are few examples of such systems deployed in the real world. Economic and practical considerations force developers to abandon security and focus instead on functionality and performance, which are more tangible than security. As a result, large bodies of legacy code often have inadequate security mechanisms. Security mechanisms are added to legacy code on-demand using ad hoc and manual techniques, and the resulting systems are often insecure.
This talk advocates the need for techniques to retrofit systems with security mechanisms. In particular, it focuses on the problem of retrofitting legacy code with mechanisms for authorization policy enforcement. It introduces a new formalism, called fingerprints, to represent security-sensitive operations. Fingerprints are code templates that represent accesses to security-critical resources, and denote key steps needed to perform operations on these resources. This talk develops both fingerprint mining and fingerprint matching algorithms.
Fingerprint mining algorithms discover fingerprints of security-sensitive operations by analyzing source code. This talk presents two novel algorithms that use dynamic program analysis and static program analysis, respectively, to mine fingerprints. The fingerprints so mined are used by the fingerprint matching algorithm to statically locate security-sensitive operations. Program transformation is then employed to statically modify source code by adding authorization policy lookups at each location that performs a security-sensitive operation.
These techniques have been applied to three real-world systems. These case studies demonstrate that techniques based upon program analysis and transformation offer a principled and automated alternative to the ad hoc and manual techniques that are currently used to retrofit legacy software with security mechanisms. Time permitting, we will talk about other problems in the context of retrofitting legacy code for security. I will also indicate where ideas from model-checking have been used in this work.
Many companies today are paying attention to cloud computing and new aspects of large-scale, distributed computing. This emerging paradigm of the information age offers exciting benefits to companies and users, but cloud computing, like any other innovation, faces challenges such as security and privacy risks. How do different stakeholders perceive these risks and the effectiveness of the mitigations? And, how are these reflected in their trust in the cloud? The answers to these questions can affect the outcome of policy debates, and the allocation of resources in controlling security issues of cloud environments. This work presents an introduction to the cloud and some of its advantages and disadvantages. It discusses the role of risk perception and trust in security and privacy challenges of the cloud. It also makes recommendations addressing these challenges.
Piracy is a significant source of concern facing software developers, music labels, and movie production companies. Firms continue to invest in digital rights management technologies to thwart piracy, but their efforts are quickly defeated by hackers and pirates. In the context of piracy, we observe a surprising phenomenon: pirates may often choose to purchase the digital good after pirating it. This is quite interesting given the minimal risk of being caught. Since piracy is often considered a victimless crime, we theorize that moral obligation may mediate other constructs from the theory of planned behavior. We believe this is a consequence of the desire for an individual to rationalize unethical behavior, especially when the crime is victimless. We also identify under what circumstances an individual might be susceptible to exogenous nudging from a software company. Salient constructs under initial purchase and piracy conversion intentions are compared to document under which situations they become relevant to the potential pirate.
Physically unclonable functions (PUFs) are hardware structures that create unique characteristics for distinct copies of a device. Specifically, the physical nature of manufacturing a device introduces slight variations that can be neither controlled nor predicted. PUFs quantify these differences into a random one-way function. In our work, we have explored multiple application scenarios for integrating PUFs into security systems.
In the first application, we propose leveraging PUFs to bind access requests to known, trusted devices. This scheme also offers a lightweight key exchange protocol that can reduce the computational cost for low-power embedded devices. In our second work, we have designed PEAR, a portable authentication token based on PUFs that allows for privacy-preserving transactions with websites. Finally, we have created PUF ROKs, which are read-once cryptographic keys based on PUFs. In this talk, we will introduce these applications, highlighting the advantages of deploying PUFs over competing technologies, as well as presenting the results of our empirical and formal analyses of these prototypes.
Coordinated attacks, such as botnets, present a major threat to today's computing infrastructures. They are able to evade traditional detection techniques by using zero-day and polymorphic exploits, partitioning misbehavior, and encrypting communications. I will discuss our work that aims to identify coordinated activity itself by analyzing the patterns of network communication and inferring information via the available side information.
First, I will discuss the detection of linked network flows that relay traffic across compromised computers, called stepping stones. We use statistical techniques to locate timing correlation between flows, aided by active perturbation of network delays to insert a specialized pattern, called a watermark. I will show that the use of watermarks provides superior detection performance over passive correlation and present two watermark designs: RAINBOW, a low-overhead watermark for enterprise-level stepping stone detection, and SWIRL, a scalable design that can be used in the wide area.
I will then discuss our work on using community detection to locate groups of computers organized into a structured peer-to-peer topology. Our tool, BotGrep, finds tightly connected components in communication graphs using several graph-theoretic metrics and heuristics. It is designed to scale to very large data sets, allowing large core ISPs to detect previously unknown peer-to-peer botnets.
Computing system compromises occur because system integrity is not managed effectively. The various parties that contribute to a system, programmers, OS distributors, and system administrators, do not account for integrity threats comprehensively, leading to recurrence of the same kinds of attacks. The problem is that we lack scalable and automated approaches for these parties to assess the integrity of their individual components that enables one to build upon the efforts of others. In this talk, I will discuss an conceptual approach to composing system-wide integrity from enforcement of multiple system layers. This approach is motivated by various work in information flow security, but we find that managing system-wide integrity requires different inferencing approaches and care in mapping actual components to the model. In particular, we will discuss methods to establish a specifications of integrity, validating the initial integrity of system components and channels, and composing systems from such components that protect runtime integrity. We will demonstrate the use of methods on Xen and Linux systems for deploying cloud computing applications. We show that accounting for integrity in component design can lead to comprehensive system-wide management.
The 80s and 90s saw a revolution in hardware verification, where automata theory played a prominent role, formalizing model-checking and establishing the basis of verification using the logic-automata connection. We shift focus to software verification and ask how exactly would automata theory be useful in program analysis.
Drawing from work in recent years in software verification in my research group as well as in the field, I will identify several key areas, ranging from modeling, abstraction, model-checking, interface synthesis, testing, to logical reasoning with dynamic data-structures, where automata theory promises to provide the right abstractions and yield effective tools for program analysis.
Current web browsers are complex, have enormous trusted computing bases, and provide attackers with easy access to modern computer systems. In this talk we introduce the Illinois Browser Operating System (IBOS), a new operating system and a new browser that reduces the trusted computing base for web browsers. In our architecture we expose browser-level abstractions at the lowest software layer, enabling us to remove almost all traditional OS components and services from our trusted computing base by mapping browser abstractions to hardware abstractions directly. We show that this architecture is flexible enough to enable new browser security policies, can still support traditional applications, and adds little overhead to the overall browsing experience.
I will also talk briefly about some of my groups recent work in defending against malicious hardware.
Regular expression (RegEx) matching is a core component of deep packet inspection in modern networking and security devices. Prior RegEx matching algorithms are either software-based or FPGA-based. Software-based solutions have to be implemented in customized ASIC chips to achieve high-speed, the limitations of which include high deployment cost and being hard-wired to a specific solution and thus limited ability to adapt to new RegEx matching solutions. Although FPGA-based solutions can be modified, resynthesizing and updating FPGA circuitry in a deployed system to handle RegEx updates is slow and difficult. In this talk, we present the first hardware-based RegEx matching solution that uses Ternary Content Addressable Memories (TCAMs), which are off-the-shelf chips and have been widely deployed in modern networking devices for packet classification. There are three main reasons why TCAM-based RegEx matching works well. First, a small TCAM is capable of encoding a large Deterministic Finite Automata (DFA) with carefully designed algorithms leveraging the ternary nature and first-match semantics of TCAMs. Second, TCAMs facilitate high-speed RegEx matching because TCAMs are essentially high-performance parallel lookup systems: any lookup takes constant time (i.e, a few CPU cycles) regardless of the number of occupied entries. Third, because TCAMs are off-the-shelf chips that are widely deployed in modern networking devices, it is easy to design networking devices that include our TCAM based RegEx matching solution.
In this seminar, we present results from a global study about Web 2.0 use in organizations. The study, commissioned by McAfee, Inc., included a worldwide survey of over 1,000 organizational IT leaders, and in-depth interviews with industry experts. Data paint a rich picture of adoption and usage trends, as well as security concerns related to Web 2.0 technologies.
In this seminar, an Obfuscation Module is discussed. This module provides a means to perform computation on untrusted computing systems while maintaining the confidentiality and integrity of the information. Being able to do so not only enables assured processing, such as running a program with certain assurances that the algorithm will remain protected, but it can also increase the defensive posture of cyber systems. When an executable is requested by the operating system, the module will apply obfuscation techniques to repackage it. Once repackaged, it will send the new executable to the host system. In this way, the untrusted system will never have access to the original executable image but a convoluted equivalent of it, protecting the confidentiality of the image and the algorithm which it implements, since it is cost prohibitive to unscramble the available executable.
This talk will initially provide an overview of Telcordia's cyber security research. The talk will then focus on Telcordia's research in securing MANETs. MANETs are networks that do not require a fixed infrastructure (like base stations or access points) that are typically used in commercial wireless networks. In MANETs, messages are relayed from node to node from the source of a packet towards the destination. If there is a "sufficient" number of nodes covering a specific area, communication between the source and the destination can be achieved. MANETs have attracted a lot of interest in applications where fixed infrastructure may not be available or has been destroyed such as vehicle to vehicle communication, military networks, and disaster relief support. The key value of MANETs is their ability to allow nodes to join forces quickly to form a network. Achieving the potential value of MANETs in a secure manner though is a significant challenge. This talk will discuss Telcordia's research and progress in this area.
With software-as-a-service becoming mainstream, more and more applications are delivered to the client through the Web. Unlike a desktop application, a web application is a "two-part" program, with its components deployed both in the browser and in the web server. The communication between these two components inevitably leaks out the program's internal states to those eavesdropping on its web traffic, simply through the side channel features of the communication such as packet length and timing, even if the traffic is entirely encrypted. In this talk, I will present our discovery showing that such side-channel leaks are both fundamental and realistic: a set of high-profile web applications are found to disclose highly sensitive user data such as one's family incomes, health profiles, investment secrets and more through their side channels. More importantly, we found that the root causes of the problem are some fundamental characteristics of web applications: stateful communication, low entropy input for better interaction, and significant traffic distinctions. This indicates that a significant improvement of the current web-application development practice becomes necessary. As a response to this urgent call, I will also describe in this talk a new technique we developed, called Sidebuster, which facilitates detection and quantification of side-channel vulnerabilities during development of web applications.
This talk will examine the state of current and proposed rootkits, to try and answer the following question: are rootkits stupid and lame? The speaker will provide supporting evidence that most all rootkits are eminently detectable, in theory. But theory doesn’t matter if tools for detection are not used in practice. Therefore the talk will highlight the few weaknesses in detection methodologies and many weaknesses in tools, so that the audience can think about what they could do to make the world more secure.
Assurance of authenticity as well as confidentiality of data is an important problem, in cloud computing and in third-party data distribution environments. Existing data authentication schemes for structured and semi-structured data such as trees and graphs leak information, leading to privacy and confidentiality breaches. We have developed schemes for leakage-free authentication of trees and graphs. Our schemes are provably secure and efficient. In this talk, I would present these schemes as well as describe how to address the problem for disconnected trees/graphs (forests) (e.g., a set of databases). Time permitting, we would discuss some of the applications of these schemes. Our solutions have several applications in the cloud-based service offerings such as in the database and e-mail as services, storage and distribution of healthcare and biological data, and in security of social networks.
In this talk we identify two general frameworks (inter-flow and intra-flow) that encompass several network coding-based systems proposed in wireless mesh networks. Our systematic analysis of the components of these frameworks reveals vulnerabilities to a wide range of attacks, which may severely degrade system performance. We then focus on addressing the most severe and generic attack against network coding systems, known as packet pollution attack. We show that existing cryptographic mechanisms that were proposed to solve the problem have a prohibitive cost that makes them impractical in wireless mesh networks. We propose the first practical defense mechanisms to pollution attacks in network coding for wireless mesh networks. The experimental results show that the proposed mechanisms can effectively filter out polluted packets and quickly identify and isolate attacker nodes while incurring small computation and bandwidth overhead.
The paper describes a computational system, an application and implementation of the mature Ontological Semantic Technology, for detecting unintentional inferences in casual unsolicited and unrestricted verbal output of individuals, potentially responsible for leaked classified information to people with unauthorized access. Uses of the system for cases of insider threat and/or social engineering are discussed.
This seminar will provide an overview of how Information Security (AKA Cyber Security, AKA INFOSEC) engineering, requirements analysis and security policies and other activities fit into the overall life cycle of an IT system. We will define an INFOSEC systems engineering methodology using industry best practices and we will define the major steps or key activities in that systems engineering methodology. We will also discuss what the role of Information Systems Security Engineering and the Systems Security Engineers should be in the Life Cycle processes.
The power of modern websites emerges to a large extent from the ability to combine content from different sources. As an example, a site may include a Google map next to business information a user had been searching for. Combining content from possibly untrusted sites gives rise to all sorts of security concerns, as JavaScript has no concept of separating scripts from different sources. This has lead to several recent attacks like the Samy or Yamanner worms. This talk presents the state of the art in securing JavaScript for such settings and proposes a sandboxing facility for in-browser script separation.
Shannon started the unclassified scientific research in cryptography with his October 1949 paper. First we briefly survey the scientific research in cryptography since then. We discuss the strengths and weaknesses of this research, attempting to present a balanced viewpoint.
The lecture will also discuss the progress we have not made. We will show that not everything in modern cryptography is rosy. Besides above examples, we will also talk about the discrepancy between the massive number of applications of cryptography studied by academics and the fact most of these are being viewed as completely irrelevant to the real world.
The security field is an excellent illustration of the maxim that
the more things change, the more they stay the same.'' Thus while
technical details change, underlying security principles remain
remarkably constant. Dr. Bell's talkEverything I Needed to Know
about Security, I Learned in 1974'' covers the lessons he learned
in his early modeling work, how they have remained valid since, and
how those principles inform his view of 21st-Century challenges.
The rapid growth of communication environments such as the Internet has spurred the development of a wide range of systems and applications based on peer-to-peer ideologies. As these applications continue to evolve, there is an increasing effort towards improving their overall performance. This effort has led to the incorporation of measurement-based adaptivity mechanisms and network awareness into peer-to-peer applications, which can greatly increase peer-to-peer performance and dependability. Unfortunately, these mechanisms are often vulnerable to attack, making the entire solution less suitable for real-world deployment. In this work, we study how to create robust systems components for adaptivity, network awareness, and responding to identified threats. These components can form the basis for creating efficient, high-performance, and resilient peer-to-peer systems.
For the second time, MITRE's Common Weakness Enumeration project has released a Top-25 list. However, this year's is a much more sophisticated document, created using a systematic and more rigorous approach. It contains several sections and tables as well as profiles, and isn't only a list. I will explain what the CWE is, what the purpose of the Top-25 is, how it was created, which problems it faced and which it still faces, how it has been improved since last year, and how you can use it.
By exploiting existing vulnerabilities, malicious parties can take advantage of resources made available by grid systems to attack mission critical websites or the grid itself. In this paper, we present two approaches for protecting against attacks aiming at targets located outside or inside the grid. Our approach is based on special-purpose software agents, referred to as accountability agents that collect provenance and resource usage data in order to perform detection and protection. We show the effectiveness of our approach and the performance of the accountability agent based system by conducting various experiments on a grid-emulated testbed.
We present ribbons, a shared memory programming model that allows for more implicit sharing of memory than processes but is more restrictive than threads. Ribbons structure the heap into protection domains. Privileges between these protection domains are carefully controlled to provide the ability to fully or partially “sandbox” certain portions of a program’s computation. RibbonJ, a backwards-compatible extension of Java, is defined to easily create programs that leverage the ribbons model. RibbonJ is implemented within Jikes RVM, and avoids the overhead of inline security checks and read or write barriers by leveraging the memory protection mechanisms already supported in modern hardware and operating systems. This is joint work with Harrison Metzger and Professor Patrick Eugster.
This talk presents a systematic approach for estimating the trustworthiness of data items in data stream environments (such as sensor networks). The approach uses the data item provenance as well as their values. To obtain trust scores, the approach exploits a cyclic framework which well reflects the inter-dependency property: the trust scores of data items affect the trust scores of network nodes, and vice versa. The trust scores of data items are computed from their value similarity and provenance similarity. The value similarity comes from the principle that “the more similar values for the same event, the higher the trust scores,” and we compute it under the assumption of normal distribution. The provenance similarity is based on the principle that “the more different provenances with similar values, the higher the trust scores,” and we compute it using the tree similarity. Since new data items continuously arrive in DSMSs, we need to evolve (i.e., recompute) trust scores to reflect those new items. As evolution scheme, we propose the batch mode for computing scores (non)periodically along with the immediate mode. Experimental results show that the approach is efficient and effective in data stream environments.
This talk will look at how analytics can be used to increase our understanding of what digital evidence actually means. The real value of evidence is often related to the context and meaning of the data ; not just on its mere existence. The talk will examine how analytics can be used to answer core investigative and intelligence questions and where meaning can be found.
Trusted insiders who misuse their privileges to gather and steal sensitive information represent a potent threat to businesses. Applying access controls to protect sensitive information can reduce the threat but has significant limitations. Even if access controls are set properly, they don't protect against rogue employees who legitimately need to access sensitive information. Since 2002, researchers at MITRE have investigated methods for detecting insiders who misuse their legitimate access to steal information. A three-year, internally funded research effort developed and evaluated a research prototype of a system called Elicit (Exploit Latent Information to Counter Insider Threats) to help analysts identify insider threats. Work on Elicit prompted a team of engineers and social scientists to experimentally explore how malicious insiders use information differently from a benign baseline group. This talk presents results from the research prototype evaluation, discusses preliminary results from the double-blind study of malicious insiders, and offers some essential aspects for detecting insider threats gleaned from these efforts.
In today's society, biometric technologies are being used in a number of different applications. This discussion will introduce the concept of biometric technologies, and outline various challenges and solutions that are being undertaken in the biometrics lab at Purdue University.
Threats to privacy are not only due to traditional computer security issues; human factors issues such as unintentional disclosure of information also have an impact on privacy preservation. In this talk I will discuss two examinations of psychological aspects of privacy and how they relate to technology. First, I will present results from an investigation of everyday privacy behaviors and discuss how these naturally occurring behaviors can guide the design of privacy protective technology. Then, I will introduce the concept of misclosure, which is the unintentional disclosure of information, and provide multiple example misclosures. I will conclude by demonstrating that misclosures a) occur frequently b) occur across systems and c) may be preventable by considering human factors during design.
The Director of the VeriSign iDefense Applied Vulnerability Research Labs discusses current cyber security trends identified in 2008 and manifested in 2009 from Cyber Crime, Cyber War, Cyber Espionage and Cyber Terrorism. He will then look over the horizon to identify some potential Cyber Security Disruptors; ideas or technologies coming down the pike that will fundamentally change how the security community protects its enterprise and its customers.
Social and communication networks are formed by entities (such as individuals or computer hosts) and their connections (which may be contacts, relationships, or flows of information). Such networks are analyzed to understand the influence of individuals in organizations, the transmission of disease in communities, the operation of computer networks, among many other topics. While network data can now be recorded at unprecedented scale, releasing it can result in unacceptable disclosures about participants and their relationships. As a result, privacy concerns are severely constraining the dissemination of network data and disrupting the emerging field of network science.
Our recent work investigates the properties of a network that can be accurately studied without threatening the privacy of individuals and their connections. We adopt the rigorous condition of differential privacy, and develop algorithms for releasing randomly perturbed statistics about the topology of a sensitive network. This talk will focus on two basic analysis tasks: the estimation of the degree distribution of a network and the study of small structural patterns that occur in a network (sometimes called motif analysis). We show that the degree distribution of a network can be very accurately estimated by a novel technique in which constraints are applied to the noisy output to improve utility. This technique is of general interest, and can be used to boost the accuracy of differentially private output in other tasks as well. We show that studying motifs is fundamentally harder, but can be done with acceptable accuracy if the privacy condition is relaxed.
We start with presenting motivation and goals for the Future Internet, and reviewing basics of trust in computing.
The Pervasive Trust Foundation (PTF) for the Future Internet is proposed next. This includes presenting motivation for trust foundation for the Future Internet, showing placement of security services and mechanisms within the architecture, and trust considerations for security services.
Inefficient operation of the PTF-based architecture is the main obstacle to making such architecture a reality. There are two classes of approaches that can reduce operational costs. First, inherent PTF properties result in automatic cost-saving. Second, additional cost-saving techniques --such as leveraging high-trust enclaves, or using enclave "insurers"-- can be used.
The architectural principles presented here are a position statement, and their practical verification will require substantial research efforts.
Access control policies in healthcare domain define permissions for users to access different medical records. A Role Based Access Control (RBAC) mechanism allows management of privileges to medical records for users when they assume certain roles thus mitigating the threat of inside attacks. Such a threat emanates from unauthorized users. We can provide a selective combination of policies where sensitive records can be available only to a specific role, say the primary doctor, under Discretionary Access Control (DAC) whereby in turn he/she may share the record with other physicians for consultation after permission from the patient. This mechanism allows not only a better compliance of principle of least privilege but also helps to mitigate the threat of authorized insiders disclosing sensitive information. Our research is being prototyped on the Policy Machine (PM) developed by the National Institute of Standards and Technology (NIST). PM allows integration and co-existence of multiple policies. Currently, we are expanding the capabilities of PM to provide a flexible healthcare access control policy which has the benefits of context awareness and discretionary access. We will present the newly implemented temporal RBAC model on PM and describe initial capabilities for secure management of healthcare data.
Infrastructureless and decentralized communication substrates such as mobile ad hoc networks and peer-to-peer systems enable setting up communication services beyond borders of contemporary wired or cellular client/server systems. Yet, due to their specific characteristics like wireless multihop data transmission and lack of central trusted instances, infrastructureless and decentralized networks are also beyond the protection of contemporary security mechanisms. This especially requires consideration in possible first responder or military application scenarios. Various new threats targeting each layer of the ISO/OSI model have been identified. Central questions regarding security include how to deal with misbehavior and how to protect information in networks without well-defined borders, consisting of devices, services, and users from multiple administrative domains.
In this talk we present possible solutions for excluding misbehaving nodes from infrastructureless networks to recover the availability of the network in presence of attacks. We further present mathematical tools for governing cooperative decision processes without central trusted instances as basis for security objectives such as authentication and access control in decentralized systems. We show evaluation results based on analytical models as well as simulation and testbed studies and highlight general challenges regarding the evaluation of protocols and algorithms for infrastructureless decentralized communication networks.
As information assets have become a critical factor for enterprises to stay competitive, there is an increasing awareness of information security management. However, they are easily overlooked by those who focus only on the IT side, failing to see that human resources and policies are the most likely cause of information risks, which need to become real enterprise-wide and strategic issues. This paper examines the impacts of an IT executive’s structural status in Top Management Teams (TMTs) on information security risk management. E-Business has made it imperative for IT executives to adopt cross-functional roles due to the increased importance of securing and managing risks to information assets across the enterprise. Therefore, IT executive representation and status in a TMT is necessary to strategically and operationally conduct liaison activities between IT groups and other business units. However, there is little empirical research examining the effects of IT executives’ structural status on managing information security risks. We employ logistical regression to examine the data from 2003 to 2008 with information security breach reports and executive compensation data. We augment this data with IT internal controls information provided by external auditors. Our results demonstrate high IT executive engagement and fair compensation are associated with reduced levels of both IT internal controls weaknesses and reported information security breaches. Second, we find that pay dispersion in a TMT increases the probability of information security breaches, while IT executive turnover is not significantly associated with breaches. As a comprehensive analysis across the accounting, human resources, and information systems literature, this study gives firms new insights into how they set IT executive compensation strategies as well as delegate authority and responsibility for ensuring confidentiality, integrity, and availability of information assets.
Given the proliferation of malware, the integrity of embedded communication systems is becoming a growing concern. Recent compromises to systems such as ATMs and network switches and routers provide evidence of the potential security problems of embedded communication systems. Trusted communication channels that pass sensitive information should only be established after the integrity of the remote system can be assured. Security hardware, such as the Trusted Computing Group’s (TCG’s) Trusted Platform Module (TPM) provides a mechanism to measure and authenticate the integrity of individual machines. This device can be readily found in many laptops today, however we are unaware of its use as a mechanism for providing or denying communication access to services based on the integrity of remote systems. In this work, we propose PlugNPlay Trust, an integrity framework which is a drop-in solution for providing a hardware root of trust for embedded applications. The PlugNPlay Trust design exploits the static nature of embedded communication systems and independently provides remote attestation and identity verification for the host application using the TPM. This framework, coupled with the attestation and dynamic firewall exception services we authored, enables remote parties to confirm the integrity of embedded communication systems, thereby limiting the effects and the proliferation of malware in compromised systems. Although there are preexisting technologies for interfacing with the TPM directly, we implemented the first prototype for allowing or denying access to networked services based on the trustworthiness of a remote system. The PlugNPlay framework simplifies the integration of existing TPM related tools and provides a ready to use platform for trusted computing research.
As a discipline, software security has made great progress over the last decade. There are now at least 46 large scale software security initiatives underway in enterprises including global financial services firms, independent software vendors, defense organizations, and other verticals. In 2008, Brian Chess, Sammy Migues and I interviewed the executives running nine initiatives using the twelve practices of the Software Security Framework as our guide. Those companies among the nine who graciously agreed to be identified include: Adobe, The Depository Trust and Clearing Corporation (DTCC), EMC, Google, Microsoft, QUALCOMM, and Wells Fargo. The resulting data, drawn from real programs at different levels of maturity was used to guide the construction of the Building Security In Maturity Model (BSIMM). This talk will describe the observation-based maturity model, drawing examples from many real software security programs. A maturity model is appropriate because improving software security almost always means changing the way an organization works---people, process, and automation are all required. While not all organizations need to achieve the same security goals, all successful large scale software security initiatives share common ideas and approaches. Whether you rely on the Cigital Touchpoints, Microsoft's SDL, or OWASP CLASP, there is much to learn from practical experience. Since its March release, the BSIMM is being expanded to include BSIMM Europe, BSIMM II, and BSIMM Lite. Use the BSIMM as a yardstick to determine where you stand and what kind of software security plan will work best for you.
Starting Over After A Lost Decade, In Search of a Bold New Vision for Cyber Security: It is not enough to develop a comprehensive cyber security program that exists in isolation from the world beyond the cloud and the cables. We have to understand the political, economic and social environments that impact our ability to deliver security, as well as our own organizational cultures. We cannot wage a 21st Century struggle for hearts and minds with a 20th Century world-view anymore than we can wage a 21st Century struggle to secure information and systems with 20th Century technology. A bold new vision is needed, one that is holistic and evolves out of transformative metaphors that reframe our concepts about security.
Information security professionals increasingly need to be familiar with developments in cyberlaw to ensure they comport their actions with the contours of the law. Unfortunately, with technology changing far faster than the statutes, judges are increasingly being called upon to fill in the interstices. In this interactive session, facts from actual cases will be presented in a “You Be the Judge” format to highlight important developments in recent cases and identify key trends in the case law. What is the legal efficacy of a click-through consent banner and how does this impact information security professionals? What constitutes an “interception” and what types of interceptions are legal and illegal? What law dictates whether an employer can or cannot inspect its employee’s personal e-mail messages? Do individuals have to divulge their encryption keys requested to do so by border guards or law enforcement agents? Are there jurisdictional borders in cyberspace? Who has jurisdiction and how does the law apply in virtual worlds? How do extradition laws apply to cybercrimes? These and many other questions will be answered in this interactive seminar.
From security architecture to implementation details... what matters when a customer faces a project to implement a global J2EE application? This presentation will cover some of the more pertinent concepts and details involved from real world experiences in customer environments.
Behind countless complex applications lurk trusty relational databases that are responsible for managing the data that fuel these applications. For example, relational databases are used to support electronic medical health record systems, timecard reporting systems, and transportation systems. Ideally, the relational database system has been sufficiently hardened to prevent exfiltration or modification of data. Unfortunately, adversaries often have insider access to the networks and machines on which the database is running and can easily circumvent such security measures. Therefore, in this research project, we create profiles of known, legitimate behavior so that we can flag any anomalous behavior as potentially illegitimate.
In this presentation, because SQL injection remains the #1 attack vector, I will first illustrate how SQL injection attacks can exfiltrate data from a database system. I will then discuss various locations within the database engine that one might monitor activity, highlighting the benefits of placing a monitor between the query optimizer and query execution engine. Next, I will describe how we use cross-feature analysis to generate profiles of legitimate behavior and how these profile are used at run-time to identify anomalous activity. Then, I will present experimental results both in terms of performance overhead and precision/recall. I will conclude with a discussion of when our techniques are most applicable and how a clever adversary might nevertheless elude our monitor.
As increasing amounts of valuable information are produced and persist digitally, the ability to determine the origin of data becomes important. In science, medicine, commerce, and government, data provenance tracking is essential for rights protection, regulatory compliance, management of intelligence and medical data, and authentication of information as it flows through workplace tasks. While significant research has been conducted in this area, the associated security and privacy issues have not been explored, leaving provenance information vulnerable to illicit alteration as it passes through untrusted environments.
In this talk, we show how to provide strong integrity and confidentiality assurances for data provenance information in an untrusted distributed environment. We describe our provenance-aware system prototype that implements provenance tracking of data writes at the application layer, which makes it extremely easy to deploy. We present empirical results that show that, for typical real-life workloads, the run-time overhead of our approach to recording provenance with confidentiality and integrity guarantees ranges from 1% - 13%.
For more details, please refer to http://dais.cs.uiuc.edu/provenance
Mix networks, originally proposed in 1981, provide a way for Internet users to send messages--such as email, blog posts, or tweets--without automatically revealing their identities or their locations. In this talk, we will describe Sphinx, a cryptographic message format used to relay anonymized messages within a mix network. It is the first scheme to support a full set of security features: compactness, efficiency, provable security, indistinguishable replies, hiding the path length and relay position, as well as providing unlinkability for each leg of the message's journey over the network. We will compare Sphinx to other mix formats, and will also briefly outline Sphinx's security reduction proof.
This Software Assurance (SwA) is a slightly different spin on the SwA presentation and discussion. The need for measurable SwA, for the purposes of presenting and assurance "case" and explained with a practitioner's point of view. Current pursuits and practices are shared with the context of what is needed from the SwA industry.
Intentional insider misuse of information systems resources (i.e., IS misuse) represents a significant threat to organizations. For example, industry statistics suggest that between 50-75% of security incidents originate from within an organization. Because of the large number of misuse incidents, it has become important to understand how to reduce such behavior. General deterrence theory suggests that certain controls can serve as deterrent mechanisms by increasing the perceived threat of punishment for IS misuse. This study presents an extended deterrence theory model that combines work from criminology, social psychology, and information systems. The model posits that user awareness of security countermeasures directly influences the perceived certainty and severity of organizational sanctions associated with IS misuse, which leads to reduced IS misuse intention. The model is then tested on 269 computer users from eight different companies. The results suggest that three practices deter IS misuse: user awareness of security policies; security education, training, and awareness (SETA) programs; and computer monitoring. The results also suggest that perceived severity of sanctions is more effective in reducing IS misuse than certainty of sanctions. Further, there is evidence that the impact of sanction perceptions vary based on one’s level of morality. The results have implications for both the research and practice of IS security.
Over the last years it has become apparent that privacy issues become more and more important when accessing data sources either on the Web or by database management systems. That is, the user does not only want to hide the query, but also the result of that query from others. In the past the problem of querying a database privately was solved by organizational rather than by technical means.
In this talk we describe the problem of querying databases privately more formally and discuss existing solutions from the area of private information retrieval (PIR). The lack of efficiency and scalability motivated us look for alternative approaches using a so called “secure co-processor” (built by IBM). We introduce a set of algorithms that take advantage of the (physical) properties of the co-processor and show which algorithms are necessary to guarantee privacy for database queries. In the last part of my talk I briefly describe our vision how to extend the current privacy approach to location-based services, in particular to moving objects such as vehicles (cars).
In the past six years, 44 states in the United States have embraced a new form of privacy and identity theft regulation – mandatory disclosure of data breach information. Information disclosure regulation is a form of legislation considered effective for issues that span consumer protection and risk and where market mechanisms would/could work effectively to shape consumer and producer behavior and bring about allocative efficiency. Informational regulation is a new approach in the data privacy milieu, but has a precedent in environmental and health policy. While data breach information disclosure policies intend to have an impact on consumer and producer behavior, little is known about the costs and benefits of these policies and whether they are in fact enhancing social welfare in the area of identity theft and privacy. This talk addresses this relatively nascent public policy phenomenon with a focus on future considerations for policy analysis in this area to determine if and how such policy may be affecting the state of information assurance and security in the USA.
The networking research community is working to design the Next Generation Internet, which will meet the needs of the twenty-first century. The first requirement for the Next Generation Internet is security. Furthermore, the Internet will include heterogeneous environment, such as cellular and sensor networks. In this talk, I will present our research work related to above mentioned problems and focusing on a new security oriented Internet architecture and security solutions for heterogeneous environments.
It should allow receivers to set policies for how and where they receive their information. The Next Generation Internet should be designed for mobile objects. Naming, addressing architecture, and routing have to be such that these objects can move and decide how and where they want to receive their Internet traffic with full rights of privacy of their location, if desired. In this talk, I will present our research work related to above mentioned problems and focusing on Internet architecture, mobile, wireless and security issues.
In the course of doing security vulnerability testing for government and commercial clients over the past 10 years, our Information Security Solutions team at Sypris Electronics has seen a lot of interesting things—perhaps none more so than a recent attack witnessed on a client’s network targeted by a buffer overflow on a popular application. The attack launched a trojan horse, which then dropped in another piece of malware that stealthily connected out to several sites to receive command and control. We will go down the rabbit hole with the attack (as much as I can publicly divulge), talk about our approach to the forensic investigation, and how the client was advised to implement countermeasures to provide an overall framework of security against future attacks.
It is possible people may have known about this particular exploit for more than six months before it was publicly disclosed, and the vendor still has not published a patch for it. Therefore, in this talk, we will also explore the concept of responsible disclosure, information sharing (minus attribution), and how all of this possibly fits into the Presidential Comprehensive National Cybersecurity Initiative (CNCI).
Query-based web search is becoming an integral part of many people's daily activities. Most do not realize that their search history can be used to identify them (and their interests). In July 2006, AOL released an anonymized search query log of some 600K randomly selected users. While valuable as a research tool, the anonymization was insufficient: individuals could be identified from the contents of the queries alone Government requests for such logs serves to increase the concern. To address this problem, we propose a client-centered approach of "plausibly deniable search". Each user query is substituted with a standard, closely-related query intended to fetch the desired results. In addition, a set of k-1 cover queries are issued; these have characteristics similar to the standard query but on unrelated topics. The system provides a property that any of these k queries will produce the same of set of k queries, giving k possible topics the user could have been searching for. We use Latent Semantic Indexing (LSI) based technique to generate queries, and evaluate on the DMOZ webpage collection to show the effectiveness of the proposed approach.
Building distributed systems is particularly difficult because of the asynchronous, heterogeneous, and failure-prone environment where these systems must run. This asynchrony makes verifying the correctness of systems implementations even more challenging. Tools for building distributed systems must strike a compromise between reducing programmer effort and increasing system efficiency. Mace is a C++ language extension, compiler, runtime, and toolset, that translates a concise but expressive distributed system specification into a C++ implementation. Mace exploits a natural decomposition of distributed systems into a layered, event-driven state machine. A key design principle of Mace is to separate each service algorithm from the implementation mechanics (serialization, dispatch, synchronization, etc.), debugging code (logging and property testing), and its utility services (lower-level services providing a specified interface). Our experience indicates that precisely because Mace imposes limits on the design structure of distributed systems, it supports the implementation of a wide variety of high-level supporting tools, including model checking, simulation, live debugging, and visualization. Mace is fully operational, has been in development for four years, and has been used to build a wide variety of Internet-ready distributed systems. This talk will describe both the Mace programming language design and MaceMC, the first model checker that can find liveness violations in unmodified systems implementations.
The need for information security is undeniable and self-evident. The pervasiveness of this critical topic requires primarily risk assessment and management through quantitative means. To conduct an assessment; repeated security probes, surveys, and input data measurements must be taken and verified toward the goal of risk mitigation with minimal cost. One can evaluate risk using a probabilistically accurate statistical estimation scheme in a quantitative security meter (SM) model that mimics the events of the breach of security. An empirical study using Java code is presented and its accuracy is verified by discrete-event or Monte Carlo simulations. The design improves as more data are collected and updated. Practical aspects of the SM are presented with a real-world example as related to a PC user and a risk-management scenario using the Game Theory approach for optimal cost mitigation results.
Index Terms(10)— Quantitative Risk Assessment, Cost Mitigation, Countermeasure, Security, Privacy, Management, Simulation, Threat, Vulnerability, Game Theory
If you create an application that runs on one or more computers connected to a network such as the internet, your code will be attacked.
Consequences of compromised systems often include loss of trust, reputation and revenue. Software will always have defects and vulnerabilities. Strikes against digital assets are unquestionably on the rise. We can, however, make it substantially harder to find and exploit vulnerabilities by identifying insecure coding practices and developing secure alternatives.
During this practical session, we'll examine in detail the principles behind some of the worst attack patterns seen today in the software industry. Most importantly, we'll learn effective defense programming techniques every developer must employ when building software.
Code injection attacks, in their various forms, have been in existence and been an area of consistent research for a number of years. A code injection attack is a method whereby an attacker inserts malicious code into a running computing system and transfers execution to his malicious code. In this way he can gain control of a running process or operating system due to the fact that his injected code will run at the same privilege level as the entity being attacked. At the user-level, these attacks can be used to gain access to a system through an application bug. At the kernel-level, they are commonly used to install kernel rootkits and hide an attacker's presence on a machine.
In this talk I will discuss code injection with regards to the memory architecture of modern computer systems. I will compare two common memory architectures, von Neumann and Harvard, with respect to their susceptibility to code injection attacks and the advantages and disadvantages of each in practice. Based on this, I will present a third memory architecture which is immune to code injection attacks and describe implementations of it that are able to stop code injection at the user and kernel levels. My experimental results show that this architecture is able to effectively and efficiently prevent code injection attacks against unmodified operating systems and applications running on standard x86 hardware.
A rules-based statistical algorithm (RBSA) identifies packets in any TCP connection that are client keystrokes of an ssh login. The input data of the algorithm are the packet arrival times and TCP/IP headers of the connection packets at a point along the path of the connection.
The algorithm is applied to all connections seen by a network monitor; ssh port 22 connections are classified as client-keystrokes or scp file transfers, and ssh keystroke connections are discovered for all other ports. This forms a network login database that can be further analyzed for network security monitoring and forensics. One application is to an "inside'' network in which the monitor sees all connections between the inside and outside.
The model --- which uses the packet sizes, flags, and interarrival times --- first goes through the packets identifying epochs of different activities, and then goes back and uses more detailed information for the classification. Performance from three types of packet traces is excellent.
Previous work has proceeded by forming connection summary statistics from the headers and timestamps, and classifying the connection as one with keystrokes or not using the statistics. The RBSA takes on a much more ambitious task of classifying each packet as a client keystroke packet or not, but in the end the classification of the connection has extremely low false positives and false negatives.
One important property of the RBSA is that it does not employ packet payload, as is done in some connection-level surveillance methods, so it cannot be defeated by an attacker through payload encryption. A second important property is that the inside network can be a large enterprise, allowing monitoring and forensics across a very large number of hosts from a single device."
There have been significant research developments in technology to protect privacy. Unfortunately, few of these have made the transition to practice. A large part of the problem is the lack of an accepted way to measure privacy. Legal and regulatory terms do not translate well into technological solutions, and the plethora of technical approaches do not seem to resonate with privacy advocates.
This talk will discuss issues and challenges, with examples of the reason why a clear standard is difficult. A risk-based approach will be presented that allows anonymization based on controlling the potential damage from disclosure. This approach will be compared with more traditional anonymization measures, showing the difficulty of measuring the potential for harm from those measures.
This represents joint work with Mehmet Ercan Nergiz (Purdue University) and Maurizio Atzori (University of Pisa).
Theories of deindividuation share common grounds, one of which is anonymity. For decades, it has been hypothesized that anonymity affects human behavior. With the rise of the popularity and development of personal computing, claims are made that individuals perceive themselves to be more anonymous in computer mediated environments. This perception may be a major factor contributing to the engagement of individuals in online antisocial behaviors and in cyber criminal activities like high-tech white collar crimes and Information Technology (IT) insider threat crimes. This talk presents an overview of the literature on anonymity and the deindividuation theory. A philosophical bind is then made between the various effects of anonymity, high-tech white collar crimes and IT insider threat crimes. These philosophical accounts may be used as a cornerstone for scientific research in the new cyber crime phenomenon.
In this talk, I will present a new approach to automatically generate a vulnerability signature for an unknown vulnerability, given a zero-day attack instance. Our approach is based on two systems we developed: Tupni and ShieldGen.
Tupni takes one or more input instances and reverse engineers their format by analyzing how an application parses and processes them. Its reverse-engineered format has a rich set of information, including record sequences, record types and input constraints. We have implemented a prototype of Tupni and demonstrated that it can effectively reverse engineer ten common, real-world file and network message formats.
ShieldGen can generate a vulnerability signature for an unknown vulnerability, given a zero-day attack instance and its format. The key novelty of ShieldGen is that it leverages knowledge of the input format to generate new potential attack instances, uses a zero-day detector as an oracle to determine if an instance can still exploit the vulnerability, and then takes the feedback of the oracle to guide its search for the vulnerability signature. We have implemented a prototype of ShieldGen and used it to generate high-quality vulnerability signatures for three real-world vulnerabilities.
By feeding the input format generated by Tupni to ShieldGen, we can automatically generate a vulnerability signature even when the format of the attack instance is unknown. We have integrated Tupni with ShieldGen and demonstrated that we can automatically generate the vulnerability signature for a real-world WMF vulnerability given a single malicious WMF file.
The Role Graph Model was first introduced by Nyanchama and Osborn in 1994. It has been extended over the years to include parameterized roles, an administrative model and a delegation model. We will show how the semantics of our role graph operations differ from those of the ANSI standard. Then we will discuss how to simulate DAC, and how the underlying basic model helped us to understand and expand the model to deal with delegation. The present and future of RBAC will also be discussed.
Steganography is a discipline of computer science whose aim is to conceal the existence of information. Steganography synergizes various technologies including data compression, digital signal processing, information theory, data networks, cryptography, coding theory, and the human audio and visual system. Strap on your seatbelt. I will present some key concepts of steganography, describe a number of basic and advanced spatial and transform domain techniques (with lots of pictures and sounds for the “attention-challenged”), and demonstrate these techniques using custom steganography software. The demonstrations include a Least Significant Bit (LSB) technique, High-Capacity Hiding in Jpegs, and time modulation in audio.
Scott Orton is the Anti-Tamper (AT) subject matter expert at Raytheon and was previously responsible for establishing the DOD AT executive agency. Scott will discuss the trends in information security driving the merge of AT and IA. He will also discuss valuable lessons learned from the AT community that have applicability in IA.
Currently many initiatives are being proposed for identity management, such as OpenID, SAML, CardSpace/Information Cards, and OAuth, as its importance is becoming apparent. Identity management is as an integral part of service infrastructures to make identity available to services across organizations in a secure and privacy protected manner. The identity data are crucial to successfully providing the privileged and personalized experiences for legitimate users of services. Also it is important that the users should have strong control over their identity data to foster a socially responsible service industry.
This talk will give an overview of trends in identity management, and illustrate best practices and lessons learned in real settings using case studies. The talk will also highlight standard harmonization (SAML/Liberty, OpenID, CardSpace/Information Cards, etc.) and explore the future research agenda (e.g., mobile applications).
Business processes –the next generation workflows- have attracted considerable research interest in the last fifteen years. More recently, several XML-based languages have been proposed for specifying and orchestrating business processes, resulting in the WS-BPEL language. Even if WS-BPEL has been developed to specify automated business processes that orchestrate activities of multiple Web services, there are many applications and situations requiring that people be considered as additional participants that can influence the execution of a process. Significant omissions from WS-BPEL are the specification of activities that require interactions with humans to be completed, called human activities, and the specification of authorization information associating users with human activities in a WS-BPEL business process and authorization constraints, such as separation of duty, on the execution of human activities. This talk investigates the problem of access control and resiliency for WS-BPEL processes. Access control in the context of business process means checking whether a user claiming the execution of an activity is authorized and the execution does not violate authorization constraints. Resiliency means that even if some users become unavailable, the remaining users can still complete the execution of the process according to the stated authorizations and authorization constraints. We present RBAC-WS-BPEL, an RBAC model for WS-BPEL business processes that supports the specification of resiliency constraints, authorizations and authorization constraints on business process activities. Resiliency constraints are evaluated when a WS-BPEL process is deployed, to check if there is a sufficient number of authorized users to perform the process so that authorization constraints are satisfied and the process terminates even if some users become unavailable. Authorizations and authorization constraints are evaluated whenever a user claims the execution of a business process’s activity to determine if the execution of the activity by the user does not violate any authorization constraints and does not prevent some other subsequent activities from completing.
What if you could determine exactly where, in any compiled binary, a security threat existed?
Answering this question has been the fundamental goal of anti-virus software for many years past, with limited success. Instead, what if you could determine not where security threats do exist, but where they could possibly exist? This is certainly a step in the right direction for total software security -- one which puts us well on our way to being able to develop applications safe against hidden malicious code. All of this is possible with the machine code analysis methodology known as Signature Analysis.
However, consider the following question: What if you could determine exactly where, in any compiled binary, a security threat might exist, and, further, precisely what this threat might affect later in the application’s execution?
This information can be retrieved by combining the capabilities of Code Slicing Analysis with the previously mentioned Signature Analysis. This paradigm not only assists in hardening against currently known threats, but it also identifies areas that are affected by those threats.
These principles form the framework for a novel static technique for ensuring software integrity. The goal of this seminar is to present these ideas and to discuss possible future applications.
Software vendors have traditionally focused on improving code quality for improving software security and quality. The code quality improvement effort aims toward reducing the number of design and coding errors in software. In principle, we can use formal correctness proof techniques to identify and remove all errors in software with respect to a given specification and hence remove all its vulnerabilities. In practice, however, building large and complex software devoid of errors, and hence security vulnerabilities, remains a very difficult task. Software vendors can minimize the risk associated with the exploitation of future vulnerabilities. One way to minimize the risk is by reducing the attack surfaces of their software. A smaller attack surface makes the exploitation of the vulnerabilities harder and lowers the damage of exploitation, and hence mitigates the security risk. We believe that a complete risk mitigation strategy requires a combination of code quality efforts and attack surface measurement. SAP and CMU collaborated to develop a new attack surface measurement method for measuring the attack surfaces of SAP software systems implemented in Java. We implemented a tool and demonstrated the feasibility of our approach by measuring the attack surface of an SAP software system. In this talk, we will present the attack surface measurement method and report on its application.
The ability for information services to continue operating despite attacks is a core enabler of mission assurance goals. Existing security techniques lack this concept of resilience and are inadequate for protecting critical services and data against targeted attacks by sophisticated adversaries. Widely implemented signature and anomaly-based detection techniques fail to keep pace with the advancement of attacker sophistication.
Our objective is to develop and prototype resilience techniques that make applications impervious to the damaging effects of attacks without relying on identifying and filtering specific attacks. We employ effects-based countermeasures to impart resilience to applications, creating an environment inhospitable to attack goals, and countering previously unknown attacks on service utility, in particular, code injection and data subversion.
Organizations have recently shown increased interest in database activity monitoring and anomaly detection techniques to safeguard their internal databases. Once an anomaly is detected, a response from the database is needed to contain the effects of the anomaly. However, the problem of issuing an appropriate response to a detected database anomaly has received little attention so far. In this work, we propose a framework and a policy language for issuing a response to a database anomaly based on the characteristics of the anomaly. We also propose a novel approach to dynamically change the state of the access control system in order to contain the damage that may be caused by the anomalous request. We have implemented our mechanisms in the PostgreSQL DBMS and we discuss relevant implementation issues. We have also carried out an experimental evaluation to assess the performance overhead introduced by our response mechanism. The experimental results show that the techniques are very efficient.
The last decade has witnessed a huge increase in deployment of biometric systems, and while most of these systems have been single vendor, monolithic architectures the issue of interoperability is bound to arise as distributed architectures are considered for large scale deployments. The distortions and variations introduced when acquiring fingerprint images propagate from the acquisition subsystem all the way to the matching subsystem. These variations ultimately affect performance rates of the overall fingerprint recognition system. Fingerprint images captured using the same sensor technology during enrollment and recognition phases will introduce similar distortions, thus making it easier to compensate for such distortions and reducing its effect on the performance of the overall fingerprint recognition system. However, an impact on performance is expected, but unpredictable, when different fingerprint sensor technologies are used during enrollment and recognition phases. The purpose of this study was to examine the effect of sensor dependent variations and distortions, characteristics of the sensor and characteristics of the finger skin on the interoperability matching error rates of minutiae based fingerprint recognition systems. Fingerprint images were be collected from 9 different fingerprint sensors from 190 subjects for analysis of this research study. A statistical analysis framework for testing interoperability was formulated for this research, which included parametric and non-parametric tests. The statistical analysis framework tested similarity of minutiae count, similarity of image quality and similarity of performance between native and interoperable datasets. Interoperability performance analysis was conducted on each sensor dataset and also by grouping datasets based on the acquisition technology and interaction type of the acquisition sensor. The end objective of this study was to provide greater insight into the effect of a fingerprint dataset acquired from various sensors on performance measured in terms of error rates like false non match rates (FNMR) and false match rates (FMR).
Virtualization technology can deliver better IT asset utilization, more agile IT asset allocation, more efficient use of resources, while supporting a potentially more secure IT infrastructure. Virtualization accomplishes these benefits by leveraging mechanisms which provide a) asset isolation, b) resource sharing and c) provisioning dynamics. This session will address how to use configuration and behavioral information to address the increased complexity of security, compliance and risk assessment in virtualized environments. Comprehensive security and risk situation awareness of more dynamic, more interdependent, and more insulated assets, will allow enterprises to take fuller advantage of the promised benefits of virtualization. This session will also briefly address extension of these considerations to the cloud and utility computing infrastructures.
Mobile devices equipped with positioning capabilities (e.g., GPS) can ask location-dependent queries to Location Based Services (LBS). To protect privacy, the user location must not be disclosed. Existing solutions utilize a trusted anonymizer between the users and the LBS. This approach has several drawbacks: (i) All users must trust the third party anonymizer, which is a single point of attack. (ii) A large number of cooperating, trustworthy users is needed. (iii) Privacy is guaranteed only for a single snapshot of user locations; users are not protected against correlation attacks (e.g., history of user movement).
We propose a novel framework to support private location-dependent queries, based on the theoretical work on Private Information Retrieval (PIR). Our framework does not require a trusted third party, since privacy is achieved via cryptographic techniques. Compared to existing work, our approach achieves stronger privacy for snapshots of user locations; moreover, it is the first to provide provable privacy guarantees against correlation attacks. We use our framework to implement approximate and exact algorithms for nearest-neighbor search. We optimize query execution by employing data mining techniques, which identify redundant computations. Contrary to common belief, the experimental results suggest that PIR approaches incur reasonable overhead and are applicable in practice.
Web sites on the Internet often use redirection. Unfortunately, without additional security, many of the redirection links can be manipulated and abused to mask phishing attacks. In this work, we prescribe a set of heuristics to identify redirects that can be exploited. Using these heuristics, we examine the prevalence of exploitable redirects present in today's Web. Finally, we propose techniques for Web servers to secure their redirects and for clients to protect themselves from being misled by manipulated redirects.
This work was presented at the USENIX Workshop On Offensive Technologies (WOOT) in July, 2008. Subsequently, several online press venues have covered it, including The Washington Post, SC Magazine, and Herald Times.
Creating secure code requires more than just good intentions. Programmers need to know how to make their code safe in an almost infinite number of scenarios and configurations. Static source code analysis gives users the ability to review their work with a fine tooth comb and uncover the kinds of errors that lead directly to vulnerabilities. This talk frames the software security problem and shows how static analysis is part of the solution.
Highlights include:
- The most common security short-cuts and why they lead to security failures
- Why programmers are in the best position to get security right
- Where to look for security problems
- How static analysis helps
- The critical attributes and algorithms that make or break a static analysis tool
We will look at how static analysis works, how to integrate it into the software development processes, and how to make the most of it during security code review. Along the way we'll look at examples taken from real-world security incidents, showing how coding errors are exploited, how they could have been prevented, and how static analysis can rapidly uncover similar errors.
With few exceptions, executive management doesn’t care about security. They care about risk. In this session, Jack will discuss the differences and share his experiences in taking the information security program at a Fortune 100 financial services company from a security focus to one of risk management. This presentation will cover why the change took place, how it took place (what worked and what didn’t), and the practical benefits that resulted.
Third Generation (3G) cellular networks utilize time-varying and location-dependent channel conditions to provide broadband services. They employ opportunistic scheduling to efficiently utilize spectrum under fairness or QoS constraints. Opportunistic scheduling algorithms rely on collaboration among all mobile users to achieve their design objectives. However, we demonstrate that rogue cellular devices can exploit vulnerabilities in opportunistic scheduling algorithms, such as Proprotional Fair (PF), to usurp the majority of time slots in 3G networks. Our simulations show that only five rogue device per 50-user cell can use up to 90% of the time slots, and can cause 2 seconds of end-to-end inter-packet transmission delay on VoIP applications for every user in the same cell, rendering VoIP applications useless. To defend against these attacks, we explore several detection and prevention schemes, including modifications to the PF scheduler and a secure handoff procedure.
This is a joint with with Denys Ma, Radmilo Racic, and Xin Liu.
For sensor networks deployed to monitor and report real events, event source location privacy is an attractive and critical security property, which unfortunately is also very difficult and expensive to achieve. This is not only because adversaries may attack against sensor source privacy through traffic analysis, but also because sensor networks are very limited in resources.
In this talk, we will discuss the techniques we have developed for enhancing source location privacy in sensor networks under a global adversarial model. Specifically, we will propose the notion of statistically strong source anonymity, where carefully chosen dummy traffic will be introduced to hide the real event sources. In addition, several privacy-preserving mechanisms will be employed to drop dummy messages on their roads to the base station to prevent explosion of network traffic.
Companies spend millions of dollars implementing security technologies to protect their corporate networks. Laptop computers and other mobile devices lose this protection once they leave the confines of the corporate office. This presentation will define mobility-related threats, show live hacks and define best security practices to address these risks, with a particular focus on Network Access Control and NAP technologies.
There is inherent tension between network performance and security. With the rapidly evolving drive for military and economic data being accessible via Service Oriented Architectures, the import of securing such data is increasing and the consequences for a security breach often are detailed in our daily media. Complex security architectures are maturing, but broad questions remain about how to certify or accredit the transactions occurring in Net-Centric Enterprise Services. This presentation does not propose a solution and is intended to motivate discussion, collaboration and directed research.
This paper investigates the relationship between information security related disclosures in financial reports and the impacts of information security incidents through cross-sectional and cluster analysis. First, by drawing upon the theories of disclosures in the accounting literature, we examine the effect of the number of disclosures on stock price reactions to information security incidents from 1997 to 2006. Our findings suggest that first-time disclosed information security risk factors in financial reports can mitigate the impact of information security incidents on business value. Second, a cluster analysis is performed on the disclosures in financial reports before and after the incidents. The results demonstrate that companies react to information security incidents by disclosing additional and more specific risk factors in subsequent financial reports. A prediction model is also built to classify disclosures as a belonging to a firm reported in the as breached or non-breached. The model can correctly classify a disclosure with approximately 75% accuracy which help investors and auditors assess information provided by the firm. This paper not only contributes to the literature in information security and accounting but also sheds light on how managers can evaluate their information security policies and convey information security practices more effectively to the investors.
This presentation discusses evolving concepts in security architectures. Current security architectures are based on the enclave architecture model. This model organizes and separates networked information systems into trusted, untrusted, and shared areas. Security components are located within these areas to provide the required security services based upon system requirements. While this model has many advantages in a basic client server business model, it has limitations with the evolving need to share information. This talk discusses the enclave security architecture and how it is implemented within enterprise networks. It also discusses information sharing needs that are difficult to meet within the constructs of the enclave as well as some of the security limitations of the enclave model. Potential solutions include incorporating new architectural concepts and new technologies to provide a greater variety of robust enterprise implementation options.
2006 and 2007 were seminal years which saw emergence of several information security threats and significant data breaches. The media focus on various incidents have made consumers much more aware of information security and hence, any significant security breach results in a significant loss of brand image.
As a result, corporate boards are demanding more information security controls as a part of their risk management oversight. This has forced a rethink among the C-suite executives and has increased the importance of information security in their eyes. The CSO's are seeing an elevation in prestige and importance and are becoming empowered to contribute to the organizational strategy by defining information security as a part of organizational governance and risk management framework.
The objectives of this talk are two fold. First, the focus will be on practical aspects of information security in most organizations. I will describe how Information Security is becoming a more central function and how the organizational roles and responsibilities are transforming as a result. Second, I will talk about the top information security initiatives for 2008 and what is driving those including examples and explanations of what transpired in several security breaches. Some of those initiatives are governance, wireless security, hardening of network infrastructure and data loss prevention. Throughout this talk, where applicable, I will also identify information security challenges that have not proven tractable in the hope that it will help inspire research ideas.
Electronic voting machines have made our elections less reliable and less secure, but recent developments offer hope of a better system in the future. Current research offers the hope of a future voting system that is more reliable and more secure than ever before, at reasonable cost, by combining high-tech and low-tech methods so that each can compensate for the weaknesses of the other. This talk will sketch what this future might look like, and will highlight some of the research that may make it possible.
What do the Department of Defense and the Electronic Frontier Foundation have in common? They have both funded the development of Tor (torproject.org), a free-software anonymizing network that helps people around the world use the Internet in safety. Tor's 1500 volunteer servers carry traffic for several hundred thousand users including ordinary citizens who want protection from identity theft and prying corporations, corporations who want to look at a competitor's website in private, law enforcement and government intelligence agencies who need to do operations on the Internet without being noticed, and aid workers in the Middle East who need to contact their home servers without fear of physical harm.
We'll give an overview of the Tor architecture, and talk about why you'd want to use it, what security it provides, and policy and legal issues. Then we can open it up for discussion about open research questions, wider social implications, and other topics the audience wants to consider.
While the world is constantly changing, the core principles of security have not changed that much, yet organizations are stilling be compromised. This talk will look at some of the problems in cyber space and some unique solutions for securing information.
SQL injection attacks are one of the topmost threats for applications written for the Web. These attacks are launched through specially crafted user input on web applications that use low level string operations to construct SQL queries. In this talk, I will present a novel and powerful scheme for automatically transforming web applications to render them safe against all SQL injection attacks.
A characteristic diagnostic feature of SQL injection attacks is that they change the intended structure of queries issued. Our technique for detecting SQL injection is to dynamically mine the programmer-intended query structure on any input, and detect attacks by comparing it against the structure of the actual query issued. We propose a simple and novel mechanism for mining programmer intended queries by dynamically evaluating runs over benign candidate inputs. This mechanism is theoretically well founded and is based on inferring intended queries by considering the symbolic query computed on a program run. Our approach has been implemented in a tool called CANDID that retrofits Web applications written in Java to defend them against SQL injection attacks. We report experimental results that show that our approach performs remarkably well in practice.
(Joint work with Sruthi Bandhakavi, Prithvi Bisht and P. Madhusudan)
The widespread adoption of home routers by the general public has added a new target for malware and crimeware authors. A router's ability to manipulate essentially all network traffic coming in to and out of a home, means that malware installed on these devices has the ability to launch powerful Man-In-The-Middle (MITM) attacks, a form of attack that has previously been largely ignored. Making matters worse, many homes have deployed wireless routers which are insecure if the attacker has geographic proximity to the router and can connect to it over its wireless channel. However, some have downplayed this risk by suggesting that attackers will be unwilling to spend the time and resources necessary, nor risk exposure to attack a large number of routers in this fashion. In this talk, we will consider the ability of malware to propagate from wireless router to wireless router over the wireless channel, infecting large urban areas where such routers are deployed relatively densely. We develop an SIR epidemiological model, and use it to simulate the spread of malware over major metropolitan centers in the US. Using hobbyist collected wardriving data from Wigle.net and our model, we show the potential for the infection of tens of thousands of routers in short periods of time is quite feasible. We consider simple prescriptive suggestions to minimize the likelihood that such attacks are ever performed. Next, we show a simple yet worrisome attacks that can easily and silently be performed from infected routers. We call this attack 'Trawler Phishing'. The attack generalizes a well understood failure of many web-sites to properly implement SSL, and allows attackers to harvest credentials from victims over a period of time, without the need to use spamming techniques or mimicked, but illegitimate web-sites, as in traditional phishing attacks, bypassing the most effective phishing prevention technologies. Further, it allows attackers to easily form data-portfolios on many victims, making collected data substantially more valuable. We consider prescriptive suggestions and countermeasure for this attack.
The work on epidemiological modeling is joint work with Hao Hu, Vittoria Colizza and Alex Vespignani. The work on trawler phishing is joint work Sid Stamm.
Non-state and state intelligence are converging in a context of fluid boundaries. It is increasingly difficult to know who is inside and who is not. Creating a trusted network does not resolve the most critical security problems because those problems begin at the interface of the network and the human user. The identity and intention of that human user is critical, but that is often what is most difficult to discern.
This emergent world of ambiguous boundaries and multiple identities challenges our models and descriptions of the playing field. Even with a program, we can't always tell the players, because both players and program are morphing.
And it's worse than that: the ethical guidelines of the past, rooted in religious systems thousand of years old, are going through the looking-glass, too, along with the structures of spirituality and religion. Identity-shift applies to God and Self as well as the social and cultural structures in which they are embedded.
This speech confronts the transformation of the structures in which we live, identifies some consequences of identity-shift, and distinguishes the business of security from the myths of the security business. It points to new ways to organize our lives that complement rather than replace traditional methods of defending electronic and human networks.
In order to support emerging online activities within the digital information infrastructure, such as commerce, healthcare, entertainment and scientific collaboration, it is increasingly important to verify and protect the digital identity of the individuals involved. Identity management systems manage the digital identity life cycle of individuals that includes issuance, usage and revocation of digital identifiers.
Identity management systems have improved the management of identity information and user convenience; however they do not provide specific solutions to address protection of identity from threats such as identity theft and privacy violation. One major shortcoming of current approaches is the lack of strong verification techniques for management and protection of digital identifiers. Moreover current identity management systems do not consider neither biometric nor history-based identifiers. Both biometric and history-based identifiers are increasingly becoming an integral part of an individual's identity. Such types of identity data also need to be used with other digital identifiers and protected against misuse.
In this presentation I introduce a number of techniques that address the above problems. The approach is based on the concept of privacy preserving multi-factor identity verification. The main technique consists of verifying multiple identifier claims of an individual, without revealing extraneous identity information. A distinguishing feature of our approach is that we employ identity protection and verification techniques at all stages of the identity life cycle. In addition we develop techniques to use biometrics in a secure and privacy preserving manner. We also enhance our approach with the use of history-based identifiers.
The potential for security to be tightly integrated into virtual machine technology is an exciting prospect. Not only does virtualization offer IT departments the opportunity to reduce costs, but it also offers increased agility. Now that application vendors are coming to understand the benefits of virtual machine technology, the technical world has also started to take note of supplementary services, such as security products and functions, which can also reside in these virtualized environments. Heron will discuss the future of security in virtualized environments and how IT professionals can take a Security Risk Management (SRM) approach to securing their virtual machines.
Recent rapid development of wireless networks of sensors, actuators and identifiers dictates the digitalization of our physical world and the creation of the "internet of things". In this new internet, each wireless device will sense and provide contextual information, of which crucial component are locations of devices and objects. In this talk, we present recent research results in secure computation and verification of locations of wireless devices: we show that current localization systems are highly vulnerable to attacks and we demonstrate that out solutions can prevent these attacks. We further illustrate how location-awareness can help in solving some of the fundamental security challenges of wireless networks, e.g., enabling authenticated and confidential communication without pre-shared keys of credentials.
This talk discusses how engineers can go about learning what they need to know to prevent the most significant emerging data security vulnerabilities, and the impact these vulnerabilities are having on electronic commerce. I'll review how attacks such as XSRF (Cross-Site-Request-Forgery) and SQL Injection work, and how to defend against them. I'll present some industry-wide statistics on software security vulnerabilities reported to various databases, and emerging trends in the field of software security. Finally, I'll discuss the current state of security education, and provide pointers to certification programs, books, and organizations where engineers can learn more.
Protecting valuable information assets, including personal data about employees, students, customers, and medical patients, is an enterprise-wide responsibility. Like all components of good corporate governance, it begins with senior leadership establishing a culture of awareness about the importance of safeguarding these assets, and extends through coordinated actions among all business units, divisions, and departments. When creating data privacy programs, organizations should align them with their strategic enterprise risk management objectives and follow a top-down approach to achieve the greatest benefit.
This presentation will focus on a practical approach to data privacy, that seeks to understand the business needs for data and align a data privacy protection program to those needs. Effective programs prevent companies from ending up in the news, disclosing a data loss, by enabling its employees to stay vigilant for situations where data may be at risk. Topics to be discussed include:
- The Goals of an Effective Data Privacy Program
- Current Data Privacy Landscape
- Common Privacy Program Pitfalls
- Key Components of a Successful Data Privacy Program
- The Top Down Data Privacy Risk Assessment
- Data Privacy Roles and Responsibilities
- High Level Roadmap and Ideas to Consider for Future Strategy
Software development processes and tools used for small communication devices have changed significantly over the years. Some of these practices and processes have resulted in improvements in quality and time to market for their target products, but in some cases have unintended results for the security and trustedness of those same products. This talk will look at several of these practices and approaches that can drive improvements in quality and productivity metrics for embedded communication software development teams yet create vulnerabilities and/or weaken the security architecture for those products.
The problem of a mice traveling through a maze is well known. The maze can be represented using a planar graph. We present a variant of the maze. We consider a grid vertex colored planar graph in which an adversary can choose up to t colors and remove all vertices that have these colors and their adjacent edges. We call the grid in which these vertices and adjacent edges are removed a reduced grid. The problem is that a mice must be able to move in the reduced grid from the first row to the last row, and from the first column to the last column, and this for all possible reductions. We present three types of solutions to construct such grids. The efficiency of these solutions is discussed.
The problem finds its origin in the problem of secure multiparty computation. Imagine going to a medical doctor in Iraq who needs to prescribe some medication, which might be counterindicated. The typical solution is to disclose all medical records to the doctor. If secure multiparty computation would be used, the medical doctor in Iraq only learns from the distributed medical databases whether the medication is, or is not, counterindicated. We consider the problem of parties each having a secret belonging to a non-abelian group. The parties want to compute the product of these secrets without leaking anything that does not follow trivially from the product. Our solution is black box, i.e., independent of the non-abelian group. This has applications to threshold block ciphers and post-quantum cryptography.
Trust models have been touted to facilitate cooperation among unknown entities. In our current work, we are interested in behavior-based trust models, i.e., models that derive the trustworthiness of an entity from its behavior in previous interactions. Existing proposals in this field typically feature one specific trust model. Further, various publications exist which have proposed different centrality measures to rank individuals, i.e., compute their reputation based on feedback, and have demonstrated their effectiveness in certain (rather specific) situations. This presentation in turn proposes a framework for behavior-based trust models for open environments with the following distinctive characteristic. Based on a relational representation of behavior-specific knowledge, we propose a trust-policy algebra allowing for the specification of a wide range of trust policies. Since the evaluation of the standing of an entity requires centrality indices, we propose a first-class operator of our algebra for their computation. The presentation concludes with an objective comparison of the effectiveness of the various centrality measures in reputation systems.
The first step in migrating to a role based access control (RBAC) system, is role development, in which teams of people meticulously define sets of roles that meet the needs of an organization's security and business requirements. Because it is so labor intensive, role development is the most expensive step in migrating to RBAC. In this talk, I will describe an approach called role discovery to help assist with the role development process. We attack the problem by finding simplifications of a bipartite graph that models the existing access control rules. Biclique covers of this graph are a fundamental tool in our approach. I will describe some of the theoretical background of this problem as well as some experimental results testing the approach on several real-world datasets.
Human aspects of information security were identified at the early stages in the history of time shared computing. The recent surge in attacks that exploit security vulnerabilities involving human factors have also put them under the spotlight of various research fields including human-computer interaction, information security and cognitive science. The human centered vulnerabilities involve an interplay of a broad range of actors from Information Technology specialists (who might mis-configure the security hardware and software or enforce impractical security policies) to end users (who might have a poor understanding of good security practices or not know the possible impact of weak security).
This talk will focus on human aspects of authentication mechanisms. I will present two methods that we have developed to reinforce the security of existing systems by improving their usability.
Previous studies have repeatedly shown that users find it taxing to remember truly random passwords. Many users choose easy to guess --therefore not secure-- passwords, since they require the least effort to recall. Experienced users adopt "mnemonic phrases" to generate and easily recall more secure passwords. However, regularity in the human languages may render such passwords vulnerable against a brute force attack. In the first part of the talk, I will present a method that we developed to automatically generate mnemonic phrases which can yield secure passwords in an effort to increase the usability of text password authentication.
Many computer users need to remember a multiplicity of usernames and passwords for different systems, and the users tend to reuse passwords across these systems which may have different security guarantees. In such cases remembering a different mnemonic phrase for each password does not scale and quickly becomes a challenging task. In the second part of the talk, I will present a scheme that helps the users remember a multiplicity of truly random passwords. The new scheme is applicable to an existing password authentication system without any modification, as it does not require any form of involvement from the service provider (e.g., bank, brokerage). Nor does it require the user to have any computing device at hand (not even a calculator). The scheme is such that changes to passwords do not necessitate a change in what the user remembers. Hence, passwords can be frequently changed without any additional burden on the memory of the user, thereby increasing the system's security.
The Internet has become one of the main sources of knowledge acquisition, harboring resources such as online newspapers, web portals for scientific documents, personal blogs, encyclopedias, and advertisements. It has become a part of our daily life to search and access this immense amount of online information, and more recently we have also started to contribute to this pool of information our own creativity in the form of text, images and video. Unfortunately, it is still an open question as to how we, as authors, can control the way that the information we create is distributed or re-used.
Rights management problems are serious for text since it is much easy for other people to download and manipulate copyrighted text from Internet and later re-use it free from control. There is a need for a rights protection system that ``travels with the content''. Digital watermarking is an information hiding mechanism that embeds the copyright information in the document. Besides traveling with the content of the documents, digital watermarks are also imperceptible (i.e., seamless) to the user, which makes the process of removing them from the document challenging.
Using linguistic features for information hiding into natural language text is an exciting and new idea. This talk begins with a short survey of existing technologies in natural language watermarking, and then focuses on a recently developed natural language watermarking system that is practical, easy-to-use and provides resilience to attacks through the use of ambiguity in natural language. The talk is aimed for a general audience, and will be self-contained covering the necessary background information.
Every profession goes through mistakes and unwise steps, especially in its early years. It is through trial and error that leaders and innovators of the profession are able to advance knowledge. Computer security is no exception. Both insiders' and outsiders' choices have held back and even harmed the state of computing. Of course, hindsight is usually more accurate than foresight.
This talk picks a handful of ideas that in retrospect have turned out dumb, ideas such as compound complexity, single-state hardware, downloaded code, and incomplete mediation. For each idea we will see from where the idea came, why it is unwise, and why we should have known better. From these examples, we will see how better choices can be made in the future.
Abstract 1:
Real-time logic (RTL) is useful for the verification of a safety assertion with respect to the specification of a real-time system. Since the satisfiability problem for RTL is undecidable, the systematic debugging of a real-time system appears impossible. With RTL, each propositional formula corresponds to a verification condition. The number of truth assignments of a propositional formula can help us determine the specific constraints which should be added or modified to derive the expected solutions. This talk describes this debugging approach and how it can be embedded into autonomous systems. We have implemented a tool called ADRTL for automatic debugging of RTL specifications. The confidence of our approach is high as we have effectively evaluated ADRTL on several existing industrial applications, including the NASA X-38 Crew Return Vehicle avionics.
Abstract 2:
Embedded systems are becoming ubiquitous and are increasingly interconnected or networked, making them more vulnerable to security attacks. A large class of these systems such as SCADA and PCS has real-time and safety constraints. Therefore, in addition to satisfying these requirements, achieving system security emerges as a critical challenge to ensure that users can trust these embedded systems to perform correct operations. One objective in a secure system is to identify attacks by detecting anomalous system behaviors. This part of the talk describes the challenges in the design and implementation of such intrusion detection system (IDS), addressing (1) accuracy: the IDS identifies no or as few false positives as the resource (time, space, power, etc.) and/or policy constraints allow, and no or as few false negatives as the resource and/or policy constraints allow; (2) efficiency/timeliness: the IDS does not violate the host embedded system's application deadlines and has a reasonable space overhead; (3) scalability: the IDS can scale to work with large embedded systems; and (4) power-awareness: the IDS does not significantly reduce the operational period of battery-powered embedded systems. We conclude with an outline of one of several promising embedded IDS approaches under investigation. This approach is based on automatic rule-base generation and semantic analysis.
If there is a difference between information and bits we had better find it soon. The bit-count is bounding upward, no one dares throw anything away, and once "search" supplants "organize" there is no going back. Information may or may not want to be free, but it wants to be in motion, so much so that ISPs see their future in movie rentals and the speed of light determines how far away your trade submission servers can be from the Exchange and still do micro-arbitrage. Like a gas, information has to be collected, purified, and compressed to be of value, so any leak, impurity, or loss of containment is a loss of value, per se. The street price of drugs has a more stable floor than the street price of stolen data, the percentage of attack tools that are privately held is rising, and the workfactor for information defense is the integral of the workfactor for information offense, yet we do not have the quantitative tools to value our information. That is possibly the key -- quantitative information risk management that is on par with quantitative financial risk management.
Over the years intrusion detection technology has improved to the point that it is highly useful to both the commercial and non-commercial sector. This technology is, however, by no means anything close to perfect. Even the best intrusion detection systems miss a fairly large proportion of attacks that occur; they also tend to yield unacceptably high false alarm rates. Correlating the output of multiple systems and devices is a promising solution for the limitations in today's intrusion detection systems. There have been numerous advances in intrusion detection event correlation, yet this technology lags behind intrusion detection technology. How events are correlated makes a big difference concerning the value of event correlation. This talk will cover the various approaches to event correlation as well as their advantages and disadvantages.
Data mining is the process of posing queries and extracting patterns, often previously unknown from large quantities of data using pattern matching or other reasoning techniques. Data mining has many ap-plications in security including for national security as well as for cyber security. The threats to national security include attacking buildings, destroying critical infrastructures such as power grids and telecom-munication systems. Data mining techniques are being investigated to find out who the suspicious people are and who is capable of carrying out terrorist activities. Cyber security is involved with protecting the computer and network systems against corruption due to Trojan horses, worms and viruses. Data mining is also being applied to provide solutions such as intrusion detection and auditing. The first part of the presentation will discuss my joint research with Prof. Latifur Khan and our students at the University of Texas at Dallas on data mining for cyber security applications For example; anomaly detection techniques could be used to detect unusual patterns and behaviors. Link analysis may be used to trace the viruses to the perpetrators. Classification may be used to group various cyber attacks and then use the profiles to detect an attack when it occurs. Prediction may be used to determine potential future attacks depending in a way on information learnt about terrorists through email and phone conversations. Data mining is also being applied for intrusion detection and auditing. Other applications include data mining for malicious code detection such as worm detection and managing firewall policies. This second part of the presentation will discuss the various types of threats to national security and de-scribe data mining techniques for handling such threats. Threats include non real-time threats and real-time threats. We need to understand the types of threats and also gather good data to carry out mining and obtain useful results. The challenge is to reduce false positives and false negatives. The third part of the presentation will discuss some of the research challenges. We need some form of real-time data mining, that is, the results have to be generated in real-time, we also need to build models in real-time for real-time intrusion detection. Data mining is also being applied for credit card fraud de-tection and biometrics related applications. While some progress has been made on topics such as stream data mining, there is still a lot of work to be done here. Another challenge is to mine multimedia data including surveillance video. Finally, we need to maintain the privacy of individuals. Much research has been carried out on privacy preserving data mining. In summary, the presentation will provide an overview of data mining, the various types of threats and then discuss the applications of data mining for malicious code detection and cyber security. Then we will discuss the consequences to privacy.
As cyber security has evolved in the new world of distributed computing there have been dramatic changes to the nature of our security needs. Mr. Schmidt will talk about issues that affect large enterprises, small and medium business and end users. He will talk about common threats, and the possibility of frameworks which would protect ourselves, our civil rights and our privacy while ensuring improved security.
Information policy at the enterprise level is invariably an exercise in gaps and inconsistencies. The range of concerns—including security—is broad, the environment tends to be heterogeneous and dispersed, the contextual scope is significant, and the stakeholders are numerous. MITRE ran headlong into this problem as it set about conceiving and implementing a new enterprise IT architecture, with questions increasingly raised regarding what policies the new architecture had to be capable of supporting. The MITRE Information Policy Framework (MIPF) is the mechanism MITRE developed to answer these questions. The MIPF supports systematic, structured analysis and formulation of information policy in five areas: security, privacy, management, stewardship, and sharing. This presentation will discuss the structure and use of the MIPF, with an emphasis on security requirements.
Computer systems ease the sharing and use of information, but accessibility of information leads to privacy concerns. Technology is being developed to address this issue - enabling use of information while controlling the disclosure. But is this enough to protect privacy? How do we even know if it is enough? This talk will survey recent developments in privacy and anonymity technology, emphasizing the variety of privacy definitions, their benefits, and their weaknesses.
Information permeates every corner of our lives and shapes our universe. Understanding and harnessing information holds the potential for significant advances. The breadth and depth of underlying concepts of the science of information transcend traditional disciplinary boundaries of scientific and commercial endeavors. Information can be manifested in various forms: business information is measured in dollars; chemical information is contained in shapes of molecules; biological information stored and processed in our cells prolongs life. So what is information? In this talk we first attempt to identify the most important features of information and define it in the broadest possible sense. We subsequently turn to the notion and theory of information introduced by Claude Shannon in 1948 that served as the backbone for digital communication. We go on to bridge Shannon information with Boltzmann's entropy, Maxwell's demon, Landauer's principle and Bennett's irreversible computations. We point out, however, that while Shannon created a successful and beautiful theory of information for communication, a wide spread application of information theory to economics, biology, life science and complex networks seems to be still awaiting us. We shall discuss some examples that recently crop up in biology, chemistry, computer science, and quantum physics. We conclude with a list of challenges for future research. We hope to put forward some educated questions, rather than answers, to the issues and tools that lay before researchers interested in information.
Assured information sharing has been a "grand challenge" problem of information security for several decades. Currently, there is broad consensus that the state-of-practice of information sharing is inadequate. One primary problem is that people on the field (e.g., soldiers, firefighters) have mission-critical need for sensitive information but are often among the least trusted principals in their organizations and hence do not receive the information. Another problem is that data producers claim ownership of the data they produce and place sharing constraints on that data despite the competing interests of multiple parties over that data. In this talk, we highlight these and other problems and discuss a wide range of technical solutions that are needed. We elaborate on the need to balance the risks of sharing data with the risks of not sharing data and present several proposed approaches for doing so. We also describe how obligation policies play an important role in addressing some information sharing issues.
Computer-related incidents that have the potential to destabilize, violate, or damage, the resources, services, policies, or data of the community or individual members of the community are happening in increasing numbers. Despite the news, we know that they are happening not just in academia which has been painted as insecure and wide-open, but in corporate and not-for-profit environments as well. We have inclinations about what is causing these incidents, but now we also have facts. While we look for technical fixes to the problems, the real factors that are related to the cause of these incidents may not be technical at all, but rather human. This presentation will discuss the "Computer Incident Factor Analysis and Categorization Project", CIFAC, which was carried on at the University of Michigan under funding from the National Science Foundation. Dr. Rezmierski will present the project findings and will discuss what they mean for colleges, universities, corporations, not-for-profit organizations and individuals. The presentation will include discussion of actual incidents, the statistical methodology and findings, and the recommendations put forward by the researcher team.
The talk will look at the phenomenon of deviant computer behavior and how understanding the individuals who engage in this behavior can benefit digital evidence investigations. A brief overview of the current research on computer deviance will be presented. An investigative process model will also be introduced that will assist in the investigation and analysis of computer crimes.
The Internet is facing threats from increasingly stealthy and sophisticated malware. Recent reports have suggested that new computer worms and malware deliberately avoid fast massive propagation. Instead, they lurk in infected machines and inflict contaminations over time, such as rootkit and backdoor installation, botnet creation, and data/identity theft. In defense against Internet malware, the following tasks are critical: (1) raising timely alerts to trigger a malware investigation, (2) determining the break-in point of malware, i.e. the vulnerable software via which the malware initially infiltrates the victim, and (3) identifying all contaminations inflicted by the malware during its residence in the victim. In this talk, I will present Process Coloring, an information flow-preserving, provenance-aware approach to malware investigation. In particular, I will demonstrate that through the preservation and tainting of malware break-in provenance along OS-level information flows, malware investigators will be able to improve the efficiency and effectiveness of existing log-based intrusion investigation tools. Furthermore, process coloring brings the new capability of runtime malware alert, which cannot be achieved by existing log-based tools. I will also present results of our experiments with a number of real-world Internet worms as well as a highly tamper-resistant implementation of process coloring using virtualization-based techniques.
This presentation explores the evolution of cyber crime and cyber security as global issues over the past decade. It examines the growth of cyber bank robbery, cyber extortion, identity theft, economic espionage, denial of service, cyber vandalism, cyber stalking and other criminal endeavors. It also sheds a harsh light on corporate and government response to these problems: technologies, organization, professional issues, awareness and education, etc. The presentation includes a compelling timeline, explores fascinating case studies and also provides real-world cyber security recommendations for governments, businesses and families.
Many multicast overlay networks maintain application-specific performance goals such as bandwidth, latency, jitter and loss rate by dynamically changing the overlay structure using measurement- based adaptation mechanisms. This results in an unstructured overlay where no neighbor selection constraints are imposed. Although such networks provide resilience to benign failures, they are susceptible to attacks conducted by adversaries that compromise overlay nodes. Previous defense solutions proposed to address attacks against overlay networks rely on strong organizational constraints and are not effective for unstructured overlays. In this work, we identify, demonstrate and mitigate insider attacks against measurement-based adaptation mechanisms in unstructured multicast overlay networks. The attacks target the overlay network construction, maintenance, and availability and allow malicious nodes to control significant traffic in the network, facilitating selective forwarding, traffic analysis, and overlay partitioning. We propose techniques to decrease the number of incorrect or unnecessary adaptations by using outlier detection. We demonstrate the attacks and mitigation techniques in the context of a mature, operationally deployed overlay multicast system, ESM, through real- life deployments and emulations conducted on the PlanetLab and DETER testbeds, respectively.
Systems are composed of multiple complex levels including the physical infrastructure, personnel or “humans-in-the-loop”, administration policies and procedures, computers, networks, and the communication protocols for connectivity that tie the system into a workable unit. Each aspect is in itself a complex system. When we consider system security, we tend to focus on the electronic components—the connectivity, computers, and network—over the non-electronic. Although we rigorously implement security in the various system components, the security is rarely integrated across the boundaries of the entire system spectrum. We tend to implement security on the distinct levels of the system without considering the impact or interaction with other system levels. For example, we may fully implement encryption, passwords, and firewalls and feel that our electronic systems are secure, while the weakest link may be staff members who fall victim to social engineering techniques and unknowingly reveal sufficient information to allow a perpetrator to circumvent our best security. Or we may have fortified computer systems and well trained personnel, but neglect the fact that we are being monitored through the building’s walls, floors, and windows.
Without true understanding of the nature of the interactions of the system, we cannot fully understand how vulnerabilities in one level of the system such as the physical infrastructure can be exploited to allow attacks on another level such as the computer networks. By taking advantage of these vulnerabilities, perpetrators are able to circumvent even the most effective computer and network security, breach that security, and achieve their goals. We only need to consider the current challenges of insider threats or threats from coordinated attacks on the physical infrastructure and the computer networks to appreciate the need for better integrated system security.
Our goal is to provide analytical tools for the real world, focusing on the decision makers who implement security policies across the system spectrum. Further, to be effective, these analytical tools must be implemented within an organizing framework that provides both an integrated view of security as well as the insight and understanding necessary to make effective security issues. This necessitates the development of step-by-step processes for analyzing and implementing security decisions. While this may seem to be a soft and less complete technical solution, it is actually implementing technology at the highest level because of the integration required to address each aspect of the system as well as the multi-disciplinary approach blending computer science, engineering, psychology, linguistics, and management in developing such analytic tools.
This presentation will discuss work in progress in developing these analytical tools as well as the overarching framework for implementing integrated system security. Our intention is to understand “what can be” or “what could happen”. With this insight, they can more effectively provide prevention, protection, or remediation strategies.
A high-level security policy states an overall requirement for a sensitive task. One example of a high-level security policy is a separation of duty policy, which requires a sensitive task to be performed by a team of at least k users. It states a high-level requirement about the task without the need to refer to individual steps in the task. While extremely important and widely used, separation of duty policies state only quantity requirements and do not capture qualification requirements on users involved in the task. This talk will introduce a novel algebra that enables the specification of high-level policies that combine qualification requirements with quantity requirements motivated by separation of duty considerations. A high-level policy associates a task with a term in the algebra and requires that all sets of users that perform the task satisfy the term. The syntax and semantics of the algebra, as well as the algebraic properties of its operators will be presented. The talk will also discuss results for computational problems related to the algebra and compare the algebra with regular expressions.
The falling cost and wide availability of electronic devices have led to their widespread use by individuals, corporations, and governments. These devices, such as computers, cell phones, digital cameras, and printers, all contain various sensors which generate data that are stored or transmitted to another device. One example of this is a security system containing a network of video cameras, temperature sensors, alarms, computers, and other devices. In such a network, it is important to be able to trust the data from each of these sensors. Forensic techniques can be used to uniquely identify each device using the data it produces. This is different from simply securing the data being sent across the network because we are also authenticating the sensor that is creating the data.
Forensic characterization of a device allows identification of the type of device, make, model, configuration, and other characteristics based solely on observation of the data that the device produces. These characteristics that uniquely identify a device are called device signatures. As an example, the noise characteristics in a digital image can be used as a signature of the camera that produced it. Similarly, the ‘‘noise’’ characteristics of a print engine can be used as a signature of the printer that generated a document.
This talk will present current research and techniques for forensic characterization of printers and image capture devices such as digital cameras and scanners.
Virus and worm attacks that spread through holes in popular consumer software emphasize the role the online public must play in preserving the safety and integrity of the Internet. To protect the network commons, more users must engage in safe online behavior by such actions as controlling their private information, updating software security patches, downloading protective software, and filtering their email. While network security remains an abstract notion to the general public, online consumers can understand the issue in terms of their personal privacy behavior, actions that result in the undesired disclosure of information and unwanted intrusions on their personal cyberspace. In her talk, Professor Rifon will discuss a social-psychological approach to understanding Internet user privacy and security safety related behaviors.
In outsourced content publishing, the data owner gives the content to a service provider who answers requests from users. Similarly, in outsourced databases, the data owner delegates a service provider to answer queries. Outsourcing enables fast and fault-tolerant delivery of information. However, since service providers in outsourced systems may not be trusted by users, the user needs to verify the integrity of information obtained.
First, I present a cryptographic solution for the verification of pseudonymized documents. A document can be pseudonymized by the service provider on the fly, based on the data owner's policies and the user's access permissions. Our pseudonym protocol is simple and efficient, and only requires the data owner to prepare and sign the document once. Second, I present a solution for integrity verification of database aggregate queries, such as sum and max. We design proofs of correctness and completeness of aggregate results. What makes the problem challenging is that individual data entries may be sensitive (such as in medical databases), and should not be revealed to the user. We give cryptographic protocols to support verification of query results in a privacy-preserving fashion.
The secure information sharing problem is one of the oldest and most fundamental and elusive problems in information security. Mission objectives dictate that Information must be shared and made available to authorized recipients, and yet information must be protected from leakage and subversion by malicious insiders and malicious software. The doctrine of "share but protect" indicates the inherent conflict in achieving effective secure information sharing. In this talk we demonstrate the complexity and richness of the secure information sharing problem space. We then identify some "sweet spots" that appear promising in their practical benefit and feasibility of solutions. We describe the PEI models approach to decompose security problems into the three layers of policy models (topmost), enforcement models (middle), and implementation models (bottom). We discuss how this approach can be applied to the secure information sharing problem. Finally we indicate how modern trusted computing technology can be used to solve important variations of this problem.
Are your security & IT controls really effective? Do you know how your security & IT operations compare to high performers?
In this presentation, Gene Kim will share the work he has been doing over the last six years with the IT Process Institute (ITPI), Software Engineering Institute, and Institute of Internal Auditors, codifying the observed practices of high-performing IT organizations. These high performers have a culture of change management, a culture of causality and a perpetual desire to detect variance before it causes a catastrophic event.
Specifically, Gene will discuss the ITPI IT Controls Benchmarking Survey of practice, a recently completed research project which has quantified the value, effectiveness, efficiency and security of controls. This landmark research has uncovered an alternative approach to being an effective security executive, based on measuring security by its ability to maintain its existing commitments; integrate controls into daily IT operations (prevent); put automated controls in place to variance before loss events (detect); reduce the percent of security incidents that result in loss events (detect); and successfully investigate and conclude security investigations.
Attendees will learn about the key research findings: * That high performers have 5-8x higher operational and security effectiveness and efficiency measures * The 20% of IT controls that have 80% of the measurable benefits, and how to implement and the prescriptive steps to take in order to achieve defined security results * The certain processes and controls that have shown catalytic and sustaining properties, meaning that the value they add demonstrably exceeds the cost to implement, and report out on them.
In this talk, we will see that malicious traffic flows such as denial-of-service attacks and various scanning activities can be visualized in an intuitive manner. A simple but novel idea of plotting a packet using its source IP address, destination IP address, and the destination port in a 3-dimensional space graphically reveals ongoing attacks. Leveraging this property, combined with the fact that only three header fields per each packet need to be examined, a fast attack detection and classification algorithm can be devised.
Defending against attacks on a web application is by nature is complex process, one that must address everything from coding practices to user management to network architecture. This talk will describe a number of techniques that, used in concert, will make your web app a much tougher cookie to crack. Primary focus will be on open-source "XAMP" setups, but the concepts should be applicable to most other systems.
We describe the detrimental effects of browser cache/ history sniffing in the context of phishing attacks, and detail an approach that neutralizes the threat by means of URL personalization; we report on an implementation performing such personalization on the fly, and analyze the costs of and security properties of our proposed solution.
The assurance of network security is dependent not only on the protocols but also on polices that determine the functional behavior of network security devices. Network security devices such as Firewalls, IPSec gateways, IDS/IPS operate based on locally configured access control policies. However, the complexity of managing security polices, particularly in enterprise networks, poses many challenges for deploying effective security. For example, security policies are usually configured in isolation from each other, even though they are not necessarily independent as they interact with each other to form the global security policy. As a result of such ad-hoc management, policy inconsistencies and network vulnerability are created. In addition security policy might grow in size causing a significant performance overhead in security devices. A major performance gain can be achieved if policies can be dynamic optimized to adapt to traffic properties (called traffic-aware policy optimization). This talk will explain these challenges and present the recent research results in the area of automated verification, and optimization of network security polices.
Invariably, new technologies introduce new vulnerabilities which, in principle, enable new attacks by increasingly potent adversaries. Yet new systems are more adept at handling well-known attacks by old adversaries than anticipating new ones. Our adversary models seem to be perpetually out of date: often they do not capture adversary attacks enabled by new vulnerabilities and sometimes address attacks rendered impractical by new technologies. In this talk, I provide a brief overview of adversary models beginning with those required by program and data sharing technologies, continuing with those required by computer communication and networking technologies, and ending with those required by mobile ad-hoc and sensor network technologies. I argue that mobile ad-hoc and sensor networks require new adversary models (e.g., different from those of Dolev-Yao and Byzantine adversaries). I illustrate this with adversaries that attack perfectly sensible and otherwise correct protocols of mobile ad-hoc and sensor networks. These attacks cannot be countered with traditional security protocols as they require emergent security properties.
Cryptology is typically defined as cryptography (the construction of cryptographic algorithms) and cryptanalysis (attacks on these algorithms). Both are important, but the latter is more fun. Cryptographic hash functions are one of the core building blocks within both security protocols and other application domains. In the last few decades a wealth of these functions have been developed, but the two in most widespread usage are MD5 and SHA1. Recently, there has been a great deal of activity regarding the cryptanalysis of MD5. We survey the recent attacks on the MD5 hash function from the modest progress in the mid 90s to the startling recent results instigated by Xiaoyun Wang. We will look at the details of these attacks, some recent improvements, two applications, and discuss the current outlook on cryptographic hashing.
For large government agencies and corporations there can be significant value in the use of identity, access, and rights management infrastructures or IDM. The organizations investment in directory services, authorization services, rights management, and public key systems all combine to form a sometimes complex infrastructure. The products that are deployed may be based upon standards such as WS-Security, SAML, and X509.3 but many are still hampered by proprietary vendor implementation, lack of understanding of the capability of the technology as it relates to business process, or unwise architectural decisions. This seminar will focus on how the models for IDM are maturing and comment on how the urgency to deploy solutions changes when combined with service oriented architecture. The seminar will give practical examples from the experience of working within large scale infrastructures in both corporate and government environments. It will conclude with commentary on the IDM issues and solutions revolving around the largest government identity management effort to date
In the days after Presidential Decision Directive 63 "Therminator: was born at NSA. This talk gives an overview of the applications of strategies from non-linear dynamics, complexity theory and elements from cybernetics in the context of reducing high-dimensional data sets (e.g. internet traffic) and explains why simple equilibrium thermodynamics is the weapon of choice.
The forgery of source IP addresses, called IP spoofing, is commonly exploited to launch damaging denial-of-service (DoS) attacks in the Internet. Currently proposed spoofing prevention approaches either focus on protecting only the target of such attacks and not the routing fabric used to forward spoofed packets, or fail under commonly occurring situations like path asymmetry. We will presents a hop-wise packet marking approach that equips the routers to drop spoofed packets close to their origination. Our approach has utmost concern for immediate deployability and simulations show that it dramatically reduces the amount of spoofing possible even under partial deployment.
The Health Insurance Portability and Accountability Act of 1996 (HIPAA) has resulted in the presence of very descriptive privacy policies on healthcare websites. These policies are intended to notify users about the organization's privacy practices; however, they are typically not easy to read, leading few people to actually read them. Given the fact that these policies are not optional, but required by HIPAA, they should be presented in a clear and concise manner that encourages consumers to read them. At the present time, this is not the case. This seminar will present the preliminary results of our study that compares various ways to present privacy management information to healthcare consumers. The study involved an online experiment and survey of 993 Internet users.
Hierarchies arise in the context of access control whenever the set of users can be modeled as a set of partially ordered classes (i.e., represented as a directed graph). In such systems, a user that belongs to a particular class inherits privileges of all of its descendant classes. The problem of key management for an access hierarchy then consists in assigning a key to each class in the hierarchy so that keys for descendant classes can be obtained via an efficient key derivation process. We propose an efficient solution to this problem with a number of important properties, some of which are: a single key per class, local handling of changes to the hierachy, and provable security against collusion. Whereas many previous schemes had some of these properties, ours is the first that satisfies all of them. In addition, we give techniques to exponentially lower key derivation time for trees with only a contant increase in the space to store the hierarchy.
Federated systems are an emerging paradigm for information sharing and integration. Such systems require access management policies that not only protect user privacy and resource security but also allow scalable and seamless interoperation. Current solutions to distributed access control generally fail to simultaneously address both dimensions of the problem. This talk describes the design of a policy-engineering framework, called xFederate, for specification and enforcement of access management policies in federated systems. It has been designed from the perspectives of both security management and software engineering to not only allow specification of requirements for federated access management but also allow development of standardized policy definitions and constructs that facilitate policy deployment and enforcement in a federated system. The framework also includes the design of an administrative model targeted at access control policy administration in a decentralized environment. Two profiles of the policy language, namely a SAML profile and a WS-Policy profile, have been developed to integrate the framework with industry standards for federation and policy-based management in the emerging Web services paradigm. The talk will include an online demo of a research prototype that illustrates the use of xFederate as an enabling technology for secure Web services with applications in federated digital libraries and federated electronic healthcare management.
Mobile ad hoc networks (MANETs) are collections of wireless mobile nodes with links that are made or broken in an arbitrary way. Communication is achieved via routes whose node relay packets. Several routing algorithms have been proposed in the literature. These focus mainly on efficiency with security relegated to weak adversary models. In this talk we consider the security of distributed MANET applications in malicious adversary models. We model a MANET by a stochastic finite state machine that is subject to mobility, medium and markovian constraints and describe an adversary structure that addresses the malicious attacks that are particular to MANETS (wormhole attacks, Sybil attacks, packet dropping, selfishness). We then show how the traditional cryptographic framework for provable security can be adapted to this particular adversary structure. Finally we consider two complementary approaches that can be used to achieve provably secure routing in our adversary model: a reactive approach that traces malicious behavior and a proactive approach that tolerates malicious behavior.
This talk examines formal concepts of digital forensic investigations. To date, the field has had an applied focus and little theory exists to formally define analysis techniques and requirements. This work defines an extended finite state machine (FSM) model and uses it to describe a computer's history, which contains the primitive and abstract states and events that existed and occurred. Using this model, categories of analysis techniques can be defined. This talk describes the model, describes the categories of analysis techniques, and compares the existing tools to the analysis technique categories.
Digital identity management technology is fundamental in customizing user experience, protecting privacy, underpinning accountability and compliance in today
Attacks on computer and other networked systems can be categorized as physical, syntactic and semantic. Physical attacks seek to destroy hardware, while syntactic attacks, such as computer worms and viruses, target the network infrastructure. Semantic attacks are directed at the mind of the user of a computer system, or, more generally, any decision process in an automated system. For example, a false, or misleading, discussion group posting which leads readers of the posting to become victims of a pump-and-dump scheme, whereby the price of a company
In the nineties the disconnection between physical experience and the digital networked experience was celebrated - individuals are said to move into cyberspace, become virtual and leave the constraints of the physical realm. The increase in fraud, difficulties in securing email, and increasing prevalent browser-based attacks illustrate that the lack physical signaling information can also be costly. I introduce a trust that evaluation system, Net Trust. The trust evaluation system offered in Net Trust builds on the technical construction of networks of trust, reputation systems, and social browsing. Net Trust is explicitly a socio-technical solution; the solution employs a user
This talk introduces cross-drive analysis (CDA), a new approach for performing analysis of forensic data sets that are too large or complex to be analyzed with today's existing tools. CDA works by performing systematic information extraction and cross-correlation across an entire data set. CDA was used to analyze 182 disk drives acquired on the secondary market; it automatically identified drives containing a high concentration of confidential financial records and three pairs of drives, each previously used by the same organization. CDA shows strong promise in allowing forensic examiners to prioritize their work and in automatically identifying members of preexisting social networks.
IP spoofing accompanies many malicious activities and is even means for performing reflector DDoS attacks. Route-based filtering (RBF) enables a router to filter spoofed packets based on their incoming interface - this information is stored in an incoming table. Packets arriving on the expected incoming interface for their source address are considered legitimate, while all the other packets are filtered as spoofed. Past research has shown that RBF can be very effective when deployed at the vertex cover of the Internet AS-map (about 1500 ASes) but no practical approach has been proposed for incoming table construction. We first show that RBF achieves high effectiveness even if the number of deploying points is very small (30 chosen deployment points reduce the amount of the spoofed Internet traffic to 5%). We further show that completeness of the incoming tables is critical for filtering effectiveness - partially full tables are as good as empty. This implies that routers cannot rely on reports of a few participating domains to build their incoming tables, but instead must devise means of accurately "guessing" incoming interface information for all traffic they see. Their guessing strategy must quickly react to offending traffic and determine with high accuracy whether the reason for the offense was a route change (in which case incoming interface information must be updated) or spoofing. We next propose a protocol called Clouseau which builds accurate incoming tables at RBF routers, and keeps these tables up to date in face of frequent route changes. Clouseau infers incoming table information by applying randomized drops to offending TCP traffic and observing its retransmission behavior. No communication is required with packet sources or other RBF routers, which makes Clouseau suitable for partial deployment. The inference process is further resilient to subversion by an attacker who is familiar with the design of Clouseau.
Secret Handshake is an authentication protocol with non-standard and strong anonymity property: Namely, the secrecy of the affiliations (i.e. the certificates) of party A who engages in this authentication protocol with party B will be protected against any B* (i.e. a malicious party which pretends to be B) who does not meet A's authentication criteria. This strong secrecy and anonymity protection turns out to be possible, and quite efficiently so, based on various standard cryptographic assumptions. The talk will give an overview of the problem, the various solutions, and the several efficiency and security issues involved in making such anonymous authentication schemes practical.
Access control in decentralized systems is an important problem that has not been fully understood, except perhaps that it should be based on credentials. There are mainly two research approaches towards this goal: one is to pursue powerful individual credentials yet without necessarily considering flexible access control policies, the other is to consider flexible policies yet without necessarily accommodating the useful credential schemes that have become available. This paper proposes a unified approach that simultaneously consider flexible policies and useful credentials. A first realization of this approach is the notion of assembly signatures (and identifications), which are: (1) privacy-preserving, meaning that the access requestor's privacy is ensured; (2) policy-driven, meaning that the validity of a signature is with respect to a given access control policy; (3) ``mixed credentials"-based, meaning that a signature is constructed out of various anonymous and non-anonymous credentials. (This is a joint work with Moti Yung)
Trust negotiation is an emerging approach for establishing trust in open systems, where sensitive interactions may often occur between entities with no prior knowledge of each other. Although several proposals today exist of systems for the management of trust negotiation, none of them provides a comprehensive approach to the problem of privacy preservation. Trust negotiation systems, however, by their very nature may represent a threat to privacy. Credentials, exchanged during negotiations, often contain sensitive personal information that thus needs to be selectively released. As we believe that trust negotiation systems must effectively address privacy issues to be widely acceptable, we have investigated privacy in the context of trust negotiations. In this talk, we will propose the main results obtained so far in the area of trust negotiation as part of the Ph.D. activity. We propose a set of privacy preserving features to be included in any trust negotiation system, such as the support for the P3P standard, as well as a number of innovative features such as a novel format to encode digital credentials specifically designed for preserving privacy. Finally, we illustrate techniques for supporting anonymous trust negotiations as part of a privacy-preserving trust negotiations, to carry on trust negotiations without revealing identity related information.
As systems grow in size and complexity, our ability to protect them through manual intervention or static defenses degrades. We believe that, in addition to proper design principles and proactive mechanisms, automated reactive approaches must be employed to close the gap in the attacker vs. defender capabilities. Toward this goal, we have been examining the possibility of software systems that self-diagnose and repair themselves in the presence of previously unknown attacks and failures, with minimal or no human intervention. In this talk, I will discuss our research in self-healing software systems. I will introduce the concepts of "micro-speculation" and "error virtualization", which can be combined to provide a generic mechanism for dealing with low-level software failures and vulnerabilities. I will describe the use of these techniques in two system prototypes of self-healing software that address such vulnerabilities: the Worm Vaccine architecture and STEM (Selective Transactional EMulation). I will close the talk with a discussion of our preliminary work toward software Application Communities, groups of identical instances of an application that cooperate to improve their collective security.
This talk considers security challenges facing the Internet's Domain Name System (DNS). The DNS is one of the most widely used and least secure Internet systems. Viirtually every Internet application relies on the DNS to convert names into IP addresses and the DNS provides a wide range of other critical mappings such as identifying mail servers and locate services. But despite its importance, the original DNS design gave very little thought to security and a variety of misdirection and denial of service attacks are possible. For example, a web browser relies on the DNS to convert www.purdue.edu into an IP address. The DNS supplies the web browser with an IP address (more precisely an "A" resource record set) such as 129.82.100.64 (is this address correct?). If this address is wrong, the browser will be directed to the wrong site. If the DNS fails to return a response, the browser will not be able to load the desired web page. Currently, both the operational and research communities are making considerable efforts to improve DNS security. After nearly a decade of development, the IETF has standardized DNS Security Extensions that add public key authentication into the DNS. The hierarchical structure of the DNS is leveraged to authenticate public keys, keys can be managed offline, and the signatures allow a resolver to authenticate a response. However several open issues remain, including key revocation, support for dynamic updates, resolver security policies, incremental deployment, and commercial challenges. The DNS Security Extension enable a number of new techniques, but basic problems on denial of service remain. The research community has largely focused on denial of service attacks against critical top level servers could potentially cause considerable damage to the DNS service. This has led to proposals for replacing the DNS tree with a distributed hash table attacking a few critical top level servers. This talk will argues that, despite some major flaws, the DNS Security Extensions provide the necessary tools to build a robust and secure DNS. By using these tools appropriately, a wholesale replacement of the DNS system by other approaches can and should be avoided.
Sensor networks are vulnerable to physical attacks. Once a node's cryptographic key is compromised, an attacker may completely impersonate it, and introduce arbitrary false information into the network. Most existing techniques focus on detecting and tolerating false information introduced by compromised nodes. They cannot pinpoint exactly where the false information is introduced and who is responsible for it. We propose an application-independent framework for identifying compromised sensor nodes. In this framework, sensor nodes may conceptually observe the activity of each other following the deployment topology of a sensor network. An alert is generated if a node observes an abnormal activity. Such alerts are collected by the base station, which further reason and finally identify compromised nodes. We develop efficient and accurate reasoning algorithms that can effectively deal with collusion and local majorities. Our algorithms are optimal in the sense that they identify the largest number of compromised nodes without introducing false positives.
While considering all existing hazards for humans due to (a) natural disastrous events, (b) failures of human hazard attention or (c) intentional harmful behaviors of humans, we address the problem of building hazard aware spaces (HAS) to alert innocent people. We have researched and developed components of a prototype HAS system for detecting fire using wireless "smart" micro electro-mechanical systems (MEMS) sensors, such as, the MICA sensors, and spectral cameras, for instance, thermal infrared (IR), visible spectrum and multi-spectral cameras. Within this context, my presentation overviews technical challenges and prototype scientific solutions to (1) robotic sensor deployment, (2) localization of sensors and objects, (3) synchronization of sensors and cameras, (4) calibration of spectral cameras and sensors, (5) proactive camera control, (6) hazard detection, (7) human alert, (8) hazard confirmation, and (9) hazard understanding and containment. The work presented will also include theoretical and practical limitations that have to be understood when working with novel technologies. http://www.ncsa.uiuc.edu/people/pbajcsy/
This talk deals with practical issues of web application security, with an emphasis on open-source web service tools such as Apache, PHP, and MySQL. Recent exploits in widely-used open source web applications such as phpBB and Wordpress underline the need for web app developers to make security a primary consideration. We'll discuss the most common types of attacks and how to defend against them, both on a code, application, and network design level.
Large-scale collaborative applications are characterized by a large number of users and other processing end entities that are distributed over geographically disparate locations. Therefore, these applications use messaging infrastructures that scale to the application needs and enable users to process messages without concern for message transmission and delivery. Widespread use of these infrastructures is hindered by the need for scalable security services; viz., services for confidentiality, integrity, and authentication. Current solutions for providing security for these systems use trusted servers (or a network of servers), which consequently bear significant trust liabilities of maintaining confidentiality, integrity, and authentication of messages and keys that are processed by the servers. In this talk we look at current approaches for secure messaging in three commonly used messaging infrastructures: email, group communication, and publish/subscribe. We then show how novel encryption techniques can be used to minimize trust liabilities in these infrastructures in a scalable manner. We are in the process of developing prototypes of our solutions. We will discuss the prototype designs and present some initial experimentation results.
This lecture provides an introduction to biometric technologies. Various technologies will be examined, including iris, face, voice, dynamic signature, fingerprint, and keystroke dynamics. An overview of assessing performance, discussing implementations, as well as system design will be covered.
In order to protect individuals' privacy, the technique of k-anonymization has been proposed to de-associate sensitive attributes from the corresponding identifiers. In this work, we provide privacy-enhancing methods for creating k-anonymous tables in a distributed scenario. Specifically, we consider a setting in which there is a set of customers, each of whom has a row of a table, and a miner, who wants to mine the en- tire table. Our objective is to design protocols that allow the miner to obtain a k-anonymous table representing the customer data, in such a way that does not reveal any extra information that can be used to link sensitive attributes to corresponding identifiers, and without requiring a central authority who has access to all the original data. We give two different formulations of this problem, with provably private solutions. Our solutions enhance the privacy of k-anonymization in the distributed scenario by maintaining end-to-end privacy from the original customer data to the final k-anonymous results.
Automated trust negotiation is an approach to authorization for open systems, i.e., systems where resources are shared across organizational boundaries. Automated trust negotiation enables open computing by assigning an access control policy to each resource that is to be made accessible to "outsiders"; an attempt to access the resource triggers a trust negotiation, consisting of the iterative, bilateral disclosure of digital credentials and related information. In our recent work in applying the TrustBuilder system for trust negotiation to real-world systems, we have encountered the need to make trust negotiation facilities available to legacy peers, which has led to the development of the Traust system. We have also encountered the need to include helpful third parties in the negotiation process, such as credential wallets, remote authorization servers, and brokers. PeerTrust2 is our effort to design a language that allows us to reason about trust negotiations involving helpful third parties, while supporting exposure control, delegation, proof hints, declarations of purpose, sensitive policies, and other potentially useful aspects of access control. In this talk, I will demonstrate Traust and describe its internal design, and then describe PeerTrust2.
Proving ownership rights on outsourced relational databases is a crucial issue in today internet-based application environment and in many content distribution applications. In this talk, we will present mechanisms for proof of ownership based on the secure embedding of a robust imperceptible watermark in relational data. We will discuss the available watermark embedding and decoding techniques. Furthermore, we will provide a comparison between these techniques based on several dimensions such as applicability, efficiency, and security.
Digital investigations have occurred in some form or another for many years, yet there is no scientific model of the process. After all, there are multiple ways and sequences in which evidence may be found. An investigator does not necessarily need a model to solve a case, but a scientific model is useful for developing investigation tools and technology because it allows us to define requirements and identify what areas need more attention. Further, there are guidelines for entering technical evidence into a U.S. court that may require the technical procedure to be published and have known error rates. In this talk, I will present an overview of existing process models that an investigator can use. I will then present our initial findings on a more scientific model that is based on how digital evidence is created and will show how it can be applied to the process models used by practitioners. Our event-based model allows us to more clearly define requirements for investigation tools, which will help in the development and testing process.
Software patching has not been an effective first-line defense preventing large-scale worm attacks, even when patches had long been available for their corresponding vulnerabilities. Generally, people have been reluctant to patch their systems immediately, because patches are perceived to be unreliable and disruptive to apply. To address this problem, we propose a first-line worm defense in the network stack, using shields -- vulnerability-specific, exploit-generic network filters installed in end systems once a vulnerability is discovered, and before the patch is applied. These filters examine the incoming or outgoing traffic of vulnerable applications, and drop or correct traffic that exploits vulnerabilities. Shields are less disruptive to install and uninstall, easier to test for bad side effects, and hence more reliable than traditional software patches. Further, shields are resilient to polymorphic or metamorphic variations of exploits In the Shield project, we're showing that this concept is feasible by implementing a prototype Shield framework that filters traffic at the transport layer. We have designed a safe and restrictive language to describe vulnerabilities as partial state machines of the vulnerable application. The expressiveness of the language has been verified by encoding the signatures of a number of known vulnerabilities. Our evaluation provides evidence of Shield's low false positive rate and impact on application throughput. An examination of a sample set of known vulnerabilities suggests that Shield could be used to prevent exploitation of a substantial fraction of the most dangerous ones.
Lockheed Martin realizes that their newly hired college graduates are an investment in Lockheed Martin's future. As a result the Company looks out for their new college hires. Dr Cherry will talk about several programs dedicated to enhancing the work experience of newly hired and vested college graduates. For instance, one program focuses on new technical graduates right out of college. Another program focuses on new graduates already thinking about a management track. A third program focuses on college graduates that have been around 3-5 years and are serious about focusing on a leadership role. Finally, Dr. Hamilton and Dr. Cherry will dish out relevant insights they gained as they forged ahead in their careers in the corporate world.
Instruction Set Randomization (ISR) has been proposed as a promising defense against code injection attacks. It defuses all standard code injection attacks since the attacker does not know the instruction set of the target machine. A motivated attacker, however, may be able to circumvent ISR by determining the randomization key. In this talk, I will describe a remote attack for determining an ISR key using an incremental guessing strategy and present a method for injecting a worm in an ISR-protected network. The attack is plausible under a variety of realistic conditions and can infect an ISR-protected server in under 6 minutes. Our results provide insights into properties necessary for ISR implementations to be secure and suggest ways to improve to ISR designs. I will speculate on more general architectures for using diversity that can avoid the need to keep secrets from potential attacker that is inherent in previous diversity-based defenses such as ISR and memory address randomization.
Much of the research in computer security, especially in digital forensics and intrusion detection, is concerned with retrieving and analyzing the information that is present on a system. In my talk I will analyze what kind of information is actually desired by a forensic investigator and examine if these needs can be fulfilled by today's operating systems. Some of the desired information is currently not present in many systems and I will make suggestions on how to supply more relevant audit data on a system and increase its quality. The second part of my talk will focus on two particular difficult categories of information that a forensic investigator might desire: user influence and origin information. I will present a model that allows a system to bind arbitrary information in the form of labels to its principals and then propagate the labels as information is exchanged among them. I will demonstrate the usefulness of the model with various case studies and discuss a proof-of-concept implementation. While my work is motivated and aimed primarily at digital forensic investigations, it has applications in other areas of computer science, in particular network traceback, intrusion detection, and access control.
Public key cryptography is an indispensable part of most modern communication systems. However, quantum computers can break cryptosystems like RSA, which are based on
The most commonly used intrusion detection system (IDS) performance metrics are detection rate and false alarm rate. From a usability point of view, a very important measurement is Bayesian detection rate, which indicates how likely there is an intrusion when the IDS outputs an alert. It depends on detection rate, false alarm rate, and base rate (the prior probability of intrusion). Typically, an anomaly detection system has a low Bayesian detection rate because it has a non-zero false alarm rate and the base rate in the target environment is very low. We argue that we need better system architecture to improve Bayesian detection rate. The main objective is to increase the base rate of data stream analyzed by complex detection modules. The general principle is to use layered architecture. One approach is to use a cascade of successively more complex detection modules. We show that base rate increases from one layer to the next. In many cases, the overall false alarm rate of the cascade can be very low. We describe a worm detection system with cascade architecture. In DSC, the lower layer module identifies hosts with
I will present some new definitions and constructions for privacy in large databases. In contrast to conventional privacy mechanisms that aim to prevent any access to individual records, our techniques are designed to prevent indiscriminate harvesting of information while enabling some forms of legitimate access. We start with a simple construction for an obfuscated database that is provably indistinguishable from a black-box lookup oracle (in the random oracle model). Some attributes of the database are designated as "key," the rest as "data." The database behaves as a lookup oracle if, for any record, it is infeasible to extract the data fields without specifying the key fields, yet, given the values of the key fields, it is easy to retrieve the corresponding data fields. We then generalize our constructions to a larger class of queries, and achieve a privacy property we call "group privacy." It ensures that users can retrieve individual records or small subsets of records from the database by identifying them precisely. The database is obfuscated in such a way that queries returning a large subset of records are computationally infeasible. This is joint work with Arvind Narayanan.
In an open environment such as the Internet, the decision to collaborate with a stranger (e.g., by granting access to a resource) is often based on the characteristics (rather than the identity) of the requester, via digital credentials: Access is granted if Alice's credentials satisfy Bob's access policy. The literature contains many scenarios in which it is desirable to carry out such trust negotiations in a privacy-preserving manner, i.e., so as minimize the disclosure of credentials and/or of access policies. Elegant solutions were proposed for achieving various degrees of privacy-preservation through minimal disclosure. We present efficient protocols that protect both sensitive credentials and sensitive policies. That is, Alice gets the resource only if she satisfies the policy, Bob does not learn anything about Alice's credentials (not even whether Alice gained access or not), and Alice learns neither Bob's policy structure nor which credentials caused her to gain access.
In an ad hoc wireless network nodes not in direct range communicate via intermediate nodes. Thus, a significant concern is the ability to route in the presence of Byzantine failures which include nodes that drop, fabricate, modify, replay, or mis-route packets in an attempt to disrupt the routing service. In this talk we will present ODSBR, our on-demand Byzantine resilient routing protocol for ad hoc wireless networks. The protocol relies on an adaptive probing technique that detects a malicious link after $log n$ faults have occurred, where $n$ is the length of the path. Problematic links are avoided by using a weight-based mechanism that multiplicatively increases their weights and by using an on-demand route discovery protocol that finds a least weight path to the destination. Our protocol bounds the amount of damage that an attacker or a group of colluding attackers can cause to the network. We demonstrate through simulation the effectiveness of ODSBR, in mitigating Byzantine attacks. Our analysis of the impact of these attacks versus the adversary's effort gives insights into their relative strengths, their interaction and their importance when designing secure routing protocols. Finally, we show how the technique used by ODSBR can be applied to hybrid wireless networks consisting of cellular and ad hoc 802.11 wireless networks.
Commercial web sites are more dependant than ever on being placed prominently within the result pages returned by a search engine to be successful. "Spam" web pages are web pages that are created for the sole purpose of misleading search engines and misdirecting traffic to target sites. Certain classes of spam pages, in particular those that are machine-generated, diverge in some of their properties from the properties of web pages in general. As a result, these pages can be identified through statistical analysis. We have examined a variety of such properties, including linkage structure, page content, and page evolution, and have found that outliers in the statistical distributions of these properties are predominantly caused by web spam. Joint work with Mark Manasse and Marc Najork.
Basing authorization on attributes of the resource requester provides flexibility and scalability that is essential in the context of large distributed systems. Logic programming provides an convenient, expressive, and well-understood framework in which to work with authorization policy. This talk will summarize an attribute-based authorization framework built on logic programming: RT, a family of Role-based Trust-management languages. It will then discuss efficient and effective evaluation of RT policies that are stored in a distributed manner. After discussing these basics, the talk will consider the problem of assessing authorization policies with respect to the vulnerability of resource owners to a variety of security risks to which they are exposed by delegations to other principals, risks such as undesired authorizations and unavailability of critical resources. We will consider several such properties of RT policies, many of which we will see can be decided efficiently. For other properties, we will see that the complexity depends on the subset of RT in which the policy is expressed. This part of the talk will conclude by discussing some prospects for continued research in this area. Finally, the talk will visit the problem of using attribute credentials to obtain access when the credentials and their contents may themselves be private. Trust negotiation, a simple approach to this problem, will be introduced, as well as an intuitive and useful security property formalizing the protection of private credentials. This research was funded by DARPA and the NSF.
Many business transactions over the Internet involve the exchange of digital products between two parties -- electronic mails, digital audio and video, electronic contract signing and digital signatures, to name a few. Often these transactions occur between players that do not always have identifiable place of doing business and hence do not trust each other. Consequently, there exists ample scope for any of the parties involved, to misbehave and gain advantage over the other party. To overcome this problem researchers have proposed protocols that ensure fairness, that is, no party can gain an advantage even if the party misbehaves. Most works in this area focus on gathering evidence during the protocol execution that is used later, in case of a dispute. The actual handling of the dispute is done manually, after the protocol execution, and is outside the scope of the protocol. However, in an electronic commerce environment, where the merchants and customers may disappear quickly, such "after-the-fact" protection may be inadequate.In this work we propose an e-commerce protocol for trading digital products over the Internet. The novel features of our protocol include: (1) ensuring fair exchange, (2) not requiring manual dispute resolution in case of unfair behavior by any party, (3) assuring each party that the item he is about to receive is indeed the correct one, (4) not requiring the active involvement of a trusted third party unless a problem occurs, and (5) ensuring anonymity for the customer.
A key issue in computer system security is to protect information against unauthorized access. Emerging workflow-based applications in healthcare, manufacturing, the financial sector, and e-commerce inherently have complex, time-based access control requirements. To address the diverse security needs of these applications, a Role Based Access Control (RBAC) approach can be used as a viable alternative to traditional discretionary and mandatory access control approaches. The key features of RBAC include policy neutrality, support for least privilege, and efficient access control management. However, existing RBAC approaches do not address the growing need for supporting time-based access control requirements for these applications. In this talk, I will present a Generalized Temporal Role Based Access Control (GTRBAC) model that combines the key features of the RBAC model with a powerful temporal framework. The proposed GTRBAC model allows specification of a comprehensive set of time-based access control policies, including temporal constraints on role enabling, user-role and role-permission assignments, and role activations. The model provides an event-based mechanism for providing context based access control, as well as expressing dynamic access control policies, which are crucial for developing secure workflow-based enterprise applications. I will discuss various design guidelines for managing complexity of policy specification as well as an XML-based GTRBAC policy specification language.
Syslog is the primary source of information about intrusion-related activity on a Unix system. Searching for known messages and patterns in syslog data is easy to do, and many tools are available for doing so. However, information and patterns that are not already "known" -- those that have not been seen or derived already, may provide even more information about attacks and intrusions. Data mining techniques can help us discover and analyze that information, but, the general lack of structure in syslog data makes it impossible to apply these techniques directly to the data. To address the problem, we are researching methods of generating patterns from an archive of system logs which can uniquely identify syslog messages by the variant and invariant elements of the messages. Once syslog messages can be uniquely identified, data mining techniques for use in intrusion detection or forensic analysis will be far more useful.
The robustness testing method is based on systematic creation of a very large number of communication protocol messages containing exceptional data elements and structures simulating malicious attacks or corrupted traffic. The method provides a proactive way of assessing software robustness and security. Robustness here is defined as the ability of software to tolerate exceptional input and stressful environment conditions. A piece of software which is not robust fails when facing such circumstances. In the worst case, a malicious intruder can take advantage of robustness shortcomings to deny service from authentic users or to compromise the system running the piece of software. As part of one robustness testing usage scenario, namely security assessment, also the communication process from security vulnerability discovery to vulnerability elimination will be explored. This research was originally initiated in PROTOS project at the University of Oulu, Finland.
Most people now realize that computer security is hard. However, many people do not realize that creating a correct security policy is hard. Creating an accurate security policy is on the order of complexity of developing software in general. In particular how can you show the policy is correct?The focus of this seminar is to look at tools and techniques for showing that the mandatory security policy based on type enforcement meets its objectives. The approach breaks down the security policy objectives so that they can be studied in terms of information flows. The policies are specified for the Security Enhanced Linux type enforcement mechanism. Type enforcement and mandatory access control will also be discussed.
The Internet is uniquely and strategically positioned to address the needs of a growing segment of population in a very cost-effective way. It provides tremendous connectivity and immense information sharing capability which the organizations can use for their competitive advantage. Several organizations have transited from their old and disparate business models based on ink and paper to a new, consolidated ones based on digital information on the Internet. However, information sharing on the Internet usually occurs in broad, highly dynamic network-based environments, and formally accessing the resources in a secure manner poses a difficult challenge. Balancing the competing goals of collaboration and security is difficult because interaction in collaborative systems is targeted towards making people, information, and resources available to all who need it, whereas information security seeks to ensure the integrity of these elements while providing it only to those with proper authorization. As organizations implement information strategies that call for sharing access to resources in the networked environment, mechanisms must be provided to protect the resources from adversaries.This talk addresses the issue of how to advocate selective information sharing in collaborative systems through access control schemes while minimizing the risks of unauthorized access proposing a delegation framework. It also introduces a systematic approach to specify delegation and revocation policies using a set of rules. The feasibility of the proposed framework is also discussed through policy specification, enforcement, and a proof-of-concept implementation.
Role-based access control (RBAC) has received considerable attention in recent years, resulting in several important theoretical models and increasing use in commercial products. Nevertheless, role-based administration, the use of role-based techniques to control RBAC systems, has been less widely studied. We will consider the problem of controlling the propagation of authorization information in computer systems in general, and in role-based systems in particular. We will then introduce the concept of administrative scope, an intuitive notion corresponding to the set of role(s) that can be controlled by a given role, and demonstrate how this can be used as the fundamental unit in the development of a family of administrative models for RBAC systems. We compare the characteristics of these models with the well-known ARBAC97 administrative model. We conclude by discussing how administrative scope can be used to provide an administrative framework for more complex RBAC models.
We describe the Diffie-Hellman key-exchange protocol and the Pohlig-Hellman cipher. We discuss discrete logarithms and the cryptanalysis of these two systems. We also describe the Mental Poker protocol.
We discuss the history and basic facts of Information Theory and give simple applications to cryptography and data security.
Computer security takes on more importance as commerce becomes e-commerce and business embraces the Net. However, little progress has been made in the security field, especially when vendor technology is considered. Popular press coverage of computer security orbits around basic technology issues such as what firewalls are, when to use the DES encryption algorithm, which anti-virus product is best, or how the latest email-based attack works. The problem is, many security practitioners don't know what the problem is. It's the software! Internet-enabled software applications, especially custom applications, present the most common security risk encountered today, and are the target of choice for real hackers. This talk is all about software security risk and how to manage it. The trick is to begin early, know your threats (including language-based flaws and pitfalls), design for security, and subject your design to thorough objective risk analyses and testing. This talk covers material that software practitioners, including architects and languages researchers, can use to avoid security problems and produce more secure Internet-based code.
The studies all say that 70% to 80% of information security incidents involve "insiders". However, today, it is becoming increasingly difficult to pinpoint exactly what we mean by an insider. Complicating the issue, law enforcement is increasingly overloaded and the FBI has gone on record as saying that the victims of such incidents should begin their own investigation. The good news is that the victim will likely be in a position to respond much more rapidly than will law enforcement. The bad news is if the victim does not respond correctly, evidence may be irretrievably lost or damaged limiting or eliminating the effective response by law enforcement at a later point. Where law enforcement is not to be involved, such errors can have a devastating effect on civil litigation. This seminar will explore the resources available for investigating a computer security incident, discuss the investigative process, explore the underlying legal issues and specific laws and introduce some forensic techniques that a victim may use to preserve evidence correctly.
Intrusion detection (ID) is an important component of infrastructure protection mechanisms. Intrusion detection systems (IDSs) need to be accurate, adaptive, extensible, and cost-effective. These requirements are very challenging because of the complexities of today's network environments and the lack of IDS development tools. Our research aims to systematically improve the development process of IDSs. In the first half of the talk, I will describe our data mining framework for constructing ID models. This framework mines activity patterns from system audit data and extracts predictive features from the patterns. It then applies machine learning algorithms to the audit records, which are processed according to the feature definitions, to generate intrusion detection rules. This framework is a "toolkit" (rather than a "replacement") for the IDS developers. I will discuss the design and implementation issues in utilizing expert domain knowledge in our framework. In the second half of the talk, I will give an overview of our current research efforts, which include: cost-sensitive analysis and modeling techniques for intrusion detection; information-theoretic approaches for anomaly detection; and correlation analysis techniques for understanding attack scenarios and early detection of intrusions.
What's wrong with today's Internet? If TCP/IP has won, what's left to be done? In truth, we've only just begun ... to understand the how the Internet is evolving, the impact of our staggering demand for information, and how a whole set revolutionary technologies will change the Internet's foundation. This talk skims the waves - it highlights some of the key changes on the horizon and explains why they will be important. Some key trends we'll touch on include: overlay networks like voice-over-IP, media overlays, and security overlays; quality-of-service and how to manage it; peer-to-peer networking - what's driving it and how it may change the Internet completely; and security protocols - how they're being used and why they're not everywhere. This will be a technical talk, focused on how things work and why these trends are interesting. Don't expect to walk away with a new set of tools, but do expect to come away with a better understanding of how things work and a some new ideas about some emerging technologies that may just change everything.
Despite decades of advances in computer science and software engineering, our computing systems seem to be less and less trustworthy. Each week seems to bring new stories of computer viruses, invasions of privacy, serious bugs in common software platforms, and network intrusions. The trend seems to be getting worse instead of better. Why is that? And is there hope for safer systems for day-to-day use in e-commerce and government? In this talk, we will examine some of the factors that have led to this distressing state of events. Included will be a discussion of some rules for designing secure software, and an examination of why the current Internet marketplace encourages those rules to be ignored. The clear solution is not one of technology -- but of consumer action. Audience feedback is encouraged.
Resource-constrained devices are becoming ubiquitous. Examples include cell phones, palm pilots, and digital thermostats. It can be difficult to fit required functionality into such a device without sacrificing the simplicity and clarity of the software. Increasingly complex embedded systems require extensive brute-force testing, making development and maintenance costly. This is particularly true for system components that are written in assembly language. Static checking has the potential of alleviating these problems, but until now there has been little tool support for programming at the assembly level. In this paper we present the design and implementation of a static checker for interrupt-driven Z86-based software with hard real-time requirements. For six commercial microcontrollers, our checker has produced upper bounds on interrupt latencies and stack sizes, as well as verified fundamental safety and liveness properties. Our approach is based on a known algorithm for model checking of pushdown systems, and produces a control-flow graph annotated with information about time, space, safety, and liveness. Each benchmark is approximately 1000 lines of code, and the checking is done in a few seconds on a standard PC. Our tool is one of the first to give an efficient and useful static analysis of assembly code. It enables increased confidence in correctness, significantly reduced testing requirements, and support for maintenance throughout the system life-cycle. Joint work with Dennis Brylow and Niels Damgaard.
Information about the incidence of security breaches is difficult to obtain. Emergency situations are not favorable to the maintenance of records, the security breaches are embarrassing and possibly damaging, and disclosing information about the incidents may reveal some sensitive information. Moreover, the nature of the incident and its cause are not always fully known. Because of this, the frequency and cost is difficult to assess by type of incident. The IRDB project attempts to provide a framework to record incident information and duration. Besides email and cost recording, it provides a dynamic classification of incidents. In the IRDB, incidents have a risk type and an attack type. The risk type expresses the consequences of the attack (e.g., root access). The attack type identifies kinds of attacks (e.g., SANS top ten). Each type is itself classified by properties. With this system, we hope that 1) organizations using the same type classification can directly share data; 2) organizations not using the same type classification can translate data based on the properties of the types; 3) statistical data from many different organizations can be assembled to present a coherent picture of incident costs and frequencies on a national scale. By making the type classification dynamic, it is hoped that the severity of future, currently unknown types of attacks can be rapidly assessed.
Information security, and the technologies that provide such security, are a very hot topic throughout the information technology and business communities today. This presentation opens with a consideration of the current network environment. It answers the questions "where are these technologies?" and "where are the gaps in the technologies that are being addressed?" especially as they impact security. Next, the presentation considers the field of network security technologies. It addresses the good, the bad and the undecided aspects of the field today. After setting the stage with this background information, the presentation identifies the most important trends that will impact the network security industry in the coming few years: the federal government finally cares, the vanishing network perimeter, and the opportunity to achieve ubiquitous encryption. Toward the end of the presentation, Dr. Reel presents two "killer" security-related applications. Finally, the presentation closes with a discussion of the major needs in the information security field.
In order for e-commerce and e-business to grow at the fullest extent possible, higher levels of trust and accountability need to become established. The corporate buyers who rely on reliable structures need to hold those who build and support commercial network initiatives (call them "infrastructure and service providers") responsible for things that go wrong. Downtime, outages, viruses, data integrity, data confidentiality and hacker damage are some of the losses that providers need to prevent and absorb in a proactive manner. Today it is the ecommerce buyer / user who get stuck holding the bag. In the near future it will be the provider who will be held responsible. There is a world of difference between information security and e-business risk management. Traditional info security just looks at the technical / network controls that ecommerce relies on. Ebusiness risk management takes a multi-disciplinary approach that instills controls throughout the enterprise, not just in the technology. This multi-disciplinary approach addresses the legal, operational, financial and technical controls that must be present in all ebusiness environments. Addressing an aspect of the financial controls, insurance is a necessary element in all ebusiness risk management strategies. If a loss occurs (which it always will - there's no such thing as a 100% perfect system), a specialized insurance policy is the financial mechanism that will allow the ecommerce provider to absorb the loss and pay for the damages.
In today's increasingly dependent and interdependent global information society, information assurance for systems is gaining tremendous importance. Individuals, governments, and societies are insisting on secure and safe communications environments. The solution to providing those assurances lies in the formation of partnerships between and among business, academia and government. Mr. Fleming will present an overview of a model for such partnerships, to include critical elements for the success of those joint ventures. Dr. Maconachy will briefly discuss the cognitive and social implications related to moving towards a global security-based enteprise.
With the recent phenomenal growth of the availability and connectivity of computing resources and the advent of e-commerce, more valuable and private data is being stored online than ever before. But with greater value and availability comes greater threat. In this talk we examine the information security problem of anomaly detection --- recognizing the occurrence of ``out of the ordinary'' events which may prove to be hazardous. We evaluate this problem as a machine learning task and describe the application of two machine learning techniques: instance-based learning (IBL) and hidden Markov models (HMMs). This work focuses on anomaly detection at the user level (as opposed to the network or system call level), which introduces a number of interesting and complex issues from a machine learning standpoint. In particular, we explore privacy, resource constraints, non-stationarity (a.k.a. concept drift), and performance issues and give empirical analyses based on real user data. We close with some thoughts on extensions to this work and on other areas of application.
With the advent of mobile code (excutable programs that are carried on web pages and inside E-Mail) in everyday use, the capability to include malicious software without the recipient's knowlege has been implicit. From the first crude examples ("Concept", 1995) through the "Russian New Year" exploits (1997-98), to the current surprises (Bubbleboy, 1999) there has been a continual advance in sophistication. Despite attempts by the manufacturer to provide mitigation, these patches are little known or applied and often apply only to the latest versions and not the bulk of the installed base. We shall examine the built-in capabilities that make this possible, the probable rationale behind such decisions, and the implication for future events.
How can one automatically identify classified documents? This is a vital question for the Department of Energy (DOE), which is reviewing millions of classified documents for possible declassification, and for Los Alamos National Laboratory (LANL), which is checking its unclassified computing storage systems for the presence of classified documents. The DOE, having already developed an expert rule system for automatic document classification, provided LANL with a small set of documents with which to explore a statistical classifier as an alternative. We represented documents as vectors of character trigram frequencies, used a chi-square statistic to select the optimal trigrams, and trained a linear classifier to distinguish classified and unclassified documents. Results ranged from 60% to 87% accuracy, depending on the training set size and other variables. In contrast, the LANL effort started "from scratch" and needed to be moved rapidly into large-scale production. We implemented an expert system tailored to the classified documents of most concern to LANL. The talk will discuss the practical issues that arose in canvassing large amounts of files in a variety of formats, and the security issues involved in the sampling, analysis, and notification processes.
The recent spate of attacks against Yahoo and other sites with large on-line presences brought denial-of-service attacks into the public consciousness. The methods used in these attacks make it very difficult, if not impossible, to locate the source of the attacks. The problem lies not only in finding the particular computers used to launch the attacks, but also in finding the individuals controlling those computers. I will discuss the attacks that occurred, why it is so difficult to track the intruders, research work that attempt to make it possible do so, and open research problems in the area. CERIAS has on-going work related to the problem of tracking intruders across the Internet, and I expect this to be an evolving and interesting area of research in the future.
In October of 1999, Denver based Space Imaging launched the world's first very-high resolution commercial satellite, IKONOS 2, into polar orbit around the earth. For the first time in history, sub-1 meter near real time digital imagery is now available for virtually the entire globe to anyone with a credit card and access to the internet. This talk will explore: (1) the policy history around the US government's decision to let this technology "go commercial," (2) the status of current US remote sensing policy and some remaining policy issues that still need to be addressed, and (3) the potential implications of this information revolution for national security, law enforcement, privacy, and several other issues.
This paper explores a promising interface between natural language processing (NLP) and information assurance and security (IAS). More specifically, it is devoted to possible applications of the accumulated considerable resources in NLP to IAS. The paper is of a mixed theoretical and empirical nature. Of the four possible venues of applications, (i) memorizing randomly generated passwords with the help of automatically generated funny jingles, (ii) natural language watermarking, (iii) using the available machine translation (MT) systems for (additional) encryption of text messages, and (iv) downgrading, or sanitizing, classified information in networks, two venues, (i) and (iv), have been at least partially implemented, and the remaining two, (ii) and (iii), are being implemented to the proof-of-concept level. We feel that it is important, however, even at this early stage, to review for the information security community what NLP can do for it and to invite feedback and further efforts and ideas in this direction.
Tripwire has a long history of openly available source, having been created at Purdue University in 1992 as a publicly available security tool. It has been created into an industrial strength tool, and has been successful in protecting critical enterprise processes in business and government. One of the decisions we made was to use a conventional shrink-wrapped software model -- in other words, source code was no longer readily available to the public. Without question, this has been a smooth and successful transition. Tripwire v2.0 provided a variety of additional compelling features so that customers have embraced the new product. However, there were some things that happened along the way that didn't quite go as planned. And some things were just were downright surprising. This presentation will address some of the consequences of having a closed source product, and describe some issues in considerable detail. Then, possible "open source" opportunities will be presented, with all sorts of benefits discussed, evaluated, and some discarded. Some perceived dangers are mulled over, and also evaluated. Audience participation will be encouraged.
Many security breaches are caused by inappropriate inputs crafted by people with malicious intents. To enhance the system security, we need either to ensure that inappropriate inputs are filtered out by the program, or to ensure that only trusted people can access those inputs. In the second approach, we sure do not want to put such constraint on every input, instead, we only want to restrict the access to the security relevant inputs. The goal of this paper is to investigate how to identify which inputs are relevant to system's security. We have formulated the problem as an security relevancy problem, and deploy static analysis technique to identify security relevant inputs. Our approach are based on dependency analysis technique, it identifies if the behavior of any security critical action depends on certain input. If such a dependency relationship exists, we say that the input is security relevant, otherwise, we say the input is security non-relevant. We have applied this technique to a security analysis project initiated by Microsoft Windows NT security group. The project is intended to identify security relevant registry keys (a special kind of input) in Windows NT operating system. The results produced from this approach is proved to be useful to enhance Windows NT security. We will report our experience and results from this project in the paper. Thwarting Denial of Service Attacks against Communication Protocols with Backward Compatible Changes: A Case Study(for Mahesh Tripunitara) We will discuss a novel approach to building safeguards against denial of service attacks against communication protocols. Our approach involves changes to the relevant communication protocol subject to the following constraint: the protocol that results from the change must be backward compatible with the unchanged protocol. That is, an entity that employs the changed protocol must be able to communicate with an entity that employs the unchanged version. We will look at a specific problem in this context. The problem involves a class of denial of service attacks against IP. The class is called ARP (Address Resolution Protocol) cache poisoning and involves an attacker introducing a spurious IP to Ethernet mapping in a victim's ARP cache. We will discuss the solution and some implementation aspects of it. Apart from being backward compatible, our solution has two favourable properties: it is implemented as middleware, and is asynchronous
We will discuss a novel approach to building safeguards against denial of service attacks against communication protocols. Our approach involves changes to the relevant communication protocol subject to the following constraint: the protocol that results from the change must be backward compatible with the unchanged protocol. That is, an entity that employs the changed protocol must be able to communicate with an entity that employs the unchanged version. We will look at a specific problem in this context. The problem involves a class of denial of service attacks against IP. The class is called ARP (Address Resolution Protocol) cache poisoning and involves an attacker introducing a spurious IP to Ethernet mapping in a victim's ARP cache. We will discuss the solution and some implementation aspects of it. Apart from being backward compatible, our solution has two favourable properties: it is implemented as middleware, and is asynchronous.
Information security is an inarticulate, incoherent, incomplete, incorrect folk art attempting to preserve confidentiality, integrity, and availability (CIA) of information from destruction, disclosure, use, and modification (DDUM). This CIA/DDUM framework is the equivalent of alchemy in the middle ages when the elements consisted of fire, water, earth, and air. We must have security based on a coherent and complete framework model for stopping irrational cybercriminals. We must replace security risk reduction, an unmeasurable negative goal, with achieving standards of due care consistent with the new view of security as an enabling function.
This presentation will teach participants how to develop secure infrastructures in eCommerce by discussing security impacts to business applications, Netcentric security elements, and real stories from client experience. The presentation includes a thorough discussion of risk assessment methodology.
As use of information technology continues to expand, the need to identify and preserve electronic evidence becomes a paramount. Once strictly the domain of law enforcement agencies, computer forensic examination has become a common part of litigation. Mr. Hansen will discuss a evolution of computer forensics, some of the ongoing legal and technical challenges that face a service provider in this area. Mr. Hansen will review a number of recent cases, and identify current trends in this area.
This talk addresses the issue of reconciling the needs of law enforcement and national security with the continuing evolution of computer and communications technology. It will describe the needs of both the law enforcement and national security communities including their current technical requirements and solutions. It will then describe technological trends and show how technical imperatives will render current solutions ineffective. It concludes with a description of possible directions that may be used to meet both law enforcement and national security needs while accounting for both technical evolution and social rights.
In the past several years there has been an explosive growth in digital imaging technology and applications. Digital images and video are now widely distributed on the Internet and via CD-ROM. One problem with a digital image is that an unlimited number of copies of an "original" can be easily distributed and/or forged. This presents problems if the image is copyrighted. The protection and enforcement of intellectual property rights has become an important issue in the "digital world." Many approaches are available for protecting digital images and video; traditional methods include encryption, authentication and time stamping. In this talk we describe algorithms for image authentication and forgery prevention known as digital watermarking. A digital watermark is a signal that is embedded in a digital image or video sequence that allows one to establish ownership, identify a buyer or provide some additional information about the digital content. In this talk we will review the current state of watermarking and describe some of the open research problems.
Multicast routing is a service that provides for efficient many-to-many communication in a network. Traditionally, secure multicast protocols have used existing multicast routing services and relied on cryptographic protection of the messages sent to provide security. Much previous work in the area has been on methods of establishing a shared key between members subscribing to the multicast group. Some problems with this approach are that any network member can receive the encrypted traffic, and that the multicast routing protocol itself is subject to attacks which allow for effective denial-of-service attacks against the group members. I present Keyed-HIP (KHIP), a protocol for secure, hierarchical, multicast routing that changes the multicast model to prevent non-group members from receiving the secure traffic, and limits the effectiveness of denial of service attacks against the multicast group. KHIP also provides an efficient mechanism for distributing data encryption keys to all members of the group. While the type of security provided by KHIP is not necessary in all cases, for some applications the traditional model of multicast security may be lacking.