Information Security Commons^™

Experiments With Applying Artificial Immune System In Network Attack Detection, Alexis Cooper

KSU Proceedings on Cybersecurity Education, Research and Practice

The assurance of security within a network is difficult due to the variations of attacks. This research conducts various experiments to implement an Artificial Immune System based Intrusion Detection System to identify intrusions using the Negative Selection Algorithm. This research explores the implementation of an Artificial Immune System opposed to the industry standard of machine learning. Various experiments were conducted to identify a method to separate data to avoid false-positive results. The use of an Artificial Immune System requires a self and nonself classification to determine if an intrusion is present within the network. The results of an Artificial Immune …

A Developmental Study On Assessing The Cybersecurity Competency Of Organizational Information System Users, Richard Nilsen, Yair Levy, Steven Terrell, Dawn Beyer

KSU Proceedings on Cybersecurity Education, Research and Practice

Organizational information system users (OISUs) that are open to cyber threats vectors are contributing to major financial and information losses for individuals, businesses, and governments. Moreover, technical cybersecurity controls may be rendered useless due to a lack of cybersecurity competency of OISUs. The main goal of this research study was to propose and validate, using subject matter experts (SMEs), a reliable hands-on assessment prototype tool for measuring the knowledge, skills, and abilities (KSAs) that comprise the cybersecurity competency of an OISU. Primarily using the Delphi methodology, this study implemented four phases of data collection using cybersecurity SMEs for proposing and …

Voice Hacking Proof Of Concept: Using Smartphones To Spread Ransomware To Traditional Pcs, Leonardo I. Mazuran, Bryson R. Payne, Tamirat T. Abegaz

KSU Proceedings on Cybersecurity Education, Research and Practice

This paper presents a working proof of concept that demonstrates the ability to deploy a sequence of hacks, triggered by speaking a smartphone command, to launch ransomware and other destructive attacks against vulnerable Windows computers on any wireless network the phone connects to after the voice command is issued. Specifically, a spoken, broadcast, or pre-recorded voice command directs vulnerable Android smartphones or tablets to a malicious download page that compromises the Android device and uses it as a proxy to run software designed to scan the Android device’s local area network for Windows computers vulnerable to the EternalBlue exploit, spreading …

Security Device Roles, Vabrice Wilder

KSU Proceedings on Cybersecurity Education, Research and Practice

“An abstract of this article was published in the proceedings of the Conference on Cybersecurity Education, Research & Practice, 2017”. Communication has evolved since the beginning of mankind from smoke signals to drones to now the internet. In a world filled with technology the security of one’s device is not to be taken for granted. A series of research was done in order to gather details about network devices that can aid in the protection of one’s information while being transferred through the internet. The findings included but not limited to, switches, the seven layers of OSI, routers, firewalls, load …

"Think Before You Click. Post. Type." Lessons Learned From Our University Cyber Secuity Awareness Campaign, Rachael Innocenzi, Kaylee Brown, Peggy Liggit, Samir Tout, Andrea Tanner, Theodore Coutilish, Rocky Jenkins

KSU Proceedings on Cybersecurity Education, Research and Practice

This article discusses the lessons learned after implementing a successful university-wide cyber security campaign. The Cyber Security Awareness Committee (CyberSAC), a group comprised of diverse units across campus, collaborated together on resources, talent, people, equipment, technology, and assessment practices to meet strategic goals for cyber safety and education. The project involves assessing student learning and behavior changes after participating in a Cyber Security Password Awareness event that was run as a year-long campaign targeting undergraduate students. The results have implications for planning and implementing university-wide initiatives in the field of cyber security, and more broadly, higher education at large.

Ssetgami: Secure Software Education Through Gamification, Hector Suarez, Hooper Kincannon, Li Yang

KSU Proceedings on Cybersecurity Education, Research and Practice

Since web browsers have become essential to accomplishing everyday tasks, developing secure web applications has become a priority in order to protect user data, corporate databases and critical infrastructure against cyber-crimes . This research presents a game-like (gamification) approach to teach key concepts and skills on how to develop secure web applications. Gamification draws on motivational models, one of psychological theories. Gamification design has great potential over traditional education where we often find students demotivated and lecturers failing to engage them in learning activities. This research created game-like learning modules to teach top vulnerabilities and countermeasures for these top vulnerabilities …

Analyzing Cyber Threats Affecting The Financial Industry, Anna Skelton

Student Works

As critical infrastructure, financial institutions must execute the highest level of cybersecurity as the threat of a crippling cyberattack continues to develop. Malicious actors, including disenfranchised employees, state sponsored actors, and traditional hackers, all have motivations to target the financial industry, and do so frequently. However, the threat changes slightly between resource rich large institutions and their smaller, community bank counterparts. The complex and multifaceted threat must be fully understood in order to properly address and analyze solution options to preserve the security of these institutions and the economy that they contribute to.

Ua8 It Security Bulletin, Wku Information Technology

WKU Administration Documents

WKU Information Technology security bulletin issued to faculty & staff via email.

• Ciampa, Mark. Ransomware
• Securing the Human
• New to WKU?
• Phone Scams
• Phishing
• SMiShing
• Handling Sensitive Data
• University Policy

Marketing Strategy Of School Of Professional Studies In China, Jiahui Liu, Jing Wang, Shuo An, Wengxing Wang, Yiwei Wang

School of Professional Studies

Chinese students are the most visible international presence at many universities across the United States, and the number continues to grow. Since 2010, The number of graduate students studying abroad has entered the period in which the increase has been declining. Under the circumstance of the weak global economy and high cost of education, the administration needs to attract the attention of Chinese students. In the process of competing for applicants, how to develop marketing strategies to attract students’ eyeballs has become an important means of trying to increase school income through Chinese students. The marketing strategy mentioned in this …

Fair Deposits Against Double-Spending For Bitcoin Transactions, Xingjie Yu, Shiwen M. Thang, Yingjiu Li, Robert H. Deng

Research Collection School Of Computing and Information Systems

In Bitcoin network, the distributed storage of multiple copies of the blockchain opens up possibilities for double spending, i.e., a payer issues two separate transactions to two different payees transferring the same coins. To detect the doublespending and penalize the malicious payer, decentralized non-equivocation contracts have been proposed. The basic idea of these contracts is that the payer locks some coins in a deposit when he initiates a transaction with the payee. If the payer double spends, a cryptographic primitive called accountable assertions can be used to reveal his Bitcoin credentials for the deposit. Thus, the malicious payer could be …

Pedagogical Resources For Industrial Control Systems Security: Design, Implementation, Conveyance, And Evaluation, Guillermo A. Francia Iii, Greg Randall, Jay Snellen

Journal of Cybersecurity Education, Research and Practice

Industrial Control Systems (ICS), which are pervasive in our nation’s critical infrastructures, are becoming increasingly at risk and vulnerable to internal and external threats. It is imperative that the future workforce be educated and trained on the security of such systems. However, it is equally important that careful and deliberate considerations must be exercised in designing and implementing the educational and training activities that pertain to ICS. To that end, we designed and implemented pedagogical materials and tools to facilitate the teaching and learning processes in the area of ICS security. In this paper, we describe those resources, the professional …

Cyber Security For Everyone: An Introductory Course For Non-Technical Majors, Marc J. Dupuis

Journal of Cybersecurity Education, Research and Practice

In this paper, we describe the need for and development of an introductory cyber security course. The course was designed for non-technical majors with the goal of increasing cyber security hygiene for an important segment of the population—college undergraduates. While the need for degree programs that focus on educating and training individuals for occupations in the ever-growing cyber security field is critically important, the need for improved cyber security hygiene from the average everyday person is of equal importance. This paper discusses the approach used, curriculum developed, results from two runs of the course, and frames the overall structure of …

How Much Should We Teach The Enigma Machine?, Jeffrey A. Livermore

Journal of Cybersecurity Education, Research and Practice

Developing courses and programs in Information Assurance can feel like trying to force ten pounds of flour into a five pound sack. We want to pack more into our courses than we have time to teach. As new technologies develop, we often find it necessary to drop old technologies out of the curriculum and our students miss out on the historical impacts the old technologies had. The discipline is so broad and deep that we have to carefully choose what concepts and technologies we study in depth, what we mention in passing, and what we leave out. Leaving out important …

From The Editors, Carole L. Hollingsworth, Michael E. Whitman, Herbert J. Mattord

Journal of Cybersecurity Education, Research and Practice

Welcome to the third issue of the Journal of Cybersecurity Education, Research and Practice (JCERP).

Detecting Deception In Asynchronous Text, Fletcher Glancy

Annual ADFSL Conference on Digital Forensics, Security and Law

Glancy and Yadav (2010) developed a computational fraud detection model (CFDM) that successfully detected financial reporting fraud in the text of the management’s discussion and analysis (MDA) portion of annual filings with the United States Securities and Exchange Commission (SEC). This work extends the use of the CFDM to additional genres, demonstrates the generalizability of the CFDM and the use of text mining for quantitatively detecting deception in asynchronous text. It also demonstrates that writers committing fraud use words differently from truth tellers.

Umass Memorial Healthcare Information System Job Ladder, Matthew Simoncini, Vamsi Kavuru, Antariksh Nanda, Tahaseen Mahaboob Basha, Vikram Patil

School of Professional Studies

The capstone project report emphasizes the importance of a job ladder and the need of an hour to implement it at UMASS Memorial health care. The scope of this project is to create a well-established job ladder at UMASS with pre-defined standards on job levels related to Information Technology department that would facilitate in hiring, developing and promoting employees at various stages.

A Learning Framework For The Ywca Central Massachusetts, Dayna Ankermann, Manjushree Burdekar, Priyanka Joshi, Ying Song, Yumeng Chen, Xing Xie

School of Professional Studies

After meeting with the Director of Wellness and Health Equity at the YWCA Central Massachusetts (which will be referred to as the YWCA from here on out), we learned that as a non-profit gym and health center, it is heavily underfunded. The main focus of the project was to determine how to upkeep the facility while bringing in new customers with limited resources and budget. Due to the needs of the YWCA, our group focused on six aspects: revenue stream, donor retention, increasing membership, customer experience, social media marketing, and membership fee structure. After completing extensive research, we were able …

Human Services Management (Hsm) Certificate Program Expansion To Western Massachusetts Feasibility Study, Paul Campbell, Patrick Deschenes, Maria Pacheco, Bradley Paul, Elizabeth Vittum, Jing Zhang

School of Professional Studies

One of the most popular cost-savings programs that the Providers’ Council currently offers its members is a Certificate in Nonprofit Human Service Management (HSM) provided in partnership with Clark University and Suffolk University. As human services providers are struggling to hire and retain qualified staff, the need to provide professional development opportunities to help grow and expand a skilled health and human services workforce is a critical issue facing nonprofit organizations and communities in Massachusetts. This feasibility study examines the viability of Providers’ Council and Clark University expanding its HSM Certificate Program to organizations and staff located in western Massachusetts. …

Somali National University, Sharmarke Abdulla, Nikala Pieroni, Jenna Caskie, Sergii Odnodvorets, Tanyue Gong, Lahari Dasari

School of Professional Studies

The executive summary presents an overview of the principal conclusions and recommendations for Somali National University Faculty of Education (FoEd) regarding the following concerns: Difficulty with recruiting high quality prospects to the FoEd; Ineffective and counterintuitive use of social media as a tool to improve brand equity, as well as as a tool to attract and communicate with prospective and current students; Unbalanced gender ratio of current student body; Absence of student services and student supports; Low student retention rate; Limited resources for academic advising; This document is the result of a Clark University School of Professional Studies Capstone Project.

Earning A Seat At The Table: How It Departments Can Partner In Organizational Change And Innovation, Robert L. Moore, Nathan Johnson

STEMPS Faculty Publications

Few would argue that the information technology department (ITD) is not an essential part of an organization. It is hard to envision a project that does not need the support of the ITD. Despite this importance, the ITD is not always involved in the management of projects. Often, the ITD is brought into the project late in the planning and development process. In many cases, the inclusion of the ITD in an advanced project stage can result in project failure where early involvement could have prevented it. Why is it that ITDs, while clearly a vital part of project implementation, …

Source Credibility And Cybersecurity Behaviors Of Computer Users, Bracken Sallin

Summer Community of Scholars Posters (RCEU and HCR Combined Programs)

No abstract provided.

Examining And Exposing The Darknet, Ton H. Don

College of Graduate Studies: Theses & Dissertations

This thesis consists of two studies; the first study is “Diving into the Darknet” and the second is “Exposing the Darknet on Mobile Devices”. The Darknet is a network of hidden sites and services which are built based on anonymity. In “Diving into the Darknet”, we applied different data science methods to establish the relationships between the data in the data set. This data set has information related to seller, drug types, and transactions. Additionally, we used Tableau to visualize the data set. For the second study, we took a digital forensics perspective of the Darknet. Orfox and Orbot, a …

Threats To Information Protection - Industry And Academic Perspectives: An Annotated Bibliography, Michael E. Whitman, Herbert J. Mattord

Journal of Cybersecurity Education, Research and Practice

Threats to information assets have always been a concern to those responsible for making information useful and defending its value. The concepts of threat, threat agent, threat events and threat sources have evolved in recent years have very precise definitions. A summary of threat classification models used in academic research is provided along with a summary of recent industry threat assessment reports. Finally, the results from a recent study, 2015 SEC/CISE Threats to Information Protection Report Including a Current Snapshot of the State of the Industry, are given.

From The Editors, Herbert J. Mattord, Michael E. Whitman, Carole L. Hollingsworth

Journal of Cybersecurity Education, Research and Practice

Welcome to the second issue of the Journal of Cybersecurity Education, Research and Practice (JCERP).

Towards An In-Depth Understanding Of Deep Packet Inspection Using A Suite Of Industrial Control Systems Protocol Packets, Guillermo A. Francia Iii, Xavier P. Francia, Anthony M. Pruitt

Journal of Cybersecurity Education, Research and Practice

Industrial control systems (ICS) are increasingly at risk and vulnerable to internal and external threats. These systems are integral part of our nation’s critical infrastructures. Consequently, a successful cyberattack on one of these could present disastrous consequences to human life and property as well. It is imperative that cybersecurity professionals gain a good understanding of these systems particularly in the area of communication protocols. Traditional Transmission Control Protocol (TCP) and User Datagram Protocol (UDP) are made to encapsulate some of these ICS protocols which may enable malicious payload to get through the network firewall and thus, gain entry into the …

Planning And Implementing A Successful Nsa-Nsf Gencyber Summer Cyber Academy, Bryson R. Payne, Tamirat Abegaz, Keith Antonia

Journal of Cybersecurity Education, Research and Practice

The GenCyber program is jointly sponsored by the National Security Agency (NSA) and the National Science Foundation (NSF) to help faculty and cybersecurity experts provide summer cybersecurity camp experiences for K-12 students and teachers. The main objective of the program is to attract, educate, and motivate a new generation of young men and women to help address the nationwide shortage of trained cybersecurity professionals. The curriculum is flexible and centers on ten cybersecurity first principles. Currently, GenCyber provides cyber camp options for three types of audiences: students, teachers, and a combination of both teachers and students. In 2016, over 120 …

The Transition Experiences Of International Graduate Students In Clark University School Of Professional Studies, Xuesong Huang, Mingyang Lian, Dang Trung, Jay Sheth, Yuwei Yang, Irina Klimenko

School of Professional Studies

In the last decade, the School of Professional Studies at Clark University has witnessed a sharp increase in international students. More and more international students in the millennial generation have entered the School of Professional Studies pursuing one of the two-year graduate programs: Master of Science in Professional Studies, Master of Science in Public Administration, and Master of Science in Information Technology. In the past, working adult student dominant the program. These students already had a career outside the classrooms before them came to study. The millennial international students have generated new adjustment problems. Some of the transition issues of …

Threats To Information Protection - Industry And Academic Perspectives: An Annotated Bibliography, Michael E. Whitman, Herbert J. Mattord

KSU Proceedings on Cybersecurity Education, Research and Practice

Threats to information assets have always been a concern to those responsible for making information useful and defending its value. The concepts of threat, threat agent, threat events and threat sources have evolved in recent years have very precise definitions. The article includes a summary of threat classification models used in academic research is provided along with a summary of recent industry threat assessment reports. Finally, the article shares results from a recent study, 2015 SEC/CISE Threats to Information Protection Report Including a Current Snapshot of the State of the Industry, are given.

Integrate Text Mining Into Computer And Information Security Education, Hongmei Chi, Ezhil Kalaimannan, Dominique Hubbard

KSU Proceedings on Cybersecurity Education, Research and Practice

Insider threats has become a significant challenge to organization, due to the employees varying levels of access to the internal network. This will intern bypass the external security measures that have been put in place to protect the organization’s resources. Computer-mediated communication (CMC) is a form of communication over virtual spaces where users cannot see each other. CMC includes email and communication over social networks, amongst others. This paper focuses on the design and implementation of exercise modules, which can be integrated into cybersecurity courses. The main objectives of the paper include how to teach and integrate the CMC learning …

Cover Text Steganography: N-Gram And Entropy-Based Approach, Sara M. Rico-Larmer

KSU Proceedings on Cybersecurity Education, Research and Practice

Steganography is an ancient technique for hiding a secret message within ordinary looking messages or objects (e.g., images), also known as cover messages. Among various techniques, hiding text data in plain text file is a challenging task due to lack of redundant information. This paper proposes two new approaches to embed a secret message in a cover text document. The two approaches are n-gram and entropy metric-based generation of stego text. We provide examples of encoding secret messages in a cover text document followed by an initial evaluation of how well stego texts look close to the plain …