Information Security Commons^™

Blockchain Security: Situational Crime Prevention Theory And Distributed Cyber Systems, Nicholas J. Blasco, Nicholas A. Fett

International Journal of Cybersecurity Intelligence & Cybercrime

The authors laid the groundwork for analyzing the crypto-economic incentives of interconnected blockchain networks and utilize situational crime prevention theory to explain how more secure systems can be developed. Blockchain networks utilize smaller blockchains (often called sidechains) to increase throughput in larger networks. Identified are several disadvantages to using sidechains that create critical exposures to the assets locked on them. Without security being provided by the mainchain in the form of validated exits, sidechains or statechannels which have a bridge or mainchain asset representations are at significant risk of attack. The inability to have a sufficiently high cost to attack …

Map My Murder: A Digital Forensic Study Of Mobile Health And Fitness Applications, Courtney Hassenfeldt, Shabana Baig, Ibrahim Baggili, Xiaolu Zhang

Electrical & Computer Engineering and Computer Science Faculty Publications

The ongoing popularity of health and fitness applications catalyzes

the need for exploring forensic artifacts produced by them. Sensitive

Personal Identifiable Information (PII) is requested by the applications

during account creation. Augmenting that with ongoing

user activities, such as the user’s walking paths, could potentially

create exculpatory or inculpatory digital evidence. We conducted

extensive manual analysis and explored forensic artifacts produced

by (n = 13) popular Android mobile health and fitness applications.

We also developed and implemented a tool that aided in the timely

acquisition and identification of artifacts from the examined applications.

Additionally, our work explored the type of …

Blocks' Network: Redesign Architecture Based On Blockchain Technology, Moataz Hanif

Doctoral Dissertations and Master's Theses

The Internet is a global network that uses communication protocols. It is considered the most important system reached by humanity, which no one can abandon. However, this technology has become a weapon that threatens the privacy of users, especially in the client-server model, where data is stored and managed privately. Additionally, users have no power over their data that store in a private server, which means users’ data may interrupt by government or might be sold via service provider for-profit purposes. Furthermore, blockchain is a technology that we can rely on to solve issues related to client-server model if appropriately …

Iot Ignorance Is Digital Forensics Research Bliss: A Survey To Understand Iot Forensics Definitions, Challenges And Future Research Directions, Tina Wu, Frank Breitinger, Ibrahim Baggili

Electrical & Computer Engineering and Computer Science Faculty Publications

Interactions with IoT devices generates vast amounts of personal data that can be used as a source of evidence in digital investigations. Currently, there are many challenges in IoT forensics such as the difficulty in acquiring and analysing IoT data/devices and the lack IoT forensic tools. Besides technical challenges, there are many concepts in IoT forensics that have yet to be explored such as definitions, experience and capability in the analysis of IoT data/devices and current/future challenges. A deeper understanding of these various concepts will help progress the field. To achieve this goal, we conducted a survey which received 70 …

Cybersecurity Education: The Quest To Building Bridge Skills, Andy Igonor, Raymond L. Forbes, Jonathan Mccombs

All Faculty and Staff Scholarship

Today's employers differ in what skills and abilities they believe make for a competent cybersecurity professional; however, they concur on the importance of technical and soft skills, which we collectively refer to as "bridge skills" - in other words, skills needed to bridge employer needs and what higher education teaches. Higher education, on the other hand favors producing a holistic and rounded graduate, with soft skills incorporated into the first one or two years of study. Somewhere between these two dichotomies is a missing link which currently manifests as higher education not meeting the needs of industry relative to cybersecurity …

Weaving The Dark Web: Legitimacy On Freenet, Tor, And I2p, John Schriner

Publications and Research

This is a book review of Robert W. Gehl's Weaving the Dark Web: Legitimacy on Freenet, Tor, and I2P (2018). The book explores these anonymity networks and the concept of legitimacy throughout. Using a multidisciplinary approach and interviews with network-builders and users, Gehl helps to demystify the dark web and critically examine these networks and technologies.

”Cyberworld” As A Theme For A University-Wide First-Year Common Course, Kristen Przyborski, Frank Breitinger, Lauren Beck, Ronald S. Harichandran

Engineering and Applied Science Education Faculty Publications

Nowadays we all live in a cyber world and use the internet for emailing, banking, streaming video, shopping, reading news, or other activities. Given all the time people spend online, it is important that all students (regardless of their major) learn some basics about living in a cyber world, e.g., strategies for online safety, impact of artificial intelligence, digital forensics or ancestry.com. To facilitate students from many majors to learn about important issues related to the internet, eight faculty from a variety of disciplines at the University of New Haven integrated the theme of Cyber World into our team-taught, first-year …

Cybersecurity Education: The Need For A Top-Driven, Multidisciplinary, School-Wide Approach, Lucy Tsado

Journal of Cybersecurity Education, Research and Practice

The human resource skills gap in cybersecurity has created an opportunity for educational institutions interested in cybersecurity education. The current number of schools designated by the Department of Homeland Security (DHS) and National Security Agency (NSA) as Centers of Academic Excellence (CAE) to train cybersecurity experts are not sufficient to meet the shortfall in the industry. The DHS has clearly mapped out knowledge areas for cybersecurity education for both technical and non-technical disciplines; it is therefore possible for institutions not yet designated CAEs to generate cybersecurity experts, with the long-term goal of attaining the CAE designation. The purpose of this …

What To Do When Privacy Is Gone, James Brusseau

Computer Ethics - Philosophical Enquiry (CEPE) Proceedings

Today’s ethics of privacy is largely dedicated to defending personal information from big data technologies. This essay goes in the other direction. It considers the struggle to be lost, and explores two strategies for living after privacy is gone. First, total exposure embraces privacy’s decline, and then contributes to the process with transparency. All personal information is shared without reservation. The resulting ethics is explored through a big data version of Robert Nozick’s Experience Machine thought experiment. Second, transient existence responds to privacy’s loss by ceaselessly generating new personal identities, which translates into constantly producing temporarily unviolated private information. The …

Difference Between Algorithmic Processing And The Process Of Lifeworld (Lebenswelt), Domenico Schneider

Computer Ethics - Philosophical Enquiry (CEPE) Proceedings

The following article compares the temporality of the life-world with the digital processing. The temporality of the life-world is determined to be stretched and spontaneous. The temporality of the digital is given by discrete step-by-step points of time. Most ethical issues can be traced back to a mismatch of these two ways of processing. This creates a foundation for the ethics of the digital processing. Methodologically, phenomenological considerations are merged with media-philosophical considerations in the article.

Information Privacy: Not Just Gdpr, Danilo Bruschi

Computer Ethics - Philosophical Enquiry (CEPE) Proceedings

The "information rush" which is characterizing the current phase of the information age calls for actions aimed at enforcing the citizens' right to privacy. Since the entire information life-cycle (collection, manipulation, storing) is now carried out by digital technologies, most of such actions consists of the adoption of severe measures (both organizational and technological) aimed at improving the security of computer systems, as in the case of the EU General Data Protection Regulation. Usually, data processors which comply with these requirements are exempted by any other duty. Unfortunately recent trends in the computer attack field show that even the adoption …

Legal And Technical Issues For Text And Data Mining In Greece, Maria Kanellopoulou - Botti, Marinos Papadopoulos, Christos Zampakolas, Paraskevi Ganatsiou

Computer Ethics - Philosophical Enquiry (CEPE) Proceedings

Web harvesting and archiving pertains to the processes of collecting from the web and archiving of works that reside on the Web. Web harvesting and archiving is one of the most attractive applications for libraries which plan ahead for their future operation. When works retrieved from the Web are turned into archived and documented material to be found in a library, the amount of works that can be found in said library can be far greater than the number of works harvested from the Web. The proposed participation in the 2019 CEPE Conference aims at presenting certain issues related to …

The Right To Human Intervention: Law, Ethics And Artificial Intelligence, Maria Kanellopoulou - Botti, Fereniki Panagopoulou, Maria Nikita, Anastasia Michailaki

Computer Ethics - Philosophical Enquiry (CEPE) Proceedings

The paper analyses the new right of human intervention in use of information technology, automatization processes and advanced algorithms in individual decision-making activities. Art. 22 of the new General Data Protection Regulation (GDPR) provides that the data subject has the right not to be subject to a fully automated decision on matters of legal importance to her interests, hence the data subject has a right to human intervention in this kind of decisions.

Cybersecurity For Critical Infrastructure: Addressing Threats And Vulnerabilities In Canada, Samuel A. Cohen

Graduate Theses/Dissertations

The aim of this thesis is to assess the unique technical and policy-based cybersecurity challenges facing Canada’s critical infrastructure environment and to analyze how current government and industry practices are not equipped to remediate or offset associated strategic risks to the country. Further, the thesis also provides cases and evidence demonstrating that Canada’s critical infrastructure has been specifically targeted by foreign and domestic cyber threat actors to pressure the country’s economic, safety and national security interests. Essential services that Canadians and Canadian businesses rely on daily are intricately linked to the availability and integrity of vital infrastructure sectors, such as …

Forensic Analysis Of Spy Applications In Android Devices, Shinelle Hutchinson, Umit Karabiyik

Annual ADFSL Conference on Digital Forensics, Security and Law

Smartphones with Google's Android operating system are becoming more and more popular each year, and with this increased user base, comes increased opportunities to collect more of these users' private data. There have been several instances of malware being made available via the Google Play Store, which is one of the predominant means for users to download applications. One effective way of collecting users' private data is by using Android Spyware. In this paper, we conduct a forensic analysis of a malicious Android spyware application and present our findings. We also highlight what information the application accesses and what it …

“Greening” Worcester: Municipal Best Practices For Sustainability, Erin Mckeon, Charline Kirongozi, Jared Duval, Antannia Greene, Qianshu Sun, Zewei Yao

School of Professional Studies

In response to the urgent threat posed by climate change, more and more cities, including Worcester, are attempting to become more environmentally responsible and sustainable. Worcester is attempting to develop ways to become more sustainable; both to strengthen their communities and to protect the planet. The Green Worcester Working Group (GWWG) tasked the Clark Capstone Team with researching best practices for municipal sustainability. The GWWG has set the following priorities: climate change mitigation, resilience, open spaces, sustainable resource management, education and awareness. Taking these into account, the Clark Capstone Team researched the sustainability practices of cities in New England, across …

Worcester Chamber Of Commerce: Recruiting Minority Business Owners, Ryan Dimaria, Alexander Hull, Xikun Lu, Haopeng Wang, Jiacheng Hou, Danning Zhao

School of Professional Studies

Our capstone project was to help the Worcester Regional Chamber of Commerce identify how to re-frame their marketing so it would be appealing to immigrant and minority owned businesses. Based on interviews and external research, our group was able to create a tangible and resourceful data set that provided justified recommendations and ideas on how the Chamber could make adjustments to their marketing plan to attract more businesses of this particular demographic in the city of Worcester. By implementing these recommendations, we believe the Chamber has the opportunity to create a more diverse group of Chamber members, add value to …

Service Now: Cmdb Research, Monika Patel, Smita Patil, Katerina Tzanavara, Manish Chauhan, Yuhao Wang, Houmin Xie, Lei Shi

School of Professional Studies

The MAPFRE Capstone team has been tasked with reviewing and recommending roadmap on the existing CMDB configuration. Paper discusses the team’s overall research on ServiceNow CMDB, Client’s deliverables and introduction to the latest technological innovations. Based on given objectives and team’s analysis we have recommended key solutions for the client to better understand the IT environment areas of business service impact, asset management, compliance, and configuration management. In addition, our research has covered all the majority of the technical and functional areas to provide greater visibility and insight into existing CMDB and IT environment.

For One Child, Zion Bereket, Xin Huang, Yitong Lin, Ruobing Pei, Rachel White, Ziyuan Li

School of Professional Studies

The entirety of this project was completed on the foundation of the three focus areas, which were identified by our client as areas of high need. The client wanted to prioritize these three areas as they believed that these three areas were the most integral to the successful achievement of their mission, as well as to the overall health and longevity of the organization.

Hiv/Aids In The Latino Community Of San Francisco: Past And Present, Jessica Da Silva

School of Professional Studies

There are approximately 122,000 people of Latino origin in San Francisco, which account for 15% of the total population (Census, 2010). Historically, Latinos have and still face several barriers to access healthcare and improvements in health (Aguirre-Molina, Molina & Zambrana, 2001). When the world was exposed to the spread of a new and unknown virus, the broader population suffered from the epidemic. The Latino community in San Francisco was and still is one of the hardest hit by the virus.

Changing The Current Perception Of Affordable Housing In Worcester, Simone Mcguinness, William Roberts, Vaske Gjino, Tong Zhou, Mengxin Ma, Sarawadee Sonpuak

School of Professional Studies

One of Worcester Interfaith’s goals is to eradicate the stigma of affordable housing in Worcester. Currently, the perception of affordable housing is of an image of unkept and old residences filled with destitute citizens who cannot afford basic needs to live in a city, let alone housing. This image is perpetuated by media, stigma, and a lack of education of the true reality of affordable housing and who its recipients are. Affordable housing-qualified citizens represent a range of educations, professions, age, race, and income levels. Affordable housing units, too, represent a variety of homes, many of which are extremely well-kept …

Federal, State And Local Law Enforcement Agency Interoperability Capabilities And Cyber Vulnerabilities, Tyrone Trapnell

Electronic Theses and Dissertations

The National Data Exchange (N-DEx) System is the central informational hub located at the Federal Bureau of Investigation (FBI). Its purpose is to provide network subscriptions to all Federal, state and local level law enforcement agencies while increasing information collaboration across all domains. The National Data Exchange users must satisfy the Advanced Permission Requirements, confirming the terms of N-DEx information use, and the Verification Requirement (verifying the completeness, timeliness, accuracy, and relevancy of N-DEx information) through coordination with the record-owning agency (Management, 2018). A network infection model is proposed to simulate the spread impact of various cyber-attacks within Federal, state …

On Efficiency Of Artifact Lookup Strategies In Digital Forensics, Lorenz Liebler, Patrick Schmitt, Harald Baier, Frank Breitinger

Electrical & Computer Engineering and Computer Science Faculty Publications

In recent years different strategies have been proposed to handle the problem of ever-growing digital forensic databases. One concept to deal with this data overload is data reduction, which essentially means to separate the wheat from the chaff, e.g., to filter in forensically relevant data. A prominent technique in the context of data reduction are hash-based solutions. Data reduction is achieved because hash values (of possibly large data input) are much smaller than the original input. Today's approaches of storing hash-based data fragments reach from large scale multithreaded databases to simple Bloom filter representations. One main focus was put on …

A Framework To Reveal Clandestine Organ Trafficking In The Dark Web And Beyond, Michael P. Heinl, Bo Yu, Duminda Wijesekera

Journal of Digital Forensics, Security and Law

Due to the scarcity of transplantable organs, patients have to wait on long lists for many years to get a matching kidney. This scarcity has created an illicit market place for wealthy recipients to avoid long waiting times. Brokers arrange such organ transplants and collect most of the payment that is sometimes channeled to fund other illicit activities. In order to collect and disburse payments, they often resort to money laundering-like schemes of money transfers. As the low-cost Internet arrives in some of the affected countries, social media and the dark web are used to illegally trade human organs. This …

Immersive Virtual Reality Attacks And The Human Joystick, Peter Casey, Ibrahim Baggili, Ananya Yarramreddy

Electrical & Computer Engineering and Computer Science Faculty Publications

This is one of the first accounts for the security analysis of consumer immersive Virtual Reality (VR) systems. This work breaks new ground, coins new terms, and constructs proof of concept implementations of attacks related to immersive VR. Our work used the two most widely adopted immersive VR systems, the HTC Vive, and the Oculus Rift. More specifically, we were able to create attacks that can potentially disorient users, turn their Head Mounted Display (HMD) camera on without their knowledge, overlay images in their field of vision, and modify VR environmental factors that force them into hitting physical objects and …

Frameup: An Incriminatory Attack On Storj: A Peer To Peer Blockchain Enabled Distributed Storage System, Xiaolu Zhang, Justin Grannis, Ibrahim Baggili, Nicole Lang Beebe

Electrical & Computer Engineering and Computer Science Faculty Publications

In this work we present a primary account of frameup, an incriminatory attack made possible because of existing implementations in distributed peer to peer storage. The frameup attack shows that an adversary has the ability to store unencrypted data on the hard drives of people renting out their hard drive space. This is important to forensic examiners as it opens the door for possibly framing an innocent victim. Our work employs Storj as an example technology, due to its popularity and market size. Storj is a blockchain enabled system that allows people to rent out their hard drive space …

Self-Efficacy In Information Security: A Mixed Methods Study Of Deaf End-Users, Kyle Murbach

Masters Theses & Doctoral Dissertations

This explanatory sequential mixed methods study focuses on gaining an overall understanding of the potential variances in self-efficacy in information security and security practice behavior in the deaf population. Very little is understood about the deaf experience when engaging in security practices and their confidence levels in doing so. Due to the fastpaced nature of cyber security and its many facets, the human factor plays a crucial role in the success of cyber security. It is important to understand the potential implications of variances that may affect a deaf end-user’s security practice behavior to be able to provide more effective …

Awareness And Perception Of Cybercrimes And Cybercriminals, Hannarae Lee, Hyeyoung Lim

International Journal of Cybersecurity Intelligence & Cybercrime

Awareness is a starting point to recognize, understand, or know a situation or fact, and the perception makes a difference in how to deal with it. Although the term cybercrime may not be new to the most public and the police, not all of them are well aware of the nature and extent of cybercrimes, cybercriminals, and cyber-victims, which in turn affects their perceptions of matters. The four papers in this issue of the International Journal of Cybersecurity Intelligence and Cybercrime empirically examine these important topics and discuss policy implications.

Phishing And Cybercrime Risks In A University Student Community, Roderic Broadhurst, Katie Skinner, Nicholas Sifniotis, Bryan Matamoros-Macias, Yuguang Ipsen

International Journal of Cybersecurity Intelligence & Cybercrime

In an exploratory quasi-experimental observational study, 138 participants recruited during a university orientation week were exposed to social engineering directives in the form of fake email or phishing attacks over several months in 2017. These email attacks attempted to elicit personal information from participants or entice them into clicking links which may have been compromised in a real-world setting. The study aimed to determine the risks of cybercrime for students by observing their responses to social engineering and exploring attitudes to cybercrime risks before and after the phishing phase. Three types of scam emails were distributed that varied in the …

Examining Perceptions Of Online Harassment Among Constables In England And Wales, Thomas J. Holt, Jin R. Lee, Roberta Liggett, Karen M. Holt, Adam Bossler

International Journal of Cybersecurity Intelligence & Cybercrime

The ubiquity of the Internet and computer technology has enabled individuals to engage in bullying, threats, and harassing communications online. Limited research has found that local line officers may not view these offenses as serious compared to real world crimes despite their negative physical and emotional impact on victims. The perceptions of officers can produce poor interactions with victims during calls for service, particularly victim blaming, which can reduce citizens’ confidence in police agencies generally. However, local law enforcement agencies are increasingly mandated to respond to these cases, calling to question how their views may impact the community. This study …