Information Security Commons^™

Developing Network Situational Awareness Through Visualization Of Fused Intrusion Detection System Alerts, Serafin A. Avitia V

Theses and Dissertations

With networks increasing in physical size, bandwidth, traffic volume, and malicious activity, network analysts are experiencing greater difficulty in developing network situational awareness. Traditionally, network analysts have used Intrusion Detection Systems to gain awareness but this method is outdated when analysts are unable to process the alerts at the rate they are being generated. Analysts are unwittingly placing the computer assets they are charged to protect at risk when they are unable to detect these network attacks. This research effort examines the theory, application, and results of using visualizations of fused alert data to develop network situational awareness. The fused …

An Analysis Of Botnet Vulnerabilities, Sean W. Hudson

Theses and Dissertations

Botnets are a significant threat to computer networks and data stored on networked computers. The ability to inhibit communication between servers controlling the botnet and individual hosts would be an effective countermeasure. The objective of this research was to find vulnerabilities in Unreal IRCd that could be used to shut down the server. Analysis revealed that Unreal IRCd is a very mature and stable IRC server and no significant vulnerabilities were found. While this research does not eliminate the possibility that a critical vulnerability is present in the Unreal IRCd software, none were identified during this effort.

Using Hierarchical Temporal Memory For Detecting Anomalous Network Activity, Gerod M. Bonhoff

Theses and Dissertations

This thesis explores the nature of cyberspace and forms an argument for it as an intangible world. This research is motivated by the notion of creating intelligently autonomous cybercraft to reside in that environment and maintain domain superiority. Specifically, this paper offers 7 challenges associated with development of intelligent, autonomous cybercraft. The primary focus is an analysis of the claims of a machine learning language called Hierarchical Temporal Memory (HTM). In particular, HTM theory claims to facilitate intelligence in machines via accurate predictions. It further claims to be able to make accurate predictions of unusual worlds, like cyberspace. The research …

What Constitutes An Act Of War In Cyberspace, Kelli S. Kinley

Theses and Dissertations

In December 2005 a new mission statement was released by the Air Force Leadership, "to deliver sovereign options for the defense of the United States of America and its global interests...to fly and fight in Air, Space and Cyberspace." (Wynne & Mosley, 2005) With the stand up of the AFCYBER command and the use of cyberspace to carry out our daily mission the U.S. needs to have a clear understanding of what war in cyberspace looks like and what the laws are governing war in cyberspace. This research and it's resulting data analysis is intended to provide a better understanding …

Comparing Information Assurance Awareness Training For End-Users: A Content Analysis Examination Of Air Force And Defense Information Systems Agency User Training Modules, John W. Frugé

Theses and Dissertations

Today, the threats to information security and assurance are great. While there are many avenues for IT professionals to safeguard against these threats, many times these defenses prove useless against typical system users. Mandated by laws and regulations, all government agencies and most private companies have established information assurance (IA) awareness programs, most of which include user training. Much has been given in the existing literature to laying out the guidance for the roles and responsibilities of IT professionals and higher level managers, but less is specified for "everyday" users of information systems. This thesis attempts to determine the content …

A Delphi Study Assessing Long-Term Access To Electronic Medical Records (Emr), Byron D. Nicholson

Theses and Dissertations

This research effort addressed the issue of long-term access to electronic medical records as technological generations become obsolete, thereby preventing the access to patient health information. Using the Delphi methodology, experts with experience in electronic medical records and applicable systems provided insight based on their years of hands-on experience managing and/or using records and these systems. The end result of this research was a collection of ideas that medical institutions and medical informaticians must consider to ensure that patients and hospitals do not lose long-term access to electronic medical records as electronic medical records and technology continually evolves. Results of …

Suspicion Modeling In Support Of Cyber-Influence Operations/Tactics, Henry G. Paguirigan

Theses and Dissertations

Understanding the cognitive process of IT user suspicion may assist organizations in development of network protection plans, personnel training, and tools necessary to identify and mitigate nefarious intrusions of IT systems. Exploration of a conceptual common ground between psycho-social and technology-related concepts of suspicion are the heart of this investigation. The complexities involved in merging these perspectives led to the overall research question: What is the nature of user suspicion toward IT: The research problem/phenomenon was addressed via extensive literature review, and use of the Interactive Qualitative Analysis problem/phenomenon. Analysis of the system led to the development of a model …

Software Assurance Best Practices For Air Force Weapon And Information Technology Systems - Are We Bleeding?, Ryan A. Maxon

Theses and Dissertations

In the corporate world, "bits mean money," and as the Department of Defense (DoD) becomes more and more reliant on net-centric warfare, bits mean national security. Software security threats are very real, as demonstrated by the constant barrage of Internet viruses, worms, Trojans, and hackers seeking to exploit the latest vulnerability. Most organizations focus their resources on reactive defenses such as firewalls, antivirus software, and encryption, however as demonstrated by the numerous attacks that are successful, those post facto measures are not enough to stop the bleeding. The DoD defines software assurance (SwA) as the "level of confidence that software …

An Examination Into How Group Performance Is Influenced By Various Communication Channels, Jason C. Norgaard

Theses and Dissertations

This purpose of this research was to look at the how group performance is influenced by various communication channels. Specifically, this research sought to determine what communication factors are affected when groups are forced to use different communications channels. The three communications channels tested were face-to-face communications, audio conferencing, and computer-mediated communications through an Internet chat program. Each channel was measured on accuracy, efficiency, and total number of ideas generated. The research found that the groups using computer-mediated communications had a difficult time completing the exercises in the allotted time. Additionally, the computer-mediated produced significantly fewer total words and total …

Composable Distributed Access Control And Integrity Policies For Query-Based Wireless Sensor Networks, David W. Marsh

Theses and Dissertations

An expected requirement of wireless sensor networks (WSN) is the support of a vast number of users while permitting limited access privileges. While WSN nodes have severe resource constraints, WSNs will need to restrict access to data, enforcing security policies to protect data within WSNs. To date, WSN security has largely been based on encryption and authentication schemes. WSN Authorization Specification Language (WASL) is specified and implemented using tools coded in JavaTM. WASL is a mechanism{independent policy language that can specify arbitrary, composable security policies. The construction, hybridization, and composition of well{known security models is demonstrated and shown to preserve …

Establishing The Human Firewall: Reducing An Individual's Vulnerability To Social Engineering Attacks, Jamison W. Scheeres

Theses and Dissertations

Hackers frequently use social engineering attacks to gain a foothold into a target network. This type of attack is a tremendous challenge to defend against, as the weakness lies in the human users, not in the technology. Thus far, methods for dealing with this threat have included establishing better security policies and educating users on the threat that exists. Existing techniques aren’t working as evidenced by the fact that auditing agencies consider it a given that will be able to gain access via social engineering. The purpose of this research is to propose a better method of reducing an individual’s …

Digital Signal Processing Leveraged For Intrusion Detection, Theodore J. Erickson

Theses and Dissertations

This thesis describes the development and evaluation of a novel system called the Network Attack Characterization Tool (NACT). The NACT employs digital signal processing to detect network intrusions, by exploiting the Lomb-Scargle periodogram method to obtain a spectrum for sampled network traffic. The Lomb-Scargle method for generating a periodogram allows for the processing of unevenly sampled network data. This method for determining a periodogram has not yet been used for intrusion detection. The spectrum is examined to determine if features exist above a significance level chosen by the user. These features are considered an attack, triggering an alarm. Two traffic …

Dod Role For Securing United States Cyberspace, Jane J. Griffin

Theses and Dissertations

The cyber attacks on Estonia in late April and the early weeks of May 2007 significantly crippled the country, preventing it from performing banking, communications, news reporting, government transactions and command and control activities. Estonia is considered a “Wired Society”, much like the United States. Both countries rely on the cyberspace infrastructure economically and politically. Estonia sought assistance outside the country to recover from and to address the attacks. The cyber attacks on Estonia focused world-wide attention on the effects that cyberspace attacks could have on countries. If a cyber attack of national significance occurred against the United States, what …

An Analysis Of Information Asset Valuation (Iav) Quantification Methodology For Application With Cyber Information Mission Impact Assessment (Cimia), Denzil L. Hellesen

Theses and Dissertations

The purpose of this research is to develop a standardized Information Asset Valuation (IAV) methodology. The IAV methodology proposes that accurate valuation for an Information Asset (InfoA) is the convergence of information tangible, intangible, and flow attributes to form a functional entity that enhances mission capability. The IAV model attempts to quantify an InfoA to a single value through the summation of weighted criteria. Standardizing the InfoA value criteria will enable decision makers to comparatively analyze dissimilar InfoAs across the tactical, operational, and strategic domains. This research develops the IAV methodology through a review of existing military and non-military valuation …

Network Security In Two-Year Colleges, Tamya Jean Stallings

Theses and Dissertations

Network security has become a growing challenge in industry and education. With the increase of viruses, spam, hackers, and identity theft, organizations are beginning to look at areas to improve the protection of their Information Technology structure. Higher Education has the highest vulnerability to network security threats especially the two-year institutions. Two-year institutions are known for open access admission. Open labs, limited staff and resources hinder security measures for these institutions. This thesis focuses on the two-year institution delving into the Information Technology Departments and how security is handled. What challenges have these institutions faced trying to protect data and …

Collaborative, Trust-Based Security Mechanisms For A National Utility Intranet, Gregory M. Coates

Theses and Dissertations

This thesis investigates security mechanisms for utility control and protection networks using IP-based protocol interaction. It proposes flexible, cost-effective solutions in strategic locations to protect transitioning legacy and full IP-standards architectures. It also demonstrates how operational signatures can be defined to enact organizationally-unique standard operating procedures for zero failure in environments with varying levels of uncertainty and trust. The research evaluates layering encryption, authentication, traffic filtering, content checks, and event correlation mechanisms over time-critical primary and backup control/protection signaling to prevent disruption by internal and external malicious activity or errors. Finally, it shows how a regional/national implementation can protect private …

Internet Protocol Geolocation: Development Of A Delay-Based Hybrid Methodology For Locating The Geographic Location Of A Network Node, John M. Roehl

Theses and Dissertations

Internet Protocol Geolocation (IP Geolocation), the process of determining the approximate geographic location of an IP addressable node, has proven useful in a wide variety of commercial applications. Commercial applications of IP Geolocation include market research, redirection for performance enhancement, restricting content, and combating fraud. The potential for military applications include securing remote access via geographic authentication, intelligence collection, and cyber attack attribution. IP Geolocation methods can be divided into three basic categories based upon what information is used to determine the geographic location of the given IP address: 1) Information contained in databases, 2) information that is leaked during …

Geospatial Informational Security Risks And Concerns Of The U.S. Air Force Geobase Program, Scott A. Bryant

Theses and Dissertations

Technological advancements such as Geospatial Information Systems (GIS) and the Internet have made it easier and affordable to share information, which enables complex and time sensitive decisions to be made with higher confidence. Further, advancements in information technology have dramatically increased the ability to store, manage, integrate, and correlate larger amounts of data to improve operational efficiency. However, the same technologies that enable increased productivity also provide increased capabilities to those wishing to do harm. Today’s military leaders are faced with the challenge of deciding how to make geospatial information collected on military installations and organizations available to authorized communities …

Hardware Virtualization Applied To Rootkit Defense, Douglas P. Medley

Theses and Dissertations

This research effort examines the idea of applying virtualization hardware to enhance operating system security against rootkits. Rootkits are sets of tools used to hide code and/or functionality from the user and operating system. Rootkits can accomplish this feat through using access to one part of an operating system to change another part that resides at the same privilege level. Hardware assisted virtualization (HAV) provides an opportunity to defeat this tactic through the introduction of a new operating mode. Created to aid operating system virtualization, HAV provides hardware support for managing and saving multiple states of the processor. This hardware …

Implementation And Optimization Of The Advanced Encryption Standard Algorithm On An 8-Bit Field Programmable Gate Array Hardware Platform, Ryan J. Silva

Theses and Dissertations

The contribution of this research is three-fold. The first is a method of converting the area occupied by a circuit implemented on a Field Programmable Gate Array (FPGA) to an equivalent as a measure of total gate count. This allows direct comparison between two FPGA implementations independent of the manufacturer or chip family. The second contribution improves the performance of the Advanced Encryption Standard (AES) on an 8-bit computing platform. This research develops an AES design that occupies less than three quarters of the area reported by the smallest design in current literature as well as significantly increases area efficiency. …

Beyond Passswords: Usage And Policy Transformation, Alan S. Alsop

Theses and Dissertations

The purpose of this research is to determine whether the transition to a two-factor authentication system is more secure than a system that relied only on what users “know” for authentication. While we found that factors that made passwords inherently vulnerable did not transfer to the PIN portion of a two-factor authentication system, we did find significant problems relating to usability, worker productivity, and the loss and theft of smart cards. The new authentication method has disrupted our ability to stay connected to ongoing mission issues, forced some installations to cut off remote access for their users and in one …

On-Demand Key Distribution For Mobile Ad-Hoc Networks, Daniel F. Graham

Theses and Dissertations

Mobile ad-hoc networks offer dynamic portable communication with little or no infrastructure. While this has many benefits, there are additional shortcomings specific to wireless communication that must be addressed. This research proposes gossip-based on-demand key distribution as a means to provide data encryption for mobile ad-hoc networks. This technique uses message keys to avoid encrypting and decrypting a message at every node. Other optimizations used include secure channel caching and joint rekey messages. The use of gossip makes the scheme robust to node failure. Experimental results show only a 15% increase in end-to-end delay with a node failure rate of …

Recommendations For A Standardized Program Management Office (Pmo) Time Compliance Network Order (Tcno) Patching Process, Michael Czumak Iii

Theses and Dissertations

Network security is a paramount concern for organizations utilizing computer technology, and the Air Force is no exception. Network software vulnerability patching is a critical determinant of network security. The Air Force deploys these patches as Time Compliance Network Orders (TCNOs), which together with associated processes and enforced timelines ensure network compliance. While the majority of the network assets affected by this process are Air Force owned and operated, a large number are maintained by external entities known as Program Management Offices (PMOs). Although these externally controlled systems provide a service to the Air Force and reside on its network, …

A Browser-Side Solution For Detection And Prevention Of Cross-Site Request Forgery Attacks, Mary C. Henthorn

Theses and Dissertations

The security of web-based applications concerns everyone who conducts business online. Cross-site request forgeries (CSRF) subject users, as well as applications, to attack. Cloaked by the standardized request and response interchange between browsers and web-based applications, an attacker can employ the browser as an agent to slip data into the transaction. CSRF exploits ride on session authentication and authorization, stealthily bypassing the security measures intended to form bonds of trust between the user and the application. Until CSRF protection is incorporated in all web-based applications, wary users may look for client-side protection. This thesis offers an original Firefox browser extension …

Off-The-Record Secure Chat Room Via Public Im Services, Jiang Bian

Theses and Dissertations

This thesis proposes a solution into the implementation of on-line chat-room environments that ensures the privacy protection of such services and provides an off-the-record feature. Instant Messaging (IM) is becoming an integral part of social as well as business life. The main concern with IM systems is that the information being transmitted is easily accessible. Some protection could be achieved with the use of a secure tunneling (i.e. VPN etc.). Nevertheless, even the use of VPN-like technologies does not provide end-to-end secrecy. Off-the-record (OTR), designed by Borisov. N et al. is a protocol which enables IM users to have private …

Mitigating Tcp Degradation Over Intermittent Link Failures Using Intermediate Buffers, M. Brent Reynolds

Theses and Dissertations

This thesis addresses the improvement of data transmission performance in a challenged network. It is well known that the popular Transmission Control Protocol degrades in environments where one or more of the links along the route is intermittently available. To avoid this degradation, this thesis proposes placing at least one node along the path of transmission to buffer and retransmit as needed to overcome the intermittent link. In the four-node, three-link testbed under particular conditions, file transmission time was reduced 20 fold in the case of an intermittent second link when the second node strategically buffers for retransmission opportunity.

Online Survey System: A Web-Based Tool For Creating And Administering Student Evaluations Online, Fatima Marie Idowu

Theses and Dissertations

With the advancement in technology over the years, the administering of online surveys has expanded. In particular, universities are using the online medium to administer surveys to students, in order to evaluate faculty performances. The move of surveys to the online realm has meant a reduction in cost, time and efforts, of survey administrators, and the increase in use of technology within universities. With the use of online surveys the challenges of confidentiality, anonymity and response rates are as prominent as they are with paper-based surveys.

This study researched the use of online surveys in education; detailing systems currently used …

Mitigating Insider Threat Using Human Behavior Influence Models, Anthony J. Puleo

Theses and Dissertations

Insider threat is rapidly becoming the largest information security problem that organizations face. With large numbers of personnel having access to internal systems, it is becoming increasingly difficult to protect organizations from malicious insiders. The typical methods of mitigating insider threat are simply not working, primarily because this threat is a people problem, and most mitigation strategies are geared towards profiling and anomaly detection, which are problematic at best. As a result, a new type of model is proposed in this thesis, one that incorporates risk management with human behavioral science. The new risk-based model focuses on observable influences that …

Development Of A Methodology For Customizing Insider Threat Auditing On A Microsoft Windows Xp® Operating System, Terry E. Levoy

Theses and Dissertations

Most organizations are aware that threats from trusted insiders pose a great risk to their organization and are very difficult to protect against. Auditing is recognized as an effective technique to detect malicious insider activities. However, current auditing methods are typically applied with a one-size-fits-all approach and may not be an appropriate mitigation strategy, especially towards insider threats. This research develops a 4-step methodology for designing a customized auditing template for a Microsoft Windows XP operating system. Two tailoring methods are presented which evaluate both by category and by configuration. Also developed are various metrics and weighting factors as a …

Development Of A Malicious Insider Composite Vulnerability Assessment Methodology, William H. King

Theses and Dissertations

Trusted employees pose a major threat to information systems. Despite advances in prevention, detection, and response techniques, the number of malicious insider incidents and their associated costs have yet to decline. There are very few vulnerability and impact models capable of providing information owners with the ability to comprehensively assess the effectiveness an organization's malicious insider mitigation strategies. This research uses a multi-dimensional approach: content analysis, attack tree framework, and an intent driven taxonomy model are used to develop a malicious insider Decision Support System (DSS) tool. The DSS tool's utility and applicability is demonstrated using a notional example. This …