Information Security Commons^™

Doc Wayne Youth Services, Inc. Capstone Project Youth Employment And Mentoring, Bongani T. Jeranyama, Zhengjun Liu, Sarah Parsons

School of Professional Studies

In Boston, Massachusetts, young adults age 16-19 who have dropped out of high school have a very high unemployment rate of 43.8%. Additionally, in the United States of America the difference between a young adult with a high school diploma as opposed to a young adult without a high school diploma in terms of weekly income is $180 USD; between a young adult with a high school diploma versus a young professional with a bachelor’s degree is $433 USD. These numbers demonstrate the need for services that improve academic achievement, job readiness and preparedness, and youth mentorship for struggling young …

A Nonprofit Model In A For-Profit World: A Closer Look At Sheltered Workshops And Sustainability As An Employee Run Business, Bing Jang, Mitchell Perry, Nikolin Vangjeli, Laura Ducharme

School of Professional Studies

Historically, society has tended to isolate and segregate individuals with intellectual and developmental disabilities. Despite improvements such forms of discrimination continue to be a serious social problem. On October 11, 2011, the Department of Justice began an investigation into several state’s systems of providing vocational services to individuals with intellectual and developmental disabilities. This action came about due to several states being out of compliance around Title II of the Americans with Disabilities Act (ADA). Title II of the ADA prohibits discrimination on the basis of disability for all services, programs and activities provided to the public by state and …

A Framework To Manage Sensitive Information During Its Migration Between Software Platforms, Olusegun Ademolu Ajigini, John Andrew Van Der Poll, Jan H. Kroeze Phd

The African Journal of Information Systems

Software migrations are mostly performed by organisations using migration teams. Such migration teams need to be aware of how sensitive information ought to be handled and protected during the implementation of the migration projects. There is a need to ensure that sensitive information is identified, classified and protected during the migration process.

This paper suggests how sensitive information in organisations can be handled and protected during migrations, by using the migration from proprietary software to open source software to develop a management framework that can be used to manage such a migration process. The research employed a sequential explanatory mixed …

Evaluating The Gasday Security Policy Through Penetration Testing And Application Of The Nist Cybersecurity Framework, Andrew Nicholas Kirkham

Master's Theses (2009 -)

This thesis explores cybersecurity from the perspective of the Marquette University GasDay lab. We analyze three different areas of cybersecurity in three independent chapters. Our goal is to improve the cybersecurity capabilities of GasDay, Marquette University, and the natural gas industry. We present network penetration testing as a process of attempting to gain access to resources of GasDay without prior knowledge of any valid credentials. We discuss our method of identifying potential targets using industry standard reconnaissance methods. We outline the process of attempting to gain access to these targets using automated tools and manual exploit creation. We propose several …

Biometrics-Based Dynamic Authentication For Secure Services, Saif Mohammed Saeed Abdulla Al Aryani

Theses

This thesis proposes a secure authentication protocol against physical session hijacking attacks. In client/server technology, users establish sessions to access the services offered by the servers. However, using physical session hijacking attacks, malicious users may physically take control of ongoing sessions. Malicious users also can establish sessions with servers using stolen passwords. In both cases, the server will be communicating with the wrong user who pretends to be the real user. The goal of this authentication protocol is to continuously and dynamically ensure that during an ongoing session the current session’s user is himself the real person that is known …

Securing The Integrity Of The Power Distribution System For Smart Grid Applications, Hosam Yousef Hittini

Theses

The distribution system is one of the main components in a smart grid, readings are transferred from the distribution substations to the control center. Compromising transferred system data will result in drawing wrong conclusions about current operation status at the control center. Which leads to sending wrong operational commands that may result in very serious consequences.

Firstly, we propose a scalable communications architecture for future smart grid distribution systems (i.e. Security Aware Distribution System Architecture - SADSA). The architecture is adaptable to use Wi-Fi or other technologies to transfer smart grid information. The architecture is studied from various angles. Both …

Dual-Server Public-Key Encryption With Keyword Search For Secure Cloud Storage, Rongmao Chen, Yi Mu, Guomin Yang, Fuchun Guo, Xiaofen Wang

Research Collection School Of Computing and Information Systems

Searchable encryption is of increasing interest for protecting the data privacy in secure searchable cloud storage. In this paper, we investigate the security of a well-known cryptographic primitive, namely, public key encryption with keyword search (PEKS) which is very useful in many applications of cloud storage. Unfortunately, it has been shown that the traditional PEKS framework suffers from an inherent insecurity called inside keyword guessing attack (KGA) launched by the malicious server. To address this security vulnerability, we propose a new PEKS framework named dual-server PEKS (DS-PEKS). As another main contribution, we define a new variant of the smooth projective …

Anonymous Proxy Signature With Hierarchical Traceability, Jiannan Wei, Guomin Yang, Yi Mu, Kaitai Liang

Research Collection School Of Computing and Information Systems

Anonymous proxy signatures are very useful in the construction of anonymous credential systems such as anonymous voting and anonymous authentication protocols. As a basic requirement, we should ensure an honest proxy signer is anonymous. However, in order to prevent the proxy signer from abusing the signing right, we should also allow dishonest signers to be traced. In this paper, we present three novel anonymous proxy signature schemes with different levels of (namely, public, internal and original signer) traceability. We define the formal definitions and security models for these three different settings, and prove the security of our proposed schemes under …

Masthead

Journal of Digital Forensics, Security and Law

No abstract provided.

Front Matter

Journal of Digital Forensics, Security and Law

No abstract provided.

Back Matter

Journal of Digital Forensics, Security and Law

No abstract provided.

Whitelisting System State In Windows Forensic Memory Visualizations, Joshua A. Lapso

Theses and Dissertations

Examiners in the field of digital forensics regularly encounter enormous amounts of data and must identify the few artifacts of evidentiary value. The most pressing challenge these examiners face is manual reconstruction of complex datasets with both hierarchical and associative relationships. The complexity of this data requires significant knowledge, training, and experience to correctly and efficiently examine. Current methods provide primarily text-based representations or low-level visualizations, but levee the task of maintaining global context of system state on the examiner. This research presents a visualization tool that improves analysis methods through simultaneous representation of the hierarchical and associative relationships and …

Cyberspace And Organizational Structure: An Analysis Of The Critical Infrastructure Environment, Michael D. Quigg Ii

Theses and Dissertations

Now more than ever, organizations are being created to protect the cyberspace environment. The capability of cyber organizations tasked to defend critical infrastructure has been called into question by numerous cybersecurity experts. Organizational theory states that organizations should be constructed to fit their operating environment properly. Little research in this area links existing organizational theory to cyber organizational structure. Because of the cyberspace connection to critical infrastructure assets, the factors that influence the structure of cyber organizations designed to protect these assets warrant analysis to identify opportunities for improvement.

This thesis analyzes the cyber‐connected critical infrastructure environment using the dominant …

A Framework For Incorporating Insurance Into Critical Infrastructure Cyber Risk Strategies, Derek R. Young

Theses and Dissertations

Critical infrastructure owners and operators want to minimize their cyber risk and expenditures on cybersecurity. The insurance industry has been quantitatively assessing risk for hundreds of years in order to minimize risk and maximize profits. To achieve these goals, insurers continuously gather statistical data to improve their predictions, incentivize their clients' investment in self-protection and periodically refine their models to improve the accuracy of risk estimates. This paper presents a framework which incorporates the operating principles of the insurance industry in order to provide quantitative estimates of cyber risk. The framework implements optimization techniques to suggest levels of investment for …

Statistic Whitelisting For Enterprise Network Incident Response, Nathan E. Grunzweig

Theses and Dissertations

This research seeks to satisfy the need for the rapid evaluation of enterprise network hosts in order to identify items of significance through the introduction of a statistic whitelist based on the behavior of the processes on each host. By taking advantage of the repetition of processes and the resources they access, a whitelist can be generated using large quantities of host machines. For each process, the Modules and the TCP & UDP Connections are compared to identify which resources are most commonly accessed by each process. Results show 47% of processes receiving a whitelist score of 75% or greater …

Ultrasonic Data Steganography, Alexander Orosz Edwards

KSU Journey Honors College Capstones and Theses

What started off as a question on the possibly of data transmission via sound above the level of human hearing evolved into a project exploring the possibility of ultrasonic data infiltration and exfiltration in an information security context. It is well known that sound can be used to transmit data as this can be seen in many old technologies, most notably and simply DTMF tones for phone networks. But what if the sound used to transmit signals was in in the ultrasonic range? It would go generally unnoticed to anyone not looking for it with tools such as a spectrum …

Ultrasonic Data Transmission And Steganography, Hunter Young

KSU Journey Honors College Capstones and Theses

This project discusses the feasibility of using ultrasound to transmit data between computer systems, particularly computer systems that have been intentionally cut off from traditional networks for increased security. The goal of this project is to provide a synthesis of the current research that has been done into the use of ultrasonic data transmission, and to conduct a series of tests determining the validity of certain claims made in regards to ultrasonic data transmission within the information security community. All research, experiments, results, and inferences have been discussed in the context of how they relate to the realm of information …

An Overview Of Cryptography (Updated Version, 3 March 2016), Gary C. Kessler

Publications

There are many aspects to security and many applications, ranging from secure commerce and payments to private communications and protecting passwords. One essential aspect for secure communications is that of cryptography...While cryptography is necessary for secure communications, it is not by itself sufficient. This paper describes the first of many steps necessary for better security in any number of situations.

A much shorter, edited version of this paper appears in the 1999 edition of Handbook on Local Area Networks published by Auerbach in September 1998.

A Cyber Forensics Needs Analysis Survey: Revisiting The Domain's Needs A Decade Later, Vikram S. Harichandran, Frank Breitinger, Ibrahim Baggili, Andrew Marrington

Electrical & Computer Engineering and Computer Science Faculty Publications

The number of successful cyber attacks continues to increase, threatening financial and personal security worldwide. Cyber/digital forensics is undergoing a paradigm shift in which evidence is frequently massive in size, demands live acquisition, and may be insufficient to convict a criminal residing in another legal jurisdiction. This paper presents the findings of the first broad needs analysis survey in cyber forensics in nearly a decade, aimed at obtaining an updated consensus of professional attitudes in order to optimize resource allocation and to prioritize problems and possible solutions more efficiently. Results from the 99 respondents gave compelling testimony that the following …

Strongly Leakage-Resilient Authenticated Key Exchange, Rongmao Chen, Yi Mu, Guomin Yang, Willy Susilo, Fuchun Guo

Research Collection School Of Computing and Information Systems

Authenticated Key Exchange (AKE) protocols have been widely deployed in many real-world applications for securing communication channels. In this paper, we make the following contributions. First, we revisit the security modelling of leakage-resilient AKE protocols, and show that the existing models either impose some unnatural restrictions or do not sufficiently capture leakage attacks in reality. We then introduce a new strong yet meaningful security model, named challenge-dependent leakage-resilient eCK (CLR- eCKCLR- eCK) model, to capture challenge-dependent leakage attacks on both long-term secret key and ephemeral secret key (i.e., randomness). Second, we propose a general framework for constructing one-round CLR- eCKCLR- …

A Method And A Case Study For The Selection Of The Best Available Tool For Mobile Device Forensics Using Decision Analysis, Shahzad Saleem, Oliver Popov, Ibrahim Baggili

Electrical & Computer Engineering and Computer Science Faculty Publications

The omnipresence of mobile devices (or small scale digital devices - SSDD) and more importantly the utility of their associated applications for our daily activities, which range from financial transactions to learning, and from entertainment to distributed social presence, create an abundance of digital evidence for each individual. Some of the evidence may be a result of illegal activities that need to be identified, understood and eventually prevented in the future. There are numerous tools for acquiring and analyzing digital evidence extracted from mobile devices. The diversity of SSDDs, types of evidence generated and the number of tools used to …

Cca-Secure Keyed-Fully Homomorphic Encryption, Junzuo Lai, Deng, Robert H., Changshe Ma, Kouichi Sakurai, Jian Weng

Research Collection School Of Computing and Information Systems

To simultaneously achieve CCA security and homomorphic property for encryption, Emura et al. introduced a new cryptographic primitive named keyed-homomorphic encryption, in which homomorphic ciphertext manipulations can only be performed by someone holding a devoted evaluation key which, by itself, does not enable decryption. A keyed-homomorphic encryption scheme should provide CCA2 security when the evaluation key is unavailable to the adversary and remain CCA1-secure when the evaluation key is exposed. While existing keyed-homomorphic encryption schemes only allow simple computations on encrypted data, our goal is to construct CCA-secure keyed-fully homomorphic encryption (keyed-FHE) capable of evaluating any functions on encrypted data …

The Implications Of Rfid Technology In University Id Cards, Michael Beaver

Missouri S&T’s Peer to Peer

Radio frequency identification (RFID) chips have been rising in popularity because of their usefulness and convenience, and have now made their way into the ID cards of universities. An RFID chip is an identification device that, when powered by some nearby source, sends out a signal with information that was stored in the chip. RFID physical security systems work just like a lock and key, with the RFID chip acting as the key. Instead of having a unique pattern, RFID chips have an identification code that is read by the lock. Some RFID chips also hide this code behind a …

One Size Does Not Fit All: A Game-Theoretic Approach For Dynamically And Effectively Screening For Threats, Matthew Brown, Arunesh Sinha, Aaron Schlenker, Milind Tambe

Research Collection School Of Computing and Information Systems

An effective way of preventing attacks in secure areas is to screen for threats (people, objects) before entry, e.g., screening of airport passengers. However, screening every entity at the same level may be both ineffective and undesirable. The challenge then is to find a dynamic approach for randomized screening, allowing for more effective use of limited screening resources, leading to improved security. We address this challenge with the following contributions: (1) a threat screening game (TSG) model for general screening domains; (2) an NP-hardness proof for computing the optimal strategy of TSGs; (3) a scheme for decomposing TSGs into subgames …

Improving Forensic Software Tool Performance In Detecting Fraud For Financial Statements, Brian Cusack, Tau’Aho Ahokov

Australian Digital Forensics Conference

The use of computer forensics is important for forensic accounting practice because most accounting information is in digital forms today. The access to evidence is increasingly more complex and in far greater volumes than in previous decades. The effective and efficient means of detecting fraud are required for the public to maintain their confidence in the reliability of accounting audit and the reputation of accounting firms. The software tools used by forensic accounting can be called into question. Many appear inadequate when faced with the complexity of fraud and there needs to be the development of automated and specialist problem-solving …

Establishing Effective And Economical Traffic Surveillance In Tonga, Brian Cusack, George Maeakafa

Australian Digital Forensics Conference

The Pacific Islands are seriously challenged by the growth in wealth and the expansion of international material possessions. On the roads traffic has grown dramatically and the types of vehicles now using Island roads has greatly changed. With the importation of cheap second hand vehicles designed for freeway speeds serious safety issues have grown proportionally with the increasing numbers. In this research we consider the prohibitive costs of traditional traffic controls to economy and propose a light weight highly mobile aerial surveillance system that integrates with ground policing capability. Our research question was: How can road safety and security be …

A Privacy Gap Around The Internet Of Things For Open-Source Projects, Brian Cusack, Reza Khaleghparast

Australian Information Security Management Conference

The Internet of Things (IoT) is having a more important role in the everyday lives of people. The distribution of connectivity across social and personal interaction discloses personalised information and gives access to a sphere of sensitivities that were previously masked. Privacy measures and security to protect personal sensitivities are weak and in their infancy. In this paper we review the issue of privacy in the context of IoT open-source projects, and the IoT security concerns. A proposal is made to create a privacy bubble around the interoperability of devices and systems and a filter layer to mitigate the exploitation …

Leveraging Client Processing For Location Privacy In Mobile Local Search, Wisam Mohamed Eltarjaman

Electronic Theses and Dissertations

Usage of mobile services is growing rapidly. Most Internet-based services targeted for PC based browsers now have mobile counterparts. These mobile counterparts often are enhanced when they use user's location as one of the inputs. Even some PC-based services such as point of interest Search, Mapping, Airline tickets, and software download mirrors now use user's location in order to enhance their services. Location-based services are exactly these, that take the user's location as an input and enhance the experience based on that. With increased use of these services comes the increased risk to location privacy. The location is considered an …

Best Practices To Increase Efficacy Of Graduate School Admissions Communications At Clark University, Diana Curran, Nikki Feinberg, Mitchell Kelley, Ruiqi Li, Anning Zhou

School of Professional Studies

Within the period of time that a graduate student deposits and subsequently arrives at their academic institution, receiving timely information is important for their preparation. This process has been deemed by the Deans of the Enterprise Schools at Clark University as one that needs further investigation. As such, this Capstone looks at the array of communication that goes out to each graduate student during this four-month period. The purpose of examining this communication is to analyze its effectiveness in engaging students. To analyze the effectiveness of this communication, surveys were distributed to current students in these schools to gather data …

Google Earth Forensics On Ios 10’S Location Service, Brian Cusack, Raymond Lutui

Australian Digital Forensics Conference

The easy access and common usage of GNSS systems has provided a wealth of evidential information that may be accessed by a digital forensic investigator. Google Earth is commonly used on all manner of devices for geolocation services and consequently has a wide range of tools that will relate real time and stored GNSS data to maps. As an aid to investigation Google Earth forensics is available for use. An investigator can use it by downloading geolocation data from devices and placing it on Google Earth maps, place geolocation data on historical archival maps, or by direct usage of the …