Information Security Commons^™

A Blockchain-Based Security-Oriented Framework For Cloud Federation, Ramandeep Kaur Sandhu, Kweku Muata A. Osei-Bryson

KSU Proceedings on Cybersecurity Education, Research and Practice

Cloud federations have been formed to share the services, prompt and support cooperation, as well as interoperability among their already deployed cloud systems. However, the creation and management of the cloud federations lead to various security issues such as confidentially, integrity and availability of the data. Despite the access control policies in place, an attacker may compromise the communication channel processing the access requests and the decisions between the access control systems and the members(users) and vice-versa. In cloud federation, the rating of the services offered by different cloud members becomes integral to providing the users with the best quality …

Laboratory Exercises To Accompany Industrial Control And Embedded Systems Security Curriculum Modules, Gretchen Richards

KSU Proceedings on Cybersecurity Education, Research and Practice

The daily intrusion attempts and attacks on industrial control systems (ICS) and embedded systems (ES) underscore the criticality of the protection of our Critical Infrastructures (CIs). As recent as mid-July 2018, numerous reports on the infiltration of US utility control rooms by Russian hackers have been published. These successful infiltration and possible manipulation of the utility companies could easily translate to a devastating attack on our nation’s power grid and, consequently, our economy and well-being. Indeed, the need to secure the control and embedded systems which operate our CIs has never been so pronounced. In our attempt to address this …

Teaching Cybersecurity In An Undergraduate Engineering Course, Xiuli Qu, Xiaohong Yuan

KSU Proceedings on Cybersecurity Education, Research and Practice

Organizations create a huge amount of sensitive and confidential data, which must be protected from unauthorized access or disclosure. Nowadays, most organizations store their business data in digital formats. With the increasing use of digital data, data breaches are more often and serious in recent years. Therefore, it is very important for next-generation engineers to be aware of the importance of information security, and be able to recognize vulnerabilities and threats to an information system and design user-friendly and effective security measures. To achieve it, two modules of information systems security, including lectures and in-class labs, were developed and taught …

Study Of Physical Layer Security And Teaching Methods In Wireless Communications, Zhijian Xie, Christopher Horne

KSU Proceedings on Cybersecurity Education, Research and Practice

In most wireless channels, the signals propagate in all directions. For the communication between Alice and Bob, an Eavesdropper can receive the signals from both Alice and Bob as far as the Eavesdropper is in the range determined by the transmitting power. Through phased array antenna with beam tracking circuits or cooperative iteration, the signals are confined near the straight line connecting the positions of Alice and Bob, so it will largely reduce the valid placement of an Eavesdropper. Sometimes, this reduction can be prohibitive for Eavesdropper to wiretap the channel since the reduced space can be readily protected. Two …

Car Hacking: Can It Be That Simple?, Bryson Payne

KSU Proceedings on Cybersecurity Education, Research and Practice

The Internet of Things (IoT) has expanded the reach of technology at work, at home, and even on the road. As Internet-connected and self-driving cars become more commonplace on our highways, the cybersecurity of these “data centers on wheels” is of greater concern than ever. Highly publicized hacks against production cars, and a relatively small number of crashes involving autonomous vehicles, have brought the issue of securing smart cars to the forefront as a matter of public and individual safety. This article describes the integration of a module on car hacking into a semester-long ethical hacking cybersecurity course, including full …

Towards An Empirical Assessment Of Cybersecurity Readiness And Resilience In Small Businesses, Darrell Eilts, Yair Levy

KSU Proceedings on Cybersecurity Education, Research and Practice

Many small businesses struggle to improve their cybersecurity posture despite the risk to their business. Small businesses lacking adequate protection from cyber threats, or a business continuity strategy to recover from disruptions, have a very high risk of loss due to a cyberattack. These cyberattacks, either deliberate or unintentional, can become costly when a small business is not prepared. This developmental research is focused on the relationship between two constructs that are associated with readiness and resilience of small businesses based on their cybersecurity planning, implementation, as well as response activities. A Cybersecurity Preparedness-Risk Taxonomy (CyPRisT) is proposed using the …

Evaluating Two Hands-On Tools For Teaching Local Area Network Vulnerabilities, Ariana Brown, Jinsheng Xu, Xiaohong Yuan

KSU Proceedings on Cybersecurity Education, Research and Practice

According to the Verizon’s Data Breach Investigations Report, Local Area Network (LAN) access is the top vector for insider threats and misuses. It is critical for students to learn these vulnerabilities, understand the mechanisms of exploits, and know the countermeasures. The department of Computer Science at North Carolina A&T State University designed two different educational tools that help students learn ARP Spoofing Attacks, which is the most popular attack on LAN. The first tool, called Hacker’s Graphical User Interface (HGUI), is a visualization tool that demonstrates ARP Spoofing Attack with real time animation. The second tool is a hands-on (HandsOn) …

Digital Identity, Philip Andreae

KSU Proceedings on Cybersecurity Education, Research and Practice

No abstract provided.

Why Managing 3rd Party Cybersecurity Risk Is A Matter Of National Security, Keith Deininger

KSU Proceedings on Cybersecurity Education, Research and Practice

No abstract provided.

Six Things I Wish New Employees Knew, Brian Albertson

KSU Proceedings on Cybersecurity Education, Research and Practice

No abstract provided.

Why Networks Still Matter, Tim O'Neill

KSU Proceedings on Cybersecurity Education, Research and Practice

No abstract provided.

Beyond The Classroom - What Students Need To Know, Will Alexander

KSU Proceedings on Cybersecurity Education, Research and Practice

No abstract provided.

Bipartite Quantum Interactions: Entangling And Information Processing Abilities, Siddhartha Das

LSU Doctoral Dissertations

The aim of this thesis is to advance the theory behind quantum information processing tasks, by deriving fundamental limits on bipartite quantum interactions and dynamics. A bipartite quantum interaction corresponds to an underlying Hamiltonian that governs the physical transformation of a two-body open quantum system. Under such an interaction, the physical transformation of a bipartite quantum system is considered in the presence of a bath, which may be inaccessible to an observer. The goal is to determine entangling abilities of such arbitrary bipartite quantum interactions. Doing so provides fundamental limitations on information processing tasks, including entanglement distillation and secret key …

Liboblivious: A C++ Library For Oblivious Data Structures And Algorithms, Scott D. Constable, Steve Chapin

Electrical Engineering and Computer Science - Technical Reports

Infrastructure as a service (IaaS) is an enormously beneficial model for centralized data computation and storage. Yet, existing network-layer and hardware-layer security protections do not address a broad category of vulnerabilities known as side-channel attacks. Over the past several years, numerous techniques have been proposed at all layers of the software/hardware stack to prevent the inadvertent leakage of sensitive data. This report discusses a new technique which integrates seamlessly with C++ programs. We introduce a library, libOblivious, which provides thin wrappers around existing C++ standard template library classes, endowing them with the property of memory-trace obliviousness.

Enhancement Of Media Splicing Detection: A General Framework, Songpon Teerakanok, Tetsutaro Uehara

Journal of Digital Forensics, Security and Law

Digital media (i.e., image, audio) has played an influential role in today information system. The increasing of popularity in digital media has brought forth many technological advancements. The advancements, however, also gives birth to a number of forgeries and attacks against this type of information. With the availability of easy-to-use media manipulating tools available online, the authenticity of today digital media cannot be guaranteed. In this paper, a new general framework for enhancing today media splicing detection has been proposed. By combining results from two traditional approaches, the enhanced detection results show improvement in term of clarity in which anomalies …

Fingerprinting Jpegs With Optimised Huffman Tables, Sean Mckeown, Gordon Russell, Petra Leimich

Journal of Digital Forensics, Security and Law

A common task in digital forensics investigations is to identify known contraband images. This is typically achieved by calculating a cryptographic digest, using hashing algorithms such as SHA256, for each image on a given medium, and comparing individual digests with a database of known contraband. However, the large capacities of modern storage media and time pressures placed on forensics examiners necessitates the development of more efficient processing methods. This work describes a technique for fingerprinting JPEGs with optimised Huffman tables which requires only the image header to be present on the media. Such fingerprints are shown to be robust across …

A New Framework For Securing, Extracting And Analyzing Big Forensic Data, Hitesh Sachdev, Hayden Wimmer, Lei Chen, Carl Rebman

Journal of Digital Forensics, Security and Law

Finding new methods to investigate criminal activities, behaviors, and responsibilities has always been a challenge for forensic research. Advances in big data, technology, and increased capabilities of smartphones has contributed to the demand for modern techniques of examination. Smartphones are ubiquitous, transformative, and have become a goldmine for forensics research. Given the right tools and research methods investigating agencies can help crack almost any illegal activity using smartphones. This paper focuses on conducting forensic analysis in exposing a terrorist or criminal network and introduces a new Big Forensic Data Framework model where different technologies of Hadoop and EnCase software are …

A Bit Like Cash: Understanding Cash-For-Bitcoin Transactions Through Individual Vendors, Stephanie J. Robberson, Mark R. Mccoy

Journal of Digital Forensics, Security and Law

As technology improves and economies become more globalized, the concept of currency has evolved. Bitcoin, a cryptographic digital currency, has been embraced as a secure and convenient type of money. Due to its security and privacy for the user, Bitcoin is a good tool for conducting criminal trades. The Financial Crimes Enforcement Network (FinCEN) has regulations in place to make identification information of Bitcoin purchasers accessible to law enforcement, but enforcing these rules with cash-for-Bitcoin traders is difficult. This study surveyed cash-for-Bitcoin vendors in Oklahoma, Texas, Arkansas, Missouri, Kansas, Colorado, and New Mexico to determine personal demographic information, knowledge of …

A Lightweight Cloud Sharing Phr System With Access Policy Updating, Zuobin Ying, Wenjie Jang, Shuanlong Cao, Ximeng Liu, Jie Cui

Research Collection School Of Computing and Information Systems

The rapid development of smart wearable devices makes personal health management feasible, which also stimulates the evolution of personal health records (PHRs). However, PHRs face many security challenges ever since it has been created. Besides, the complicated policy adjusting operation makes the PHRs stored in the cloud not so easy to use. In this paper, we propose a lightweight PHRs system on the basis of attribute-based encryption with policy updating. To update an outsourced ciphertext PHRs in the cloud, PHRs owners only need to generate an updating key, then upload it to the cloud server instead of retrieving the entire …

Database Security And Auditing (Ksu), Lei Li, Rebecca H. Rutherfoord, Svetana Peltsverger, Richard Halstead-Nussloch, Jack Zheng, Zhigang Li

Computer Science and Information Technology Grants Collections

This Grants Collection for Database Security and Auditing was created under a Round Eleven ALG Textbook Transformation Grant.

Affordable Learning Georgia Grants Collections are intended to provide faculty with the frameworks to quickly implement or revise the same materials as a Textbook Transformation Grants team, along with the aims and lessons learned from project teams during the implementation process.

Documents are in .pdf format, with a separate .docx (Word) version available for download. Each collection contains the following materials:

• Linked Syllabus
• Initial Proposal
• Final Report

Information Security Concepts And Administration (Ksu), Meng Han, Lei Li, Zhigang Li, Svetana Peltsverger, Ming Yang, Guangzhi Zheng

Computer Science and Information Technology Grants Collections

This Grants Collection for Information Security Concepts and Administration was created under a Round Ten ALG Textbook Transformation Grant.

Affordable Learning Georgia Grants Collections are intended to provide faculty with the frameworks to quickly implement or revise the same materials as a Textbook Transformation Grants team, along with the aims and lessons learned from project teams during the implementation process.

Documents are in .pdf format, with a separate .docx (Word) version available for download. Each collection contains the following materials:

• Linked Syllabus
• Initial Proposal
• Final Report

Initializing Trust In Smart Devices Via Presence Attestation, Xuhua Ding, Gene Tsudik

Research Collection School Of Computing and Information Systems

Many personal computing and more specialized (e.g., high-end IoT) devices are now equipped with sophisticated processors that only a few years ago were present only on high-end desktops and servers. Such processors often include an important hardware security component in the form of a DRTM (Dynamic Root of Trust for Measurement) which initiates trust and resists software (and even some physical) attacks. However, despite substantial prior research on trust establishment with secure hardware, DRTM security was always considered without any involvement of the human user, who represents a vital missing link. This prompts an important challenge: how can a user …

Implementation Of Secure Dnp3 Architecture Of Scada System For Smart Grids, Uday Bhaskar Boyanapalli

Master of Science in Computer Science Theses

With the recent advances in the power grid system connecting to the internet, data sharing, and networking enables space for hackers to maliciously attack them based on their vulnerabilities. Vital stations in the smart grid are the generation, transmission, distribution, and customer substations are connected and controlled remotely by the network. Every substation is controlled by a Supervisory Control and Data Acquisition (SCADA) system which communicates on DNP3 protocol on Internet/IP which has many security vulnerabilities. This research will focus on Distributed Network Protocol (DNP3) communication which is used in the smart grid to communicate between the controller devices. We …

Phasorsec: Protocol Security Filters For Wide Area Measurement Systems, Prashant Anantharaman, Kartik Palani, Rafael Brantley, Sergey Bratus, Sean W. Smith

Dartmouth Scholarship

The addition of synchrophasors to the power grid to improve observability comes at the cost of an increased attack surface: the wide area measurement system. A common source of zero-days, that can be used to exploit the system, is improper input validation. The strict availability and timing requirements of the grid make it critical that input validation be done right and in a timely fashion. PhasorSec is a hardened security filter for the synchrophasor communication protocol, C37.118. PhasorSec is built using language theoretic principles which treat all input as a language with a specific grammar that defines what input must …

Enabling Verifiable Multiple Keywords Search Over Encrypted Cloud Data, Yinbin Miao, Jian Weng, Ximeng Liu, Kim-Kwang Raymond Choo, Zhiquan Liu, Hongwei Li

Research Collection School Of Computing and Information Systems

Searchable Encryption (SE) enables a user to search over encrypted data, such as data stored in a remote cloud server. Existing certificate-, identity-, and attribute-based SE schemes suffer from certificate management or key escrow limitations. Furthermore, the semi-honest-but-curious cloud may conduct partial search operations and return a fraction of the search results (i.e., incomplete results) in order to reduce costs. In this paper, we present a secure cryptographic primitive, Verifiable Multiple Keywords Search (VMKS) over ciphertexts, which leverages the Identity-Based Encryption (IBE) and certificateless signature techniques. The VMKS scheme allows the user to verify the correctness of …

Function Risk Assessment Under Memory Leakage, Jianming Fu, Rui Jin, Yan Lin, Baihe Jiang, Zhengwei Guo

Research Collection School Of Computing and Information Systems

Code reuse attack (CRA), specifically reusing and then reconstructing the codes (gadgets) already existed in programs and libraries, is widely exploited in software attacks. Admittedly, determination of the location of the gadgets consisted of target instructions along with control flow transfer instructions, is of critical importance. Address Space Randomization (ASR), which serves as an effective technique to mitigate CRA, increases the entropy by randomizing the location of the code or data, and baffles adversaries from figuring out the memory layout. Currently, variable randomization methods of high granularity are proposed by scholars to prevent adversaries from deducting memory layout. However, their …

Hawkeye: Towards A Desired Directed Grey-Box Fuzzer, Hongxu Chen, Yinxing Xue, Yuekang Li, Bihuan Chen, Xiaofei Xie, Xiuheng Wu, Yang Liu

Research Collection School Of Computing and Information Systems

Grey-box fuzzing is a practically effective approach to test real-world programs. However, most existing grey-box fuzzers lack directedness, i.e. the capability of executing towards user-specified target sites in the program. To emphasize existing challenges in directed fuzzing, we propose Hawkeye to feature four desired properties of directed grey-box fuzzers. Owing to a novel static analysis on the program under test and the target sites, Hawkeye precisely collects the information such as the call graph, function and basic block level distances to the targets. During fuzzing, Hawkeye evaluates exercised seeds based on both static information and the execution traces to generate …

Back Matter

Journal of Digital Forensics, Security and Law

No abstract provided.

Sharia Law And Digital Forensics In Saudi Arabia, Fahad Alanazi, Andrew Jones, Catherine Menon

Journal of Digital Forensics, Security and Law

These days, digital crime is one of the main challenges for law enforcement and the judicial system. Many of the laws which are used to protect the users of current technologies were derived from legislation and laws that are utilized in the control of crimes that are based in the physical realm. This applies not only in Western countries, but in countries that adopt Sharia law. There is a need to establish specific legislation and accepted best practice to deal with digital crimes that is compatible with Sharia law, which affects more than one billion Muslims. This paper presents a …

Ontologies And The Semantic Web For Digital Investigation Tool Selection, Hayden Wimmer, Lei Chen, Thomas Narock

Journal of Digital Forensics, Security and Law

The nascent field of digital forensics is heavily influenced by practice. Much digital forensics research involves the use, evaluation, and categorization of the multitude of tools available to researchers and practitioners. As technology evolves at an increasingly rapid pace, the digital forensics field must constantly adapt by creating and evaluating new tools and techniques to perform forensic analysis on many disparate systems such as desktops, notebook computers, mobile devices, cloud, and personal wearable sensor devices, among many others. While researchers have attempted to use ontologies to classify the digital forensics domain on various dimensions, no ontology of digital forensic tools …