Information Security Commons^™

Title Ix: Perceptions And Utilization On U.S. College Campuses, Emma Narkewicz

School of Professional Studies

The research study investigated student perceptions and utilization of Title IX services on U.S. university and college campuses, testing the hypothesis that if students hold negative perceptions of Title IX offices, then they will not report campus sexual violence they experience to Title IX offices. There are currently high rates of sexual violence on college campuses but very low rates of reporting. Current or former U.S. college students aged 18-30 (N = 47) completed a mixed methods anonymous survey composed of Likert scale and open response questions. Participants were asked about prior interactions with Title IX offices and their perceptions …

Broadband In Rhode Island, Deborah Ruggiero

School of Professional Studies

Broadband is the 21st century fiber-optic highway in our technology and information economy. The need for high-speed fiber-optic connectivity is critical for economic development, education, business, e-learning, and telehealth

Happening In Plain Sight: An Evaluation Of Sexual Harassment In Municipal Government Through A Case Study Of Newark, New Jersey, Hoween R. A. Flexer, Caitlin R. Louie

School of Professional Studies

In the city of Newark, New Jersey, Sebrevious Scott, a participant in the New Jersey Reentry program was hired as part-time office assistant in the city's re-entry office. After being transferred to the city’s Parks and Grounds Departments, she started being sexually harassed, inappropriately touched and propositioned by her supervisor, Richard Kirkland. Scott made repeated attempts to report these actions through the appropriate channels. She was met with dismissal, resistance, and later retaliation. While working in this hostile environment she was also pursuing a full-time employment opportunity with the city upon the completion of the reentry program. Unfortunately, this never …

Employee Retention Rate, Lila Sorenson

School of Professional Studies

This paper addresses the following problem regarding low employee retention rates in non-profit mental health organizations, specifically at NFI. The problem at hand is that majority of staff at NFI have an average length of stay of one year or less. The purpose of this paper is to address the current problem and hypothesize factors that could impact the low retention rates. Additionally, the purpose of the paper is to brainstorm potential solutions regarding the low retention rates and suggestions of how to implement the solutions. The documents contained in this paper include data analysis of employee average length of …

Analysis Of Theoretical And Applied Machine Learning Models For Network Intrusion Detection, Jonah Baron

Masters Theses & Doctoral Dissertations

Network Intrusion Detection System (IDS) devices play a crucial role in the realm of network security. These systems generate alerts for security analysts by performing signature-based and anomaly-based detection on malicious network traffic. However, there are several challenges when configuring and fine-tuning these IDS devices for high accuracy and precision. Machine learning utilizes a variety of algorithms and unique dataset input to generate models for effective classification. These machine learning techniques can be applied to IDS devices to classify and filter anomalous network traffic. This combination of machine learning and network security provides improved automated network defense by developing highly-optimized …

How The Growth Of Technology Has Forced Accounting Firms To Put An Emphasis On Cybersecurity, Holden Halbach

Accounting Undergraduate Honors Theses

The advancement of technology has brought many changes to accounting firms. Computer applications such as Microsoft Excel have made calculators and physical spreadsheets obsolete. Then with the introduction of cloud computing employees can store, access, and exchange large amounts of data instantaneously from any location. These technological innovations have increased the accuracy and efficiency of firms substantially. However, this growth in technology has shown the importance of putting an emphasis on cybersecurity throughout the accounting industry. The emphasis placed on cybersecurity throughout accounting firms is more prevalent than any other industry. This is primarily because accounting firms not only deal …

Security Fatigue And Its Effects On Perceived Password Strength Among University Students, Chase Carroll

Honors Theses

This study was performed with the goal of observing the effect, if any, that security fatigue has on students’ perceived strength of passwords. In doing so, it was hoped to find some correlation between the two that would help in establishing a measurable effect of the phenomenon in students. This could potentially aid organizational decision-makers, such as security policy writers and system admins, to make more informed decisions about implementing security measures. To achieve the goal of observing this fatigue and attempting to measure it, a survey was distributed to numerous students on the University of Tennessee at Chattanooga campus. …

Brave New World Reboot: Technology’S Role In Consumer Manipulation And Implications For Privacy And Transparency, Allie Mertensotto

Marketing Undergraduate Honors Theses

Most consumers are aware that our data is being obtained and collected through the use of our devices we keep in our homes or even on our person throughout the day. But, it is understated how much data is being collected. Conversations you have with your peers – in a close proximity of a device – are being used to tailor advertising. The advertisements you receive on your devices are uniquely catered to your individual person, due to the fact it consistently uses our data to produce efficient and personal ads. On the flip side, our government is also tapping …

Cross Domain Iw Threats To Sof Maritime Missions: Implications For U.S. Sof, Gary C. Kessler, Diane M. Zorri

Publications

As cyber vulnerabilities proliferate with the expansion of connected devices, wherein security is often forsaken for ease of use, Special Operations Forces (SOF) cannot escape the obvious, massive risk that they are assuming by incorporating emerging technologies into their toolkits. This is especially true in the maritime sector where SOF operates nearshore in littoral zones. As SOF—in support to the U.S. Navy— increasingly operate in these contested maritime environments, they will gradually encounter more hostile actors looking to exploit digital vulnerabilities. As such, this monograph comes at a perfect time as the world becomes more interconnected but also more vulnerable.

A Framework To Detect The Susceptibility Of Employees To Social Engineering Attacks, Hashim H. Alneami

Doctoral Dissertations and Master's Theses

Social engineering attacks (SE-attacks) in enterprises are hastily growing and are becoming increasingly sophisticated. Generally, SE-attacks involve the psychological manipulation of employees into revealing confidential and valuable company data to cybercriminals. The ramifications could bring devastating financial and irreparable reputation loss to the companies. Because SE-attacks involve a human element, preventing these attacks can be tricky and challenging and has become a topic of interest for many researchers and security experts. While methods exist for detecting SE-attacks, our literature review of existing methods identified many crucial factors such as the national cultural, organizational, and personality traits of employees that enable …

Achieving Differential Privacy And Fairness In Machine Learning, Depeng Xu

Graduate Theses and Dissertations

Machine learning algorithms are used to make decisions in various applications, such as recruiting, lending and policing. These algorithms rely on large amounts of sensitive individual information to work properly. Hence, there are sociological concerns about machine learning algorithms on matters like privacy and fairness. Currently, many studies only focus on protecting individual privacy or ensuring fairness of algorithms separately without taking consideration of their connection. However, there are new challenges arising in privacy preserving and fairness-aware machine learning. On one hand, there is fairness within the private model, i.e., how to meet both privacy and fairness requirements simultaneously in …

Network-Based Detection And Prevention System Against Dns-Based Attacks, Yasir Faraj Mohammed

Graduate Theses and Dissertations

Individuals and organizations rely on the Internet as an essential environment for personal or business transactions. However, individuals and organizations have been primary targets for attacks that steal sensitive data. Adversaries can use different approaches to hide their activities inside the compromised network and communicate covertly between the malicious servers and the victims. The domain name system (DNS) protocol is one of these approaches that adversaries use to transfer stolen data outside the organization's network using various forms of DNS tunneling attacks. The main reason for targeting the DNS protocol is because DNS is available in almost every network, ignored, …

On Decentralization Of Bitcoin: An Asset Perspective, Ling Cheng, Feida Zhu, Huiwen Liu, Chunyan Miao

Research Collection School Of Computing and Information Systems

Since its advent in 2009, Bitcoin, a cryptography-enabled peer-to-peer digital payment system, has been gaining increasing attention from both academia and industry. An effort designed to overcome a cluster of bottlenecks inherent in existing centralized financial systems, Bitcoin has always been championed by the crypto community as an example of the spirit of decentralization. While the decentralized nature of Bitcoin's Proof-of-Work consensus algorithm has often been discussed in great detail, no systematic study has so far been conducted to quantitatively measure the degree of decentralization of Bitcoin from an asset perspective -- How decentralized is Bitcoin as a financial asset? …

Leveraging Multiple Relations For Fashion Trend Forecasting Based On Social Media, Yujuan Ding, Yunshan Ma, Lizi Liao, Wai Keung Wong, Tat-Seng Chua

Research Collection School Of Computing and Information Systems

—Fashion trend forecasting is of great research significance in providing useful suggestions for both fashion companies and fashion lovers. Although various studies have been devoted to tackling this challenging task, they only studied limited fashion elements with highly seasonal or simple patterns, which could hardly reveal the real complex fashion trends. Moreover, the mainstream solutions for this task are still statistical-based and solely focus on time-series data modeling, which limit the forecast accuracy. Towards insightful fashion trend forecasting, previous work [1] proposed to analyze more fine-grained fashion elements which can informatively reveal fashion trends. Specifically, it focused on detailed fashion …

A Novel Dynamic Analysis Infrastructure To Instrument Untrusted Execution Flow Across User-Kernel Spaces, Jiaqi Hong, Xuhua Ding

Research Collection School Of Computing and Information Systems

Code instrumentation and hardware based event trapping are two primary approaches used in dynamic malware analysis systems. In this paper, we propose a new approach called Execution Flow Instrumentation (EFI) where the analyzer execution flow is interleaved with the target flow in user- and kernel-mode, at junctures flexibly chosen by the analyzer at runtime. We also propose OASIS as the system infrastructure to realize EFI with virtues of the current two approaches, however without their drawbacks. Despite being securely and transparently isolated from the target, the analyzer introspects and controls it in the same native way as instrumentation code. We …

Securing Fog Federation From Behavior Of Rogue Nodes, Mohammed Saleh H. Alshehri

Graduate Theses and Dissertations

As the technological revolution advanced information security evolved with an increased need for confidential data protection on the internet. Individuals and organizations typically prefer outsourcing their confidential data to the cloud for processing and storage. As promising as the cloud computing paradigm is, it creates challenges; everything from data security to time latency issues with data computation and delivery to end-users. In response to these challenges CISCO introduced the fog computing paradigm in 2012. The intent was to overcome issues such as time latency and communication overhead and to bring computing and storage resources close to the ground and the …

Characteristic Reassignment For Hardware Trojan Detection, Noah Waller

Graduate Theses and Dissertations

With the current business model and increasing complexity of hardware designs, third-party Intellectual Properties (IPs) are prevalently incorporated into first-party designs. However, the use of third-party IPs increases security concerns related to hardware Trojans inserted by attackers. A core threat posed by Hardware Trojans is the difficulty in detecting such malicious insertions/alternations in order to prevent the damage. This thesis work provides major improvements on a soft IP analysis methodology and tool known as the Structural Checking tool, which analyzes Register-Transfer Level (RTL) soft IPs for determining their functionalities and screening for hardware Trojans. This is done by breaking down …

Fine-Grained And Controllably Redactable Blockchain With Harmful Data Forced Removal, Huiying Hou, Shidi Hao, Jiaming Yuan, Shengmin Xu, Yunlei Zhao

Research Collection School Of Computing and Information Systems

Notoriously, immutability is one of the most striking properties of blockchains. As the data contained in blockchains may be compelled to redact for personal and legal reasons, immutability needs to be skillfully broken. In most existing redactable blockchains, fine-grained redaction and effective deletion of harmful data are mutually exclusive. To close the gap, we propose a fine-grained and controllably redactable blockchain with harmful data forced removal. In the scheme, the originator of the transaction has fine-grained control over who can perform the redaction and which portions of the transaction can be redacted. The redaction transaction is performed after collecting enough …

When Function Signature Recovery Meets Compiler Optimization, Yan Lin, Debin Gao

Research Collection School Of Computing and Information Systems

Matching indirect function callees and callers using function signatures recovered from binary executables (number of arguments and argument types) has been proposed to construct a more fine-grained control-flow graph (CFG) to help control-flow integrity (CFI) enforcement. However, various compiler optimizations may violate calling conventions and result in unmatched function signatures. In this paper, we present eight scenarios in which compiler optimizations impact function signature recovery, and report experimental results with 1,344 real-world applications of various optimization levels. Most interestingly, our experiments show that compiler optimizations have both positive and negative impacts on function signature recovery, e.g., its elimination of redundant …

On The Root Of Trust Identification Problem, Ivan De Oliveira Nunes, Xuhua Ding, Gene Tsudik

Research Collection School Of Computing and Information Systems

Trusted Execution Environments (TEEs) are becoming ubiquitous and are currently used in many security applications: from personal IoT gadgets to banking and databases. Prominent examples of such architectures are Intel SGX, ARM TrustZone, and Trusted Platform Modules (TPMs). A typical TEE relies on a dynamic Root of Trust (RoT) to provide security services such as code/data confidentiality and integrity, isolated secure software execution, remote attestation, and sensor auditing. Despite their usefulness, there is currently no secure means to determine whether a given security service or task is being performed by the particular RoT within a specific physical device. We refer …

Efficient And Verifiable Proof Of Replication With Fast Fault Localization, Haoran Yuan, Xiaofeng Chen, Guowen Xu, Jianting Ning, Joseph K. Liu, Robert H. Deng

Research Collection School Of Computing and Information Systems

Proof of replication technique has been widely used to verify whether the cloud service providers (CSPs) store multiple replications of a file with dedicated and unique storage space, which effectively prevents CSPs from colluding and storing only one copy of the file. In this field, many representative schemes have been proposed and applied to various scenarios. However, most of the existing schemes are based on the timing assumption (i.e., the verifier rejects the proof of replication if the prover's response is timeout) and do not explicitly consider the problem of batch verification and fault localization. This will bring unnecessary computational …

Privacy Is Infringed In Plain Sight And How To Dissapear, Zachary Taylor

Electronic Theses, Projects, and Dissertations

This culminating project explored how Amazon, Apple, Facebook, Google, and Microsoft infringe on their user's information privacy. Focus was on tools and techniques one can use to strengthen their information privacy. Privacy or information privacy was defined as the right to have some control over how your personal information is collected and used. This project will also introduce a verity of open-source tools and techniques that would help the unsuspected user to maintain their privacy.The questions asked were: what are some common techniques that Amazon, Apple, Facebook, Google, or Microsoft use to gain personal information?, At what cost would it …

Trust Models And Risk In The Internet Of Things, Jeffrey Hemmes

Regis University Faculty Publications

The Internet of Things (IoT) is envisaged to be a large-scale, massively heterogeneous ecosystem of devices with varying purposes and capabilities. While architectures and frameworks have focused on functionality and performance, security is a critical aspect that must be integrated into system design. This work proposes a method of risk assessment of devices using both trust models and static capability profiles to determine the level of risk each device poses. By combining the concepts of trust and secure device fingerprinting, security mechanisms can be more efficiently allocated across networked IoT devices. Simultaneously, devices can be allowed a greater degree of …

Shedding Light On Dark Patterns: A Case Study On Digital Harms, Noreen Y. Whysel

Publications and Research

You’ve been there before. You thought you could trust someone with a secret. You thought it would be safe, but found out later that they blabbed to everyone. Or maybe they didn’t share it, but the way they used it felt manipulative. You gave more than you got and it didn’t feel fair. But now that it’s out there, do you even have control anymore?

Ok. Now imagine that person was your supermarket. Or your bank. Or your boss.

As designers of digital spaces for consumer products and services, how often do we consider the relationship we have with our …

Viability Of Consumer Grade Hardware For Learning Computer Forensics Principles, Lazaro A. Herrera

Journal of Digital Forensics, Security and Law

We propose utilizing budget consumer hardware and software to teach computer forensics principles and for non-case work, research and developing new techniques. Consumer grade hardware and free / open source software is more easily accessible in most developing markets and can be used as a first purchase for education, technique development and even when developing new techniques. These techniques should allow for small forensics laboratories or classroom settings to have the tooling and framework for trying existing forensics techniques or creating new forensics techniques on consumer grade hardware. We'll be testing how viable each individual piece of hardware is as …

Shor’S Algorithm: How Quantum Computing Affects Cybersecurity, Caroline Fedele, Asai Asaithambi

Showcase of Osprey Advancements in Research and Scholarship (SOARS)

Honorable Mention Winner

Almost all of today’s computer security relies on something known as the RSA cryptosystem. This system relies on a mathematical, specifically number theory, problem known as prime factorization, where a composite number is broken down into its two prime number factors. This in an ideal method for encryption because it is easy to multiply two numbers, encoding the data, but it much harder to determine which numbers were originally multiplied together, thus hard to decode the data. If this composite number is sufficiently large, there is no known algorithm for efficiently breaking it down – at least …

Cyberbullying: Its Social And Psychological Harms Among Schoolers, Hyeyoung Lim, Hannarae Lee

International Journal of Cybersecurity Intelligence & Cybercrime

Criminal justice around the world has prioritized the prevention and protection of bullying and its victims due to the rapid increases in peer violence. Nevertheless, relatively few studies have examined what treatments or assistance are effective for peer victims to reduce and recover from their social and psychological suffering, especially in cyberbullying cases. Using data derived from the National Crime Victimization Survey-School Crime Supplement data in 2011 and 2013 (N=823), the current study examined the impact of two emotional support groups (i.e., adult and peer groups) on cyberbullying victims' social and psychological harm. The findings indicated that both adult and …

Cyber-Victimization Trends In Trinidad & Tobago: The Results Of An Empirical Research, Troy Smith, Nikolaos Stamatakis

International Journal of Cybersecurity Intelligence & Cybercrime

Cybertechnology has brought benefits to the Caribbean in the form of new regional economic and social growth. In the last years, Caribbean countries have also become attractive targets for cybercrime due to increased economic success and online presence with a low level of cyber resilience. This study examines the online-related activities that affect cybercrime victimization by using the Routine Activity Theory (RAT). The present study seeks to identify activities that contribute to different forms of cybercrime victimization and develop risk models for these crimes, particularly the understudied cyber-dependent crimes of Hacking and Malware. It also aims to explore if there …

Assessing The Credibility Of Cyber Adversaries, Jenny A. Wells, Dana S. Lafon, Margaret Gratian

International Journal of Cybersecurity Intelligence & Cybercrime

Online communications are ever increasing, and we are constantly faced with the challenge of whether online information is credible or not. Being able to assess the credibility of others was once the work solely of intelligence agencies. In the current times of disinformation and misinformation, understanding what we are reading and to who we are paying attention to is essential for us to make considered, informed, and accurate decisions, and it has become everyone’s business. This paper employs a literature review to examine the empirical evidence across online credibility, trust, deception, and fraud detection in an effort to consolidate this …

Buffer Overflow And Sql Injection In C++, Noah Warren Kapley

Masters Theses & Specialist Projects

Buffer overflows and SQL Injection have plagued programmers for many years. A successful buffer overflow, innocuous or not, damages a computer’s permanent memory. Safer buffer overflow programs are presented in this thesis for the C programs characterizing string concatenation, string copy, and format get string, a C program which takes input and output from a keyboard, in most cases. Safer string concatenation and string copy programs presented in this thesis require the programmer to specify the amount of storage space necessary for the program’s execution. This safety mechanism is designed to help programmers avoid over specifying the amount of storage …