Information Security Commons^™

Corporate Cybersecurity In The Context Of M&A Transactions, Cameron Beck

Cybersecurity Undergraduate Research Showcase

The rapid rise of digital devices has unlocked a new dimension of innovation and prosperity in the 21st century. Computers are now an integrated and ubiquitous part of our global culture. You would be hard-pressed to walk into any given room without several computer chips humming inaudibly inside the machines that facilitate our modern world. Even lightbulbs and doorbells are connected to the Internet, capturing information from the world around them and sending that information to the Cloud. The Internet expands access to communication, international marketplaces, entertainment, professional resources, and nearly every book in the world.

Random Password Generation, Kirk Smith

Cybersecurity Undergraduate Research Showcase

This paper will discuss the topic of random generation, first by explaining the topic, followed by how the literature review was performed. Then, a literature review will be performed, followed by a discussion of human biases and the strength of random password generation.

The Future Of Blockchain, Elijah N. Gartrell

Cybersecurity Undergraduate Research Showcase

Blockchain is the leading technology for cryptocurrencies, NFT’s and other online marketplace transactions that go through it because of it’s secure technology and how they distribute their data with Smart Contracts. This report shows how we can use Blockchain for other uses in our world and how it could advance us in the cybersecurity aspects. Showing also why we should use blockchain with basic cybersecurity concerns as in: Malware Detection, Voter Fraud, and Medical Record Security.

The “Office Of The Ciso”: A Framework For Chief Information Security Officers, Yael Nagler, Christophe Veltsos

Computer Information Science Department Publications

As we enter 2022, cybersecurity continues to challenge corporations and their CISOs. The sophistication of cyberthreats coupled with an evolving digital landscape has resulted in increased complexity and expanded responsibilities for the CISO. Simply put, there is greater scrutiny, greater regulation, greater complexity, and greater scope than ever before. To respond to these changes, CISOs must organize their “Office of the CISO” to meet the expectations and deliver for their organizations. Whether the CISO has a staff of three or thirty and whether they are prepared or not, these elements are being increasingly expected of CISOs. You can think of …

Examining Cooperative System Responses Against Grid Integrity Attacks, Alexander D. Parady

Honors Undergraduate Theses

Smart grid technologies are integral to society’s transition to sustainable energy sources, but they do not come without a cost. As the energy sector shifts away from a century’s reliance on fossil fuels and centralized generation, technology that actively monitors and controls every aspect of the power infrastructure has been widely adopted, resulting in a plethora of new vulnerabilities that have already wreaked havoc on critical infrastructure. Integrity attacks that feedback false data through industrial control systems, which result in possible catastrophic overcorrections and ensuing failures, have plagued grid infrastructure over the past several years. This threat is now at …

Password Managers: Secure Passwords The Easy Way, Alexander Master

CERIAS Technical Reports

Poor passwords are often the central problem identified when data breaches, ransomware attacks, and identity fraud cases occur. This Purdue Extension publication provides everyday users of Internet websites and computer systems with tools and strategies to protect their online accounts. Securing information access with password managers can be convenient and often free of cost, on a variety of devices and platforms. “Do’s and Don’ts” of password practices are highlighted, as well as the benefits of multi-factor authentication. The content is especially applicable for small businesses or non-profits, where employees often share access to systems or accounts.

A Metric For Machine Learning Vulnerability To Adversarial Examples, Matt Bradley

Masters Theses & Doctoral Dissertations

Machine learning is used in myriad aspects, both in academic research and in everyday life, including safety-critical applications such as robust robotics, cybersecurity products, medial testing and diagnosis where a false positive or negative could have catastrophic results. Despite the increasing prevalence of machine learning applications and their role in critical systems we rely on daily, the security and robustness of machine learning models is still a relatively young field of research with many open questions, particularly on the defensive side of adversarial machine learning. Chief among these open questions is how best to quantify a model’s attack surface against …

Timestamp Estimation From Outdoor Scenes, Tawfiq Salem, Jisoo Hwang, Rafael Padilha

Annual ADFSL Conference on Digital Forensics, Security and Law

The increasing availability of smartphones allowed people to easily capture and share images on the internet. These images are often associated with metadata, including the image capture time (timestamp) and the location where the image was captured (geolocation). The metadata associated with images provides valuable information to better understand scenes and events presented in these images. The timestamp can be manipulated intentionally to provide false information to convey a twisted version of reality. Images with manipulated timestamps are often used as a cover-up for wrongdoing or broadcasting false claims and competing views on the internet. Estimating the time of capture …

Anatomy Of An Internet Hijack And Interception Attack: A Global And Educational Perspective, Ben A. Scott, Michael N. Johnstone, Patryk Szewczyk

Annual ADFSL Conference on Digital Forensics, Security and Law

The Internet’s underlying vulnerable protocol infrastructure is a rich target for cyber crime, cyber espionage and cyber warfare operations. The stability and security of the Internet infrastructure are important to the function of global matters of state, critical infrastructure, global e-commerce and election systems. There are global approaches to tackle Internet security challenges that include governance, law, educational and technical perspectives. This paper reviews a number of approaches to these challenges, the increasingly surgical attacks that target the underlying vulnerable protocol infrastructure of the Internet, and the extant cyber security education curricula; we find the majority of predominant cyber security …

Anatomy Of An Internet Hijack And Interception Attack: A Global And Educational Perspective, Ben A. Scott, Michael N. Johnstone, Patryk Szewczyk

Research outputs 2022 to 2026

The Internet’s underlying vulnerable protocol infrastructure is a rich target for cyber crime, cyber espionage and cyber warfare operations. The stability and security of the Internet infrastructure are important to the function of global matters of state, critical infrastructure, global e-commerce and election systems. There are global approaches to tackle Internet security challenges that include governance, law, educational and technical perspectives. This paper reviews a number of approaches to these challenges, the increasingly surgical attacks that target the underlying vulnerable protocol infrastructure of the Internet, and the extant cyber security education curricula; we find the majority of predominant cyber security …

Edge-Iiotset: A New Comprehensive Realistic Cyber Security Dataset Of Iot And Iiot Applications For Centralized And Federated Learning, Mohamed A. Ferrag, Othmane Friha, Djallel Hamouda, Leandros Maglaras, Helge Janicke

Research outputs 2022 to 2026

In this paper, we propose a new comprehensive realistic cyber security dataset of IoT and IIoT applications, called Edge-IIoTset, which can be used by machine learning-based intrusion detection systems in two different modes, namely, centralized and federated learning. Specifically, the dataset has been generated using a purpose-built IoT/IIoT testbed with a large representative set of devices, sensors, protocols and cloud/edge configurations. The IoT data are generated from various IoT devices (more than 10 types) such as Low-cost digital sensors for sensing temperature and humidity, Ultrasonic sensor, Water level detection sensor, pH Sensor Meter, Soil Moisture sensor, Heart Rate Sensor, Flame …

Lightweight And Expressive Fine-Grained Access Control For Healthcare Internet-Of-Things, Shengmin Xu, Yingjiu Li, Robert H. Deng, Yinghui Zhang, Xiangyang Luo, Ximeng Liu

Research Collection School Of Computing and Information Systems

Healthcare Internet-of-Things (IoT) is an emerging paradigm that enables embedded devices to monitor patients vital signals and allows these data to be aggregated and outsourced to the cloud. The cloud enables authorized users to store and share data to enjoy on-demand services. Nevertheless, it also causes many security concerns because of the untrusted network environment, dishonest cloud service providers and resource-limited devices. To preserve patients' privacy, existing solutions usually apply cryptographic tools to offer access controls. However, fine-grained access control among authorized users is still a challenge, especially for lightweight and resource-limited end-devices. In this paper, we propose a novel …

Cyber Security Curriculum In Western Australian Primary And Secondary Schools: Interim Report: Curriculum Mapping, Nicola Johnson, Ahmed Ibrahim, Leslie Sikos, Cheryl Glowrey

Research outputs 2022 to 2026

Cyber-crime poses a significant threat to Australians—think of, for example, how scams take advantage of vulnerable people and systems. There is a need to educate people from an early age to protect them from cyberthreats.

Consistent with the increasing prevalence of cyberthreats to individuals and organisations in Australia, the national Australian curriculum has been updated (version 9.0) to include specific content for cyber security for primary and secondary students up to Year 10. Endorsed by Education Ministers in April 2022, the Western Australian School Curriculum and Standards Authority (SCSA) completed a detailed audit of the endorsed Australian Curriculum version 9.0 …

Asymmetrical Trusted Technology Networks In Developing Economies: A Case Study On Critical Infrastructure In Bhutan, Pratima Pradhan, Bal Subba, Thinley Jamtsho, Ganga Ram Ghimiray, David M. Cook

Research outputs 2022 to 2026

Developing Nations are subject to amplified challenges in terms of the integration of technology, and the exposure to non-domestic opportunism from larger neighboring economies. These challenges are recognizable as asymmetrical differences between what is seen as the normative list of critical infrastructures, and the specialisms that can dominate an emerging economy with early maturity technology networks. This paper discusses the case of Bhutan and demonstrates the need for strengthened approaches to trusted networks to ensure the reliability and continuity of the Nation's critical infrastructures. The paper also links the importance of trusted information sharing networks as part of an overarching …

The Effects Of Antecedents And Mediating Factors On Cybersecurity Protection Behavior, Ling Li, Li Xu, Wu He

Information Technology & Decision Sciences Faculty Publications

This paper identifies opportunities for potential theoretical and practical improvements in employees' awareness of cybersecurity and their motivational behavior to protect themselves and their organizations from cyberattacks using the protection motivation theory. In addition, it contributes to the literature by examining additional variables and mediators besides the core constructs of the Protection Motivation Model (PMT). This article uses empirical data and structural equation modeling to test the antecedents and mediators of employees' cybersecurity motivational behavior. The study offers theoretical and pragmatic guidance for cybersecurity programs. First, the model developed in this study can partially explain how people may change their …

Modeling Iot Solutions: A Lack Of Iot Device Security, And User Education, Benjamin Newlin

Cybersecurity Undergraduate Research Showcase

The Internet of Things, more commonly known as IoT devices, is an ever growing topic, both in the marketplace and in cyber security. While new devices are released into the public every year, a lack of standardized security concepts is also growing ever so clear. By having a model or standard for IoT devices and manufacturers to follow, the customer-base of these devices will have an easier time identifying trustworthy devices as well as how to secure their own devices.

Cyber Whistleblowers: The Black Sheep Of Whistleblowing?, Andrew Wisniewski Jr.

Cybersecurity Undergraduate Research Showcase

From the Introduction:

Contrary to popular belief, this paper argues that cyber whistleblowing can contribute to a greater cyber security posture. However, this requires the development of clearer legal obligations and protections for cyber whistleblowers. This paper will explore the psychology behind whistleblowing, the effectiveness of whistleblowing in a cybersecurity context, how to create a safer and more transparent environment for whistleblowers and companies, and how current laws contribute to cyber whistleblowing.

Nft Sneaker Marketplace Design, Testing, And Challenges, Chris Zhu

Honors Theses

This paper introduces the preliminary background and implementation of the NFT sneaker marketplace. Specifically, we build sneaker NFTs on top of ERC-20 within the Ethereum network and use a top-to-bottom design mechanism. Our website performs well in its functionality, compatibility, and performance. We discuss possible future steps for security implementation. In particular, we recommend using a cold wallet for clients' transactions and implementing multi-signature contracts to avoid spoofing and repudiation. Introducing the sneaker NFT marketplace will vastly reduce the costs of transactions and delivery time in the physical sneaker marketplace. We hope investors in the physical asset space can find …

The Impact Of A Gencyber Camp On In-Service Teachers’ Tpack, Kevin M. Thomas, Jessica Ivy, Kristin Cook, Robert R. Kelley

Journal of Cybersecurity Education, Research and Practice

The purpose of this study was to examine the impact of a GenCyber camp curriculum on teachers’ technology, pedagogy, and content knowledge (TPACK). The camp was designed to engage participants in developing the knowledge and skills to incorporate GenCyber Cybersecurity First Principles and GenCyber Cybersecurity Concepts (GenCyber, 2019) into their curriculums. Participants (37 middle and high school teachers from a variety of disciplines) attended one of two weeklong camps held at a Midwestern liberal arts university. Using the TPACK Self-Reflection and TPACK Self-Assessment Surveys, pre- and post-camp data were collected from participants. Findings indicate that participants demonstrated an increase in …

Toward A Student-Ready Cybersecurity Program: Findings From A Survey Of Stem-Students, Lora Pitman, Brian K. Payne, Tancy Vandecar-Burdin, Lenora Thorbjornsen

Journal of Cybersecurity Education, Research and Practice

As the number of available cybersecurity jobs continues to grow, colleges strive to offer to their cybersecurity students an environment which will make them sufficiently prepared to enter the workforce after graduation. This paper explores the academic and professional needs of STEM-students in various higher education institutions across Virginia and how cybersecurity programs can cater to these needs. It also seeks to propose an evidence-based approach for improving the existing cybersecurity programs so that they can become more inclusive and student-ready. A survey of 251 college students in four higher-education institutions in Virginia showed that while there are common patterns …

A Review Of Distributed Identity Technology In Iot Devices, Myles Perry

Cybersecurity Undergraduate Research Showcase

Distributed identity technology provides solutions to many of the faults currently found in federated identity systems. Applying this technology to internet of things devices has many possible benefits in the realm of device authentication. However, this also provides new challenges not present in existing distributed identity systems. The large number of devices that would enter and leave the system means balancing sybil attack vulnerability and linkage attack vulnerability becomes challenging. Internet of things devices also have less memory and computing power than a standard personal computer or phone. This means any protocol to execute distributed identity in these devices must …

Detecting The Presence Of Electronic Devices In Smart Homes Using Harmonic Radar, Beatrice Perez, Gregory Mazzaro, Timothy J. Pierson, David Kotz

Dartmouth Scholarship

Data about users is collected constantly by phones, cameras, Internet websites, and others. The advent of so-called ‘Smart Things' now enable ever-more sensitive data to be collected inside that most private of spaces: the home. The first step in helping users regain control of their information (inside their home) is to alert them to the presence of potentially unwanted electronics. In this paper, we present a system that could help homeowners (or home dwellers) find electronic devices in their living space. Specifically, we demonstrate the use of harmonic radars (sometimes called nonlinear junction detectors), which have also been used in …

Cybersecurity & Correctional Institutions, Kelly Himelwright

Cybersecurity Undergraduate Research Showcase

Cybersecurity is becoming an increasingly important aspect of correctional operations. To properly maintain security, more jails and prisons are using comprehensive cyber protection techniques. Correctional facilities face risks that were perhaps unimaginable only a few decades ago. Many organizations have used information technology to help them run their businesses, but few have the resources or vision to foresee and adequately manage the cyber dangers that come with it. Institutions need to be more aware of these hazards, as well as have more information security experts on staff.

Towards Secure And Trustworthy Iot Systems, Lan Luo

Electronic Theses and Dissertations, 2020-2023

The boom of the Internet of Things (IoT) brings great convenience to the society by connecting the physical world to the cyber world, but it also attracts mischievous hackers for benefits. Therefore, understanding potential attacks aiming at IoT systems and devising new protection mechanisms are of great significance to maintain the security and privacy of the IoT ecosystem. In this dissertation, we first demonstrate potential threats against IoT networks and their severe consequences via analyzing a real-world air quality monitoring system. By exploiting the discovered flaws, we can impersonate any victim sensor device and polluting its data with fabricated data. …

Cybersecurity Logging & Monitoring Security Program, Thai H. Nguyễn

School of Computer Science & Engineering Undergraduate Publications

With ubiquitous computing becoming pervasive in every aspect of societies around the world and the exponential rise in cyber-based attacks, cybersecurity teams within global organizations are spending a massive amount of human and financial capital on their logging and monitoring security programs. As a critical part of global organizational security risk management processes, it is important that log information is aggregated in a timely, accurate, and relevant manner. It is also important that global organizational security operations centers are properly monitoring and investigating the security use-case alerting based on their log data. In this paper, the author proposes a model …

C2 Microservices Api: Ch4rl3sch4l3m4gn3, Thai H. Nguyễn

School of Computer Science & Engineering Undergraduate Publications

In the 21^st century, cyber-based attackers such as advance persistent threats are leveraging bots in the form of botnets to conduct a plethora of cyber-attacks. While there are several social engineering techniques used to get targets to unknowingly download these bots, it is the command-and-control techniques advance persistent threats use to control their bots that is of critical interest to the author. In this research paper, the author aims to develop a command-and-control microservice application programming interface infrastructure to facilitate botnet command-and-control attack simulations. To achieve this the author will develop a simple bot skeletal framework, utilize the latest …

Formal Modeling And Verification Of A Blockchain-Based Crowdsourcing Consensus Protocol, Hamra Afzaal, Muhammad Imran, Muhammad Umar Janjua, Sarada Prasad Gochhayat

VMASC Publications

Crowdsourcing is an effective technique that allows humans to solve complex problems that are hard to accomplish by automated tools. Some significant challenges in crowdsourcing systems include avoiding security attacks, effective trust management, and ensuring the system’s correctness. Blockchain is a promising technology that can be efficiently exploited to address security and trust issues. The consensus protocol is a core component of a blockchain network through which all the blockchain peers achieve an agreement about the state of the distributed ledger. Therefore, its security, trustworthiness, and correctness have vital importance. This work proposes a Secure and Trustworthy Blockchain-based Crowdsourcing (STBC) …

A Lightweight Reliably Quantified Deepfake Detection Approach, Tianyi Wang, Kam Pui Chow

Annual ADFSL Conference on Digital Forensics, Security and Law

Deepfake has brought huge threats to society such that everyone can become a potential victim. Current Deepfake detection approaches have unsatisfactory performance in either accuracy or efficiency. Meanwhile, most models are only evaluated on different benchmark test datasets with different accuracies, which could not imitate the real-life Deepfake unknown population. As Deepfake cases have already been raised and brought challenges at the court, it is disappointed that no existing work has studied the model reliability and attempted to make the detection model act as the evidence at the court. We propose a lightweight Deepfake detection deep learning approach using the …

Healthcare 5.0 Security Framework: Applications, Issues And Future Research Directions, Mohammad Wazid, Ashok Kumar Das, Noor Mohd, Youngho Park

VMASC Publications

Healthcare 5.0 is a system that can be deployed to provide various healthcare services. It does these services by utilising a new generation of information technologies, such as Internet of Things (IoT), Artificial Intelligence (AI), Big data analytics, blockchain and cloud computing. Due to the introduction of healthcare 5.0, the paradigm has been now changed. It is disease-centered to patient-centered care where it provides healthcare services and supports to the people. However, there are several security issues and challenges in healthcare 5.0 which may cause the leakage or alteration of sensitive healthcare data. This demands that we need a robust …

An Exploration On Apts In Biocybersecurity And Cyberbiosecurity, Xavier-Lewis Palmer, Lucas Potter, Saltuk Karahan

School of Cybersecurity Faculty Publications

Novel and complex digital threats that are increasingly interwoven with means and products of biology that can affect society. Much work in Biocybersecurity/Cyberbiosecurity (BCS/CBS) discuss vulnerabilities, but few deeply address malicious actor varieties as attacks at this intersection are new. The path to those attacks remains mostly theoretical, presenting considerable difficulty to accomplish in practical scenarios. In terms of advanced persistent threats (APTs) this of course needs to change as biomanufacturing facilities are at risk, considering Covid-19 and other potential pandemics. Further attacks are not out of reach and thus we must start to imagine how BCS APTs may appear. …