Information Security Commons^™

Awareness And Perception Of Cybercrimes And Cybercriminals, Hannarae Lee, Hyeyoung Lim

International Journal of Cybersecurity Intelligence & Cybercrime

Awareness is a starting point to recognize, understand, or know a situation or fact, and the perception makes a difference in how to deal with it. Although the term cybercrime may not be new to the most public and the police, not all of them are well aware of the nature and extent of cybercrimes, cybercriminals, and cyber-victims, which in turn affects their perceptions of matters. The four papers in this issue of the International Journal of Cybersecurity Intelligence and Cybercrime empirically examine these important topics and discuss policy implications.

Phishing And Cybercrime Risks In A University Student Community, Roderic Broadhurst, Katie Skinner, Nicholas Sifniotis, Bryan Matamoros-Macias, Yuguang Ipsen

International Journal of Cybersecurity Intelligence & Cybercrime

In an exploratory quasi-experimental observational study, 138 participants recruited during a university orientation week were exposed to social engineering directives in the form of fake email or phishing attacks over several months in 2017. These email attacks attempted to elicit personal information from participants or entice them into clicking links which may have been compromised in a real-world setting. The study aimed to determine the risks of cybercrime for students by observing their responses to social engineering and exploring attitudes to cybercrime risks before and after the phishing phase. Three types of scam emails were distributed that varied in the …

Examining Perceptions Of Online Harassment Among Constables In England And Wales, Thomas J. Holt, Jin R. Lee, Roberta Liggett, Karen M. Holt, Adam Bossler

International Journal of Cybersecurity Intelligence & Cybercrime

The ubiquity of the Internet and computer technology has enabled individuals to engage in bullying, threats, and harassing communications online. Limited research has found that local line officers may not view these offenses as serious compared to real world crimes despite their negative physical and emotional impact on victims. The perceptions of officers can produce poor interactions with victims during calls for service, particularly victim blaming, which can reduce citizens’ confidence in police agencies generally. However, local law enforcement agencies are increasingly mandated to respond to these cases, calling to question how their views may impact the community. This study …

Cybercrime And Digital Forensics: Bridging The Gap In Legislation, Investigation And Prosecution Of Cybercrime In Nigeria, Kabiru H. Mohammed, Yusuf D. Mohammed, Abiodun A. Solanke

International Journal of Cybersecurity Intelligence & Cybercrime

The advancement of Information and Communication Technologies (ICT) opens new avenues and ways for cybercriminals to commit crime. The primary goal of this paper is to raise awareness regarding gaps that exist with regards to Nigeria’s capabilities to adequately legislate, investigate and prosecute cases of cybercrimes. The major source of cybercrime legislation in Nigeria is an act of the National Assembly which is majorly a symbolic legislation rather than a full and active legislation. In perusing these avenues of inquiry, the authors seek to identify systemic impediments which hinder law enforcement agencies, prosecutors, and investigators from properly carrying out their …

Security Analysis Of A Large-Scale Concurrent Data Anonymous Batch Verification Scheme For Mobile Healthcare Crowd Sensing, Yinghui Zhang, Jiangang Shu, Ximeng Liu, Jin Li, Dong Zheng

Research Collection School Of Computing and Information Systems

As an important application of the Internet of Things (IoT) technologies, mobile healthcare crowd sensing (MHCS) still has challenging issues, such as privacy protection and efficiency. Quite recently in IEEE Internet of Things Journal (DOI: 10.1109/JIOT.2018.2828463), Liu et al. proposed a large-scale concurrent data anonymous batch verification scheme for mobile healthcare crowd sensing, claiming to provide batch authentication, non-repudiation, and anonymity. However, after a close look at the scheme, we point out that the scheme suffers two types of signature forgery attacks and hence fails to achieve the claimed security properties. In addition, a reasonable and rigorous probability analysis indicates …

Understanding Open Ports In Android Applications: Discovery, Diagnosis, And Security Assessment, Daoyuan Wu, Debin Gao, Rocky K. C. Chang, En He, Eric K. T. Cheng, Robert H. Deng

Research Collection School Of Computing and Information Systems

Open TCP/UDP ports are traditionally used by servers to provide application services, but they are also found in many Android apps. In this paper, we present the first open-port analysis pipeline, covering the discovery, diagnosis, and security assessment, to systematically understand open ports in Android apps and their threats. We design and deploy a novel on-device crowdsourcing app and its server-side analytic engine to continuously monitor open ports in the wild. Over a period of ten months, we have collected over 40 million port monitoring records from 3,293 users in 136 countries worldwide, which allow us to observe the actual …

Verifiable Computation Using Re-Randomizable Garbled Circuits, Qingsong Zhao, Qingkai Zeng, Ximeng Liu, Huanliang Xu

Research Collection School Of Computing and Information Systems

Yao's garbled circuit allows a client to outsource a function computation to a server with verifiablity. Unfortunately, the garbled circuit suffers from a one-time usage. The combination of fully homomorphic encryption (FHE) and garbled circuits enables the client and the server to reuse the garbled circuit with multiple inputs (Gennaro et al.). However, there still seems to be a long way to go for improving the efficiency of all known FHE schemes and it need much stronger security assumption. On the other hand, the construction is only proven to be secure in a weaker model where an adversary can not …

An Attribute-Based Framework For Secure Communications In Vehicular Ad Hoc Networks, Hui Cui, Robert H. Deng, Guilin Wang

Research Collection School Of Computing and Information Systems

In this paper, we introduce an attribute-based framework to achieve secure communications in vehicular ad hoc networks (VANETs), which enjoys several advantageous features. The proposed framework employs attribute-based signature (ABS) to achieve message authentication and integrity and protect vehicle privacy, which greatly mitigates the overhead caused by pseudonym/private key change or update in the existing solutions for VANETs based on symmetric key, asymmetric key, and identity-based cryptography and group signature. In addition, we extend a standard ABS scheme with traceability and revocation mechanisms and seamlessly integrate them into the proposed framework to support vehicle traceability and revocation by a trusted …

An Overview Of Cryptography (Updated Version 24 January 2019), Gary C. Kessler

Publications

There are many aspects to security and many applications, ranging from secure commerce and payments to private communications and protecting health care information. One essential aspect for secure communications is that of cryptography. But it is important to note that while cryptography is necessary for secure communications, it is not by itself sufficient. The reader is advised, then, that the topics covered here only describe the first of many steps necessary for better security in any number of situations.

Multi-Authority Attribute-Based Keyword Search Over Encrypted Cloud Data, Yibin Miao, Robert H. Deng, Ximeng Liu, Kim-Kwang Raymond. Choo, Hongjun Wu, Hongwei Li

Research Collection School Of Computing and Information Systems

Searchable Encryption (SE) is an important technique to guarantee data security and usability in the cloud at the same time. Leveraging Ciphertext-Policy Attribute-Based Encryption (CP-ABE), the Ciphertext-Policy Attribute-Based Keyword Search (CP-ABKS) scheme can achieve keyword-based retrieval and fine-grained access control simultaneously. However, the single attribute authority in existing CP-ABKS schemes is tasked with costly user certificate verification and secret key distribution. In addition, this results in a single-point performance bottleneck in distributed cloud systems. Thus, in this paper, we present a secure Multi-authority CP-ABKS (MABKS) system to address such limitations and minimize the computation and storage burden on resource-limited devices …

Cyber Security Awareness Among College Students, Abbas Moallem

Faculty Publications

This study reports the early results of a study aimed to investigate student awareness and attitudes toward cyber security and the resulting risks in the most advanced technology environment: the Silicon Valley in California, USA. The composition of students in Silicon Valley is very ethnically diverse. The objective was to see how much the students in such a tech-savvy environment are aware of cyber-attacks and how they protect themselves against them. The early statistical analysis suggested that college students, despite their belief that they are observed when using the Internet and that their data is not secure even on university …

A New Network Model For Cyber Threat Intelligence Sharing Using Blockchain Technology, Daire Homan, Ian Shiel, Christina Thorpe

Conference Papers

The aim of this research is to propose a new blockchain network model that facilitates the secure dissemination of Cyber Threat Intelligence (CTI) data. The primary motivations for this study are based around the recent changes to information security legislation in the European Union and the challenges that Computer Security and Incident Response Teams (CSIRT) face when trying to share actionable and highly sensitive data within systems where participants do not always share the same interests or motivations. We discuss the common problems within the domain of CTI sharing and we propose a new model, that leverages the security properties …

Probabilistic Record Linkage With Elliptic Curve Operations, Shreya Dhiren Patel

Electronic Theses and Dissertations

Federated query processing for an electronic health record infrastructure enables large epidemiology studies using data integrated from geographically dispersed medical institutions. However, government imposed privacy regulations prohibit disclosure of patient's health record outside the context of clinical care, thereby making it difficult to determine which records correspond to the same entity in the process of query aggregation.

Privacy-preserving record linkage is an actively pursued research area to facilitate the linkage of database records under the constraints of regulations that do not allow the linkage agents to learn sensitive identities of record owners. In earlier works, scalability has been shown to …

A Study Of Perceptions On Incident Response Exercises, Information Sharing, Situational Awareness, And Incident Response Planning In Power Grid Utilities, Joseph Garmon

Electronic Theses and Dissertations

The power grid is facing increasing risks from a cybersecurity attack. Attacks that shut off electricity in Ukraine have already occurred, and successful compromises of the power grid that did not shut off electricity to customers have been privately disclosed in North America. The objective of this study is to identify how perceptions of various factors emphasized in the electric sector affect incident response planning. Methods used include a survey of 229 power grid personnel and the use of partial least squares structural equation modeling to identify causal relationships. This study reveals the relationships between perceptions by personnel responsible for …

Image-Based Malware Classification: A Space Filling Curve Approach, Stephen O Shaughnessy

Conference Papers

Anti-virus (AV) software is effective at distinguishing between benign and malicious programs yet lack the ability to effectively classify malware into their respective family classes. AV vendors receive considerably large volumes of malicious programs daily and so classification is crucial to quickly identify variants of existing malware that would otherwise have to be manually examined. This paper proposes a novel method of visualizing and classifying malware using Space-Filling Curves (SFC's) in order to improve the limitations of AV tools. The classification models produced were evaluated on previously unseen samples and showed promising results, with precision, recall and accuracy scores of …

Security Analysis Of The Internet Of Things Using Digital Forensic And Penetration Testing Tools, Olajide Ojagbule

College of Graduate Studies: Theses & Dissertations

We exist in a universe where everything is related to the internet or each other like smart TVs, smart telephones, smart thermostat, cars and more. Internet of Things has become one of the most talked about technologies across the world and its applications range from the control of home appliances in a smart home to the control of machines on the production floor of an industry that requires less human intervention in performing basic daily tasks. Internet of Things has rapidly developed without adequate attention given to the security and privacy goals involved in its design and implementation. This document …

Anomaly Detection In Bacnet/Ip Managed Building Automation Systems, Matthew Peacock

Theses: Doctorates and Masters

Building Automation Systems (BAS) are a collection of devices and software which manage the operation of building services. The BAS market is expected to be a $19.25 billion USD industry by 2023, as a core feature of both the Internet of Things and Smart City technologies. However, securing these systems from cyber security threats is an emerging research area. Since initial deployment, BAS have evolved from isolated standalone networks to heterogeneous, interconnected networks allowing external connectivity through the Internet. The most prominent BAS protocol is BACnet/IP, which is estimated to hold 54.6% of world market share. BACnet/IP security features are …

From The Editors, Herbert J. Mattord, Michael E. Whitman

Journal of Cybersecurity Education, Research and Practice

A message from the editors.

Investigating The Impact Of Publicly Announced Information Security Breaches On Corporate Risk Factor Disclosure Tendencies, Sandra J. Cereola, Joanna Dynowska

Journal of Cybersecurity Education, Research and Practice

As the reported number of data breaches increase and senators push for more disclosure regulation, the SEC staff issued a guidance in 2011 on disclosure obligations relating to cybersecurity risks and incidents. More recently, on February 26, 2018 the SEC Commission issued interpretive guidance to help assist public companies prepare disclosures regarding cybersecurity risks and incidents. As reported incidents of cybersecurity breaches occur, investors are concerned about the risks associated with these incidents and the impact they may have on financial performance. Although the SEC staff guidance warns public companies to make timely disclosure, recognizing the threat that cybercrime poses …

Sit Back, Relax, And Tell Me All Your Secrets, Sarah Kirk, Daniel Foreman, Cody Lee, Shannon W. Beasley

Journal of Cybersecurity Education, Research and Practice

The goal of this research is to describe an active learning opportunity that was conducted as a community service offering through our Center for Cybersecurity Education and Applied Research (CCEAR). As a secondary goal, the participants sought to gain real world experience by applying techniques and concepts studied in security classes. A local insurance company tasked the CCEAR with assembling a team of students to conduct penetration testing (including social engineering exploits) against company personnel. The endeavor allowed the insurance company to obtain information that would assess the effectiveness of employee training with regard to preventing the divulgence of sensitive …