Information Security Commons^™

Securing The Integrity Of The Power Distribution System For Smart Grid Applications, Hosam Yousef Hittini

Theses

The distribution system is one of the main components in a smart grid, readings are transferred from the distribution substations to the control center. Compromising transferred system data will result in drawing wrong conclusions about current operation status at the control center. Which leads to sending wrong operational commands that may result in very serious consequences.

Firstly, we propose a scalable communications architecture for future smart grid distribution systems (i.e. Security Aware Distribution System Architecture - SADSA). The architecture is adaptable to use Wi-Fi or other technologies to transfer smart grid information. The architecture is studied from various angles. Both …

Biometrics-Based Dynamic Authentication For Secure Services, Saif Mohammed Saeed Abdulla Al Aryani

Theses

This thesis proposes a secure authentication protocol against physical session hijacking attacks. In client/server technology, users establish sessions to access the services offered by the servers. However, using physical session hijacking attacks, malicious users may physically take control of ongoing sessions. Malicious users also can establish sessions with servers using stolen passwords. In both cases, the server will be communicating with the wrong user who pretends to be the real user. The goal of this authentication protocol is to continuously and dynamically ensure that during an ongoing session the current session’s user is himself the real person that is known …

Evaluating The Gasday Security Policy Through Penetration Testing And Application Of The Nist Cybersecurity Framework, Andrew Nicholas Kirkham

Master's Theses (2009 -)

This thesis explores cybersecurity from the perspective of the Marquette University GasDay lab. We analyze three different areas of cybersecurity in three independent chapters. Our goal is to improve the cybersecurity capabilities of GasDay, Marquette University, and the natural gas industry. We present network penetration testing as a process of attempting to gain access to resources of GasDay without prior knowledge of any valid credentials. We discuss our method of identifying potential targets using industry standard reconnaissance methods. We outline the process of attempting to gain access to these targets using automated tools and manual exploit creation. We propose several …

Masthead

Journal of Digital Forensics, Security and Law

No abstract provided.

Front Matter

Journal of Digital Forensics, Security and Law

No abstract provided.

Back Matter

Journal of Digital Forensics, Security and Law

No abstract provided.

Statistic Whitelisting For Enterprise Network Incident Response, Nathan E. Grunzweig

Theses and Dissertations

This research seeks to satisfy the need for the rapid evaluation of enterprise network hosts in order to identify items of significance through the introduction of a statistic whitelist based on the behavior of the processes on each host. By taking advantage of the repetition of processes and the resources they access, a whitelist can be generated using large quantities of host machines. For each process, the Modules and the TCP & UDP Connections are compared to identify which resources are most commonly accessed by each process. Results show 47% of processes receiving a whitelist score of 75% or greater …

Whitelisting System State In Windows Forensic Memory Visualizations, Joshua A. Lapso

Theses and Dissertations

Examiners in the field of digital forensics regularly encounter enormous amounts of data and must identify the few artifacts of evidentiary value. The most pressing challenge these examiners face is manual reconstruction of complex datasets with both hierarchical and associative relationships. The complexity of this data requires significant knowledge, training, and experience to correctly and efficiently examine. Current methods provide primarily text-based representations or low-level visualizations, but levee the task of maintaining global context of system state on the examiner. This research presents a visualization tool that improves analysis methods through simultaneous representation of the hierarchical and associative relationships and …

A Framework For Incorporating Insurance Into Critical Infrastructure Cyber Risk Strategies, Derek R. Young

Theses and Dissertations

Critical infrastructure owners and operators want to minimize their cyber risk and expenditures on cybersecurity. The insurance industry has been quantitatively assessing risk for hundreds of years in order to minimize risk and maximize profits. To achieve these goals, insurers continuously gather statistical data to improve their predictions, incentivize their clients' investment in self-protection and periodically refine their models to improve the accuracy of risk estimates. This paper presents a framework which incorporates the operating principles of the insurance industry in order to provide quantitative estimates of cyber risk. The framework implements optimization techniques to suggest levels of investment for …

Cyberspace And Organizational Structure: An Analysis Of The Critical Infrastructure Environment, Michael D. Quigg Ii

Theses and Dissertations

Now more than ever, organizations are being created to protect the cyberspace environment. The capability of cyber organizations tasked to defend critical infrastructure has been called into question by numerous cybersecurity experts. Organizational theory states that organizations should be constructed to fit their operating environment properly. Little research in this area links existing organizational theory to cyber organizational structure. Because of the cyberspace connection to critical infrastructure assets, the factors that influence the structure of cyber organizations designed to protect these assets warrant analysis to identify opportunities for improvement.

This thesis analyzes the cyber‐connected critical infrastructure environment using the dominant …

Ultrasonic Data Steganography, Alexander Orosz Edwards

KSU Journey Honors College Capstones and Theses

What started off as a question on the possibly of data transmission via sound above the level of human hearing evolved into a project exploring the possibility of ultrasonic data infiltration and exfiltration in an information security context. It is well known that sound can be used to transmit data as this can be seen in many old technologies, most notably and simply DTMF tones for phone networks. But what if the sound used to transmit signals was in in the ultrasonic range? It would go generally unnoticed to anyone not looking for it with tools such as a spectrum …

Ultrasonic Data Transmission And Steganography, Hunter Young

KSU Journey Honors College Capstones and Theses

This project discusses the feasibility of using ultrasound to transmit data between computer systems, particularly computer systems that have been intentionally cut off from traditional networks for increased security. The goal of this project is to provide a synthesis of the current research that has been done into the use of ultrasonic data transmission, and to conduct a series of tests determining the validity of certain claims made in regards to ultrasonic data transmission within the information security community. All research, experiments, results, and inferences have been discussed in the context of how they relate to the realm of information …

An Overview Of Cryptography (Updated Version, 3 March 2016), Gary C. Kessler

Publications

There are many aspects to security and many applications, ranging from secure commerce and payments to private communications and protecting passwords. One essential aspect for secure communications is that of cryptography...While cryptography is necessary for secure communications, it is not by itself sufficient. This paper describes the first of many steps necessary for better security in any number of situations.

A much shorter, edited version of this paper appears in the 1999 edition of Handbook on Local Area Networks published by Auerbach in September 1998.

A Cyber Forensics Needs Analysis Survey: Revisiting The Domain's Needs A Decade Later, Vikram S. Harichandran, Frank Breitinger, Ibrahim Baggili, Andrew Marrington

Electrical & Computer Engineering and Computer Science Faculty Publications

The number of successful cyber attacks continues to increase, threatening financial and personal security worldwide. Cyber/digital forensics is undergoing a paradigm shift in which evidence is frequently massive in size, demands live acquisition, and may be insufficient to convict a criminal residing in another legal jurisdiction. This paper presents the findings of the first broad needs analysis survey in cyber forensics in nearly a decade, aimed at obtaining an updated consensus of professional attitudes in order to optimize resource allocation and to prioritize problems and possible solutions more efficiently. Results from the 99 respondents gave compelling testimony that the following …

Cca-Secure Keyed-Fully Homomorphic Encryption, Junzuo Lai, Deng, Robert H., Changshe Ma, Kouichi Sakurai, Jian Weng

Research Collection School Of Computing and Information Systems

To simultaneously achieve CCA security and homomorphic property for encryption, Emura et al. introduced a new cryptographic primitive named keyed-homomorphic encryption, in which homomorphic ciphertext manipulations can only be performed by someone holding a devoted evaluation key which, by itself, does not enable decryption. A keyed-homomorphic encryption scheme should provide CCA2 security when the evaluation key is unavailable to the adversary and remain CCA1-secure when the evaluation key is exposed. While existing keyed-homomorphic encryption schemes only allow simple computations on encrypted data, our goal is to construct CCA-secure keyed-fully homomorphic encryption (keyed-FHE) capable of evaluating any functions on encrypted data …

A Method And A Case Study For The Selection Of The Best Available Tool For Mobile Device Forensics Using Decision Analysis, Shahzad Saleem, Oliver Popov, Ibrahim Baggili

Electrical & Computer Engineering and Computer Science Faculty Publications

The omnipresence of mobile devices (or small scale digital devices - SSDD) and more importantly the utility of their associated applications for our daily activities, which range from financial transactions to learning, and from entertainment to distributed social presence, create an abundance of digital evidence for each individual. Some of the evidence may be a result of illegal activities that need to be identified, understood and eventually prevented in the future. There are numerous tools for acquiring and analyzing digital evidence extracted from mobile devices. The diversity of SSDDs, types of evidence generated and the number of tools used to …

Strongly Leakage-Resilient Authenticated Key Exchange, Rongmao Chen, Yi Mu, Guomin Yang, Willy Susilo, Fuchun Guo

Research Collection School Of Computing and Information Systems

Authenticated Key Exchange (AKE) protocols have been widely deployed in many real-world applications for securing communication channels. In this paper, we make the following contributions. First, we revisit the security modelling of leakage-resilient AKE protocols, and show that the existing models either impose some unnatural restrictions or do not sufficiently capture leakage attacks in reality. We then introduce a new strong yet meaningful security model, named challenge-dependent leakage-resilient eCK (CLR- eCKCLR- eCK) model, to capture challenge-dependent leakage attacks on both long-term secret key and ephemeral secret key (i.e., randomness). Second, we propose a general framework for constructing one-round CLR- eCKCLR- …

The Implications Of Rfid Technology In University Id Cards, Michael Beaver

Missouri S&T’s Peer to Peer

Radio frequency identification (RFID) chips have been rising in popularity because of their usefulness and convenience, and have now made their way into the ID cards of universities. An RFID chip is an identification device that, when powered by some nearby source, sends out a signal with information that was stored in the chip. RFID physical security systems work just like a lock and key, with the RFID chip acting as the key. Instead of having a unique pattern, RFID chips have an identification code that is read by the lock. Some RFID chips also hide this code behind a …

One Size Does Not Fit All: A Game-Theoretic Approach For Dynamically And Effectively Screening For Threats, Matthew Brown, Arunesh Sinha, Aaron Schlenker, Milind Tambe

Research Collection School Of Computing and Information Systems

An effective way of preventing attacks in secure areas is to screen for threats (people, objects) before entry, e.g., screening of airport passengers. However, screening every entity at the same level may be both ineffective and undesirable. The challenge then is to find a dynamic approach for randomized screening, allowing for more effective use of limited screening resources, leading to improved security. We address this challenge with the following contributions: (1) a threat screening game (TSG) model for general screening domains; (2) an NP-hardness proof for computing the optimal strategy of TSGs; (3) a scheme for decomposing TSGs into subgames …

Improving Forensic Software Tool Performance In Detecting Fraud For Financial Statements, Brian Cusack, Tau’Aho Ahokov

Australian Digital Forensics Conference

The use of computer forensics is important for forensic accounting practice because most accounting information is in digital forms today. The access to evidence is increasingly more complex and in far greater volumes than in previous decades. The effective and efficient means of detecting fraud are required for the public to maintain their confidence in the reliability of accounting audit and the reputation of accounting firms. The software tools used by forensic accounting can be called into question. Many appear inadequate when faced with the complexity of fraud and there needs to be the development of automated and specialist problem-solving …