Information Security Commons^™

Workplace Surveillance, Tamara Kneese

Media Studies

Employers have long devised techniques and used new technologies to surveil employees in order to increase efficiency, decrease theft, and otherwise assert power and control over subordinates. New and cheaper networked technologies make surveillance easier to implement, but what are the ramifications of widespread workplace surveillance?

Security Policies That Make Sense For Complex Systems: Comprehensible Formalism For The System Consumer, Rhonda R. Henning

CCAC Theses and Dissertations

Information Systems today rarely are contained within a single user workstation, server, or networked environment. Data can be transparently accessed from any location, and maintained across various network infrastructures. Cloud computing paradigms commoditize the hardware and software environments and allow an enterprise to lease computing resources by the hour, minute, or number of instances required to complete a processing task. An access control policy mediates access requests between authorized users of an information system and the system's resources. Access control policies are defined at any given level of abstraction, such as the file, directory, system, or network, and can be …

Ios Device Forensics, Lauren Drish

All Capstone Projects

Many people today have an iPhone, iPad or iPod. Not many would realize that valuable information is stored on these devices. When a crime occurs, an iOS Device could hold key information to help solve said crime that criminals are not aware are present on the device. This can include GPS information as well as application history on the device itself.

The project I wish to do and complete is to create a class where students can learn the about iOS Forensics. Student will be able to learn the basics of an iDevice, as well as how to work with …

Attribute-Based Signing Right Delegation, Weiwei Liu, Yi Mu, Guomin Yang

Research Collection School Of Computing and Information Systems

Attribute-based signature and proxy signature are both very useful in many real-world applications. In this paper, we combine the special features of both signatures and propose an attribute-based proxy signature scheme, where the original signer, who possesses a set of attributes, can delegate his/her signing right to a designated proxy signer. By verifying the signature, a verifier can be convinced that the signature is generated by the proxy signer who has obtained the delegation from a legitimate signer whose attributes satisfy a predicate. However, the verifier cannot tell from the signature who is the original signer. We provide the formal …

Analyzing The Dangers Posed By Chrome Extensions, Lujo Bauer, Shaoying Cai, Limin Jia, Timothy Passaro, Yuan Tian

Research Collection School Of Computing and Information Systems

A common characteristic of modern web browsers is that their functionality can be extended via third-party addons. In this paper we focus on Chrome extensions, to which the Chrome browser exports a rich API: extensions can potentially make network requests, access the local file system, get low-level information about running processes, etc. To guard against misuse, Chrome uses a permission system to curtail an extension's privileges. We demonstrate a series of attacks by which extensions can steal data, track user behavior, and collude to elevate their privileges. Although some attacks have previously been reported, we show that subtler versions can …

Lossy Trapdoor Relation And Its Applications To Lossy Encryption And Adaptive Trapdoor Relation, Haiyang Xue, Xianhui Lu, Bao Li, Yamin Liu

Research Collection School Of Computing and Information Systems

Peikert and Waters proposed the notion of lossy trapdoor function in STOC 2008. In this paper, we propose a relaxation of lossy trapdoor function, called lossy trapdoor relation. Unlike the lossy trapdoor function, lossy trapdoor relation does not require completely recovering the input but a public computable injective map of it. Interestingly, the lossy trapdoor relation maintains the application of lossy trapdoor function on the lossy encryption. Moreover, motivated by the construction of adaptive trapdoor relation proposed by Wee (Crypto 2010), we introduce all-but-one verifiable lossy trapdoor relation which is in fact a relaxation of all-but-one lossy trapdoor function. – …

Masthead

Journal of Digital Forensics, Security and Law

No abstract provided.

Back Matter

Journal of Digital Forensics, Security and Law

No abstract provided.

Front Matter

Journal of Digital Forensics, Security and Law

No abstract provided.

Understanding Usability-Related Information Security Failures In A Healthcare Context, Edward D. Boyer

CCAC Theses and Dissertations

This research study explores how the nature and type of usability failures impact task performance in a healthcare organization. Healthcare organizations are composed of heterogeneous and disparate information systems intertwined with complex business processes that create many challenges for the users of the system. The manner in which Information Technology systems and products are implemented along with the overlapping intricate tasks the users have pose problems in the area of usability. Usability research primarily focuses on the user interface; therefore, designing a better interface often leaves security in question. When usability failures arise from the incongruence between healthcare task and …

Investigating The Determinants Of Disaster Recovery Technology Investment Choice In Small And Medium-Sized Enterprises, Faranak Afshar

CCAC Theses and Dissertations

Due to the importance of small and medium-sized enterprises (SMEs) as drivers of economic growth, it is essential to explore the security issues impacting SMEs' success and failure. One of the main security risks that could significantly impair the operability of the organizations is the permanent loss of data due to man-made and/or natural disasters and interruptions. Research has shown that SMEs are not taking disaster preparedness for their computer and networking systems as seriously as they should. This dissertation is an attempt to explain the process of a risky choice, specifically the decision maker's choice of not investing in …

Employee And Organization Security Value Alignment Through Value Sensitive Security Policy Design, Dianne Blitstein Solomon

CCAC Theses and Dissertations

Every member of the organization must be involved in proactively and consistently preventing data loss. Implementing a culture of security has proven to be a reliable method of enfranchising employees to embrace security behavior. However, it takes more than education and awareness of policies and directives to effect a culture of security. Research into organizational culture has shown that programs to promote organizational culture - and thus security behavior - are most successful when the organization's values are congruent with employee values. What has not been clear is how to integrate the security values of the organization and its employees …

Trust, Betrayal, And Whistle-Blowing: Reflections On The Edward Snowden Case, Herman T. Tavani, Frances Grodzinsky

School of Computer Science & Engineering Faculty Publications

Is every act of whistle blowing, by definition, a betrayal of trust on the part of the whistle-blower? If so, are employees who blow the whistle, by implication, untrustworthy employees? Assuming that they are, would employees who blow the whistle (presumably on the grounds of moral obligation) also be willing to concede that they are not trustworthy employees, by virtue of carrying out their whistle-blowing act(s)? In answering these questions, we first propose some working definitions of whistle-blowing, trust, and trustworthiness. We then ask whether some instances of whistle-blowing are morally permissible (and perhaps also morally required), even if it …

Verifiable Computation On Outsourced Encrypted Data, Junzuo Lai, Robert H. Deng, Hwee Hwa Pang, Jian Weng

Research Collection School Of Computing and Information Systems

On one hand, homomorphic encryption allows a cloud server to perform computation on outsourced encrypted data but provides no verifiability that the computation is correct. On the other hand, homomorphic authenticator, such as homomorphic signature with public verifiability and homomorphic MAC with private verifiability, guarantees authenticity of computation over outsourced data but does not provide data confidentiality. Since cloud servers are usually operated by third-party providers which are almost certain to be outside the trust domain of cloud users, neither homomorphic encryption nor homomorphic authenticator suffices for verifiable computation on outsourced encrypted data in the cloud. In this paper, we …

Control Flow Obfuscation Using Neural Network To Fight Concolic Testing, Haoyu Ma, Xinjie Ma, Weijie Liu, Zhipeng Huang, Debin Gao, Chunfu Jia

Research Collection School Of Computing and Information Systems

Concolic testing is widely regarded as the state-of-the-art technique in dynamic discovering and analyzing trigger-based behavior in software programs. It uses symbolic execution and an automatic theorem prover to generate new concrete test cases to maximize code coverage for scenarios like software verification and malware analysis. While malicious developers usually try their best to hide malicious executions, there are also circumstances in which legitimate reasons are presented for a program to conceal trigger-based conditions and the corresponding behavior, which leads to the demand of control flow obfuscation techniques. We propose a novel control flow obfuscation design based on the incomprehensibility …

Dupfinder: Integrated Tool Support For Duplicate Bug Report Detection, Ferdian Thung, Pavneet Singh Kochhar, David Lo

Research Collection School Of Computing and Information Systems

To track bugs that appear in a software, developers often make use of a bug tracking system. Users can report bugs that they encounter in such a system. Bug reporting is inherently an uncoordinated distributed process though and thus when a user submits a new bug report, there might be cases when another bug report describing exactly the same problem is already present in the system. Such bug reports are duplicate of each other and these duplicate bug reports need to be identified. A number of past studies have proposed a number of automated approaches to detect duplicate bug reports. …

Privatedroid: Private Browsing Mode For Android, Su Mon Kywe, Christopher Landis, Yutong Pei, Justin Satterfield, Yuan Tian, Patrick Tague

Research Collection School Of Computing and Information Systems

Private browsing mode is a privacy feature adopted by many modern computer browsers. With the increased use of mobile devices and escalating privacy concerns for mobile users, browser applications on mobile devices have also started incorporating private browsing mode. Even so, the use of private browsing mode is limited to the browser applications and cannot be applied directly on other third-party mobile applications. In this paper, we propose PrivateDroid, which provides a private browsing mode for third-party applications on the Android platform. First, we discuss three possible approaches of implementing mobile private browsing mode: code instrumentation, an extra sandbox, and …

Authorized Keyword Search On Encrypted Data, Jie Shi, Junzuo Lai, Yingjiu Li, Huijie Robert Deng, Jian Weng

Research Collection School Of Computing and Information Systems

Cloud computing has drawn much attention from research and industry in recent years. Plenty of enterprises and individuals are outsourcing their data to cloud servers. As those data may contain sensitive information, it should be encrypted before outsourced to cloud servers. In order to ensure that only authorized users can search and further access the encrypted data, two important capabilities must be supported: keyword search and access control. Recently, rigorous efforts have been made on either keyword search or access control over encrypted data. However, to the best of our knowledge, there is no encryption scheme supporting both capabilities in …

Potential Biases In Bug Localization: Do They Matter?, Pavneet Singh Kochhar, Yuan Tian, David Lo

Research Collection School Of Computing and Information Systems

Issue tracking systems are valuable resources during software maintenance activities and contain information about the issues faced during the development of a project as well as after its release. Many projects receive many reports of bugs and it is challenging for developers to manually debug and fix them. To mitigate this problem, past studies have proposed information retrieval (IR)-based bug localization techniques, which takes as input a textual description of a bug stored in an issue tracking system, and returns a list of potentially buggy source code files. These studies often evaluate their effectiveness on issue reports marked as bugs …

Uncovering Embarrassing Moments In In-Situ Exposure Of Incoming Mobile Messages, Chulhong Min, Saumay Pushp, Seungchul Lee, Inseok Hwang, Youngki Lee, Seungwoo Kang, Junehwa Song

Research Collection School Of Computing and Information Systems

Mobile instant messengers serve as major interaction media for everyday chats. Contrary to the belief that a message is seen only by a designated receiver, it can be accidentally exposed to someone nearby and could result in embarrassing moments, for example, when the receiver is viewing pictures together with his friend upon the message arrival. To understand the significance of the problem and core factors that cause such embarrassments, we collected 961 in-situ responses from 14 participants upon the actual message arrival and analyzed them from the perspective of the receiver's situation. The results showed that 29% of message arrivals …