Mitigating Man-In-The-Middle Attacks On Smartphones – A Discussion Of Ssl Pinning And Dnssec,
2014
Deakin University
Mitigating Man-In-The-Middle Attacks On Smartphones – A Discussion Of Ssl Pinning And Dnssec, Veelasha Moonsamy, Lynn Batten
Australian Information Security Management Conference
Since their introduction, smartphones remain one of the most used handheld devices and this trend is predicted to continue in the coming years. Consequently, the number of attacks on smartphones is increasing exponentially; current market research shows that data traffic generated by smartphones will escalate by tenfold in 2019. Such an increase in traffic indicates that the smartphone industry will remain an attractive target for attackers. Whilst smartphone users are aware of the benefits of installing antivirus applications for malware evasion, they have limited knowledge on how to mitigate MiTM attacks. Furthermore, application developers do not always consider implementing appropriate …
Cache-Timing Attack Against Aes Crypto System - Countermeasures Review,
2014
University of Khartoum
Cache-Timing Attack Against Aes Crypto System - Countermeasures Review, Yaseen H. Taha, Settana M. Abdulh, Naila A. Sadalla, Huwaida Elshoush
Australian Information Security Management Conference
Side channel attacks are based on side channel information, which is information that is leaked from encryption systems. Implementing side channel attacks is possible if and only if an attacker has access to a cryptosystem (victim) or can interact with cryptosystem remotely to compute time statistics of information that collected from targeted system. Cache timing attack is a special type of side channel attack. Here, timing information caused by cache effect is collected and analyzed by an attacker to guess sensitive information such as encryption key or plaintext. Cache timing attack against AES was known theoretically until Bernstein carry out …
The Impact Of Social Constructivism On Erp Systems Security: A Critical Social Review,
2014
University of Johannesburg
The Impact Of Social Constructivism On Erp Systems Security: A Critical Social Review, Kennedy Njenga
Australian Information Security Management Conference
Little is understood about the effects of social constructivism that shapes conflicting concerns regarding Enterprise Resource Planning (ERP) security and usability during implementation. This work looks at social constructivism as produced and reproduced by stakeholders in the ERP systems implementation phase. Social constructivism is characterised by the embedded trade-off for usability, espoused by end-user and security, espoused by developers. Social constructivism was conceptualised qualitatively from a selected case study. Critical Social Theory (CST) was used as the theoretical lens. Stakeholders concerned with ERP security aspects in the implementation phase were interviewed and data transcribed and interpreted. Hermeneutical interpretation was applied …
12th Australian Information Security Management Conference, 2014, Edith Cowan University: Conference Details,
2014
Edith Cowan University
12th Australian Information Security Management Conference, 2014, Edith Cowan University: Conference Details, Security Research Institute, Edith Cowan University
Australian Information Security Management Conference
No abstract provided.
The Application Of An Agile Approach To It Security Risk Management For Smes,
2014
Deakin University
The Application Of An Agile Approach To It Security Risk Management For Smes, Damien Hutchinson, Chris Armitt, Dean Edwards-Lear
Australian Information Security Management Conference
This paper demonstrates the application of an agile risk management approach to perform asset-based risk analysis to meet the information security requirements of SMEs (Small and Medium-sized Enterprises). This approach is proposed as an alternative to traditional methods that are cumbersome, resource intensive and costly, often hindering their value and use by SMEs. The organisation being studied is an Aged Care Facility (ACF) with legal and ethical responsibilities. Within the business there is little knowledge regarding potential information technology threats that could impact on these responsibilities. The ACF maintains a system containing client personal and medical records, network communications, as …
15th Australian Information Warfare Conference, 2014, Edith Cowan University - Conference Details,
2014
Edith Cowan University
15th Australian Information Warfare Conference, 2014, Edith Cowan University - Conference Details, Security Research Institute, Edith Cowan University
Australian Information Warfare and Security Conference
No abstract provided.
Detecting Covert Communication Channels In Raster Images,
2014
Auckland University of Technology
Detecting Covert Communication Channels In Raster Images, Brian Cusack, Jarrett Chambers
Australian Information Warfare and Security Conference
Digital image steganography is a method for hiding secret messages within everyday Internet communication channels. Such covert communications provide protection for communications and exploit the opportunities available in digital media. Digital image steganography makes the nature and content of a message invisible to other users by taking ordinary internet artefacts and using them as cover objects for the messages. In this paper we demonstrate the capability with raster image files and discuss the challenges of detecting such covert communications. The contribution of the research is community awareness of covert communication capability in digital media and the motivation for including such …
Detecting Click Fraud In Online Advertising: A Data Mining Approach,
2014
Singapore Management University
Detecting Click Fraud In Online Advertising: A Data Mining Approach, Richard Oentaryo, Ee Peng Lim, Michael Finegold, David Lo, Feida Zhu, Clifton Phua, Eng-Yeow Cheu, Ghim-Eng Yap, Kelvin Sim, Kasun Perera, Bijay Neupane, Mustafa Faisal, Zeyar Aung, Wei Lee Woon, Wei Chen, Dhaval Patel, Daniel Berrar
Research Collection School Of Computing and Information Systems
Click fraud - the deliberate clicking on advertisements with no real interest on the product or service offered - is one of the most daunting problems in online advertising. Building an elective fraud detection method is thus pivotal for online advertising businesses. We organized a Fraud Detection in Mobile Advertising (FDMA) 2012 Competition, opening the opportunity for participants to work on real-world fraud data from BuzzCity Pte. Ltd., a global mobile advertising company based in Singapore. In particular, the task is to identify fraudulent publishers who generate illegitimate clicks, and distinguish them from normal publishers. The competition was held from …
Privacy-Preserving Ad-Hoc Equi-Join On Outsourced Data,
2014
Singapore Management University
Privacy-Preserving Ad-Hoc Equi-Join On Outsourced Data, Hwee Hwa Pang, Xuhua Ding
Research Collection School Of Computing and Information Systems
In IT outsourcing, a user may delegate the data storage and query processing functions to a third-party server that is not completely trusted. This gives rise to the need to safeguard the privacy of the database as well as the user queries over it. In this article, we address the problem of running ad hoc equi-join queries directly on encrypted data in such a setting. Our contribution is the first solution that achieves constant complexity per pair of records that are evaluated for the join. After formalizing the privacy requirements pertaining to the database and user queries, we introduce a …
A Comparative Analysis Of The National Cyber Security Strategies Of Leading Nations,
2014
Franklin University
A Comparative Analysis Of The National Cyber Security Strategies Of Leading Nations, Bilge Karabacak, Unal Tatar, Orhan Calik, Minhac Celik
All Faculty and Staff Scholarship
The rapid pace of technological developments in the area of information and communications technologies caused nations and peoples to be more reliant on cyber infrastructure to survive. Besides opportunities, the widespread use of information technology introduces new threats as well. Risks related to cyber security have started to threaten critical infrastructures, which are defined as assets that are essential for the functioning of a society and its economy. Cyber security has become one of the most serious national security concerns. In 2003 the United States was the first nation to prepare and publish a national cyber security strategy In the …
Cross-Domain Password-Based Authenticated Key Exchange Revisited,
2014
Singapore Management University
Cross-Domain Password-Based Authenticated Key Exchange Revisited, Liqun Chen, Hoon Wei Lim, Guomin Yang
Research Collection School Of Computing and Information Systems
We revisit the problem of secure cross-domain communication between two users belonging to different security domains within an open and distributed environment. Existing approaches presuppose that either the users are in possession of public key certificates issued by a trusted certificate authority (CA), or the associated domain authentication servers share a long-term secret key. In this article, we propose a generic framework for designing four-party password-based authenticated key exchange (4PAKE) protocols. Our framework takes a different approach from previous work. The users are not required to have public key certificates, but they simply reuse their login passwords, which they share …
Cloud Security Meets Telemedicine,
2014
Edith Cowan University
Cloud Security Meets Telemedicine, Michael N. Johnstone
Research outputs 2014 to 2021
Medical systems are potentially one domain where security is seen as an impediment to patient care and not as an essential part of a system. This is an issue for safety-critical systems where reliability and trust are essential for successful operation. Cloud computing services offer a seamless means to allow medical data to be transferred from patient to medical specialist, whilst maintaining security requirements. This paper uses a case study to investigate the use of cloud computing in a mobile application to assist with diagnostics for patients with Parkinson Disease. It was found that the developers of the app ignored …
Book Review: The Basics Of Digital Forensics: The Primer For Getting Started In Digital Forensics,
2014
Slippery Rock University of PA
Book Review: The Basics Of Digital Forensics: The Primer For Getting Started In Digital Forensics, Stephen Larson
Journal of Digital Forensics, Security and Law
The Basics of Digital Forensics: The Primer for Getting Started in Digital Forensics is well-named–it really is very basic. And it should be, as the book’s intended audience includes entry-level digital forensics professionals and complimentary fields such as law enforcement, legal, and general information security. Though the copyright is 2012, some of the data is from 2009, and there is mention of estimates for 2010.
“Time For Some Traffic Problems”: Enhancing E-Discovery And Big Data Processing Tools With Linguistic Methods For Deception Detection,
2014
University of Maryland, College Park
“Time For Some Traffic Problems”: Enhancing E-Discovery And Big Data Processing Tools With Linguistic Methods For Deception Detection, Erin S. Crabb
Journal of Digital Forensics, Security and Law
Linguistic deception theory provides methods to discover potentially deceptive texts to make them accessible to clerical review. This paper proposes the integration of these linguistic methods with traditional e-discovery techniques to identify deceptive texts within a given author’s larger body of written work, such as their sent email box. First, a set of linguistic features associated with deception are identified and a prototype classifier is constructed to analyze texts and describe the features’ distributions, while avoiding topic-specific features to improve recall of relevant documents. The tool is then applied to a portion of the Enron Email Dataset to illustrate how …
Hot Zone Identification: Analyzing Effects Of Data Sampling On Spam Clustering,
2014
University of Alabama, Birmingham
Hot Zone Identification: Analyzing Effects Of Data Sampling On Spam Clustering, Rasib Khan, Mainul Mizan, Ragib Hasan, Alan Sprague
Journal of Digital Forensics, Security and Law
Email is the most common and comparatively the most efficient means of exchanging information in today's world. However, given the widespread use of emails in all sectors, they have been the target of spammers since the beginning. Filtering spam emails has now led to critical actions such as forensic activities based on mining spam email. The data mine for spam emails at the University of Alabama at Birmingham is considered to be one of the most prominent resources for mining and identifying spam sources. It is a widely researched repository used by researchers from different global organizations. The usual process …
Accurate Modeling Of The Siemens S7 Scada Protocol For Intrusion Detection And Digital Forensics,
2014
Tel-Aviv University
Accurate Modeling Of The Siemens S7 Scada Protocol For Intrusion Detection And Digital Forensics, Amit Kleinmann, Avishai Wool
Journal of Digital Forensics, Security and Law
The Siemens S7 protocol is commonly used in SCADA systems for communications between a Human Machine Interface (HMI) and the Programmable Logic Controllers (PLCs). This paper presents a model-based Intrusion Detection Systems (IDS) designed for S7 networks. The approach is based on the key observation that S7 traffic to and from a specific PLC is highly periodic; as a result, each HMI-PLC channel can be modeled using its own unique Deterministic Finite Automaton (DFA). The resulting DFA-based IDS is very sensitive and is able to flag anomalies such as a message appearing out of its position in the normal sequence …
From The Editor-In-Chief,
2014
JDFSL
From The Editor-In-Chief, Ibrahim Baggili
Journal of Digital Forensics, Security and Law
Welcome to JDFSL’s fourth and final issue for 2014! First, I would like to thank our editorial board, reviewers, and the JDFSL team for bringing this issue to life. It has been a big year for JDFSL as the journal continues to progress. I would like to highlight our critical achievements for 2014 before touching on the papers that were accepted in this issue: 1. JDFSL has gone to a fully open access model without author payment through support from academic institutions. 2. JDFSL has formed and continues to form partnerships with various conferences that relate to cyber security and …
Book Review: Judiciary-Friendly Forensics Of Software Copyright Infringement (Vinod Polpaya Bhattathiripad),
2014
University of Sao Paulo
Book Review: Judiciary-Friendly Forensics Of Software Copyright Infringement (Vinod Polpaya Bhattathiripad), Pedro L. P. Sanchez
Journal of Digital Forensics, Security and Law
Judiciary-Friendly Forensics of Software Copyright Infringement is a book by Dr. Vinod Polpaya Bhattathiripad, published by IGI-Global as part of its Research Essentials series. The book discusses the forensics of software copyright infringement and highlights theoretical, functional, and procedural matters in the investigation of copyright infringement of software products, as well as the development of forensic technologies to detect and avoid software piracy. It is of interest to software forensic experts, lawyers in the field of copyright infringement, judges, software professionals, and students.
Table Of Contents,
2014
Embry-Riddle Aeronautical University
Table Of Contents
Journal of Digital Forensics, Security and Law
No abstract provided.
Personal Denial Of Service (Pdos) Attacks: A Discussion And Exploration Of A New Category Of Cyber Crime,
2014
Pennsylvania State University, Berks
Personal Denial Of Service (Pdos) Attacks: A Discussion And Exploration Of A New Category Of Cyber Crime, Michael R. Bartolacci, Larry J. Leblanc, Ashley Podhradsky
Journal of Digital Forensics, Security and Law
The growth of the Internet has created a corresponding growth in Internet-based crimes and online misbehavior, particularly among younger computer-savvy people. Younger generations have grown up in a world where internet access, social networking, e-commerce and smartphones are commonplace. Given this fact, they have learned how to use, and how to abuse, technology. This leads us to define a new category of cybercrime called a Personal Denial of Service attack (PDOS). A PDOS is a cyber-crime in which an individual deliberately prevents the access of another individual or small group to online services such as email or banking. Due to …
