Information Security Commons^™

Digital Dna: The Ethical Implications Of Big Data As The World’S New-Age Commodity, Clark H. Dotson

Honors Theses

In the emerging digital world that we find ourselves in, it becomes apparent that data collection has become a staple of daily life, whether we like it or not. This research discussion aims to bring light to just how much one’s own digital identity is valued in the technologically-infused world of today, with distinct research and local examples to bring awareness to the ethical implications of your online presence. The paper in question examines anecdotal and research evidence of the collection of data, both through true and unjust means, as well as ethical implications of what this information truly represents. …

What Senior U.S. Leaders Say We Should Know About Cyber, Dr. Joseph H. Schafer

Military Cyber Affairs

On April 6, 2023, the Atlantic Council’s Cyber Statecraft Initiative hosted a panel discussion on the new National Cybersecurity Strategy. The panel featured four senior officials from the Office of the National Cyber Director (ONCD), the Department of State (DoS), the Department of Justice (DoJ), and the Department of Homeland Security (DHS). The author attended and asked each official to identify the most important elements that policymakers and strategists must understand about cyber. This article highlights historical and recent struggles to express cyber policy, the responses from these officials, and the author’s ongoing research to improve national security cyber policy.

Combining Frameworks To Improve Military Health System Quality And Cybersecurity, Dr. Maureen L. Schafer, Dr. Joseph H. Schafer

Military Cyber Affairs

Existing conceptual frameworks and commercially available technology could be considered to rapidly operationalize the use of Quality Measures (QM) within military health systems (Costantino et al. 2020). Purchased healthcare as well as digital healthcare services have paved the way for data collection from multiple information systems thus offering stakeholders actionable intelligence to both guide and measure healthcare outcomes. However, the collection of data secondary to Smart Devices, disparate information systems, cloud services, and the Internet of Medical Things (IOMT) is a complication for security experts that also affect clients, stakeholders, organizations, and businesses delivering patient care. We have combined three …

A Survey And Comparative Study On Vulnerability Scanning Tools, Cassidy Khounborine

Computer Science and Computer Engineering Undergraduate Honors Theses

Vulnerability scanners are a tool used by many organizations and developers as part of their vulnerability management. These scanners aid in the security of applications, databases, networks, etc. There are many different options available for vulnerability scanners that vary in the analysis method they encompass or target for which they scan, among many other features. This thesis explores the different types of scanners available and aims to ease the burden of selecting the ideal vulnerability scanner for one’s needs by conducting a survey and comparative analysis of vulnerability scanners. Before diving into the vulnerability scanners available, background information is provided …

Linux Malware Obfuscation, Brian Roden

Computer Science and Computer Engineering Undergraduate Honors Theses

Many forms of malicious software use techniques and tools that make it harder for their functionality to be parsed, both by antivirus software and reverse-engineering methods. Historically, the vast majority of malware has been written for the Windows operating system due to its large user base. As such, most efforts made for malware detection and analysis have been performed on that platform. However, in recent years, we have seen an increase in malware targeting servers running Linux and other Unix-like operating systems resulting in more emphasis of malware research on these platforms. In this work, several obfuscation techniques for Linux …

Reverse Engineering Post-Quantum Cryptography Schemes To Find Rowhammer Exploits, Sam Lefforge

Computer Science and Computer Engineering Undergraduate Honors Theses

Post-quantum cryptography is a necessary countermeasure to protect against attacks from quantum computer. However, the post-quantum cryptography schemes are potentially vulnerable to side channel attacks. One such method of attacking involves creating bit-flips in victim memory through a process called Rowhammer. These attacks can vary in nature, but can involve rowhammering bits to raise the encryption scheme's decryption failure rate, or modifying the scheme's random seed. With a high enough decryption failure rate, it becomes feasible to generate sufficient information about the secret key to perform a key recovery attack. This thesis proposed two attacks on proposed post-quantum cryptography algorithms, …

Critical Infrastructure Workforce Development Pods For Teaching Cybersecurity Using Netlab+, Gideon Sutterfield

Computer Science and Computer Engineering Undergraduate Honors Theses

As digital automation for Industrial Control Systems has grown, so has its vulnerability to cyberattacks. The world of industry has responded effectively to this, but the world of academia is still lagging as its emphasis is still almost entirely on information technology. Considering this, we created a workforce development pod that serves as a hands-on learning module for teaching students key cybersecurity ideas surrounding operational technology using the NETLAB+ platform. A pod serves as the virtual environment where the learning exercise takes place. This project’s implementation involved the creation of a segmented network within the pod where a student starts …

Rbac Attack Exposure Auditor. Tracking User Risk Exposure Per Role-Based Access Control Permissions, Adelaide Damrau

Undergraduate Honors Theses

Access control models and implementation guidelines for determining, provisioning, and de-provisioning user permissions are challenging due to the differing approaches, unique for each organization, the lack of information provided by case studies concerning the organization’s security policies, and no standard means of implementation procedures or best practices. Although there are multiple access control models, one stands out, role-based access control (RBAC). RBAC simplifies maintenance by enabling administrators to group users with similar permissions. This approach to managing user permissions supports the principle of least privilege and separation of duties, which are needed to ensure an organization maintains acceptable user access …

Trace Dna Detection Using Diamond Dye: A Recovery Technique To Yield More Dna, Leah Davis

Master's Theses

This study aspires to find a new screening approach to trace DNA recovery techniques to yield a higher quantity of trace DNA from larger items of evidence. It takes the path of visualizing trace DNA on items of evidence with potential DNA so analysts can swab a more localized area rather than attempting to recover trace DNA through the general swabbing technique currently used for trace DNA recovery. The first and second parts consisted of observing trace DNA interaction with Diamond Dye on porous and non-porous surfaces.

The third part involved applying the Diamond Dye solution by spraying it onto …

An Application Risk Assessment Of Werner Enterprises, Nathan Andres

Theses/Capstones/Creative Projects

Risk assessments provide a systematic approach to identifying potential risks that could negatively impact an organization’s operations, financial performance, and reputation. Using a risk assessment, companies can evaluate potential risks and vulnerabilities, prioritize them based on their potential impact, and develop strategies to manage and address these risks effectively.

Werner Enterprises Inc. is a nationally known trucking company headquartered in Omaha, Nebraska. Our cybersecurity capstone project motivation was to partner with Werner to produce an assessment of known application risks in a functional way that can be repeated for all of Werner’s applications. To achieve this, we created a risk …

Towards Privacy-Preserving Social Media Networks: Protecting The Facial Privacy Of Images Uploaded On Social Media, Ahsi Lo

Theses and Dissertations

Since the 2000s, social media has allowed individuals the ability to communicate online. As the popularity of social media increased, the sharing of information such as pictures increased as well. Recently, there have been privacy concerns about the information shared online such as cases where third parties were able to gain access to users’ information without being given explicit access through scraping or other means. When user images are scraped from social media, there is a risk that these individuals can be identified o✏ine. Bystanders, who may be captured in images also run this risk of identification. This research investigates …

Iot Health Devices: Exploring Security Risks In The Connected Landscape, Abasi-Amefon Obot Affia, Hilary Finch, Woosub Jung, Issah Abubakari Samori, Lucas Potter, Xavier-Lewis Palmer

School of Cybersecurity Faculty Publications

The concept of the Internet of Things (IoT) spans decades, and the same can be said for its inclusion in healthcare. The IoT is an attractive target in medicine; it offers considerable potential in expanding care. However, the application of the IoT in healthcare is fraught with an array of challenges, and also, through it, numerous vulnerabilities that translate to wider attack surfaces and deeper degrees of damage possible to both consumers and their confidence within health systems, as a result of patient-specific data being available to access. Further, when IoT health devices (IoTHDs) are developed, a diverse range of …

Design, Modeling, And Simulation Of Secure X.509 Certificate Revocation, Sai Medury

Masters Theses and Doctoral Dissertations

TLS communication over the internet has risen rapidly in the last seven years (2015--2022), and there were over 156M active SSL certificates in 2022. The state-of-the-art Public Key Infrastructure (PKI), encompassing protocols, computational resources, and digital certificates, has evolved for 24 years to become the de-facto choice for encrypted communication over the Internet even on newer platforms such as mobile devices and Internet-of-Things (IoT) (despite being low powered with computational constraints). However, certificate revocation is one sub-protocol in TLS communication that fails to meet the rising scalability demands and remains open to exploitation. In this dissertation, the standard for X.509 …

The Effect Of Cybersecurity Training On Government Employee’S Knowledge Of Cybersecurity Issues And Practices, Juan Jaime Saldana Ii

Theses and Dissertations

There is an ever-pressing need for cybersecurity awareness and implementation of learning strategies in the workplace to mitigate the increased threat posed by cyber-attacks and exacerbated by an untrained workforce. The lack of cybersecurity knowledge amongst government employees has increased to critical levels due to the amount of sensitive information their agencies are responsible for. The digital compromise of a government entity often leads to a compromise of constituent data along with the disruption of public services (Axelrod, 2019; Yazdanpanahi, 2021). The need for awareness is further complicated by agencies looking to cater to a digital culture looking for a …

Rattus Norvegicus As A Biological Detector Of Clandestine Remains And The Use Of Ultrasonic Vocalizations As A Locating Mechanism, Gabrielle M. Johnston

Master's Theses

In investigations, locating missing persons and clandestine remains are imperative. One way that first responder and police agencies can search for the remains is by using cadaver dogs as biological detectors. Cadaver dogs are typically used due to their olfactory sensitivity and ability to detect low concentrations of volatile organic compounds produced by biological remains. Cadaver dogs are typically chosen for their stamina, agility, and olfactory sensitivity. However, what is not taken into account often is the size of the animal and the expense of maintaining and training the animal. Cadaver dogs are typically large breeds that cannot fit in …

Gaslight: Attacking Hard-Label Black-Box Classifiers Via Deep Reinforcement Learning, Rajat Sethi

All Theses

Through artificial intelligence, algorithms can classify arrays of data, such as images or videos, into a predefined set of categories. With enough labeled data, a classifier can analyze an input’s components and calculate confidence scores for each category. However, machine learning relies heavily on approximation, which allows attackers to exploit classifiers by providing adversarial
examples. Specifically, attackers can modify their input so that the victim classifier cannot correctly label it, while a human observer would be unable to notice the difference.
This thesis proposes Gaslight, a system that uses deep reinforcement learning to generate adversarial examples against a victim classifier. …

Individual Differences In Vulnerability To Phishing, Fake News, And Vishing, Jeff Black

All Theses

Digital deception, such as phishing emails, scam phone calls, and fake news, poses a threat to anyone using digital devices. Research on digital deception often points to individual differences like age, cognitive impulsivity, and digital literacy, but has only investigated different types of digital deception independent of each other. Therefore, it is unclear whether users vulnerable to one type of deception are also vulnerable to others, and why. The present research examined relationships between vulnerability to different types of deception, and how this vulnerability is associated with common individual differences like age, cognitive impulsivity, digital literacy, and gullibility, and exploratory …

Graphprompt: Unifying Pre-Training And Downstream Tasks For Graph Neural Networks, Zemin Liu, Xingtong Yu, Yuan Fang, Xinming Zhang

Research Collection School Of Computing and Information Systems

Graphs can model complex relationships between objects, enabling a myriad of Web applications such as online page/article classification and social recommendation. While graph neural networks (GNNs) have emerged as a powerful tool for graph representation learning, in an end-to-end supervised setting, their performance heavily relies on a large amount of task-specific supervision. To reduce labeling requirement, the "pre-train, fine-tune"and "pre-train, prompt"paradigms have become increasingly common. In particular, prompting is a popular alternative to fine-tuning in natural language processing, which is designed to narrow the gap between pre-training and downstream objectives in a task-specific manner. However, existing study of prompting on …

A Framework For Identifying Malware Threat Distribution On The Dark Web, Shelby Caldwell

Graduate Theses and Dissertations (2019 - present)

The Dark Web is an ever-growing phenomenon that has not been deeply explored. It is no secret that in recent years, malware has become a powerful threat to technology users. The Dark Web is known for supporting anonymity and secure connections for private interactions. Over the years, it has become a rich environment for displaying trends, details, and indicators of emerging malware threats. Through the application of data science and open-source intelligence techniques, trends in malware distribution can be studied. In this research, we create a framework for helping identify malware threat distribution patterns. We examine this type of Dark …

Risk Assessment Framework For Evaluation Of Cybersecurity Threats And Vulnerabilities In Medical Devices, Maureen S. Van Devender

Graduate Theses and Dissertations (2019 - present)

Medical devices are vulnerable to cybersecurity exploitation and, while they can provide improvements to clinical care, they can put healthcare organizations and their patients at risk of adverse impacts. Evidence has shown that the proliferation of devices on medical networks present cybersecurity challenges for healthcare organizations due to their lack of built-in cybersecurity controls and the inability for organizations to implement security controls on them. The negative impacts of cybersecurity exploitation in healthcare can include the loss of patient confidentiality, risk to patient safety, negative financial consequences for the organization, and loss of business reputation. Assessing the risk of vulnerabilities …