Information Security Commons^™

A Taxonomy Of Cyberattacks Against Critical Infrastructure, Miloslava Plachkinova, Ace Vo

Journal of Cybersecurity Education, Research and Practice

The current study proposes a taxonomy to organize existing knowledge on cybercrimes against critical infrastructure such as power plants, water treatment facilities, dams, and nuclear facilities. Routine Activity Theory is used to inform a three-dimensional taxonomy with the following dimensions: hacker motivation (likely offender), cyber, physical, and cyber-physical components of any cyber-physical system (suitable target), and security (capable guardian). The focus of the study is to develop and evaluate the classification tool using Design Science Research (DSR) methodology. Publicly available data was used to evaluate the utility and usability of the proposed artifact by exploring three possible scenarios – Stuxnet, …

The 2020 Twitter Hack – So Many Lessons To Be Learned, Paul D. Witman, Scott Mackelprang

Journal of Cybersecurity Education, Research and Practice

In mid-July 2020, the social media site Twitter had over 100 of its most prominent user accounts start to tweet requests to send Bitcoin to specified Bitcoin wallets. The requests promised that the Bitcoin senders would receive their money back doubled, as a gesture of charity amidst the COVID-19 pandemic. The attack appears to have been carried out by a small group of hackers, leveraging social engineering to get access to internal Twitter support tools. These tools allowed the hackers to gain full control of the high-profile user accounts and post messages on their behalf. The attack provides many paths …

Editorial Vol 2021, No 2, Herbert J. Mattord, Michael E. Whitman, Hossain Shahriar

Journal of Cybersecurity Education, Research and Practice

Welcome to the Winter 2021 edition of the Journal for Cybersecurity Education, Research, and Practice.

Provably Weak Instances Of Plwe Revisited, Again, Katherine Mendel

CSB and SJU Distinguished Thesis

Learning with Errors has emerged as a promising possibility for postquantum cryptography. Variants known as RLWE and PLWE have been shown to be more efficient, but the increased structure can leave them vulnerable to attacks for certain instantiations. This work aims to identify specific cases where proposed cryptographic schemes based on PLWE work particularly poorly under a specific attack.

Automated Reverse Engineering Of Role-Based Access Control Policies Of Web Applications, Ha Thanh Le, Lwin Khin Shar, Domenico Bianculli, Lionel C. Briand, Cu Duy Nguyen

Research Collection School Of Computing and Information Systems

Access control (AC) is an important security mechanism used in software systems to restrict access to sensitive resources. Therefore, it is essential to validate the correctness of AC implementations with respect to policy specifications or intended access rights. However, in practice, AC policy specifications are often missing or poorly documented; in some cases, AC policies are hard-coded in business logic implementations. This leads to difficulties in validating the correctness of policy implementations and detecting AC defects.In this paper, we present a semi-automated framework for reverse-engineering of AC policies from Web applications. Our goal is to learn and recover role-based access …

Seqseg: A Sequential Method To Achieve Nasopharyngeal Carcinoma Segmentation Free From Background Dominance, Guihua Tao, Haojiang Li, Jiabin Huang, Chu Han, Jiazhou Chen, Guangying Ruan, Wenjie Huang, Yu Hu, Tingting Dan, Bin Zhang, Shengfeng He

Research Collection School Of Computing and Information Systems

Reliable nasopharyngeal carcinoma (NPC) segmentation plays an important role in radiotherapy planning. However, recent deep learning methods fail to achieve satisfactory NPC segmentation in magnetic resonance (MR) images, since NPC is infiltrative and typically has a small or even tiny volume with indistinguishable border, making it indiscernible from tightly connected surrounding tissues from immense and complex backgrounds. To address such background dominance problems, this paper proposes a sequential method (SeqSeg) to achieve accurate NPC segmentation. Specifically, the proposed SeqSeg is devoted to solving the problem at two scales: the instance level and feature level. At the instance level, SeqSeg is …

Optimal Eavesdropping In Quantum Cryptography, Atanu Acharyya Dr.

Doctoral Theses

Quantum key distribution (QKD) has raised some promise for more secured communication than its classical counterpart. It allows the legitimate parties to detect eavesdropping which introduces error in the channel. If disturbed, there are ways to distill a secure key within some threshold error-rate. The amount of information gained by an attacker is generally quantified by (Shannon) mutual information. Knowing the maximum amount of information that an intruder can gain is important for post-processing purposes, and we mainly focus on that side in the thesis. Renyi information is also useful especially when post-processing is considered. The scope of this thesis …

Using Memory Forensics To Analyze Programming Language Runtimes, Modhuparna Manna

LSU Doctoral Dissertations

The continued increase in the use of computer systems in recent times has led to a significant rise in the capabilities of malware and attacker toolkits that target different operating systems and their users. Over the last several years, cybersecurity threat reports have documented numerous instances of users that were targeted by governments, intelligence agencies, and criminal groups, and the result was that the victims ended up having highly sophisticated malware installed on their systems. Unfortunately, the rise of these threats has not been met with equal research and development of defensive mechanisms that can detect and analyze such malware. …

Digital Evidence In Appeals Of Criminal Cases Before The U.S. Courts Of Appeal: A Review Of Decisions And Examination Of The Legal Landscape From 2016 – 2020, Martin Novak

Journal of Digital Forensics, Security and Law

This study is a follow-up to Digital Evidence in Criminal Cases before the U.S. Courts of Appeal: Trends and Issues for Consideration – 2010 to 2015. The current study examines appeals of criminal cases before the United States Courts of Appeal from January 2016 through August 2020, where one or more appeal claims were related to digital evidence. The purpose of this research was to determine if the legal landscape has changed since 2015; examine the most relevant legal issues related to digital evidence; and analyze how precedential cases may have affected digital forensics as evidence.

Security Strategy In Combating Online Extremist Ideologies In Uae, Khalid Al-Qasimi

Journal of Police and Legal Sciences

This study aims at identifying the role of security strategies; the foundations of correct belief and good upbringing in the face of extremist ideology in order to protect the intellectual security of society. The researcher adopted the descriptive analytical approach in order to describe and analyze the role of the security strategy, the foundations of the correct faith and good upbringing in spreading moderation and combating extremist ideology through electronic websites.

The study has arrived at a number of findings, the most important of which are: extremist ideology cannot be confronted by traditional methods, but must be combated through modern …

Combating Terrorism Financing In The Cyber Environment A Study In Light Of The Egyptian And Emirati Experiences, Amar Elbably

Journal of Police and Legal Sciences

The research deals with the study of combating the financing of terrorism on the dark Internet, where terrorism "cyber has become an international actor, engages in interactions with states, individuals and institutions, and creates an agreement between the intelligence services and some terrorist movements, that these movements obtain information, finance, arm or training, in exchange for cyber-attacks against a mutual adversary, and the Internet plays a prominent role in the manufacture of extremism, terrorism, incitement to violence, promotion of radical ideas and attracting elements qualified for deviation, exploited in That's the dark part of the Internet, with an expansion of …

Technical Behaviours Of Child Sexual Exploitation Material Offenders, Chad Steel, Emily Newman, Suzanne O'Rourke, Ethel Quayle

Journal of Digital Forensics, Security and Law

An exploration of the technological behaviours of previously convicted child sexual exploitation material (CSEM) offenders provides a foundation for future applied research into deterrence, investigation, and treatment efforts. This study evaluates the technology choices and transitions of individuals previously convicted of CSEM offenses. Based on their inclusion in two sex offender registries, anonymous survey results (n=78) were collected from English-speaking adults within the United States. CSEM offenders chose technologies based on both utility and perceived risk; peer-to-peer and web-browsers were the most common gateway technologies and showed substantial sustained usage; a substantial minority of users never stored CSEM and only …

Forensic Discoverability Of Ios Vault Applications, Alissa Gilbert, Kathryn C. Seigfried-Spellar

Journal of Digital Forensics, Security and Law

Vault Applications are used to store potentially sensitive information on a smartphone; and are available on Android and iOS. The purpose of using these applications could be used to hide potential evidence or illicit photos. After comparing five different iOS photo vaults, each vault left evidence and photos behind. However, of the three forensic toolkits used, each produced different results in their scans of the phone. The media left behind was due to the photo vaults not protecting their information as claimed, and using basic obfuscation techniques in place of security controls. Future research will look at how newer security …

A Predictive Model To Predict Cyberattack Using Self-Normalizing Neural Networks, Oluwapelumi Eniodunmo

Theses, Dissertations and Capstones

Cyberattack is a never-ending war that has greatly threatened secured information systems. The development of automated and intelligent systems provides more computing power to hackers to steal information, destroy data or system resources, and has raised global security issues. Statistical and Data mining tools have received continuous research and improvements. These tools have been adopted to create sophisticated intrusion detection systems that help information systems mitigate and defend against cyberattacks. However, the advancement in technology and accessibility of information makes more identifiable elements that can be used to gain unauthorized access to systems and resources. Data mining and classification tools …

A Probabilistic Perspective Of Human-Machine Interaction, Mustafa Canan, Mustafa Demir, Samuel Kovacic

Engineering Management & Systems Engineering Faculty Publications

Human-machine interaction (HMI) has become an essential part of the daily routine in organizations. Although the machines are designed with state-of-the-art Artificial Intelligence applications, they are limited in their ability to mimic human behavior. The human-human interaction occurs between two or more humans; when a machine replaces a human, the interaction dynamics are not the same. The results indicate that a machine that interacts with a human can increase the mental uncertainty that a human experiences. Developments in decision sciences indicate that using quantum probability theory (QPT) improves the understanding of human decision-making than merely using classical probability theory (CPT). …

Examining Trends And Experiences Of The Last Four Years Of Socially Engineered Ransomware Attacks, William Seymour

Cybersecurity Undergraduate Research Showcase

This study examines and reports the trends of social engineering-based ransomware attacks over the past four years from three major technology corporations. The focus of the reports was on major threat actors and their attacks against the corporations and their clients. The data were organized chronologically by year, and prevalent or abnormal findings were shared in this report. It was found that social engineering attacks were tremendously effective. Many ransomware attacks stemmed from Phishing. Social engineering approaches allowed attackers to conduct breaches using ransomware applications like GandCrab and Ryuk. Humans are incredibly susceptible and fall for social engineering tactics- primarily …

Corporate Cybersecurity In The Context Of M&A Transactions, Cameron Beck

Cybersecurity Undergraduate Research Showcase

The rapid rise of digital devices has unlocked a new dimension of innovation and prosperity in the 21st century. Computers are now an integrated and ubiquitous part of our global culture. You would be hard-pressed to walk into any given room without several computer chips humming inaudibly inside the machines that facilitate our modern world. Even lightbulbs and doorbells are connected to the Internet, capturing information from the world around them and sending that information to the Cloud. The Internet expands access to communication, international marketplaces, entertainment, professional resources, and nearly every book in the world.

Random Password Generation, Kirk Smith

Cybersecurity Undergraduate Research Showcase

This paper will discuss the topic of random generation, first by explaining the topic, followed by how the literature review was performed. Then, a literature review will be performed, followed by a discussion of human biases and the strength of random password generation.

The Future Of Blockchain, Elijah N. Gartrell

Cybersecurity Undergraduate Research Showcase

Blockchain is the leading technology for cryptocurrencies, NFT’s and other online marketplace transactions that go through it because of it’s secure technology and how they distribute their data with Smart Contracts. This report shows how we can use Blockchain for other uses in our world and how it could advance us in the cybersecurity aspects. Showing also why we should use blockchain with basic cybersecurity concerns as in: Malware Detection, Voter Fraud, and Medical Record Security.

The “Office Of The Ciso”: A Framework For Chief Information Security Officers, Yael Nagler, Christophe Veltsos

Computer Information Science Department Publications

As we enter 2022, cybersecurity continues to challenge corporations and their CISOs. The sophistication of cyberthreats coupled with an evolving digital landscape has resulted in increased complexity and expanded responsibilities for the CISO. Simply put, there is greater scrutiny, greater regulation, greater complexity, and greater scope than ever before. To respond to these changes, CISOs must organize their “Office of the CISO” to meet the expectations and deliver for their organizations. Whether the CISO has a staff of three or thirty and whether they are prepared or not, these elements are being increasingly expected of CISOs. You can think of …