Information Security Commons^™

Cis 356: Fundamentals Of Cybersecurity And Intelligence Gathering - Vulnerabilities And Exploits, Fahad Chowdhury, Nyc Tech-In-Residence Corps

Open Educational Resources

Lecture for the course: CIS 356: Fundamentals of Cybersecurity and Intelligence Gathering - "Vulnerabilities and Exploits" (Week Two) delivered at Lehman College in Spring 2020 by Fahad Chowdhury as part of the Tech-in-Residence Corps program.

Cis 356: Fundamentals Of Cybersecurity And Intelligence Gathering - Encryption And Hashing, Fahad Chowdhury, Nyc Tech-In-Residence Corps

Open Educational Resources

Lecture for the course: CIS 356: Fundamentals of Cybersecurity and Intelligence Gathering - "Encryption and Hashing" (Week Four) delivered at Lehman College in Spring 2020 by Fahad Chowdhury as part of the NYC Tech-in-Residence Corps program.

Cis 356-Zi81: Intermediate-Level Topics In Computer Applications (Spring 2020), Fahad Choudhury, Nyc Tech-In-Residence Corps

Open Educational Resources

Syllabus for CIS 356-ZI81: Intermediate-Level Topics in Computer Applications (Spring 2020)

Geopolitics And The Digital Domain: How Cyberspace Is Impacting International Security, Georgia Wood

Independent Study Project (ISP) Collection

The digital domain is the emerging environment for which the internet and data connectivity exists. This new domain is challenging the traditional place for geopolitics to exist, and creating new challenges to international relations. The use of cyberweapons through direct cyberattacks, such as the possibility of an attack on the U.S. power grid, or misinformation campaigns, such as the one launched by Russia against the 2016 U.S. Presidential election, can expand the international threat landscape. While these new threats increase, states are widely not prepared to address the new challenges in the digital domain. This paper will use three primary …

Attribute-Based Cloud Data Integrity Auditing For Secure Outsourced Storage, Yong Yu, Yannan Li, Bo Yang, Willy Susilo, Guomin Yang, Jian Bai

Research Collection School Of Computing and Information Systems

Outsourced storage such as cloud storage can significantly reduce the burden of data management of data owners. Despite of a long list of merits of cloud storage, it triggers many security risks at the same time. Data integrity, one of the most burning challenges in secure cloud storage, is a fundamental and pivotal element in outsourcing services. Outsourced data auditing protocols enable a verifier to efficiently check the integrity of the outsourced files without downloading the entire file from the cloud, which can dramatically reduce the communication overhead between the cloud server and the verifier. Existing protocols are mostly based …

Cis 356: Fundamentals Of Cybersecurity And Intelligence Gathering - Hackers, Fahad Chowdhury, Nyc Tech-In-Residence Corps

Open Educational Resources

Lecture for the course: CIS 356: Fundamentals of Cybersecurity and Intelligence Gathering - "Hackers" (Week Three) delivered at Lehman College in Spring 2020 by Fahad Chowdhury as part of the NYC Tech-in-Residence Corps program.

Leakage-Resilient Biometric-Based Remote User Authentication With Fuzzy Extractors, Yangguang Tian, Yingjiu Li, Binanda Sengupta, Nan Li, Chunhua Su

Research Collection School Of Computing and Information Systems

Fuzzy extractors convert biometrics and other noisy data into a cryptographic key for security applications such as remote user authentication. Leakage attacks, such as side channel attacks, have been extensively modelled and studied in the literature. However, to the best of our knowledge, leakage attacks to biometric-based remote user authentication with fuzzy extractors have never been studied rigorously. In this paper, we propose a generic framework of leakage-resilient and privacy-preserving biometric-based remote user authentication that allows an authorized user to securely authenticate herself to a remote authentication server using her biometrics. In particular, the authorized user relies only on her …

Byod-Insure: A Security Assessment Model For Enterprise Byod, Melva Ratchford

Masters Theses & Doctoral Dissertations

As organizations continue allowing employees to use their personal mobile devices to access the organizations’ networks and the corporate data, a phenomenon called ‘Bring Your Own Device’ or BYOD, proper security controls need to be adopted not only to secure the corporate data but also to protect the organizations against possible litigation problems. Until recently, current literature and research have been focused on specific areas or solutions regarding BYOD. The information associated with BYOD security issues in the areas of Management, IT, Users and Mobile Device Solutions is fragmented. This research is based on a need to provide a holistic …

Account Recovery Methods For Two-Factor Authentication (2fa): An Exploratory Study, Lauren Nicole Tiller

Psychology Theses & Dissertations

System administrators have started to adopt two-factor authentication (2FA) to increase user account resistance to cyber-attacks. Systems with 2FA require users to verify their identity using a password and a second-factor authentication device to gain account access. This research found that 60% of users only enroll one second-factor device to their account. If a user’s second factor becomes unavailable, systems are using different procedures to ensure its authorized owner recovers the account. Account recovery is essentially a bypass of the system’s main security protocols and needs to be handled as an alternative authentication process (Loveless, 2018). The current research aimed …

Identity-Based Encryption Transformation For Flexible Sharing Of Encrypted Data In Public Cloud, Robert H. Deng, Zheng Qin, Qianhong Wu, Zhenyu Guan, Robert H. Deng, Yujue Wang, Yunya Zhou

Research Collection School Of Computing and Information Systems

With the rapid development of cloud computing, an increasing number of individuals and organizations are sharing data in the public cloud. To protect the privacy of data stored in the cloud, a data owner usually encrypts his data in such a way that certain designated data users can decrypt the data. This raises a serious problem when the encrypted data needs to be shared to more people beyond those initially designated by the data owner. To address this problem, we introduce and formalize an identity-based encryption transformation (IBET) model by seamlessly integrating two well-established encryption mechanisms, namely identity-basedencryption (IBE) and …

Energy-Efficient Distance-Bounding With Residual Charge Computation, Yunhui Zhuang, Anjia Yang, Gerhard Hancke, Duncan S. Wong, Guomin Yang

Research Collection School Of Computing and Information Systems

Real-time location systems are often required in industrial applications. In addition to securely determining an item's location, these systems also need to accommodate energy-limited tracking tokens. Distance-bounding protocols enable a Verifier to cryptographically determine an upper-bound on the physical distance to a Prover by measuring the round-trip time of specially designed challenge-response messages. This type of protocols serve as countermeasure to three common attacks on location-based systems and have been extensively studied with the goal of achieving optimal security bounds for the respective attacks. In this paper, we propose a new energy-efficient distance-bounding protocol that protects against all three common …

On The Security Of Lwe Cryptosystem Against Subversion Attacks, Zhichao Yang, Rongmao Chen, Chao Li, Longjiang Qu, Guomin Yang

Research Collection School Of Computing and Information Systems

Subversion of cryptography has received wide attentions especially after the Snowden Revelations in 2013. Most of the currently proposed subversion attacks essentially rely on the freedom of randomness choosing in the cryptographic protocol to hide backdoors embedded in the cryptosystems. Despite the fact that significant progresses in this line of research have been made, most of them mainly considered the classical setting, while the research gap regarding subversion attacks against post-quantum cryptography remains tremendous. Inspired by this observation, we investigate a subversion attack against existing protocol that is proved post-quantum secure. Particularly, we show an efficient way to undetectably subvert …

Front Matter

Journal of Digital Forensics, Security and Law

No abstract provided.

Developing A Serious Game To Explore Joint All Domain Command And Control, Nathaniel W. Flack

Theses and Dissertations

Changes in the geopolitical landscape and increasing technological complexity have prompted the U.S. Military to coin Multi-Domain Operations (MDO) and Joint All-Domain Command and Control as terms to describe an over-arching strategy that frames the complexity of warfare across both traditional and emerging warfighting domains. Teaching new and advanced concepts associated with these terms requires both innovation as well as distinct education and training tools in order to realize the cultural change advocated by senior military leaders. BSN, a Collectible Card Game, was developed to teach concepts integral to MDO and initiate discussion on military strategy.

Near Real-Time Zigbee Device Discrimination Using Cb-Dna Features, Yousuke Z. Matsui

Theses and Dissertations

Currently, Low-Rate Wireless Personal Area Networks (LR-WPAN) based on the Institute of Electrical and Electronics Engineers (IEEE) 802.15.4 standard are at risk due to open-source tools which allow bad actors to exploit unauthorized network access through various cyberattacks by falsifying bit-level credentials. This research investigates implementing a Radio Frequency (RF) air monitor to perform Near RealTime (NRT) discrimination of Zigbee devices using the IEEE 802.15.4 standard. The air monitor employed a Multiple Discriminant Analysis/Euclidean Distance classifier to discriminate Zigbee devices based upon Constellation-Based Distinct Native Attribute (CB-DNA) fingerprints. Through the use of CB-DNA fingerprints, Physical Layer (PHY) characteristics unique to …

Honeyhive - A Network Intrusion Detection System Framework Utilizing Distributed Internet Of Things Honeypot Sensors, Zachary D. Madison

Theses and Dissertations

Exploding over the past decade, the number of Internet of Things (IoT) devices connected to the Internet jumped from 3.8 billion in 2015 to 17.8 billion in 2018. Because so many IoT devices remain upatched, unmonitored, and left on, they have become a tantalizing target for attackers to gain network access or add another device to their botnet. HoneyHive is a framework that uses distributed IoT honeypots as Network Intrusion Detection Systems (NIDS) sensors that beacon back to a centralized Command and Control (C2) server. The tests in this experiment involve four types of scans and four levels of active …

Automated Extraction Of Network Activity From Memory Resident Code, Austin Nicholas Sellers

LSU Master's Theses

Advancements in malware development, including the use of file-less and memory-only payloads, have led to a significant interest in the use of volatile memory analysis by digital forensics practitioners. Memory analysis can uncover a wealth of information not available via traditional analysis, such as the discovery of injected code, hooked APIs, and more. Unfortunately, the process of analyzing such malicious code is largely left to analysts who must manually reverse engineer the code to discover its intent. This task is not only slow and error-prone, but is also generally left only to senior-level analysts to perform, given that significant reverse …

All You Need To Know About Cybersecurity Ever! In 45 Minutes, Joe Beckman

Purdue Road School

This session will cover the information every local government official needs to know to keep their data safe from hackers.

Data Mining Of Chinese Social Networks: Factors That Indicate Post Deletion, Meisam Navaki Arefi

Computer Science ETDs

Widespread Chinese social media applications such as Sina Weibo (Chinese Twitter), the most popular social network in China, are widely known for monitoring and deleting posts to conform to Chinese government requirements. Censorship of Chinese social media is a complex process that involves many factors. There are multiple stakeholders and many different interests: economic, political, legal, personal, etc., which means that there is not a single strategy dictated by a single government authority. Moreover, sometimes Chinese social media do not follow the directives of government, out of concern that they are more strictly censoring than their competitors.

One crucial question …

Encryption Decrypted, Alex Ramsey

UNO Student Research and Creative Activity Fair

Encryption is a complex and bewildering process, yet it is absolutely foundational for secure and safe activities on the internet. Encryption, in its many forms, ultimately enables identity verification, password protection, secure conversation, cryptocurrency trade, and other online activities. Despite this widespread use, encryption is not a process easily explained to the layperson due to its complexity. Thus, the object of this research is to demystify the process of encryption and provide an understanding of one of the most common forms of modern encryption - RSA Encryption. This will be accomplished through the information provided on my poster as well …