CERIAS Weekly Security Seminar - Purdue University

Information security, and the technologies that provide such security, are a very hot topic throughout the information technology and business communities today. This presentation opens with a consideration of the current network environment. It answers the questions "where are these technologies?" and "where are the gaps in the technologies that are being addressed?" especially as they impact sec...

In order for e-commerce and e-business to grow at the fullest extent possible, higher levels of trust and accountability need to become established. The corporate buyers who rely on reliable structures need to hold those who build and support commercial network initiatives (call them "infrastructure and service providers") responsible for things that go wrong. Downtime, outages, viruses, data inte...

In today's increasingly dependent and interdependent global information society, information assurance for systems is gaining tremendous importance. Individuals, governments, and societies are insisting on secure and safe communications environments. The solution to providing those assurances lies in the formation of partnerships between and among business, academia and government. Mr. Fleming wil...

With the recent phenomenal growth of the availability and connectivity of computing resources and the advent of e-commerce, more valuable and private data is being stored online than ever before. But with greater value and availability comes greater threat. In this talk we examine the information security problem of anomaly detection --- recognizing the occurrence of ``out of the ordinary'' events...

With the advent of mobile code (excutable programs that are carried on web pages and inside E-Mail) in everyday use, the capability to include malicious software without the recipient's knowlege has been implicit. From the first crude examples ("Concept", 1995) through the "Russian New Year" exploits (1997-98), to the current surprises (Bubbleboy, 1999) there has been a continual advance in sophis...

How can one automatically identify classified documents? This is a vital question for the Department of Energy (DOE), which is reviewing millions of classified documents for possible declassification, and for Los Alamos National Laboratory (LANL), which is checking its unclassified computing storage systems for the presence of classified documents. The DOE, having already developed an expert rule...

The recent spate of attacks against Yahoo and other sites with large on-line presences brought denial-of-service attacks into the public consciousness. The methods used in these attacks make it very difficult, if not impossible, to locate the source of the attacks. The problem lies not only in finding the particular computers used to launch the attacks, but also in finding the individuals controll...

In October of 1999, Denver based Space Imaging launched the world's first very-high resolution commercial satellite, IKONOS 2, into polar orbit around the earth. For the first time in history, sub-1 meter near real time digital imagery is now available for virtually the entire globe to anyone with a credit card and access to the internet. This talk will explore: (1) the policy history around the U...

This paper explores a promising interface between natural language processing (NLP) and information assurance and security (IAS). More specifically, it is devoted to possible applications of the accumulated considerable resources in NLP to IAS. The paper is of a mixed theoretical and empirical nature. Of the four possible venues of applications, (i) memorizing randomly generated passwords with the...

Tripwire has a long history of openly available source, having been created at Purdue University in 1992 as a publicly available security tool. It has been created into an industrial strength tool, and has been successful in protecting critical enterprise processes in business and government. One of the decisions we made was to use a conventional shrink-wrapped software model -- in other words, so...

Many security breaches are caused by inappropriate inputs crafted by people with malicious intents. To enhance the system security, we need either to ensure that inappropriate inputs are filtered out by the program, or to ensure that only trusted people can access those inputs. In the second approach, we sure do not want to put such constraint on every input, instead, we only want to restrict the...

Information security is an inarticulate, incoherent, incomplete, incorrect folk art attempting to preserve confidentiality, integrity, and availability (CIA) of information from destruction, disclosure, use, and modification (DDUM). This CIA/DDUM framework is the equivalent of alchemy in the middle ages when the elements consisted of fire, water, earth, and air. We must have security based on a co...

This presentation will teach participants how to develop secure infrastructures in eCommerce by discussing security impacts to business applications, Netcentric security elements, and real stories from client experience. The presentation includes a thorough discussion of risk assessment methodology. About the speaker: Mr. Santarcangelo is a consultant in the Security Technologies Specialty for And...

As use of information technology continues to expand, the need to identify and preserve electronic evidence becomes a paramount. Once strictly the domain of law enforcement agencies, computer forensic examination has become a common part of litigation. Mr. Hansen will discuss a evolution of computer forensics, some of the ongoing legal and technical challenges that face a service provider in this...

This talk addresses the issue of reconciling the needs of law enforcement and national security with the continuing evolution of computer and communications technology. It will describe the needs of both the law enforcement and national security communities including their current technical requirements and solutions. It will then describe technological trends and show how technical imperatives wi...

In the past several years there has been an explosive growth in digital imaging technology and applications. Digital images and video are now widely distributed on the Internet and via CD-ROM. One problem with a digital image is that an unlimited number of copies of an "original" can be easily distributed and/or forged. This presents problems if the image is copyrighted. The protection and enforce...

Current research in information security at many labs are largely focused on traditional themes: firewalls, intrusion detection, cryptography, and computer viruses. However, there are other challenges that need to be addressed to provide a basis for protecting our information infrastructure. About the speaker: Dr. Eugene Spafford is a Distinguished Professor with an appointment in Computer Science...

Multicast routing is a service that provides for efficient many-to-many communication in a network. Traditionally, secure multicast protocols have used existing multicast routing services and relied on cryptographic protection of the messages sent to provide security. Much previous work in the area has been on methods of establishing a shared key between members subscribing to the multicast group....