CERIAS Weekly Security Seminar - Purdue University

People face increasing dangers from cyber enemies. At the same time, cyber pros are suffering from stress, burnout and "hamster wheel"syndrome. They experience many difficulties every day in easily protecting people and companies from danger. There is a different option. Cyber pros have the opportunity of better work-life balance, more rewarding careers and achieving their personal missions to bet...

Data deidentification aims to provide data owners with edible cake: to allow them to freely use, share, store and publicly release sensitive record data without risking the privacy of any of the individuals in the data set.   And, surprisingly, given some constraints, that's not impossible to do.    However, the behavior of a deidentification algorithm depends on the distribution of the data itsel...

 Students: This is a hybrid event. You are encouraged to attend in-person in STEW G-52As computing advances are making profound changes in our society, they also expose us to new security threats. While the impact of cyber attacks was often in our digital life in the past, our cyber world is increasingly intertwined with the physical world. Compromised safety-critical systems or critical infrastru...

Differential Privacy has become a widely used tool to protect privacy in data science applications.  In this talk, I will present two use cases for differential privacy: a) in collection of key-value statistics and b) as a protection against membership inference attacks.  Key-value statistics are commonly used to gather information about the use of software products.  Yet, the collector may be unt...

Often, policy makers and cybersecurity professionals talk about cybersecurity as if cybersecurity is only important insofar as it benefits or protects other assets or values. For example, it is common to hear people argue that cybersecurity is important because of its role in economic growth, or potential damage military operations. Those arguments are not wrong, but they fail to understand nation...

Use of Ransomware as a class of malware has exploded in recent years, causing millions in damages to organizations across the world. The damage isn't slowing down. On the contrary, ransomware as a tool is being adopted by a wide array of perpetrators. This includes nation-states, for cash, and to use the demand for cash to obfuscate activities like espionage and sabotage. Ransomware has become a p...

Authentication is a critical part to ensure the identity of a legitimate user. During authentication, an individual's credential is validated with a specific computational technique to determine the association of the user with his/her claimed identity. In this talk, I will discuss an adaptive multi-factor authentication (A-MFA) framework which uses adaptive selection of multiple modalities at dif...

There is no one bigger game changer in the world than technology and its uptake in every aspect of our lives including our collective future. Cybersecurity has become the top priority across the board. There is need for informed cybersecurity investments that consider sustainability, responsible data usage, being prepared for any crisis and being resilient. We have to enable a culture of responsib...

Students: This is a hybrid event. You are encouraged to attend in person in STEW 050B (G52)Common IT based Cyber techniques do not apply to many parts of the aviation industry. The aviation industry has to meet a number of Federal Aviation Regulations and using Industry provided standards show compliance to those regulations, perhaps for the life of the airplane after initial certification. Most a...

Visual misinformation, including fake, manipulated or out-of-context images and videos, is increasingly common on the Internet and social media platforms. Because of visuals' superior impression, retention, virality and persuasiveness, visual misinformation poses a significant threat to national security, social cohesion, and public health. Yet, we know very little about how users process and judg...

Students: This is a hybrid event. You are encouraged to attend in person in STEW 050B (G52)Space systems provide many critical functions to the military, federal agencies, and infrastructure networks. Space Policy Directive-5 Cybersecurity Principles for Space Systems describes both the cyber threat to space systems and the need for these systems to be secure and resilient against cyber-attacks. M...

The mission of the Cybersecurity Assurance and Policy (CAP) Center at Morgan State University is to provide the defense and intelligence community with the knowledge, methodology, solutions, and highly skilled cybersecurity professionals to mitigate penetration and manipulation of our nation's cyber-physical infrastructure. Internet of Things (IoT) devices permeate all areas of life and work, with...

With the rapidproliferation of pervasive electronic devices in our lives, the internet ofthings (IoT) has become a reality and its influence on our day to dayactivities is set to further increase with a projected 125 Billion connecteddevices by 2030. However, this poses serious security and privacy issues as wewill no longer have direct control over with whom and what our devicescommunicate. Count...

The mobile network (e.g., 4G LTE and 5G NR), the only large-scale wireless network infrastructure on par with the Internet, plays a critical role in interconnecting various mobile devices (e.g., smartphones, massive/critical IoT devices) and providing them with ubiquitous network services. In recent years, more users are accessing the Internet through mobile networks; since the first quarter of 20...

For at least two decades, the U.S. intelligence community and special projects agencies have been exploring the potential of prediction markets and crowd-forecasting platforms to better forecast geopolitical and technical trends. Similarly, a number of prominent corporations, including Google, Ford, Yahoo, Hewlett-Packard, and Eli Lilly, have likewise turned to these tools to predict everything fr...

Automated cyber defense tools require the ability to analyze binary applications, detect vulnerabilities and automatically patch or mitigate those vulnerabilities. The insertion of security mechanisms that operate at function boundaries (e.g, control flow mitigation, stack guards)require automated detection of those boundaries. This talk discusses the problem, related research and a new technique...

The war Russia has waged on Ukraine has seemed largely kinetic, but the most effective weapons weilded thus far have been consumer technologies. Putin has pursued a hybrid warfare strategy, yet the Ukrainians have fought his mendacious claims with the realities of conflict captured by mobile devices and social media. Bogged down by guerilla fighting in Ukrainian cities, Putin will view offensive c...

More than half the stored data in the world resides on hard drives. Yes, a 50+ year old technology is storing our photos, music, research, taxes, and more— and nobody blinks an eye. Given that over one zettabyte of hard drive storage shipped in 2020, this storage media is not going away anytime soon. We at Backblaze manage over 200,000 hard drives to store over 1.3 Exabytes of data. Since 2013 we...

Precis: The United States encountered digital cyberspace with the gradual rise of digital technology, treating cyberspace as an electromagnetic domain. China encountered cyberspace more swiftly, surpassing several years ago the United States in the number of people connected in cyberspace (now approximately one billion people), treating cyberspace as a domain of human behavior. For the United Stat...

The electric power grid is a complex cyber-physical system that forms the lifeline of a modern society. Its reliable and secure operation is of paramount importance to national security and economic well-being. The power grid today is a highly automated network, wherein a variety of communication networks and information systems are interconnected to the physical grid for the purpose of monitoring...

The Metaverse is coming. What is the Metaverse? A massive, infinitely scalable, shared virtual world where land, buildings, bots, avatars and other property can be bought sold and persist. Think of it as the future convergence of all of today's virtual worlds, interconnected with a single settlement layer for totally interoperable transactions. The Metaverse will be accessible by billions via any...

The complexities of and losses from a shoddily created cyberspace substrate continue to hollow the economies and national power of consolidated democracies.  As China rises as a strategically focused and digitally aggressive authoritarian giant, it is critical that democratic leaders both understand the reality they face and how an institutional alternative may be created to avoid being weak cyber...

Threat modeling is an extremely valuable tool in the secure software development pipeline. Some studies suggest it has greater impact on security posture than other more widely practiced security activities. There are many different frameworks, models, and methodologies that have been developed in an attempt to make threat modeling easier. Yet, despite these efforts, popular approaches to threat m...

Cyber-physical systems are delivering an increasing portion of the infrastructure services at the heart of our economy and national security, and you don't have to look far for examples of technology-enabled, industrial control, and the internet-of-things in the core operations of healthcare, food and agriculture, energy, transportation, or manufacturing. Further, one has only to look at the conte...

As we begin 2022, the cost, sophistication, and lethality of cyber-breaches continues to rise. Threat actors, especially state-sponsored, and criminal enterprises are taking advantage of the expanding cyber-attack surface by using their resources to employ more sophisticated means for discovering target vulnerabilities, automating phishing, and finding new deceptive paths for infiltrating malware....