CERIAS Weekly Security Seminar - Purdue University

Trustworthy operation of industrial control systems depends on secure and real-time code execution on the embedded programmable logic controllers (PLCs). The controllers monitor and control the critical infrastructures, such as electric power grids and healthcare platforms,and continuously report back the system status to human operators. This talk is about Zeus, a contactless embedded controller...

Smartspeakers, such as Amazon Echo, have been adopted by millions of users. However,the privacy impacts of smart speakers have not been well examined. We investigatethe privacy leakage of smart speakers under an encrypted traffic analysisattack, referred to as voice command fingerprinting. In this attack, anadversary eavesdrops encrypted voice traffic from and to a smart speaker andinfers which vo...

Most social platforms offer mechanisms allowing users to delete their posts, and a significant fraction of users exercise this right to be forgotten. However, ironically, users' attempt to reduce attention to sensitive posts via deletion, in practice, attracts unwanted attention from stalkers specifically to those (deleted) posts. Thus, deletions may leave users more vulnerable to attacks on their...

Anyone in this business knows how fun and exciting hacking can be, but also the emotional and physical toll it can take. Mental health is a longstanding dirty secret in the infosec community, and we are just now learning how to talk about it. The wear and tear of everyday stress combined with an 'always on' aspect of an operational environment creates a perfect storm for burning out. While stress...

The Internet of Things (IOT) is a potential massive market. However, the deployment of IOT brings forth many challenges across the dimensions of the business side (efficient supply chain) as well as the technical side (secure deployment). In order for the IOT promise to deliver massive volume, the marketplace must have secure, efficient, and effective ways to deploy and secure billions of devices...

Cryptocurrencies are the latest in a series of market bubbles that demonstrate irrational exuberance. In this lecture, Mitch Parker, CISO of IU Health, will go over previous market bubbles, and compare and contrast the differences between the security controls in two peer to peer exchange methods, the current US federal banking system, and Bitcoin. Through this, Mitch will demonstrate the need to...

GDPR/ NYDFS/ CCPA and other State, Federal and Supra-regional regulations coming online quickly. Governments are driving Security, Privacy & Compliance throughout the world. Since there is not an overriding set of Federal laws such as GLBA, many organizations in the US are unprepared for the upcoming deluge of regulations. Gain an understanding of what is coming and learn ways that you can hel...

Sure, you may know how to subnet a class "C" network into 64 different networks, but how about where to go to learn about technology that has yet to make it into a textbook? Or to find your next job? Or just somewhere where you can commensurate with someone who understands what you mean when you say, "That APT left the MSSP DOA!" This presentation will outline the OSINT and TTP's cyber security pr...

The global impact resulting from the distribution of doctored digital photographs has reached an epidemic proportion. These digitally altered photos are distributed through social media, news outlets, traditional web resources and are making their way into the mainstream media. The impact of these photos can dramatically change the way people think, act, react, believe and can ultimately cause har...

Nation-state adversaries have shown the ability to disrupt critical infrastructure through cyber-attacks targeting systems of networked, embedded computers. This knowledge raises concern that space systems could face similar threats. This project will research and develop moving target defense algorithms that will add cyber resilience to space systems by improving their ability to withstand cyber-...

Consider a scenario where a group of agents, each receiving partially informative private signals, aim to learn the true underlying state of the world that explains their collective observations. These agents might represent a group of individuals interacting over a social network, a team of autonomous robots tasked with detection, or even a network of processors trying to collectively solve a sta...

While made famous for the work that was done on the physical plastic cards many of carry around in our wallets, Mastercard is thinking way beyond those cards for the future. We'll walk through how Mastercard deploys its assets creating simple, safe and secure experiences for customers whether it is for payments or their identities.

This session provides observations regarding the process of moving the datacenter assets of a Top100 bank fully into the cloud. The Golden Rules providing security and assurance will be described. The gotchas, surprises, lessons learned, and resulting strategic changes are presented to raise awareness and prevent future mistakes by attendees. About the speaker: Steve Lodin is the Senior Director o...

Despite over 50 years of intensive research and experimentation, we still are plagued with systems that are fragile, compromised, and impossible to fully trust. There is near-daily news of compromises and losses, from criminals, nation-state actors, and vandals. The cyber ecosystem we have developed and upon which society is increasingly reliant appears to develop (or have exposed) a new vulnerabi...

As more disciplines leverage computational and data-driven modeling, the security of campus cyberinfrastructure is becoming increasingly important in order to protect intellectual property and secure a competitive advantage for researchers. Funded by the NSF Cybersecurity Innovation for Cyberinfrastructure (CICI) program, the Purdue Live Security Analyzer (PULSAR) project aims to enhance the cyber...

Learn about common attacks against online accounts, ways to protect your accounts against malicious actors, and the next generation of Identity standards and application architecture. About the speaker: Rob Mundt, is an Enterprise Security Architect at Eli Lilly and Company focused on the identity domain. Rob has been at Lilly for 18 years with a majority of that time focused on information securi...

About the speaker: Jim Routh is the Chief Security Officer for CVS Health and leads the Global Security function focused on cyber security for CVS Health businesses and converged security for the Aetna business division. He is former CSO for Aetna and the former Chair of the H-ISAC Board. He serves as a member of the Advisory Board of the ClearSky Security Fund. He was formerly the Global Head of...

Recent reports on how side-channel attacks can be used to obtain secret information stored in Cache memories and how current processors that rely on speculative execution of code aids in these side-channel attacks have caught the attention of everyone. Names such as Spectre and Meltdown describe how a well-resourced attacker can discover secret information such as passwords and cyber keys. Since t...

Within recent years, secure comparison protocols have been proposed using binary decomposition and properties of algebraic fields. These protocols have become increasingly efficient, but their performance has seemingly reached a plateau. We propose a new approach to this problem that transforms the comparison function into comparing specialized summations and takes advantage of dynamically switchi...

In this talk the concept of Cyber Physical Human Systems security in the context of aviation systems will be introduced. The talk will also coverthe proposed security framework involving the detecting and responding to the attacks. In addition, the talk will describe the results of vulnerability assessment experiments from Aviations Cyber-Physical Systems pespective and the simulation experiments...

Most sophisticated cyber attack follow the well-known cyber kill chain. The first step of the cyber kill chain is the reconnaissance phase where attacker probe the network in search of weakness, misconfiguration, vulnerabilities, and identify potential targets before the actual attack start. To this end, the attacker need to collect important information about the characteristics of each devices (...

Nowadays more and more data are gathered for detecting andpreventing cyber attacks. Unique to the cyber securityapplications, learning models face active adversaries that try todeceive learning models and avoid being detected. Hence futuredatasets and the training data no longer follow the samedistribution. The existence of such adversarial samplesmotivates the development of robust and resilient...

ARM possessors are being widely used on mobile devices and smart IoT devices. Despite the best efforts, an operating system is too hard to be absolutely secured on both x86 and ARM platforms. We addresse the problem of executing an unmodified application in a compromised OS for ARM platforms. Existing protection mechanisms mainly focus on x86 platform, utilizing SGX of Intel Processors or a hyperv...

Information, not just data, is key to today's security challenges. To solve these security challenges requires not only advancing computer science and big data analytics but requires new analysis and decision-making environments that enable reliable, decisions from trustable, understandable information. These environments are successful when they effectively couple human decision making with advan...

In application environments like international military coalitions or multi-party relief work in a disaster zone, passing secure messages using a Delay Tolerant Network (DTN) is challenging because the existing public-private key cryptographic approaches may not be always accessible across different groups due to the unavailability of Public Key Infrastructure (PKI). In addition, connectivity may...