CERIAS Weekly Security Seminar - Purdue University

Increasingly, the United States is becoming more and more dependent on Space-based technologies and systems. Our adversaries are well aware of this and have become much more aggressive in their attempts to understand, infiltrate and interfere with Space-based operations, while watching the corresponding impacts to ground-based critical infrastructure. Mr. Keen will discuss that increasing dependen...

To secure connected products, developers and manufacturers must use tools and processes that are purpose built to analyze the complex binaries found within connected devices and embedded systems. Beyond the capabilities of traditional security tooling, dedicated product security (software supply chain security) tools must run in the specialized languages, systems, and deployment cycles for these c...

For 5 years, we have experimented with technology, people, and process controls at RELX, all designed to create an integrated framework for phishing mitigation. I'll speak about technology we've adopted (and that we haven't). I'll speak about failures in industry efforts (e.g., digital signatures). I'll speak about behavioral science and how we have adopted its concepts to drive behavior change. I...

The rise of enterprise cloud computing has brought an even greater emphasis on data. According to an analysis compiled by Statista, two zettabytes of data were created, captured, copied, and consumed globally in 2010. That figure will reach 97 zettabytes this year and 181 zettabytes by 2025. As the adoption of cloud computing continued to evolve, so did how enterprises approached securing their da...

Cybersecurity is inherently complicated due to the dynamic nature of the threats andever-expanding attack surfaces.  Ironically,this challenge is exacerbated by the rapid advancement of many new technologieslike Internet of Things (IoT) devices, 5G infrastructure, cloud-basedcomputing, etc.  This is where artificialintelligence (AI) and machine learning (ML) techniques can be called intoservice, a...

Whether you're implementing security policy or developing products, considering the human element is critical. Yet security professionals often fall victim to misconceptions and pitfalls that undermine users' ability to reach their full security potential. Grounded in real-world examples and human-centered research, this talk will explore how to recognize and overcome these pitfalls towards improv...

The Move Prover (MVP) is a formal verifier for smart contracts written In the Move programming language. MVP has an expressive specification language, and is fast and reliable enough that it can be run routinely by developers and in integration testing. Besides the simplicity of smart contracts and the Move language, three implementation approaches are responsible for the practicality of MVP: (1)...

People face increasing dangers from cyber enemies. At the same time, cyber pros are suffering from stress, burnout and "hamster wheel"syndrome. They experience many difficulties every day in easily protecting people and companies from danger. There is a different option. Cyber pros have the opportunity of better work-life balance, more rewarding careers and achieving their personal missions to bet...

Data deidentification aims to provide data owners with edible cake: to allow them to freely use, share, store and publicly release sensitive record data without risking the privacy of any of the individuals in the data set.   And, surprisingly, given some constraints, that's not impossible to do.    However, the behavior of a deidentification algorithm depends on the distribution of the data itsel...

 Students: This is a hybrid event. You are encouraged to attend in-person in STEW G-52As computing advances are making profound changes in our society, they also expose us to new security threats. While the impact of cyber attacks was often in our digital life in the past, our cyber world is increasingly intertwined with the physical world. Compromised safety-critical systems or critical infrastru...

Differential Privacy has become a widely used tool to protect privacy in data science applications.  In this talk, I will present two use cases for differential privacy: a) in collection of key-value statistics and b) as a protection against membership inference attacks.  Key-value statistics are commonly used to gather information about the use of software products.  Yet, the collector may be unt...

Often, policy makers and cybersecurity professionals talk about cybersecurity as if cybersecurity is only important insofar as it benefits or protects other assets or values. For example, it is common to hear people argue that cybersecurity is important because of its role in economic growth, or potential damage military operations. Those arguments are not wrong, but they fail to understand nation...

Use of Ransomware as a class of malware has exploded in recent years, causing millions in damages to organizations across the world. The damage isn't slowing down. On the contrary, ransomware as a tool is being adopted by a wide array of perpetrators. This includes nation-states, for cash, and to use the demand for cash to obfuscate activities like espionage and sabotage. Ransomware has become a p...

Authentication is a critical part to ensure the identity of a legitimate user. During authentication, an individual's credential is validated with a specific computational technique to determine the association of the user with his/her claimed identity. In this talk, I will discuss an adaptive multi-factor authentication (A-MFA) framework which uses adaptive selection of multiple modalities at dif...

There is no one bigger game changer in the world than technology and its uptake in every aspect of our lives including our collective future. Cybersecurity has become the top priority across the board. There is need for informed cybersecurity investments that consider sustainability, responsible data usage, being prepared for any crisis and being resilient. We have to enable a culture of responsib...

Students: This is a hybrid event. You are encouraged to attend in person in STEW 050B (G52)Common IT based Cyber techniques do not apply to many parts of the aviation industry. The aviation industry has to meet a number of Federal Aviation Regulations and using Industry provided standards show compliance to those regulations, perhaps for the life of the airplane after initial certification. Most a...

Visual misinformation, including fake, manipulated or out-of-context images and videos, is increasingly common on the Internet and social media platforms. Because of visuals' superior impression, retention, virality and persuasiveness, visual misinformation poses a significant threat to national security, social cohesion, and public health. Yet, we know very little about how users process and judg...

Students: This is a hybrid event. You are encouraged to attend in person in STEW 050B (G52)Space systems provide many critical functions to the military, federal agencies, and infrastructure networks. Space Policy Directive-5 Cybersecurity Principles for Space Systems describes both the cyber threat to space systems and the need for these systems to be secure and resilient against cyber-attacks. M...

The mission of the Cybersecurity Assurance and Policy (CAP) Center at Morgan State University is to provide the defense and intelligence community with the knowledge, methodology, solutions, and highly skilled cybersecurity professionals to mitigate penetration and manipulation of our nation's cyber-physical infrastructure. Internet of Things (IoT) devices permeate all areas of life and work, with...

With the rapidproliferation of pervasive electronic devices in our lives, the internet ofthings (IoT) has become a reality and its influence on our day to dayactivities is set to further increase with a projected 125 Billion connecteddevices by 2030. However, this poses serious security and privacy issues as wewill no longer have direct control over with whom and what our devicescommunicate. Count...

The mobile network (e.g., 4G LTE and 5G NR), the only large-scale wireless network infrastructure on par with the Internet, plays a critical role in interconnecting various mobile devices (e.g., smartphones, massive/critical IoT devices) and providing them with ubiquitous network services. In recent years, more users are accessing the Internet through mobile networks; since the first quarter of 20...

For at least two decades, the U.S. intelligence community and special projects agencies have been exploring the potential of prediction markets and crowd-forecasting platforms to better forecast geopolitical and technical trends. Similarly, a number of prominent corporations, including Google, Ford, Yahoo, Hewlett-Packard, and Eli Lilly, have likewise turned to these tools to predict everything fr...

Automated cyber defense tools require the ability to analyze binary applications, detect vulnerabilities and automatically patch or mitigate those vulnerabilities. The insertion of security mechanisms that operate at function boundaries (e.g, control flow mitigation, stack guards)require automated detection of those boundaries. This talk discusses the problem, related research and a new technique...

The war Russia has waged on Ukraine has seemed largely kinetic, but the most effective weapons weilded thus far have been consumer technologies. Putin has pursued a hybrid warfare strategy, yet the Ukrainians have fought his mendacious claims with the realities of conflict captured by mobile devices and social media. Bogged down by guerilla fighting in Ukrainian cities, Putin will view offensive c...

More than half the stored data in the world resides on hard drives. Yes, a 50+ year old technology is storing our photos, music, research, taxes, and more— and nobody blinks an eye. Given that over one zettabyte of hard drive storage shipped in 2020, this storage media is not going away anytime soon. We at Backblaze manage over 200,000 hard drives to store over 1.3 Exabytes of data. Since 2013 we...