 |
|
Commentary and Opinion
Richard Austin's review of Beautiful Security: Leading Security Experts Explain How They Think by Andy Oram and Jon Viega, Eds.
Review of the ARO Workshop on Digital Forensics (Arlington, VA, September 10-11, 2009) by Yong Guan
NIST Publication on Key Establishment, from Elaine Barker
NIST Report on the Cryptographic Key Management Workshop, from Sarah Caswell
NIST SP 800-81 Rev. 1 DRAFT Secure Domain Name System (DNS) Deployment Guide
News Bits: Announcements and correspondence from readers (please contribute!)
Cipher
calls-for-papers
and
calendar
Calendar
(the calls-for-papers and the calendar announcements may differ
slightly in content or time of update):
FC 2010 Financial Cryptography and Data Security, Tenerife, Canary Islands, Spain, January 25-28, 2010. (Submissions due 15 September 2009) )
Financial Cryptography and Data Security is a major international forum for research, advanced development, education, exploration, and debate regarding information assurance, with a specific focus on commercial contexts. The conference covers all aspects of securing transactions and systems. Original works focusing on both fundamental and applied real-world deployments on all aspects surrounding commerce security are solicited. Submissions need not be exclusively concerned with cryptography. Systems security and inter-disciplinary efforts are particularly encouraged.
EC2ND 2009 5th European Conference on Computer Network Defence, Politecnico di Milano, Milano, Italy, November 12-13, 2009. (Submissions due 15 September 2009)
The theme of the conference is the protection of computer networks. The conference will draw participants from academia and industry in Europe and beyond to discuss hot topics in applied network and systems security. EC2ND invites submissions presenting novel ideas at an early stage with the intention to act as a discussion forum and feedback channel for promising, innovative security research. While our goal is to solicit ideas that are not completely worked out, and might have challenging and interesting open questions, we expect submissions to be supported by some evidence of feasibility or preliminary quantitative results. Topics include but are not limited to:
WiSec 2010 3rd ACM Conference on Wireless Network Security, Stevens Institute of Technology, Hoboken, NJ, USA, March 22-24, 2010. (Submissions due 21 September 2009)
As wireless networks become ubiquitous, their security gains in importance. The ACM Conference on Wireless Network Security (WiSec) aims at exploring attacks on wireless networks as well as techniques to thwart them. The considered networks encompass cellular, metropolitan, local area, vehicular, ad hoc, satellite, underwater, cognitive radio, and sensor networks, as well as RFID. Topics of interest include, but are not limited to:
ASIACCS 2010 5th ACM Symposium on Information, Computer and Communications Security, Beijing, China, April 13-16, 2010. (Submissions due 28 September 2009)
ASIACCS is a major international forum for information security researchers, practitioners, developers, and users to explore and exchange the latest cyber-security ideas, breakthroughs, findings, techniques, tools, and experiences. We invite submissions from academia, government, and industry presenting novel research on all theoretical and practical aspects of computer and network security. Topics of interest include, but are not limited to:
ESSoS 2010 2nd International Symposium on Engineering Secure Software and Systems, Pisa, Italy, February 3-4, 2010. (Submissions due 30 September 2009)
The goal of this symposium is to bring together researchers and practitioners to advance the states of the art and practice in secure software engineering. Being one of the few conference-level events dedicated to this topic, it explicitly aims to bridge the software engineering and security engineering communities, and promote cross-fertilization. The symposium will feature two days of technical program as well as one day of tutorials. The technical program includes an experience track for which the submission of highly informative case studies describing (un)successful secure software project experiences and lessons learned is explicitly encouraged. Topics of interest include, but are not limited to:
SecSE 2010 4th International Workshop on Secure Software Engineering, Held in conjunction with ARES 2010, Krakow, Poland, February 15-18, 2010. (Submissions due 30 September 2009)
Software is an integral part of everyday life, and we expect and depend upon software systems to perform correctly. Software security is about ensuring that systems continue to function correctly also under malicious attack. As most systems now are web-enabled, the number of attackers with access to the system increases dramatically and thus the threat scenario changes. The traditional approach to secure a system includes putting up defence mechanisms like IDS and firewalls, but such measures are no longer sufficient by themselves. We need to be able to build better, more robust and more secure systems. Even more importantly, however, we should strive to achieve these qualities in all software systems, not just the ones that need special protection. This workshop will focus on techniques, experiences and lessons learned for building secure and dependable software. Suggested topics include, but are not limited to:
SPattern 2010 4th International Workshop on Secure systems methodologies using patterns, Held in conjunction with the 5th International Conference on Availability, Reliability and Security (ARES 2010), Krakow, Poland, February 15-18, 2010. (Submissions due 1 October 2009)
Security patterns have arrived to a stage where there are a significant
number of them, two books about them have been published, and industry
is starting to accept and use them. Analysis and design patterns have
been around for about ten years and have found practical use in many projects.
They have been incorporated into several software development methodologies
where less experienced developers can use them to receive the advice and
knowledge of experts. The situation is not so clear for security patterns
because no accepted methodology exists for their use.
Catalogs of security patterns are a good step, but they are not enough.
Building secure systems is a difficult process where security aspects are
interlaced with the satisfaction of functional requirements. Developers
are typically experts on a language or a development methodology but know
little about security, which results in them not knowing what security
mechanisms make sense at which moments. We need methodologies that guide a
designer at each stage of the development cycle. A few of them have
appeared, but none of them has been tested in production applications.
This workshop focuses on secure software methodologies. We seek papers
describing individual security patterns, new methodologies, new aspects
of existing methodologies, pattern languages to use in the methodologies,
reference architectures, blueprints, and related aspects. Experiences in
applying the methodologies to real situations are especially welcome.
RFIDsec 2010 The 2010 Workshop on RFID Security, Singapore, February 22-23, 2010. (Submissions due 9 October 2009)
RFIDSec aims to provide a major forum to address the fundamental issues in theory and practice related to security and privacy issues, designs, standards, and case studies in the development of RFID systems and EPCglobal network. Papers representing original research in both the theory and practice concerning RFID security are solicited. Topics of interest include, but are not limited to:
Journal of System Architecture, Special Issue on Security and Dependability Assurance of Software Architectures, Spring 2010. (Submission Due 15 October 2009)
Guest editor: Ernesto Damiani (Università degli Studi di Milano, Italy),
Sigrid Gürgens (Fraunhofer Institute for Secure Information Technology, Germany),
Antonio Maña (Universidad de Málaga, Spain),
George Spanoudakis (City University, London, UK),
and Claudio A. Ardagna (Università degli Studi di Milano, Italy)
The JSA special issue will focus in particular on context, methodologies, techniques,
and tools for V&V of software architectures, with particular focus on supporting
assurance and compliance, as well as security and dependability certification,
for evolving and long-lived systems. Authors are invited to submit papers on a
variety of topics, including but not limited to:
WECSR 2010 Workshop on Ethics in Computer Security Research, Held in conjunction with the 14th International Conference on Financial Cryptography and Data Security (FC 2010), Tenerife, Canary Islands, Spain, January 28-29, 2010. (Submissions due 15 October 2009)
Computer security often leads to discovering interesting new problems and challenges. The challenge still remains to follow a path acceptable for Institutional Review Boards at academic institutions, as well as compatible with ethical guidelines for professional societies or government institutions. However, no exact guidelines exist for computer security research yet. This workshop will bring together computer security researchers, practitioners, policy makers, and legal experts. This workshop solicits submissions describing or suggesting ethical and responsible conduct in computer security research. While we focus on setting standards and sharing prior experiences and experiments in computer security research, successful or not, we tap into research behavior in network security, computer security, applied cryptography, privacy, anonymity, and security economics. This workshop will favor discussions among participants, in order to shape the future of ethical standards in the field.
SESOC 2010 International Workshop on SECurity and SOCial Networking, Mannheim, Germany, March 29 - April 2 2010. (Submissions due 18 October 2009)
Future pervasive communication systems aim at supporting social and collaborative communications: the evolving topologies are expected to resemble the actual social networks of the communicating users and information on their characteristics can be a powerful aid for any network operation. New emerging technologies that use information on the social characteristics of their participants raise entirely new privacy concerns and require new reflections on security problems such as trust establishment, cooperation enforcement or key management. The aim of this workshop is to encompass research advances in all areas of security, trust and privacy in pervasive communication systems, integrating the social structure of the network as well. Topics of interest include:
Springer Requirements Engineering journal, Special Issue on Digital Privacy: Theory, Policies and Technologies, Summer 2010. (Submission Due 31 October 2009)
Guest editor: Annie I. Anton (North Carolina State University, USA),
Travis D. Breaux (Institute for Defense Analyses, USA),
Stefanos Gritzalis (University of the Aegean, Greece),
and John Mylopoulos (University of Trento, Italy)
This special issue of the Requirements Engineering journal aims at providing
researchers and professionals with insights on the state-of-the-art in
Digital Privacy from the views of Theory, Policies and Technologies.
Topics of interest may include one or more of the following (but are
not limited to) themes:
Elsevier Computer Communications, Special Issue on Multimedia Networking and Security in Convergent Networks, Summer 2010. (Submission Due 1 November 2009)
Guest editor: Chang Wen Chen (University at Buffalo, USA),
Stefanos Gritzalis (University of the Aegean, Greece),
Pascal Lorenz (University of Haute Alsace, France),
and Shiguo Lian (France Telecom R&D Beijing, China)
Authors are invited to submit detailed technical manuscripts reporting recent
developments in the topics related to the special issue. Note the special emphasis
on convergent and heterogeneous networks this special issue is devoted to
exploring the challenges and solutions for multimedia communication and
security in convergent network environments. The new challenge in network
management is to deal with heterogeneous client capabilities as well as
dynamic end-to-end resources availability, and to ensure satisfactory
service quality for every client. The new challenge in secure communication
is to solve the privacy and security issues becoming increasingly important
topics in network convergence. Some suggested topics include but are not limited to:
IEEE Security & Privacy, Special Issue on Privacy-Preserving Sharing of Sensitive Information, July/August 2010. (Submission Due 15 November 2009)
Guest editor: Sal Stolfo (Columbia University, USA)
and Gene Tsudik (UC Irvine, USA)
Privacy-Preserving Sharing of Sensitive Information (PPSSI) is
motivated by the increasing need for organizations or people who don't
fully trust each other to share sensitive information. Many types of
organizations must often collect, analyze, and disseminate data
rapidly and accurately without exposing sensitive information to wrong
or untrusted parties. For example, census-takers collect private data
with the understanding that it won't be released in a form traceable
to the individual who provided it. Companies might be willing to
divulge sensitive financial data to organizations that release only
aggregate data for an industry sector. A hospital might share patient
information with a state health agency but only to allow the latter to
determine the number (and not the identities) of uninsured patients.
While statistical methods for protecting data have been in use for
decades, they're not foolproof and they generally involve a trusted
third party to produce privacy-preserving statistical digests. More
recently, techniques employing secure multi-party function evaluation,
encrypted keywords, and private information retrieval have been
studied and, in a few cases, deployed, However there are no practical
tools and technologies to guarantee data privacy, especially, whenever
organizations have certain common goals and require exchanges of
data. To this end, the objective of PPSSI technology is to enable
multiple entities to cooperate and share information without exposing
more than what is necessary to complete a common task. Potential
submission topics include (but are not limited to) the following:
SP 2010 31st IEEE Symposium on Security and Privacy, The Claremont Resort, Oakland, CA, USA, May 1619, 2010. (Submissions due 18 November 2009)
Since 1980, the IEEE Symposium on Security and Privacy has been the
premier forum for computer security research, presenting the latest
developments and bringing together researchers and practitioners. We
solicit previously unpublished papers offering novel research
contributions in any aspect of computer security or privacy. Papers
may present advances in the theory, design, implementation, analysis,
verification, or empirical evaluation of secure systems. S&P is
interested in all aspects of computer security and privacy. P apers
without a clear application to security or privacy, however, will be
considered out of scope and may be rejected without full
review.
*Systematization of Knowledge Papers*: In addition to the standard
research papers, we are also soliciting papers focused on
systematization of knowledge. The goal of this call is to encourage
work that evaluates, systematizes, and contextualizes existing
knowledge. These papers will provide a high value to our community but
would otherwise not be accepted because they lack novel research
contributions. Suitable papers include survey papers that provide
useful perspectives on major research areas, papers that support or
challenge long-held beliefs with compelling evidence, or papers that
provide an extensive and realistic evaluation of competing approaches
to solving specific problems. Submissions will be distinguished by a
checkbox on the submission form. They will be reviewed by the full PC
and held to the same standards as traditional research papers, except
instead of emphasizing novel research contributions the emphasis will
be on value to the community. Accepted papers will be presented at the
symposium and included in the proceedings.
*Workshops*:
The Symposium is also soliciting submissions for colocated workshops.
Workshop proposals should be sent by Friday, 21 August 2009 by email
to Carrie Gates (carrie.gates@ca.com). Workshops may be half-day or
full-day in length. Submissions should include the workshop title, a
short description of the topic of the workshop, and biographies of the
organizers.
TaPP 2010 2nd Workshop on the Theory and Practice of Provenance, Held in conjunction with the 8th USENIX Conference on File and Storage Technologies (FAST 2010), San Jose, CA, USA, February 22, 2010. (Submissions due 14 December 2009)
Provenance, or meta-information about computations, computer systems, database queries, scientific workflows, and so on, is emerging as a central issue in a number of disciplines. The TaPP workshop series builds upon a set of workshops on Principles of Provenance organized in 2007-2009, which helped raise the profile of this area within diverse research communities, such as databases, security, and programming languages. We hope to attract serious cross-disciplinary, foundational, and highly speculative research and to facilitate needed interaction with the broader systems community and with industry. We invite submissions addressing research problems involving provenance in any area of computer science, including but not limited to:
IFIP-TM 2010 4th IFIP International Conference on Trust Management, Morioka, Japan, June 16-18, 2010. (Submissions due 19 December 2009)
The mission of the IFIPTM 2010 Conference is to share research solutions to problems of Trust and Trust management, including related Security and Privacy issues, and to identify new issues and directions for future research and development work. IFIPTM 2010 invites submissions presenting novel research on all topics related to Trust, Security and Privacy, including but not limited to those listed below:
IFIP-CIP 2010 4th Annual IFIP WG 11.10 International Conference on Critical Infrastructure Protection, Fort McNair, Washington, DC, USA, March 1417, 2010. (Submissions due 31 December 2009)
The IFIP Working Group 11.10 on Critical Infrastructure Protection is an active international community of researchers, infrastructure operators and policy-makers dedicated to applying scientific principles, engineering techniques and public policy to address current and future problems in information infrastructure protection. Following the success of the first three conferences, the Fourth Annual IFIP WG 11.10 International Conference on Critical Infrastructure Protection will again provide a forum for presenting original, unpublished research results and innovative ideas related to all aspects of critical infrastructure protection. Papers are solicited in all areas of critical infrastructure protection. Areas of interest include, but are not limited to:
ACNS 2010 8th International Conference on Applied Cryptography and Network Security, Beijing, China, June 22-25, 2010. (Submissions due 5 February 2010)
Original papers on all aspects of applied cryptography and network security are solicited for submission to ACNS '10. Topics of relevance include but are not limited to:
Listing of academic positions available by
Cynthia Irvine
Staying in touch....
Changing your email address? Please send updates to cipher@ieee-security.org
IEEE Computer Society's Technical Committee on Security and Privacy
| TC home page | TC Officers | |
| How to join the TC | TC publications available online | |
| TC Publications for sale | Cipher past issues archive | |
| IEEE Computer Society | Cipher Privacy Policy |