 |
|
Commentary and Opinion
Review of the Web 2.0 Security and Privacy Workshop (Claremont Hotel, Berkeley, CA, May 20, 2010) by Sruthi Bandhavkavi
Review of the Conference on Detection of Intrusions and Malware & Vulnerability Assessment (Bonn, Germany, July 8-9, 2010) by Asia Slowinska and Johannes Hoffmann
Richard Austin's review of The Failure of Risk Management: Why Its Broken and How to Fix It by Douglas Hubbard
News:
Conference and Workshop Announcements
Cipher
calls-for-papers
and
calendar
(the calls-for-papers and the calendar announcements may differ
slightly in content or time of update):
WESS 2010 5th Workshop on Embedded Systems Security, Scottsdale, AZ, USA, October 24, 2010. (Submissions due 26 July 2010)
Embedded computing systems are widely found in application areas ranging from safety-critical systems to vital information management. This introduces a large number of security issues. Embedded systems are vulnerable to remote intrusion, local intrusion, fault-based and power/timing-based attacks, intellectual-property theft, subversion, hijacking and more. Due to their strong link to software engineering and hardware engineering, these security issues are different from the traditional security problems found on personal computers. For example, embedded devices are resource-constrained in power and performance, which requires them to use computationally efficient solutions. They have a very weak physical trust boundary, which enables many different implementation-oriented attacks. They use an intimate connection between hardware and software, often without the shielding of an operating system. This workshop provides a forum for researchers to present novel ideas on addressing security issues that arise in the design, the operation, and the testing of secure embedded systems. Of particular interest are security topics that are unique to embedded systems. Topics of Interest:
Journal of Network and Computer Applications, Special Issue on Trusted Computing and Communications, 2nd Quarter, 2011. (Submission Due 1 August 2010)
Guest editor: Laurence T. Yang (St. Francis Xavier University, Canada)
and Guojun Wang (Central South University, China)
With the rapid development and the increasing complexity of computer
and communications systems and networks, traditional security
technologies and measures can not meet the demand for integrated
and dynamic security solutions. As a challenging and innovative
research field, trusted computing and communications target computer
and communications systems and networks that are available, secure,
reliable, controllable, dependable, and so on. In a word, they must be
trustworthy. If we view the traditional security as identity trust,
the broader field of trusted computing and communications also
includes behavior trust of systems and networks. In fact, trusted
computing and communications have become essential components of
various distributed services, applications, and systems, including
self-organizing networks, social networks, semantic webs, e-commence,
and e-government. Research areas of relevance would therefore include,
but not only limited to, the following topics:
IEEE Software, Special Issue on Software Protection, March, 2011. (Submission Due 1 August 2010)
Guest editor: Paolo Falcarin (University of East London, UK),
Christian Collberg (University of Arizona, USA),
Mikhail Atallah (Purdue University, USA),
and Mariusz Jakubowski (Microsoft Research)
Software protection is an area of growing importance in software engineering
and security: leading-edge researchers have developed several pioneering
approaches for preventing or resisting software piracy and tampering,
building a heterogeneous body of knowledge spanning different topics:
obfuscation, information hiding, reverse engineering, source/binary
code transformation, operating systems, networking, encryption, and
trusted computing. IEEE Software seeks submissions for a special
issue on software protection. We seek articles that present proven
mechanisms and strategies to mitigate one or more of the problems
faced by software protection. These strategies should offer
practitioners appropriate methods, approaches, techniques, guidelines,
and tools to support evaluation and integration of software protection
techniques into their software products. Possible topics include:
INTRUST 2010 International Conference on Trusted Systems, Beijing, China, December 13-15, 2010. (Submissions due 1 August 2010)
INTRUST 2010 conference focuses on the theory, technologies and applications of trusted systems. It is devoted to all aspects of trusted computing systems, including trusted modules, platforms, networks, services and applications, from their fundamental features and functionalities to design principles, architecture and implementation technologies. The goal of the conference is to bring academic and industrial researchers, designers, and implementers together with end-users of trusted systems, in order to foster the exchange of ideas in this challenging and fruitful area. INTRUST 2010 solicits original papers on any aspect of the theory, advanced development and applications of trusted computing, trustworthy systems and general trust issues in modern computing systems. The conference will have an academic track and an industrial track. This call for papers is for contributions to both of the tracks. Submissions to the academic track should emphasize theoretical and practical research contributions to general trusted system technologies, while submissions to the industrial track may focus on experiences in the implementation and deployment of real-world systems.
NDSS 2011 Network & Distributed System Security Symposium, San Diego, California, USA, February 6-9, 2011. (Submissions due 6 August 2010)
The Network and Distributed System Security Symposium fosters information exchange among researchers and practitioners of network and distributed system security. The target audience includes those interested in practical aspects of network and distributed system security, with a focus on actual system design and implementation. A major goal is to encourage and enable the Internet community to apply, deploy, and advance the state of available network and distributed systems security technology. Special emphasis will be made to accept papers in the core theme of network and distributed systems security. Consequently, papers that cover networking protocols and distributed systems algorithms are especially invited to be submitted. Moreover, practical papers in these areas are also very welcome. Submissions are solicited in, but not limited to, the following areas:
CPSRT 2010 International Workshop on Cloud Privacy, Security, Risk & Trust, Held in conjunction with the 2nd IEEE International Conference on Cloud Computing Technology and Science (CloudCom 2010), Indianapolis, IN, USA, November 30 - December 3, 2010. (Submissions due 20 August 2010)
Cloud computing has emerged to address an explosive growth of web-connected devices, and handle massive amounts of data. It is defined and characterized by massive scalability and new Internet-driven economics. Yet, privacy, security, and trust for cloud computing applications are lacking in many instances and risks need to be better understood. Privacy in cloud computing may appear straightforward, since one may conclude that as long as personal information is protected, it shouldn't matter whether the processing is in a cloud or not. However, there may be hidden obstacles such as conflicting privacy laws between the location of processing and the location of data origin. Cloud computing can exacerbate the problem of reconciling these locations if needed, since the geographic location of processing can be extremely difficult to find out, due to cloud computing's dynamic nature. Another issue is user-centric control, which can be a legal requirement and also something consumers want. However, in cloud computing, the consumers' data is processed in the cloud, on machines they don't own or control, and there is a threat of theft, misuse or unauthorized resale. Thus, it may even be necessary in some cases to provide adequate trust for consumers to switch to cloud services. In the case of security, some cloud computing applications simply lack adequate security protection such as fine-grained access control and user authentication (e.g. Hadoop). Since enterprises are attracted to cloud computing due to potential savings in IT outlay and management, it is necessary to understand the business risks involved. If cloud computing is to be successful, it is essential that it is trusted by its users. Therefore, we also need studies on cloud-related trust topics, such as what are the components of such trust and how can trust be achieved, for security as well as for privacy. The CPSRT workshop will bring together a diverse group of academics as well as government and industry practitioners in an integrated state-of-the-art analysis of privacy, security, risk, and trust in the cloud. The workshop will address cloud issues specifically related to (but not limited to) the following topics of interest:
CT-RSA 2011 RSA Conference, The Cryptographers' Track, San Francisco, CA, USA, February 14-18, 2011. (Submissions due 20 August 2010)
The RSA Conference is the largest annual computer security event, with over 350 vendors, and thousands of attendees. The Cryptographers' Track (CT-RSA) is a research conference within the RSA Conference. CT- RSA has begun in 2002, and has become an established venue for presenting cryptographic research papers. Original research papers pertaining to all aspects of cryptography are solicited. Submissions may present applications, techniques, theory, and practical experience on topics including, but not limited to:
SAC-TRECK 2011 26th ACM Symposium on Applied Computing, Track: Trust, Reputation, Evidence and other Collaboration Know-how (TRECK), TaiChung, Taiwan, March 21-25, 2011. (Submissions due 24 August 2010)
The goal of the ACM SAC 2011 TRECK track remains to review the set of applications that benefit from the use of computational trust and online reputation. Computational trust has been used in reputation systems, risk management, collaborative filtering, social/business networking services, dynamic coalitions, virtual organisations and even combined with trusted computing hardware modules. The TRECK track covers all computational trust/reputation applications, especially those used in real-world applications. The topics of interest include, but are not limited to:
Wiley Security and Communication Networks (SCN), Special Issue on Defending Against Insider Threats and Internal Data Leakage, 2011. (Submission Due 31 August 2010)
Guest editor: Elisa Bertino (Purdue university, USA),
Gabriele Lenzini (SnT-Univ. of Luxembourg, Luxembourg),
Marek R. Ogiela (AGH University of Science & Technology, Poland),
and Ilsun You (Korean Bible University, Korea)
This special issue collects scientific studies and works reporting on the
most recent challenges and advances in security technologies and management
systems about protecting an organization's information from corporate malicious
activities. It aims to be the showcase for researchers that address the problems
on how to prevent the leakage of organizations' information caused by insiders.
The contributions to this special issue can conduct state-of-the-art surveys
and case-analyses of practical significance, which, we wish, will support and
foster further research and technology improvements related to this important
subject. Papers on practical as well as on theoretical topics are invited.
Topics include (but are not limited to):
IEEE Internet Computing, Special Issue on Security and Privacy in Social Networks, May/June 2011. (Submission Due 1 September 2010)
Guest editor: Gail-Joon Ahn (Arizona State University, USA),
Mohamed Shehab (UNC Charlotte, USA),
and Anna Squicciarini (Penn State University, USA)
Social networks where people exchange personal and public information have
enabled users to connect with their friends, coworkers, colleagues, family
and even with strangers. Several social networking sites have developed to
facilitate such social interactions and sharing activities on the Internet
over the past several years. The popularity of social networking sites on
the Internet introduces the use of mediatedcommunication into the
relationship development process. Also, online social networks have
recently emerged as a promising area of research with a vast reach
and application space. Users post information on their profiles to
share and interact with their other friends in the social network.
Social networks are not limited to simple entertaining applications;
instead several critical businesses have adopted social networks to
attract new customer spaces and to provide new services. The current
trends of social networks are indirectly requiring users to become
system and policy administrators for protecting their content in this
social setting. This is further complicated by the rapid growth rate
of social networks and by the continuous adoption of new services on
social networks. Furthermore, the use of personal information in
social networks raises entirely new privacy concerns and requires
new insights on security problems. Several studies and recent news
have highlighted the increasing risk of misuse of personal data
processed by online social networking applications and the lack
of awareness among the user population. The security needs of social
networks are still not well understood and are not fully defined.
Nevertheless it is clear these will be quite different from classic
security requirements. It is important to bring a depth of security
experience from multiple security domains and technologies to this
field as well as depth and breadth of knowledge about social networks.
The aim of this special issue is to encompass research advances in
all areas of security and privacy in social networks. We welcome
contributions relating to novel technologies and methodologies for
securely building and managing social networks and relevant secure
applications as well as to cross-cutting issues. Topics of interest
include but are not limited to:
In-Bio-We-Trust 2010 International Workshop on Bio-Inspired Trust Management for Information Systems, Held in conjunction with the Bionetics 2010, Boston, MA, USA, December 1-3, 2010. (Submissions due 1 September 2010)
Traditional security mechanisms fall short of what new information systems need. To fix this problem, two research communities have recently proposed new security mechanisms. One of those communities is called "bio-inspired systems" and is increasingly borrowing ideas from nature to make information systems more effective and robust. The other is called "trust management systems" and has been proposing and scrutinizing algorithms for information systems that mimic how people manage trust in society. Increasingly the two communities are working on similar research problems but, alas, they are doing so separately. Although there is an enormous number of potentially useful bio-inspired mechanisms that can be exploited in trust management, it comes as a surprise that bio-inspired trust management has not received any attention at all. Clearly,the dialog between researchers in bio-inspired systems and in trust management should widen. The workshop seeks to bring together the world's experts in both communities, and to stimulate and disseminate interesting research ideas and results. Contributions are solicited in all aspects of bio-inspired and trust management systems, including:
SecIoT 2010 1st Workshop on the Security of the Internet of Things, Held in conjunction with the Internet of Things 2010, Tokyo, Japan, November 29, 2010. (Submissions due 10 September 2010)
While there are many definitions of the Internet of Things (IoT), all of them revolve around the same central concept: a world-wide network of interconnected objects. These objets will make use of multiple technological building blocks, such as wireless communication, sensors, actuators, and RFID, in order to allow people and things to be connected anytime anyplace, with anything and anyone. However, before this new vision takes its first steps, it is essential to consider the security implications of billions of intelligent things cooperating with other real and virtual entities over the Internet. SecIoT'10 wants to bring together researchers and professionals from universities, private companies and Public Administrations interested or involved in all security-related heterogeneous aspects of the Internet of Things. We invite research papers, work-in-progress reports, R&D projects results, surveying works and industrial experiences describing significant security advances in the following (non-exclusive) areas of the Internet of Things:
ESSoS 2011 International Symposium on Engineering Secure Software and Systems, Madrid, Spain, February 9-10, 2011. (Submissions due 13 September 2010)
Trustworthy, secure software is a core ingredient of the modern world. Unfortunately, the Internet is too. Hostile, networked environments, like the Internet, can allow vulnerabilities in software to be exploited from anywhere. To address this, high-quality security building blocks (e.g., cryptographic components) are necessary, but insufficient. Indeed, the construction of secure software is challenging because of the complexity of modern applications, the growing sophistication of security requirements, the multitude of available software technologies and the progress of attack vectors. Clearly, a strong need exists for engineering techniques that scale well and that demonstrably improve the software's security properties. The Symposium seeks submissions on subjects related to its goals. This includes a diversity of topics including (but not limited to):
IEEE Transactions on Information Forensics and Security, Special Issue on Using the Physical Layer for Securing the Next Generation of Communication Systems, June 1, 2011. (Submission Due 15 September 2010)
Guest editor: Vincent Poor (Princeton University, USA),
Wade Trappe (Rutgers University, USA),
Aylin Yener (Pennsylvania State University,USA),
Hisato Iwai (Doshisha University, Japan),
Joao Barros (University of Porto, Portugal),
and Paul Prucnal (Princeton University, USA)
Communication technologies are undergoing a renaissance as there is a
movement to explore new, clean slate approaches for building communication
networks. Although future Internet efforts promise to bring new perspectives
on protocol designs for high-bandwidth, access-anything from anywhere services,
ensuring that these new communication systems are secure will also require a
re-examination of how we build secure communication infrastructures. Traditional
approaches to building and securing networks are tied tightly to the concept of
protocol layer separation. For network design, routing is typically considered
separately from link layer functions, which are considered independently of
transport layer phenomena or even the applications that utilize such functions.
Similarly, in the security arena, MAC-layer security solutions (e.g. WPA2 for
802.11 devices) are typically considered as point-solutions to address threats
facing the link layer, while routing and transport layer security issues are
dealt with in distinct, non-integrated protocols like IPSEC and TLS. The
inherent protocol separation involved in security solutions is only further
highlighted by the fact that the physical layer is generally absent from consideration.
This special issue seeks to provide a venue for ongoing research area in physical
layer security across all variety of communication media, ranging from wireless
networks at the edge to optical backbones at the core of the network. The
scope of this special issue will be interdisciplinary, involving contributions
from experts in the areas of cryptography, computer security, information
theory, signal processing, communications theory, and propagation theory. In
particular, the areas of interest include, but are not limited to, the following:
CODASPY 2011 1st ACM Conference on Data and Application Security and Privacy, San Antonio, TX, USA, February 21-23, 2011. (Submissions due 15 September 2010)
Data and the applications that manipulate data are the crucial assets in today's information age. With the increasing drive towards availability of data and services anytime anywhere, security and privacy risks have increased. New applications such as social networking and social computing provide value by aggregating input from numerous individual users and/or the mobile devices they carry with them and computing new information of value to society and individuals. Data and applications security and privacy has rapidly expanded as a research field with many important challenges to be addressed. The goal of the conference is to discuss novel exciting research topics in data and application security and privacy and to lay out directions for further research and development in this area. The conference seeks submissions from diverse communities, including corporate and academic researchers, open-source projects, standardization bodies, governments, system and security administrators, software engineers and application domain experts.
FC 2011 15th International Conference on Financial Cryptography and Data Security, Bay Gardens Beach Resort, St. Lucia, February 28 - March 4, 2011. (Submissions due 1 October 2010)
Financial Cryptography and Data Security is a major international forum for research, advanced development, education, exploration, and debate regarding information assurance, with a specific focus on commercial contexts. The conference covers all aspects of securing transactions and systems. Original works focusing on both fundamental and applied real-world deployments on all aspects surrounding commerce security are solicited. Submissions need not be exclusively concerned with cryptography. Systems security and inter-disciplinary efforts are particularly encouraged.
IFIP-DF 2011 7th Annual IFIP WG 11.9 International Conference on Digital Forensics, Orlando, Florida, USA, January 30 - February 2, 2011. (Submissions due 15 October 2010)
The IFIP Working Group 11.9 on Digital Forensics (www.ifip119.org) is an active international community of scientists, engineers and practitioners dedicated to advancing the state of the art of research and practice in the emerging field of digital forensics. The Seventh Annual IFIP WG 11.9 International Conference on Digital Forensics will provide a forum for presenting original, unpublished research results and innovative ideas related to the extraction, analysis and preservation of all forms of electronic evidence. Papers and panel proposals are solicited. All submissions will be refereed by a program committee comprising members of the Working Group. Papers and panel submissions will be selected based on their technical merit and relevance to IFIP WG 11.9. The conference will be limited to approximately sixty participants to facilitate interactions between researchers and intense discussions of critical research issues. Keynote presentations, revised papers and details of panel discussions will be published as an edited volume - the seventh in the series entitled Research Advances in Digital Forensics (Springer) in the summer of 2011. Revised and/or extended versions of selected papers from the conference will be published in special issues of one or more international journals. Technical papers are solicited in all areas related to the theory and practice of digital forensics. Areas of special interest include, but are not limited to:
SESOC 2011 3rd International Workshop on Security and Social Networking, Held in conjunction with the PerCom 2011, Seattle, WA, USA, March 21, 2011. (Submissions due 31 October 2010)
Future pervasive communication systems aim at supporting social and collaborative communications: the evolving topologies are expected to resemble the actual social networks of the communicating users and information on their characteristics can be a powerful aid for any network operation. New emerging technologies that use information on the social characteristics of their participants raise entirely new privacy concerns and require new reflections on security problems such as trust establishment, cooperation enforcement or key management. The aim of this workshop is to encompass research advances in all areas of security, trust and privacy in pervasive communication systems, integrating the social structure of the network as well. Topics of Interest include:
IEEE Network, Special Issue on Network Traffic Monitoring and Analysis, May 2011. (Submission Due 15 November 2010)
Guest editor: Wei Wang (University of Luxembourg, Luxembourg),
Xiangliang Zhang (University of Paris-sud 11, France),
Wenchang Shi (Renmin University of China, China),
Shiguo Lian (France Telecom R&D Beijing, China),
and Dengguo Feng (Chinese Academy of Sciences, China)
Modern computer networks are increasingly complex and ever-evolving.
Understanding and measuring such a network is a difficult yet vital
task for network management and diagnosis. Network traffic monitoring,
analysis and anomaly detection provides useful tools in understanding
network behavior and in determining network performance and reliability
so as to effectively troubleshoot and resolve the issues in practice.
Network traffic monitoring and anomaly detection also provides a basis
for prevention and reaction in network security, as intrusions, attacks,
worms, and other kinds of malicious behaviors can be detected by traffic
analysis and anomaly detection. This special issue seeks original
articles examining the state of the art, open issues, research results,
tool evaluation, and future research directions in network monitoring,
analysis and anomaly detection. Possible topics include:
Listing of academic positions available by
Cynthia Irvine
Posted June 2010
George Mason University
Department of Applied Information Technology
Fairfax, VA
Review of applications will continue until positions are filled
http://jobs.gmu.edu, Position number F9379z
Staying in touch....
Changing your email address? Please send updates to cipher@ieee-security.org
IEEE Computer Society's Technical Committee on Security and Privacy
| TC home page | TC Officers | |
| How to join the TC | TC publications available online | |
| TC Publications for sale | Cipher past issues archive | |
| IEEE Computer Society | Cipher Privacy Policy |