 |
|
Commentary and Opinion
Richard Austin's review of SQL Injection Attacks and Defense by Justin Clarke
Book announcement of Surveillance or Security?: The Risks Posed by New Wiretapping Technologies by Susan Landau
News Items
Announcements and correspondence from readers (please contribute!)
Listing of academic positions available by
Cynthia Irvine
Staying in touch....
Conference and Workshop Announcements
Cipher
calls-for-papers
and
calendar
Calendar
(the calls-for-papers and the calendar announcements may differ
slightly in content or time of update):
Cipher calendar announcements are on Twitter; follow "ciphernews"
CSC 2011 Workshop on Cryptography and Security in Clouds, Zurich, Switzerland, March 15-16, 2011. (Abstract Submissions due 17 January 2011)
The cloud computing model offers cheap access to a variety of standardized services, but comes with concerns about the correctness, privacy, and integrity of remote data and computations. Cryptographic mechanisms can reduce such trust by allowing the user to protect its data and computations, as well as to verify aspects of remote computation. The aim of this workshop is to bring together researchers and practitioners working in cryptography and security, from academia and industry, who are interested in the security of current and future cloud computing technology. The workshop considers the viewpoint of cloud-service providers as well as the concerns of cloud users. The goal is to create a dialogue about common goals and to discuss solutions for security problems in cloud computing, with emphasis on cryptographic methods. Topics of interest include:
HOST 2011 4th IEEE International Sympoium on Hardware-Oriented Security and Trust, San Diego, CA, June 5-6, 2011. (Submissions due 19 January 2011)
A wide range of applications, from secure RFID tagging to high-end trusted computing, relies on dedicated and trusted hardware platforms. The security and trustworthiness of such hardware designs are critical to their successful deployment and operation. Recent advances in tampering and reverse engineering show that important challenges lie ahead. For example, secure electronic designs may be affected by malicious circuits, Trojans that alter system operation. Furthermore, dedicated secure hardware implementations are susceptible to novel forms of attack that exploit side-channel leakage and faults. Third, the globalized, horizontal semiconductor business model raises concerns of trust and intellectual-property protection. HOST 2011 is a forum for novel solutions to address these challenges. Innovative test mechanisms may reveal Trojans in a design before they are able to do harm. Implementation attacks may be thwarted using side-channel resistant design or fault-tolerant designs. New security-aware design tools can assist a designer in implementing critical and trusted functionality, quickly and efficiently. HOST 2011 seeks contributions based on, but not limited to, the following topics:
ACNS 2011 9th International Conference on Applied Cryptography and Network Security, Nerja, Malaga, Spain, June 7-10, 2011. (Submissions due 21 January 2011)
Original papers on all aspects of applied cryptography as well as computer/network security and privacy are solicited. Topics of interest include, but are not limited to:
DIMVA 2011 8th International Conference on Detection of Intrusions and Malware & Vulnerability Assessment, Amsterdam, The Netherlands, July 7-8, 2011. (Submissions due 21 January 2011)
The annual DIMVA conference serves as a premier forum for advancing the
state of the art in intrusion detection, malware detection, and
vulnerability assessment. DIMVA's scope includes, but is not restricted
to the following areas:
Intrusion Detection
LEET 2011 4th USENIX Workshop on Large-Scale Exploits and Emergent Threats, Boston, MA, USA, March 29, 2011. (Submissions due 25 January 2011)
Now in its fourth year, LEET continues to provide a unique forum for the discussion of threats to the confidentiality of our data, the integrity of digital transactions, and the dependability of the technologies we increasingly rely on. We encourage submissions of papers that focus on the malicious activities themselves (e.g., reconnaissance, exploitation, privilege escalation, rootkit installation, attack), our responses as defenders (e.g., prevention, detection, and mitigation), or the social, political, and economic goals driving these malicious activities and the legal and ethical codes guiding our defensive responses. Topics of interest include but are not limited to:
IH 2011 13th Information Hiding Conference, Prague, Czech Republic, May 18-20, 2011. (Submissions due 31 January 2011)
For many years, Information Hiding has captured the imagination of researchers. Digital watermarking and steganography protect information, conceal secrets or are used as core primitives in digital rights management schemes. Steganalysis and forensics pose important challenges to investigators; and privacy techniques try to hide relational information such as the actors' identities in anonymous communication systems. These and other topic share the notion that security is defined by the difficulty to make (or avoid) inference on certain properties of host data, which therefore has to be well understood and modeled. Current research themes include:
D-SPAN 2011 2nd IEEE International Workshop on Data Security and PrivAcy in wireless Networks, Held in conjunction with IEEE WoWMoM 2011, Lucca, Italy, June 20, 2011. (Submissions due 4 February 2011)
D-SPAN 2011, the Second International Workshop on Data Security and PrivAcy in wireless Networks (D-SPAN), is focused on defining new problems and developing novel techniques for data security and privacy issues in wireless and mobile networks. With the emergence of data-intensive wireless networks such as wireless sensor networks and data-centric mobile applications such as location-based services, the traditional boundaries between these three disciplines are blurring. This workshop solicits papers from two main categories: (1) papers that consider the security and privacy of data collection, transmission, storage, publishing, and sharing in wireless networks broadly defined, e.g., MANET, cellular, vehicular, ad hoc, cognitive, as well as sensor networks, and (2) papers that use data analytics techniques to address security and privacy problems in wireless networks. The workshop provides a venue for researchers to present new ideas with impact on three communities: wireless networks, databases, and security. The list of topics includes, but not limited to:
CSF 2011 24th IEEE Computer Security Foundations Symposium, Domaine de l'Abbaye des Vaux-de-Cernay, France, June 27-29, 2011. (Submissions due 9 February 2011)
New theoretical results in computer security are welcome. Also welcome are more exploratory presentations, which may examine open questions and raise fundamental concerns about existing theories. Panel proposals are sought as well as papers. Possible topics include, but are not limited to:
USENIX Security 2011 20th USENIX Security Symposium, San Francisco, CA, USA, August 10-12, 2011. (Submissions due 10 February 2011)
The USENIX Security Symposium brings together researchers, practitioners, system administrators, system programmers, and others interested in the latest advances in the security of computer systems and networks. Refereed paper submissions are solicited in all areas relating to systems and network security, including:
SAR/SSI 2011 International Conference on Network and Information Systems Security, La Rochelle, France, May 18-21, 2011. (Submissions due 14 February 2011)
The SAR-SSI conference series provides a forum for presenting novel research results, practical experiences and innovative ideas in network and information systems security. The goal of SAR-SSI-2011 is fostering exchanges among academic researchers, industry and a wider audience interested in network and information system security. The conference will offer a broad area of events, ranging from panels, tutorials, technical presentations and informal meetings. Prospective authors are encouraged to submit papers describing novel research contributions as well as proposals for tutorials and panels.
DBSec 2011 25th Annual WG 11.3 Conference on Data and Applications Security and Privacy, Richmond, Virginia, USA, July 11-13, 2011. (Submissions due 14 February 2011)
The 25th Annual WG 11.3 Conference on Data and Applications Security and Privacy provides a forum for presenting original unpublished research results, practical experiences, and innovative ideas in data and applications security. Both research papers and panel proposals are solicited. Papers may present theory, techniques, applications, or practical experience on topics of relevance to IFIP WG 11.3:
TRUST 2011 4th International Conference on Trust and Trustworthy Computing, Pittsburgh, PA, USA, June 22-24, 2011. (Submissions due 15 February 2011)
This conference focuses on trusted and trustworthy computing, both from
the technical and social perspectives. The conference itself has two main
strands, one devoted to technical aspects and one devoted to socio-economic
aspects of trusted computing. The conference solicits original papers on
any aspect (technical or social and economic) of the design, application
and usage of trusted and trustworthy computing, which concerns a broad range
of concepts including trustworthy infrastructures, cloud computing, services,
hardware, software and protocols. Topics of interest include, but are not
limited to:
Technical Strand
ID 2011 ACM/Springer International Workshop on Identity: Security, Management & Applications, Kochi, Kerala, India, July 22-24, 2011. (Submissions due 15 February 2011)
2011 ACM/Springer International Workshop on Identity ID 2011: Security, Management & Applications, is designated to meet with researchers, engineers and practitioners from academia, service providers, industry and government working on Identity-based Internet & infrastructure systems. ID 2011 aims to bring to forefront the recent trends in most significant technology topics such as Identity Management (IdM), Cloud Computing, Internet of Things (IoT), Service Oriented Architecture (SoA), Security & Privacy Systems, Access Management, Risk Management, and Role and Policy Management, etc in software, hardware and firmware applications running on private and public networks.
SADFE 2011 International Workshop on Systematic Approaches to Digital Forensic Engineering, Held in conjunction with the IEEE Symposium on Security and Privacy (SP 2011), Berkeley, CA, USA, May 26, 2011. (Submissions due 18 February 2011)
The SADFE (Systematic Approaches to Digital Forensic Engineering) International Workshop promotes systematic approaches to cyber crime investigations, by furthering the advancement of digital forensic engineering as a disciplined science and practice. Today's digital artifacts permeate our lives and are part of every crime and every case of digital discovery. The field of digital forensics faces many challenges, including scale, scope and presentation of highly technical information in legal venues to nontechnical audiences. Digital evidence may be extant for only nanoseconds or for years; they may consist of a single modified bit, or huge volumes of data; they may be found locally or spread globally throughout a complex digital infrastructure on public or private systems. Following the success of previous SADFE workshops, cyber crime investigations and digital forensics tools will continue to be the key topics of the meeting. We also welcome a broader range of digital forensics papers that do not necessarily involve either crime or digital forensics tools. General attack analysis, the insider threat, insurance and compliance investigations, similar forms of retrospective analysis, and digital discovery are all viable topics. Past speakers and attendees of SADFE have included computer and information scientists, social scientists, digital forensic practitioners, IT professionals, law enforcement, lawyers, and judges. The synthesis of science with practice and the law with technology form the foundation of this conference. SADFE addresses the gap between today's practice and the establishment of digital forensics as a science. To advance the field, SADFE-2011 solicits broad-based, innovative approaches to digital forensic engineering in the following four areas:
IEEE Security and Privacy Magazine, Special Issue on Living with Insecurity, November/December 2011, (Submission Due 23 February 2011)
Editor: Deborah A. Frincke (PNNL, USA) and Bill Arbaugh (University of Maryland, USA)
Many approaches to security start with the assumption that there is a trustworthy and secure base on which one can build, perhaps based on some provably correct hardware platform. In contrast, this issue seeks papers that start with the opposite assumption. While a computing environment in which all of our devices are reliable and secure sounds appealing, that is not the world in which we live. For the foreseeable future, we will be living and working in an environment of vulnerable, unreliable systems, where we still wrestle with definitions of what it even means to be secure. This special edition focuses on how we can live with insecurity, how our devices and systems can support users at home and at work, when the underlying base is potentially compromised and users themselves may be untrustworthy or unfocused on security. In this themed issue we are particularly interested in papers that address the implications of building software and hardware upon an admittedly untrustworthy basis, across the full spectrum of design, development, testing, use, and maintenance of digitally based systems. We are also interested in policy and regulatory issues related to our topic. Potential topics and questions related to living with security include:
DFRWS 2011 11th Digital Forensics Research Conference, New Orleans, LA, USA, August 1-3, 2011. (Submissions due 27 February 2010)
DFRWS brings together leading researchers, developers, practitioners, and educators interested in advancing the state of the art in digital forensics from around the world. As the most established venue in the field, DFRWS is the preferred place to present both cutting-edge research and perspectives on best practices for all aspects of digital forensics. As an independent organization, we promote open community discussions and disseminate the results of our work to the widest audience. We invite original contributions as research papers, panel proposals, Work-in-Progress talks, workshop proposals, and demo proposals. Topics of Interest:
SAFECOMP 2011 30th International Conference on Computer Safety, Reliability and Security, Naples, Italy, September 19-21, 2011. (Submissions due 27 February 2011)
SAFECOMP is an annual event covering the state-of-the-art, experience and trends in the areas of safety, security and reliability of critical computer applications. The 2011 Key theme is "Safety and security of computer-based systems and infrastructures: from risk assessment to threat mitigation". Papers are invited in application and industrial sectors as well as research areas. Especially papers on industrial experience and practice are encouraged.
PETS 2011 11th Privacy Enhancing Technologies Symposium, Waterloo, ON, Canada, July 27-29, 2011. (Submissions due 28 February 2011)
Privacy and anonymity are increasingly important in the online world. Corporations, governments, and other organizations are realizing and exploiting their power to track users and their behavior. Approaches to protecting individuals, groups, but also companies and governments, from profiling and censorship include decentralization, encryption, distributed trust, and automated policy disclosure. The 11th Privacy Enhancing Technologies Symposium addresses the design and realization of such privacy services for the Internet and other data systems and communication networks by bringing together anonymity and privacy experts from around the world to discuss recent advances and new perspectives. The symposium seeks submissions from academia and industry presenting novel research on all theoretical and practical aspects of privacy technologies, as well as experimental studies of fielded systems. We encourage submissions with novel technical contributions from other communities such as law, business, and data protection authorities, that present their perspectives on technological issues. Suggested topics include but are not restricted to:
International Journal of Secure Software Engineering, Special Issue on Lessons Learned in Engineering Secure & Dependable Web Applications, January/February 2012, (Submission Due 7 March 2011)
Editor: Martin Gilje Jaatun (SINTEF ICT, Norway), Edgar Weippl (SBA Research, Austria), and Riccardo Scandariato (KU Leuven, Belgium)
Software is an integral part of everyday life, and we expect and depend upon software systems to perform correctly. Software security is about ensuring that systems continue to function correctly also under malicious attack. As most systems now are web-enabled, the number of attackers with access to the system increases dramatically and thus the threat scenario changes. The traditional approach to secure a system includes putting up defense mechanisms such as Intrusion Detection Systems and firewalls, but such measures are no longer sufficient by themselves. We need to be able to build better, more robust and thus more secure systems. Even more importantly, however, we should strive to achieve these qualities in all software systems, not just the ones that need special protection. This special issue will focus on techniques, experiences and lessons learned for engineering secure and dependable software for the web. Suggested topics include, but are not limited to:
PST 2011 9th International Conference on Privacy, Security and Trust, Montreal, Quebec, Canada, July 19-21, 2011. (Submissions due 20 March 2011)
PST2011 provides a forum for researchers world-wide to unveil their latest work in privacy, security and trust and to show how this research can be used to enable innovation. PST2011 will include an Innovation Day featuring workshops and tutorials followed by two days of high-quality research papers whose topics include, but are NOT limited to, the following:
ESORICS 2011 16th European Symposium on Research in Computer Security, Leuven, Belgium, September 12-14, 2011. (Submissions due 21 March 2011)
ESORICS is the annual European research event in Computer Security. The Symposium started in 1990 and has been held in several European countries, attracting a wide international audience from both the academic and industrial communities. Papers offering novel research contributions in computer security are solicited for submission to the Symposium. The primary focus is on original, high quality, unpublished research and implementation experiences. Submitted papers must not substantially overlap with papers that have been published or that are simultaneously submitted to a journal or a conference with proceedings. We encourage submissions of papers discussing industrial research and development. Suggested topics include but are not restricted to:
W2SP 2011 Web 2.0 Security and Privacy 2011 Workshop, Held in conjunction with IEEE Symposium on Security and Privacy (SP 2011), Berkeley, CA, USA, May 26, 2011. (Submissions due 25 March 2011)
W2SP brings together researchers, practitioners, web programmers, policy makers, and others interested in the latest understanding and advances in the security and privacy of the web, browsers and their eco-system. We have had four years of successful W2SP workshops. This year, we will additionally invite selected papers to a special issue of the journal. We are seeking both short position papers (2-4 pages) and longer papers (a maximum of 10 pages). The scope of W2SP 2011 includes, but is not limited to:
FCS 2011 Workshop on Foundations of Computer Security, Held in conjunction with LICS 2011, Toronto, Ontario, Canada, June 20, 2011. (Submissions due 29 March 2011)
Computer security is an established field of computer science of both theoretical and practical significance. In recent years, there has been increasing interest in logic-based foundations for various methods in computer security, including the formal specification, analysis and design of security protocols and their applications, the formal definition of various aspects of security such as access control mechanisms, mobile code security and denial-of-service attacks, and the modeling of information flow and its application to confidentiality policies, system composition, and covert channel analysis. The aim of the workshop FCS'11 is to provide a forum for continued activity in different areas of computer security, bringing computer security researchers in closer contact with the LICS community and giving LICS attendees an opportunity to talk to experts in computer security, on the one hand, and contribute to bridging the gap between logical methods and computer security foundations, on the other. We are interested both in new results in theories of computer security and also in more exploratory presentations that examine open questions and raise fundamental concerns about existing theories, as well as in new results on developing and applying automated reasoning techniques and tools for the formal specification and analysis of security protocols.
RAID 2011 14th International Symposium on Recent Advances in Intrusion Detection, Menlo Park, CA, USA, September 20-21, 2011. (Submissions due 31 March 2011)
This symposium, the 14th in an annual series, brings together leading researchers and practitioners from academia, government, and industry to discuss issues and technologies related to intrusion detection and defense. The Recent Advances in Intrusion Detection (RAID) International Symposium series furthers advances in intrusion defense by promoting the exchange of ideas in a broad range of topics. As in previous years, all topics related to intrusion detection, prevention and defense systems and technologies are within scope, including but not limited to the following:
IEEE Computer Society's Technical Committee on Security and Privacy
| TC home page | TC Officers | |
| How to join the TC | TC publications available online | |
| TC Publications for sale | Cipher past issues archive | |
| IEEE Computer Society | Cipher Privacy Policy |