 |
|
Commentary and Opinion
Richard Austin's review of Threat Modeling: Designing for Security by Adam Shostack
NewsBits:
Is nothing sacred? Even
cat photos compromise your security. (New York Times, July 22, 2014)
Microsoft
follows Google in establishing EU's "right to be
forgotten", Reuters, July 16, 2014
No news is good news? Unlikely. If you see security
related news that's interesting, pass it on to Cipher.
Listing of academic positions available by
Cynthia Irvine
Posted June 2014
University of Surrey, UK
Guildford, Surrey, UK
Lecturer/Senior Lecturer (equivalent to Assistant/Associate Professor) in Cyber Security
Deadline for applications: 30 June, 2014
https://jobs.surrey.ac.uk/Vacancy.aspx?ref=037614
Conference and Workshop Announcements
Cipher
calls-for-papers
and
calendar
Cipher calendar announcements are on Twitter; follow "ciphernews"
new calls or announcements added since Cipher E120
(the calls-for-papers and the calendar announcements may differ
slightly in content or time of update):
MTD 2014 1st ACM Workshop on Moving Target Defense, Held in conjunction with the 21st ACM Conference on Computer and Communications Security (ACM-CCS 2014), Scottsdale, Arizona, USA, November 3, 2014. (Submission Due 22 July 2014)
The static nature of current computing systems has made them easy to attack and harder to defend. Adversaries have an asymmetric advantage in that they have the time to study a system, identify its vulnerabilities, and choose the time and place of attack to gain the maximum benefit. The idea of moving-target defense (MTD) is to impose the same asymmetric disadvantage on the attacker by making systems dynamic and harder to predict. With a constantly changing system and its ever adapting attack surface, the attacker will have to deal with a great deal of uncertainty just like defenders do today. The ultimate goal is to level the cybersecurity playing field for defenders versus attackers. This workshop seeks to bring together researchers from academia, government, and industry to report on the latest research efforts on moving-target defense, and to have productive discussion and constructive debate on this topic. We solicit submissions on original research in the broad area of MTD, with possible topics such as those listed below. Since this is still a research area in a nascent stage, the list should only be used as a reference. We welcome all works that fall under the broad scope of moving target defense, including research that shows negative results. Topics include:
WISCS 2014 1st ACM Workshop on Information Sharing and Collaborative Security, Held in conjunction with the 21st ACM Conference on Computer and Communications Security (ACM-CCS 2014), Scottsdale, Arizona, USA, November 3, 2014. (Submission Due 25 July 2014)
Sharing of security related information is believed to greatly enhance the ability of organizations to defend themselves against sophisticated attacks. If one organization detects a breach the automated sharing of observed security indicators (such as IP addresses, domain names etc.) provide valuable, actionable information to others. Through analyzing shared data it seems possible to get much better insights into emerging attacks. Sharing higher level intelligence about campaigns, threat actors and mitigations is also of great interest. Both in the US and the EU there are major efforts underway to strengthen information sharing. Yet there are a number of technical and policy challenges to realizing this vision. Which information exactly should be shared? How can privacy and confidentiality be protected? How can we create high-fidelity intelligence from shared data without getting overwhelmed by false positives? The first Workshop on Information Sharing and Collaborative Security (WISCS 2014) aims to bring together experts and practitioners from academia, industry and government to present innovative research, case studies, and legal and policy issues. Topics of interest for the workshop include, but are not limited to:
CCSW 2014 ACM Cloud Computing Security Workshop (CCSW), Held in conjunction with the 21st ACM Conference on Computer and Communications Security (CCS 2014), Scottsdale, Arizona, USA, November 7, 2014. (Submission Due 30 July 2014)
Notwithstanding the latest buzzword (grid, cloud, utility computing, SaaS, etc.), large-scale computing and cloud-like infrastructures are here to stay. The exact form they take is still for the markets to decide, yet one thing is certain: clouds bring with them new deployment models and hence new adversarial threats and vulnerabilities. CCSW brings together researchers and practitioners in all security aspects of outsourced computing, including:
VizSec 2014 11th Visualization for Cyber Security, Paris, France, November 10, 2014. (Submission Due 1 August 2014)
The 11th Visualization for Cyber Security (VizSec) is a forum that brings together researchers and practitioners from academia, government, and industry to address the needs of the cyber security community through new and insightful visualization and analysis techniques. VizSec provides an excellent venue for fostering greater exchange and new collaborations on a broad range of security- and privacy-related topics. Full papers describing novel contributions in security visualization are solicited. Papers may present techniques, applications, practical experience, theory, analysis, or experiments and evaluations. We encourage the submission of papers on technologies and methods that promise to improve cyber security practices, including, but not limited to:
SafeConfig 2014 Workshop on Cyber Security Analytics and Automation, Held in conjunction with the 21st ACM Conference on Computer and Communications Security (CCS 2014), Scottsdale, Arizona, USA, November 3, 2014. (Submission Due 4 August 2014)
Ensuring correctness and integrity of system configurations and associated policies are key to proper functioning, accessibility, security, privacy and resilience of modern information systems and services. However, this is a daunting in large enterprise systems that may contain millions of physical and/or virtual components that must be properly configured and secured from unauthorized access. Furthermore, the configuration variables often have explicit or hidden interdependencies that must be understood in order to ensure proper end to end behavior. The new sophisticated cyber security threats demand new security techniques and approaches that offer proactive, intelligent and a holistic security analytics based on analyzing the system artifacts including system traces, configurations, logs, incident reports, alarms and network traffic. Scalable analytics techniques are essential to handle large volumes of data and to normalize, model, integrate, analyze and respond to threats in real time. As the current technology moves toward "smart" cyber infrastructure and open networking platforms (e.g. OpenFlow and virtual computing) and integration of large variety of sensors, the need for large-scale security analytics and automation becomes essential to enable intelligent response, automated defense, and network resilience and agility. This workshop offers a unique opportunity by bringing together researchers from academia, industry as well as government agencies to discuss the challenges listed above, to exchange experiences, and to propose joint plans for promoting research and development in this area. SafeConfig is a one day forum that includes invited talks, technical presentations of peer-reviewed papers, poster/demo sessions, and joint panels on research collaboration. SafeConfig was started in 2009 and has been continuously running since then. It provides a unique forum to explore theoretical foundations, algorithmic advances, modeling, and evaluation of configuration related challenges for large scale cyber and cyberphysical systems.
TrustCol 2014 9th IEEE International Workshop on Trusted Collaboration, Held in conjunction with IEEE CollaborateCom 2014, Miami, Florida, USA, October 22, 2014. (Submission Due 10 August 2014)
The key goal of this workshop is to foster active interactions among diverse researchers and practitioners, and generate added momentum towards research in finding viable solutions to the security and privacy challenges faced by the current and future collaborative systems and infrastructures. We solicit unpublished research papers, both regular (8 pages max) and short (4 pages max) papers, that address theoretical issues and practical implementations/experiences related to security and privacy solutions for collaborative systems. Topics of interest include, but are not limited to:
ACSW-AISC 2015 Australasian Information Security Conference, Held as part of Australasian Computer Science Week, Sydney, Australia, January 27-30, 2015. (Submission Due 18 August 2014)
AISC aims at promoting research on all aspects of information security and increasing communication between academic and industrial researchers working in this area. We seek submissions from academic and industrial researchers on all theoretical and practical aspects of information security. Suggested topics include, but are not restricted to: access control; anonymity and pseudonymity; cryptography and cryptographic protocols; database security; identity management and identity theft; intrusion detection and prevention; malicious software; network security; privacy enhancing technologies; and trust and risk.
BDSP 2014 1st IEEE International Workshop on Big Data Security and Privacy, Washington DC, USA, October 27-30, 2014. (Submission Due 30 August 2014)
Big Data is characterized by the integration of a significant amount of data, of varying modalities or types, at a pace that cannot be handled by traditional data management systems. This has sparked innovation in the collection, processing and storage of this data. The analytic systems built to leverage Big Data have yielded (and hold even greater promise to uncover) remarkable insights that enable a host of new applications that were not thought possible prior to the era of Big Data. However, with this capacity to contribute to and benefit the greater good comes the responsibility to protect the subjects referenced in the data sets. In this context, the old adage is correct - "With great power, comes great responsibility". Ultimately, the data subjects own the data and they stand to suffer most significantly from the data's compromise. Thus, there needs to be advances in techniques for 1) ingesting Big Data in a secure and privacy-preserving, 2) performing Big Data analysis in a secure environment and in a privacy-preserving manner, and 3) storing and enforcing retention policy securely (and in private modes) for Big Data systems. If these solutions are not in place, then the willingness of people to contribute their data to be included in a Big Data system decreases. Additionally, Big Data professionals need to perform risk analyses, as they relate to security and privacy, to get a realistic view of the safety of the landscape. There is a lot of work to be done in this emerging field. This workshop is a venue for researchers and practitioners to come together and tackle them in a supportive and stimulating environment.
IEEE Transactions on Emerging Topics in Computing, Emerging topics in Cyber Security, 2015, (Submission Due 1 September 2014)
Editor: Giorgio Di Natale (LIRMM, France)
and Stefano Zanero (Politecnico di Milano, Italy)
Cyber Security is a topic which is getting a very high level of attention from researchers,
decision makers, policy makers and from the general public. The value of digital
information is growing dramatically. Physical systems coupled with computing
devices (so-called cyber-physical systems) carry out functions that are fundamental
for our society. Protecting these emerging critical digital infrastructures is an
increasingly relevant objective from a military and political point of view. For
this reason, the IEEE Transactions on Emerging Topics in Computing (TETC) seek
original manuscripts for a Special Issue on Emerging Topics in Cyber Security,
scheduled to appear in the first issue of 2015. TETC is the newest Transactions
of the IEEE Computer Society, and it uses an Open Access model exclusively.
Papers may present advances in the theory, design, implementation, analysis,
verification, or empirical evaluation and measurement of cyber security
systems, to deal with emerging computing technologies and applications.
Given the the peculiar nature of TETC, we are seeking in particular papers
that are more "far-reaching" than is usual for journal submissions, as long
as they show promise for opening up new areas of study, or questioning
long-held beliefs and tenets of the cybersecurity field.
ESSoS 2015 6th International Symposium on Engineering Secure Software and Systems, Milan, Italy, March 4-6, 2015. (Submission Due 8 September 2014)
Trustworthy, secure software is a core ingredient of the modern world. So is the Internet. Hostile, networked environments, like the Internet, can allow vulnerabilities in software to be exploited from anywhere. To address this, high-quality security building blocks (e.g., cryptographic components) are necessary, but insufficient. Indeed, the construction of secure software is challenging because of the complexity of modern applications, the growing sophistication of security requirements, the multitude of available software technologies and the progress of attack vectors. Clearly, a strong need exists for engineering techniques that scale well and that demonstrably improve the software's security properties. The goal of this symposium, which will be the sixth in the series, is to bring together researchers and practitioners to advance the states of the art and practice in secure software engineering. Being one of the few conference-level events dedicated to this topic, it explicitly aims to bridge the software engineering and security engineering communities, and promote cross-fertilization. The symposium will feature two days of technical program. In addition to academic papers, the symposium encourages submission of high-quality, informative industrial experience papers about successes and failures in security software engineering and the lessons learned. Furthermore, the symposium also accepts short idea papers that crisply describe a promising direction, approach, or insight. Paper submissions are solicited in all areas relating to secure software and secure systems research, including but not limited to:
ICISSP 2015 1st International Conference on Information Systems Security and Privacy, ESEO, Angers, Loire Valley, France, February 9-11, 2015. (Submission Due 9 September 2014)
The International Conference on Information Systems Security and Privacy aims at creating a meeting point of researchers and practitioners that address security and privacy challenges that concern information systems, especially in organizations, including not only technological issues but also social issues. The conference welcomes papers of either practical or theoretical nature, presenting research or applications addressing all aspects of security and privacy, such as methods to improve the accuracy of data, encryption techniques to conceal information in transit and avoid data breaches, identity protection, biometrics, access control policies, location information and mobile systems privacy, transactional security, social media privacy control, web and email vulnerabilities, trust management, compliance violations in organizations, security auditing, and so on. Cloud computing, big data, and other IT advances raise added security and privacy concerns to organizations and individuals, thus creating new research opportunities. Each of these topic areas is expanded below but the sub-topics list is not exhaustive. Papers may address one or more of the listed sub-topics, although authors should not feel limited by them. Unlisted but related sub-topics are also acceptable, provided they fit in one of the following main topic areas:
Journal of Computer Security, Special Issue on Security and High Performance Computing Systems, 2015, (Submission Due 15 September 2014)
Editor: Luca Spalazzi (Università di Ancona, Italy)
and Luca Viganò (King's College London, UK)
Providing high performance computing and security is a challenging task. On the
one hand, Internet, operating systems and distributed environments currently
suffer from poor security support and cannot resist common attacks. On the
other hand, adding security measures typically degrades performance. The
relationships between security and high performance computing systems thus
raise a number of problems and challenges that are of interest for this
special issue, such as (but not limited to) the following ones: (1). How
to enforce security requirements in high performance computing systems.
For instance, which kind of obfuscation techniques can enforce privacy
in a cloud storage, or how grid security can be verified at design-time
(formal verification) or at run-time (run-time verification). In this
case, safety properties can also be addressed, such as availability and
fault tolerance for high performance computing systems. (2). How to use
high performance computing systems to solve security problems. For
instance, a grid computation can break an encryption code, and a
cluster can support high performance intrusion detection or a
distributed formal verification system. More generally, this topic
addresses every efficient use of a high performance computing systems
to improve security. (3). The tradeoffs between maintaining high perform
and achieving security in computing systems and solutions to balance the
two objectives. In all these directions, various formal analyses, as well
as performance analyses or monitoring techniques can be conducted to show
the efficiency of a security infrastructure. The special issue seeks
submissions from academia and industry presenting novel research on all
theoretical and practical aspects of computer and network security, as
well as case studies and implementation experiences. Papers should have
practical relevance to the construction, evaluation, application, or
operation of secure systems. The topics of interest include (but are not
limited to) the following:
CODASPY 2015 5th ACM Conference on Data and Application Security and Privacy, San Antonio, Texas, USA, March 2-4 2015. (Submission Due 15 September 2014)
Data and applications security and privacy has rapidly expanded as a research field with many important challenges to be addressed. The goal of the ACM Conference on Data and Applications Security (CODASPY) is to discuss novel, exciting research topics in data and application security and privacy and to lay out directions for further research and development in this area. The conference seeks submissions from diverse communities, including corporate and academic researchers, open-source projects, standardization bodies, governments, system and security administrators, software engineers and application domain experts. Topics of interest include, but are not limited to:
IEEE Transactions on Dependable and Secure Computing, Special Issue on Cyber Crime, 2015, (Submission Due 1 October 2014)
Editor: Wojciech Mazurczyk (Warsaw University of Technology, Poland),
Thomas J. Holt (School of Criminal Justice, Michigan State University, USA)
and Krzysztof Szczypiorski (Warsaw University of Technology, Poland)
Cyber crimes reflect the evolution of criminal practices that have adapted to
the world of information and communication technologies. Cybercriminality has
become a curse of the modern world with the potential to affect every one
nationally and/or internationally. Individuals, companies, governments and
institutions may become victims as well as (involuntary) helpers of cyber
criminals. The inability to provide cyber-security can potentially have a
tremendous socio-economic impact on global enterprises as well as individuals.
The aim of this special issue is to bring together the research
accomplishments provided by the researchers from academia and the industry.
The other goal is to show the latest research results in the field of cyber
crime. Prospective authors will be encouraged to submit related distinguished
research papers on the subject of both: theoretical approaches and practical
case reviews. Topics of interest include, but are not limited to:
IFIP119-DF 2015 11th Annual IFIP WG 11.9 International Conference on Digital Forensics, Orlando, Florida, USA, January 26-28, 2015. (Submission Due 10 October 2014)
The IFIP Working Group 11.9 on Digital Forensics (www.ifip119.org) is an active international community of scientists, engineers and practitioners dedicated to advancing the state of the art of research and practice in digital forensics. The Eleventh Annual IFIP WG 11.9 International Conference on Digital Forensics will provide a forum for presenting original, unpublished research results and innovative ideas related to the extraction, analysis and preservation of all forms of electronic evidence. Papers and panel proposals are solicited. All submissions will be refereed by a program committee comprising members of the Working Group. Papers and panel submissions will be selected based on their technical merit and relevance to IFIP WG 11.9. The conference will be limited to approximately sixty participants to facilitate interactions between researchers and intense discussions of critical research issues. Keynote presentations, revised papers and details of panel discussions will be published as an edited volume - the eleventh volume in the well-known Research Advances in Digital Forensics book series (Springer, Heidelberg, Germany) during the summer of 2015. Technical papers are solicited in all areas related to the theory and practice of digital forensics. Areas of special interest include, but are not limited to:
ASIACCS 2015 10th ACM Symposium on Information, Computer and Communications Security, Singapore, April 14-17, 2015. (Submission Due 26 October 2014)
ASIACCS is a major international forum for information security researchers, practitioners, developers, and users to explore and exchange the newest cyber security ideas, breakthroughs, findings, techniques, tools, and experiences. We invite submissions from academia, government, and industry presenting novel research on all theoretical and practical aspects of computer and network security. Areas of interest for ASIACCS 2015 include, but are not limited to:
Elsevier Computer Communications Journal, Special Issue on Security and Privacy in Unified Communications: Challenges and Solutions, 2015, (Submission Due 31 October 2014)
Editor: Georgios Karopoulos (Joint Research Centre (JRC), Italy),
Georgios Portokalidis (Stevens Institute of Technology, USA),
Josep Domingo-Ferrer (Universitat Rovira i Virgili, Catalonia),
Ying-Dar Lin (National Chiao Tung University (NCTU), Taiwan),
Dimitris Geneiatakis (Joint Research Centre (JRC), Italy),
and Georgios Kambourakis (University of the Aegean, Greece)
Unified Communications (UC) merge different communication technologies, types of
products, and services, from various manufacturers, operators, and countries,
following diverse policies and standards. Specifically, in the context of UC,
a range of communication tools are integrated in a way that both corporations
and individuals are able to manage all their communications in one entity
instead of doing it disjointly. It is therefore said that UC bridges the
opening between the various computer related communication technologies and
Voice over IP (VoIP). However, this high level of heterogeneity expands the
risks related to security and privacy that stakeholders should deal with.
To eliminate or even prevent the increasing threats to end-users and operators,
it is important to explore this growing and timely research topic. This feature
topic will benefit the research community towards identifying challenges and
disseminating the latest methodologies and solutions to UC security and
privacy issues. Its objective is to publish high-quality articles presenting
open issues, algorithms, protocols, policies, frameworks, standards, and
solutions for UC related to security and privacy. Only technical papers
describing previously unpublished, original, state-of-the-art research,
and not currently under review by a conference or a journal will be
considered. Reviews and case studies which address state-of-art research
and state-of-practice industry experiences are also welcomed. We solicit
papers in a variety of topics related to unified communications security
and privacy, including, but not limited to:
Staying in touch....
Changing your email address? Please send updates to cipher@ieee-security.org
IEEE Computer Society's Technical Committee on Security and Privacy
| TC home page | TC Officers | |
| How to join the TCSP | TC publications available online | |
| TC Publications for sale | Cipher past issues archive | |
| IEEE Computer Society | Cipher Privacy Policy |