In the News

---

• "NSA gives Lockheed cyber incident response accreditation", GCN, 03 June 2014.The NSA recently gave Lockheed Martin cyber incident response accreditation (CIRA) after evaluating the company's ability to provide incident response assistance services. As an accredited CIRA service provider, Lockheed will be able to provide intrusion detection, incident response, and vulnerability assessment and penetration testing services. (ID#:14-1534) See http://gcn.com/blogs/pulse/2014/06/cyber-incident-response-assistance-accreditation.aspx?admgarea=TC_SecCybersSec

• "HP offers secure, private cloud for government", GCN, 29 May 2014. HP Enterprise Services announces HP Helion Managed Private Cloud for Public Sector, which allows government, defense, civilian, and other organizations to securely manage a dedicated, private cloud to monitor resources over multiple departments. It is designed to meet the government's "unique certification and regulatory compliance needs" while providing improved security. (ID#:14-1535) See http://gcn.com/articles/2014/05/29/hp-public-sector-cloud.aspx?admgarea=TC_SecCybersSec

• "Heartbleed begets headaches in perfecting encryption", GCN, 09 May 2014. Following the Heartbleed bug, the NIST released an update of its Special Publication 800-52, a guideline on implementing TLS protocols, to reflect the IETF's work on revising TLS from version 1.0 to 1.1 and 1.2. The IETF TLS 1.3 working group is working on increasing the safety of TLS by replacing and/or improving dated, vulnerable techniques like the RSA key transport cipher suites, upon which TLS 'handshakes" are based. (ID#:14-1536) See http://gcn.com/blogs/cybereye/2014/05/tls-heartbleed.aspx

• "Cyber defense consortium formed to share 'fresh' malware", SC Magazine, 30 May 2014. A consortium has been formed between Fortinet and Palo Alto Networks to share intelligence on malware and cyber threats. This will allow the two companies, along with other security companies that are expected to join, to "stop advanced threats at the network level" through collaboration and sharing of fresh malware samples and threat intelligence. (ID#:14-1537) See http://www.scmagazine.com/cyber-defense-consortium-formed-to-share-fresh-malware/article/349257/

• "Soraya malware targets payment card data on PoS devices and home computers", SC Magazine, 03 June 2014. Soraya, a piece of malware unique in its combination of memory-scraping, form-grabbing techniques, was discovered by Arbor Networks researchers on May 23. Soraya has likely existed since March of 2014, and compromised thousands of payment cards. Soraya appears to be developing the ability to steal FTP credentials. (ID#:14-1538) See http://www.scmagazine.com/soraya-malware-targets-payment-card-data-on-pos-devices-and-home-computers/article/349880/1/

• "Senate committee OKs bill to give DHS broader security hiring authority", SC Magazine, 23 May 2014. After swiftly passing through a Senate committee, Bill S. 2354, if passed into law, will put the Department of Homeland Security's hiring ability of cyber security personnel on par with that of the DoD and the NSA. The increased authority and flexibility should allow the DHS to be better prepared to respond quickly to cyber threats. (ID#:14-1539) See http://www.scmagazine.com/senate-committee-oks-bill-to-give-dhs-broader-security-hiring-authority/article/348427/

• "'Nemanja' PoS malware compromises 1,500 devices, half a million payment cards, worldwide", SC magazine, 22 May 2014. A piece of malware known as "Nemanja" has been found to have infected nearly 1,500 point-of-sale devices, potentially putting half a million payment cards at risk. Nemanja has even been used to infiltrate deep into networks in the financial industry. (ID#:14-1540) See http://www.scmagazine.com/nemanja-pos-malware-compromises-1500-devices-half-a-million-payment-cards-worldwide/article/348183/2/

• "Report: Companies more aware of insider threat, but lack policies, tools", SC Magazine, 20 May 2014. According to a new report, despite awareness of insider threats, many companies lack the tools and policies to deal with potential threats. Though insider threat preparedness has been generally increasing, many companies do not dedicate sufficient funds to threat-reducing programs. (ID#:14-1541) See http://www.scmagazine.com/report-companies-more-aware-of-insider-threat-but-lack-policies-tools/article/347779/2/

• "Retailers join forces to share threat intelligence", SC Magazine, 15 May 2014. A group of retailers including Lowe's, The Gap, Target, and Nike collectively launched the Retail Cyber Intelligence Sharing Center (R-CISC) in an attempt to combat major security breaches and cyber attacks, with help from government entities and cyber experts. (ID#:14-1542) See http://www.scmagazine.com/retailers-join-forces-to-share-threat-intelligence/article/347215/1/

• "Gameover Zeus Botnet Disrupted by multinational effort", Cyber Defense Magazine, 04 June 2014. A joint effort between the FBI, DoJ, and foreign agencies announced a joint effort to disrupt a dangerous, long-lived botnet called Gameover Zeus, which responsible for an estimated $100 million or more in losses. The alleged administrator of Gameover, Russian citizen Evgeniy Mikhailovich Bogachev has been charged with conspiracy, computer hacking, and bank fraud, among other charges. (ID#:14-1543) See http://www.cyberdefensemagazine.com/gameover-zeus-botnet-disrupted-by-multinational-effort/

• "A Case for Opportunistic Encryption on the Web", Ivan Ristic, Director of Engineering, Qualsys, SC Magazine, News, Opinions 5 Feb 14: The author suggests that websites that use no encryption can deploy "opportunistic encryption" to deter passive attacks. This approach is not sophisticated enough to defeat a determined targeted attacker, but it is good enough to defeat passive attacks. After all, most communications are not being actively intercepted, which means that opportunistic encryption provides sufficient protection. According to the author, all the required technologies already exist to start deploying opportunistic encryption tomorrow. What remains is that final step where the web browser and server vendors agree to use it. If accomplished, after a few short years of waiting for the new technology to spread, the web will be much safer, and one that is robustly safe from mass surveillance. (ID#:14-1232) Available at: http://www.scmagazine.com/a-case-for-opportunistic-encryption-on-the-web/article/332653/

• " The Challenge for Cybersecurity is to find leadership", Jarno Limnell, Director of Cybersecurity, Intel Security, SC Magazine UK, News, Opinions, 10 Mar 14. The author reports that at the Cyberstrat14 event in Helsinki, cybersecurity was repeatedly said to have three key needs: leadership, drive and trust. To begin, leadership and drive must lead to action and not merely to more discussion. The discussions taking place within organisations and corner offices now needs to be translated into strategies and action plans. He further suggests that with respect to cybersecurity, international politics is in need of cooperation that goes across national boundaries and that the ways forward are leadership, cooperation, and resilience. (ID#:14-1233) Available at: http://www.scmagazineuk.com/the-challenge-for-cybersecurity-is-to-find-leadership/article/337596/

• "Massive Breach Triggers Investigation of Security Practices at eBay", Security Magazine, 27 May 2014. After a confirmed security breach, a formal investigation is being led to scrutinize eBay's security practices. While hackers were able to spy on personal information of users, passwords were encrypted and therefore unlikely to have been compromised. (ID#:14-1513)See http://www.securitymagazine.com/articles/85534-massive-breach-triggers-investigation-of-security-practices-at-ebay

• "Google Plots End-to-End Messaging Encryption", Infosecurity Magazine, 04 June 2014. Google is developing a new Chrome Browser extension, "End to End", which will allow users to send Email with end-to-end encryption. The tool is currently in alpha release, and is being tested and evaluated for bugs and weaknesses. (ID#:14-1514) See http://www.infosecurity-magazine.com/view/38714/google-plots-endtoend-messaging-encryption/

• "American Express Warns California Residents of Data Breach", Infosecurity Magazine, 04 June 2014. In March 2014, Hacktivist group Anonymous released over 7 million payment card records as part of a protest. Experts say, however, that the data appears to be "recycled", having been previously disclosed, and is not part of a new breach. American Express is the only one of four affected credit card company currently notifying its customers. (ID#:14-1515) See http://www.infosecurity-magazine.com/view/38693/american-express-warns-california-residents-of-data-breach/

• "Pirate Bay Co-founder Arrested in Sweden", Infosecurity Magazine, 04 June 2014. Swedish authorities arrested Peter Sunde, co-founder of the infamous P2P file sharing site The Pirate Bay, for breaching copyright laws. Sunde is the second Pirate Bay Co-founder to be arrested, leaving another co-founder, Fredrik Neij, at large. (ID#:14-1516) See http://www.infosecurity-magazine.com/view/38705/pirate-bay-cofounder-arrested-in-sweden/

• "Hacktivist Warns World Cup Sponsors Anonymous DDos Attack is Coming", Infosecurity Magazine, 02 June 2014. An alleged member of Hacktivist group Anonymous claims that high-profile sponsors of the upcoming FIFA World Cup will be victims of DDoS attacks, in a protest of "the vast sums of money being thrown at the event when the country still suffers from severe social inequality." (ID#:14-1517) See http://www.infosecurity-magazine.com/view/38657/hacktivist-warns-world-cup-sponsors-anonymous-ddos-attack-is-coming/

• "Microsoft Lets Zero-day Exploit Linger for Seven Months", Infosecurity Magazine, 22 May 2014. The Zero Day Initiative recently revealed a zero-day vulnerability that puts Internet Explorer 8 users at risk. Microsoft, which claims that it's working on a patch, has known of the vulnerability for approximately 7 months. (ID#:14-1518) http://www.infosecurity-magazine.com/view/38550/microsoft-lets-zeroday-exploit-linger-for-seven-months/

• "US Files Indictments of Five Chinese Officials for Cyber-spying", InfoSecurity Magazine, 20 May 2014. The US DoJ is accusing five Chinese Army officials of "very specific attacks" against American organizations. The cyber-war between the US and China is showing no signs of abatement. (ID#:14-1519) See http://www.infosecurity-magazine.com/view/38488/us-files-indictments-of-five-chinese-officials-for-cyberspying-/

• "Five reasons why China is attacking U.S. tech", Computerworld, 05 June 2014. China's technological and cyber capabilities have exploded in the past decade or so as it seeks to challenge the US on technological innovation and international influence. (ID#:14-1520) See http://www.computerworld.com/s/article/9248859/Five_reasons_why_China_is_attacking_U.S._tech?taxonomyId=214&pageNumber=2

• "Trojan app encrypts files on Android devices and asks for ransom", Computerworld, 05 June 2014. Although not the first ransomware program for Android, the "Android/Simplock.A", is the first to use encryption to hold files hostage. The malware, which displays a ransom message in Russian, appears to be targeted towards Russian-speaking countries. (ID#:14-1521) See http://www.computerworld.com/s/article/9248865/Trojan_app_encrypts_files_on_Android_devices_and_asks_for_ransom

• "AT&T adds phone geolocation to protect payment cards", Computerworld, 05 June 2014. This summer, AT&T plans to test a new credit card fraud prevention service that utilizes the user's location, provided by a mobile phone, to verify the validity of purchases. AT&T plans to make the service available in over 150 countries.(ID#:14-1522) See http://www.computerworld.com/s/article/9248863/AT_T_adds_phone_geolocation_to_protect_payment_cards

• "Comcast plans to encrypt email exchanged with Google's Gmail", Computerworld, 04 June 2014. Comcast, which was shown to have encrypted only 1% of its email sent to and from Gmail servers, announces plans to work with Google to encrypt more of the mail it sends and receives. (ID#:14-1523) See http://www.computerworld.com/s/article/9248838/Comcast_plans_to_encrypt_email_exchanged_with_Google_s_Gmail

• "ISPs urged to quarantine infected computers", Computerworld, 03 June 2014. In the wake of security threats like the Gameover Zeus botnet, plans are being implemented to have ISPs notify victims of cyber attacks. However, some experts think that ISPs should not just notify victims, but actually quarantine their computers from the network to minimize the impact of cyber attacks. (ID#:14-1524) See http://www.computerworld.com/s/article/9248812/ISPs_urged_to_quarantine_infected_computers

• "GnuTLS library flaw could expose SSL clients, systems", Computerworld, 03 June 2014. A memory corruption vulnerability in GnuTLS, a popular open-source version of SSL, TLS, and DTLS encryption protocols, was fixed after being reported by Codenomicon principle systems engineer Joonas Kuorilehto. (ID#:14-1525) See http://www.computerworld.com/s/article/9248792/GnuTLS_library_flaw_could_expose_SSL_clients_systems

• "Hackers put security tool that finds payment card data into their arsenal", Computerworld, 30 May 2014. Illegitimate versions of "Card Recon", a tool that searches for payment card data in networks, have been used to create malware designed to attack point-of-sale terminals. (ID#:14-1526) See http://www.computerworld.com/s/article/9248693/Hackers_put_security_tool_that_finds_payment_card_data_into_their_arsenal

• "In baffling move, TrueCrypt open-source crypto project shuts down", Computerworld, 29 May 2014. The open-source encryption tool TrueCrypt was abruptly discontinued by its anonymous managers in late May 2014. The project's website states that the software is insecure, and encourages users to switch to BitLocker, Microsoft's encryption tool. (ID#:14-1527) See http://www.computerworld.com/s/article/9248658/In_baffling_move_TrueCrypt_open_source_crypto_project_shuts_down

• "Point-of-sale attacks accounted for a third of all data breaches in 2013", Computerworld, 21 May 2014. Despite the large number of PoS-related data breaches in 2013, hackers are shifting their attention from PoS systems to e-commerce to obtain personally identifiable information. (ID#:14-1528) See http://www.computerworld.com/s/article/9248486/Point_of_sale_attacks_accounted_for_a_third_of_all_data_breaches_in_2013

• "The cost of compliance", FCW, 04 June 2014. In the face of growing concerns over data breaches, limited manpower, and loss of productivity due to reactiveness, GRC (Governance, Risk management and Compliance) software is being used to allow IT departments "to focus on mission-critical activities rather than focusing resources on security and compliance". (ID#:14-1529) See http://fcw.com/articles/2014/06/04/critical-read-cost-of-compliance.aspx

• "Mueller: Cyber experts need offline investigative skills", FCW, 22 May 2014. Former FBI director Robert Mueller reinforced the importance of having well-qualified cyber experts, while pointing out the need for agents to be able to employ "traditional skills" in fighting cyber crime both online and offline. (ID#:14-1530) See http://fcw.com/articles/2014/05/22/mueller-cyber-investigative-skills.aspx

• "Vendors getting mixed messages on cybersecurity", FCW, 22 May 2014. As rules on federal acquisitions of cybersecurity IT are becoming more logistically demanding, NIST's new cyber framework and a report by the GSA and Pentagon, "Improving Cybersecurity and Resilience through Acquisition", are being cited as being potentially useful for simplifying acquisition rules.(ID#:14-1531) See http://fcw.com/articles/2014/05/22/cyber-aquisition.aspx

• "Infrastructure cyber intrusion: A cautionary tale", FCW, 21 May 2014. The Department of Homeland Security released details of two separate cyber attacks on critical infrastructure providers as a warning to other companies that provide power, water, and electricity. ICS-CERT, which performed analysis on the attacks, said that both incidents "point to the increasing need for critical infrastructure providers to keep up with perimeter security, remote access authentication and security monitoring capabilities..." (ID#:14-1532) See http://fcw.com/articles/2014/05/21/utility-cyber-breaches.aspx

• "Sandia exploring ephemeral biometrics for insider threat monitoring", GCN, 05 June 2014. By using individual biological data to create "monitor-able and controllable identities", Sandia National laboratories is hoping to increase security and reduce the risk of insider threats. Sandia is currently seeking partners to aid in the research and development of the program. (ID#:14-1533) See http://gcn.com/blogs/pulse/2014/06/ephemeral-biometrics.aspx?admgarea=TC_SecCybersSec

• The Federal Communications Commission recently took steps to move the country's traditional circuit-based telephone network to an Internet-based system. At the agency's January meeting, commissioners will consider an order that outlines how best to make that transition without disrupting the existing telephone network. (ID#:14-1001) See http://www.pcmag.com/article2/0,2817,2427386,00.asp

• Among costly incidents, IT leaders named breaches to be the most damaging from a financial perspective, accounting for a loss of more than $860,000 on average annually at organizations. (ID#:14-1002) See http://www.scmagazine.com//study-it-leaders-count-the-cost-of-breaches-data-loss-and-downtime/article/321782/

• "The Lessons of Bletchley Park", SC Magazine (Opinion), 20 Jan 2014, Dan Shugrue, director of product marketing, Akamai Web Security Solutions. The author suggests that counteracting current cyber threats requires a fundamental shift in the way we approach cyber defense and notes the levels of cooperation and resources provided to Bletchley Park could serve as a model. (ID#:14-1003) See http://www.scmagazine.com/the-lessons-of-bletchley-park/article/329342/

• "What Everyone Needs to Know About Today's Cyberthreats", NPR Interview on 14 January with P.W. Singer, Co-Author of Cybersecurity and Cyberwar, a book which looks at cybersecurity issues faced by the military, government, businesses and individuals, and what happens when you try to balance security with freedom of speech and the ideals of an open internet. (ID#:14-1004) See http://www.npr.org/2014/01/14/262387292/what-everyone-needs-to-know-about-todays-cyberthreats

• "Cybersecurity Development and Research" , Cybersecurity Industry Interview with Xerox's Chuck Brooks: Part Three, by Brian Finch. One of the topics concerned the areas of cybersecurity need more research, with Brooks noting that all areas need more research. (ID#:14-1005) See http://www.huffingtonpost.com/brian-e-finch/cybersecurity-industry-in_2_b_4620232.html

• "Cybersecurity challenges in developing nations", Tagert, Adam, ProQuest, UMI Dissertations Publishing, 2010. 3445893. Nations are deploying information and communications technology without a full understanding of the security challenges. (ID#:14-1006) See http://www.datacenter.com/

• "Cybersecurity "failure" could result in next major terrorism attack" SC Magazine UK, 22 January; Doug Drinkwater, Senior Reporter, reported on the views at the sixth International Forum on Cyber Security, of a panel comprising futurologists, former police investigators, industry vendors and privacy advocates who looked at the state of cyber security and the challenges facing CIOs, CISOs and other IT managers. (ID#:14-1007) See http://www.scmagazineuk.com/cyber-security-failure-could-result-in-next-major-terrorism-attack/article/330532/

• "Fuzzy Math: The need for a national cybersecurity breach notification standard" SC Magazine, (Opinion) 31 January; Stephen Boyer, BitSight Technologies, suggests that current data collection on security breaches, while proving analysis and insight based on their unique vantage points, do not provide, individually or collectively, ground truth into the number of security incidents and data breaches. The inconsistency of the data illustrates the need for comprehensive and consistent standards around the notification of security incidents and data breaches. (ID#:14-1008) See http://www.scmagazine.com//fuzzy-math-the-need-for-a-national-cyber-breach-notification-standard/article/331478/

---

Note:

Articles listed on these pages have been found on publicly available internet pages and are cited with links to those pages. Some of the information included herein has been reprinted with permission from the authors or data repositories. Direct any requests via Email to SoS.Project (at) SecureDataBank.net for removal of the links or modifications to specific citations. Please include the ID# of the specific citation in your correspondence.

---

Academic SoS Research Highlights

---

• The Science of Security Lablet in the Computer Science Department at NC State is studying environmental factors that impact the security decisions made by users of smartphones and mobile devices. This work seeks to leverage mobile device centers to study how environmental factors influence user behavior. The Co-PIs are from the departments of Computer Science and Psychology, and the project is also the beneficiary of expertise in security and mobile device platforms. (ID#:14-1009)

---

Note:

Articles listed on these pages have been found on publicly available internet pages and are cited with links to those pages. Some of the information included herein has been reprinted with permission from the authors or data repositories. Direct any requests via Email to SoS.Project (at) SecureDataBank.net for removal of the links or modifications to specific citations. Please include the ID# of the specific citation in your correspondence.

---

Academic SoS Research Programs

---

• Researchers at the Naval Postgraduate School are seeking to address the challenge of composing secure systems from heterogeneous components having different security characteristics. They apply basic cybersecurity science to identify and reason about properties relevant to composed secure systems. To narrow the scope of the work, they are investigating SCADA systems. (ID#:14-1010) See http://www.nps.edu/Academics/Schools/GSOIS/Departments/CAG/index.html

• DETER, a research project funded by the Department of Homeland Security, the National Science Foundation, and the Department of Defense, is aimed at making cyber security research a rigorous experimental science. Part of the project, DeterLab is a cyber-security experimentation lab for cyber-defense invention and evaluation used by researchers worldwide. The DETER research team at USC ISI and U.C. Berkeley receives support from more than 20 major universities, technology research labs, and corporations engaged in cyber-security research. (ID#:14-1163) See http://deter-project.org/about_deter_project

---

Note:

Articles listed on these pages have been found on publicly available internet pages and are cited with links to those pages. Some of the information included herein has been reprinted with permission from the authors or data repositories. Direct any requests via Email to SoS.Project (at) SecureDataBank.net for removal of the links or modifications to specific citations. Please include the ID# of the specific citation in your correspondence.

---

Cooperative SoS Activities

---

• SWAMP--A Tool for Software Assurance

• The Software Assurance Marketplace, or "SWAMP," opened in February 2014 to provide a resource for software developers, software assurance tool developers, infrastructure operators and software researchers to perform continuous assurance (CSwA) testing, and to collaborate and improve software assurance in a secure operating environment. Offerings include cloud security, cybersecurity, education, and open source.
• The "SWAMP" is a national software assurance resource funded by a grant from the Department of Homeland Security Science and Technology Directorate. Miron Livny will serve as its director and chief technology officer. It is housed in the Morgridge Institute for Research at the University of Wisconsin-Madison. Other participants include the Indiana University Center for Applied Cybersecurity Research, the University of Wisconsin Computer Sciences Department and the National Center for Supercomputing Applications at the University of Illinois, Urbana -Champaign.
• The SWAMP offers continuous, automated access to assessment capabilities including the assessment of Java, C and C++ software against five static analysis tools. The SWAMP's first set of tools include FindBugs, PMD, Clang, CppCheck and GCC and eight platforms. Results are displayed via Secure Decisions' CodeDx vulnerability results viewer. Over the next five years, the SWAMP will add mobile, dynamic and binary analysis tools and more assessment capabilities.
• According to Kevin Greene, DHS's software assurance program manager, "We see widespread adoption of the SWAMP as having a profound, positive impact on software systems and applications that powers our critical infrastructure. Better assurance practices lead to better security, it's that simple." He adds, "The SWAMP collaboration is a great example of the public and private sector coming together to advance improvements in software assurance activities to deal with emerging cyber threats." (ID#:14-1230)

• News article about SWAMP. University of Illinois National Supercomputing Center. http://www.ncsa.illinois.edu/news/story/ncsa_helps_launch_resource_to_fight_cybercrime

• To learn more about SWAMP, visit http://www.continuousassurance.org

• The U.S. Army Research Laboratory (ARL) has established a Collaborative Research Alliance (CRA) comprised of ARL, U.S. Army Communications-Electronics Research, Development and Engineering Center, academia and industry researchers to study cyber science issues as they relate to Army networks. Led by Pennsylvania State University, the CRA also includes Carnegie Mellon University, Indiana University, the University of California at Davis, and the University of California Riverside. "The CRA gives us an opportunity to jointly advance the theoretical foundations of a science of cybersecurity in the context of Army networks. Such a science will eventually lead to network defense strategies and empirically validated tools. Substantial interactions and staff rotations between domain experts and scientists across the consortium and ARL will be vital to enable the joint research that will ensure the success of the program," said Dr. Ananthram Swami, the Collaborative Alliance Manager for the CRA. (ID#:14-1231) See http://www.arl.army.mil/www/default.cfm?article=2382

---

Note:

Articles listed on these pages have been found on publicly available internet pages and are cited with links to those pages. Some of the information included herein has been reprinted with permission from the authors or data repositories. Direct any requests via Email to SoS.Project (at) SecureDataBank.net for removal of the links or modifications to specific citations. Please include the ID# of the specific citation in your correspondence.

---

Interdisciplinary SoS Activities

• Carnegie Mellon University CyLab is a multidisciplinary effort involving faculty and graduate students from more than six different CMU departments and schools. It initiates partnerships between the public and private sectors to develop new technologies for measurable, secure, available, trustworthy, and sustainable computing and communications systems. CyLab has identified seven areas of research and development that cover a range of technologies, systems and users. Its projects fall under one or more research areas, and are designed to create cross-functional and multi-disciplinary solutions by leveraging skills from faculty across the university. In addition to technical capabilities, skills may include such areas as policy development, risk management or modeling. The goal of CyLab projects is to develop a new generation of technologies that will lead to measurable, available, secure, trustworthy, and sustainable computing and communications systems while concurrently developing management and policy tools that enable successful exploitation of the new technologies. For an example of a project that spans several disciplines, see https://www.cylab.cmu.edu/research/projects/2013/secure-software-development-operation.html (ID#:14-1017)

• Boston University's Center for Reliable Information Systems and Cyber Security (RISCS) was established to promote and coordinate research and education in system reliability and information security by emphasizing a multidisciplinary approach. In addition to such technical disciplines as reliable and secure computations and engineering, other fields include economics, ethics, and law. The Center involves faculty and graduate students from the Colleges of Arts and Sciences and Engineering, the School of Management, and Metropolitan College. The Center is focusing its research on cryptology, network and software security, software safety, economic and game-theoretic approaches to Internet computing, data base security, robust monitoring, fair and secure file sharing, among others. One research project, "New Directions in Cryptography" is seeking to develop new algorithmic and analytical techniques to address the fact that there are no longer traditional boundaries between the attacker and the "private internals" of the cryptographic algorithm under attack. For details on this and other RISCS projects, see http://www.bu.edu/riscs/ (ID#:14-1018)

---

Note:

Articles listed on these pages have been found on publicly available internet pages and are cited with links to those pages. Some of the information included herein has been reprinted with permission from the authors or data repositories. Direct any requests via Email to SoS.Project (at) SecureDataBank.net for removal of the links or modifications to specific citations. Please include the ID# of the specific citation in your correspondence.

---

Meet the Leaders in SoS Research

---

• Dr. Carl Landwehr: A member of the 2012 Cyber Security Hall of Fame (http://www.cybersecurityhalloffame.com/), Dr. Landwehr is known as a leader in the field of trustworthy computing. His contributions have focused on high assurance software development through the identification of software vulnerabilities, token-based authentication, system evaluation, and multilevel security. He holds degrees from Yale and the University of Michigan and has taught at Purdue, Georgetown, Virginia Tech, and the University of Maryland. He worked as a senior researcher in cyber security at the Naval Research Lab, and has led cybersecurity programs at the National Science Foundation, and at IARPA. Long an active member of IEEE, he received their Outstanding Contribution Award in 2009. He is currently a Lead Research Scientist at the Cyber Security Policy and Research Institute (CSPRI) at George Washington University and also serves as a senior advisor to the Office of the Director of National Intelligence. (ID#:14-1012)

• Dr. Gene Spafford: Dr Spafford, a leader in the field of computing, was elected to the Cyber Security Hall of Fame in 2013. His research has focused on computing and network security, and security policies and ethics. He founded the Center for Education and Research in Information Assurance and Security (CERIAS) at Purdue, and remains its Executive Director. He has served as an advisor and consultant on security and intelligence issues to multiple US Government agencies including the National Science Foundation and the Departments of Defense, Justice, and Energy, and to major corporations including Microsoft, Intel, and Unisys. He also served as a member of the President's Information Technology Advisory Committee. Active in many professional organizations, he has received awards from ACM, SANS and CRA, among others, for his leadership and contributions to computing and cyber security. He is a professor with appointment in Computer Science at Purdue University. (ID#:14-1013)

• Dr. Rivest, one of the inventors of the RSA algorithm, is the Andrew and Erna Viterbi Professor of Computer Science at MIT's Department of Electrical Engineering and Computer Science (EECS) and a member of MIT's Computer Science and Artificial Intelligence Laboratory (CSAIL). A 2012 inductee into the CyberSecurity Hall of Fame, he is also a member of the National Academy of Engineering, the National Academy of Sciences, and is a Fellow of the Association for Computing Machinery, the International Association for Cryptologic Research, and the American Academy of Arts and Sciences. His research interests currently focus on cryptography, computer and network security, voting systems, and algorithms. (ID#:14-1162)

---

Note:

Articles listed on these pages have been found on publicly available internet pages and are cited with links to those pages. Some of the information included herein has been reprinted with permission from the authors or data repositories. Direct any requests via Email to SoS.Project (at) SecureDataBank.net for removal of the links or modifications to specific citations. Please include the ID# of the specific citation in your correspondence.

---

SoS Academic Survey

---

• The SoS Academic survey continues to be updated as additional responses are received. Preliminary analysis indicates strong support for four critical elements:
  • The idea that current disciplines contribute to cybersecurity
  • Scientific success requires replication
  • Anonymity and accountability are relevant
  • Experimentation and hypothesis testing are "critical" elements

• Additional responses are still encouraged. (ID#:14-1011) See http://cps-vo.org/SoSSurvey

• Join the VO Portal for SoS at http://cps-vo.org/group/SoS

---

Note:

Articles listed on these pages have been found on publicly available internet pages and are cited with links to those pages. Some of the information included herein has been reprinted with permission from the authors or data repositories. Direct any requests via Email to SoS.Project (at) SecureDataBank.net for removal of the links or modifications to specific citations. Please include the ID# of the specific citation in your correspondence.

---

Spotlight on Research Activities Outside of the US

---

• The goal of University College London's Science of Cyber Security Research Institute is to move security from common, established practices to an evidence base. It focuses on understanding the overall security of organizations: technology, people and processes. The Institute encourages collaboration between and among researchers at multiple participating universities by hosting cross-university projects. Projects include Productive Security, Choice Architecture for Information Security, Games and Abstraction: The Science of Cyber Security, and Cyber Security Cartographies (CySeCa) (ID#:14-1019) See http://www.ucl.ac.uk/cybersecurity

• Centrum Wiskunde & Informatica (CWI) is the national research institute for mathematics and computer science in the Netherlands. The Institute's research focuses on five themes: Software, Information, Life Sciences, Logistics, and Energy; the Institute is further organized into research groups including Algorithms and Complexity, Cryptology, and Scientific Computing, among others. The research in the Cryptology Group is organized around the following themes: 1) communication security beyond the horizon; 2) theory; 3) alternative models; and 4) cryptanalysis and applications to information security. Additionally, there is special focus on interplays with algebra, number theory, geometry, combinatorics, probability theory, complexity theory, formal methods, quantum physics and information theory. (ID#:14-1020) See http://www.cwi.nl/

• Institut National de Recherche en Informatique et en Automatique (INRIA): The French Institute for Research in Computer Science and Automation is a public science and technology institution established in 1967 dedicated to computational sciences. INRIA has 3000 researchers located at eight research centers across France. Its researchers integrate basic and applied research and combine computer sciences with mathematics to invent the digital technologies of the future. INRIA research falls into five broad fields: Applied Mathematics, Computation, and Simulation; Algorithmics, Programming, Software, and Architecture; Networks, Systems and Services, Distributed Computing; Perception, Cognition, Interaction; Computational Sciences for Biology, Medicine, and the Environment. Each research field has multiple themes, and teams are focused on themes within research areas. (ID#:14-1021)See http://www.inria.fr/en/

• The aim of the European Research Consortium for Informatics and Mathematics (ERCIM) is to foster collaborative work within the European research community and to increase co-operation with European industry. Leading European research institutes from across Europe are members of ERCIM. Scientific Fields include Hardware; Computer Systems Organization; Software; Data; Theory of Computation; Mathematics of Computing; Information Systems; Computer Applications; Computing Milieux; and Mathematics. (ID#:14-1022) See http://www.ercim.eu/

• The Institute for Security, Privacy, and Information Security (ISPIA) at the University of Calgary is a multi-disciplinary research center focused on security and privacy in information communication systems. ISPIA researchers are drawn from the fields of mathematics, computer science, engineering, physics, history and law. Its membership also includes personnel from the IT and law enforcement community. ISPIA's research is wide-ranging, from technical areas such as theoretical cryptography and quantum computing to legal issues associated with privacy and digital rights. (ID#:14-1234) See http://www.ispia.ucalgary.ca

• The Center for Applied Cryptographic Research (CCACR) at the University of Waterloo conducts research in both theoretical and applied cryptography and information security. The Center is a cooperative activity with the Government of Canada and multiple Canadian corporations. The Center has a multi-disciplinary approach and draws from the departments of Combinatorics and Optimization, Computer Science, Electrical and Computer Engineering, Physics, and Pure Mathematics. In addition to the research projects themselves, the Center also sponsors research groups and labs. (ID#:14-1235) See http://cacr.uwaterloo.ca/

---

Note:

Articles listed on these pages have been found on publicly available internet pages and are cited with links to those pages. Some of the information included herein has been reprinted with permission from the authors or data repositories. Direct any requests via Email to SoS.Project (at) SecureDataBank.net for removal of the links or modifications to specific citations. Please include the ID# of the specific citation in your correspondence.

---