News Items

Verizon has released a comprehensive data breach report that covers a wide-range of attack scenarios. This report identifies potential targets, characteristics, patterns, and complexity measurements of different attacks that may be launched at a system. The purpose of this data breach digest is to help companies and individuals develop countermeasures against attacks, identify attacks when they occur, and form strategies for recovery. This article discusses the attributes of this report, examples of scenarios given, as well as the importance of a data breach report.

http://www.darkreading.com/threat-intelligence/verizon-data-breach-digest-triangulates-humanity-inside-security/d/d-id/1328123

It has been discovered that embedded devices are also susceptible to being hacked with Windows and Android malware. Mirai is a malware program that targets Linux-based devices such as IP cameras and digital video recorders to launch DDoS attacks. This article discusses the other impacts of this attack as well as how it performs.

http://www.csoonline.com/article/3168357/security/windows-trojan-hacks-into-embedded-devices-to-install-mirai.html

The US House of Representatives has passed the Email Privacy Act (H.R. 387). This act would require law enforcement to attain a search warrant before having access to private emails and other documents held with cloud storage providers such as Google. However, approval is still required from the US Senate. This article discusses what privacy advocates are doing to persuade the approval of this act as well as the weaknesses of other privacy acts such as the 1986 Electronic Communications Privacy Act (ECPA).

https://www.eff.org/deeplinks/2017/02/fight-over-email-privacy-moves-senate

Although research and development of quantum computers is still in progress, security companies are already anticipating breaks in encryptions due to quantum computing capabilities. The National Institute of Standards and Technology suggests the conversion to "post-quantum" encryption by 2025. This article discusses how some companies are bracing themselves for the potential impacts quantum computing may have on encryption.

https://www.technologyreview.com/s/603424/quantum-computing-paranoia-creates-a-new-industry/

Raleigh, NC

February 2, 2017

The winter 2016 quarterly Science of Security (SoS) Lablet meeting, sponsored by NSA, was hosted at North Carolina State University on February 1 and 2, 2017. Laurie Williams and Munindar Singh, Principle Investigators at NCSU, hosted the event. In addition to speakers from the Lablets and NSA, corporate speakers provided insights into the problems of privacy and security. Presentations of current research and interim findings stimulated thought and discussion.

Normally, blog posts about a super bowl commerial would not rate as interesting for the Science of Security community. However; one did.

As utilization of encrypted navigation through HTTPS increases, cyber criminals have detected vulnerabilities to bypass detection. Investigations reveal that hackers have discovered ways to attack by exploiting the inability to explore HTTPS tunnels due to access controls. This article discusses different attacks that can be launched when HTTPS is compromised as well as how to prevent such attacks and monitor threats.

https://www.scmagazineuk.com/https-abusers-hide-malware-in-encrypted-tunnels-to-avoid-security/article/635816/

As the number of security breaches rises, companies within the transactions industry are further exploring methods of biometrics as a means of uniquely identifying consumers based on biological characteristics, in order to strengthen the security of transactions. This article discusses the expected future of the biometrics market as well as how a few companies are currently utilizing this technology.

http://www.nasdaq.com/article/biometrics-and-payments-companies-are-using-your-fingerprints-for-cybersecurity-cm744228

San Francisco based R&D firm, Otherlab, is being funded by DARPA in a quest to develop low cost, "disposable" drones that can deliver time-sensitive items such as food in emergency or disaster situations. Currently the drones are constructed mainly of cardboard, with low cost electronics. DARPA is funding a second project to develop degradable electronics as well so that the entire drone can be deployed, delivered, and forgotten about.

http://spectrum.ieee.org/automaton/robotics/drones/otherlab-apsara-aerial-delivery-system

'One algorithm to rule them all'

What if there was a "master algorithm" to tie together all of the other machine learning algorithms currently being used today? Author, Pedro Domingos, is studying the possibility. This article provides an in depth look at the varying schools of thought on machine learning as well as the benefits and dangers of developing a master algorithm.

https://techcrunch.com/2017/01/30/is-a-master-algorithm-the-solution-to-our-machine-learning-problems/

Cisco, an industry leader in cybersecurity provides two security reports annually. The 2017 report was made available January 31. Download the latest Cisco Security report here:

http://b2me.cisco.com/en-us-annual-cybersecurity-report-2017

Companies need to include digital considerations in their business model and should be relying on their technology managers to help them do so says this author.

http://www.zdnet.com/article/software-first-companies-best-prepared-for-internet-of-things-era-ahead/

More and more companies are switching to tokenless physical access control and are facing security and logistical challenges.

https://www.secureidnews.com/news-item/moving-to-tokenless-physical-access-control/

An estimated 1 million cybersecurity jobs in the US remain unfilled. One authors perspective.

http://www.forbes.com/sites/gradsoflife/2017/01/18/the-looming-cybersecurity-crisis-and-why-opportunity-youth-are-the-solution/#2d13bfc41005

Call for Student Posters on Unmanned Aircraft Systems (UAS) Communications and Networking Research

The White House announced winners of the 2014, Presidential Early Career Award for Scientists and Engineers (PECASE). This award is the highest honor bestowed by the United States government on outstanding scientists and engineers in the early stages of their independent research careers.

List of Winners: https://en.wikipedia.org/wiki/Presidential_Early_Career_Award_for_Scientists_and_Engineers

Press Release: https://www.whitehouse.gov/the-press-office/2017/01/09/president-obama-honors-federally-funded-early-career-scientists

31 high school students had a mission. Investigate a murder mystery in a fictional presidential race by analyzing the digital evidence. The New Yorker article then details the boys (no girls participated this year) views on cybersecurity and the future. One wants to attend CMU someday.

For the article: http://www.newyorker.com/magazine/2017/01/09/inside-cyber-security-awareness-week

Lablet panel discusses progress in the Science of Security at quarterly meeting

Department of Transportation has announced a Notice of Proposed Rule Making for vehicle to vehicle communication. This communication technology would have each car broadcast data about itself, like speed or breaking, so that other vehicles around it know about and other hazards on the road. It is expected to reduce accidents. Obviously security and privacy is an important part of this technology. The privacy approach is not to broadcast identifying information. Security is also important. The soundness of the approach to mitigate these risks needs to be examined.

IBM announced their machine learning technology, Watson, was being beta tested in cybersecurity. They are trying to teach it to identify malicious behavior such was malware, insiders, banking fraud, finding vulnerabilities in code and in visualizing data.

IBM Press Release with additional Details: http://www-03.ibm.com/press/us/en/pressrelease/51189.wss

The Institute for Critical Infrastructure Technology (ICIT) released a report about CPS and cyber attackers. More specifically, it documents what is going on with using IoT as a base of cyberattack. As we have seen earlier with Mirai, this report puts everything together in a handy source. The report does make some recommendations, but most relevant to the Science of Security Community is that often with IoT, manufacturers have little incentive to build secure products (higher cost, longer development times).

SANS Institude annouced the winners of its 2016 Difference Makers Award. This award celebrates those individuals whose innovation, skill and hard work have resulted in real increases in information security.

More Information and List of Winners: https://www.yahoo.com/tech/sans-announces-winners-2016-difference-makers-award-191500562.html

The U.S. Commerce Department's National Institute of Standards and Technology (NIST) released a reference resource that will help U.S. employers more effectively identify, recruit, develop and maintain cybersecurity talent. The draft NICE Cybersecurity Workforce Framework (NCWF) provides a common language to categorize and describe cybersecurity work to help organizations build a strong staff to protect their systems and data.

Allen Institute for Artificial Intelligence, funded by Microsoft founder, Paul Allen, has updated their Semantic Scholar. It is a search engine powered with Machine Learning and AI. It was released in 2015 for the Computer Science Field and recently added nurosciences.

Yes, you can find Science of Security there.