HotSoS 2017

file

Visible to the public Flawed Mental Models Lead to Bad Cyber Security Decisions: Let’s Do a Better Job

Submitted by jimblythe on Fri, 03/31/2017 - 4:05pm. Contributors:

ABSTRACT

Conventional computer security wisdom implicitly assumes models about humans and human organizations such as:

  • Only bad people circumvent security controls. (Corollary: good users never share passwords.)
  • It's actually possible for organizations to create and maintain a perfect electronic representation of the access control policies they need.

These models then translate into practices that conventional wisdom blesses as good. For just two examples:

file

Visible to the public Factors for Differentiating Human from Automated Attacks

Submitted by Masooda Bashir on Fri, 03/31/2017 - 4:05pm. Contributors:

Abstract

file

Visible to the public Exploring Defect Categories for Infrastructure as Code

Submitted by Laurie Williams on Fri, 03/31/2017 - 4:05pm. Contributors:

ABSTRACT

Infrastructure as code (IaC) technology refers to the process of automated and reproducible management of infrastructure that include operating systems, and software dependencies [1]. IaC technologies, such as Ansible, and Puppet aim to reduce deployment errors and deployment overhead through automation.

file

Visible to the public On the Disconnect between CVSS Scores and Vulnerability Bounties

Submitted by andy.meneely on Fri, 03/31/2017 - 4:05pm. Contributors:

ABSTRACT

file

Visible to the public Advanced Metrics for Risk-Based Attack Surface Approximation

Submitted by Laurie Williams on Fri, 03/31/2017 - 4:05pm. Contributors:

ABSTRACT:

Despite a growing number of threats, the software engineering community still faces a critical deficit of trained security professionals for defending against cyber attacks. To combat this shortage, efficient prioritization of the effort of security professionals is needed. To address this issue, we present Risk Based Attack Surface Approximation (RASA), which uses crash dump stack traces to approximate the attack surface of a system.