Protect

group_project

Visible to the public TWC: Medium: Collaborative: Developer Crowdsourcing: Capturing, Understanding, and Addressing Security-related Blind Spots in APIs

Despite an emphasis the security community places on the importance of producing secure software, the number of new security vulnerabilities in software increases every year. This research is based on the assumption that software vulnerabilities are caused by misunderstandings, or lack of knowledge, called blind spots, which the developers experience while they are building systems. When building systems, developers often focus more on functional requirements than on non-functional ones, such as security.

group_project

Visible to the public CAREER: Untrusted Computing Base: Detecting and Removing Malicious Hardware

Computer systems security is an arms race between defenders and attackers that has mainly been confined to software technologies. Increases in the complexity of hardware and the rising number of transistors per chip have created opportunities for hardware-based security threats. Among the most pernicious are malicious hardware footholds inserted at design time, which an attacker can use as the basis of a computer system attack. This project explores of the feasibility of foothold attacks and a fundamental design-time methodology for defending against them.

group_project

Visible to the public CAREER: Examining Users' Collective Privacy Management for Online Social Networks

To better articulate privacy as a dynamic and dialectic phenomenon in a Web 2.0 world, this project proposes a set of basic empirical research activities to investigate three aspects of privacy in online social networks: conceptualization, intervention, and awareness.

group_project

Visible to the public TWC: Medium: Collaborative: Black-Box Evaluation of Cryptographic Entropy at Scale

The ability to generate random numbers -- to flip coins -- is crucial for many computing tasks, from Monte Carlo simulation to secure communications. The theory of building such subsystems to generate random numbers is well understood, but the gap between theory and practice is surprisingly wide. As built today, these subsystems are opaque and fragile. Flaws in these subsystems can compromise the security of millions of Internet hosts.

group_project

Visible to the public EAGER: Exploring Spear-Phishing: A Socio-Technical Experimental Framework

A safe and productive society increasingly depends on a safe and trustworthy cyberspace. However, extensive research has repeatedly shown that the human factor is often the weakest part in cyberspace, and that users of information systems are often exposed to great risks when they respond to credible-looking emails. Thus, spear phishing attacks - which attempt to get personal or confidential information from users through well-targeted deceptive emails - represent a particularly severe security threat.

group_project

Visible to the public CAREER: Separations in Cryptography

Since the seminal work of Shannon in 1949 cryptography has been founded on unproven computational complexity. The security of cryptographic systems could fall apart if the assumptions behind their design turn out to be false. Thus, it is crucial to base the security of crypto-systems on weakest possible assumptions. A main component of finding minimal assumptions is to ``separate'' cryptographic tasks from assumptions that are weaker than those used in constructions. In light of recent developments in cryptography, the following two directions will be pursued:

group_project

Visible to the public TWC SBE: Option: Frontier: Collaborative: Towards Effective Web Privacy Notice and Choice: A Multi-Disciplinary Prospective

Natural language privacy policies have become a de facto standard to address expectations of notice and choice on the Web. Yet, there is ample evidence that users generally do not read these policies and that those who occasionally do struggle to understand what they read. Initiatives aimed at addressing this problem through the development of machine implementable standards or other solutions that require website operators to adhere to more stringent requirements have run into obstacles, with many website operators showing reluctance to commit to anything more than what they currently do.

group_project

Visible to the public TWC: Frontier: Collaborative: Enabling Trustworthy Cybersystems for Health and Wellness

This frontier project tackles many of the fundamental research challenges necessary to provide trustworthy information systems for health and wellness, as sensitive information and health-related tasks are increasingly pushed into mobile devices and cloud-based services.

group_project

Visible to the public  SBE: Option: Small: Safety for the Ages: Generational Differences in Motivations to Use Security Protections in an Online Banking Context

How does the average user cope with the threats they encounter while engaged in the most sensitive of all online activities, online banking? Online Safety for the Ages (OSA) examines generational differences in motivations to use risky online services and self-protective measures in the context of online banking. An influx of older adults attracted to the Internet by social media but at times unfamiliar with dealing with the hazards of online life, as well as younger users who are sometimes oblivious to those dangers, pose distinct challenges to the preservation of online safety.