Advances in Information Security – serie

As cyberspace continues to rapidly expand, its infrastructure is now an in- gral part of the world's economy and social structure. Given this increasing int- connectivity and interdependence, what progress has been made in developing an ecosystem of safety and security? This study is the second phase of an initial - tempt to survey and catalog the multitude of emerging organizations promoting global initiatives to secure cyberspace. The authors provide a breakdown and analysis of organizations by type, - cluding international, regional, private-public, and non-governmental organi- tions. Concluding with a discussion of the progress made in recent years, the study explores current trends regarding the effectiveness and scope of coverage provided by these organizations and addresses several questions concerning the overall state of international cyber security. The authors would like to thank Mr. Anthony Rutkowski for generously p- viding his time, guidance, and support. The authors would also like to thank the International Telecommunication Union (ITU) Telecommunication Development Sector (ITU-D) and the United States National Science Foundation (NSF Grant R3772) for partially supporting the research conducted in this study. In addition, the authors would like to thank the Georgia Institute of Technology’s Center for International Strategy, Technology, and Policy (CISTP) for assistance in hosting the Cyber Security Organization Catalog, and the Georgia Tech Information Se- rity Center (GTISC) for cooperation and promotion of this study. Table of Contents 1 The International Landscape of Cyber Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 2 A Brief History of Global Responses to Cyber Threats . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

There are two groups of researchers who are interested in designing network protocols and who cannot (yet) effectively communicate with one another c- cerning these protocols. The first is the group of protocol verifiers, and the second is the group of protocol implementors. The main reason for the lack of effective communication between these two groups is that these groups use languages with quite different semantics to specify network protocols. On one hand, the protocol verifiers use specification languages whose semantics are abstract, coarse-grained, and with large atom- ity. Clearly, protocol specifications that are developed based on such semantics are easier to prove correct. On the other hand, the protocol implementors use specification languages whose semantics are concrete, fine-grained, and with small atomicity. Protocol specifications that are developed based on such - mantics are easier to implement using system programming languages such as C, C++, and Java. To help in closing this communication gap between the group of protocol verifiers and the group of protocol implementors, we present in this monograph a protocol specification language called the Timed Abstract Protocol (or TAP, for short) notation. This notation is greatly influenced by the Abstract Protocol Notation in the textbook Elements of Network Protocol Design, written by the second author, Mohamed G. Gouda. The TAP notation has two types of sem- tics: an abstract semantics that appeals to the protocol verifiers and a concrete semantics thatappeals to the protocol implementors group.

Intrusion Detection and Correlation: Challenges and Solutions presents intrusion detection systems (IDSs) and addresses the problem of managing and correlating the alerts produced. This volume discusses the role of intrusion detection in the realm of network security with comparisons to traditional methods such as firewalls and cryptography.The Internet is omnipresent and companies have increasingly put critical resources online. This has given rise to the activities of cyber criminals. Virtually all organizations face increasing threats to their networks and the services they provide. Intrusion detection systems (IDSs) take increased pounding for failing to meet the expectations researchers and IDS vendors continually raise. Promises that IDSs are capable of reliably identifying malicious activity in large networks were premature and never tuned into reality.While virus scanners and firewalls have visible benefits and remain virtually unnoticed during normal operations, the situation is different with intrusion detection sensors. State-of-the-art IDSs produce hundreds or even thousands of alerts every day. Unfortunately, almost all of these alerts are false positives, that is, they are not related to security-relevant incidents.Intrusion Detection and Correlation: Challenges and Solutions analyzes the challenges in interpreting and combining (i.e., correlating) alerts produced by these systems. In addition, existing academic and commercial systems are classified; their advantage and shortcomings are presented, especially in the case of deployment in large, real-world sites.

Image and Video Encryption provides a unified overview of techniques for encryption of images and video data. This ranges from commercial applications like DVD or DVB to more research oriented topics and recently published material. This volume introduces different techniques from unified viewpoint, then evaluates these techniques with respect to their respective properties (e.g., security, speed.....).The authors experimentally compare different approaches proposed in the literature and include an extensive bibliography of corresponding published material.

As e-learning increases in popularity and reach, more people are taking online courses and thus need to understand security issues relevant to this topic. Security in E-Learning discusses typical threats to e-learning projects and introduces how these issues have been and should be addressed. This knowledge is essential to conduct a security risk analysis effectively, because participants need to be aware of common threats, protection mechanisms and effort/cost issues. Based on the security risk analysis, appropriate preventive measures are thoroughly discussed in this book.Security in E-Learning is designed for a professional audience composed of researchers and practitioners in industry and IT professionals. This volume is also suitable for upper undergraduate-level and graduate-level students in computer science.

Impacts and Risk Assessment of Technology for Internet Security-Enabled Information Small-Medium Enterprises details the key impacts and risk assessment within the context of technology-enabled information (TEI), which is engaged in the process of discovering the opportunities and challenges presented by electronic data or information transfer to small medium enterprises (SMEs) business operations.

Hop Integrity in the Internet introduces a new security defense, hop integrity, that can be used against denial-of-service attacks in the Internet.  If a message that is part of a denial-of-service attack is originated by an adversarial host in the Internet and if the message header includes a wrong address for the originating host (in order to hide the true source of the attack), then the message will be classified as modified or replayed and will be discarded by the first router that receives the message in the Internet.A suite of protocols for providing hop integrity in the Internet is discussed in great detail. In particular, each protocol in the suite is specified and verified using an abstract and formal notation called the Secure Protocol Notation.  The protocols include:- Secure address resolution - Weak hop integrity - Strong hop integrity using soft sequence numbers- Strong hop integrity using hard sequence numbersOther benefits of hop integrity extend to secure routing, mobile IP, and IP multicast.

Data mining has emerged as a significant technology for gaining knowledge from vast quantities of data. However, concerns are growing that use of this technology can violate individual privacy. These concerns have led to a backlash against the technology, for example, a "Data-Mining Moratorium Act" introduced in the U.S. Senate that would have banned all data-mining programs (including research and development) by the U.S. Department of Defense.Privacy Preserving Data Mining provides a comprehensive overview of available approaches, techniques and open problems in privacy preserving data mining. This book demonstrates how these approaches can achieve data mining, while operating within legal and commercial restrictions that forbid release of data. Furthermore, this research crystallizes much of the underlying foundation, and inspires further research in the area.Privacy Preserving Data Mining is designed for a professional audience composed of practitioners and researchers in industry. This volume is also suitable for graduate-level students in computer science.

Biometric user authentication techniques evoke an enormous interest by science, industry and society. Scientists and developers constantly pursue technology for automated determination or confirmation of the identity of subjects based on measurements of physiological or behavioral traits of humans.Biometric User Authentication for IT Security: From Fundamentals to Handwriting conveys general principals of passive (physiological traits such as fingerprint, iris, face) and active (learned and trained behavior such as voice, handwriting and gait) biometric recognition techniques to the reader. Unlike other publications in this area that concentrate on passive schemes, this professional book reflects a more comprehensive analysis of one particular active biometric technique: handwriting. Aspects that are thoroughly discussed include sensor characteristic dependency, attack scenarios, and the generation of cryptographic keys from handwriting.

Data warehousing and data mining provide techniques for collecting information from distributed databases and for performing data analysis. The ever expanding, tremendous amount of data collected and stored in large databases has far exceeded our human ability to comprehend--without the proper tools. There is a critical need for data analysis that can automatically analyze data, summarize it and predict future trends. In the modern age of Internet connectivity, concerns about denial of service attacks, computer viruses and worms are extremely important.Data Warehousing and Data Mining Techniques for Cyber Security contributes to the discipline of security informatics. The author discusses topics that intersect cyber security and data mining, while providing techniques for improving cyber security. Since the cost of information processing and internet accessibility is dropping, an increasing number of organizations are becoming vulnerable to cyber attacks. This volume introduces techniques for applications in the area of retail, finance, and bioinformatics, to name a few.Data Warehousing and Data Mining Techniques for Cyber Security is designed for practitioners and researchers in industry. This book is also suitable for upper-undergraduate and graduate-level students in computer science.

This monograph is the outgrowth of Stefan Axelson's PhD Dissertation at Chalmers University in Göteborg, Sweden. The dissertation, in turn collects a number of research efforts performed over a period of six years or so into a coherent whole. It was my honor to serve as the "opponent" at Dr. Axelsson's examination. In the Swedish system, it is the job of the opponent to place the candidate's work into a broader perspective, demonstrating its significance and contributions to the field and then to introduce the work to the attendees at the examination. This done, the candidate presents the technical details of the work and the opponent critiques the work giving the candidate the opportunity to defend it^. This forward is adapted from the introduction that I gave at the examination and should serve to acquaint the reader, not only with the work at hand, but also with the field to which it applies. The title of the work, "Under­ standing Intrusion Detection Through Visualization," is particularly telling. As is the case with any good piece of research, we hope to gain an understanding of a problem, not just a recipe or simple solution of immediate, but limited utility. For much of its formative period, computer security concentrated on devel­ oping systems that, in effect, embodied a fortress model of protection.

Database security is one of the classical topics in the research of information system security. Ever since the early years of database management systems, a great deal of research activity has been conducted. Fruitful results have been produced, many of which are widely adopted in commercial and military database management systems. In recent years, the research scope of database security has been greatly expanded due to the rapid development of the global internetworked infrastructure. Databases are no longer stand-alone systems that are only accessible to internal users of - ganizations. Instead, allowing selective access from different security domains has become a must for many business practices. Many of the assumptions and problems in traditional databases need to be revisited and readdressed in decentralized en- ronments. Further, the Internet and the Web offer means for collecting and sharing data with unprecedented flexibility and convenience. New data services are eme- ing every day, which also bring new challenges to protect of data security. We have witnessed many exciting research works toward identifying and addressing such new challenges. We feel it is necessary to summarize and systematically present works in these new areas to researchers. This book presents a collection of essays, covering a wide range of today's active areas closely related to database security organized as follows. In Part I, We review classical work in database security, and report their recent advances and necessary extensions.

Software that covertly monitors user actions, also known as spyware, has become a first-level security threat due to its ubiquity and the difficulty of detecting and removing it. This is especially so for video conferencing, thin-client computing and Internet cafes.CryptoGraphics: Exploiting Graphics Cards for Security explores the potential for implementing ciphers within GPUs, and describes the relevance of GPU-based encryption to the security of applications involving remote displays. As the processing power of GPUs increases, research involving the use of GPUs for general purpose computing has arisen. This work extends such research by considering the use of a GPU as a parallel processor for encrypting data. The authors evaluate the operations found in symmetric and asymmetric key ciphers to determine if encryption can be programmed in existing GPUs. A detailed description for a GPU based implementation of AES is provided. The feasibility of GPU-based encryption allows the authors to explore the use of a GPU as a trusted system component. Unencrypted display data can be confined to the GPU to avoid exposing it to any malware running on the operating system.

Quality of Protection: Security Measurements and Metrics is an edited volume based on the Quality of Protection Workshop in Milano, Italy (September 2005). This volume discusses how security research can progress towards quality of protection in security comparable to quality of service in networking and software measurements, and metrics in empirical software engineering. Information security in the business setting has matured in the last few decades. Standards such as IS017799, the Common Criteria (ISO15408), and a number of industry certifications and risk analysis methodologies have raised the bar for good security solutions from a business perspective.Designed for a professional audience composed of researchers and practitioners in industry, Quality of Protection: Security Measurements and Metrics is also suitable for advanced-level students in computer science.

As postal liberalization gains momentum, traditional postage meter markets are being transformed into digital meter markets for enterprise mailers. Modern technologies such as cryptography, digital signatures, hardware security devices, the Internet, 2D bar codes, and high-speed scanning equipment have come together to establish different flavors of electronic postage, addressing the needs of postal operators, private carriers and mailers.Electronic Postage Systems:  Technology, Security, Economics introduces a taxonomy of electronic postage systems and explains their security risks and countermeasures. The underlying cryptographic mechanisms are introduced and explained, and the industrial-scale electronic postage systems existing worldwide, are sorted out with respect to this taxonomy. The author also discusses privacy and anonymous mail, the state of standardization of electronic postage, and the process of security evaluation and testing of electronic postage systems.

Our Internet-connected society increasingly relies on computers.  As a result, attacks on computers from malicious software have never been a bigger concern. Computer Viruses and Malware draws together hundreds of sources to provide an unprecedented view of malicious software and its countermeasures. This book discusses both the technical and human factors involved in computer viruses, worms, and anti-virus software.  It also looks at the application of malicious software to computer crime and information warfare.Computer Viruses and Malware is designed for a professional audience composed of researchers and practitioners in industry. This book is also suitable as a secondary text for advanced-level students in computer science.

Company network administrators are compelled today to aggressively pursue a robust network security regime. Network Security Policies and Procedures gives the reader a strong, multi-disciplinary understanding of how to pursue this goal.This professional volume introduces the technical issues surrounding security as well as how security policies are formulated at the executive level and communicated throughout the organization. Readers will gain a better understanding of how their colleagues on "the other side of the fence" view an organization’s security and will thus be better equipped to act in a way that forwards an organization’s goals.Network Security Policies and Procedures is intended for both technical and management professionals interested in learning how security manifests itself throughout all levels of an organization. This book is also suitable for advanced-level students in computer science and electrical engineering.

Shared resources, such as the Internet, have created a highly interconnected cyber-infrastructure. Critical infrastructures in domains such as medical, power, telecommunications, and finance are highly dependent on information systems. These two factors have exposed our critical infrastructures to malicious attacks and accidental failures. Many malicious attacks are achieved by malicious code or malware, such as viruses and worms. Given the deleterious affects of malware on our cyber infrastructure, identifying malicious programs is an important goal. Unfortunately, malware detectors have not kept pace with the evasion techniques commonly used by hackers, i.e., the good guys are falling behind in the arms race.Malware Detection captures the state of the art research in the area of malicious code detection, prevention and mitigation.

Localization is a critical process in mobile ad hoc networks and wireless sensor networks. Wireless sensor node or MANET devices need to know the network's location or its relative location, with respect to the rest of the network neighbors. However, due to the open spectrum nature of wireless communication, it is subject to attacks and intrusions. Hence the wireless network synchronization needs to be both robust and secure. Furthermore, issues such as energy constraints and mobility make the localization process even more challenging.Secure Localization and Time Synchronization for Wireless Sensor and Ad Hoc Networks presents the latest research results in the area of secure localization for both wireless mobile ad hoc networks and wireless sensor networks.

The recent technological advances have made it possible to deploy small, l- power, low-bandwidth, and multi-functional wireless sensor nodes to monitor and report the conditions and events in their local environments. A large collection of these sensor nodes can thus form a wireless sensor network in an ad hoc manner, creating a new type of information systems. Such sensor networks have recently emerged as an important means to study and interact with the physical world and have received a lot of attention due to their wide applications in military and civilian operations such as target tracking and data acquisition. However, in many of these applications, wireless sensor networks could be deployed in hostile environments where there are malicious attacks against the network. Providing security services in sensor networks, however, turns out to be a very challenging task. First, sensor nodes usually have limited resources such as storage, bandwidth, computation and energy. It is often undesirable to implement expensive algorithms (e. g. , frequent public key operations) on sensor nodes. Second, sensor nodes are usually deployed unattended and built without compromise prevention in mind. An attacker can easily capture and compromise a few sensor nodes without being noticed. When sensor nodes are compromised, the attacker can learn all the secrets stored on them and launch a variety of attacks. Thus, any security mechanism for sensor networks has to be resilient to compromised sensor nodes.

The open design of the Internet has not only opened many new opp- tunities for communications, but it has also opened many new avenues for attackers against organisations network and computing resources. This book is a critical investigation of the Internet Protocol Security (IPSec) based on combination of theoretical investigation and practical implementation, which provides an in-depth understanding of the IPSec framework. The bene?ts of IPSec were exploited while the delimiting factors cannot be ignored. Infor- tion security has become a major concern in recent times as more and more computers are being connected to the global Internet. With so much data tra- ferring over public networks, the risk of sensitive information has increased exponentially and the increase of Internet hosts continuously requires ad- tional security support. The IPSec may be used in three different security - mains: Virtual private networks, Application-level security, and Routing se- rity. It comprises of suite of protocols, which are developed to ensure that the integrity, con?dentiality and authentication of data communications over an IP network. The IPSec is predominately used in virtual private networks (VPNs). But when used in application-level security or routing security, the IPSec is not a complete solution and must be coupled with other security measures to be effective. As with other security systems, poor maintenance can easily lead to a critical system failure.

Computer and network security is an issue that has been studied for many years. The Ware Report, which was published in 1970, pointed out the need for c- puter security and highlighted the di?culties in evaluating a system to determine if it provided the necessary security for particular applications. The Anderson Report, published in 1972, was the outcome of an Air Force Planning Study whose intent was to de?ne the research and development paths required to make secure computers a reality in the USAF. A major contribution of this report was the de?nition of the reference monitor concept, which led to security kernel architectures. In the mid to late 1970s a number of systems were designed and implemented using a security kernel architecture. These systems were mostly sponsored by the defense establishment and were not in wide use. Fast forwarding to more recent times, the advent of the world-wide web, inexp- sive workstations for the o?ce and home, and high-speed connections has made it possible for most people to be connected. This access has greatly bene?ted society allowing users to do their banking, shopping, and research on the Int- net. Most every business, government agency, and public institution has a public facing web page that can be accessed by anyone anywhere on the Internet. - fortunately, society’s increased dependency on networked software systems has also given easy access to the attackers, and the number of attacks is steadily increasing.

Preserving Privacy for On-Line Analytical Processing addresses the privacy issue of On-Line Analytic Processing (OLAP) systems. OLAP systems usually need to meet two conflicting goals. First, the sensitive data stored in underlying data warehouses must be kept secret. Second, analytical queries about the data must be allowed for decision support purposes. The main challenge is that sensitive data can be inferred from answers to seemingly innocent aggregations of the data. This volume reviews a series of methods that can precisely answer data cube-style OLAP, regarding sensitive data while provably preventing adversaries from inferring data.Preserving Privacy for On-Line Analytical Processing is appropriate for practitioners in industry as well as graduate-level students in computer science and engineering.

Botnets have become the platform of choice for launching attacks and committing fraud on the Internet. A better understanding of Botnets will help to coordinate and develop new technologies to counter this serious security threat. Botnet Detection: Countering the Largest Security Threat, a contributed volume by world-class leaders in this field, is based on the June 2006 ARO workshop on Botnets. This edited volume represents the state-of-the-art in research on Botnets. It provides botnet detection techniques and response strategies, as well as the latest results from leading academic, industry and government researchers. Botnet Detection: Countering the Largest Security Threat is intended for researchers and practitioners in industry. This book is also appropriate as a secondary text or reference book for advanced-level students in computer science.

Telecommunications networks are a critical component of the economic and social infrastructures in which we live. Each day, well over three billion people across the globe rely upon these systems, as their primary means of connecting to the world around them.Given the significant focus on securing critical infrastructure in recent years, Security for Telecommunications Networks creates a starting place for new researchers in the field of secure telecommunications networks. This volume not only discusses emerging threats, along with system vulnerability, but also presents the open questions posited by network evolution and defense mechanisms. This is one of the first books to discuss securing current and next generation telecommunications networks by the security community.Security for Telecommunications Networks is designed for a professional audience composed of practitioners and researchers in industry. This book is also suitable as a secondary text book or reference for advanced-level students in computer science and electrical engineering.

Vulnerability Analysis is a process that defines, identifies, and classifies the vulnerabilities in a computer network or an application. Vulnerability in a network or application can in turn be used to launch various attacks like cross-site scripting attacks, SQL injection attacks, format string attacks, buffer overflows, DNS amplification attacks etc. Although these attacks are not new and are well known, the number of vulnerabilities disclosed to the public jumped nearly 5 percent during the first six months of 2007. This accounts to be the fourth year report, which shows the raise in vulnerability (see the news link on security focus http://www.securityfocus.com/brief/614). In January 2007, a vulnerable network resulted in a theft of 45.6 million credit card numbers in TJX companies due to unauthorized intrusion. A good protocol analysis and effective signature writing is one of the - fective method to prevent vulnerability and minimize the chances of intrusion in the network. However, protocol analysis poses two challenges namely false po- tive and evasion. If the signature to prevent the vulnerability is not written pr- erly, it will result in dropping of a valid traffic thereby resulting in false positive. An effective signature should also consider the chances of evasion; otherwise a malicious attacker can use the variant of exploit and evade the protection provided by the IDS/IPS.

Research oriented non-repudiation protocols have been active since the beginning of this millennium. It is time to take a step forward and realize that in many applications there are more than two entities. Secure Multi-Party Non-Repudiation Protocols and Applications supports this statement. This volume provides state of the art in non-repudiation protocols and gives insight of its applicability to e-commerce applications. This professional book organizes the existing scant literature regarding non-repudiation protocols with multiple entities participation. It provides the reader with sufficient grounds to understand the non-repudiation property and its applicability to real applications.Secure Multi-Party Non-Repudiation Protocols and Applications is essential for professional audiences with in-depth knowledge of information security and a basic knowledge of applied cryptography. This book is also suitable as an advanced-level text or reference book for students incomputer science.

In our world of ever-increasing Internet connectivity, there is an on-going threat of intrusion, denial of service attacks, or countless other abuses of computer and network resources. In particular, these threats continue to persist due to the flaws of current commercial intrusion detection systems (IDSs).Intrusion Detection Systems is an edited volume by world class leaders in this field.This edited volume sheds new light on defense alert systems against computer and network intrusions. It also covers integrating intrusion alerts within security policy framework for intrusion response, related case studies and much more. This volume is presented in an easy-to-follow style while including a rigorous treatment of the issues, solutions, and technologies tied to the field.Intrusion Detection Systems is designed for a professional audience composed of researchers and practitioners within the computer network and information security industry. It is also suitable as a reference or secondary textbook for advanced-level students in computer science.

The Primality Testing Problem (PTP) has now proved to be solvable in deterministic polynomial-time (P) by the AKS (Agrawal-Kayal-Saxena) algorithm, whereas the Integer Factorization Problem (IFP) still remains unsolvable in (P). There is still no polynomial-time algorithm for IFP. Many practical public-key cryptosystems and protocols such as RSA (Rivest-Shamir-Adleman) rely their security on computational intractability of IFP.Primality Testing and Integer Factorization in Public Key Cryptography, Second Edition, provides a survey of recent progress in primality testing and integer factorization, with implications to factoring based public key cryptography. Notable new features are the comparison of Rabin-Miller probabilistic test in RP, Atkin-Morain elliptic curve test in ZPP and AKS deterministic test.This volume is designed for advanced level students in computer science and mathematics, and as a secondary text or reference book; suitable for practitioners and researchers in industry.