Cybersecurity

November 1, 2017

SERC TALKS: “The Dilemmas of Cybersecurity – Why is Everything Broken?”

Speaker: Dr. William L. Scherlis, Carnegie Mellon University | CONTACT

Abstract

There are diverse barriers to advancement of strong cybersecurity, and many of these derive from unresolved conflicts among equities relating to technical means for high assurance, allocation of risk and liability, identity and attribution, deterrence and active defense, product and process evaluation, and diffusion of technology. What are the prospects, from a technical and policy perspective, to address these conflicts in ways that will enable higher levels of security?

Bio

William L. Scherlis is a Professor of Computer Science and Director of the Institute for Software Research (ISR) in the School of Computer Science at Carnegie Mellon University (CMU). He founded and led the CMU PhD Program in Software Engineering for its first decade of operation. He was Acting CTO for the Software Engineering Institute for 2012 and early 2013. Dr. Scherlis completed a Ph.D. in Computer Science at Stanford University, a year at the University of Edinburgh (Scotland) as a John Knox Fellow, and an A.B. at Harvard University in Applied Mathematics. His research relates to software assurance, cybersecurity, software analysis, and assured safe concurrency. Scherlis has testified before Congress on software sustainment, on information technology and innovation, and on roles for a Federal CIO. He interrupted his career at CMU to serve at Defense Advanced Research Projects Agency (DARPA) for six years, departing in 1993 as a senior executive. Scherlis chaired the National Research Council (NRC) study committee that produced the report Critical Code: Software Producibility for Defense in 2010. He served multiple terms as a member of the DARPA Information Science and Technology Study Group (ISAT). He has been an advisor to major IT companies and a founder of CMU spin-off companies. Scherlis is a Fellow of the IEEE and a lifetime National Associate of the National Academy of Sciences. He is a emeritus member of the SERC Research Council in the area of Trusted Systems.

October 4, 2017

SERC TALKS: “What are the Top Ten Software Security Flaws?”

DOWNLOAD SLIDES

Speaker: Gary McGraw, Synopsys | CONTACT

Abstract

Software security defects come in two categories: bugs in the implementation and flaws in the design. In the commercial marketplace, much more attention has been paid to finding and fixing bugs than has been paid to finding and fixing flaws. That is because automatically identifying bugs is a much easier problem than identifying design flaws. The IEEE Center for Secure Design was founded to address this issue head on. My presentation will cover the IEEE CSD’s first deliverable by introducing and discussing how to avoid the top ten software security flaws. The content was developed in concert with Twitter, Google, Cigital, HP, Sadosky Foundation of Argentina, George Washington University, Intel/McAfee, RSA, University of Washington, EMC, Harvard University, and Athens University of Economics and Business. During the talk, I will introduce and discuss how to avoid the top ten software security design flaws. It’s important, of course, to know that these flaws account for half of the defects commonly encountered in software security. But more important still is learning how to avoid these problems when designing a new system or revisiting an existing system.

Bio

Gary McGraw is the Vice President Security Technology of Synopsys (SNPS), a silicon valley company headquartered in Mountain View, CA. He is a globally recognized authority on software security and the author of eight best selling books on this topic. His titles include Software Security, Exploiting Software, Building Secure Software, Java Security, Exploiting Online Games, and 6 other books; and he is editor of the Addison-Wesley Software Security series. Dr. McGraw has also written over 100 peer-reviewed scientific publications, authors a periodic security column for SearchSecurity, and is frequently quoted in the press. Besides serving as a strategic counselor for top business and IT executives, Gary is on the Advisory Boards of Max Financial, NTrepid, and Ravenwhite. He has also served as a Board member of Cigital (acquired by Synopsys) and as Advisor to Dasient (acquired by Twitter), Fortify Software (acquired by HP), and Invotas (acquired by FireEye). His dual PhD is in Cognitive Science and Computer Science from Indiana University where he serves on the Dean’s Advisory Council for the School of Informatics. Gary produces the monthly Silver Bullet Security Podcast for Synopsys and IEEE Security & Privacy magazine (syndicated by SearchSecurity).

August 2, 2017

SERC TALKS: “How Do We Prepare the People Who Will Need to Manage the Real-time Responses to Cyber Attacks on Physical Systems?”

ABSTRACT:

As part of an ongoing multi-year SERC Research Task led by University of Virginia, the research effort focuses on development of cyber attack resilience concepts for cyber-physical systems, an experimentally-based set of activities have been focused on exploring human factors issues. In particular, situations involving human operators have been simulated where cyber attacks have been detected by a dedicated monitoring sub-system (referred to as a Sentinel), and a system operator is alerted and provided with relevant system reconfiguration advisories. The simulated attack scenarios include possibilities for extreme events, including possibilities for killing or seriously injuring people. The research effort has focused on operator responses to the detections and advisories, including a collaboration project with the MITRE Corporation in a simulation activity at Creech Air Force Base involving pilots remotely controlling attacked unmanned aerial vehicles (UAVs), and a collaboration project at Wright-Patterson Air Force Base (WPAFB) with the Air Force Institute of Technology involving experiments with 32 airmen remotely controlling attacked unmanned ground vehicles. The Creech Air Force Base effort raised a number of significant human factors questions that are especially pertinent to system reconfiguration responses to cyber attacks, while the more focused WPAFB experiments addressed the relationship between a particular operator behavioral characteristic (level of suspicion) and operator responses. The Talk provides the results from these efforts and their implications on operator selection and training, including identifying a broader set of needed integrated human factors and system design research activities focused on cyber attack resiliency.

Speakers: Dr. Barry Horowitz, University of Virginia | CONTACT || Dr. Inki Kim, University of Virginia | CONTACT

Short Biography of Dr. Horowitz

Dr. Horowitz is a SERC Research Council member in Trusted Systems and Principal Investigator of a 6 year long research project (Security Engineering). He is also the director for the University of Virginia (UVa) research site of the National Science Foundation sponsored Industry/University Cooperative Re- search Center called WICAT (Wireless Internet Center for Advanced Technology). Prior to UVa, he was president and CEO of the MITRE Corporation. He received the Air Force’s highest award for a civilian, is a member of the National Academy of Engineering, Tau Beta Pi and Eta Kappa Nu honor societies, and was awarded the AFCEA Gold Medal of Engineering in 1990. Dr. Horowitz is currently serving as a member of the Naval Studies Board (NSB) of the National Academy of Science, and has participated as a panel member on a variety of studies conducted by the Defense Science Board, the Army Science Board and the National Academy of Engineering.

Short Biography of Dr. Kim

Dr. Kim is an Assistant Professor in the Department of Systems and Information Engineering, and a faculty advisor for Human Factors Student Chapter at the University of Virginia. His research interest focuses on experiment, simulation and modeling of human behaviors and performance while interacting with advanced technologies. He supervises a laboratory (HCSI: Human-Centered Systems and Innovation) to empirically test cognitive and physical responses of people in reality and Virtual/Augmented reality. During his Ph.D. program at Penn State, he developed a virtual haptic simulation for resident training, and it was recognized in the Human Factors and Ergonomics Society (HFES) and the Institute of Industrial Engineers (IIE), and the work contributed to winning research grants from the National Institute of Health (NIH). Before joining the Ph.D. program in 2009, he had conducted and supervised thirteen industry projects to improve usability and affective responses to various consumer products for IBM, Hyundai Motors, LG Electronics, LG chemical, and the Korea Railroad Corporation. Earlier during his M.S. program at Seoul National University, Korea, he built a statistical model to predict affective responses of cinema audiences based on the visual and auditory cues in movies, and the research was sponsored by the Korea Film Council.

DOWNLOAD SLIDES