Organizations are repeatedly embarrassed when their sensitive digital documents go public or fall into the hands of adversaries, often as a result of unintentional or inadvertent leakage. Such leakage has been traditi...
详细信息
ISBN:
(纸本)9781450329392
Organizations are repeatedly embarrassed when their sensitive digital documents go public or fall into the hands of adversaries, often as a result of unintentional or inadvertent leakage. Such leakage has been traditionally handled either by preventive means, which are evidently not hermetic, or by punitive measures taken after the main damage has already been done. Yet, the challenge of preventing a leaked file from spreading further among computers and over the Internet is not resolved by existing approaches. this paper presents a novel method, which aims at reducing and limiting the potential damage of a leakage that has already occurred. the main idea is to tag sensitive documents within the organization's boundaries by attaching a benign detectable malware signature (DMS). While the DMS is masked inside the organization, if a tagged document is somehow leaked out of the organization's boundaries, common security services such as Anti-Virus (AV) programs, firewalls or email gateways will detect the file as a real threat and will consequently delete or quarantine it, preventing it from spreading further. this paper discusses various aspects of the DMS, such as signature type and attachment techniques, along with proper design considerations and implementation issues. the proposed method was implemented and successfully tested on various file types including documents, spreadsheets, presentations, images, executable binaries and textual source code. the evaluation results have demonstrated its effectiveness in limiting the spread of leaked documents.
We are seeing a significant shift in the types and characteristics of computing devices that are commonly used. Today, more smartphones are sold than personal computers. An area of rapid growth are also cloud systems;...
详细信息
ISBN:
(纸本)9781450329392
We are seeing a significant shift in the types and characteristics of computing devices that are commonly used. Today, more smartphones are sold than personal computers. An area of rapid growth are also cloud systems; and our everyday lives are invaded by sensors like smart meters and electronic tickets. the days when most computing resources were managed directly by a computer's operating system are over---data and computation is distributed, and devices are typically always connected via the *** light of this shift, it is important to revisit the basic security properties we desire of computing systems and the mechanisms that we use to provide them. A building block of most of the security we enjoy in today's systems is accesscontrol. this panel will examine the challenges we face in adapting the accesscontrolmodels, techniques, and tools produced thus far to today's and tomorrow's computing environments. Key characteristics of these new systems that may require our approach to accesscontrol to change is that in many (e.g., cloud) systems users do not directly controltheir data; that a vast population of users operating mobile and other new devices has very little education in their use; and that cyber-physical systems permeate our environment to the point where they are often invisible to their *** control comprises enforcement systems, specification languages, and policy-management tools or approaches. In each of these areas the shifting computing landscape leaves us examining how current technology can be applied to new contexts or looking for new technology to fill the gap. Enforcement of access-control policy based on a trusted operating system, for example, does not cleanly translate to massively distributed, heterogeneous computing environments; to environments with many devices that are minimally administered or administered with minimal expertise; and to potentially untrusted clouds that hold sensitive data and computations that belo
the proceedings contain 14 papers. the topics discussed include: why do we know so little about programming languages, and what would have happened if we had known more?;scriptable operating systems with Lua;abstracti...
ISBN:
(纸本)9781450332118
the proceedings contain 14 papers. the topics discussed include: why do we know so little about programming languages, and what would have happened if we had known more?;scriptable operating systems with Lua;abstracting abstract control;contracts for domain-specific languages in ruby;sweeten your JavaScript: hygienic macros for ES5;design and evaluation of gradual typing for Python;SqueakJS: a modern and practical Smalltalk that runs in any browser;ACDC-JS: explorative benchmarking of Javascript memory management;dynamic page sharing optimization for the R language;using JavaScript and WebCL for numerical computations: a comparative study of native and web technologies;dynamic detection of object capability violations through model checking;object versioning to support recovery needs: using proxies to preserve previous development states in lively;and on the use of type predicates in object-oriented software: the case of Smalltalk.
Mass surveillance activities by the security agencies of the Five Eyes countries (e.g. NSA, CSEC, etc) pose a significant challenge to those who care about the privacy, security and other democratic rights related to ...
详细信息
ISBN:
(纸本)9781450329392
Mass surveillance activities by the security agencies of the Five Eyes countries (e.g. NSA, CSEC, etc) pose a significant challenge to those who care about the privacy, security and other democratic rights related to our burgeoning digitally mediated communications. the on-going media coverage of the Snowden documents has brought unprecedented attention to longstanding concerns about whether and how individuals can exercise effective control over their personal information as we increasingly lead our lives on-line. the revelations are also undermining comfortable assumptions about the institutions and infrastructures we depend on for the efficient and equitable functioning of a democratic society. We've seen agencies mandated to protect our networks compromise once trusted security standards, and secretly hoard vulnerabilities for later exploitation rather than fix them. We are witnesses to government and their corporate partners secretly accessing massive amounts of our data, and grudgingly acknowledge their activities only when forced to by whistleblowers. How can we restore trust in the organizations we interact with and hand our personal data to on a daily basis? How can we require them to be more open, transparent and accountable? What are the technically viable options that can help achieve the reliable protections that many regard as fundamental and wish they could take for granted?Drawing on recent research, this talk will review some of the key surveillance challenges we face in the areas of internet routing and identity authentication. the *** project provides a mapping tool for visualizing the routes data packets take across the internet backbone, and in particular where one's own traffic may be subject to NSA interception at key internet routing choke points. It further documents patterns of "boomerang routing", whereby domestic Canadian traffic is often routed via the US, exposing it to foreign surveillance, and compares the data privacy transpare
Modern software applications are commonly built by leveraging pre-fabricated modules, e.g. application programming interfaces (APIs), which are essential to implement the desired functionalities of software applicatio...
详细信息
Modern software applications are commonly built by leveraging pre-fabricated modules, e.g. application programming interfaces (APIs), which are essential to implement the desired functionalities of software applications, helping reduce the overall development costs and time. When APIs deal with security-related functionality, it is critical to ensure they comply withtheir design requirements since otherwise unexpected flaws and vulnerabilities may be consequently occurred. Often, such APIs may lack sufficient specification details, or may implement a semantically-different version of a desired security model to enforce, thus possibly complicating the runtime enforcement of security properties and making it harder to minimize the existence of serious vulnerabilities. this paper proposes a novel approach to address such a critical challenge by leveraging the notion of software assertions. We focus on security requirements in role-based accesscontrolmodels and show how proper verification at the source-code level can be performed with our proposed approach as well as with automated state-of-the-art assertion-based techniques.
In this paper a meta-model for information flow control is defined using the foundation of Barker's accesscontrol meta-model. the purposes for defining this meta-model is to achieve a more principled understandin...
详细信息
In this demonstration paper, we describe the implementation of a versatile accesscontrol prototype based on multimodal biometrics and graphical passwords that had been designed and developed aligned withthe current ...
详细信息
Context-aware accesscontrol systems should reactively adapt accesscontrol decisions to dynamic environmental conditions. In this paper we present an extension of the TRBAC model that allows the specification and enf...
详细信息
ISBN:
(纸本)9781450319508
Context-aware accesscontrol systems should reactively adapt accesscontrol decisions to dynamic environmental conditions. In this paper we present an extension of the TRBAC model that allows the specification and enforcement of general reactive policies. then we extend XacmL to support the new model, and illustrate a prototype implementation of the PDP. Copyright 2013 acm.
Version control systems are widely used in software development and document management. Unfortunately, versioning confidential files is not normally supported: Existing solutions encrypt the transport channel, but st...
详细信息
ISBN:
(纸本)9781450319508
Version control systems are widely used in software development and document management. Unfortunately, versioning confidential files is not normally supported: Existing solutions encrypt the transport channel, but store data in plaintext within a repository. We come up with an accesscontrol solution that allows secure versioning of confidential files even in the presence of a malicious server administrator. Using convergent encryption as a building block, we enable space-efficient storage of version histories despite secure encryption. We describe an implementation of our concept for the Subversion (SVN) system, and evaluate storage efficiency and runtime of this implementation. Our implementation is compatible with existing SVN versions without requiring changes to the storage backend. Copyright 2013 acm.
Mobile applications allow individuals on-the-move access to resources "anytime, anywhere" using hand-held mobile devices. We argue that for critical and sensitive resources this is often times not desirable ...
详细信息
ISBN:
(纸本)9781450319508
Mobile applications allow individuals on-the-move access to resources "anytime, anywhere" using hand-held mobile devices. We argue that for critical and sensitive resources this is often times not desirable - a lost or stolen mobile device can be tampered with to view or alter sensitive information. We need authorization policies that take into account time of access and location of the user in addition to the credentials of the user. Towards this end, we propose a new spatio-temporal role-based accesscontrol model. It improves upon existing models by providing features that are useful for mobile applications. thus, an application using our model can specify different types of spatio-temporal constraints. We discuss how such an application using our spatio-temporal accesscontrol model can be verified using the UPPAAL model checker. We also demonstrate how to reduce the state-space explosion problem that is inherent in model checkers. Copyright 2013 acm.
暂无评论