Subject: Electronic CIPHER, Issue 54, June 7, 2003
_/_/_/_/ _/_/_/ _/_/_/_/ _/ _/ _/_/_/_/ _/_/_/_/
_/ _/ _/ _/ _/ _/ _/ _/ _/
_/ _/ _/_/_/_/ _/_/_/_/ _/_/ _/_/_/_/
_/ _/ _/ _/ _/ _/ _/ _/
_/_/_/_/ _/_/_/ _/ _/ _/ _/_/_/_/ _/ _/
====================================================================
Newsletter of the IEEE Computer Society's TC on Security and Privacy
Electronic Issue 54 June 7, 2003
Hilarie Orman, Editor Sven Dietrich, Assoc. Editor
Bob Bruen, Book Review Editor
====================================================================
http://www.ieee-security.org/cipher.html
Contents:
* Letter from the Editor
* Conference and Workshop Announcements
* Conference and Workshop Announcements
o Cipher calls-for-papers and calendar
* Commentary and Opinion
o Reviews of selected talks from the IEEE Security and Privacy Symposium,
(Berkeley, California, May 12-14) by Jason Holt and Hilarie Orman
o Review of the IQPC conference on Australia's Infrastructure Security
(Sydney, April 22-23, 2003) by Vernon Stagg
o Tolga Acar's review of the book "Role-Based Access Control"
by D.F.Ferraiolo, D.R.Kuhn, R.Chandramouli
* Reader's guide to recent security and privacy literature,
(last new entry was March 15, 2002; contributions welcome)
* List of Computer Security Academic Positions, by Cynthia Irvine
* Staying in Touch
o Information for subscribers and contributors
o Recent address changes
* Interesting Links and New reports available via FTP and WWW
* Links for the IEEE Computer Society TC on Security and Privacy
o Becoming a member of the TC
o TC Officers
o TC publications for sale
====================================================================
Letter from the Editor
====================================================================
Dear Readers:
Jim Davis, Cipher's excellent editor for the last 3 years, has become
editor emeritus, his time now being taken up fully on research
efforts. It was only a matter of a day between my volunteering to
step up and my receiving a flood of email about the myriad of details
that the editor handles routinely. On behalf of all our readers I
offer him our thanks for his efforts towards making Cipher a reliable
and interesting publication for the security community.
Why did I volunteer for this? I think I was caught up in enjoyment of
the Security and Privacy Symposium, the granduer of the TC meeting in
the Claremont ballroom, and the thought that it would be fun. Please
help make it so by contributing material for Cipher - conference summaries,
book reviews, news reports, etc. With so many people facing restricted
travel budgets, conference reports are especially valuable.
Sven Dietrich is the new associate editor, and he is welcomed to the
Cipher masthead.
Some of you may have seen that the new IEEE Security and Privacy
magazine is associated with an on-line forum for the security
community. I would like to hear thoughts on how we might use this for
fast-breaking news and discussion.
I'm now using an automated mailing list for distributing Cipher. This
is run from a local ISP, and it greatly simplifies the task of
handling a large mailing list and eliminating spam. Also, there are a slew
of new email aliases for communicating with the Cipher department editors;
these get forwarded through the ieee-security.org site and will make it
easier to assure that information gets to the right people.
[Of course, it might make it more difficult. Just as I posted this issue
to the web, I found that the email forwarding capability ceased to
work a few weeks ago during the website migration; I hope this will be
fixed by June 9 and that I will be able to recover any messages sent
between May 23 and then.]
As always, thanks to our colleagues, old and new, who contribute to Cipher!
Secure regards,
Hilarie Orman
cipher-editor@ieee-security.org
====================================================================
Conference and Workshop Announcements
====================================================================
====================================================================
Upcoming Calls-For-Papers and Events
====================================================================
The complete Cipher Calls-for-Papers is located at
www.ieee-security.org/cfp.html. The Cipher event Calendar is at
www.cs.utah.edu/flux/cipher/cipher-hypercalendar.html
____________________________________________________________________
Cipher Event Calendar
____________________________________________________________________
Calendar of Security and Privacy Related Events
maintained by Hilarie Orman
Date (Month/Day/Year), Event, Locations, web page for more info.
* 6/23/03: WISP, Eindhoven, Netherlands;
http://www.iit.cnr.it/staff/fabio.martinelli/wisp-cfp.html
* 6/23/03- 6/24/03: WIAPP '03, San Jose, CA;
* 6/25/03: AMS 2003, Seattle WA; http://www.caip.rutgers.edu/ams2003
* 6/26/03- 6/28/03: WISE 3, Monterey, California,
http://cisr.nps.navy.mil/wise3/
* 6/26/03- 6/27/03: FCS '03, Ottawa, Canada;
http://www.cs.stanford.edu/~iliano/fcs03/
* 6/30/03-7/ 1/03: ECIW 2003, University of Reading, UK;
-----------------
* 7/1/03: WORM, Washington, DC; http://pisa.ucsd.edu/worm03/
* 7/2/03: CSFW 16, Pacific Grove, CA.
www.csl.sri.com/csfw/index.html
* 7/9/03- 7/11/03: ACISP 2003, Wollongong, Australia;
http://www.itacs.uow.edu.au/research/NSLabs/acisp03/
* 8/4/03- 8/ 6/03: IFIP WG11.3, Estes Park, Colorado;
http://www.cs.colostate.edu/~ifip03
* 8/11/03- 8/13/03: 7th ECC, Waterloo, Ontario, Canada
* 8/14/03- 8/15/03: SAC 2003, Ottawa, Canada Conf Web page
* 8/17/03- 8/21/03: CRYPTO '03, Santa Barbara, CA.
www.iacr.org/conferences/crypto2003/cfp.html
* 8/18/03- 8/21/03: NSPW 2003, Ascona, Switzerland; http://www.nspw.org/
* 8/25/03- 8/29/03: SIGCOMM 2003, Karlsruhe, Germany;
http://www.acm.org/sigcomm/sigcomm2003
* 8/25/03- 8/26/03: ICET '03, Minneapolis, Minnesota;
http://www.rfbinternational.com/ICET03.htm
* 8/25/03- 8/27/03: WISA 2003, Jeju Island, Korea Conf Web page
-----------------
* 9/ 1/03- 9/ 5/03: TRUSTBUS '03, Prague, Czech Republic;
http://www.uni-regensburg.de/Fakultaeten/WiWi/pernul/dexa03ws/
* 9/8/03- 9/10/03: RAID 2003, Pittsburgh, PA;
http://www.raid-symposium.org/raid2003
* 9/16/03- 9/19/03: ETFA 2003, Lisbon, Portugal;
http://www.uninova.pt/etfa2003
* 9/19/03: WiSe, San Diego, CA; Conf Web page, in conjunciton with Mobicom
* 9/20/03- 9/24/03: MMM-ACNS-2003, St. Petersburg, Russia;
http://space.iias.spb.su/mmm-acns03/
* 9/28/03-10/1/03: ICON 2003, Sydney, Australia.
www.ee.unsw.edu.au/~icon/
--------------
* 10/1/03-10/ 3/03: ISC '03, Bristol, UK;
http://www.hpl.hp.com/conferences/isc03/call_for_papers.htm
* 10/2/03-10/ 3/03: CMS 2003, Turin, Italy;
http://security.polito.it/cms2003/
* 10/10/03-10/13/03: ICICS '03, Mongolia, China;
http://www.cstnet.net.cn/icics2003/
* 10/16/03-10/19/03: ACNS '03, Kunming, China,
http://www.onets.com.cn/dhe.htm
* 10/27/03-10/31/03: CCS 2003, Washington, DC;
http://www.acm.org/sigs/sigsac/ccs/CCS2003/
* 10/27/03: WORM, Washington, DC; http://pisa.ucsd.edu/worm03/
* 10/30/03: FMSE 2003, Washington, DC; http://www.zurich.ibm.com/~mbc/FMSE02/
* 10/30/03: WPES 2003, Washington, DC; http://seclab.dti.unimi.it/wpes2003
--------------
* 11/ 4/03-11/ 7/03: ICNP '03, Atlanta, Georgia; http://icnp03.cc.gatech.edu
--------------
* 12/ 8/03-12/12/03: ACSAC 19, Las Vegas, Nevada; http://www.acsac.org
--------------
* 2/ 9/04- 2/12/04: FC '04, Key West, FL; http://ifca.ai/fc04/CFP.htm
* 2/19/04- 2/21/04: TCC 2004, Cambridge, MA; http://www-cse.ucsd.edu/users/mihir/tcc/tcc04/cfp.html
--------------
* 3/1/04- 3/ 4/04: PKC '04, Singapore, http://www.i2r.a-star.edu.sg/pkc2004/
____________________________________________________________________
Journal, Conference and Workshop Calls-for-Papers
____________________________________________________________________
Security and Survivability of Networked Systems (in conjunction with
HICSS-37), Big Island, Hawaii, USA, January 5-8, 2004. (submissions
due June 1, 2003) [posted here 5/12/03]
This minitrack focuses on security and survivability in large,
non-trivial, networked computer systems. Of special interest are
contributions that address survival, tolerance, recovery or masking of
malicious attacks. Submissions will be sought from researchers in the
area of system survivability, software dependability, computer and
network security, fault-tolerance and intrusion tolerance, and
economic or statistical modeling of secure/survivable systems. Topics
include, but are not limited to:
- System or software survivability
- Safety critical failure modes
- Network or system intrusion tolerance
- Modeling malicious behavior or attacks
- Mathematical models for verification of vulnerability to malicious acts
- Models for measurement, evaluation, or validation of survivability
- Software and hardware fault tolerance
- Design for dependability and/or survivability
- PRA and hybrid fault models accounting for malicious acts and events
More information can be found at http://www.cs.uidaho.edu/~krings/HICSS37.htm.
--------------
WPES 2003 2nd Workshop on Privacy in the Electronic Society,
Washington, D.C., USA, October 30, 2003. (submissions due June 10,
2003)
Privacy issues have been the subject of public debates and the need
for privacy-aware policies, regulations, and techniques has been
widely recognized. Goal of this workshop is to discuss the problems of
privacy in the global interconnected societies and possible solutions
to it. The workshop seeks submissions from academia and industry
presenting novel research on all theoretical and practical aspects of
electronic privacy, as well as experimental studies of fielded
systems. We encourage submissions from other communities such as law
and business that present these communities' perspectives on
technological issues. Topics of interest include, but are not limited
to:
- anonymity, pseudonymity, and unlinkability
- business model with privacy requirements
- data protection from correlation and leakage attacks
- electronic communication privacy
- information dissemination control
- privacy-aware access control
- privacy in the digital business
- privacy enhancing technologies
- privacy policies and human rights
- privacy and anonymity in Web transactions
- privacy threats
- privacy and confidentiality management
- privacy in the electronic records
- privacy in health care and public administration
- public records and personal privacy
- privacy and virtual identity
- personally identifiable information
- privacy policy enforcement
- privacy and data mining
- relationships between privacy and security
- user profiling
- wireless privacy
More information about the conference can be found at
http://seclab.dti.unimi.it/wpes2003.
--------------
WISA 2003 The 4th International Workshop on Information Security
Applications, Jeju Island, Korea, August 25-27, 2003. (submissions due
June 27, 2003)
The areas of interest include, but are not limited to:
- Internet Security - Cyber Indication and Intrusion Detection
- E-Commerce and Financial Cryptosystems
- Smart Cards and Secure Hardware
- Access Control and Database Security
- Network Security, VPNs and Firewalls
- Mobile Security
- Biometrics and Human Interfaces
- Applied Cryptography
- Privacy and Anonymity
- Public Key Cryptography / Key Management
- Security Management
- Threats and Information Warfare
- Digital Rights Management
- Virus Protection
- Secure Software, Systems and Applications
Additional information can be found on the conference web page at
http://icns.ewha.ac.kr/wisa2003.
---------------------
Nordsec2003 Nordic Workshop on Secure IT Systems, Gjo/vik University
College, Norway, October 15-17, 2003. (submissions due June 30, 2003)
The NORDSEC workshops started in 1996 with the aim of bringing together researchers and practitioners within computer security in the Nordic countries. The theme of the workshops have been applied security, i.e., all kinds of security issues that could encourage interchange and cooperation between the research community and the industrial/consumer community. Possible topics include, but are not limited to the following:
- Privacy and Privacy Enhancing Technologies
- Wireless Communication Security
- Inter/Intra/Extranet Security
- Security Protocol Modelling and Analysis
- E-and M-Business Security
- New Firewall Technologies
- Secure Infrastructures; TTP, PKI, Key Escrow/Recovery
- Computer Crime and Information Warfare
- Detecting Attacks, Intrusions and Computer Misuse
- Smart Card Applications
- Security Management and Audit
- Security Evaluations and Measurements
- Security in Commercial off-the-shelf Products, COTS
- Operating System Security
- Security Models
- New Ideas and Paradigms for Security
- Security Education and Training
- Quality of Service or Software Engineering in Relation to Security
More information can be found at www.hig.no/esorics2003/nordsec2003/.
---------------------
2003 ACM Workshop on Survivable and Self-Regenerative Systems (in
association with the 10th ACM Conference on Computer and
Communications Security), George Mason University, Fairfax VA,
October 31, 2003 (submissions due July 9, 2003)
One of the key areas of current research in the fields of computer and
communication security is survivability, where the objective is to
survive attacks that exploit inevitable security vulnerabilities,
rather than to strictly prevent or detect intrusions or
vulnerabilities. Survivability research has explored the intersection
of Fault Tolerance and Security, and recently, the notion of using
self-regenerative capabilities in the context of survivability has
generated a significant interest in the community. This workshop aims
to provide a venue for scholars in this area to exchange ideas and to
explore research issues involving survivable and self-regenerative
systems. Papers offering original research contributions in any aspect
of this emerging field are solicited for submission to this
workshop. Topics of interest include, but are not limited to, the
following:
- Survivable Systems & Networks
- Self-Regenerative Systems & Networks
- Use of Self-Healing Techniques in Surviving Attacks
- Security vs. Fault Tolerance in building survivable and self-regenerative systems
- Use of Self-Stabilization Techniques in Surviving Attacks
- Role of Formal Models in Survivable and Self-Regenerative Systems
- Self-Adapting and Self-Securing Systems and Techniques
- Measuring and Quantifying Survivability and Self-Regeneration
- Role of Redundancy, Diversity, Unpredictability and Deception in Survivable and
Self-Regenerative Systems
- Impact of Detection Accuracy and Latency on Survivability and
Self-Regeneration
More information can be found at http://www.acm.org/sigs/sigsac/ccs/CCS2003/workshops.html.
SASN 2003 Workshop on Security of Ad Hoc and Sensor Networks,
Washington, D.C., USA, October 31, 2003. (submissions due July 18,
2003)
Ad hoc and sensor networks are expected to become an integral part of
the future computing landscape. However, these networks introduce new
security challenges due to their dynamic topology, severe resource
constraints, and absence of a trusted infrastructure. This workshop
seeks submissions from academia and industry presenting novel research
on all aspects of security for ad hoc and sensor networks, as well as
experimental studies of fielded systems. Submission of papers based on
work-in-progress is encouraged. Topics of interest include, but are
not limited to, the following as they relate to wireless networks,
mobile ad hoc networks, or sensor networks:
- Security under resource constraints, e.g., energy, bandwidth, memory,
and computation constraints
- Performance and security tradeoffs
- Secure roaming across administrative domains
- Key management
- Authentication and access control
- Trust establishment, negotiation, and management
- Intrusion detection and tolerance
- Secure location services
- Privacy and anonymity
- Secure routing
- Secure MAC protocols
- Denial of service
- Prevention of traffic analysis
More information can be found at www.cs.gmu.edu/sasn.
--------------------
FC'04 Financial Cryptography, Key West, Florida, USA, February 9-12,
2004. (submissions due September 1, 2003)
Original papers and presentations on all aspects of financial-data
security and secure digital commerce are solicited for submission to
the Eighth Annual Conference on Financial Cryptography (FC '04). FC
'04 will bring together researchers and practitioners in the
financial, legal, cryptologic, and data-security fields to foster
cooperation and exchange of ideas. In addition to novel scientific
research as in previous years, the program for FC ?04 will include
sessions on digital finance and economics and on secure financial
systems and digital-cash architectures. For the systems and finance
sessions, submissions must have a visible bearing on
financial-security issues, but need not be exclusively concerned with
cryptography or security. A complete list of topics along with
instructions for submitting a paper can be found on the conference web
page at http://www.ifca.ai/fc04.
====================================================================
Conferences and Workshops
(the call for papers deadline has passed)
====================================================================
ACSAC 19 http://www.acsac.org
The 19th Annual Computer Security Applications Conference,
Las Vegas, Nevada USA, December 8-12, 2003.
Security and Survivability of Networked Systems (in conjunction with HICSS-37)
http://www.cs.uidaho.edu/~krings/HICSS37.htm
Big Island, Hawaii, USA, January 5-8, 2004,
ARCS
Adaptive and Resilient Computing Security , Santa Fe Institute Workshop,
SFI, NM, November 5-6, 2003. Email: robert.ghanea-hercock@bt.com
WiSe 2003 http://www.ece.cmu.edu/~adrian/wise2003/
Workshop on Wireless Security (in conjunction with MobiCom 2003)
San Diego, CA, USA, September 19, 2003,
4th Annual IEEE Information Assurance Workshop,
http://www.itoc.usma.edu/workshop/2003
United States Military Academy, West Point, NY, USA, June 18-20,
FCS'2003 www.cs.stanford.edu/~iliano/fcs03
LICS Satellite Workshop on Foundations of Computer Security, Ottawa,
Canada, June 26-27, 2003
PODSY2003 http://lpdwww.epfl.ch/fgaertner/podsy2003
Workshop on Principles of Dependable Systems, San Francisco, CA, USA,
June 22, 2003
WISP 2003 http://www.iit.cnr.it/staff/fabio.martinelli/wisp-cfp.html
Workshop on Issues in Security and Petri Nets, Eindhoven, NL, June 23, 2003
Special Session on Web Services, First International Conference on Web
Services, Las Vegas, NV, USA, June 23-26, 2003
http://tab.computer.org/tfec/icws03
WISE 3/ WECS 5 http://cisr.nps.navy.mil/wise3/
Third World Conference on Information Security Education, and
Workshop on Education in Computer Security, Naval Postgraduate School,
Monterey California, USA, June 26-28, 2003.
CSFW16 www.csl.sri.com/csfw/csfw16
16th IEEE Computer Security Foundations Workshop, Asilomar, Pacific Grove,
CA, USA, June 30-July 2, 2003.
ACISP 2003 www.itacs.uow.edu.au/research/nslabs/acisp03
The Eighth Australasian Conference on Information Security and Privacy,
Wollongong, Australia, July 9-11, 2003
Security in Distributed Computing (special track of the 22nd Annual
ACM SIGACT-SIGOPS Symposium on Principles of Distributed Systems),
Boston, Massachusetts, USA, July 13-16, 2003 www.podc.org/podc2003/
USENIX Security 2003 12th USENIX Security Symposium Washington, DC,
USA August 4-8, 2003 www.usenix.org
IFIP WG11.3 2003 7th Annual IFIP WG 11.3 Workshop Conference on Data
and Applications Security, Estes Park, Colorado, USA, August 4-6, 2003
www.cs.colsostate.edu/~ifip03
ECC 2003 www.cacr.math.uwaterloo.ca
The 7th Workshop on Elliptic Curve Cryptography, University of Waterloo,
Waterloo Canada, August 11-13, 2003
TrustBus'03 www.uni-regensburg.de/fakultaeten/wiwi/pernul/dexa03ws/
Trust and Privacy in Digital Business, Prague, Czech Republic, September 1-5,
2003
7th International Conference on Knowledge-Based Intelligent
Information & Engineering Systems (special session on Artificial
Intelligence Applications to Information Security), St Anne's College,
University of Oxford, U.K., September 3-5, 2003.
scalab.uc3m.es/~docweb/AIIS_KES03.html
CHES 2003 www.chesworkshop.org
Workshop on Cryptographic Hardware and Embedded Systems, Cologne,
Germany, September 8-10, 2003
CMS 2003 http://security.polito.it/cms2003/cfp.pdf
The 7th IFIP Communications and Multimedia Security Conference,
Turin, Italy, October 2-3, 2003
Communications Security Symposium (part of the IEEE GLOBECOM 2003
workshop), San Francisco, CA, USA, December 1-5, 2003.
www.globecom2003.com/CFP1.html
====================================================================
Commentary and Opinion
====================================================================
____________________________________________________________________
Book Reviews
____________________________________________________________________
Book reviews from past issues of Cipher are archived at
www.ieee-security.org/Cipher/BookReviews.html, and conference reports
are archived at www.ieee-security.org/Cipher/ConfReports.html.
____________________________________________________________________
Book Review By Tolga Acar
June 5, 2003
____________________________________________________________________
"Role-Based Access Control"
D.F.Ferraiolo, D.R.Kuhn, R.Chandramouli.
Artech House, Computer Security Series, 2003.
ISBN 1-58053-370-1
Finally, there is a book on RBAC (Role-Based Access Control). The book
covers research and development on Role-Based Access Control,
concentrates on the increased emphasis and popularity in the last
decade. This is the first book consolidating numerous RBAC papers. It
is a must-read for every RBAC researcher and developer and for an
organization offering or architecting a role-based access control
system.
The book starts with an overview of traditional access controls and
security models as prerequisites for understanding RBAC, such as Mandatory
and Discretionary Access Controls, Clark-Wilson, Biba and Chinese Wall
security models, and the reference monitor concept, among others. Most
security researchers can skip the first few chapters, or use it as a
starting point of their literature survey.
RBAC itself is described in three chapters. The first chapter explains
the core features: users, roles, permissions, role activation, user
and permission assignments, and permission mapping into
privileges. The second is on role hierarchies including inheritance
and hierarchy structures. The last core RBAC chapter is about
separation of duty (SoD) and constraints in RBAC systems: types of SoD,
SoD concepts in role hierarchies, SoD issues in privilege and role
asignments, and temporal constraints, all of which are adequately discussed.
The MAC on RBAC concept is defined for confidentiality-based MAC
systems. Simple, liberal and strict *-properties are defined for
the Bell-LaPadula security model providing confidentiality. Similar
concepts for Biba-type systems providing integrity are not discussed,
reflecting the present state of research.
NIST's proposed RBAC standard, role-based administration of RBAC
concepts are addressed in two chapters, followed by two chapters for
enterprise-minded readers: RBAC/XML access control frameworks and
their integration into enterprise environments. Interestingly, there
is no mention of XACML even though DOM and SAX API sets are briefly
discussed. There is no mention of GFAC (Generalized Framework for
Access Control) binding RBAC into this framework.
The chapter covering RBAC in Workflow Management systems, Web Systems,
Java, UNIX, and Federal Databases is quite helpful for RBAC
architects. This chapter alone is a good reason to have the book.
____________________________________________________________________
Conference Reports
____________________________________________________________________
____________________________________________________________________
Review of
Selected Talks from IEEE Security and Privacy Symposium
May 12-14, 2003
by Jason Holt and Hilarie Orman
___________________________________________________________________
Reviews by Jason Holt, BYU CS grad student
"Using Replication and Partitioning to Build Secure Distributed Systems"
Lantian Zheng, Stephen Chong and Andrew C. Myers from Cornell University,
and Steve Zdancewic from UPenn.
Paper available at http://www.cs.cornell.edu/andru/papers/sp03.pdf
Jif compiler available at: http://www.cs.cornell.edu/jif/
Andrew Myers gave a presentation about their Java extension called
"Jif". Jif provides integrity and confidentiality for data in
programs run on distributed systems of untrusting hosts. Data can be
given "confidential" or "integrity" labels with respect to specific
principals, and the compiler does the rest. "Confidential" means that
the object should never be revealed to the specified host (unless an
explicit "downgrade" is made to the policy). "Integrity" means that
the specified host (automagically) provides a commitment to a value
which is (again, automagically) verified when the value is later used.
Jif provides a sort of formal verification for checking assumptions
and catching errors during development, as well as code to catch
misbehaving hosts during execution.
------
"Using Memory Errors to Attack a Virtual Machine"
Sudhakar Govindavajhala, Andrew W. Appel, (Princeton)
Sudhakar Govindarajhala gave an enjoyable and well-received
presentation (and demonstration) of how to break a Java VM's type
checking mechanism in the presence of hardware memory errors. An
array of a carefully constructed objects of type A is created to use
up as much memory as possible. All the A objects contain pointers to
a single instance of a slightly different object of type B. If a
memory error flips a bit in any of the pointers, then with high
probability it will instead point to another type A object - even
though the VM thinks it's pointing at the B object. This creates a
sort of union in which a pointer can be modified as if it were an int.
The VM's security settings for the program can then be manipulated at
will. The attack is even portable, working on both IBM and Sun's Java
VMs, and Sudhakar pointed out that C# VMs should be just as
vulnerable.
He followed the talk with a demonstration, shining a bright light on the
DIMMs in a PC for a few minutes; the attack worked perfectly. ECC memory was
mentioned as a good candidate for protecting against this kind of attack, as
long as the machine takes action when a suspicious number of detectable faults
occur. Sudhakar also touched briefly on the possibility that an exploit might
be found which could take advantage of memory faults to compromise OS security
instead of just VM constraints, and that memory faults may be possible to
create (or simply exploit when they occur naturally) without close-range
attacks on the hardware itself.
------
"Secret Handshakes from Pairing-Based Key Agreements"
D. Balfanz, G. Durfee (PARC), N. Shankar (U. Maryland), D.K. Smetters, J.
Staddon, H.C. Wong (PARC)
Paper available at: http://www2.parc.com/csl/members/balfanz/publications/handshakes.pdf
Secret handshakes add new capabilities to credential systems and secure
service discovery mechanisms. Alice can send Bob a message which reveals that
she has credential A if and only if Bob possesses credential B.
Eavesdroppers and uncredentialed imposters learn nothing about what
credentials are required and used. This can be used to resolve circular
dependencies between Alice and Bob's policies (eg., where each reveals their
Secret Agent credential only to other Secret Agents). Balfanz et al provide a
specification for using secret handshakes in TLS, and have created a Java
implementation.
------
Reviews by Hilarie Orman, Purple Streak, Inc.:
Invited Talk, Matt Blaze, ATT Research
Blaze's work on understanding the security of metal keys is entertaining to
the cryptographic community because of its analogies to "breaking" a
mathematical or software system based on security through obscurity.
In his invited talk he gave some of the history of metal key and lock
designs, including some interesting commentary from over a hundred
years ago about the advantages of public discussion of security. By
the 1950's the discourse seems to have changed in favor of a viewing
locksmiths as a secret guild, protecting the public through its
obscure information. Blaze showed how easy it was to burst through
the secrecy of a particular lock and key design and to produce a
master key by analyzing the simple combinatorics and chipping away at a
test key.
A novel twist to the talk was seeing Blaze exhibit a portable device
for cutting keys, and during the coffee break he demonstrated its use,
producing a master key for an example lock system starting from a key blank
a key instance.
Another interesting piece of information came from Steve Bellovin's
short remarks about the simplistic nature of the rekeying system used
for electronic locks in hotels.
------
Invited Talk, Michael Howard, Microsoft
Howard is part of group with Microsoft, headed by Steve Lipner, that
shows developers how to produce more secure software. Showing a bit
of attitude even before speaking, he displayed his Powerpoint slides
from a laptop machine bearing a bumper sticker in highly visible
lettering asserting "My other machine is your Linux box".
Howard takes a down-to-earth, practical approach to the problem. He
makes developers aware of the dangers of leaving opportunities for
exploits by system security underminers. His goal is to have
Microsoft's products free from bonehead errors like buffer overflows,
gratuitously high privilege levels, unnecessary features, and a host
of other evils.
A questioner revealed some skepticism in asking about Microsoft's
notorious "Easter Eggs." Howard showed his belief that his
organization has some bite behind its bark in replying that Easter Egg
hiders would be fired.
____________________________________________________________________
Review of
IQPC Conference on National Critical Infrastructure in Australia
by Vernon Stagg
___________________________________________________________________
During April 22-23, 2003 the International Quality and Productivity Centre
(IQPC) ran a conference in Sydney, Australia that was based on National
Critical Information Infrastructure in Australia. (This review and
associated web links are available from my website http://www.infowar.com.au)
Peter Coroneos, Chief Executive of the Internet Industry Association chaired
Day One of the conference. He discussed how the issues are real and that we
need to consider the Cyber dimension and the Internet. There is a need to
determine criticality, and understand that many elements that are critical
aren't necessarily obvious. Peter discussed the IIA's role in securing the
Internet in Australia, the relationship with law enforcement agencies, and
problems with prosecuting cyber crimes. He also detailed an Anti-SPAM
campaign that the IIA has begun.
Speakers
Mike Rothery, Senior Adviser National Information Infrastructure (NII), the
Australian Attorney-General's Department discussed Information
Infrastructure Assurance and the role the AGD has in NII protection. He
spoke of how infrastructure assurance is more than just IT security, and
that we must consider organisational and information risks. Need to realise
that previously discrete (disconnected) systems are now networked and
exchange data inside and outside an organisation. Now there is shared
infrastructure, an organisation's network infrastructure is extending,
incorporating all systems (IT, power, utilities, control, etc.) so a failure
could impact the whole organisation. Vulnerabilities are inherited from
strategic partnerships such as:
*IT outsourcing
*Data warehousing
*Call centers
*Mergers and Acquisitions
Mike pointed out we need to consider security in relation to all decisions,
that business decisions don't usually consider IT security. It must also be
realised the NII exists in an international context, and that individual
organisations have a dependence on the NII which may be affected by overseas
events. Mike explained that often accidents can help us understand about
dependencies (e.g. Longford) and show what impact the community may suffer
from such an incident. Mike talked about protection and discussed an
interesting case of an abattoir that uses dial-in access on an unencrypted
channel, and no IT people in place!
In terms of NII ownership Mike highlighted the need for private sector
partnership in securing elements, and that the Government has no intention
or desire to regulate industry, particularly due to the rapidly changing
nature of IT and the NII. Organisations must consider the strategic context
in which they operate. Threats and vulnerabilities to their systems may be
over and above their own internal security issues, and have national
significance. Mike discussed the outcomes of the Business-Government Task
Force, the recent formation of a Trusted Information Sharing Network and
Critical Infrastructure Advisory Council and how these fit into the
Government's priorities for Safeguarding Australia.
Mike Spring, Director, Information Systems Security, Government
Communications Security Bureau (NZ), talked about New Zealand's approach to
Critical Infrastructure Protection (CIP). He began with an outline of the
structure of the GCSB and why it was involved with CIP. He talked about New
Zealand's strategy for CIP, two key reports issued so far, and a Centre for
CIP CCIP that was established. The GCSB is the single responsible authority
for CIP, and the CCIP is an entity within this department and is publicly
funded. The CCIP has been operational since November 2001, and has three
functions: Watch and Warn, Investigation and Analysis, and Outreach. The
CCIP has links with other international CIP bodies, FIRST, APEC-Tel, and
other cyber-security forums.
Tim Burmeister, Senior Manager Infosec Policy, Defence Signals Directorate
talked about CIP from a national perspective. He spoke of how electronic
threats cross international borders and that security needs to be considered
in an international context. Tim spoke of how DSD has shifted its focus to
include threats to commerce and SME's. He highlighted concerns with credit
card fraud, electronic transactions, and a need to understand the real level
of the threat. Tim outlined DSD's history of involvement with CIP, the
Interdepartmental Committee Report on the NII, the links DSD has with ASIO
and the Australian Federal Police, and DSD's information security role. He
talked about the services DSD offers including the Australasian Information
Security Evaluation Program AISEP, the Evaluated Products List EPL, ISIDRAS
and the Computer Network Vulnerability Team. Tim spoke of common IT security
mistakes that include:
*Policies not utilised and also quickly become outdated
*The "hot" new security product will not solve all problems
*Mis-configured security
*Poorly managed security
*Procedures not updated to reflect new risks
Tim explained how good security reduces the risk of loss of information or
attack, creates a perception of trust, and encourages people to conduct
online transactions. Advice can be given on the threats and vulnerabilities,
but the decisions are made at the top level, and often with additional
information that may not be known by the security advisers. In relation to
incident reporting it can only work when incidents are detected or known.
Referring to Cyber Warfare he pointed out most attacks are aimed at
individual machines or systems. No major attack has occurred on
infrastructure, but an IT attack on a control system could be a problem.
Warwick Watkins, Director General of the Department of Information
Technology and Management (NSW) began by examining emergency events that
have occurred, including:
*Victoria - Longford, Coode Island, Anthrax, and Ash Wednesday
*NSW - Nyngan floods, Thredbo, Sydney fires and hailstorms,
Newcastle earthquake, and
*Waterfall rail disaster
He outlined how incidents such as these can be large and serious, require
critical information from numerous agencies involved, can have long term
effects, and affect many. Warwick looked at how information is required for
emergency management to assist in responding, inform decision makers, inform
the media, and advise and guide the public. He spoke of the common Spatial
Data Infrastructure established by the US Congress for all government
agencies to use in providing comprehensive, accurate and timely data sets
that are essential for effective emergency service response (Australian SDI
efforts). This includes basic information held (proprietary, road networks,
elevation model, hydrography, etc) along with supplemental information
(social, economic and environmental) and the need to combine these for event
specific incidents. Warwick said we should not worry about a specific event,
rather focus on building a robust and flexible capability that is effective,
mobile, adaptive and timely in its response. He discussed a scenario that
was run that considered the explosion of a bomb hidden in a rubbish bin, and
how the data was mapped to the impact zone to determine the emergency
response. Warwick finished by pointing out that organisations tend to focus
on the response, but that it is important to be prepared and ready.
Georgina Crundell, Global Head of Information Security, ANZ Banking Group
explained that ANZ are not just concerned with Australian domestic threats
but also international issues. She outlined some of the major risks faced by
the bank and discussed how they approach information security within ANZ,
using a proactive, top-down model. ANZ has gone through a number of
organisational changes to incorporate information security into their
organisation. Large number of security initiatives are being developed and
incorporated into the start of projects. Georgina identified the need to
determine what it is you want to protect, and to identify information
assets. An example for ANZ is the SWIFT system that must process over $250
billion by 4 PM daily. The issue of ROI also is important in effective
information security, as are skills cost and training staff. Relationships
between IT departments must be developed/maintained to ensure thorough
understanding and awareness of security policies. Georgina finished by
discussing various security processes within ANZ, and a number of
cooperative strategies with other partners.
Carsten Larsen, General Manager of ACTEW-AGL discussed his organisation's
role in the recent Canberra bushfire crisis. He showed a video of events,
and how the infrastructure was affected during this crisis. Working through
the crisis, he presented a case study of the events, and the measures and
procedures taken by ACTEW, including setting up a crisis center, ensuring
all units had mobile phone chargers, and keeping a management person in
reserve to act as backup (to avoid burnout).
David Harris, National General Manager, Corporate Security, Telstra examined
security issues, pointing out that the boundaries are gone. He questioned
whether traditional security and business thinking address CIIP. A look at
traditional security thinking (Security 101 as he referred to it!) covering
confidentiality, integrity, and availability and how it applies to today's
environment, requiring an all-hazards approach. He said a security framework
must enable business to provide flexible, controlled access to services and
information for customers, partners, and the whole value chain. Through an
examination of perceived benefits, capability, and a threat/loss
relationship he showed that without capability there is no threat, with
capability there needs to be opportunity. Securing the infrastructure must
support its functionality and efficiency; an emphasis must be on the ease of
use, with adequate security. This must also be supplanted with effective
operational management of your IT services, and be able to deal with
evidentiary complexities for fraud and intrusion incidents. By considering
the context of a possible emergency, you can have an efficient and useful
disaster recovery plan.
Daniel Lai, National Security Director of the Australian Customs Service
began with an outline of his organisation's role and function. Noting that
organisations are spending more on security, he examined the ROI issue on IT
security spending. He considered how no-one is measuring the benefits of
spending (e.g. putting in a firewall), and that for critical/highly
important elements the cost should not be an issue. By incorporating ROI
into the project lifecycle, security is aligned with business objectives,
and can be integrated into the total cost of ownership. Daniel indicated
there is no need to sweat the small stuff, but we need to incorporate
security into the organisation's culture.
Eric Faccer, Research Scientist, DSTC Security Group began with the
perception of threat, recounting the October 30, 1938 transmission of War of
the Worlds and the ensuing panic it caused. He showed that this was caused
due to centralisation (single point of failure), a trusted source (the
radio), and lack of failover/redundancy. Next he looked at how computers
have been around for around 50 years whilst infrastructure has only been
around for about 10 years. Noting that CIIP policy will not always be
congruent with private sector IT security procedures, he examined
functionality versus real security and the inverse relationship it has.
Following this he showed how perceived security builds a false level of
trust. Since security is a non-trivial exercise, there may be side-effects
that are not considered that may in turn cause new security problems. He
noted how many organisations have developed their own cryptographic ciphers
which have been broken, such as WEP. Eric also pointed out inconsistencies
with technology and law, such as the Tennessee law that states it is
"illegal for a woman to drive a car unless there is a man either running or
walking in front of it waving a red flag to warn approaching motorists and
pedestrians"
A panel was then convened that examined the issue of regulation to invest in
Critical Information Infrastructure Protection (CIIP). The overall consensus
was that whilst regulation may make it easier, no-one is particularly keen
for it. Commonwealth Government policy is that market forces provide the
drivers for CIIP, and that there is a need for shared responsibility. It
would be more effective to educate rather than regulate, also that
regulation would have trouble in keeping up with rapidly changing IT. In
some cases regulation may be appropriate or even necessary, but legislation
won't necessarily ensure the reliability or stability of CII. Business
continuity planning and disaster recovery are key issues that are required
in CIIP, organisations must get involved.
Leif Gamertsfelder, Senior Associate of Deacons finished Day One off with a
look at company directors' duties and liability in relation to CIIP. He
discussed how CIIP talks about national goods and services and their
national security requirement, and how this is different to corporate
security and requirements. He explained how company directors must exercise
business judgement in relation to information assurance and network
security, and that if a security incident occurs, do you have a valid
defence? Leif examined the security management cycle and liability issues,
including delegation and business "judgements". He stressed that the driver
in the Corporations Act is shareholder value, and that it has no relation to
CIIP. He also considered the ASX Listing Rule 3.1 and the problem with
determining when you should disclose information, and how this could affect
share prices. As a possible solution to encourage security spending, based
on national interests, Leif suggested that national security could be a
driver for security in individual organisations, through incentives such as
tax concessions for security spending and research and development.
The first half of the second day of the conference was chaired by Mark
Gardner, Chief Strategist of Securenet whilst the second half was chaired by
Ajoy Ghosh, Chairman, Standards Australia Workgroup on Computer Forensic
Standards
Geoffrey Ross, Managing Director of Securenet began the first presentation
with the view that security must be taken seriously. He talked about rising
and constant threats, and how they can mutate and become more complex. He
reviewed the impact of the recent Slammer worm and how the Securenet center
in Canberra dealt with it. Geoffrey talked how risks are shared and this
must be recognised and addressed, looking both inwards and outwards of our
organisations. He examined issues both inside the enterprise IT and outside,
and questioned whether organisations are getting the message, and if
directors and officers are identifying their responsibilities. Recognising
that security has traditionally been defensive, but also an enabler, he said
we need to focus on the enablement aspect of security.
Nick Tate, Director of AusCERT discussed the background and history of
AusCERT and its related activities. He showed the general rise in incident
reporting and discussed key findings of the AusCERT 2002 Computer Crime and
Security Survey. Nick talked about various research and education networks,
and how many universities have high speed, wide bandwidth networks which
allow for greater activity. He stressed the need to incorporate these large
capacity university networks into the NII. Nick also discussed recent
information sharing and reporting initiatives, AusCERT's links with global
partners, a new National Alert Scheme, and education and training schemes,
including the ISSPCS security certification scheme.
Ashley Wearne Managing Director, of Network Associates talked about
proactive threat protection and security issues in a business context. He
discussed how the threats to global business are getting worse, and asked
what is your level of awareness of security of your organisation? He
outlined how viruses have peaked in terms of speed of infection, whereas
response times to deploy counter measures have grown, creating a window of
vulnerability. He said we should not focus on the technology, trying to fit
the pieces, rather consider the business impact, how to manage the situation
and get things working. He applied the 7 Habits of Highly Effective People
and how this would apply to security management, using SPAM as an example.
He discussed how new legislation will affect organisations and the personal
liability that directors and officers will have for external and internal
attacks. Ashley said we need to revise architectural thinking towards
defence, and outlined the approach that Network Associates provides.
Ajoy Ghosh, Chairman of Standards Australia Workgroup on Computer Forensic
Standards, discussed the development of the Guidelines for the Management of
IT Evidence. He detailed the difference between a Standard and a Handbook,
the requirements for IT Evidence, and the purpose of the Handbook. Ajoy
outlined the characteristics of IT evidence and the general principles of
evidence collection. He explained the evidence lifecycle and how it can
determine the design and operation of your IT system to allow for correct
procedures to be carried out if/when required. A draft copy of the Handbook
was provided to delegates.
Ben McDevitt, General Manager, Counter Terrorism, Australian Federal Police
discussed the terrorist threat and the need for business cooperation in
defending the CII. He talked of the changing nature of crime, the
transnational nature of cybercrime, and the growing nature of electronic
crime. He examined the use and application of technology in crimes, how
terrorists had embraced this technology, and the vulnerability of society on
infrastructure. He talked of the private ownership of much of the CII, how
businesses will need to overcome rivalries and share information, and how
efforts such as the Trusted Information Sharing Network can help. He said
that businesses need to protect their own infrastructures from a whole range
of disaster scenarios, and cyber-security should be taken seriously. Ben
also detailed the formation of the Australian High Tech Crime Centre and how
it will be the electronic front line against computer-generated crime.
The session before lunch was a panel that examined national security versus
privacy protection. A number of interesting issues were raised during this
session, including:
*National Privacy Principles that outline broad requirements for
privacy, should be built into policy from the start
*Security and privacy often overlap, but where they part is in
individual use of systems and communications
*Consider the privacy impact in your organisation
*Electronic transactions are reducing the level of anonymity through
mechanisms such as authentication
*What are you able to monitor and what type of monitoring can
you do?
*In general there are sufficient laws in place to deal with issues
such as digital signatures
*However, the laws are somewhat fuzzy in relation to digital information
*Organisations policies must be enforceable, and often many legal
cases are thrown out because of poor policies
*Problems establishing identity controls for anonymity issues
*Review of current Gatekeeper implementation, driven partially by high
number of fraud cases
*Information Security Interest Group is looking at security
certification, and NOIE is examining the role the government would
have with this.
Andy Norton, Manager, Intrusion Prevention Vulnerability Management,
Symantec Corporation gave a presentation on enterprise vulnerability
management. He discussed how reactive security costs more than proactive
security, but that security tends to be reactive. He outlined three common
causes of reactive deployment of vulnerability management:
*Security is dealt with as an IT issue
*No integration of people or processes
*High ownership of cost
He suggested that IT should get help from Human Resources who have
experience and mandate to get policy out to the organisation. By applying
the SANS methodology Symantec have developed a tool for the vulnerability
management process. This will assist with tracking user awareness,
integrating technical compliance, and identifying vulnerabilities. Andy
talked about the scope and breadth of vulnerability data, and the level and
depth you have to go to, and the need to prioritise. He said that security
is not just technology but people and processes.
Brent Clark, ePayment Security Consultant, examined the history of Internet
payments and compared payments in the real world to payments in the online
world. He detailed how online payments are made today and how credit cards
are still the de-facto standard. He examined identity theft and online
fraud, and cited the case of the Sydney Opera House fraud. Next he moved
onto authentication and some of the online solutions, such as Verified by
Visa and Mastercard Securecode. Brent said how ANZ was the first bank to
introduce online authentication and how the other banks are implementing
similar measures now. He talked about the Maestro Online Debit system and
how it was an alternative to using a credit card, also P2P payment systems
such as PayPal. Looking towards the future of online payments Brent talked
of the rise and fall of PKI, the belief that strong password authentication
will dominate, and that card companies will drive payment infrastructure. He
also suggested the Internet may form a substitute infrastructure for EFTPOS
by 2020. Referring to B2B payment, he predicted card companies will also
dominate B2B systems and will extend their epayment product range for this
market.
Mark Dolan, International eCommerce Manager, P&O Ports began by considering
the real risk of sea freight: Crew, cargo, vessel, and containers. He
discussed various shipping compliance measures, including the US 24 hour
rule. He then discussed how security has not traditionally been part of the
supply chain management (SCM) process. He said that security is seen as
impacting upon the SCM process although some consider it beneficial. Mark
then outlined a Safe and Secure Tradeline Process Flow model that was
developed in 2002 that integrates security into the SCM process. It was
tested across the Asia Pacific by various vendors and operators. The trial
ran over two months with 200 containers carried over secure channels
providing online container management, status and audit trails, as well as
complying with security requirements. Mark explained that this system
shifted expenditure from a compliance cost to an investment cost, helped
automate the SCM process, and facilitated delivery of containers.
Keith Inman, Director, Electronic Enforcement Unit, Australian Securities
and Investment Commission began with an overview of ASIC's role and
regulatory functions. He said ASIC's role in CIIP was based on legislative
charter and operational risks. He discussed how ecommerce has boosted issues
of financial performance, economy, and customer confidence. Considering the
operational risks he detailed how electronic footprints may be left by an
intruder and how many of the systems used may be publicly owned. This
requires an integrity of public registers, reliance on others to keep
records, and access to technical expertise. Keith told of how the government
sees it would be counter-productive to regulate and restrict the information
economy, and that there are synergistic opportunities for government and
industry to work together. He discussed a number of such partnerships with
ASIC that include auDa, IIA, and Standards Australia.
____________________________________________________________________
News Briefs
____________________________________________________________________
Mary Ellen Zurjo's News Briefs from past issues of Cipher are archived at
www.ieee-security.org/Cipher/NewsBriefs.html
____________________________________________________________________
____________________________________________________________________
News Bits contains correspondence, interesting links, non-commercial
announcements and other snippets of information the editor thought
that Cipher readers might find interesting.
====================================================================
Reader's Guide to Current Technical Literature in Security and
Privacy
====================================================================
The Reader's Guide from Past issues of Cipher is archived at
www.ieee-security.org/Cipher/ReadersGuide.html
====================================================================
Listing of academic positions available
by Cynthia Irvine
====================================================================
http://cisr.nps.navy.mil/jobscipher.html
Mississippi State Univ
Department of Computer Science and Engineering
Starkville, MS
Tenure Track (Assistant/Associate Professor)
Open until filled
http://www.cse.msstate.edu
Distributed Systems Architecture Laboratory
France Telecom Research and Development
Grenoble, France
Postdoctoral Research Position on Operating Systems Security for
Embedded and Mobile Devices
Position to start on April 15, 2003
Contact: marc.lacoste@rd.francetelecom.com or
jeanphilippe.fassino@rd.francetelecom.com
Florida International University
Miami, Florida
Assistant/Associate Professor of Computer Science
Evaluation begins January 9, 2003 and continues until the positions are filled.
http://www.cs.fiu.edu/cgi-bin/portal/index.pl?iid=9668&isa=Bulletin&op=show
The George Washington University
Computer Science Dept.
Washington DC 20052
202 994-4955
fax 202 994-4875
Two full-time security assistant professor faculty positions
Fall 2003 - Open until filled
Contact Prof. Lance J. Hoffman
lhoffma1@gwu.edu
http://www.cs.gwu.edu/prospective/faculty2/
GWU is recognized by the National Security Agency as a Center of Academic
Excellence in Information Assurance Education
Foundations of Programming Languages Research Group
School of Computer Science, Telecommunications and Information Systems
DePaul University
Chicago, IL, USA
Postdoctoral Research Associate on NSF-funded Trusted Computing project
Cryptyc: Cryptographic Protocol Type Checker
Position to start on 1 January 2003
Details at http://cryptyc.cs.depaul.edu/hiring.html
Information Security Group,
Laboratories for Information Technology
Singapore
Postdoc/Associate Research Staff
Cryptography and Information Security
Contact email: baofeng@lit.org.sg
CASE Center, http://www.ecs.syr.edu/dept/eecs/positions/supria.html
Syracuse University, Syracuse, NY 13244-4100, USA
Visiting SUPRIA position
Max-Planck Institute for Computer Science,
http://www.mpi-sb.mpg.de/units/nwg1/offers/positions.html
Saarbruecken, Germany
Postdoc / Research associate position
Areas of particular interest: static program analysis, verification,
security, cryptographic protocols, and critical software. Applications
begin immediately.
James Madison University, Harrisonburg, VA, http://www.cs.jmu.edu/faculty_openings.htm
Department of Computer Science
Tenure-Faculty position
The James Madison University Department of Computer Science is seeking
applications of faculty that specialize in INFOSEC or closely related
areas.
Department of Information and Software Engineering, http://ise.gmu.edu/hire/
George Mason University, Fairfax, VA
1 Tenure-track, 1 visiting position
Positions are in security. Areas of particular interest: Computer
security, networking, data mining, and software engineering. Search
will continue until positions are filled.
Purdue University, West Lafayette, IN, http://www.cs.purdue.edu/announce/faculty2001.html
Department of Computer Science
Emphasis on Assistant Professor Positions, but more senior applicants
will be considered.
Areas of particular interest: Computer security and INFOSEC.
Positions beginning August 2000.
Renesselaer Polytechnic Institute Troy, NY, http://www.cs.rpi.edu/faculty-opening.html
Department of Computer Science
Tenure Track, Teaching, and Visiting Positions
Areas of particular interest: Computer security, networking, parallel and
distributed computing, and theory.
Positions beginning Fall 2000.
Swiss Federal Institute of Technology Link to site
Lausanne (EPFL), Switzerland/Eurecom/Telecom Paris
General Director
Areas of particular interest: Education and research in
telecommunications.
Florida State University, Talahassee, FL, http://www.cs.fsu.edu/positions/
Department of Computer Science
Tenure-track positions at all ranks, several positions
available. Available (1/00) Areas of particular interest: Trusted
Systems, security, cryptography, software engineering, provability and
verification, real-time and software engineering, provability and
verifications, real-time and safety-critical systems, system software,
databases, fault tolerance, and computational/simulation-based design.
--------------
This job listing is maintained as a service to the academic community. If you
have an academic position in computer security and would like to have in it
included on this page, send the following information:
Institution,
City, State,
Position title,
date position announcement closes, and
URL of position description
to: irvine@cs.nps.navy.mil
====================================================================
Interesting Links and Reports Available via FTP and WWW
====================================================================
"Reports Available" links from previous issues of
Cipher are archived at www.ieee-security.org/Cipher/NewReports.html
and www.ieee-security.org/Cipher/InterestingLinks.html
====================================================================
Information on the Technical Committee on Security and Privacy
====================================================================
____________________________________________________________________
Information for Subscribers and Contributors
____________________________________________________________________
SUBSCRIPTIONS:
Two options:
1. To receive the full ascii CIPHER issues as e-mail, send e-mail to
cipher-admin@ieee-security.org (which is NOT automated) with subject line
"subscribe".
2. To receive a short e-mail note announcing when a new issue of
CIPHER is available for Web browsing send e-mail to
cipher-admin@ieee-security.org (which is NOT automated)
with subject line "subscribe postcard".
To remove yourself from the subscription list, send e-mail to
cipher-admin@ieee-security.org with subject line "unsubscribe".
Those with access to hypertext browsers may prefer to read Cipher
that way. It can be found at URL http://www.ieee-security.org/cipher.html
CONTRIBUTIONS:
Contribution to cipher@ieee-security.org are invited. Cipher is a
NEWSletter, not a bulletin board or forum. It has a fixed set of
departments, defined by the Table of Contents. Please indicate in the
subject line for which department your contribution is intended. For
Calendar entries, please include a URL and/or e-mail address for the
point-of-contact. For Calls for Papers, please submit a one paragraph
summary to cipher-cfp@ieee-security.org See this and past issues for
examples. ALL CONTRIBUTIONS CONSIDERED AS PERSONAL COMMENTS; USUAL
DISCLAIMERS APPLY. All reuses of Cipher material should respect
stated copyright notices, and should cite the sources explicitly; as a
courtesy, publications using Cipher material should obtain permission
from the contributors.
____________________________________________________________________
Recent Address Changes
____________________________________________________________________
Address changes from past issues of Cipher are archived at
http://www.ieee-security.org/Cipher/AddressChanges.html
______________________________________________________________________
How to become <> a member of the
IEEE Computer Society's TC on Security and Privacy
________________________________________________________________________
You may easily join the TC on Security & Privacy by completing
the on-line for at IEEE at http://www.computer.org/TCsignup/index.htm.
_____________________________________________________________
TC Publications for Sale
_____________________________________________________________
Proceedings of the IEEE CS Symposium on Security and Privacy
The Technical Committee on Security and Privacy has copies of its
publications available for sale directly to you. You may pay for
Proceedings by credit card or check.
Proceedings of the IEEE Symposium on Security and Privacy
Year(s) Format Price
2001 Hardcopy $25.00*
2000 Hardcopy $15.00*
1999 Hardcopy SOLD OUT
1998 Hardcopy $10.00*
2000-2001 CD-ROM $25.00*
* Plus shipping charges
See http://www.ieee-security.org/TC/TCPubs4Sale.html for complete
information on ordering.
IEEE CS Press
You may also order some back issues from IEEE CS Press at
www.computer.org/cspress/catalog/proc9.htm.
________________________________________________________________________
TC Officer Roster
________________________________________________________________________
Chair: Past Chair:
Mike Reiter Thomas A. Berson
Carnegie Mellon University Anagram Laboratories
ECE Department P.O. Box 791
Hamerschlag Hall, Room D208 Palo Alto, CA 94301
Pittsburgh, PA 15213 USA (650) 324-0100 (voice)
(412) 268-1318 (voice) berson@anagram.com
reiter@cmu.edu
Vice Chair: Chair,Subcommittee on Academic Affairs:
Heather Hinton Cynthia Irvine
IBM Software Group - Tivoli U.S. Naval Postgraduate School
11400 Burnett Road Computer Science Department
Austin, TX 78758 Code CS/IC
(512)436 1538 (voice) Monterey CA 93943-5118
hhinton@us.ibm.com (408) 656-2461 (voice)
irvine@cs.nps.navy.mil
Chair, Subcommittee on Standards: Chair,Subcomm.on Security Conferences:
David Aucsmith Jonathan Millen
Intel Corporation SRI International EL233
JF2-74 Computer Science Laboratory
2111 N.E. 25th Ave 333 Ravenswood Ave.
Hillsboro OR 97124 Menlo Park, CA 94025
(503) 264-5562 (voice) (650) 859-2358 (voice)
(503) 264-6225 (fax) (650) 859-2844 (fax)
awk@ibeam.intel.com millen@csl.sri.com
Newsletter Editor:
Hilarie Orman
Purple Streak, Inc.
Salem, UT 84653
cipher-editor@ieee-security.org
BACK ISSUES:
Cipher is archived at: http://www.ieee-security.org/cipher.html
========end of Electronic Cipher Issue #54, June 7, 2003===========