The software and systems on which we depend are not formed completely by the organizations which created them, instead, they are assembled from a variety of pre-existing subcomponents created by disconnected actors operating within a complex supply chain. Any analysis of computing system security and privacy is incomplete without an understanding of this supply chain of both ephemeral and physical components that comprise computing systems on which we depend. Frailties existing at any one of the manifold nodes in the supply chain can have downstream effects both directly and indirectly to the security and resiliency of the assembled computing system. This workshop seeks to gather case studies, empirical analysis, and research focused on understanding potential threats to the computing system supply chain, both hardware and software, and their future mitigation. This workshop will, through panels of noted experts, invited and paper presentations, provide case studies for improving policy and practices, as well as promising research and tools to address this national challenge.
The Cyber Resilient Supply Chain Technologies (CReSCT) Workshop will explore research and case studies to characterize, measure and enhance supply chain security for computing systems. Participants will consist heavily of academic and industry researchers but are also expected to include researchers from the National Laboratories and government agencies with a supply chain risk management mission related to computing systems. Research advances presented at the workshop may help industry and government make powerful impacts to mitigate existing computing system supply chain vulnerabilities.

Advances in technology come with countless benefits for society, but these advances sometimes introduce new risks as well. Various characteristics of technology, including its increasing complexity, may present novel challenges in understanding its impact and addressing its risks. Enforcement agencies have broad jurisdiction to protect consumers against certain harmful practices (typically called "deceptive and unfair" practices in the United States), but sophisticated technical analysis may be necessary to assess practices, risks, and more. Moreover, consumer protection covers an incredibly broad range of issues, from substantiation of claims that a smartphone app provides advertised health benefits to the adequacy of practices for securing sensitive customer data.
The Workshop on Technology and Consumer Protection (ConPro ’20) will explore computer science topics with an impact on consumers. This workshop has a strong security and privacy emphasis, with an overall focus on ways in which computer science can prevent, detect, or address the potential for technology to deceive or unfairly harm consumers. Participants will consist heavily of academic and industry researchers but are also expected to include researchers from the Federal Trade Commission—the U.S. government’s primary consumer protection body—and other government agencies with a consumer protection mission. Research advances and ideas presented at the workshop may help improve the lives of consumers, and discussions at the event may help researchers understand how their work can best promote consumer welfare given laws and norms surrounding consumer protection.

Deep learning and security have made remarkable progress in the last several years. On the one hand, neural networks have been recognized as a promising tool for security in academia and industry. On the other hand, the security of deep learning has gained focus in research, and the robustness of neural networks has recently been called into question. This workshop strives for bringing these two complementary views together by (a) exploring deep learning as a tool for security as well as (b) investigating the security of deep learning. Deep learning for security: In the past, machine learning and security researchers have lacked suitable collaborative outlets and opportunities for knowledge transfer. This has hindered progress in fundamental challenges surrounding the detection and analysis of malicious code and security threats. As a result, the research pace in this area has been limited.
The workshop aims at bringing practitioners from both fields together and exploring novel opportunities for improving the detection and analysis of attacks as well as applying novel learning architectures and concepts. Security of deep learning: Deep learning has not been originally designed with security in mind, and many learning algorithms suffer from vulnerabilities that enable thwarting their successful application. As a consequence, the workshop will also investigate the security of deep learning and discuss novel attack and defense mechanisms. Only if both views are jointly considered, the application of deep learning can have a long-lasting effect on security and bring forth novel paradigms in security applications.
The workshop is aimed at academic and industrial researchers interested in deep learning and security. We are planning to invite distinguished speakers who will present recent advances in both areas and pinpoint promising directions for research. We believe that closer interaction between both research areas will overcome current joint problems and ultimately enable a bidirectional and fruitful knowledge transfer.

Current computer software that processes electronic data such as documents, images, videos, and messages is vulnerable to maliciously crafted input data. The Language-theoretic approach (LangSec) offers a connection between fundamental computability principles and practical systems vulnerabilities when handling untrusted inputs. LangSec posits that the only path to trustworthy computer software that takes untrusted inputs is treating all valid or expected inputs as a formal language, and the respective input-handling routine as a parser for that language. The parsing must be feasible, and the parser must match the language in required computation power and convert the input for the consumption of subsequent computation.
For some collected history and background on LangSec, please see the www.langsec.org site. The 6th installation of the workshop will continue the tradition and further focus on methodologies (1) that can infer formal language specifications from samples of electronic data, (2) that can generate secure parsers from formal specifications of electronic data, and (3) that describe the complexity hierarchy of verifying parser implementations.

The Internet of Things has become increasingly popular and innovative. With the rise of connected devices, we have an opportunity to significantly improve the safety of legacy systems. For instance, insights from data across systems can be exploited to reduce accidents, improve air quality and support disaster events. IoT based cyber-physical systems (CPS) also bring new risks that arise due to the unexpected interaction between systems and the larger number of attack vectors on these systems. These safety risks can arise in the context of use of medical devices, smart home appliance control, smart car design or conflicts in policy execution at a societal scale.
The Workshop on the Internet of Safe Things seeks to bring together researchers to create solutions for the development of safe cyber-physical systems. As safety is inherently linked with the security and privacy of a system, we also seek contributions in these areas that address safety concerns. We seek to develop a community that systematically dissects the vulnerabilities and risks exposed by these emerging CPSs, and creates tools, algorithms, frameworks, and systems that help in the development of safe systems. We seek contributions across domains - autonomous vehicles, smart homes, medical devices, smart grid; and across disciplines - systems, control, human-computer interaction, security, reliability, machine learning, and verification.

The Workshop on Assured Autonomous Systems (WAAS) plans to address the gap that exists between theory-heavy autonomous systems and algorithms and the privacy, security, and safety of their real-world implementations. Advances in machine learning and artificial intelligence have shown great promise in automating complex decision-making processes across transportation, critical infrastructure, and cyber infrastructure domains. Practical implementations of these algorithms require significant systems engineering and integration support, especially as they integrate with the physical world. This integration is wrought with artificial intelligence (AI) safety, security, and privacy issues.
The primary focus of this workshop is the: (1) detection of, (2) response to, and (3) recovery from AI safety, security, and privacy violations in autonomous systems. Key technical challenges include discriminating between application-layer data breaches and benign process noises, responding to breaches and failures in real-time systems, and recovering from decision making failures autonomously.