Engineers are increasingly expected to build and maintain privacy-preserving and data-protection compliant systems following varying methodologies, in different ICT domains, and based on different infrastructures. While there is a consensus on the benefits of an engineering approach to privacy, research is needed in developing techniques that can aid the translation of legal and normative concepts, and user expectations into systems requirements, as well as methods that can support organizations and engineers in developing (socio-) technical systems that address these requirements.

To cover this gap, the goal of the end International Workshop on Privacy Engineering is to provide an environment where ICT researchers and practitioners, seeking to develop and deploy innovative methods to practically apply privacy solutions into systems designs, can meet and discuss their latest advances. In particular, the workshop aims to foster discussion in the area of privacy engineering process and supporting activities and tools, and the specificities of privacy engineering in the different stages of a software development process (e.g. in requirements elicitation, analysis, design, testing, evaluation, etc.). The workshop is also interested in gathering interdisciplinary reflections on privacy engineering concepts and frameworks, including organizational, legal, political and economic aspects.

LangSec offers a coherent explanation for the "science of insecurity" and imposes an easy-to-understand structure on the seemingly ad hoc collection of software mistakes or design flaws. This explanation is predicated on the connection between fundamental computability principles and the continued recurrence of software flaws despite numerous and diverse secure programming initiatives.

LangSec posits that the only path to trustworthy software that safely handles untrusted inputs is treating all valid or expected inputs as a formal language and treating the respective input-handling routines as a recognizer for that language.

However, far from being an "Ivory Tower" theory, the LangSec approach to systems design is primarily concerned with achieving practical assurance: development that is rooted in fundamentally sound theory, but is expressed in efficient and practical tools for building software. One major objective of the workshop is to develop and share this viewpoint with attendees and the broader systems security community, to help establish a foundation for research based on LangSec principles.

The overall goal of the workshop is to bring more clarity and focus to two complementary areas: (1) practical software assurance and (2) vulnerability analysis (identification, characterization, and exploit development). The LangSec community views these activities as related and highly structured engineering disciplines and seeks to provide a forum to explore and develop this relationship.

The threat of malicious insiders to organizational security has historically been one of the most difficult challenges to address. Insiders often attack using authorized access and with behavior very difficult to distinguish from normal activities. Today, insider attacks are further enabled by immense data storage capabilities, advanced searching algorithms, and the difficulty of comprehensive monitoring of networked systems. Because the actions that occur during insider attacks look much like normal user activities, this exacerbates the technical challenges of proposed solutions to reduce the high incidence of false positives. Furthermore, several recent high-profile attacks have been enabled by non-malicious, or unintentional, insiders fooled by exploits from external attackers.

The insider threat problem continues to receive attention from government agencies. Executive Order 13587 requires all US Government agencies handling classified information to implement insider threat programs to protect sensitive information, leading to a greatly increased interest among US Government agencies in advances in detection of insider threats. Additionally, upcoming changes to the NISP Operating Manual (NISPOM, DoD 5220.22-M) will require insider threat programs for potentially tens of thousands of defense contractors. In recent years, DARPA sponsored two programs (CINDER and ADAMS) aimed at Insider Threat challenges, and there is currently a planned insider threat program sponsored by IARPA, called Scientific advances to Continuous Insider Threat Evaluation (SCITE), that focuses on new research aimed at identifying malicious insiders using active indicators. Technical solutions are emerging, but there are still significant challenges, for example, in the areas of reliable data on insider attacks, understanding the fundamentals of insider threats, and security and privacy aspects of surveillance data caused by advanced insider threat detection programs.

With the development of new mobile platforms, such as Android and iOS, mobile computing has shown exponential growth in popularity in recent years. To benefit from the availability of constantly-growing consumer base, new services and applications are being built from the composition of existing ones at breakneck speed. This rapid growth has also been coupled with new security and privacy concerns and challenges. For instance, more and more sensitive content is being collected and shared by third-party applications that, if misused, can have serious security and privacy repercussions. Consequently, there is a growing need to study and address these new challenges.

The goal of the MoST workshop is to bring together researchers, practitioners, policy makers, and hardware and software developers of mobile systems to explore the latest understanding and advances in the security and privacy for mobile devices, applications, and systems. The scope of MoST 2016 includes, but is not limited to, security and privacy specifically for mobile devices and services related to: device hardware, operating systems, middleware, mobile web, secure and efficient communication, secure application development tools and practices, privacy, vulnerabilities and remediation techniques, usable security, identity and access control, risks in putting trust in the device vs. in the network/cloud, special applications, such as medical monitoring and records, mobile advertisement, secure applications and application markets, and economic impact of security and privacy technologies. We are seeking both short position papers (2-4 pages) and longer papers (a maximum of 10 pages).

As computing and communication systems continue to expand and offer new services, these advancements require more dynamic, diverse, and interconnected computing infrastructures. Unfortunately, defending and maintaining resilient and trustworthy operation of these complex systems are increasingly difficult challenges. Conventional approaches to Security, Trust, Assurance and Resilience (STAR for short) are often too narrowly focused and cannot easily scale to manage large, coordinated and persistent attacks in these environments.

Designs found in nature are increasingly used as a source of inspiration for STAR and related networking and intelligence solutions for complex computing and communication environments. Nature's footprint is present in the world of Information Technology, where there are an astounding number of computational bio-inspired techniques. These well-regarded approaches include genetic algorithms, neural networks, ant algorithms, immune systems just to name a few. For example several networking management and security technologies have successfully adopted some of nature’s approaches, such as swarm intelligence, artificial immune systems, sensor networks, moving target defense, diversity-based software design, etc. Nature has also developed an outstanding ability to recognize individuals or foreign objects and adapt/evolve to protect a group or a single organism. Solutions that incorporate these nature-inspired characteristics often have improved performance and/or provided new capabilities beyond more traditional methods.

The aim of this BioSTAR workshop is to bring together the research accomplishments provided by the researchers from academia and the industry. The other goal is to show the latest research results in the field of nature-inspired STAR aspects in computing and communications.

The Learning from Authoritative Security Experiment Results (LASER) workshops focus on learning from and improving cyber security experimental results. The workshop explores both positive and negative results, the latter of which are not often published. The workshop goal is to foster a dramatic change in the paradigm of cyber security research and experimentation, improving the overall quality of practiced science.

LASER 2016 will focus on computer security experimentation methods and results that demonstrate approaches to increasing the repeatability and archiving of experiments, methods, results, and data. Participants will find LASER to be a constructive and highly interactive venue featuring informal paper presentations and extended discussions. To promote a high level of interaction, attendance will be limited, with first preference given to participating authors. Additional seats will be available on a first-come first-served basis.

LASER also seeks to foster good science in the next generation of cyber security researchers. As such, LASER offers a limited number of student scholarships for participation.