MMM-ACNS-10 Conference

Invited Speakers

Hervé Debar (Institut Telecom - Telecom SudParis, France)
Dieter Gollmann (Technical University of Hamburg-Harburg, Germany)
Greg Morrisett (School of Engineering and Applied Sciences, Harvard University, USA)
Bart Preneel (Electrical Engineering Department, Katholieke Universiteit Leuven, Belgium)
Ravi Sandhu (University of Texas at San Antonio, Institute for Cyber Security, USA)

Titles and abstracts of talks, and short CV of invited speakers

Dr. Hervé Debar
(Institut Telecom - Telecom SudParis, France)

Title: Service dependencies in information systems security

Abstract:
In the complex world of information services, we are realizing that system dependencies upon one another have not only operational implications but also security implications. These security implications are multifold. Beyond allowing an attacker to propagate over an information system by leveraging stepping stones vulnerabilities, it also allows a defender to select the most interesting enforcement points for its policies, overall reducing the cost of managing the security of these complex systems. In this paper, we present a dependency model that has been designed for the purpose of providing security operators with a quantitative decision support system for deploying and managing security policies.
It is joint work with Nizar Kheir, Nora Cuppens-Boulahia and Frédéric Cuppens.

Curriculum vitae:
Hervé Debar is head of the Networks and Communication Systems at Télécom SudParis, an engineering school of Institut Télécom, France. He has 20 years of experience in ICT security research, mostly in industry with CS, Dassault, IBM Zurich Research Lab and France Telecom Orange Labs. In 2000, he designed and implemented one of the first commercial SIEM systems, IBM Tivoli RiskManager. He has led multiple activities related to alert correlation, such as the M2D2 and M4D4 models and the Intrusion Detection Message Exchange Format (RFC4765). He has been the coordinator of the WOMBAT FP7 project for malware threat analysis and is currently involved in research on advanced threat management and countermeasures.

Prof. Dieter Gollmann
(Technical University of Hamburg-Harburg, Germany)

Title: Secure Applications Without Secure Infrastructures

Abstract:
The Internet (together with other communications systems) has become a critical infrastructure in industrialized societies. We will examine to which extent this infrastructure needs to be secured for applications to be deployed securely. We will give examples for application layer attacks that cannot be defended against at the infrastructure layer. Hence, deploying a secure infrastructure is not sufficient to protect critical applications. Conversely, we will give examples where an application can be protected without relying on security services provided by the infrastructure. Hence, deploying a secure infrastructure is not necessary to protect critical applications. We will argue that it is only essential for the computing infrastructure to protect its own execution integrity and for the communications infrastructure to offer availability.

Curriculum vitae:
Prof. Dieter Gollmann received his Dipl.-Ing. in Engineering Mathematics (1979) and Dr.tech. (1984) from the University of Linz, Austria, where he was a research assistant in the Department for System Science.
He was a Lecturer in Computer Science at Royal Holloway, University of London, and later a scientific assistant at the University of Karlsruhe, Germany, where he was awarded the 'venia legendi' for Computer Science in 1991. He rejoined Royal Holloway in 1990, where he was the first Course Director of the MSc in Information Security. He was a Visiting Professor at the Technical University of Graz in 1991, an Adjunct Professor at the Information Security Research Centre, QUT, Brisbane, in 1995, and has acted as a consultant for HP Laboratories Bristol. He joined Microsoft Research in Cambridge in 1998. In 2003, he took the chair for Security in Distributed Applications at Hamburg University of Technology, Germany. He is a Visiting Professor with the Information Security Group at Royal Holloway, a Visiting Professor with the School of Software at Tsinghua University, Beijing, and was an Adjunct Professor at the Technical University of Denmark.
Dieter Gollmann is one the acting editor-in-chief of the International Journal of Information Security link.springer.de/link/service/journals/10207/ and an associate editor of the IEEE Security & Privacy Magazine http://www.computer.org/security/. His textbook on 'Computer Security' is due to appear in its third edition in 2010.

Prof. Greg Morrisett
(School of Engineering and Applied Sciences, Harvard University, USA)

Title: Integrating Types and Specifications for Secure Software Development

Abstract:
Today, the majority of security errors in software systems are due to implementation errors, as opposed to flaws in fundamental algorithms (e.g., cryptography). Type-safe languages, such as Java, help rule out a class of these errors, such as code-injection through buffer overruns. But attackers simply shift to implementation flaws above the level of the primitive operations of the language (e.g., SQL-injection attacks). Thus, next-generation languages need type systems that can express and enforce application-specific security policies.

Curriculum vitae:
Greg Morrisett is the Allen B. Cutting Professor and Associate Dean for Computer Science at Harvard University. His research has focused on programming languages, compilers, and software security. He is best known for his work on developing type systems that guarantee strong safety and security properties for low-level languages, including typed intermediate compiler languages, typed assembly language, and Cyclone, a type-safe dialect of C.
Morrisett has received a number of awards for his research, including a Presidential Early Career Award for Scientists and Engineers, an NSF Career Award, and an Alfred P. Sloan Fellowship. He served as Chief Editor for the Journal of Functional Programming, and as an associate editor for ACM Transactions on Programming Languages and Systems and for Information Processing Letters. Morrisett currently serves on the DARPA Information Science and Technology Study Group, Microsoft's Trusthworthy Computing Academic Advisory Board, and the Fortify Technical Advisory Board.

Prof. Bart Preneel
(Electrical Engineering Department, Katholieke Universiteit Leuven, Belgium)

Title: Cryptography for Network Security: Failures, Successes and Challenges

Abstract:
This talk discusses the state of the art of cryptographic algorithms as deployed for securing computing networks. While one can argued that the design of efficient cryptographic algorithms is the "easy" part of securing a large scale network, it seems that very often security problems are identified in algorithms and their implementations. This talk discusses the state of the art for a broad range of cryptographic algorithms that are used in networking applications.

Curriculum vitae:
Bart Preneel is full professor at the Katholieke Universiteit Leuven. He was visiting professor at five universities in Europe and was a research fellow at the University of California at Berkeley. He has authored and co-authored more than 300 reviewed scientific publications and is inventor of three patents. His main research interests are cryptography and information security. Bart Preneel is president of the IACR (International Association for Cryptologic Research). He is a member of the Editorial Board of the Journal of Cryptology and the IEEE Transactions on Forensics and Information Security; he has served as guest editor for several special issues of international journals. He has participated to more than 20 research projects sponsored by the European Commission, for four of these as project manager. He has been or is program chair of more than 10 international conferences and he has been invited speaker at more than 50 conferences. He frequently consults for industry and government, in areas such as cryptographic algorithms and protocols, eID cards, e-voting and network security. He has also testified as an expert before the Belgian and European Parliament and the Belgian courts. In 2003, he has received the European Information Security Award in the area of academic research.

Prof. Ravi Sandhu
(University of Texas at San Antonio, Institute for Cyber Security, USA)

Title: Group-Centric Models for Secure and Agile Information Sharing

Abstract:
To share information and retain control (share-but-protect) is a classic cyber security problem for which effective solutions continue to be elusive. Where the patterns of sharing are well defined and slow to change it is reasonable to apply the traditional access control models of lattice-based, role-based and attribute-based access control, along with discretionary authorization for further fine-grained control as required. Proprietary and standard rights markup languages have been developed to control what a legitimate recipient can do with the received information including control over its further discretionary dissemination. This dissemination-centric approach offers considerable flexibility in terms of controlling a particular information object with respect to already defined attributes of users, subjects and objects. However, it has many of the same or similar problems that discretionary access control manifests relative to role-based access control. In particular specifying information sharing patterns beyond those supported by currently defined authorization attributes is cumbersome or infeasible. Recently a novel mode of information sharing called group-centric was introduced by these authors and their colleagues. Group-centric secure information sharing (g-SIS) is designed to be agile and accommodate ad hoc patterns of information sharing. In this paper we review g-SIS models, discuss their relationship with traditional access control models and demonstrate their agility relative to these.
It is joint work with Ram Krishnan.

Curriculum vitae:
Ravi Sandhu is Executive Director of the Institute for Cyber Security at the University of Texas at San Antonio, where he holds the Lutcher Brown Endowed Chair in Cyber Security. Previously he was on the faculty at George Mason University (1989-2007) and Ohio State University (1982-1989). He holds BTech and MTech degrees from IIT Bombay and Delhi, and MS and PhD degrees from Rutgers University. He is a Fellow of IEEE, ACM and AAAS, and has received awards from IEEE, ACM, NSA and NIST. A prolific and highly cited researcher, his work has accumulated over 11,000 Google Scholar citations. His research has been funded by NSF, NSA, NIST, DARPA, AFOSR, ONR, AFRL and private industry. His seminal papers on role-based access control established it as the dominant form of access control in practical systems. His numerous other models and mechanisms have also had considerable impact. He is founding General Chair of the ACM Conference on Data and Application Security and Privacy. He served as founding Editor-in-Chief of ACM Transactions on Information and System Security and on the editorial board for IEEE Internet Computing. He was Chairman of ACM SIGSAC, and founded the ACM Conference on Computer and Communications Security and the ACM Symposium on Access Control Models and Technologies and chaired their Steering Committees. He has served as General Chair, Program Chair and Committee Member for numerous security conferences. He has consulted for leading industry and government organizations, and has lectured all over the world. He is an inventor on 17 security technology patents. He has pioneered the teaching of cyber security at the graduate level and was the principal architect of the MS and PhD degrees in Information Security and Assurance at George Mason University. At the Institute for Cyber Security he leads multiple teams conducting world-leading research on many aspects of cyber security including secure information sharing, social computing security, cloud computing security, service oriented architecture security, botnet analysis and detection, and infrastructure assurance, in collaboration with researchers all across the world. His web site is at www.profsandhu.com.