Search CSRC

Conference: 30th IFIP Conference on Data and Application Security and Privacy (DBSEC 2016) Abstract: Diversity as a security mechanism has received revived interest recently due to its potential for improving the resilience of software and networks against unknown attacks. Recent work shows diversity can be modeled and quantified as a security metric at the network level. However, such an effort do...

Conference: 31st IFIP TC 11 International Conference (SEC 2016) Abstract: Multicast authentication of synchrophasor data is challenging due to the design requirements of Smart Grid monitoring systems such as low security overhead, tolerance of lossy networks, time-criticality and high data rates. In this work, we propose inf-TESLA, Infinite Timed Efficient Stream Loss-tol...

Journal: IEEE Transactions on Information Forensics and Security Abstract: Diversity has long been regarded as a security mechanism for improving the resilience of software and networks against various attacks. More recently, diversity has found new applications in cloud computing security, moving target defense, and improving the robustness of network routing. However, mo...

Conference: The Fifth International Conference on Cloud Computing, GRIDs, and Virtualization (CLOUD COMPUTING 2014) Abstract: Infrastructure as a Service (IaaS) is one of the three main cloud service types where the cloud consumer consumes a great variety of resources such as computing (Virtual Machines or VMs), virtual network, storage and utility programs (DBMS). Any large-scale offering of this service is feasible only...

Conference: 7th World Multi-conference on Systemics, Cybernetics and Informatics (WMSCI 2003) Abstract: The effectiveness of an enterprise access control framework depends upon the integrity of the various components or the building blocks used in that framework. The essential components of that framework are: (a) an Enterprise Access Control Model (b) a Validation mechanism to verify the enterprise a...

Conference: Sixth International Conference on Information Assurance and Security (IAS 2010) Abstract: Attribute relations in access control mechanisms or languages allow accurate and efficient specification of some popular access control models. However, most of the access control systems including today s de-facto access control protocol and specification language, XACML, does not provide sufficien...

Abstract: The Baldrige Cybersecurity Excellence Builder is a voluntary self-assessment tool that enables organizations to better understand the effectiveness of their cybersecurity risk management efforts. It helps your organization identify strengths and opportunities for improvement in managing cybersecurit...

Conference: IEEE International Conference on Software Testing Verification and Validation Workshop (ICSTW 2022) Abstract: CAgen is a state-of-the-art combinatorial test generation tool that is known for its execution speed. In addition, it supports an extensive list of features such as constraint handling, higher-index arrays, and import and export of models/test sets in various different formats. It is based on the FI...

Conference: The 12th ACM Conference on Data and Application Security and Privacy Abstract: We describe a formalized systems theoretic method for creating cyber-physical system (CPS) risk overlays that augment existing tree-based models used in CPS risk and threat analysis processes. This top-down approach objectively scopes the system's threat surface for some risk scenario consequence by...

Conference: 2021 ANS Virtual Annual Meeting Abstract: The major challenge faced by the nuclear industry related to software testing of digital embedded devices is the identification of practical software (SW) testing solutions that provide a strong technical basis and is at the same time effective in establishing credible evidence of software CCF reduc...

Conference: Balisage: The Markup Conference 2020 Abstract: Markup technologies are very general purpose, as reflects their generality of conception. They become interesting as well as useful as they are applied to accomplish goals in the real world. Since principles of generic declarative markup were first applied to accomplishing publishing-related goals i...

Conference: 11th International Workshop on Security in Information Systems (WOSIS 2014) Abstract: Constructing an efficient and accurate model from security events to determine an attack scenario for an enterprise network is challenging. In this paper, we discuss how to use evidence obtained from security events to construct an attack scenario and build an evidence graph. To achieve the accuracy...

Journal: IEEE Transactions on Dependable and Secure Computing Abstract: By enabling a direct comparison of different security solutions with respect to their relative effectiveness, a network security metric may provide quantifiable evidences to assist security practitioners in securing computer networks. However, research on security metrics has been hindered by diffic...

Conference: 24th Annual IFIP WG 11.3 Working Conference on Data and Applications Security (DBSec 2010) Abstract: Authentication assurance level taxonomies that have been specified in many real-world smart identity token deployments do not fully reflect all the security properties associated with their underlying authentication mechanisms. In this paper we describe the development and application of a new metho...

Conference: Third ACM Workshop on Role-Based Access Control (RBAC '98) Abstract: Role Based Access Control (RBAC), an access control mechanism, reduces the cost of administering access control policies as well as making the process less error-prone. The Admin Tool developed for the NIST RBAC Model manages user/role and role/role relationships stored in the RBAC Database. This pa...

Abstract: Modern computers rely on fundamental system firmware, commonly known as the Basic Input/Output System (BIOS), to enable system components to communicate and work together. The BIOS is typically developed by both original equipment manufacturers (OEMs) and independent BIOS vendors. Manufacturers freq...

Conference: 2025 ACM International Workshop on Security and Privacy Analytics Abstract: Large Language Models (LLMs) have shown promise in automating code vulnerability repair, but their effectiveness in handling real-world code remains limited. This paper investigates the capability of LLMs, in repairing vulnerabilities and proposes a systematic approach to enhance their performance t...

Conference: 19th European Symposium on Research in Computer Security (ESORICS 2014) Abstract: The interest in diversity as a security mechanism has recently been revived in various applications, such as Moving Target Defense (MTD), resisting worms in sensor networks, and improving the robustness of network routing. However, most existing efforts on formally modeling diversity have focused on...

Journal: Journal of Systems Architecture Abstract: The ability to control access to sensitive data in accordance with policy is perhaps the most fundamental security requirement. Despite over four decades of security research, the limited ability for existing access control mechanisms to generically enforce policy persists. While researchers, practi...

NIST solicits nominations for candidate algorithms to be considered for public-key post-quantum standards. Submission requirements and evaluation criteria are available at https://www.nist.gov/pqcrypto. Proposals must be received by November 30, 2017.

NIST has published NISTIR 8214A, "NIST Roadmap Toward Criteria for Threshold Schemes for Cryptographic Primitives."

NIST has published Special Publication (SP) 800-228, Guidelines for API Protection for Cloud-Native Systems.

Conference: 13th ACM Symposium on Access Control Models and Technologies (SACMAT '08) Abstract: Security policy enforcement is instrumental in preventing the unauthorized disclosure of sensitive data, protecting the integrity of vital data, mitigating the likelihood of fraud, and ultimately enabling the secure sharing of information. In accessing a given resource, policy may dictate, for examp...

Abstract: Modern enterprise IT systems rely on a family of application programming interfaces (APIs) for integration to support organizational business processes. Hence, a secure deployment of APIs is critical for overall enterprise security. This, in turn, requires the identification of risk factors or vulne...

Abstract: Modern enterprise IT systems rely on a family of application programming interfaces (APIs) for integration to support organizational business processes. Hence, a secure deployment of APIs is critical for overall enterprise security. This, in turn, requires the identification of risk factors or vulne...