Search CSRC

Abstract: Monitoring the “physics” of control systems to detect attacks is a growing area of research. In its basic form a security monitor creates time-series models of sensor readings for an industrial control system and identifies anomalies in these measurements in order to identify potentially false contr...

Conference: 2016 ACM SIGSAC Conference on Computer and Communications Security (CCS '16) Abstract: While attacks on information systems have for most practical purposes binary outcomes (information was manipulated/eavesdropped, or not), attacks manipulating the sensor or control signals of Industrial Control Systems (ICS) can be tuned by the attacker to cause a continuous spectrum in damages. Att...

Abstract: System primitives allow formalisms, reasoning, simulations, and reliability and security risk-tradeoffs to be formulated and argued. In this work, five core primitives belonging to most distributed systems are presented. These primitives apply well to systems with large amounts of data, scalability...

Conference: 30th IFIP Conference on Data and Application Security and Privacy (DBSEC 2016) Abstract: Diversity as a security mechanism has received revived interest recently due to its potential for improving the resilience of software and networks against unknown attacks. Recent work shows diversity can be modeled and quantified as a security metric at the network level. However, such an effort do...

Conference: 31st IFIP TC 11 International Conference (SEC 2016) Abstract: Multicast authentication of synchrophasor data is challenging due to the design requirements of Smart Grid monitoring systems such as low security overhead, tolerance of lossy networks, time-criticality and high data rates. In this work, we propose inf-TESLA, Infinite Timed Efficient Stream Loss-tol...

Conference: 11th Annual Cyber and Information Security Research Conference (CISRC '16) Abstract: Industrial control systems (ICS) are composed of sensors, actuators, control processing units, and communication devices all interconnected to provide monitoring and control capabilities. Due to the integral role of the networking infrastructure, such systems are vulnerable to cyber attacks. Indepth...

Journal: IEEE Transactions on Information Forensics and Security Abstract: Diversity has long been regarded as a security mechanism for improving the resilience of software and networks against various attacks. More recently, diversity has found new applications in cloud computing security, moving target defense, and improving the robustness of network routing. However, mo...

Conference: Lightweight Cryptography Workshop 2015 Abstract: We present PFLASH, an asymmetric digital signature scheme appropriate for smart card use. We present parameters for several security levels in this low resource environment and bootstrap many technical properties (including side-channel resistance) exposed in the evaluation of predecessors of this s...

Conference: 24th Conference on Behavior Representation in Modeling and Simulation (BRiMS 2015) Abstract: Validated predictive models of human error for password-related tasks could better inform password requirements for both government and civilian systems. Here, we build upon prior modeling work focused on disentangling the source of password entry errors—recall errors versus motor execution errors—r...

Conference: 19th European Symposium on Research in Computer Security (ESORICS 2014) Abstract: The interest in diversity as a security mechanism has recently been revived in various applications, such as Moving Target Defense (MTD), resisting worms in sensor networks, and improving the robustness of network routing. However, most existing efforts on formally modeling diversity have focused on...

Conference: 6th International Symposium on Resilient Control Systems (ISRCS) Abstract: This paper presents a preliminary design for a moving-target defense (MTD) for computer networks to combat an attacker's asymmetric advantage. The MTD system reasons over a set of abstract models that capture the network's configuration and its operational and security goals to select adaptations th...

Conference: 2012 IEEE 31st Symposium on Reliable Distributed Systems (SRDS) Abstract: A network security metric is desirable in evaluating the effectiveness of security solutions in distributed systems. Aggregating CVSS scores of individual vulnerabilities provides a practical approach to network security metric. However, existing approaches to aggregating CVSS scores usually cause u...

Abstract: IT systems used to support UOCAVA voting face a variety of threats. If IT systems are not selected, configured and managed using security practices commensurate with the importance of the services they provide and the sensitivity of the data they handle, a security compromise could carry consequence...

Abstract: This whitepaper for the Technical Guidelines Development Committee (TGDC) identifies desirable security properties of remote electronic voting systems, potential benefits and threats to these systems, and current and emerging technical approaches for mitigating risks. It is intended for election off...

Conference: 4th International Conference on Electronic Voting (EVOTE2010) Abstract: We present Sigma ballots, a new type of ballot to be used in secure elections. Sigma ballots use the random order of candidates introduced by Pret a Voter, combined with the confirmation codes of Scantegrity II. These ballots can be produces by a DRE machine with a slightly modified VVPAT, or can be...

In: Towards Trustworthy Elections: New Directions in Electronic Voting Abstract: In this paper, we develop methods for constructing vote-buying/coercion attacks on end-to-end voting systems, and describe vote-buying/coercion attacks on three proposed end-to-end voting systems: Punchscan, Pret-a-voter, and ThreeBallot. We also demonstrate a different attack on Punchscan, which co...

Conference: End-to-End Voting Systems Workshop Abstract: This paper provides definitions for some desirable properties of voting systems, including auditability, ballot secrecy, incoercibility, usability and accessibility. In the context of these desirable properties, it defines the class of end-to-end independently verifiable (E2E) voting systems that pr...

Abstract: Random and pseudorandom numbers are needed for many cryptographic applications. For example, common cryptosystems employ keys that must be generated in a random fashion. Many cryptographic protocols also require random or pseudorandom inputs at various points, e.g. for auxiliary quantities used in g...

Abstract: The results of a systems analysis and evaluation conducted on the role of automatic digital processing in vote-tallying are presented. Included in the report are descriptions of hardware, software, and administrative problems encountered in fourteen elections in which electronic computing technology...

NIST has published Interagency Report (IR) 8476, 3rd High-Performance Computing Security Workshop: Joint NIST-NSF Workshop Report, which offers summaries and key insights from collaborative workshop hosted by NIST and the National Science Foundation (NSF).

NIST has published NISTIR 8360, "Machine Learning for Access Control Policy Verification."

A draft NIST Cybersecurity White Paper, "Combinatorial Coverage Difference Measurement," is now available. The public comment period is open through August 20, 2021.

Type: Presentation

Type: Presentation

Type: Presentation