2016 IEEE Cybersecurity Development (SecDev)最新文献_第4页

Building Robust Distributed Systems and Network Protocols by Using Adversarial Testing and Behavioral Analysis 利用对抗测试和行为分析构建健壮的分布式系统和网络协议

2016 IEEE Cybersecurity Development (SecDev) Pub Date : 2016-11-01 DOI: 10.1109/SecDev.2016.038

Md. Endadul Hoque, C. Nita-Rotaru

引用次数: 1

You are Not Your Developer, Either: A Research Agenda for Usable Security and Privacy Research Beyond End Users 你也不是你的开发者:一个超越最终用户的可用安全性和隐私研究的研究议程

2016 IEEE Cybersecurity Development (SecDev) Pub Date : 2016-11-01 DOI: 10.1109/SecDev.2016.013

Y. Acar, S. Fahl, Michelle L. Mazurek

{"title":"You are Not Your Developer, Either: A Research Agenda for Usable Security and Privacy Research Beyond End Users","authors":"Y. Acar, S. Fahl, Michelle L. Mazurek","doi":"10.1109/SecDev.2016.013","DOIUrl":"https://doi.org/10.1109/SecDev.2016.013","url":null,"abstract":"While researchers have developed many tools, techniques, and protocols for improving software security, exploits and breaches are only becoming more frequent. Some of this gap between theoretical security and actual vulnerability can be explained by insufficient consideration of human factors, broadly termed usability, when developing these mechanisms. In particular, security mechanisms may be difficult to use, may conflict with other priorities, or may assume more security knowledge than users possess. For almost 20 years, the usable security community has investigated how to improve the usability of security tools and interfaces aimed at end users. More recently, the community has begun to apply similar techniques in the context of improving security tools — such as APIs and bug-finding software — aimed not at end users but at developers, whose security errors are magnified across all users of their products. In this paper, we review key lessons learned from usable security for end users and consider how to apply them in the context of developers. We propose a research agenda aimed at developing a high-quality, comprehensive literature for usable security for developers, including: investigating how to conduct reliable research in this context, understanding developers' attitudes, knowledge, and priorities, measuring the status quo, and developing improved tools and interventions in the future.","PeriodicalId":166406,"journal":{"name":"2016 IEEE Cybersecurity Development (SecDev)","volume":"91 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2016-11-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"124242894","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 114

Auditing Code for Security Vulnerabilities with CodeSonar 使用CodeSonar审核安全漏洞代码

2016 IEEE Cybersecurity Development (SecDev) Pub Date : 2016-11-01 DOI: 10.1109/SecDev.2016.042

David Vitek

引用次数: 3

MOSAIC: A Platform for Monitoring and Security Analytics in Public Clouds MOSAIC:公共云监控和安全分析平台

2016 IEEE Cybersecurity Development (SecDev) Pub Date : 2016-11-01 DOI: 10.1109/SecDev.2016.025

Alina Oprea, Ata Turk, C. Nita-Rotaru, O. Krieger

引用次数: 3

Security Guarantees for the Execution Infrastructure of Software Applications 软件应用程序执行基础结构的安全保证

2016 IEEE Cybersecurity Development (SecDev) Pub Date : 2016-11-01 DOI: 10.1109/SecDev.2016.030

F. Piessens, Dominique Devriese, J. Mühlberg, Raoul Strackx

{"title":"Security Guarantees for the Execution Infrastructure of Software Applications","authors":"F. Piessens, Dominique Devriese, J. Mühlberg, Raoul Strackx","doi":"10.1109/SecDev.2016.030","DOIUrl":"https://doi.org/10.1109/SecDev.2016.030","url":null,"abstract":"Software applications run on top of infrastructure consisting of hardware (processors, devices, communication networks, …) and software (operating systems, compilers, virtual machines, language runtimes, databases, …). In many cases, attacks against application software rely at least to some extent on aspects of that infrastructure, and in some cases vulnerabilities can be fixed by strengthening the infrastructure, as well as by patching the application code. This paper argues that it is beneficial for secure software development if the security guarantees offered by the execution infrastructure are explicit and precisely defined. More specifically, a developer writing source code that will be executed on the infrastructure should know what guarantees the infrastructure offers against what class of attackers. We survey existing proposals for precise statements of such security guarantees, and argue that the notion of full abstraction proposed by Martin Abadi as a correctness condition for secure implementation of abstractions is the key notion for specifying security guarantees of execution infrastructure. We give a brief overview of how full abstraction has already been used to specify and prove security for important building blocks of an execution infrastructure, and we sketch a research agenda identifying several interesting open research problems that, when solved, could contribute to a more secure design of execution infrastructure for distributed software applications, and to a better understanding of the security properties of these infrastructures.","PeriodicalId":166406,"journal":{"name":"2016 IEEE Cybersecurity Development (SecDev)","volume":"159 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2016-11-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"127393340","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 5

Secure MPC for Analytics as a Web Application 安全的MPC分析作为一个Web应用程序

2016 IEEE Cybersecurity Development (SecDev) Pub Date : 1900-01-01 DOI: 10.1109/SECDEV.2016.027

A. Lapets, Nikolaj Volgushev, Azer Bestavros, Frederick Jansen, Mayank Varia

引用次数: 22