Proceedings of the 17th International Conference on Availability, Reliability and Security最新文献_第10页

Requirements for an Information Privacy Pedagogy based on the Constructivism Learning Theory 基于建构主义学习理论的信息隐私教育学要求

Proceedings of the 17th International Conference on Availability, Reliability and Security Pub Date : 2022-08-23 DOI: 10.1145/3538969.3544425

Thanos Papaioannou, A. Tsohou, Maria Karyda, Stylianos Karagiannis

引用次数: 0

Preliminary Analysis of Privacy Implications Observed in Social-Media Posts Across Shopping Platforms 购物平台社交媒体帖子对隐私影响的初步分析

Proceedings of the 17th International Conference on Availability, Reliability and Security Pub Date : 2022-08-23 DOI: 10.1145/3538969.3544457

Bethany Sumner, Gokila Dorai, John J. Heslen

{"title":"Preliminary Analysis of Privacy Implications Observed in Social-Media Posts Across Shopping Platforms","authors":"Bethany Sumner, Gokila Dorai, John J. Heslen","doi":"10.1145/3538969.3544457","DOIUrl":"https://doi.org/10.1145/3538969.3544457","url":null,"abstract":"The widespread activity of hash-tagging, especially among the Gen-Z population, and the impact of social commerce on average consumers raise questions about privacy implications and dangers of anonymous cyberstalking. In this work, we examined the privacy implications observed in hash-tag-based social-media posts (of average users and influencers) by following the trails of online shopping platform(s) product listings, consumer reviews, social-commerce policies, and influencer posts. We have conducted a preliminary analysis considering cyberstalking as one of the avenues that an anonymous stalker may use to impact the social-media user negatively. Further, we have conceptualized the trails behind hash-tagging activities in terms of a privacy threat model, the need for practical data analysis tools, and the lack of mitigation strategies at various layers. Mainly, this paper throws light on the need for more robust user privacy policies and the impact on socio-economic-privacy aspects. This paper also demonstrates the need for expanding the scope of digital investigations and DFIR tools beyond just the devices of individuals (including victims, suspects, perpetrators, and cyber-criminals) and to thoroughly prepare the forensic professionals to consider the online presence of individuals in its entirety including anonymous cyberstalking avenues and to raise awareness about the abuse of social networks.","PeriodicalId":306813,"journal":{"name":"Proceedings of the 17th International Conference on Availability, Reliability and Security","volume":"55 2 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2022-08-23","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"127398271","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 2

MITRE ATT&CK-driven Cyber Risk Assessment MITRE攻击与攻击驱动的网络风险评估

Proceedings of the 17th International Conference on Availability, Reliability and Security Pub Date : 2022-08-23 DOI: 10.1145/3538969.3544420

Mohamed Ahmed, S. Panda, C. Xenakis, E. Panaousis

引用次数: 18

Cyber-Security Culture Assessment in Academia: A COVID-19 Study: Applying a Cyber-Security Culture Framework to assess the Academia's resilience and readiness 学术界的网络安全文化评估:一项COVID-19研究:应用网络安全文化框架评估学术界的弹性和准备程度

Proceedings of the 17th International Conference on Availability, Reliability and Security Pub Date : 2022-08-23 DOI: 10.1145/3538969.3544467

A. Georgiadou, Ariadni Michalitsi-Psarrou, D. Askounis

{"title":"Cyber-Security Culture Assessment in Academia: A COVID-19 Study: Applying a Cyber-Security Culture Framework to assess the Academia's resilience and readiness","authors":"A. Georgiadou, Ariadni Michalitsi-Psarrou, D. Askounis","doi":"10.1145/3538969.3544467","DOIUrl":"https://doi.org/10.1145/3538969.3544467","url":null,"abstract":"Times of crisis have long been combined with an increase in cybercrime, exploiting the general instability; therefore, in such times, systems and infrastructures face greater exposure to vulnerabilities. On top of that, the COVID-19 crisis has increased our reliance on the internet, while working-from-home has been the daily reality for a large proportion of the population worldwide. Increased cyber-security awareness becomes a necessity for everyone, starting from a more knowledgeable audience; IT professionals, and software engineers. In this context, this paper aims to assess the cyber-security culture readiness of representatives studying or working within a European Polytechnique Academic Institution, during the COVID-19 crisis. Towards that end, a targeted evaluation campaign was launched for two weeks, from 28th February 2022 to 13th March 2022. The campaign consisted of four questionnaires of increased difficulty and a phishing quiz, all assessing the security culture of the participants against three dimensions; their security attitude, their competency, and their actual behavior. The campaign results have been thoroughly analyzed, and the findings were unforeseen in many cases, supporting the identification of security awareness weaknesses and assisting in drafting targeted, customized training programs.","PeriodicalId":306813,"journal":{"name":"Proceedings of the 17th International Conference on Availability, Reliability and Security","volume":"40 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2022-08-23","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"134084358","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 3

Towards Image Hashing Robust Against Cropping and Rotation 图像哈希鲁棒抗裁剪和旋转

Proceedings of the 17th International Conference on Availability, Reliability and Security Pub Date : 2022-08-23 DOI: 10.1145/3538969.3544461

M. Steinebach, Tiberius Berwanger, Huajian Liu

引用次数: 2

Implementation of Revocable Keyed-Verification Anonymous Credentials on Java Card Java卡上可撤销密钥验证匿名凭证的实现

Proceedings of the 17th International Conference on Availability, Reliability and Security Pub Date : 2022-08-23 DOI: 10.1145/3538969.3543798

Raúl Casanova Marqués, Petr Dzurenda, J. Hajny

{"title":"Implementation of Revocable Keyed-Verification Anonymous Credentials on Java Card","authors":"Raúl Casanova Marqués, Petr Dzurenda, J. Hajny","doi":"10.1145/3538969.3543798","DOIUrl":"https://doi.org/10.1145/3538969.3543798","url":null,"abstract":"Java Card stands out as a good choice for the development of smart card applications due to the high interoperability between different manufacturers, its security, and wide support of cryptographic algorithms. Despite extensive cryptographic support, current Java Cards do not support non-standard cryptographic algorithms such as post-quantum, secure-multiparty computations, and privacy-enhancing cryptographic schemes. Moreover, Java Card is restricted by the Application Programming Interface (API) in algebraic operations, which are the foundation of modern cryptographic schemes. This paper addresses the issue of developing these modern schemes by exploiting the limited cryptographic API provided by these types of cards. We show how to (ab)use the Java Card’s API to perform modular arithmetic operations, as well as basic operations on elliptic curves. Furthermore, we implement an attribute-based privacy-enhancing scheme on an off-the-shelf Java Card. To do so, we use our cryptographic API and several optimization techniques to make the scheme as efficient as possible. To demonstrate the practicality of our solution, we present the implementation results and benchmark tests.","PeriodicalId":306813,"journal":{"name":"Proceedings of the 17th International Conference on Availability, Reliability and Security","volume":"14 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2022-08-23","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"133398843","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 2

Design Space Exploration of DICE DICE的设计空间探索

Proceedings of the 17th International Conference on Availability, Reliability and Security Pub Date : 2022-08-23 DOI: 10.1145/3538969.3543785

Dominik Lorych, Lukas Jäger

{"title":"Design Space Exploration of DICE","authors":"Dominik Lorych, Lukas Jäger","doi":"10.1145/3538969.3543785","DOIUrl":"https://doi.org/10.1145/3538969.3543785","url":null,"abstract":"Trusted Computing aims to secure computer systems by ensuring that only trusted software is executed on the system, so that it behaves in expected ways. One of the approaches to this concept is the Device Identifier Composition Engine (DICE), which is specified by the Trusted Computing Group (TCG) as a solution for resource-limited devices. DICE is supposed to be a Root of Trust, which enables the implementation of a Chain of Trust on the device. It is designed for off-the-shelf hardware, such that it can be used on most modern micro-controllers. Therefore, it needs to be as minimal on resource usage as possible. Implementations until now were either focused on extending DICE with new concepts or implementing DICE with as little hardware as possible. Also they usually only implemented DICE on one single device. These factors limit the significance of their results for general DICE implementations as they mostly concentrate on evaluating their extended concepts and specific implementation features. This paper aims for the contrary, focusing more on general configuration and implementation details applicable to most DICE implementations than on specific aspects. We evaluated many different configurations for multiple devices and used these to give suggestions on possible configurations for different use cases. DICE is commonly used as he foundation to create a Chain of Trust, where firmware components get executed in sequential order. Usually a key generation component is used to generate purpose-bound keys after DICE, but specifics are application-dependent. We also implemented this component and to evaluate its key generation for different key configurations. Additionally, we implemented an example of Remote Attestation to show how the DICE architecture can be used.","PeriodicalId":306813,"journal":{"name":"Proceedings of the 17th International Conference on Availability, Reliability and Security","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2022-08-23","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"130404025","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 1

Authentication for Operators of Critical Medical Devices: A Contribution to Analysis of Design Trade-offs 关键医疗器械操作员的认证:对设计权衡分析的贡献

Proceedings of the 17th International Conference on Availability, Reliability and Security Pub Date : 2022-08-23 DOI: 10.1145/3538969.3544474

M. Gadala, L. Strigini, R. Fujdiak

{"title":"Authentication for Operators of Critical Medical Devices: A Contribution to Analysis of Design Trade-offs","authors":"M. Gadala, L. Strigini, R. Fujdiak","doi":"10.1145/3538969.3544474","DOIUrl":"https://doi.org/10.1145/3538969.3544474","url":null,"abstract":"Increasingly evident safety risks due to attacks on safety-critical devices are causing new requirements for authentication of these devices’ human operators. These requirements have now extended to medical devices. However, authentication may also introduce new safety risks, reduce usability, cause delays, and/or encourage user behaviors that compromise the very security it should protect. Thus, design of authentication mechanisms needs to take on a holistic approach that considers such interrelationships, and the effects not just of the general method chosen (say, passwords vs. fingerprints), but also of its implementation details. We illustrate this problem on a medical case study. We report early steps in a trade-off analysis that captures interactions between safety, security, usability and performance issues, to assist designers in choosing and tuning viable solutions. A qualitative analysis to narrow down the field of possible solutions is followed by a probabilistic analysis. The analyses highlight non-obvious links between system attributes, especially links due to the complex way humans interact with, and adapt to, such devices. The probabilistic analysis systematically describes risk as a function of the authentication method and its design parameters. We show example results quantifying how some key design parameters produce opposite effects on risk due to accidental and malicious causes, requiring a trade-off: the quantitative model allows the designer to manage this trade-off to achieve an acceptable level of overall risk, taking into account environmental factors like the expected prevalence of certain attack types. Both the qualitative and quantitative approaches aim to help device designers make rational decisions about authentication options and the tuning of their design parameters.","PeriodicalId":306813,"journal":{"name":"Proceedings of the 17th International Conference on Availability, Reliability and Security","volume":"45 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2022-08-23","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"115211400","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Cyber-security measures for protecting EPES systems in the 5G area 5G环境下EPES系统的网络安全保护措施

Proceedings of the 17th International Conference on Availability, Reliability and Security Pub Date : 2022-08-23 DOI: 10.1145/3538969.3544476

A. Lekidis

{"title":"Cyber-security measures for protecting EPES systems in the 5G area","authors":"A. Lekidis","doi":"10.1145/3538969.3544476","DOIUrl":"https://doi.org/10.1145/3538969.3544476","url":null,"abstract":"The recent technological advance in the fifth generation of telecommunication networks (5G) has led to a evolutions in many domains, including connected cars, manufacturing and electricity. A technological domain that had large benefits from this advance is the Electrical Power and Energy System (EPES). Despite the simplicity and efficiency that 5G brings there are also underlying risks that are slowing down its adoption. These risks are caused by the presence of convergence connectivity interfaces in legacy infrastructures that were built with no security in mind. Specifically, EPES systems are often targeted by cyber criminals to cause massive blackouts in entire cities or countries that in turn lead to societal impact, such as consumer discomfort. In this work we propose a cyber-security measures for 1) early-stage detection of cyber-security incidents and 2) protecting against them through applicable security measures. The proposed measures are applied to a Hydroelectric Power Plant (HPP) of the Public Power Corporation (PPC). The cyber-attacks are performed in a 5G-enabled smart meter that measures power production and transmits measurements to PPC’s control center through the use of 5G Network Function Virtualization (NFV) technologies, such as network slicing. To protect against the attacks, cyber-security measures are applied and incorporated in a cyber-security platform, that was developed within the PHOENIX H2020 project. The measures are used to detect the attacks and perform necessary mitigation actions for restoring the HPP operation.","PeriodicalId":306813,"journal":{"name":"Proceedings of the 17th International Conference on Availability, Reliability and Security","volume":"58 5-6","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2022-08-23","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"114024530","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 2

A Collaborative Intelligent Intrusion Response Framework for Smart Electrical Power and Energy Systems 智能电力和能源系统的协同智能入侵响应框架

Proceedings of the 17th International Conference on Availability, Reliability and Security Pub Date : 2022-08-23 DOI: 10.1145/3538969.3543820

Konstantinos-Panagiotis Grammatikakis, Ioannis Koufos, N. Kolokotronis

{"title":"A Collaborative Intelligent Intrusion Response Framework for Smart Electrical Power and Energy Systems","authors":"Konstantinos-Panagiotis Grammatikakis, Ioannis Koufos, N. Kolokotronis","doi":"10.1145/3538969.3543820","DOIUrl":"https://doi.org/10.1145/3538969.3543820","url":null,"abstract":"Smart grid systems build upon existing electrical grid infrastructure by integrating power and information technologies allowing electrical power service providers to optimise their services. The combination of complex networks formed by interconnected heterogeneous devices, and the bidirectional nature of communications between end users and service providers makes security a challenging task. As implicit trust relations formed by smart grid components expand the attack surface considerably, a highly adaptable solution is required to secure these systems. In this paper, the design of an intelligent intrusion response system is explored, which can respond to ongoing multi-stage attacks in an optimal manner with respect to service availability. The smart grid infrastructure’s vulnerabilities are modelled with a graphical network security model allowing the application of probabilistic risk management methods for quantifying threats and their corresponding risks. A game-theoretic approach has been implemented that leverages the security models to efficiently respond to cyber-attacks, whose performance is tightly coupled with the system’s attack detection capabilities. To achieve better results and ensure inter-component privacy a federated learning approach was adopted. Preliminary testing on a simulated home area network with attacks against the Modbus, BACnet, and MQTT protocols, in addition to Mirai and BlackEnergy attacks, was performed to test the viability of this approach. The results illustrated the successful mitigation of attacks but also highlighted the need to implement collaborative mechanisms into the intrusion response part of the model.","PeriodicalId":306813,"journal":{"name":"Proceedings of the 17th International Conference on Availability, Reliability and Security","volume":"107 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2022-08-23","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"116466022","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 1