发布求助
文献互助 智能选刊 最新文献

2013 IEEE Security and Privacy Workshops最新文献

筛选
英文 中文
Can users control their data in social software? an ethical analysis of control systems 用户可以在社交软件中控制他们的数据吗?控制系统的伦理分析
2013 IEEE Security and Privacy Workshops Pub Date : 2013-05-23 DOI: 10.1109/SPW.2013.6914699
Rula Sayaf, J. Rule, Dave Clarke
{"title":"Can users control their data in social software? an ethical analysis of control systems","authors":"Rula Sayaf, J. Rule, Dave Clarke","doi":"10.1109/SPW.2013.6914699","DOIUrl":"https://doi.org/10.1109/SPW.2013.6914699","url":null,"abstract":"The concept of data access and data flow control has a central role in the preservation of users¿ privacy in social software. Various frameworks employ access control and accountability approaches to enable users to control who can access their data, and identify who is accountable for misconduct. The technical and legal frameworks realise these two approaches differently. This paper presents the realisations of these approaches in the two frameworks. It discusses the level of control each approach offers, and the entailed privacy and ethical issues. It demonstrates how the two approaches are at variance in the level of control offered and the privacy aspects protected, and how the issue becomes more complex when comparing the realisations of these approaches in the technical and legal frameworks. Such complexities raise an open issue of what the appropriate balance is when employing the various realisations in one system at once.","PeriodicalId":383569,"journal":{"name":"2013 IEEE Security and Privacy Workshops","volume":"250 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2013-05-23","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"121882525","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 3
I just want your anonymized contacts! benefits and education in security & privacy research 我只要你的匿名联系人!安全和隐私研究的好处和教育
2013 IEEE Security and Privacy Workshops Pub Date : 2013-05-23 DOI: 10.1109/SPW.2013.6915057
Ty Bross, L. Camp
{"title":"I just want your anonymized contacts! benefits and education in security & privacy research","authors":"Ty Bross, L. Camp","doi":"10.1109/SPW.2013.6915057","DOIUrl":"https://doi.org/10.1109/SPW.2013.6915057","url":null,"abstract":"Does participating in privacy research benefit the participant; if so, under what conditions? How do we measure the risk and benefit of participation of privacy and security research? In this paper we describe an experiment in which we requested anonymized information in the form of hashed contacts lists. The response to the request brought forward not only another example of the privacy paradox (people give away contacts for applications but would not sell them anonymized) but also brought forward the question of research as education and awareness. After evaluation our interactions, we developed a proposal for determining if there is a benefit to participating in privacy research. Is there a benefit in privacy awareness or increased security practices for participants in privacy and security research? We sketch a coordinated cross-university study to meet three goals: implement a practical collaborative partnership; investigate the value of security research for participants in terms of education; and enable evaluation of distinct benefit assessments.","PeriodicalId":383569,"journal":{"name":"2013 IEEE Security and Privacy Workshops","volume":"54 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2013-05-23","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"124161010","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 0
Preventive Inference Control in Data-centric Business Models 以数据为中心的业务模型中的预防性推理控制
2013 IEEE Security and Privacy Workshops Pub Date : 2013-05-23 DOI: 10.1109/SPW.2013.25
R. Accorsi, G. Müller
{"title":"Preventive Inference Control in Data-centric Business Models","authors":"R. Accorsi, G. Müller","doi":"10.1109/SPW.2013.25","DOIUrl":"https://doi.org/10.1109/SPW.2013.25","url":null,"abstract":"Inference control is a modern topic in data usage management, especially in the context of data-centric business models. However, it is generally not well understood how protection mechanisms could be designed to protect the users. The contributions of this paper are threefold: firstly, it describes the inference problem and relate it to protection mechanisms; secondly, it reports on a simple mechanism to provide a-priori inference protection; thirdly, it discusses on the drawbacks of such a mechanism, as well as on the acceptance it had on a preliminary, controlled field study. In particular, the study shows that, contrary to our expectations, participants prefer an a-posteriori approach based upon audits to detect whether inferences happened.","PeriodicalId":383569,"journal":{"name":"2013 IEEE Security and Privacy Workshops","volume":"40 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2013-05-23","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"114237401","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 8
Invalidating Policies using Structural Information 使用结构信息使策略无效
2013 IEEE Security and Privacy Workshops Pub Date : 2013-05-23 DOI: 10.22667/JOWUA.2014.06.31.059
F. Kammüller, Christian W. Probst
{"title":"Invalidating Policies using Structural Information","authors":"F. Kammüller, Christian W. Probst","doi":"10.22667/JOWUA.2014.06.31.059","DOIUrl":"https://doi.org/10.22667/JOWUA.2014.06.31.059","url":null,"abstract":"Insider threats are a major threat to many organisations. Even worse, insider attacks are usually hard to detect, especially if an attack is based on actions that the attacker has the right to perform. In this paper we present a step towards detecting the risk for this kind of attacks by invalidating policies using structural information of the organisational model. Based on this structural information and a description of the organisation's policies, our approach invalidates the policies and identifies exemplary sequences of actions that lead to a violation of the policy in question. Based on these examples, the organisation can identify real attack vectors that might result in an insider attack. This information can be used to refine access control system or policies.","PeriodicalId":383569,"journal":{"name":"2013 IEEE Security and Privacy Workshops","volume":"38 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2013-05-23","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"128352714","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 43
Why "no worse off" is worse off 为什么“没有更糟”是更糟
2013 IEEE Security and Privacy Workshops Pub Date : 2013-05-23 DOI: 10.1109/SPW.2013.6914701
John Aycock, John P. Sullins
{"title":"Why \"no worse off\" is worse off","authors":"John Aycock, John P. Sullins","doi":"10.1109/SPW.2013.6914701","DOIUrl":"https://doi.org/10.1109/SPW.2013.6914701","url":null,"abstract":"We argue that a common ethical justification for computer security research reflects a naively utilitarian bias, and that this justification would be rejected under other ethical theories. By examining this issue, we hope to raise the ethical bar for security research and suggest some ways that this problem might be addressed using ideas from computer and information ethics.","PeriodicalId":383569,"journal":{"name":"2013 IEEE Security and Privacy Workshops","volume":"351 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2013-05-23","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"125630926","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 1
Conducting ethical yet realistic usable security studies 进行合乎道德但现实可行的安全研究
2013 IEEE Security and Privacy Workshops Pub Date : 2013-05-23 DOI: 10.1109/SPW.2013.6915056
A. Herzberg, R. Margulies
{"title":"Conducting ethical yet realistic usable security studies","authors":"A. Herzberg, R. Margulies","doi":"10.1109/SPW.2013.6915056","DOIUrl":"https://doi.org/10.1109/SPW.2013.6915056","url":null,"abstract":"Ethical yet realistic evaluation of usable security mechanisms is both critical and challenging. We study a particular and important case: the security achieved by different defenses against phishing, where users play a key role in detecting the attacks. We argue that proper evaluation of such anti-phishing defenses, requires users to act `naturally¿, similarly to their real-life behavior, without excessive awareness of being tested for detecting attacks.We focus on our experience from conducting one of the most extensive, long-term usable security experiments, evaluating anti-phishing defenses [5]. We discuss the different ethical and operational challenges and present our recommendations.","PeriodicalId":383569,"journal":{"name":"2013 IEEE Security and Privacy Workshops","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2013-05-23","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"131291900","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 2
Bridging the Gap: A Pragmatic Approach to Generating Insider Threat Data 弥合差距:生成内部威胁数据的实用方法
2013 IEEE Security and Privacy Workshops Pub Date : 2013-05-23 DOI: 10.1109/SPW.2013.37
Joshua Glasser, Brian Lindauer
{"title":"Bridging the Gap: A Pragmatic Approach to Generating Insider Threat Data","authors":"Joshua Glasser, Brian Lindauer","doi":"10.1109/SPW.2013.37","DOIUrl":"https://doi.org/10.1109/SPW.2013.37","url":null,"abstract":"The threat of malicious insider activity continues to be of paramount concern in both the public and private sectors. Though there is great interest in advancing the state of the art in predicting and stopping these threats, the difficulty of obtaining suitable data for research, development, and testing remains a significant hinderance. We outline the use of synthetic data to enable progress in one research program, while discussing the benefits and limitations of synthetic insider threat data, the meaning of realism in this context, as well as future research directions.","PeriodicalId":383569,"journal":{"name":"2013 IEEE Security and Privacy Workshops","volume":"293 3","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2013-05-23","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"114010848","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 202
"I hereby leave my email to...": Data Usage Control and the Digital Estate “我在此留下我的电子邮件给……”:数据使用控制和数字资产
2013 IEEE Security and Privacy Workshops Pub Date : 2013-05-23 DOI: 10.1109/SPW.2013.28
Stephan Micklitz, Martin Ortlieb, Jessica Staddon
{"title":"\"I hereby leave my email to...\": Data Usage Control and the Digital Estate","authors":"Stephan Micklitz, Martin Ortlieb, Jessica Staddon","doi":"10.1109/SPW.2013.28","DOIUrl":"https://doi.org/10.1109/SPW.2013.28","url":null,"abstract":"In most data control scenarios there is the opportunity for oversight by those who, while perhaps not directly involved in the creation of the data, understand the intended usage of the data. We argue that due to the proliferation of online data and our aging population, data owners will increasingly face requests for data access and usage when such oversight is not present because the original data owner/creator is unavailable (e.g. because of death or incapacitation). We outline the technical and user experience challenges in supporting this data usage scenario, focusing on the online service setting, and highlight some emerging research problems.","PeriodicalId":383569,"journal":{"name":"2013 IEEE Security and Privacy Workshops","volume":"18 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2013-05-23","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"127752163","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 9
Log Design for Accountability 问责制日志设计
2013 IEEE Security and Privacy Workshops Pub Date : 2013-05-23 DOI: 10.1109/SPW.2013.26
Denis Butin, Marcos Chicote, D. Métayer
{"title":"Log Design for Accountability","authors":"Denis Butin, Marcos Chicote, D. Métayer","doi":"10.1109/SPW.2013.26","DOIUrl":"https://doi.org/10.1109/SPW.2013.26","url":null,"abstract":"Accountability is a requirement to be included in the initial design phase of systems because of its strong impact on log architecture implementation. As an illustration, the logs we examine here record actions by data controllers handling personally identifiable information to deliver services to data subjects. The structures of those logs seldom consider requirements for accountability, preventing effective dispute resolution. We address the question of what information should be included in logs to make their a posteriori compliance analysis meaningful. Real-world scenarios are used to show that decisions about log architecture are nontrivial and should be made from the design stage on. Four categories of situations for which straightforward solutions are problematic are presented. Our contribution shows how log content choices and accountability definitions mutually affect each other and incites service providers to rethink up to what extent they can be held responsible. These different aspects are synthesized into key guidelines to avoid common pitfalls in accountable log design. This analysis is based on case studies performed on our implementation of the PPL policy language.","PeriodicalId":383569,"journal":{"name":"2013 IEEE Security and Privacy Workshops","volume":"46 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2013-05-23","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"116852235","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 37
On Bad Randomness and Cloning of Contactless Payment and Building Smart Cards 非接触式支付和楼宇智能卡的不良随机性和克隆性研究
2013 IEEE Security and Privacy Workshops Pub Date : 2013-05-23 DOI: 10.1109/SPW.2013.29
N. Courtois, Daniel Hulme, K. Hussain, J. Gawinecki, M. Grajek
{"title":"On Bad Randomness and Cloning of Contactless Payment and Building Smart Cards","authors":"N. Courtois, Daniel Hulme, K. Hussain, J. Gawinecki, M. Grajek","doi":"10.1109/SPW.2013.29","DOIUrl":"https://doi.org/10.1109/SPW.2013.29","url":null,"abstract":"In this paper we study the randomness of some random numbers found in real-life smart card products. We have studied a number of symmetric keys, codes and random nonces in the most prominent contactless smart cards used in buildings, small payments and public transportation used by hundreds of millions of people every day. Furthermore we investigate a number of technical questions in order to see to what extent the vulnerabilities we have discovered could be exploited by criminals. In particular we look at the case MiFare Classic cards, of which some two hundred million are still in use worldwide. We have examined some 50 real-life cards from different countries to discover that it is not entirely clear if what was previously written about this topic is entirely correct. These facts are highly relevant to the practical feasibility of card cloning in order to enter some buildings, make small purchases or in public transportation in many countries. We also show examples of serious security issues due to poor entropy with another very popular contactless smart card used in many buildings worldwide.","PeriodicalId":383569,"journal":{"name":"2013 IEEE Security and Privacy Workshops","volume":"48 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2013-05-23","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"131889297","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 9
下一页 尾页
0
×
引用
GB/T 7714-2015
复制
MLA
复制
APA
复制
导出至
BibTeX EndNote RefMan NoteFirst NoteExpress
×
提示
您的信息不完整，为了账户安全，请先补充。
现在去补充
×
提示
您因"违规操作"
具体请查看互助需知
我知道了
×
提示
现在去查看 取消
×
提示
确定
请完成安全验证×
相关产品
×
本文献相关产品
联系我们：info@booksci.cn Book学术提供免费学术资源搜索服务，方便国内外学者检索中英文文献。致力于提供最便捷和优质的服务体验。 Copyright © 2023 布克学术 All rights reserved.
京ICP备2023020795号-1
ghs 京公网安备 11010802042870号
Book学术文献互助
Book学术文献互助群
群 号：481959085
Book学术官方微信