18th Annual Computer Security Applications Conference, 2002. Proceedings.最新文献

Themes and highlights of the new security paradigms workshop 2002 2002年新安全模式研讨会的主题和重点

18th Annual Computer Security Applications Conference, 2002. Proceedings. Pub Date : 2002-12-09 DOI: 10.1109/CSAC.2002.1176301

Cristina Serban, O. S. Saydjari

引用次数: 0

A security architecture for object-based distributed systems 基于对象的分布式系统的安全体系结构

18th Annual Computer Security Applications Conference, 2002. Proceedings. Pub Date : 2002-12-09 DOI: 10.1109/CSAC.2002.1176288

B. Popescu, M. Steen, A. Tanenbaum

引用次数: 20

Intrusion detection: current capabilities and future directions 入侵检测:当前能力和未来方向

18th Annual Computer Security Applications Conference, 2002. Proceedings. Pub Date : 2002-12-09 DOI: 10.1109/CSAC.2002.1176308

K. Levitt

引用次数: 17

Networking in the Solar Trust Model: determining optimal trust paths in a decentralized trust network 太阳能信任模型中的网络化:去中心化信任网络中最优信任路径的确定

18th Annual Computer Security Applications Conference, 2002. Proceedings. Pub Date : 2002-12-09 DOI: 10.1109/CSAC.2002.1176298

M. Clifford

引用次数: 9

Representing TCP/IP connectivity for topological analysis of network security 表示TCP/IP连接，用于网络安全的拓扑分析

18th Annual Computer Security Applications Conference, 2002. Proceedings. Pub Date : 2002-12-09 DOI: 10.1109/CSAC.2002.1176275

Ronald W. Ritchey, Brian O'Berry, S. Noel

引用次数: 96

A framework for organisational control principles 组织控制原则的框架

18th Annual Computer Security Applications Conference, 2002. Proceedings. Pub Date : 2002-12-09 DOI: 10.1109/CSAC.2002.1176294

A. Schaad, J. Moffett

引用次数: 78

Penetration testing: a duet 渗透测试:二重唱

18th Annual Computer Security Applications Conference, 2002. Proceedings. Pub Date : 2002-12-09 DOI: 10.1109/CSAC.2002.1176290

Daniel E. Geer, John Harthorne

{"title":"Penetration testing: a duet","authors":"Daniel E. Geer, John Harthorne","doi":"10.1109/CSAC.2002.1176290","DOIUrl":"https://doi.org/10.1109/CSAC.2002.1176290","url":null,"abstract":"Penetration testing is the art of finding an open door. It is not a science as science depends on falsifiable hypotheses. The most penetration testing can hope for is to be the science of insecurity - not the science of security nasmuch as penetration testing can at most prove insecurity by falsifying the hypothesis that any system, network, or application is secure. To be a science of security would require falsifiable hypotheses that any given system, network, or application was insecure, something that could only be done if the number of potential insecurities were known and enumerated such that the penetration tester could thereby falsify (test) a known-to-be-complete list of vulnerabilities claimed to not be present. Because the list of potential insecurities is unknowable and hence unenumerable, no penetration tester can prove security, just as no doctor can prove that you are without occult disease. Putting it as Picasso did, \"Art is a lie that shows the truth\" and security by penetration testing is a lie in that on a good day can show the truth. These incompleteness and proof-by-demonstration characteristics of penetration testing ensure that it remains an art so long as high rates of technical advance remains brisk and hence enumeration of vulnerabilities an impossibility. Brisk technical advance equals productivity growth and thereby wealth creation, so it is forbidden to long for a day when penetration testing could achieve the status of science.","PeriodicalId":389487,"journal":{"name":"18th Annual Computer Security Applications Conference, 2002. Proceedings.","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2002-12-09","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"130663923","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 86

Beyond the perimeter: the need for early detection of denial of service attacks 超出边界:需要早期检测拒绝服务攻击

18th Annual Computer Security Applications Conference, 2002. Proceedings. Pub Date : 2002-12-09 DOI: 10.1109/CSAC.2002.1176313

J. Haggerty, Q. Shi, M. Merabti

引用次数: 13

Did you ever have to make up your mind? What Notes users do when faced with a security decision 您是否曾经不得不做出决定？面临安全决策时，Notes 用户会怎么做

18th Annual Computer Security Applications Conference, 2002. Proceedings. Pub Date : 2002-12-09 DOI: 10.1109/CSAC.2002.1176309

M. Zurko, C. Kaufman, Katherine Spanbauer, C. Bassett

引用次数: 27

A practical approach to identifying storage and timing channels: twenty years later 一种识别存储和时序信道的实用方法:二十年后

18th Annual Computer Security Applications Conference, 2002. Proceedings. Pub Date : 2002-12-09 DOI: 10.1109/CSAC.2002.1176284

R. Kemmerer

{"title":"A practical approach to identifying storage and timing channels: twenty years later","authors":"R. Kemmerer","doi":"10.1109/CSAC.2002.1176284","DOIUrl":"https://doi.org/10.1109/CSAC.2002.1176284","url":null,"abstract":"Secure computer systems use both mandatory and discretionary access controls to restrict the flow of information through legitimate communication channels such as files, shared memory and process signals. Unfortunately, in practice one finds that computer systems are built such that users are not limited to communicating only through the intended communication channels. As a result, a well-founded concern of security-conscious system designers is the potential exploitation of system storage locations and timing facilities to provide unforeseen communication channels to users. These illegitimate channels are known as covert storage and timing channels. Prior to the presentation of this paper twenty years ago the covert channel analysis that took place was mostly ad hoc. Methods for discovering and dealing with these channels were mostly informal, and the formal methods were restricted to a particular specification language. This paper presents a methodology for discovering storage and timing channels that can be used through all phases of the software life cycle to increase confidence that all channels have been identified. In the original paper the methodology was presented and applied to an example system having three different descriptions: English, formal specification, and high order language implementation. In this paper only the English requirements are considered. However the paper also presents how the methodology has evolved and the influence it had on other work.","PeriodicalId":389487,"journal":{"name":"18th Annual Computer Security Applications Conference, 2002. Proceedings.","volume":"76 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2002-12-09","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"126529473","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 74