2021 IEEE/ACM 2nd International Workshop on Engineering and Cybersecurity of Critical Systems (EnCyCriS)最新文献

Security Risk Analysis of Multi-Stage Attacks based on Data Criticality 基于数据临界性的多阶段攻击安全风险分析

2021 IEEE/ACM 2nd International Workshop on Engineering and Cybersecurity of Critical Systems (EnCyCriS) Pub Date : 2021-06-01 DOI: 10.1109/EnCyCriS52570.2021.00010

Charilaos Skandylas, Luyuan Zhou, Narges Khakpour, Simon Roe

{"title":"Security Risk Analysis of Multi-Stage Attacks based on Data Criticality","authors":"Charilaos Skandylas, Luyuan Zhou, Narges Khakpour, Simon Roe","doi":"10.1109/EnCyCriS52570.2021.00010","DOIUrl":"https://doi.org/10.1109/EnCyCriS52570.2021.00010","url":null,"abstract":"In recent years, it has become more challenging for organizations to assess the security risks of their assets properly, as more vulnerabilities are discovered, exploited, and weaponized. Further, attackers usually use complex multi-stage attack strategies to compromise a system and achieve their goals by exploiting several vulnerabilities. The number of affected assets and the strategy used to create the compromises by the threat actor will often dictate the costs and damages to the organization. When performing risk analysis, in addition to existing vulnerabilities, it is important, but often neglected, to consider the criticality of the data residing in the vulnerable asset. However, graphical threat modeling techniques often do not offer suitable tools for this type of analysis. In this paper, we propose a class of security risk metrics to estimate the cost of an attack that considers the criticality of data in addition to the dependencies among vulnerabilities. Our metrics are based on graphical modeling techniques in which we incorporate data criticality. We applied our approach to a real-life case study and obtained promising results.","PeriodicalId":409275,"journal":{"name":"2021 IEEE/ACM 2nd International Workshop on Engineering and Cybersecurity of Critical Systems (EnCyCriS)","volume":"16 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2021-06-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"116082248","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 2

Understanding Developer Security Archetypes 理解开发人员安全原型

2021 IEEE/ACM 2nd International Workshop on Engineering and Cybersecurity of Critical Systems (EnCyCriS) Pub Date : 2021-06-01 DOI: 10.1109/EnCyCriS52570.2021.00013

Ita Ryan, U. Roedig, Klaas-Jan Stol

引用次数: 1

A Systematic Literature Review on Malicious Use of Reinforcement Learning 关于恶意使用强化学习的系统文献综述

2021 IEEE/ACM 2nd International Workshop on Engineering and Cybersecurity of Critical Systems (EnCyCriS) Pub Date : 2021-06-01 DOI: 10.1109/EnCyCriS52570.2021.00011

Torstein Meyer, Nektaria Kaloudi, Jingyue Li

引用次数: 0

Attack-driven Test Case Generation Approach using Model-checking Technique for Collaborating Systems 协作系统使用模型检查技术的攻击驱动测试用例生成方法

2021 IEEE/ACM 2nd International Workshop on Engineering and Cybersecurity of Critical Systems (EnCyCriS) Pub Date : 2021-06-01 DOI: 10.1109/EnCyCriS52570.2021.00008

Zelalem Mihret, Lingjun Liu

引用次数: 2

‘Under-reported’ Security Defects in Kubernetes Manifests Kubernetes中“未被报告的”安全缺陷

2021 IEEE/ACM 2nd International Workshop on Engineering and Cybersecurity of Critical Systems (EnCyCriS) Pub Date : 2021-06-01 DOI: 10.1109/EnCyCriS52570.2021.00009

Dibyendu Brinto Bose, A. Rahman, Md. Shazibul Islam Shamim

{"title":"‘Under-reported’ Security Defects in Kubernetes Manifests","authors":"Dibyendu Brinto Bose, A. Rahman, Md. Shazibul Islam Shamim","doi":"10.1109/EnCyCriS52570.2021.00009","DOIUrl":"https://doi.org/10.1109/EnCyCriS52570.2021.00009","url":null,"abstract":"With the advent of the fourth industrial revolution, industry practitioners are moving towards container-based infrastructure for managing their digital workloads. Kubernetes, a container orchestration tool, is reported to help industry practitioners in automated management of cloud infrastructure and rapid deployment of software services. Despite reported benefits, Kubernetes installations are susceptible to security defects, as it occurred for Tesla in 2018. Understanding how frequently security defects appear in Kubernetes installations can help cybersecurity researchers to investigate security-related vulnerabilities for Kubernetes and generate security best practices to avoid them. In this position paper, we first quantify how frequently security defects appear in Kubernetes manifests, i.e., configuration files that are use to install and manage Kubernetes. Next, we lay out a list of future research directions that researchers can pursue.We apply qualitative analysis on 5,193 commits collected from 38 open source repositories and observe that 0.79% of the 5,193 commits are security-related. Based on our findings, we posit that security-related defects are under-reported and advocate for rigorous research that can systematically identify undiscovered security defects that exist in Kubernetes manifests. We predict that the increasing use of Kubernetes with unresolved security defects can lead to large-scale security breaches.","PeriodicalId":409275,"journal":{"name":"2021 IEEE/ACM 2nd International Workshop on Engineering and Cybersecurity of Critical Systems (EnCyCriS)","volume":"20 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2021-06-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"115193611","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 9

Practitioner Perception of Vulnerability Discovery Strategies 从业者对漏洞发现策略的感知

2021 IEEE/ACM 2nd International Workshop on Engineering and Cybersecurity of Critical Systems (EnCyCriS) Pub Date : 2021-06-01 DOI: 10.1109/EnCyCriS52570.2021.00014

Farzana Ahamed Bhuiyan, Justin Murphy, P. Morrison, A. Rahman

{"title":"Practitioner Perception of Vulnerability Discovery Strategies","authors":"Farzana Ahamed Bhuiyan, Justin Murphy, P. Morrison, A. Rahman","doi":"10.1109/EnCyCriS52570.2021.00014","DOIUrl":"https://doi.org/10.1109/EnCyCriS52570.2021.00014","url":null,"abstract":"The fourth industrial revolution envisions industry manufacturing systems to be software driven where mundane manufacturing tasks can be automated. As software is perceived as an integral part of this vision, discovering vulnerabilities is of paramount of importance so that manufacturing systems are secure. A categorization of vulnerability discovery strategies can inform practitioners on how to identify undiscovered vulnerabilities in software. Recently researchers have investigated and identified vulnerability discovery strategies used in open source software (OSS) projects. The efficacy of the derived strategy needs to be validated by obtaining feedback from practitioners. Such feedback can be helpful to assess if identified strategies are useful for practitioners and possible directions the derived vulnerability discovery strategies can be improvised. We survey 51 practitioners to assess if four vulnerability discovery strategies: diagnostics, malicious payload construction, misconfiguration, and pernicious execution can be used to identify undiscovered vulnerabilities. Practitioners perceive the strategies to be useful: for example, we observe 88% of the surveyed practitioners to agree that diagnostics could be used to discover vulnerabilities. Our work provides evidence of usefulness for the identified strategies.","PeriodicalId":409275,"journal":{"name":"2021 IEEE/ACM 2nd International Workshop on Engineering and Cybersecurity of Critical Systems (EnCyCriS)","volume":"40 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2021-06-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"122440986","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Asset-driven Security Assurance Cases with Built-in Quality Assurance 资产驱动的安全保障案例，内置质量保证

2021 IEEE/ACM 2nd International Workshop on Engineering and Cybersecurity of Critical Systems (EnCyCriS) Pub Date : 2021-06-01 DOI: 10.1109/EnCyCriS52570.2021.00012

Mazen Mohamad, Örjan Askerdal, Rodi Jolak, Jan-Philipp Steghöfer, R. Scandariato

引用次数: 1

Message from the Workshop Committee 车间委员会的致辞

2021 IEEE/ACM 2nd International Workshop on Engineering and Cybersecurity of Critical Systems (EnCyCriS) Pub Date : 2021-06-01 DOI: 10.1109/encycris52570.2021.00005

引用次数: 0

Title Page iii 第三页标题

2021 IEEE/ACM 2nd International Workshop on Engineering and Cybersecurity of Critical Systems (EnCyCriS) Pub Date : 2018-07-01 DOI: 10.1109/srdsw.2018.00002

引用次数: 0