Search

Given society's increasing dependence on networked systems, it is clear from past occurrences that cybercrimes pose a serious threat to long-term welfare. This article focuses on the current relationship between networked systems and cybercrimes, analyzes the nature of the relationship from a fundamental engineering perspective, and systematically explores where and how future advances in networked systems might influence the evolution of cyber-attacks, even inadvertently giving rise to new forms of cybercrimes. Historical data reveals that technological advances in engineering system design, including communications and transportation, have been often accompanied by lack of foresight. The greater the extent of the advancement, the deeper the potential chasm and more severe the damage incurred when a clever perpetrator successfully exploits the weaknesses.

It is difficult to define reliable security policy components that should be applied to validate a secure computing environment. The job gets further complicated when one has to deal with multiple policies in single computing environment. This paper demonstrates how we can overcome the difficulties of defining reliable security components by using evaluation criteria. In this paper we use common criteria to derive the security functional components for a multipolicy-based network computing environment. In the verification process, the derived policy components are related to the specific security objectives of the network communication environment. The evidence listed in the case study supports the claims that the proposed network security policy interpretation framework is a complete and cohesive set of requirements. [ABSTRACT FROM AUTHOR]

Strong passwords are essential to the security of any e-commerce site as well as to individual users. Without them, hackers can penetrate a network and stop critical processes that assist consumers and keep companies operating. For most e-commerce sites, consumers have the responsibility of creating their own passwords and often do so without guidance from the web site or system administrator. One fact is well known about password creation - consumers do not create long or complicated passwords because they cannot remember them. Through an empirical analysis, this paper examines whether the passwords created by individuals on an e-commerce site use either positive or negative password practices. This paper also addresses the issue of crack times in relationship to password choices. The results of this study will show the actual password practices of current consumers, which could enforce the need for systems administrators to recommend secure password practices on e-commerce sites and in general. [ABSTRACT FROM AUTHOR]

This article focuses on the Workshop on the Security of Information Systems 2004 conference. The aim of the workshop is to serve as a forum to gather academics, researchers, practitioners and students in the security in information systems field by presenting new developments and lessons learned from real world cases. Papers submitted at the conference were of extremely high quality. Some of the papers were selected to be published in the Special Issue of Information Systems Security.

Cyber-crime and malware has evolved so drastically over the last two years that it is a challenge for an IT professional to stay on top of recent malware trends and technological advances in cyber-security. This paper provides a look from inside the antivirus laboratory at current malware attacks and technology developments for effective defenses. [ABSTRACT FROM AUTHOR]

This paper describes an access control model. Security researchers create access control models as a way of formalizing security policies. Where security policies describe the rules about who is allowed to do what to as a system or network, access control models designate the rules and explain how the system makes authorizatio choices. Each access control model provides an element or concept that is different from the others. In terms of data sensitivity and data integrity, two models stand out, the Bell-LaPadula and the Clark-Wilson. The Bell-LaPadula model concentrates its efforts on providing security while maintaining data sensitivity, and the Clark-Wilson model focuses on data integrity. The rules in forming the basic concept of the Bell-LaPadula model was discussed. A balance of data sensitivity and data integrity in access control would create an environment that recognizes the varying levels of importance data can have.

This article presents several abstracts of research papers related to computer security. The abstract of the article "An Anti-Sniffer Based on ARP Cache Poisoning Attack," discusses an anti-sniffer based on a new detection technique. The proposed technique uses mainly an ARP cache poisoning attack to detect sniffing hosts in an Ethernet network, and is implemented in a tool called SupCom anti-sniffer. The authors also test four anti-sniffers. The abstract of the article "Reducing Enterprise Risk With Effective Threat Management," describes that the risk is the buzzword of the year, and managing and reducing risk the twin Holy Grails. Threat management combines all operational actions of intrusion prevention and protection into a life cycle where one component feeds the next. The other abstract of the article "SB1386: One Year Later," represents a comprehensive review of SB1386 and its implications for businesses from both a legal and information security perspective. It presents technical requirements, including numerous proactive steps that can be taken by an organization to avoid the significant ramifications of noncompliance, to comply with this legislation.