Search

Effective cybersecurity education requires offering hands-on exercises in addition to lecture-based learning. The study provides insights into the challenges of cybersecurity hands-on education and offers a pathway for developing better cybersecurity educational materials. The fast-paced nature of the cybersecurity field makes it difficult for educators to keep up and create realistic exercises. Hence, there is a need for a common framework that would enable educators to produce more usable and effective cybersecurity hands-on educational resources, avoiding the reinvention of the proverbial wheel. In this work, we developed criteria to categorize and evaluate existing cybersecurity education resources based on their technical and educational characteristics. We analyze and evaluate four existing cybersecurity resources and provide critical remarks on their usability and effectiveness. Finally, we propose recommendations for developing new cybersecurity labs or exercises as well as designing cybersecurity platforms. [ABSTRACT FROM AUTHOR]

Nowadays, due to the increasing number of cyberattacks, cybersecurity education, training, and awareness are considered crucial for preparing current and future IT professionals. Thus, it is essential for educational institutions to foster well-designed learning strategies in the field of cybersecurity that will not only focus on theory-based learning interventions but also on encapsulating authentic learning practices. In this context, the paper at hand presents a ubiquitous scenario-based learning (SBL) intervention, blended with IoT devices for introducing the topic of the man-in-the-middle attack to 1st-grade students in vocational education. The learning scenario enables two-way plain text communication through a LoRa network. For securing the transmission and assure confidentiality, basic encryption techniques are enabled for the transmitted messages. Meanwhile, an eavesdropper, acting as the man-in-the-middle attacker, tries to intercept the communication, by applying different decryption techniques. For this purpose, a u-Learning app was developed. The app was evaluated by ninety 1st-grade students of an educational institute of vocational training, in terms of effectiveness, efficiency, knowledge acquisition, and learners' satisfaction. Among others, the results show that the effectiveness and the efficiency of the proposed learning process were 92.03%, and 89.63%, respectively. Finally, learners' satisfaction was high, and their knowledge acquisition was improved. [ABSTRACT FROM AUTHOR]

Cybersecurity professionals need hands-on training to prepare for managing the current advanced cyber threats. To practice cybersecurity skills, training participants use numerous software tools in computer-supported interactive learning environments to perform offensive or defensive actions. The interaction involves typing commands, communicating over the network, and engaging with the training environment. The training artifacts (data resulting from this interaction) can be highly beneficial in educational research. For example, in cybersecurity education, they provide insights into the trainees' learning processes and support effective learning interventions. However, this research area is not yet well-understood. Therefore, this paper surveys publications that enhance cybersecurity education by leveraging trainee-generated data from interactive learning environments. We identified and examined 3021 papers, ultimately selecting 35 articles for a detailed review. First, we investigated which data are employed in which areas of cybersecurity training, how, and why. Second, we examined the applications and impact of research in this area, and third, we explored the community of researchers. Our contribution is a systematic literature review of relevant papers and their categorization according to the collected data, analysis methods, and application contexts. These results provide researchers, developers, and educators with an original perspective on this emerging topic. To motivate further research, we identify trends and gaps, propose ideas for future work, and present practical recommendations. Overall, this paper provides in-depth insight into the recently growing research on collecting and analyzing data from hands-on training in security contexts. [ABSTRACT FROM AUTHOR]

Machine learning models trained on data from the outside world can be corrupted by data poisoning attacks that inject malicious points into the models' training sets. A common defense against these attacks is data sanitization: first filter out anomalous training points before training the model. In this paper, we develop three attacks that can bypass a broad range of common data sanitization defenses, including anomaly detectors based on nearest neighbors, training loss, and singular-value decomposition. By adding just 3% poisoned data, our attacks successfully increase test error on the Enron spam detection dataset from 3 to 24% and on the IMDB sentiment classification dataset from 12 to 29%. In contrast, existing attacks which do not explicitly account for these data sanitization defenses are defeated by them. Our attacks are based on two ideas: (i) we coordinate our attacks to place poisoned points near one another, and (ii) we formulate each attack as a constrained optimization problem, with constraints designed to ensure that the poisoned points evade detection. As this optimization involves solving an expensive bilevel problem, our three attacks correspond to different ways of approximating this problem, based on influence functions; minimax duality; and the Karush–Kuhn–Tucker (KKT) conditions. Our results underscore the need to develop more robust defenses against data poisoning attacks. [ABSTRACT FROM AUTHOR]

In 2018, with the internet being treated as a utility on equal grounds as clean water or air, the underground malicious software economy is flourishing with an influx of growth and sophistication in the attacks. The use of malicious documents has increased rapidly in the last five years along with a spectrum of attacks. They offer flexibility in document structure with numerous features for attackers to exploit. Despite efforts from industry and research communities, this remains a viable security threat. In this paper, a broad classification of malicious documents based attacks is provided along with a detailed description of the attack opportunities available using Portable Document Format (PDF) and Office documents. Detailed structures of both file formats, state of the art tools as well as the current research in automatic detection methods have been discussed. [ABSTRACT FROM AUTHOR]

Existing mitigation techniques for cross-site scripting attacks have not been widely adopted, primarily due to imposing impractical overheads on developers, Web servers, or Web browsers. They either enforce restrictive coding practices on developers, fail to support legacy Web applications, demand browser code modification, or fail to provide browser backward compatibility. Moving target defense (MTD) is a novel proactive class of techniques that aim to defeat attacks by imposing uncertainty in attack reconnaissance and planning. This uncertainty is achieved by frequent and random mutation (randomization) of system configuration in a manner that is not traceable (predictable) by attackers. In this paper, we present WebMTD, a proactive moving target defense mechanism that thwarts various kinds of cross-site scripting (XSS) attacks on Web applications. Relying on built-in features of modern Web browsers, WebMTD randomizes values of certain attributes of Web elements to differentiate the application code from the injected code and disallow its execution; this is done without requiring Web developer involvement or browser code modification. Through rigorous evaluation, we show that WebMTD has very a low performance overhead. Also, we argue that our technique outperforms all competing approaches due to its broad effectiveness, transparency, backward compatibility, and low overhead. [ABSTRACT FROM AUTHOR]

Background and Context: Encouraging undergraduate programming students to think more about their software development processes is challenging. Most programming courses focus on coding skill development and mastering programming language features; subsequently software development processes (e.g. planning, code commenting, and error debugging) are undervalued. Moreover, many of these processes involve tacit thinking that is often seemingly invisible, meaning it can be difficult for teachers to identify and address shortcomings in student processes. Objective: In this paper, we employ a novel approach called Interpersonal Process Recall (IPR) to encourage students to think more about their software development processes. Method: We conducted IPR sessions with five undergraduate programming students—we screen captured them working on programming assignments, and then used the screen captures to stimulate reflection. IPR is hallmarked by several key features, namely its developmental (rather than evaluative) focus, and the use of a facilitator to guide reflection in a structured way. Findings: We found IPR was useful for both the teaching staff and the students, revealing incongruence between the value students placed on certain development processes and what they actually do in practice. Implications: IPR is a novel approach for shining a light on student software development processes. We hope this paper encourages other practitioners to consider adding IPR to their toolbox of approaches for encouraging students to reflect on their software development processes. [ABSTRACT FROM AUTHOR]

As the complexity and the scale of networks continue to grow, the management of the network operations and security defense has become a challenging task for network administrators, and many network devices may not be updated timely, leaving the network vulnerable to potential attacks. Moreover, the static nature of our existing network infrastructure allows attackers to have enough time to study the static configurations of the network and to launch well-crafted attacks at their convenience while defenders have to work around the clock to defend the network. This asymmetry, in terms of time and money invested, has given attackers greater advantage than defenders and has made the security defense even more challenging. It calls for new and innovative ideas to fix the problem. Moving Target Defense (MTD) is one of the innovative ideas which implements diverse and dynamic configurations of network systems with the goal of puzzling the exact attack surfaces available to attackers. As a result, the system status with the MTD strategy is unpredictable to attackers, hard to exploit, and is more resilient to various forms of attacks. There are existing survey papers on various MTD techniques, but to the best of our knowledge, insufficient focus was given on the architectural perspective of MTD strategies or some new technologies such as Internet of Things (IoT). This paper presents a comprehensive survey on MTD and implementation strategies from the perspective of the architecture of the complete network system, covering the motivation for MTD, the explanation of main MTD concepts, ongoing research efforts of MTD and its implementation at each level of the network system, and the future research opportunities offered by new technologies such as Software-Defined Networking (SDN) and Internet of Things (IoT). [ABSTRACT FROM AUTHOR]

As one part of our life, there are many different types of security threats in social network, and the virtual assets of social networking users has become the attack target. It is of great importance to use security patches in social network to offset the security threats. However, the dissemination of security patches will bring challenges to energy consumptions and network resources which are limited in social networks. In this paper, we will construct a novel optimal dissemination strategy based on differential game to get the desired equilibrium between security risks and resource consumption. The optimal dissemination rate is obtained from the Nash equilibrium solution. Simulation analysis will be given to illustrate that resource consumption and virtual assets loss can be reduced based on the proposed scheme. [ABSTRACT FROM AUTHOR]

The security of HMAC (and more general hash-based MACs) against state-recovery and universal forgery attacks was shown to be suboptimal, following a series of results by Leurent et al. and Peyrin et al. These results have shown that such powerful attacks require significantly less than $$2^{\ell }$$ computations, contradicting the common belief (where $$\ell $$ denotes the internal state size). In this work, we revisit and extend these results, with a focus on concrete hash functions that limit the message length, and apply special iteration modes. We begin by devising the first state-recovery attack on HMAC with a HAIFA hash function (using a block counter in every compression function call), with complexity $$2^{4\ell /5}$$ . Then, we describe improved tradeoffs between the message length and the complexity of a state-recovery attack on HMAC with a Merkle-Damgård hash function. Consequently, we obtain improved attacks on several HMAC constructions used in practice, in which the hash functions limits the maximal message length (e.g., SHA-1 and SHA-2). Finally, we present the first universal forgery attacks, which can be applied with short message queries to the MAC oracle. In particular, we devise the first universal forgery attacks applicable to SHA-1 and SHA-2. Despite their theoretical interest, our attacks do not seem to threaten the practical security of the analyzed concrete HMAC constructions. [ABSTRACT FROM AUTHOR]

We construct identity-based encryption and inner product encryption schemes under the decision linear assumption. Their private user keys are leakage-resilient in several scenarios. In particular, In addition, we prove that our IBE schemes are anonymous under the DLIN assumption, so that ciphertexts leaks no information on the corresponding identities. Similarly, attributes in IPE are proved computationally hidden in the corresponding ciphertexts. [ABSTRACT FROM AUTHOR]

Cybersecurity concerns among citizens and public administration officials are considered to be one of the major barriers to e-government implementation. While cyberterrorism is on the rise, the operational state of cybersecurity in the public sector appears as a black box and previous literature has scarcely examined how public authorities perceive and cope with cyber attacks. This study investigates public employees' attitudes toward cybersecurity in the public sector, as well as the arrangements and measures in place to protect sensitive governmental data and securely manage it for privacy and regulatory compliance. Thus, it contributes to the e-government literature by presenting a comprehensive framework of cybersecurity in the public sector and by providing empirical evidence thereof. Furthermore, it gives an insight into the prevalent attitudes and cybersecurity infrastructure within the realm of public administration. Finally, the article derives research and managerial implications and provides suggestions for future research. [ABSTRACT FROM AUTHOR]

A multiset hash function associates a hash value to arbitrary collections of objects with possible repetitions. Such a hash function is said to be homomorphic, or incremental, when the hash of the union of two collections is easy to compute from the hashes of the two collections themselves: it is usually their sum under a suitable group operation. In particular, hash values of large collections can be computed incrementally and/or in parallel. This makes homomorphic hashing a very useful primitive, with applications ranging from database integrity verification to streaming set/multiset comparison and network coding. Unfortunately, constructions of homomorphic hash functions proposed in the literature are hampered by two main drawbacks. They tend to be much longer than usual hash functions at the same security level (e.g. to achieve a collision resistance of 2128, they are several thousand bits long, as opposed to 256 bits for usual hash functions), and they are also quite slow. In this paper, we introduce the Elliptic Curve Multiset Hash (ECMH), which combines a usual bit string-valued hash function like BLAKE2 with an efficient encoding into binary elliptic curves to overcome both difficulties. On the one hand, the size of ECMH digests is essentially optimal: 2m-bit hash values provide O(2m) collision resistance. On the other hand, we demonstrate a highly-efficient software implementation of ECMH, which our thorough empirical evaluation shows to be capable of processing over 3 million set elements per second on a 4 GHz Intel Haswell machine at the 128 bit security level-many times faster than previous practical methods. While incremental hashing based on elliptic curves has been considered previously (Brown, D.R.L. (2008) The encrypted elliptic curve hash. IACR Cryptology ePrint Archive, 2008, 12.), the proposed method was less efficient, susceptible to timing attacks, and potentially patent-encumbered (Brown, D. and Yamada, A. (2007) Method and apparatus for performing validation of elliptic curve public keys. US Patent, 7, 257, 709.), and no practical implementation was demonstrated. [ABSTRACT FROM AUTHOR]

This work studies the problem of optimal positioning of Intrusion Detection Systems (IDSs) in a Peer-to-Peer (P2P) environment involving a number of peers and super-peers. This scenario applies to network architectures like that of Gnutella, Skype or Tor, which involve a huge number of leaf-peers and a selected number of super-peers who have higher responsibilities in the network. A malicious entity may become part of the P2P network by joining from any part of the network. It can attack a super-peer and thus disrupt the functioning of the P2P network. Peers may try to secure the network by running IDSs at certain strategically-chosen locations in the network. But a deterministic schedule of running and positioning the IDSs can be observed and thwarted by an adversary. In this paper, we explore the problem of strategically positioning IDSs in a P2P network with a randomized, game-theoretic approach. Our approach distributes the responsibility of running the IDSs between the peers in a randomized fashion and minimizes the probability of a successful attack. [ABSTRACT FROM AUTHOR]

Searchable encryption is an important cryptographic primitive that enables privacy-preserving keyword search on encrypted electronic medical records (EMRs) in cloud storage. Efficiency of such searchable encryption in a medical cloud storage system is very crucial as it involves client platforms such as smartphones or tablets that only have constrained computing power and resources. In this paper, we propose an efficient secure-channel free public key encryption with keyword search (SCF-PEKS) scheme that is proven secure in the standard model. We show that our SCF-PEKS scheme is not only secure against chosen keyword and ciphertext attacks (IND-SCF-CKCA), but also secure against keyword guessing attacks (IND-KGA). Furthermore, our proposed scheme is more efficient than other recent SCF-PEKS schemes in the literature. [ABSTRACT FROM AUTHOR]