Technology and security leaders are appointed to be the stewards of their organization's digital ... more Technology and security leaders are appointed to be the stewards of their organization's digital assets. Building on the habits that we shared in Chapter 9 and the guidance to boards of directors in Chapter 10, we share specific ideas and actions tailored for your role. As we mentioned in Chapter 1, as per research conducted by Gary McGraw and his teams at Synopsys and Cigital, there are four "tribes" of CISOs. 1 Seasoned executives in security roles who help as enablers, technology leaders, and compliance leaders may be most likely to get invited to board meetings. Security leaders whose organizations are mostly viewed as cost centers and not viewed strategically may not. The remainder of this chapter focuses on helping prepare security executives, technology leaders, and compliance leaders to be invited to board meetings. For those security leaders whose organizations are viewed mostly as cost centers, we encourage you to build enough awareness about the strategic importance of security and deliver results exhibiting that strategic importance until you get invited to a board meeting.
In our experience, managing security effectively takes not only the right mindset but the right h... more In our experience, managing security effectively takes not only the right mindset but the right habits, practiced regularly. For instance, some organizations (and to an extent basic human nature) are reactive, and in the case of cybersecurity, it often gets more attention after a recent incident or breach. With cybersecurity, there are always new and evolving threats. Organizations that lose focus, becoming lax in applying the right habits regularly, can more easily fall prey to attackers and even a public breach. The contrary is also true—by applying the right habits regularly, an organization can continually minimize the probability of a breach.
Under this license, you are free to both share (copy and redistribute the material in any medium ... more Under this license, you are free to both share (copy and redistribute the material in any medium or format) and adapt (remix, transform, and build upon the material for any purpose) the content of this document, as long as you comply with the following terms: Attribution -You must give appropriate credit, provide a link to the license, and indicate if changes were made. You may use any reasonable citation format, but the attribution may not suggest that the authors or publisher has a relationship with you or endorses you or your use. "ShareAlike" -If you remix, transform, or build upon the material, you must distribute your contributions under the same BY-SA license as the original. That means you may not add any restrictions beyond those stated in the license, or apply legal terms or technological measures that legally restrict others from doing anything the license permits. Please note that no warranties are given regarding the content of this document. This license may not give you all of the permissions necessary for a specific intended use. The IEEE Computer Society is the world's leading computing membership organization and the trusted information and career-development source for a global workforce of technology leaders. The Computer Society provides a wide range of forums for top minds to come together, including technical conferences, publications, and a comprehensive digital library, unique training webinars, professional training, and the TechLeader Training Partner Program to help organizations increase their staff's technical knowledge and expertise. To find out more about the community for technology leaders, visit .
Proceedings of the First Conference on First Workshop on Hot Topics in Understanding Botnets, Apr 10, 2007
This paper provides a detailed case study of the architecture of the Clickbot.A botnet that attem... more This paper provides a detailed case study of the architecture of the Clickbot.A botnet that attempted a low-noise click fraud attack against syndicated search engines. The botnet of over 100,000 machines was controlled using a HTTP-based botmaster. Google identified all clicks on its ads exhibiting Clickbot.Alike patterns and marked them as invalid. We disclose the results of our investigation of this botnet to educate the security research community and provide information regarding the novelties of the attack.
Denial-of-service (dos) attacks and commerce infrastructure in peer-to-peer networks (draft)
This dissertation studies denial-of-service (DoS) attacks in peer-to-peer (P2P) networks, and ele... more This dissertation studies denial-of-service (DoS) attacks in peer-to-peer (P2P) networks, and electronic commerce infrastructure for such networks. In the first part of this dissertation, we propose attack containment techniques that make search and resource discovery protocols in P2P networks more resilient to DoS attacks. We describe the importance of attack containment as a complement to prevention, detection, and recovery techniques. We describe a simple but effective traffic model that can be used to understand the effects of application-layer, query-flood DoS attacks in P2P networks. We develop a threat model that describes how good and malicious nodes are captured by the traffic model, and we describe the results of simulations based on the model. Simulations are run on both synthetic and real Gnutella network topologies, and on the Chord distributed hash table network. We analyze how different query acceptance policies can contain the effects of query-flooding DoS attacks. We also describe a DoS attack against the resource discovery mechanism of a P2P protocol called GUESS. Nodes in a GUESS network use a data structure called a pong-cache to keep track of other nodes in the network, and malicious nodes can “poison” pong-caches with malicious node ids. We describe how to contain such attacks using an ID smearing algorithm and a dynamic network partitioning scheme. In the second part of this dissertation, we develop an architecture that can be used to support electronic commerce in a P2P network. We report on a prototype implementation of the architecture that allows mobile and wireless devices to make purchases using a digital cash scheme called PDA-Payword.
The ubiquity of mobile devices and their evolution as computing platforms has made them lucrative... more The ubiquity of mobile devices and their evolution as computing platforms has made them lucrative targets for malware. Malware, such as spyware, trojans, rootkits and botnets that have traditionally plagued PCs are now increasingly targeting mobile devices and are also referred to as mobile malware. Cybercriminal attacks have used mobile malware trojans to steal and transmit users' personal information, including financial credentials, to bot master servers as well as abuse the capabilities of the device (e.g., send premium SMS messages) to generate fraudulent revenue streams. In this paper, we describe Titan, a new, network-based architecture, and a prototype implementation of it, for detecting and mitigating mobile malware. Our implementation of Titan for both Android and Linux environments was built in our 3G UMTS lab network, and was found to efficiently detect and neutralize mobile malware when tested using real malware samples from the wild. Titan employs a defensein-depth approach and features: 1) in-the-network malware detectors to identify and prevent the spread of malware and 2) a server-side mitigation engine that sends threat profiles to an on-the-phone trusted software component to neutralize and perform fine-grained remediation of malware on mobile devices.
This paper analyzes the cryptographic operation time that is required to execute secure transacti... more This paper analyzes the cryptographic operation time that is required to execute secure transactions on wireless PDAs with WAP browsers. We evaluate the time required to execute the necessary cryptographic operations to set up a WTLS connection on a Palm OS device with both ECC-based public key cryptography as well as with RSA-based public key cryptography. We find that the execution times for server-authenticated 1024-bit RSA handshakes can be up to twice as fast as for server-authenticated 163-bit ECC-based handshakes, but that the execution time for mutually-authenticated (client and server authenticated) handshakes is at least eight times faster using ECC-based handshakes.
Uploads
Papers by Neil Daswani