I don't use this site very much, so don't expect much (current) detail. My personal website is more up-to-date, but even that lags a bit.
If there is something in particular you are looking for then contact me directly. Phone: 765-494-7805 Address: 656 Oval Drive Recitation Building - Purdue CERIAS West Lafayette, IN 47907-2086
This edition of Practical Unix & Internet Security provides detailed coverage of today's increasi... more This edition of Practical Unix & Internet Security provides detailed coverage of today's increasingly important security and networking issues. Focusing on the four most popular Unix variants today--Solaris, Mac OS X, Linux, and FreeBSD--this book contains new information on PAM (Pluggable Authentication Modules), LDAP, SMB/Samba, anti-theft technologies, embedded systems, wireless and laptop issues, forensics, intrusion detection, chroot jails, telephone scanners and firewalls, virtual and cryptographic filesystems, WebNFS, kernel security levels, outsourcing, legal issues, new Internet protocols and cryptographic algorithms, and much more.
This much expanded new edition explores web security risks and how to minimize them. Aimed at web... more This much expanded new edition explores web security risks and how to minimize them. Aimed at web users, administrators, and content providers, Web Security, Privacy & Commerce covers cryptography, SSL, the Public Key Infrastructure, digital signatures, digital certificates, privacy threats (cookies, log files, web logs, web bugs), hostile mobile code, and web publishing (intellectual property, P3P, digital payments, client-side digital signatures, code signing, PICS).
User safety--browser vulnerabilities (with an emphasis on Netscape Navigator and Microsoft Intern... more User safety--browser vulnerabilities (with an emphasis on Netscape Navigator and Microsoft Internet Explorer), privacy concerns, issues with Java, JavaScript, ActiveX, and plug-ins. ... Digital certificates--what they are, how they assure identity in a networked environment, how ...
This Research Full Paper presents the results of a Delphi study. Industrial Control Systems (ICS)... more This Research Full Paper presents the results of a Delphi study. Industrial Control Systems (ICS) is a term used to describe highly integrated and mutually dependent systems made up of a complex network of hundreds of thousands of interconnected control systems. These systems usually incorporate different mass production and distribution elements to accomplish an industrial purpose. These highly integrated and mutually dependent systems have been deployed to manage, monitor, and control industrial infrastructure to provide essential services, such as electricity, energy, chemical, food and beverage, water, gas, oil, and traffic control systems. As these internet-connected systems and technologies continue to grow globally, the risks and threats of ICS cyberattacks' are rapidly increasing. If left susceptible to cyberattacks, any significant stoppage or interruption can cause real-world damages, considerable loss, and undesirable events. ICS security, the process of keeping these systems secure, is becoming a challenging priority for industrial organizations. A recent study conducted by the Center for Strategic International Studies (CSIS) showed that across eight countries of I.T. decisionmakers, 82 % of employers reported a cybersecurity skills shortage, and 71 % believe this talent gap poses direct and observable harm to their organization. A report by (ISC)2 found that there is a vast ICS cybersecurity workforce gap, and the cybersecurity workforce needs to grow 89% to meet industry needs in the United States and 145% to close the skills gap worldwide. The major factor driving the market is the increasing number of complex cyber-attacks on ICS systems, requiring a high demand for trained and skilled professionals in the ICS cybersecurity field. In 2016, a CSIS survey of IT employers found that only 23 % believed education curriculums were fully training students to join the cybersecurity industry. Likewise, in 2018, ISACA found that 61 % of institutes believe that fewer than half of those filling cybersecurity positions were qualified for the job. The current education curriculum lacks essential cybersecurity programs and degrees. It does not provide a strong foundation for building the role-specific knowledge necessary to meet the needs of the cybersecurity workforce. This deficiency needs to be urgently addressed through the creation of multiple, flexible programs in industrial control systems security. One of the first steps in this development is to identify the most critical knowledge, skills, and abilities necessary to become proficient in ICS security. This paper reports on a Delphi study designed to identify these foundational concepts and create a concept map based on the findings. This study used the Delphi method to develop the concept map. A selection of 25 experts in ICS security from academia, industry, and government were contacted and asked to outline a list of core knowledge areas. The researchers developed a summary of the experts' opinions. Two more rounds of input and feedback were solicited from the panel of experts. This paper describes the process and the resulting concept map describing the landscape of ICS cybersecurity.
This new edition of Practical Unix & Internet Security provides detailed coverage of today's ... more This new edition of Practical Unix & Internet Security provides detailed coverage of today's increasingly important security and networking issues. Focusing on the four most popular Unix variants today--Solaris, Mac OS X, Linux, and FreeBSD--this book contains new information on PAM (Pluggable Authentication Modules), LDAP, SMB/Samba, anti-theft technologies, embedded systems, wireless and laptop issues, forensics, intrusion detection, chroot jails, telephone scanners and firewalls, virtual and cryptographic filesystems, WebNFS, kernel security levels, outsourcing, legal issues, new Internet protocols and cryptographic algorithms, and much more.
This paper is a republication of an original blog post by Gene Spafford with a title of the same ... more This paper is a republication of an original blog post by Gene Spafford with a title of the same name. It includes comments on the general lack of women in the computing subfield of cybersecurity and advice for both men and women. The original blog posting can be found at https://www.cerias.purdue.edu/site/blog/post/were_out_of_balance/
Web 2.0 -- A Complex Balancing Act The First Global Study on Web 2.0 Usage, Risks and Best Practi... more Web 2.0 -- A Complex Balancing Act The First Global Study on Web 2.0 Usage, Risks and Best Practices Lorraine Kisselburgh, Mihaela Vorvoreanu, Eugene Spafford & Preeti Rao Abstract Defined broadly as consumer social media applications such as Facebook, Twitter and YouTube, and specialized Enterprise 2.0 solutions, Web 2.0 has become a term surrounded by many debates. In the first global study on Web 2.0 usage, risks, and practices, we surveyed more than 1,000 organizational decision-makers in 17 countries and interviewed experts to develop an in-depth study of emerging policies and practices in how organizations balance the risks and benefits of using Web 2.0 technologies. Our findings show high Web 2.0 adoption: 75% of organizations use Web 2.0 for a variety of business functions, with the main driver being new revenue potential. Yet organizational decision makers continue to debate employee use of Web 2.0-- either in the office or on the road. Security is the leading concern, and ...
2011 Sixth International Conference on Availability, Reliability and Security, 2011
The Sixth International Conference on Availability, Reliability and Security (ARES 2011) brings t... more The Sixth International Conference on Availability, Reliability and Security (ARES 2011) brings together researchers and practitioners in the field of dependability. ARES 2011 highlights the various aspects of dependability, following the tradition of previous ARES conferences, again with a special focus on the crucial linkage between availability, reliability and security.
Improving software assurance is of paramount importance given the impact of software on our lives... more Improving software assurance is of paramount importance given the impact of software on our lives. Static and dynamic approaches have been proposed over the years to detect security vulnerabilities. These approaches assume that the signature of a defect, for instance the use of a vulnerable library function, is known apriori. A greater challenge is detecting defects with signatures that are not known apriori–unknown software defects. In this paper, we propose a general approach for detection of unknown defects. Software ...
Models for Development, Interaction, and Management
Virtual worlds have seen tremendous growth in recent years. However, security and privacy risks a... more Virtual worlds have seen tremendous growth in recent years. However, security and privacy risks are major considerations in different forms of commerce and exchange in virtual worlds. The studies of behavioral economics and lessons from markets provide fertile ground in the employment of virtual worlds to demonstrate study and examine behaviors. In this chapter, we address user and organizational concerns about security and privacy risks by exploring the relationships among risk, perception of risk, and economic behavior in virtual worlds. To make their interaction more effective, we recommend organizations to understand perceptions of risk in virtual worlds and then implement policies and procedures to enhance trust and reduce risk. Such understanding depends in turn on the multidisciplinary nature of cyber security economics and online behavior
This paper concentrates on one technological aspect of providing communications security, firewal... more This paper concentrates on one technological aspect of providing communications security, firewall technology. It introduces a formalism called Hierarchical Colored Petri Nets (HCPN) in tutorial style. The main contribution of the paper is a description of how to model firewall systems using Hierarchical Colored Petri Nets. A byproduct of this approach is a novel way of modeling audit streams in distributed systems. HCPNs are well suited for modeling concurrent, distributed systems in which regulated flows of information are ...
This edition of Practical Unix & Internet Security provides detailed coverage of today's increasi... more This edition of Practical Unix & Internet Security provides detailed coverage of today's increasingly important security and networking issues. Focusing on the four most popular Unix variants today--Solaris, Mac OS X, Linux, and FreeBSD--this book contains new information on PAM (Pluggable Authentication Modules), LDAP, SMB/Samba, anti-theft technologies, embedded systems, wireless and laptop issues, forensics, intrusion detection, chroot jails, telephone scanners and firewalls, virtual and cryptographic filesystems, WebNFS, kernel security levels, outsourcing, legal issues, new Internet protocols and cryptographic algorithms, and much more.
This much expanded new edition explores web security risks and how to minimize them. Aimed at web... more This much expanded new edition explores web security risks and how to minimize them. Aimed at web users, administrators, and content providers, Web Security, Privacy & Commerce covers cryptography, SSL, the Public Key Infrastructure, digital signatures, digital certificates, privacy threats (cookies, log files, web logs, web bugs), hostile mobile code, and web publishing (intellectual property, P3P, digital payments, client-side digital signatures, code signing, PICS).
User safety--browser vulnerabilities (with an emphasis on Netscape Navigator and Microsoft Intern... more User safety--browser vulnerabilities (with an emphasis on Netscape Navigator and Microsoft Internet Explorer), privacy concerns, issues with Java, JavaScript, ActiveX, and plug-ins. ... Digital certificates--what they are, how they assure identity in a networked environment, how ...
This Research Full Paper presents the results of a Delphi study. Industrial Control Systems (ICS)... more This Research Full Paper presents the results of a Delphi study. Industrial Control Systems (ICS) is a term used to describe highly integrated and mutually dependent systems made up of a complex network of hundreds of thousands of interconnected control systems. These systems usually incorporate different mass production and distribution elements to accomplish an industrial purpose. These highly integrated and mutually dependent systems have been deployed to manage, monitor, and control industrial infrastructure to provide essential services, such as electricity, energy, chemical, food and beverage, water, gas, oil, and traffic control systems. As these internet-connected systems and technologies continue to grow globally, the risks and threats of ICS cyberattacks' are rapidly increasing. If left susceptible to cyberattacks, any significant stoppage or interruption can cause real-world damages, considerable loss, and undesirable events. ICS security, the process of keeping these systems secure, is becoming a challenging priority for industrial organizations. A recent study conducted by the Center for Strategic International Studies (CSIS) showed that across eight countries of I.T. decisionmakers, 82 % of employers reported a cybersecurity skills shortage, and 71 % believe this talent gap poses direct and observable harm to their organization. A report by (ISC)2 found that there is a vast ICS cybersecurity workforce gap, and the cybersecurity workforce needs to grow 89% to meet industry needs in the United States and 145% to close the skills gap worldwide. The major factor driving the market is the increasing number of complex cyber-attacks on ICS systems, requiring a high demand for trained and skilled professionals in the ICS cybersecurity field. In 2016, a CSIS survey of IT employers found that only 23 % believed education curriculums were fully training students to join the cybersecurity industry. Likewise, in 2018, ISACA found that 61 % of institutes believe that fewer than half of those filling cybersecurity positions were qualified for the job. The current education curriculum lacks essential cybersecurity programs and degrees. It does not provide a strong foundation for building the role-specific knowledge necessary to meet the needs of the cybersecurity workforce. This deficiency needs to be urgently addressed through the creation of multiple, flexible programs in industrial control systems security. One of the first steps in this development is to identify the most critical knowledge, skills, and abilities necessary to become proficient in ICS security. This paper reports on a Delphi study designed to identify these foundational concepts and create a concept map based on the findings. This study used the Delphi method to develop the concept map. A selection of 25 experts in ICS security from academia, industry, and government were contacted and asked to outline a list of core knowledge areas. The researchers developed a summary of the experts' opinions. Two more rounds of input and feedback were solicited from the panel of experts. This paper describes the process and the resulting concept map describing the landscape of ICS cybersecurity.
This new edition of Practical Unix & Internet Security provides detailed coverage of today's ... more This new edition of Practical Unix & Internet Security provides detailed coverage of today's increasingly important security and networking issues. Focusing on the four most popular Unix variants today--Solaris, Mac OS X, Linux, and FreeBSD--this book contains new information on PAM (Pluggable Authentication Modules), LDAP, SMB/Samba, anti-theft technologies, embedded systems, wireless and laptop issues, forensics, intrusion detection, chroot jails, telephone scanners and firewalls, virtual and cryptographic filesystems, WebNFS, kernel security levels, outsourcing, legal issues, new Internet protocols and cryptographic algorithms, and much more.
This paper is a republication of an original blog post by Gene Spafford with a title of the same ... more This paper is a republication of an original blog post by Gene Spafford with a title of the same name. It includes comments on the general lack of women in the computing subfield of cybersecurity and advice for both men and women. The original blog posting can be found at https://www.cerias.purdue.edu/site/blog/post/were_out_of_balance/
Web 2.0 -- A Complex Balancing Act The First Global Study on Web 2.0 Usage, Risks and Best Practi... more Web 2.0 -- A Complex Balancing Act The First Global Study on Web 2.0 Usage, Risks and Best Practices Lorraine Kisselburgh, Mihaela Vorvoreanu, Eugene Spafford & Preeti Rao Abstract Defined broadly as consumer social media applications such as Facebook, Twitter and YouTube, and specialized Enterprise 2.0 solutions, Web 2.0 has become a term surrounded by many debates. In the first global study on Web 2.0 usage, risks, and practices, we surveyed more than 1,000 organizational decision-makers in 17 countries and interviewed experts to develop an in-depth study of emerging policies and practices in how organizations balance the risks and benefits of using Web 2.0 technologies. Our findings show high Web 2.0 adoption: 75% of organizations use Web 2.0 for a variety of business functions, with the main driver being new revenue potential. Yet organizational decision makers continue to debate employee use of Web 2.0-- either in the office or on the road. Security is the leading concern, and ...
2011 Sixth International Conference on Availability, Reliability and Security, 2011
The Sixth International Conference on Availability, Reliability and Security (ARES 2011) brings t... more The Sixth International Conference on Availability, Reliability and Security (ARES 2011) brings together researchers and practitioners in the field of dependability. ARES 2011 highlights the various aspects of dependability, following the tradition of previous ARES conferences, again with a special focus on the crucial linkage between availability, reliability and security.
Improving software assurance is of paramount importance given the impact of software on our lives... more Improving software assurance is of paramount importance given the impact of software on our lives. Static and dynamic approaches have been proposed over the years to detect security vulnerabilities. These approaches assume that the signature of a defect, for instance the use of a vulnerable library function, is known apriori. A greater challenge is detecting defects with signatures that are not known apriori–unknown software defects. In this paper, we propose a general approach for detection of unknown defects. Software ...
Models for Development, Interaction, and Management
Virtual worlds have seen tremendous growth in recent years. However, security and privacy risks a... more Virtual worlds have seen tremendous growth in recent years. However, security and privacy risks are major considerations in different forms of commerce and exchange in virtual worlds. The studies of behavioral economics and lessons from markets provide fertile ground in the employment of virtual worlds to demonstrate study and examine behaviors. In this chapter, we address user and organizational concerns about security and privacy risks by exploring the relationships among risk, perception of risk, and economic behavior in virtual worlds. To make their interaction more effective, we recommend organizations to understand perceptions of risk in virtual worlds and then implement policies and procedures to enhance trust and reduce risk. Such understanding depends in turn on the multidisciplinary nature of cyber security economics and online behavior
This paper concentrates on one technological aspect of providing communications security, firewal... more This paper concentrates on one technological aspect of providing communications security, firewall technology. It introduces a formalism called Hierarchical Colored Petri Nets (HCPN) in tutorial style. The main contribution of the paper is a description of how to model firewall systems using Hierarchical Colored Petri Nets. A byproduct of this approach is a novel way of modeling audit streams in distributed systems. HCPNs are well suited for modeling concurrent, distributed systems in which regulated flows of information are ...
This paper concentrates on one technological aspect of providing communications security, firewal... more This paper concentrates on one technological aspect of providing communications security, firewall technology. It introduces a formalism called Hierarchical Colored Petri Nets (HCPN) in tutorial style. The main contribution of the paper is a description of how to model firewall systems using Hierarchical Colored Petri Nets. A byproduct of this approach is a novel way of modeling audit streams in distributed systems. HCPNs are well suited for modeling concurrent, distributed systems in which regulated flows of information are ...
Lack of trust is identified as one of the main constraints on online environments, particularly i... more Lack of trust is identified as one of the main constraints on online environments, particularly in terms of consumer protection. Although the elements that contribute to building trust can be identified in broad terms, there are still many uncertainties in defining and establishing trust in online environments. This paper investigates these uncertainties by studying the relationship between trust and the risk perceptions of users. We discuss issues such as trust as an economic good, risks to procedural fairness, and the relationship between the two. ...
Uploads
published February 2003
published november 2001
published February 2003
published november 2001