WOSIS 2014 Abstracts

Full Papers Short Papers
Full Papers
Paper Nr: 7
Title:

Increasing Privacy and Trust in Cooperative Social Platforms for Vehicular Applications
Authors:

F. Martín-Fernández, P. Caballero-Gil, C. Caballero-Gil and J. Molina-Gil
Abstract: New research challenges have arisen from the increasing number of vehicles and consequent permanent traffic jams in urban environments. The main problem is that just one passenger occupies most cars, so a natural solution should involve a more optimized use of resources, which may be carried out through carpooling. However, carpooling is not seen as an acceptable solution by many users mainly due to the lack of trust in strangers. Nowadays, mobile technology can be combined with social media to create a trust-based system that allows sharing cars in a comfortable, fast and safe way, taking advantage of the comfort of travelling in a car. The main aim of this work is the design of an improvement for existing carpooling systems that introduces a security layer to provide privacy and trust through the measurement of user reputation. The proposal has been implemented as an Android application whose results are promising.
Download
Paper Nr: 8
Title:

SCIT Based Moving Target Defense Reduces and Shifts Attack Surface
Authors:

Ajay Nagarajan and Arun Sood
Abstract: Current approach to security is based on perimeter defense and relies on reactive systems like firewalls, intrusion detection and prevention systems. These systems require a priori information about attacks and vulnerabilities. McAfee reports identifying 100,000 new unique malware each day. Thus trying to prevent intrusions is becoming impractical. Although it is difficult to model and predict a hacker’s moves, a defender might be able to make hacker’s task harder by adopting Moving Target Defense (MTD) proactive security strategies. In this paper, we present SCIT, our MTD approach. We use Attack Surface assessment to evaluate SCIT. A system’s attack surface is the subset of its resources that an attacker can use to attack the system. Manadhata uses attack surface reduction / shifting as means of assessing MTD. In this paper, we compare the dynamically changing Attack Surface for three system architectures (1) Static Systems; (2) Basic-SCIT and (3) Diverse-SCIT.
Download
Paper Nr: 9
Title:

Security in Legacy Systems Migration to the Cloud: A Systematic Mapping Study
Authors:

Luis Márquez Alcañiz, David G. Rosado, Daniel Mellado and Eduardo Fernández-Medina
Abstract: While cloud computing emerges as a major trend in IT industry, early providers and adopters are paving the path with concerns and solutions. One of the most worrisome challenges that face the corporate clients of this new form of IT provision is how to maintain the security of their most important every day apps in the new environment, that is how to migrate securely their legacy systems that run on data centres fully controlled by the organization's IT department to a less clearly controlled infrastructure that is managed at least partly outside the scope of the clients premises and even completely off-shore. This paper presents a Systematic Mapping Study on the issue as the first step to analyze the different existing approaches in the literature about migration process to Cloud computing where taking into account the security aspects that have to be also moved to Cloud. We propose four research questions dealing with the existing strategies to migrate legacy, how they relate to common security issues as well as security issues specific to the cloud environment, and how the proposals are aligned with security standards.
Download
Paper Nr: 10
Title:

Towards a Social Engineering Test Framework
Authors:

David Kelm and Melanie Volkamer
Abstract: A growing number of hacking attacks use social engineering techniques to exploit the human factor of computer systems. They include versatile sophisticated approaches like reciprocity, authority or manipulation techniques to capitalize on in general positives of humans such as helpfulness. These attacking techniques are used in the private as well as in the business context. In the latter they form a main tool for industrial espionage. While there exist evaluation standards for security critical software and hardware as well as their operational environment, due to our knowledge there is no evaluation standard available in order to evaluate vulnerability of organizations with respect to social engineering. This paper will present a framework to evaluate this kind of vulnerability. This framework includes whitebox as well as blackbox tests. The framework enables organizations to elaborate the level of resistance as well as to identify concrete vulnerabilities. These can be used to implement concrete measures to improve the situation, i.e. the level of resistance.
Download
Paper Nr: 11
Title:

Privacy and Integrity Preserving Secure Data Aggregation in Wireless Sensor Networks
Authors:

Vivaksha J. Jariwala and Devesh C. Jinwala
Abstract: The Wireless Sensor Networks (WSNs) protocols commonly use in-network processing to optimize the communication costs. In-network processing involves processing of the sensed data on-the-fly during the course of the communication to the base station. However, due to the fusion of the data items sourced at different nodes into a single one, the security of the aggregated data as well as that of the aggregating node, demands critical investigation.One of the approaches to ensure secure data aggregation is to use encrypted sensor data for processing, using homomorphic encryption. Our research here is aimed to propose an approach that uses homomorphic encryption and appropriate data integrity mechanisms to offer confidentiality, privacy and data integrityfor secure data aggregation in wireless sensor networks.
Download
Short Papers
Paper Nr: 1
Title:

Implications of the Operational Environmental on Software Security Requirements Engineering
Authors:

Christian Schmitt and Peter Liggesmeyer
Abstract: After presenting an overview about the most commonly referred reasons and issues for bad practice in software security requirements engineering, this paper introduces a security interdependency model, illustrating the implications between software and its physical, technical and organizational environment. The model is described in detail and the mutual implication and interdependencies between software security (requirements) and the operational environment are explained, enhanced with illustrative examples. Conclusions and further research perspectives with respect to security requirements engineering, and security in general are drawn.
Download
Paper Nr: 5
Title:

WCFB: A Wide Block Encryption for Large Data Sets
Authors:

Andrey Jivsov
Abstract: We define a model for applications that process large data sets in a way that enables additional optimizations of encryption operations. We show how to take advantage of identified characteristics with a new construction of a strong pseudo-random tweakable permutation, WCFB, that is built with 2m + 1 block cipher invocation for m cipherblocks, plus ≈ 5m XOR operations. WCFB mode has simple structure. WCFB can benefit from commonly occurring plaintext, such as encryption of an 0^nm sector, and repeated operations on the same wide block.
Download
Paper Nr: 12
Title:

A Model Towards Using Evidence from Security Events for Network Attack Analysis
Authors:

Changwei Liu, Anoop Singhal and Duminda Wijesekera
Abstract: Constructing an efficient and accurate model from security events to determine an attack scenario for an enterprise network is challenging. In this paper, we discuss how to use evidence obtained from security events to construct an attack scenario and build an evidence graph. To achieve the accuracy and completeness of the evidence graph, we use Prolog inductive and abductive reasoning to correlate evidence by reasoning the causality, and use an anti-forensics database and a corresponding attack graph to find the missing evidence. In addition, because the constructed scenario and supplied evidence might need to stand up in the court of law, the federal rules of evidence are also taken into account to predetermine the admissibility of the evidence.
Download