Network security Books

Book SynopsisWhat can your organization gain by adopting HTTP/2? How about faster, simpler, and more robust websites and applications? This practical guide demonstrates how the latest version of the Hypertext Transfer Protocol can dramatically improve website and application performance.

Read more less

Book SynopsisThe technology controlling United States nuclear weapons predates the Internet. Updating the technology for the digital era is necessary, but it comes with the risk that anything digital can be hacked. Moreover, using new systems for both nuclear and non-nuclear operations will lead to levels of nuclear risk hardly imagined before. This book is the first to confront these risks comprehensively. With Cyber Threats and Nuclear Weapons, Herbert Lin provides a clear-eyed breakdown of the cyber risks to the U.S. nuclear enterprise. Featuring a series of scenarios that clarify the intersection of cyber and nuclear risk, this book guides readers through a little-understood element of the risk profile that government decision-makers should be anticipating. What might have happened if the Cuban Missile Crisis took place in the age of Twitter, with unvetted information swirling around? What if an adversary announced that malware had compromised nuclear systems, clouding the confidence of nuclear decision-makers? Cyber Threats and Nuclear Weapons, the first book to consider cyber risks across the entire nuclear enterprise, concludes with crucial advice on how government can manage the tensions between new nuclear capabilities and increasing cyber risk. This is an invaluable handbook for those ready to confront the unique challenges of cyber nuclear risk.Trade Review"Perhaps the only thing more frightening than nuclear weapons is the thought of those weapons being connected to modern software systems. Herbert Lin, an expert in both realms, has written a sobering, enlightening book that should be required reading for all those thinking about the security of these weapons in the internet age."—Jim Waldo, Former Distinguished Engineer, Sun Labs"Herbert Lin is one of this country's leading experts on nuclear and cyber issues. In this important book, he provides a careful but chilling analysis of the risks we face in efforts to modernize the nuclear enterprise. Cyber Threats and Nuclear Weapons should be read carefully in Washington." —Joseph S. Nye, Jr, Harvard University"In this wide-ranging and well-crafted book, Herbert Lin wisely encapsulates his careful analysis in a series of easy-to-digest observations, with the policy imperatives that flow from them. The result is a guide for policy makers as they cope with the hair-raising prospect of nuclear modernization amidst increasing cyber risk."—Rose Gottemoeller, Former Deputy Secretary General of NATO"Lin's purpose in writing this excellent book is to acknowledge the new and sobering reality that computerization makes nuclear weapons much less secure than readers might assume. Highly recommended."—J. A. Stever, CHOICE June 2022"an informative read for novices and experts alike."—Melissa K. Griffith, Survival: Global Politics and StrategyTable of Contents1. Introduction and Background 2. The Cyber-Nuclear Connection 3. The U.S. Nuclear Enterprise 4. Cybersecurity Lessons for Nuclear Modernization 5. Cyber Risks in Selected Nuclear Scenarios 6. Designing the Cyber-Nuclear Future: Observations and Imperatives 7. Moving Forward

Read more less

Book SynopsisAs society rushes to digitize sensitive information and services, it is imperative to adopt adequate security protections. However, such protections fundamentally conflict with the benefits we expect from commodity computers. In other words, consumers and businesses value commodity computers because they provide good performance and an abundance of features at relatively low costs. Meanwhile, attempts to build secure systems from the ground up typically abandon such goals, and hence are seldomadopted.In this book, I argue that we can resolve the tension between security and features by leveraging the trust a user has in one device to enable her to securely use another commodity device or service, without sacrificing the performance and features expected of commodity systems. At a high level, we support this premise by developing techniques to allow a user to employ a small, trusted, portable device to securely learn what code is executing on her local computer. Rather than entrusting her data to the mountain of buggy code likely running on her computer, we construct an on-demand secure execution environment which can perform security-sensitive tasks and handle private data in complete isolation from all other software (and most hardware) on the system. Meanwhile, non-security-sensitive software retains the same abundance of features and performance it enjoys today.Having established an environment for secure code execution on an individual computer, we then show how to extend trust in this environment to network elements in a secure and efficient manner. This allows us to reexamine the design of network protocols and defenses, since we can now execute code on endhosts and trust the results within the network. Lastly, we extend the user's trust one more step to encompass computations performed on a remote host (e.g., in the cloud). We design, analyze, and prove secure a protocol that allows a user to outsource arbitrary computations to commodity computers run by an untrusted remote party (or parties) who may subject the computers to both software and hardware attacks. Our protocol guarantees that the user can both verify that the results returned are indeed the correct results of the specified computations on the inputs provided, and protect the secrecy of both the inputs and outputs of the computations. These guarantees are provided in a non-interactive, asymptotically optimal (with respect to CPU and bandwidth) manner.Thus, extending a user's trust, via software, hardware, and cryptographic techniques, allows us to provide strong security protections for both local and remote computations on sensitive data, while still preserving the performance and features of commodity computers.

Read more less

Book SynopsisModern critical infrastructures can be considered as large scale Cyber Physical Systems (CPS). Therefore, when designing, implementing, and operating systems for Critical Infrastructure Protection (CIP), the boundaries between physical security and cybersecurity are blurred. Emerging systems for Critical Infrastructures Security and Protection must therefore consider integrated approaches that emphasize the interplay between cybersecurity and physical security techniques. Hence, there is a need for a new type of integrated security intelligence i.e., Cyber-Physical Threat Intelligence (CPTI).This book presents novel solutions for integrated Cyber-Physical Threat Intelligence for infrastructures in various sectors, such as Industrial Sites and Plants, Air Transport, Gas, Healthcare, and Finance. The solutions rely on novel methods and technologies, such as integrated modelling for cyber-physical systems, novel reliance indicators, and data driven approaches including BigData analytics and Artificial Intelligence (AI). Some of the presented approaches are sector agnostic i.e., applicable to different sectors with a fair customization effort. Nevertheless, the book presents also peculiar challenges of specific sectors and how they can be addressed. The presented solutions consider the European policy context for Security, Cyber security, and Critical Infrastructure protection, as laid out by the European Commission (EC) to support its Member States to protect and ensure the resilience of their critical infrastructures. Most of the co-authors and contributors are from European Research and Technology Organizations, as well as from European Critical Infrastructure Operators. Hence, the presented solutions respect the European approach to CIP, as reflected in the pillars of the European policy framework. The latter includes for example the Directive on security of network and information systems (NIS Directive), the Directive on protecting European Critical Infrastructures, the General Data Protection Regulation (GDPR), and the Cybersecurity Act Regulation. The sector specific solutions that are described in the book have been developed and validated in the scope of several European Commission (EC) co-funded projects on Critical Infrastructure Protection (CIP), which focus on the listed sectors. Overall, the book illustrates a rich set of systems, technologies, and applications that critical infrastructure operators could consult to shape their future strategies. It also provides a catalogue of CPTI case studies in different sectors, which could be useful for security consultants and practitioners as well.Table of Contents Part I “Securing Critical Infrastructures of Sensitive Industrial Plants and Sites”: • Chapter 1 “InfraStress approach on risk modelling of cascading events with live data for decision support”. • Chapter 2 “Cyber-physical adversarial attacks and countermeasures for deep learning vision systems on critical infrastructures”.• Chapter 3 “Modelling of interdependencies among and InfraStress approach on risk modelling of cascading events with live data for decision support”. • Chapter 4 “Data Visualisation for Situational Awareness in Industrial Critical Infrastructure: an InfraStress Case Study”.• Chapter 5 “Critical Infrastructures, SIPS and Threat Intelligence: legal and ethical aspects of security research”. Part II “Securing Critical Infrastructures in the Water Sector”: • Chapter 6 “Cyber security importance in the water sector and the contribution of the STOP-IT project”.• Chapter 7 “Cyber-Physical security for critical water infrastructures at strategic and tactical level”. • Chapter 8 “Cyber-physical solutions for real-time detection at operational level”. • Chapter 9 “Applying Machine Learning and Deep Learning algorithms for Anomaly Detection in Critical Water Infrastructures”. Part III “Securing Critical Infrastructures for Air Transport”: • Chapter 10 “Security Challenges for Critical Infrastructures in Air Transport”.• Chapter 11 “Toolkit to enhance cyber-physical security of Critical Infrastructures in Air Transport”.• Chapter 12 “Security ontologies as technological enabler for blended threat detection and enhanced systems interoperability”. Part IV “Securing Critical Infrastructures for Gas”: • Chapter 13 “Conceptual Model and CONOPS for Secure and Resilient Gas CI”.• Chapter 14 “High-Level Reference Architecture (HLRA) for Gas Infrastructures Protection”. • Chapter 15 “The SecureGas Key Performance Indicators for resilient gas critical infrastructures”. • Chapter 16 “Communication of Security-related Incident Information to the Authorities and the Population”. Part V “Securing Critical Infrastructures of the Healthcare Sector”: • Chapter 17 “Security monitoring for medical devices”.• Chapter 18 “User Experience models for threat monitoring and security management in healthcare”. • Chapter 19 “Attacking and defending healthcare building automation networks”.• Chapter 20 “An Intuitive Distributed Cyber Situational Awareness Framework Within a Healthcare Environment”. Part VI “Securing Critical Infrastructures in the Finance Sector”: • Chapter 21 “The FINSEC Platform: End-to-End Data-Driven Cyber-Physical Threat Intelligence for Critical Infrastructures in Finance”. • Chapter 22 “Anomaly detection for critical financial infrastructure protection”. Part VII “Critical Infrastructure Protection and Smart Resilience”: • Chapter 23 “Indicator-based assessment of resilience of critical infrastructures: From single indicators to comprehensive “smart” assessment”.

Read more less

Book SynopsisCyber threats are ever increasing. Adversaries are getting more sophisticated and cyber criminals are infiltrating companies in a variety of sectors. In today’s landscape, organizations need to acquire and develop effective security tools and mechanisms – not only to keep up with cyber criminals, but also to stay one step ahead. Cyber-Vigilance and Digital Trust develops cyber security disciplines that serve this double objective, dealing with cyber security threats in a unique way. Specifically, the book reviews recent advances in cyber threat intelligence, trust management and risk analysis, and gives a formal and technical approach based on a data tainting mechanism to avoid data leakage in Android systemsTable of ContentsIntroduction ix Wiem TOUNSI Chapter 1. What Is Cyber Threat Intelligence and How Is It Evolving? 1 Wiem TOUNSI 1.1. Introduction 1 1.2. Background 3 1.2.1. New Generation Threats 3 1.2.2. Analytical Frameworks 6 1.3. Cyber Threat Intelligence 9 1.3.1. Cyber Threat Intelligence Sources 9 1.3.2. Cyber Threat Intelligence Sub-Domains 11 1.3.3. Technical Threat Intelligence (TTI) 13 1.4. Related Work 14 1.5. Technical Threat Intelligence Sharing Problems 16 1.5.1. Benefits of CTI Sharing for Collective Learning 16 1.5.2. Reasons for Not Sharing 17 1.6. Technical Threat Intelligence Limitations 21 1.6.1. Quantity Over Quality 21 1.6.2. IOC-Specific Limitations 22 1.7. Cyber Threat Intelligent Libraries or Platforms 25 1.7.1. Benefits of CTI Libraries Based In the Cloud 26 1.7.2. Reluctance to Use Cloud Services 26 1.8. Discussion 27 1.8.1. Sharing Faster Is Not Sufficient 27 1.8.2. Reducing the Quantity of Threat Feeds 28 1.8.3. Trust to Share Threat Data and to Save Reputation Concerns 30 1.8.4. Standards for CTI Representation and Sharing 31 1.8.5. Cloud-Based CTI Libraries for Collective Knowledge and Immunity 34 1.9. Evaluation of Technical Threat Intelligence Tools 36 1.9.1. Presentation of Selected Tools 37 1.9.2. Comparative Discussion 38 1.10. Conclusion and Future Work 39 1.11. References 40 Chapter 2. Trust Management Systems: A Retrospective Study on Digital Trust 51 Reda YAICH 2.1. Introduction 51 2.2. What Is Trust? 52 2.3. Genesis of Trust Management Systems 54 2.3.1. Access Control Model 54 2.3.2. Identity-Based Access Control 55 2.3.3. Lattice-Based Access Control 57 2.3.4. Role-Based Access Control 58 2.3.5. Organization-Based Access Control 59 2.3.6. Attribute-Based Access Control 61 2.4. Trust Management 62 2.4.1. Definition 62 2.4.2. Trust Management System 64 2.4.3. Foundations 65 2.4.4. Automated Trust Negotiation 70 2.5. Classification of Trust Management Systems 72 2.5.1. Authorization-Based TMSs 73 2.5.2. Automated Trust Negotiation Systems 81 2.6. Trust Management In Cloud Infrastructures 90 2.6.1. Credentials-Based Trust Models 90 2.6.2. SLA-Based Trust Models 90 2.6.3. Feedback-Based Trust Models 91 2.6.4. Prediction-Based Trust Models 92 2.7. Conclusion 93 2.8. References 94 Chapter 3. Risk Analysis Linked to Network Attacks 105 Kamel KAROUI 3.1. Introduction 105 3.2. Risk Theory 107 3.2.1. Risk Analysis Terminology 107 3.2.2. Presentation of the Main Risk Methods 109 3.2.3. Comparison of the Main Methods 116 3.3. Analysis of IS Risk In the Context of IT Networks 120 3.3.1. Setting the Context 120 3.3.2. Risk Assessment 127 3.3.3. Risk Treatment 133 3.3.4. Acceptance of Risks 136 3.3.5. Risk Communication 137 3.3.6. Risk Monitoring 138 3.4. Conclusion 138 3.5. References 138 Chapter 4. Analytical Overview on Secure Information Flow In Android Systems: Protecting Private Data Used By Smartphone Applications 141 Mariem GRAA 4.1. Introduction 142 4.2. Information Flow 143 4.2.1. Explicit Flows 143 4.2.2. Implicit Flows 143 4.2.3. Covert Channels 144 4.3. Data Tainting 145 4.3.1. Interpreter Approach 145 4.3.2. Architecture-Based Approach 146 4.3.3. Static Taint Analysis 146 4.3.4. Dynamic Taint Analysis 147 4.4. Protecting Private Data In Android Systems 149 4.4.1. Access Control Approach 149 4.4.2. Preventing Private Data Leakage Approach 153 4.4.3. Native Libraries Approaches 157 4.5. Detecting Control Flow 160 4.5.1. Technical Control Flow Approaches 160 4.5.2. Formal Control Flow Approaches 162 4.6. Handling Explicit and Control Flows In Java and Native Android Appsʼ Code 164 4.6.1. Formal Specification of the Under-Tainting Problem 164 4.6.2. Formal Under-Tainting Solution 166 4.6.3. System Design 175 4.6.4. Handling Explicit and Control Flows In Java Android Appsʼ Code 176 4.6.5. Handling Explicit and Control Flows In Native Android Appsʼ Code 180 4.6.6. Evaluation 184 4.6.7. Discussion 187 4.7. Protection Against Code Obfuscation Attacks Based on Control Dependencies In Android Systems 188 4.7.1. Code Obfuscation Definition 188 4.7.2. Types of Program Obfuscations 189 4.7.3. Obfuscation Techniques 189 4.7.4. Code Obfuscation In Android System 190 4.7.5. Attack Model 191 4.7.6. Code Obfuscation Attacks 192 4.7.7. Detection of Code Obfuscation Attacks 194 4.7.8. Obfuscation Code Attack Tests 195 4.8. Detection of Side Channel Attacks Based on Data Tainting In Android Systems 198 4.8.1. Target Threat Model 199 4.8.2. Side Channel Attacks 200 4.8.3. Propagation Rules for Detecting Side Channel Attacks 203 4.8.4. Implementation 205 4.8.5. Evaluation 207 4.9. Tracking Information Flow In Android Systems Approaches Comparison: Summary 210 4.10. Conclusion and Highlights 215 4.11. References 216 List of Authors 227 Index 229

Read more less

Book SynopsisDeveloped in collaboration with a training and certification team from Cisco, Computer Network Security is an exploration of the state-of-the-art and good practices in setting up a secure computer system. Concrete examples are offered in each chapter, to help the reader to master the concept and apply the security configuration. This book is intended for students preparing for the CCNA Security Exam (210-260 IINS) ? whether at professional training centers, technical faculties, or training centers associated with the �Cisco Academy� program. It is also relevant to anyone interested in computer security, be they professionals in this field or users who want to identify the threats and vulnerabilities of a network to ensure better security.Table of ContentsPreface xi Introduction xiii Chapter 1. Fundamentals of Network Security 1 1.1. Introduction 1 1.1.1. The main objectives of securing a network 2 1.1.2. Information security terminology 2 1.2. Types of network security 4 1.2.1. Physical security 4 1.2.2. Logical security 4 1.2.3. Administrative security 5 1.3. The main risks related to the logical security of the network 5 1.3.1. Different kinds of network attacks 5 1.3.2. Network security measures 7 1.3.3. Vulnerability audit measures 8 1.4. Exercises to test learning 8 Chapter 2. Securing Network Devices 15 2.1. Types of network traffic 15 2.2. Securing the management plan 16 2.3. Securing passwords 16 2.4. Implementing connection restrictions 17 2.4.1. Configuring a login banner 17 2.4.2. Configuring connection parameters 17 2.5. Securing access through console lines, VTY and auxiliaries 18 2.5.1. Securing access through the console line and deactivating the auxiliary line 18 2.5.2. Securing VTY access with ssh 18 2.6. Allocation of administrative roles 19 2.6.1. Privilege levels of the IOS system 19 2.6.2. Configuring a privilege level 19 2.6.3. Setting a privilege level per user 20 2.6.4. Setting a privilege level for console, VTY, and auxiliary line access 20 2.6.5. Securing access with the management of “views” and “super-views” 21 2.6.6. Securing configuration files and the IOS system 22 2.6.7. Using automated security features 23 2.7. Securing the control plane 24 2.7.1. Introduction 24 2.7.2. MD5 authentication 24 2.7.3. Configuring OSPF protocol authentication 24 2.7.4. Configuring EIGRP protocol authentication 25 2.7.5. Configuring RIP authentication 26 2.8. Exercises for application 26 Chapter 3. Supervising a Computer Network 41 3.1. Introduction 41 3.2. Implementing an NTP server 42 3.2.1. Introduction to the NTP 42 3.2.2. How the NTP works 42 3.2.3. NTP configuration 43 3.3. Implementing a Syslog server 44 3.3.1. Introduction to the Syslog 44 3.3.2. How Syslog works 45 3.3.3. Configuring a Syslog client 46 3.4. Implementing the Simple Network Management Protocol (SNMP) 46 3.4.1. Introducing the SNMP 46 3.4.2. How SNMP works 47 3.4.3. SNMP configuration 49 3.5. Exercises for application 50 Chapter 4. Securing Access Using AAA 67 4.1. Introduction 67 4.2. AAA authentication 68 4.2.1. Local AAA authentication 68 4.2.2. AAA authentication based on a server 69 4.3. AAA authorizations 71 4.4. AAA traceability 71 4.5. Exercises for application 72 Chapter 5. Using Firewalls 79 5.1. Introducing firewalls 80 5.2. Types of firewalls 80 5.3. Setting up a firewall 80 5.4. Different firewall strategies 81 5.5. ACL-based firewalls 81 5.5.1. Introduction 81 5.5.2. The location of ACLs 81 5.5.3. IPv4 ACLs 81 5.5.4. IPv6 ACLs 82 5.5.5. ACL recommendation 83 5.6. Zone-based firewalls 84 5.6.1. Introduction 84 5.6.2. Types of security zones in a network 84 5.6.3. Rules applied to interzone traffic 85 5.6.4. Terminology 86 5.6.5. Configuring a ZFW 86 5.7. Creating zones 86 5.8. Creating Class-Maps 86 5.9. Creating the Policy-Map to apply the Class-Maps 87 5.10. Defining the zone pairs 87 5.11. Applying the policy maps to the zone pairs 87 5.12. Assigning interfaces to zones 87 5.13. Exercises for application 88 Chapter 6. Putting in Place an Intrusion Prevention System (IPS) 101 6.1. Introduction to a detector 102 6.2. The differences between an IDS and an IPS 102 6.3. Types of IPS 103 6.4. Cisco IP solutions 103 6.5. Modes of deploying IPS 103 6.6. Types of alarms 104 6.7. Detecting malicious traffic 104 6.7.1. Modes of detection 104 6.7.2. Signature-based detection 104 6.7.3. Other modes of detecting malicious traffic 105 6.8. Signature micro-engines 106 6.9. Severity levels of the signatures 107 6.10. Monitoring and managing alarms and alerts 108 6.11. List of actions to be taken during an attack 108 6.12. Configuration of an IOS IPS 109 6.13. Recommended practices 111 6.14. Exercises for application 112 Chapter 7. Securing a Local Network 125 7.1. Introduction 125 7.2. Types of attacks on Layer 2 126 7.2.1. MAC address flooding attacks 126 7.2.2. MAC spoofing attack 127 7.2.3. The DHCP starvation attack 127 7.2.4. VLAN hopping attacks 128 7.2.5. STP-based attacks 130 7.3. The best security practices for protecting Layer 2 131 7.4. Exercises for application 132 Chapter 8. Cryptography 143 8.1. Basic concepts in cryptography 143 8.1.1. Definition 143 8.1.2. Terminology 144 8.2. The different classifications of cryptology 144 8.2.1. Traditional cryptography 145 8.2.2. Modern cryptography 146 8.2.3. Symmetric and asymmetric encryption 147 8.3. Key management 149 8.3.1. Introduction 149 8.3.2. Diffie-Hellman key exchange 149 8.4. Hash functions 151 8.5. HMAC codes 151 8.6. Asymmetric cryptography 151 8.6.1. Introduction 151 8.6.2. How it works 152 8.6.3. Digital signatures 153 8.6.4. Public key infrastructure 155 8.7. Exercises for application 159 Chapter 9. IPsec VPNs 173 9.1. The IPsec protocol 173 9.1.1. Objectives of IPsec 173 9.1.2. Basic IPsec protocols 174 9.1.3. The IPsec framework 174 9.1.4. The IPsec security association 175 9.1.5. IPsec modes 175 9.2. IKE protocol 176 9.2.1. Introduction 176 9.2.2. Components of IKE 176 9.2.3. IKE phases 176 9.3. The site-to-site VPN configuration 178 9.3.1. Introduction 178 9.3.2. Configuration of IPsec VPN 179 9.4. Exercises for application 181 Chapter 10. Studying Advanced Firewalls 189 10.1. Cisco ASA firewalls 189 10.1.1. Introduction 189 10.1.2. ASA models 190 10.1.3. Modes for using ASA devices 190 10.1.4. An overview of ASA 5505 191 10.1.5. ASA levels of security 192 10.1.6. Configuring an ASA with CLI 193 10.2. Exercises for application 198 10.3. Configuring Cisco elements with graphical tools 210 10.3.1. An overview of the CCP 210 10.3.2. An overview of the ASDM 210 10.3.3. Using CCP and ASDM 210 10.4. The TMG 2010 firewall 211 10.4.1. Introduction 211 10.4.2. Installation and configuration 211 References 243 Index 245

Read more less

Book SynopsisThe end of the 20th century witnessed an information revolution that introduced a host of new economic efficiencies. This economic change was underpinned by rapidly growing networks of infrastructure that have become increasingly complex. In this new era of global security we are now forced to ask whether our private efficiencies have led to public vulnerabilities, and if so, how do we make ourselves secure without hampering the economy. In order to answer these questions, Sean Gorman provides a framework for how vulnerabilities are identified and cost-effectively mitigated, as well as how resiliency and continuity of infrastructures can be increased. Networks, Security and Complexity goes on to address specific concerns such as determining criticality and interdependency, the most effective means of allocating scarce resources for defense, and whether diversity is a viable strategy. The author provides the economic, policy, and physics background to the issues of infrastructure security, along with tools for taking first steps in tackling these security dilemmas. He includes case studies of infrastructure failures and vulnerabilities, an analysis of threats to US infrastructure, and a review of the economics and geography of agglomeration and efficiency. This critical and controversial book will garner much attention and spark an important dialogue. Policymakers, security professionals, infrastructure operators, academics, and readers following homeland security issues will find this volume of great interest.Trade Review'The world is growing more interconnected every day, spun with fiber optic cable, electric power lines, transportation and water networks. Gorman provides a detailed analysis of the pattern of telecommunications networks and their interrelationships with other infrastructure. The work is truly interdisciplinary in scope, and provides planners, policy makers, security analysts, and infrastructure managers and educators in all of these fields with an invaluable resource in terms of a rich database, a methodology, and process for assembling, analyzing and portraying information on key infrastructure assets. This work emphasizes space and place in understanding interconnectivity of physical infrastructure, integrating policy and geography as well as providing an important complement to engineering approaches to interconnected infrastructure. He presents the readers with a broad set of questions and how they can be addressed about threats, risk and vulnerability and policy options for their reduction. This is a rare book of its kind, and joins a growing literature on how complexity is a key factor in understanding and setting policies for the services upon which our society depends.' -- Rae Zimmerman, New York University, US'The concepts of Critical Infrastructure Protection are radically redefining the relationship between the public and private sectors in terms of both our national and economic security. Networks, Security and Complexity is a worthy contribution in defining and advancing many of these concepts. The author is among the vanguard of rising young scholars who will assist this nation in thinking through the significant security challenges faced in the age of information and asymmetric threat.' -- John A. McCarthy, George Mason University School of Law, US'This volume on complex networks opens surprising perspectives for the interested reader, either a scientist or a policymaker. It describes and analyzes in a convincing way the significance of critical infrastructures, be it internet or transport connections. Due insight into the existence and emergence of such infrastructures is a prerequisite for an effective security policy. This study presents a model-based, operational framework for identifying critical domains in dynamic networks. The various concepts are illustrated by means of empirical case examples.' -- Peter Nijkamp, VU University Amsterdam, The NetherlandsTable of ContentsContents: 1. Setting the Stage 2. Private Efficiencies and Public Vulnerabilities 3. Is There a Threat? 4. Literature Review of Conceptual Framework 5. The Vulnerability of Networks and the Resurrection of Distance 6. Packets and Power: The Interdependency of Infrastructure 7. Allocating Scarce Resources for Network Protection 8. Diversity as Defense 9. Conclusion References Appendix Index

Read more less

Book SynopsisThis book presents a unique, step-by-step approach for monitoring, detecting, analyzing and mitigating complex network cyber threats. It includes updated processes in response to asymmetric threats, as well as descriptions of the current tools to mitigate cyber threats. Featuring comprehensive computer science material relating to a complete network baseline with the characterization hardware and software configuration, the book also identifies potential emerging cyber threats and the vulnerabilities of the network architecture to provide students with a guide to responding to threats. The book is intended for undergraduate and graduate college students who are unfamiliar with the cyber paradigm and processes in responding to attacks. Table of ContentsPre-incident Planning and Analysis.- Incident Detection and Characterization.- Vulnerability/Consequence Analysis.- Incident Response and Recovery.- Cloud Architecture.- Lessons Learned.

Read more less

Book SynopsisHash functions are the cryptographer’s Swiss Army knife. Even though they play an integral part in today’s cryptography, existing textbooks discuss hash functions only in passing and instead often put an emphasis on other primitives like encryption schemes. In this book the authors take a different approach and place hash functions at the center. The result is not only an introduction to the theory of hash functions and the random oracle model but a comprehensive introduction to modern cryptography.After motivating their unique approach, in the first chapter the authors introduce the concepts from computability theory, probability theory, information theory, complexity theory, and information-theoretic security that are required to understand the book content. In Part I they introduce the foundations of hash functions and modern cryptography. They cover a number of schemes, concepts, and proof techniques, including computational security, one-way functions, pseudorandomness and pseudorandom functions, game-based proofs, message authentication codes, encryption schemes, signature schemes, and collision-resistant (hash) functions. In Part II the authors explain the random oracle model, proof techniques used with random oracles, random oracle constructions, and examples of real-world random oracle schemes. They also address the limitations of random oracles and the random oracle controversy, the fact that uninstantiable schemes exist which are provably secure in the random oracle model but which become insecure with any real-world hash function. Finally in Part III the authors focus on constructions of hash functions. This includes a treatment of iterative hash functions and generic attacks against hash functions, constructions of hash functions based on block ciphers and number-theoretic assumptions, a discussion of privately keyed hash functions including a full security proof for HMAC, and a presentation of real-world hash functions.The text is supported with exercises, notes, references, and pointers to further reading, and it is a suitable textbook for undergraduate and graduate students, and researchers of cryptology and information security.Trade Review“The authors put a lot of work to create this 788-page book – the text has been edited even after the layout to insert links with page numbers, there are exercises and a website for errata and discussions.” (Jaak Henno, zbMATH 1490.94001, 2022)“Arno Mittelbach and Marc Fischlin did a good job at producing this book with a collection of ideas on the Theory of Hash Functions and Random Oracles, focusing in-depth on these two areas enabling the student, the practitioner, and the researcher, to deepen their knowledge. The book is a great add-on for a modern cryptography course or for 'light summer reading' for those interested in learning more about these two topics.” (Sven Dietrich, IEEE Cipher, July 20, 2021)Table of ContentsIntroduction.- Preliminaries: Cryptographic Foundations.- Part I: Foundations.- Computational Security.- Pseudorandomness and Computational Indistinguishability.- Collision Resistance.- Encryption Schemes.- Signature Schemes.- Non-cryptographic Hashing.- Part II: The Random Oracle Methodology.- The Random Oracle Model.- The Full Power of Random Oracles.- Random Oracle Schemes in Practice.- Limitations of Random Oracles.- The Random Oracle Controversy.- Part III: Hash Function Constructions.- Iterated Hash Functions.- Constructing Compression Functions.- Iterated Hash Functions in Practice.- Constructions of Keyed Hash Functions.- Constructing Random Oracles: Indifferentiability.- Constructing Random Oracles: UCEs.- Index.

Read more less

Book SynopsisThis book contains selected papers presented at the 15th IFIP WG 9.2, 9.6/11.7, 11.6/SIG 9.2.2 International Summer School on Privacy and Identity Management, held in Maribor, Slovenia, in September 2020.*The 13 full papers included in this volume were carefully reviewed and selected from 21 submissions. Also included is a summary paper of a tutorial. As in previous years, one of the goals of the IFIP Summer School was to encourage the publication of thorough research papers by students and emerging scholars. The papers combine interdisciplinary approaches to bring together a host of perspectives, such as technical, legal, regulatory, socio-economic, social or societal, political, ethical, anthropological, philosophical, or psychological perspectives.*The summer school was held virtually.Table of ContentsTutorial Paper.- Don’t Tell Them now (or at all) – End User Notification Duties under GDPR and NIS Directive.- Selected Student Papers.- Ethical Principles for Designing Responsible Offensive Cyber Security Training.- Longitudinal collection and analysis of mobile phone data with local differential privacy.- Privacy-preserving IDS for In-Car-Networks with Local Differential Privacy.- Strong customer authentication in online payments under GDPR and PSD2: a case of cumulative application.- Privacy in Payment in the Age of Central Bank Digital Currency.- Analysing drivers’ preferences for privacy enhancing car-to-car communication systems.- Learning Analytics and Privacy - Respecting Privacy in Digital Learning Scenarios.- Preserving Privacy in Caller ID Applications.- “Identity management by design” with a technical Mediator under the GDPR.- Open about the open-rate? State of email tracking in marketing emails and its effects on user's privacy.- Privacy Respecting Data Sharing and Communication in mHealth: A Case Study.- Privacy-preserving Analytics for Data Markets using MPC.- Towards models for privacy preservation in the face of metadata exploitation.

Read more less

Book SynopsisDigital forensics deals with the acquisition, preservation, examination, analysis and presentation of electronic evidence. Computer networks, cloud computing, smartphones, embedded devices and the Internet of Things have expanded the role of digital forensics beyond traditional computer crime investigations. Practically every crime now involves some aspect of digital evidence; digital forensics provides the techniques and tools to articulate this evidence in legal proceedings. Digital forensics also has myriad intelligence applications; furthermore, it has a vital role in cyber security -- investigations of security breaches yield valuable information that can be used to design more secure and resilient systems.Advances in Digital Forensics XVII describes original research results and innovative applications in the discipline of digital forensics. In addition, it highlights some of the major technical and legal issues related to digital evidence and electronic crime investigations. The areas of coverage include: themes and issues, forensic techniques, filesystem forensics, cloud forensics, social media forensics, multimedia forensics, and novel applications. This book is the seventeenth volume in the annual series produced by the International Federation for Information Processing (IFIP) Working Group 11.9 on Digital Forensics, an international community of scientists, engineers and practitioners dedicated to advancing the state of the art of research and practice in digital forensics. The book contains a selection of thirteen edited papers from the Seventeenth Annual IFIP WG 11.9 International Conference on Digital Forensics, held virtually in the winter of 2021. Advances in Digital Forensics XVII is an important resource for researchers, faculty members and graduate students, as well as for practitioners and individuals engaged in research and development efforts for the law enforcement and intelligence communities.

Read more less

Book SynopsisThis book provides the most recent security, privacy, technical and legal challenges in the IoT environments. This book offers a wide range of theoretical and technical solutions to address these challenges. Topics covered in this book include; IoT, privacy, ethics and security, the use of machine learning algorithms in classifying malicious websites, investigation of cases involving cryptocurrency, the challenges police and law enforcement face in policing cyberspace, the use of the IoT in modern terrorism and violent extremism, the challenges of the IoT in view of industrial control systems, and the impact of social media platforms on radicalisation to terrorism and violent extremism.This book also focuses on the ethical design of the IoT and the large volumes of data being collected and processed in an attempt to understand individuals’ perceptions of data and trust. A particular emphasis is placed on data ownership and perceived rights online. It examines cyber security challenges associated with the IoT, by making use of Industrial Control Systems, using an example with practical real-time considerations. Furthermore, this book compares and analyses different machine learning techniques, i.e., Gaussian Process Classification, Decision Tree Classification, and Support Vector Classification, based on their ability to learn and detect the attributes of malicious web applications. The data is subjected to multiple steps of pre-processing including; data formatting, missing value replacement, scaling and principal component analysis. This book has a multidisciplinary approach. Researchers working within security, privacy, technical and legal challenges in the IoT environments and advanced-level students majoring in computer science will find this book useful as a reference. Professionals working within this related field will also want to purchase this book.Table of ContentsIntroduction - Critical Analysis of the Challenges Police and Law Enforcement Face in Policing Cyberspace.- Ethics and the Internet of Everything: A Glimpse into People's Perceptions Of IoT Privacy and Security.- Privacy and Security Challenges and Opportunities for IoT Technologies during and beyond COVID-19.- The Challenges of the Internet of Things Considering Industrial Control Systems.- An Introduction to Cryptocurrency Investigations.- The Application of Machine Learning Algorithms in Classification of Malicious Websites.- The Use of the Internet and the Internet of Things in Modern Terrorism and Violent Extremism.- The Impact of the Internet and Social Media Platforms on Radicalisation to Terrorism and Violent Extremism.- The Internet, Social Media and the Internet of Things in Radicalisation to Terrorism and Violent Extremism.- The Internet of Things and Terrorism: A Cause for Concern.

Read more less

Book SynopsisThe cyber world has been both enhanced and endangered by AI. On the one hand, the performance of many existing security services has been improved, and new tools created. On the other, it entails new cyber threats both through evolved attacking capacities and through its own imperfections and vulnerabilities. Moreover, quantum computers are further pushing the boundaries of what is possible, by making machine learning cyber agents faster and smarter. With the abundance of often-confusing information and lack of trust in the diverse applications of AI-based technologies, it is essential to have a book that can explain, from a cyber security standpoint, why and at what stage the emerging, powerful technology of machine learning can and should be mistrusted, and how to benefit from it while avoiding potentially disastrous consequences. In addition, this book sheds light on another highly sensitive area – the application of machine learning for offensive purposes, an aspect that is widely misunderstood, under-represented in the academic literature and requires immediate expert attention.Table of Contents1. Introduction.- 2. Understanding Machine Learning.- 3. Defence.- 4. Attack.- 5. Feasibility and Misconceptions.- 6. International resonance.- 7. Prospects.- 8. Conclusion.

Read more less

Book SynopsisThe information infrastructure – comprising computers, embedded devices, networks and software systems – is vital to operations in every sector: chemicals, commercial facilities, communications, critical manufacturing, dams, defense industrial base, emergency services, energy, financial services, food and agriculture, government facilities, healthcare and public health, information technology, nuclear reactors, materials and waste, transportation systems, and water and wastewater systems. Global business and industry, governments, indeed society itself, cannot function if major components of the critical information infrastructure are degraded, disabled or destroyed.Critical Infrastructure Protection XV describes original research results and innovative applications in the interdisciplinary field of critical infrastructure protection. Also, it highlights the importance of weaving science, technology and policy in crafting sophisticated, yet practical, solutions that will help secure information, computer and network assets in the various critical infrastructure sectors. Areas of coverage include: Industrial Control Systems Security; Telecommunications Systems Security; Infrastructure Security. This book is the fourteenth volume in the annual series produced by the International Federation for Information Processing (IFIP) Working Group 11.10 on Critical Infrastructure Protection, an international community of scientists, engineers, practitioners and policy makers dedicated to advancing research, development and implementation efforts focused on infrastructure protection. The book contains a selection of 13 edited papers from the Fifteenth Annual IFIP WG 11.10 International Conference on Critical Infrastructure Protection, held as a virtual event during the spring of 2021. Critical Infrastructure Protection XV is an important resource for researchers, faculty members and graduate students, as well as for policy makers, practitioners and other individuals with interests in homeland security.

Read more less

Book SynopsisThe authors explore various aspects of information processing for the design of service systems, efficient management, secure storage, and transmission. In addition, the subline provides knowledge and practice in decentralized ICT technologies, including those based on blockchain. The aim of this book is to analyze and develop methods of building decentralized private databases without the presence of a trusted party, methods of data processing in encrypted form to ensure the confidentiality of information, and accessibility of the corresponding fragment of the original or transformed data. In this book it is also relevant to research methods and protocols routing in infocommunication networks, which provides load balancing in the network, and analysis of intrusion detection methods based on analysis of signatures and anomalies in network behavior (state changes) based on machine learning and fractal analysis methods.Table of ContentsMethods for Privacy Support in the Decentralized Environment.- Application of Bluetooth, Wi-Fi and Gps Technologies in the means of Contact Tracking.- Analysis and Research of Threat, Attacker and Security Models of Data Depersonalization in Decentralized Networks.- Cryptographic Transformations in a Decentralized Blockchain Environment.- Statistical and Signature Analysis Methods of Intrusion Detection.- Criteria and Indicators of Efficiency of Cryptographic Protection Mechanisms.- Methods of Evaluation and Comparative Research of Cryptographic Conversions.- Cryptographic Mechanisms that Ensure the Efficiency of SNARK-Systems.- Comparative Analysis of Consensus Algorithms that use a Directed Acyclic Graph Instead of a Blockchain, and Construction of Estimates of the SPECTRE Protocol Security to the Double Spend Attack.- Models and Methods of Secure Routing and Load Balancing in Infocommunication Networks.- The Methods of Data Comparison in Residue Numeral System.- Data Control in the System of Residual Classes.- Traffic Monitoring and Abnormality Detection Methods for Decentralized Distributed Networks.

Read more less

Book SynopsisA critical challenge in deep learning is the vulnerability of deep learning networks to security attacks from intelligent cyber adversaries. Even innocuous perturbations to the training data can be used to manipulate the behaviour of deep networks in unintended ways. In this book, we review the latest developments in adversarial attack technologies in computer vision; natural language processing; and cybersecurity with regard to multidimensional, textual and image data, sequence data, and temporal data. In turn, we assess the robustness properties of deep learning networks to produce a taxonomy of adversarial examples that characterises the security of learning systems using game theoretical adversarial deep learning algorithms. The state-of-the-art in adversarial perturbation-based privacy protection mechanisms is also reviewed. We propose new adversary types for game theoretical objectives in non-stationary computational learning environments. Proper quantification of the hypothesis set in the decision problems of our research leads to various functional problems, oracular problems, sampling tasks, and optimization problems. We also address the defence mechanisms currently available for deep learning models deployed in real-world environments. The learning theories used in these defence mechanisms concern data representations, feature manipulations, misclassifications costs, sensitivity landscapes, distributional robustness, and complexity classes of the adversarial deep learning algorithms and their applications. In closing, we propose future research directions in adversarial deep learning applications for resilient learning system design and review formalized learning assumptions concerning the attack surfaces and robustness characteristics of artificial intelligence applications so as to deconstruct the contemporary adversarial deep learning designs. Given its scope, the book will be of interest to Adversarial Machine Learning practitioners and Adversarial Artificial Intelligence researchers whose work involves the design and application of Adversarial Deep Learning.Table of ContentsAdversarial Machine Learning.- Adversarial Deep Learning.- Security and Privacy in Adversarial Learning.- Game-Theoretical Attacks with Adversarial Deep Learning Models.- Physical Attacks in the Real World.- Adversarial Defense Mechanisms.- Adversarial Learning for Privacy Preservation.

Read more less

Book SynopsisThis book constitutes the refereed proceedings of the 36th Annual IFIP WG 11.3 Conference on Data and Applications Security and Privacy, DBSec 2022, held in Newark, NJ, USA, in July 2022.The 12 full papers and 6 short papers presented were carefully reviewed and selected from 33 submissions. The conference covers research in data and applications security and privacy.Table of ContentsData Privacy.- Distributed Systems.- IoT Security.- Privacy-Preserving Access and Computation.- Quantum Security.- Security Operations and Policies.

Read more less

Book SynopsisThis book describes cyber-security issues underpinning several cyber-physical systems and several application domains, proposing a common perspective able to collect similarities as well as depict divergences and specific solution methods. Special attention is given to those approaches and technologies that unleash the power of collaboration among stakeholders, in a field based often developed in isolation and segregation of information. Given the pervasively growing dependency of society on IT technology, and the corresponding proliferation of cyber-threats, there is both an imperative need and opportunity to develop a coherent set of techniques to cope with the changing nature of the upcoming cyber-security challenges. These include evolving threats and new technological means to exploit vulnerabilities of cyber-physical systems that have direct socio-technical, societal and economic consequences for Europe and the world. We witness cyber-attacks on large scale infrastructures for energy, transport, healthcare systems and smart systems. The interplay between security and safety issues is now paramount and will be even more relevant in the future. The book collects contributions from a number of scientists in Europe and presents the results of several European Projects, as NeCS, SPARTA, E-CORRIDOR and C3ISP. It will be of value to industrial researchers, practitioners and engineers developing cyber-physical solutions, as well as academics and students in cyber-security, ICT, and smart technologies in general. Table of Contents1. Collaborative and confidential architectures for information sharing and analytics.- 2. Secure Interconnection of large-scale CPS-based frameworks and middleware.- 3. Virtualized security-awareness systems and digital twins.- 4. Empirical evaluation of system vulnerabilities.- 5. Collaborative physical and cyber defense requirements.- 6. Heterogeneous data centric security policies specification and enforcement.- 7. Big data for anomaly and advanced threats detection.- 8. Collaborative identification and ranking of malware.- 9. Visual analytics techniques for cyber security.- 10. Collaborative mitigation methodologies against advanced and persistent attacks.

Read more less

Book SynopsisThis book discusses understand cybersecurity management in decentralized finance (DeFi). It commences with introducing fundamentals of DeFi and cybersecurity to readers. It emphasizes on the importance of cybersecurity for decentralized finance by illustrating recent cyber breaches, attacks, and financial losses. The book delves into understanding cyber threats and adversaries who can exploit those threats. It advances with cybersecurity threat, vulnerability, and risk management in DeFi. The book helps readers understand cyber threat landscape comprising different threat categories for that can exploit different types of vulnerabilities identified in DeFi. It puts forward prominent threat modelling strategies by focusing on attackers, assets, and software. The book includes the popular blockchains that support DeFi include Ethereum, Binance Smart Chain, Solana, Cardano, Avalanche, Polygon, among others. With so much monetary value associated with all these technologies, the perpetrators are always lured to breach security by exploiting the vulnerabilities that exist in these technologies. For simplicity and clarity, all vulnerabilities are classified into different categories: arithmetic bugs, re-Entrancy attack, race conditions, exception handling, using a weak random generator, timestamp dependency, transaction-ordering dependence and front running, vulnerable libraries, wrong initial assumptions, denial of service, flash loan attacks, and vampire Since decentralized finance infrastructures are the worst affected by cyber-attacks, it is imperative to understand various security issues in different components of DeFi infrastructures and proposes measures to secure all components of DeFi infrastructures. It brings the detailed cybersecurity policies and strategies that can be used to secure financial institutions. Finally, the book provides recommendations to secure DeFi infrastructures from cyber-attacks.Table of Contents

Read more less

Book SynopsisThis book constitutes the proceedings of the 17th International Conference on Risks and Security of Internet and Systems, CRiSIS 2022, which took place in Sousse, Tunesia, during December 7-9, 2022. The 14full papers and 4 short papers included in this volume were carefully reviewed and selected from 39 submissions. The papers detail security issues in internet-related applications, networks and systems.

Read more less

Book SynopsisIn recent years, wireless networks communication has become the fundamental basis of our work, leisure, and communication life from the early GSM mobile phones to the Internet of Things and Internet of Everything communications. All wireless communications technologies such as Bluetooth, NFC, wireless sensors, wireless LANs, ZigBee, GSM, and others have their own challenges and security threats. This book addresses some of these challenges focusing on the implication, impact, and mitigations of the stated issues. The book provides a comprehensive coverage of not only the technical and ethical issues presented by the use of wireless networks but also the adversarial application of wireless networks and its associated implications. The authors recommend a number of novel approaches to assist in better detecting, thwarting, and addressing wireless challenges and threats. The book also looks ahead and forecasts what attacks can be carried out in the future through the malicious use of the wireless networks if sufficient defenses are not implemented. The research contained in the book fits well into the larger body of work on various aspects of wireless networks and cyber-security. The book provides a valuable reference for cyber-security experts, practitioners, and network security professionals, particularly those interested in the security of the various wireless networks. It is also aimed at researchers seeking to obtain a more profound knowledge in various types of wireless networks in the context of cyber-security, wireless networks, and cybercrime. Furthermore, the book is an exceptional advanced text for Ph.D. and master’s degree programs in cyber-security, network security, cyber-terrorism, and computer science who are investigating or evaluating a security of a specific wireless network. Each chapter is written by an internationally-renowned expert who has extensive experience in law enforcement, industry, or academia. Furthermore, this book blends advanced research findings with practice-based methods to provide the reader with advanced understanding and relevant skills.Table of Contents1. Key-Pre Distribution for the Internet of Things.- 2. Approaches and Methods for Regulation of Security Risks in 5G and 6G.- 3. Investigating Gesture Control of Smart Cities.- 4. Safety And Security Issues in Employing Drones.- 5. Security Threats of Unmanned Aerial Vehicles.- 6. A Machine Learning Based Approach to Detect Cyber-Attacks on Connected and Autonomous Vehicles (CAVs).- 7. Security and Privacy Concerns in Next-Generation Networks using Artificial Intelligence-based Solutions: A Potential Use Case.- 8. A Blockchain-enabled Approach for Secure Data Sharing in 6G-based Internet of Things Networks.

Read more less

Book SynopsisThis book presents the proceedings of the International Conference on Applied Cyber Security 2023 (ACS23), held in Dubai on the April 29, containing seven original contributions. Cybersecurity is continuously attracting the world’s attention and has gained in awareness and media coverage in the last decade. Not a single week passes without a major security incident that affects a company, sector, or governmental agencies. Most of the contributions are about applications of machine learning to accomplish several cybersecurity tasks, such as malware, network intrusion, and spam email detection. Similar trends of increasing AI applications are consistent with the current research and market trends in cybersecurity and other fields. We divided this book into two parts; the first is focused on malicious activity detection using AI, whereas the second groups AI applications to tackle a selection of cybersecurity problems.This book is suitable for cybersecurity researchers, practitioners, enthusiasts, as well as fresh graduates. It is also suitable for artificial intelligence researchers interested in exploring applications in cybersecurity. Prior exposure to basic machine learning concepts is preferable, but not necessary.

Read more less

Book SynopsisThis book constitutes the refereed post-conference proceedings of the 28th International Workshop on Security Protocols, held in Cambridge, UK, during March 27–28, 2023. Thirteen papers out of 23 submissions were selected for publication in this book, presented together with the respective transcripts of discussions. The theme of this year's workshop was “Humans in security protocols — are we learning from mistakes?” The topics covered are securing the human endpoint and proving humans correct.Table of ContentsSleepwalking into Disaster? Requirements Engineering for Digital Cash.- Transporting a Secret Using Destructively-Read Memory.- Authentication of IT Professionals in the Wild - A Survey.- Incentives and Censorship Resistance for Mixnets Revisited.- Can’t Keep them Away: The Failures of Anti-Stalking Protocols in Personal Item Tracking Devices.- Who is Benefiting from Your Fitness Data? A Privacy Analysis of Smartwatches.- Trusted Introductions for Secure Messaging.- Choosing Your Friends: Shaping Ethical Use of Anonymity Networks.- One Protocol to Rule them All? On Securing Interoperable Messaging.- If it’s Provably Secure, it Probably isn’t: Why Learning from Proof Failure is Hard.- Towards Human-Centric Endpoint Security.- Determining an Economic Value of High Assurance for Commodity Software Security.- Blind Auditing and Probabilistic Access Controls.

Read more less

Book SynopsisThis book includes extended and revised versions of a set of selected papers presented at the 19th International Conference on Smart Business Technologies, ICSBT 2022, Lisbon, Portugal, July 14–16, 2022, and 19th International Conference on Security and Cryptography, SECRYPT 2022, Lisbon, Portugal, July 11-13, 2022.The 7 full papers included in the volume were carefully selected from the 143 submissions accepted to participate in the conference. The papers present reciting research on e-Business technology and its current applications; and all aspects of security and privacy.Table of ContentsSPOT+: Secure and Privacy-Preserving Proximity-Tracing Protocol with Efficient Verification over Multiple Contact Information.- Blind side channel on the Elephant LFSR Extended version.- Stacked Ensemble Models Evaluation on DL Based SCA.- Explaining the Use of Cryptographic API in Android Malware.- Explaining the Use of Cryptographic API in Android Malware.- Intrinsic Weaknesses of IDSs to Malicious Adversarial Attacks and their Mitigation.- Compressing Big OLAP Data Cubes in Big Data Analytics Systems: New Paradigms, a Reference Architecture, and Future Research Perspectives.

Read more less

Book SynopsisThis book constitutes the proceedings of the 19th International Workshop on Security and Trust Management, STM 2023, co-located with the 28th European Symposium on Research in Computer Security, ESORICS 2023, held in The Hague, The Netherlands, during September 28th, 2023 The 5 full papers together with 4 short papers included in this volume were carefully reviewed and selected from 15 submissions. The workshop presents papers with topics such as security and privacy, trust models, security services, authentication, identity management, systems security, distributed systems security, privacy-preserving protocols.Table of ContentsImpact of Consensus Protocols on the Efficiency of Registration and Authentication process in Self-Sovereign Identity.- Biometric-Based Password Management.- ‘State of the Union’: Evaluating Open Source Zero Trust Components.- Secure Stitch: Unveiling the Fabric of Security Patterns for the Internet of Things.- Towards a unified abstract architecture to coherently and generically describe security goals and risks of AI systems.- Decentralized Global Trust Registry Platform for trust discovery and verification of e-Health credentials using TRAIN: COVID-19 Certificate use case.- Privacy-Preserving NN for IDS: A Study on the impact of TFHE restrictions.- Analyzing and Improving Eligibility Verifiability of the Proposed Belgian Remote Voting System.- Consent as mechanism to preserve information privacy: Its origin, evolution, and current relevance.​

Read more less

Book SynopsisThe four-volume set LNCS 14369 until 14372 constitutes the refereed proceedings of the 21st International Conference on Theory of Cryptography, TCC 2023, held in Taipei, Taiwan, in November/December 2023. The total of 68 full papers presented in the proceedings was carefully reviewed and selected from 168 submissions. They focus on topics such as proofs and outsourcing; theoretical foundations; multi-party computation; encryption; secret sharing, PIR and memory checking; anonymity, surveillance and tampering; lower bounds; IOPs and succinctness; lattices; quantum cryptography; Byzantine agreement, consensus and composability. Table of ContentsProofs and outsourcing.- theoretical foundations.- multi-party computation.

Read more less

Book SynopsisThe four-volume set LNCS 14369 until 14372 constitutes the refereed proceedings of the 21st International Conference on Theory of Cryptography, TCC 2023, held in Taipei, Taiwan, in November/December 2023. The total of 68 full papers presented in the proceedings was carefully reviewed and selected from 168 submissions. They focus on topics such as proofs and outsourcing; theoretical foundations; multi-party computation; encryption; secret sharing, PIR and memory checking; anonymity, surveillance and tampering; lower bounds; IOPs and succinctness; lattices; quantum cryptography; Byzantine agreement, consensus and composability. Table of ContentsMulti-party computation.- encryption.- secret sharing, PIR and memory.

Read more less

Book SynopsisThe four-volume set LNCS 14369 until 14372 constitutes the refereed proceedings of the 21st International Conference on Theory of Cryptography, TCC 2023, held in Taipei, Taiwan, in November/December 2023. The total of 68 full papers presented in the proceedings was carefully reviewed and selected from 168 submissions. They focus on topics such as proofs and outsourcing; theoretical foundations; multi-party computation; encryption; secret sharing, PIR and memory checking; anonymity, surveillance and tampering; lower bounds; IOPs and succinctness; lattices; quantum cryptography; Byzantine agreement, consensus and composability. Table of ContentsAnonymity, surveillance and tampering; lower bounds; IOPs and succinctness.

Read more less

Book SynopsisThe four-volume set LNCS 14369 until 14372 constitutes the refereed proceedings of the 21st International Conference on Theory of Cryptography, TCC 2023, held in Taipei, Taiwan, in November/December 2023. The total of 68 full papers presented in the proceedings was carefully reviewed and selected from 168 submissions. They focus on topics such as proofs and outsourcing; theoretical foundations; multi-party computation; encryption; secret sharing, PIR and memory checking; anonymity, surveillance and tampering; lower bounds; IOPs and succinctness; lattices; quantum cryptography; Byzantine agreement, consensus and composability. Table of ContentsLattices.- quantum cryptography.- group-based cryptography.- Byzantine agreement, consensus and composability.

Read more less

Book SynopsisThis book constitutes the refereed proceedings of the19th International Conference on Information Systems Security, ICISS 2023, held in Raipur, India, during December 16–20, 2023. The 18 full papers and 10 short papers included in this book were carefully reviewed and selected from 78 submissions. They are organized in topical sections as follows: systems security, network security, security in AI/ML, privacy, cryptography, blockchains. Table of ContentsSystems Security.- A Security Analysis of Password Managers on Android.- The Design and Application of a Unified Ontology for Cyber Security.- Big Data Forensics on Apache Kafka.- A Survey on Security Threats and Mitigation Strategies for NoSQL Databases MongoDB as a Use Case.- Theoretical Enumeration of Deployable Single-output Strong PUF Instances based on Uniformity and Uniqueness Constraints.- Network Security.- Detection and Hardening Strategies to Secure an Enterprise Network.- Attack Graph Based Security Metrics For Dynamic Networks.- An Energy-conscious surveillance scheme for intrusion detection in underwater sensor networks using Tunicate swarm optimization.- Security in AI/ML.- STN-Net: A Robust GAN-Generated Face Detector.- MDLDroid: Multimodal Deep Learning based Android Malware Detection.- A Cycle-GAN Based Image Encoding Scheme for Privacy Enhanced Deep Neural Networks.- Secure KNN Computation On Cloud.- A Multi-Stage Multi-Modal Classification Model for DeepFakes Combining Deep Learned and Computer Vision Oriented Features.- Privacy.- Security and Privacy in Machine Learning.- Attack on the Privacy-Preserving Carpooling Service TAROT.- Democracy in Your Hands!: Practical Multi-Key Homomorphic E-Voting.- Cryptography.- Secured Collaboration with Ciphertext Policy Attribute Based Signcryption in a Distributed Fog Environment for Medical Data Sharing.- Verifiable Timed Accountable Subgroup Multi-signatures.- Verifiable Timed Accountable Subgroup Multi-signatures.- Blockchains.- Ensuring Data Security in the Context of IoT Forensics Evidence Preservation with Blockchain and Self-Sovereign Identities.- Analysis of Optimal Number of Shards using ShardEval, A Simulator for Sharded Blockchains.- SoK: Digital Signatures and Taproot Transactions in Bitcoin.- BCTPV-NIZK: Publicly-verifiable non-interactive zero-knowledge proof system from minimal blockchain assumptions.- Proof-of-Variable-Authority: A blockchain consensus mechanism for securing IoT networks.- An Efficient Two-Party ECDSA Scheme for Cryptocurrencies.- Secure Smart Grid Data Aggregation Based on Fog Computing and Blockchain Technology.- Crypto-Ransomware Detection: A Honey-file based approach using chi-square test.- PSDP: Blockchain-Based Computationally Efficient Provably Secure Data Possession.- Private and Verifiable Inter-bank Transactions and Settlements on Blockchain.

Read more less

Book SynopsisThis book constitutes the proceedings of the 26th International Conference on Information Security, ISC 2023, which took place in Groningen, The Netherlands, in November 2023.The 29 full papers presented in this volume were carefully reviewed and selected from 90 submissions. The contributions were organized in topical sections as follows: privacy; intrusion detection and systems; machine learning; web security; mobile security and trusted execution; post-quantum cryptography; multiparty computation; symmetric cryptography; key management; functional and updatable encryption; and signatures, hashes, and cryptanalysis.Table of ContentsPrivacy: Exploring Privacy-Preserving Techniques on Synthetic Data as a Defense against Model Inversion Attacks.- Privacy-preserving Medical Data Generation using Adversarial Learning.- Balanced Privacy Budget Allocation for Privacy-Preserving Machine Learning.- Intrusion Detection and Systems: SIFAST: An Efficient Unix Shell Embedding Framework for Malicious Detection.- VNGuard: Intrusion Detection System for In-Vehicle Networks.- RLTrace: Synthesizing High-Quality System Call Traces for OS Fuzz Testing.- Machine Learning: Loss and Likelihood Based Membership Inference of Diffusion Models.- Symmetry Defense Against CNN Adversarial Perturbation Attacks.- Web Security: Load-and-Act: Increasing Page Coverage of Web Applications.- From Manifest V2 to V3: A Study on the Discoverability of Chrome Extensions.- Mobile Security and Trusted Execution: Libra : Library Identification in Obfuscated Android Apps.- Certificate reuse in Android applications.- TC4SE: A High-performance Trusted Channel Mechanism for Secure Enclave-based Trusted Execution Environments.- Post-Quantum Cryptography: Performance Impact of PQC KEMs on TLS 1.3 under Varying Network Characteristics.- Protecting Private Keys of Dilithium using Hardware Transactional Memory.- Multiparty Computation: Mercury: Constant-Round Protocols for Multi-Party Computation with Rationals.- Evolving Conditional Disclosure of Secrets.- Symmetric Cryptography: Permutation-Based Deterministic Authenticated Encryption with Minimum Memory Size.- Impossible Differential Cryptanalysis of the FBC Block Cipher.- Fregata: Faster Homomorphic Evaluation of AES via TFHE.- Key Management: Efficient Forward Secrecy for TLS-PSK from Pure Symmetric Cryptography.- On the Privacy-preserving Infrastructure for Authenticated Key Exchange.- Hybrid Group Key Exchange with Application to Constrained Networks.- Functional and Updatable Encryption.- Dynamic Multi-Server Updatable Encryption.- Trace-and-Revoke Quadratic Functional Encryption.- Function-Hiding Zero Predicate Inner Product Functional Encryption from Pairings.- Signatures, Hashes, and Cryptanalysis: Robust Property-Preserving Hash Meets Homomorphism.- Withdrawable Signature: How to Call off a Signature.- An Improved BKW Algorithm for Solving LWE with Small Secrets.

Read more less

Book SynopsisThis book constitutes the refereed proceedings of the 14th International Conference on Decision and Game Theory for Security, GameSec 2023, held in Avignon, France, during October 18–20, 2023.The 19 full papers and 4 short papers included in this book were carefully reviewed and selected from 33 submissions. They were organized in topical sections as follows: Mechanism design and imperfect information, Security Games, Learning in security games, Cyber deception, Economics of security, Information and privacy and Short articles.Table of ContentsMechanism design and imperfect information.- Observable Perfect Equilibrium.- Playing Repeated Coopetitive Polymatrix Games with Small Manipulation Cost.- Rule Enforcing Through Ordering.- Security Games.- Multi-defender Security Games with Schedules.- Asymmetric Centrality Game against Network Epidemic Propagation.- Shades of Grey: Strategic Bimatrix Stopping Games for Modelling (Un)Ethical Hacking Roles.- Learning in security games.- Characterizing and Improving the Robustness of Predict-Then-Optimize Frameworks.- Quantisation Effects in Adversarial Cyber-Physical GamesTakuma Adams.- Scalable Learning of Intrusion Responses through Recursive Decomposition.- Cyber deception.- Honeypot Allocation for Cyber Deception in Dynamic Tactical Networks: A Game Theoretic Approach.- Optimal Resource Allocation for Proactive Defense with Deception in Probabilistic Attack Graphs.- The Credential is Not Enough: Combining Honeypots and Fake Credentials for Cyber-Defense.- Economics of security.- Does Cyber-insurance Benefit the Insured or the Attacker? -- A Game of Cyber-Insurance.- Rational Broadcast Protocols against Timid Adversaries.- FlipPath Game to Counter Stealthy Attacks in SDN-based Tactical Networks.- Information and privacy.- Double-sided Information Asymmetry in Double Extortion Ransomware.- Opacity-enforcing active perception and control against eavesdropping attacks.- A Game-Theoretic Analysis of Auditing Differentially Private Algorithms with Epistemically Disparate Herd.- Modeling and Analysis of a Nonlinear Security Game with Mixed Armament.- Short articles.- Incentive-Based Software Security: Fair Micro-Payments for Writing Secure Code.- Using Game Theory Approach for COVID-19 Risk Analysis and Medical Resource Allocation.- Shapley Value to Rank Vulnerabilities on Attack Graphs: Applications to Cyberdeception.- Solving security models with perfect observability.

Read more less

Book SynopsisChapter 1 Basic concepts of cybersecurity.- Chapter 2 Attack vectors and malware.- Chapter 3 System security.- Chapter 4 Cryptography.- Chapter 5 Key management and PKI.- Chapter 6 Network security.- Chapter 7 Wireless Security.- Chapter 8 User authentication.- Chapter 9 IAM  Identity and Access Management.- Chapter 10 Digital Privacy.- Chapter 11Secure by design.- Chapter 12 Physical Information Security.- Chapter 13 Security culture.- Chapter 14 Cybersecurity readiness, security testing and audit.- Chapter 15 AI and cybersecurity.- Chapter 16Cyber operations.- Chapter 17 Cyber organizational structures and regulation.- Chapter 18 Governance and information security management.- Chapter 19 Cybersecurity risk management.

Read more less