Risk and Argument: A Risk-based Argumentation Method for Practical Security. Trento - 02 September 2011
|
|
|
- Cora Jordan
- 8 years ago
- Views:
Transcription
1 Risk and Argument: A Risk-based Argumentation Method for Practical Security Virginia N. L. Franqueira, Thein Than Tun, Yijun Yu, Roel Wieringa and Bashar Nuseibeh Trento - 02 September 2011
2 Agenda Problem Solution Direction Walk-through of RISA method using PED example 1/20
3 Engineering of secure systems is bound by practical limitations Limited resources Uncertainties Incomplete information Unnoticeable, hardly measurable evidence 2/20
4 Consequence & Solution Direction In practice: No absolute security No 100% security requirements satisfaction Way forward: Good enough security satisfaction As low as possible level of security risk Our solution: RISA RIsk assessment in Security Argumentation 3/20
5 From Haley et al. framework to RISA method 1. Identify Functional Requirements Key steps from Haley et al. framework Formal logic 2. Identify 3. Identify 4. Construct Security Security Outer Goals Requirements Argument good enough security 8. Prioritize Risks 7. Mitigate 6. Classify 5. Construct Inner Argument Risks Risks 5. Identify Risks Public Security Catalogues Structured Argumentation Steps for risk assessment in RISA 4/20
6 PIN Entry Devices (PED) example S.Drimer, S.J.Murdoch, and R.Anderson, Thinking Inside the Box: System-Level Failures of Tamper Proofing, in SP 2008, IEEE Press, pp , 295, /20
7 RISA step 1: Identify Functional Requirements functional goal Provide convenient payment option at Points-Of Of-Sale to consumers functional requirement Allow consumers to pay at Points-Of Of-Sale with PIN 6/ Cat.
8 RISA step 2: Identify Security Goals valuable assets PIN card details transaction value design characteristics smartcard itself cryptographic keys security goal Protect the PIN Cat. 7/20
9 RISA step 3: Identify Security Requirements security requirements confidentiality of PIN integrity of PIN security functions enclosure of PED components provides tamper detection & response mechanisms to resist physical attacks encryption/decryption of PIN ensures that the PIN is encrypted within the PED immediately after PIN entry system context diagram Cat. 8/20
10 RISA step 4: Construct Outer Argument Formal proof that behavior of PIN related to confidentiality is satisfiable bank P6 confirmation -transaction CPU P5 card- reader PIN P2 P3 P4 card display keypad PED P1 consumer Outer argument for confidentiality of PIN: (Behavioral premises) P1, P2, P3, P4, P5, P6 confirmation-transaction transaction Cat. 9/20
11 Risk assessment steps of RISA are supported by the CAPEC & CWE public catalogues cwe.mitre.org/ Cat. 10/20
12 RISA step 5: Identify Risks Cat. Structured argumentation used to challenge behavioral premises in practice via risk assessment warrant Correct PINs are accepted Premise P1 by keypad Premise P2 Consumer enters PIN PIN reaches leaves keypad PIN reaches card-reader ground claim ground claim rebuttal R1.1 R1.2 rebuttal R1.6 R1.7 Challenged Risk Reference Premise P2 R1.6: PIN is revealed if sent unencrypted within the PED and the PED enclosure can be tampered CWE-311 & CAPEC /20
13 10
14 RISA step 6: Classify Risks Cat. Risks are classified in terms of: risks transferred to system context risks to be mitigated by the system Possibilities: risk to be completely mitigated by the PED risk to be completely mitigated by the PED context risk to be partially mitigated by both 13/20
15 RISA step 7: Mitigate Risks Cat. Mitigations restore the satisfaction of security requirements by rebutting risks System behavioral premises Risks Mitigations Risk R1.6 & R1.7 & R1.8 Mitigation M2.4: Any transmission of PIN should use well-vetted encryption algorithms & recommended key sizes 14/20
16 10 CWE-311
17 RISA step 8: Prioritize Risks Cat. Empirical data about typical severity of risks or likelihood of exploit can also be found in the catalogues Risk Mitigation Typical risk severity R1.6 & R1.7 & R1.8 M2.4: Any transmission of PIN should use well-vetted encryption algorithms & recommended key sizes Low to very high Interpretation of risk severity depends on many factors 16/20
18 10 CWE-311
19 RISA recursion Other rounds of argumentation may follow recursion stops when the system security is considered good-enough and/or resources for analysis of security have been used 1. Identify Functional Requirements 2. Identify Security Goals 3. Identify Security Requirements 4. Construct Outer Argument good enough security 8. Prioritize Risks 7. Mitigate Risks 6. Classify Risks 5. Identify Risks Public Security Catalogues 18/20
20 Opportunities for future work Addressing residual risks Improvement to estimation/prioritization of risks Tool support for the method: OpenArgue tool to be adapted Validation in the field with industrial case studies Addressing impact of transferred risks in terms of system mitigations Support to search catalogues for risk identification 19/20
21 Conclusion: Mutual benefits Satisfaction analysis (SA) benefits from risk assessment (RA) RA provides systematic input for security argumentation in SA RA allows prioritization of arguments and security requirements from prioritization of risks RA scales the process of argumentation with breadth-first approach Risk assessment (RA) benefits from satisfaction analysis (SA) SA provides systematic description of system context: source of risks SA provides top structure for RA SA argumentation organizes several rounds of RA & facilitates traceability 20/20
22 Questions? C. Haley, R. Laney, J. Moffett, and B. Nuseibeh, Security Requirements Engineering: A Framework for Representation and Analysis,, IEEE Transactions on Software Engineering, 34(1), pp , 153, S.Toulmin, R.Rieke,, and A.Janik, An Introduction to Reasoning,, Macmillan, 1979.
Directives and Instructions Regarding Wireless LAN in Department of Defense (DoD) and other Federal Facilities
Directives and Instructions Regarding Wireless LAN in Department of Defense (DoD) and other Federal Facilities Wireless Infrastructure, Article 12-29-2011 The federal government, and the Department of
A Methodology for Capturing Software Systems Security Requirements
A Methodology for Capturing Software Systems Security Requirements Hassan EL-Hadary Supervised by: Prof. Sherif EL-Kassas Outline Introduction to security Software Security Security Definitions Security
Directives and Instructions Regarding Security and Installation of Wireless LAN in DoD Federal Facilities
Directives and Instructions Regarding Security and Installation of Wireless LAN in DoD Federal Facilities Wireless Infrastructure, Article 3-15-2012 The federal government recognizes that standards based
Adaptive Information Security in Cloud Applications
ISSN 1744-1986 T e c h n i c a l R e p o r t N O 2014/ 01 An Architecture for Adaptive Information Security in Cloud Applications Thein Tun and Armstrong Nhlabatsi and Niamul Khan and Arosha Bandara and
The Open University s repository of research publications and other research outputs
Open Research Online The Open University s repository of research publications and other research outputs Maintaining security requirements of software systems using evolving crosscutting dependencies
CYBERSECURITY TESTING & CERTIFICATION SERVICE TERMS
CYBERSECURITY TESTING & CERTIFICATION SERVICE TERMS These Cybersecurity Testing and Certification Service Terms ( Service Terms ) shall govern the provision of cybersecurity testing and certification services
USB Portable Storage Device: Security Problem Definition Summary
USB Portable Storage Device: Security Problem Definition Summary Introduction The USB Portable Storage Device (hereafter referred to as the device or the TOE ) is a portable storage device that provides
Chap. 1: Introduction
Chap. 1: Introduction Introduction Services, Mechanisms, and Attacks The OSI Security Architecture Cryptography 1 1 Introduction Computer Security the generic name for the collection of tools designed
544 Computer and Network Security
544 Computer and Network Security Section 1: Introduction Dr. E.C. Kulasekere Sri Lanka Institute of Information Technology - 2005 Background Information Security requirements have changed in recent times
Using trust assumptions with security requirements
Requirements Eng (2006) 11: 138 151 DOI 10.1007/s00766-005-0023-4 ORIGINAL ARTICLE Charles B. Haley Æ Robin C. Laney Jonathan D. Moffett Æ Bashar Nuseibeh Using trust assumptions with security requirements
Protocol Security Where?
IPsec: AH and ESP 1 Protocol Security Where? Application layer: (+) easy access to user credentials, extend without waiting for OS vendor, understand data; (-) design again and again; e.g., PGP, ssh, Kerberos
Information Security Evaluation based on Requirements, Metrics and Evidence Information
Information Security Evaluation based on Requirements, Metrics and Evidence Information Reijo Savola VTT Technical Research Centre of Finland, Oulu, Finland Abstract Information security assurance and
Guide to Data Field Encryption
Guide to Data Field Encryption Contents Introduction 2 Common Concepts and Glossary 3 Encryption 3 Data Field Encryption 3 Cryptography 3 Keys and Key Management 5 Secure Cryptographic Device 7 Considerations
Risk Management Guide for Information Technology Systems. NIST SP800-30 Overview
Risk Management Guide for Information Technology Systems NIST SP800-30 Overview 1 Risk Management Process that allows IT managers to balance operational and economic costs of protective measures and achieve
Longmai Mobile PKI Solution
Longmai Mobile PKI Solution A quick Solution to External and Internal fraud in Insurance Industry Putting the client at the center of modernization Contents 1. INTRODUCTION... 3 1.1 Challenges... 3 1.2
Advanced Topics in Distributed Systems. Dr. Ayman Abdel-Hamid Computer Science Department Virginia Tech
Advanced Topics in Distributed Systems Dr. Ayman Abdel-Hamid Computer Science Department Virginia Tech Security Introduction Based on Ch1, Cryptography and Network Security 4 th Ed Security Dr. Ayman Abdel-Hamid,
Problems of Security in Ad Hoc Sensor Network
Problems of Security in Ad Hoc Sensor Network Petr Hanáček * hanacek@fit.vutbr.cz Abstract: The paper deals with a problem of secure communication between autonomous agents that form an ad hoc sensor wireless
ITL BULLETIN FOR AUGUST 2012
ITL BULLETIN FOR AUGUST 2012 SECURITY OF BLUETOOTH SYSTEMS AND DEVICES: UPDATED GUIDE ISSUED BY THE NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY (NIST) Shirley Radack, Editor Computer Security Division
Excerpt of Cyber Security Policy/Standard S05-001. Information Security Standards
Excerpt of Cyber Security Policy/Standard S05-001 Information Security Standards Issue Date: April 4, 2005 Publication Date: April 4, 2005 Revision Date: March 30, 2007 William F. Pelgrin Director New
An Information Security and Privacy Perspective for Procurement Services Projects
MANAGEMENT OF DATA: An Information Security and Privacy Perspective for Procurement Services Projects Presentation for: Procurement Services Senior Leadership Meeting Presented by: Ann Nagel, Associate
Analysing Monitoring and Switching Requirements using Constraint Satisfiability
ISSN 1744-1986 T e c h n i c a l R e p o r t N o 2 0 0 8 / 0 5 Analysing Monitoring and Switching Requirements using Constraint Satisfiability Mohammed Salifu Yijun Yu Bashar Nuseibeh 20 th March 2008
Project Risk Management
Project Risk Management Study Notes PMI, PMP, CAPM, PMBOK, PM Network and the PMI Registered Education Provider logo are registered marks of the Project Management Institute, Inc. Points to Note Risk Management
. g .,, . . , Applicability of Information System Security
Information System Security Chapter 1:Introduction Dr. Lo ai Tawalbeh Faculty of Information system and Technology, The Arab Academy for Banking and Financial Sciences. Jordan Chapter 1 Introduction The
E2EE and PCI Compliancy. Martin Holloway VSP Sales Director VeriFone NEMEA
E2EE and PCI Compliancy Martin Holloway VSP Sales Director VeriFone NEMEA Security Breaches In The News 2 Security Breaches In The News 3 Security Breaches In The News 4 Security Breaches In The News 5
PASTA Abstract. Process for Attack S imulation & Threat Assessment Abstract. VerSprite, LLC Copyright 2013
2013 PASTA Abstract Process for Attack S imulation & Threat Assessment Abstract VerSprite, LLC Copyright 2013 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gemalto Mifare 1K Datasheet
Gemalto Mifare 1K Datasheet Contents 1. Overview...3 1.1 User convenience and speed...3 1.2 Security...3 1.3 Anticollision...3 2. Gemalto Mifare Features...4 2.1 Compatibility with norms...4 2.2 Electrical...4
Identifying emerging security concepts using Software artifacts through an experimental case
1 Identifying emerging security concepts using Software artifacts through an experimental case Gastón Márquez, Paulina Silva Rene Noël Santiago Matalonga Hernán Astudillo Departamento de Informática Escuela
Security considerations for IMS access independence
3GPP TSG SA WG3 Security S3#20 S3-010468 16-19 October, 2001 Sydney, Australia Source: Title: Document for: Agenda Item: Telia / independence Information Security Security considerations for access independence
Software Engineering 4C03 Research Project. An Overview of Secure Transmission on the World Wide Web. Sean MacDonald 0043306
Software Engineering 4C03 Research Project An Overview of Secure Transmission on the World Wide Web Sean MacDonald 0043306 Tuesday April 5, 2005 Introduction Software Engineering 4C03 Research Project
Test Prioritization in Security Risk Testing
Test Prioritization in Security Risk Testing 36. GI-TAV 26. 27. June, Leipzig - Deutschland Michael Berger, Fraunhofer-Fokus-Institut RASEN - 316853 1 IT SECURITY RISK ASSESSMENT AND TESTING RASEN - 316853
Trusted Platforms for Homeland Security
Trusted Platforms for Homeland Security By Kevin Schutz, Product Manager Secure Products Summary Ongoing threats from hackers, viruses, and worms continue to make security a top priority for IT and business
Cryptography and Network Security Chapter 1
Cryptography and Network Security Chapter 1 Acknowledgments Lecture slides are based on the slides created by Lawrie Brown Chapter 1 Introduction The art of war teaches us to rely not on the likelihood
POLICY ON THE USE OF COMMERCIAL SOLUTIONS TO PROTECT NATIONAL SECURITY SYSTEMS
Committee on National Security Systems CNSSP No. 7 9 December 2015 POLICY ON THE USE OF COMMERCIAL SOLUTIONS TO PROTECT NATIONAL SECURITY SYSTEMS THIS DOCUMENT PRESCRIBES MINIMUM STANDARDS YOUR DEPARTMENT
MPOS: RISK AND SECURITY
MPOS: RISK AND SECURITY 2 Evolution of Payment Acceptance Consumers want to get the best deal with the minimum pain Sellers want to ensure they never turn down a sale and maximise consumer loyalty 3 Evolution
Security Policy. Trapeze Networks
MP-422F Mobility Point Security Policy Trapeze Networks August 14, 2009 Copyright Trapeze Networks 2007. May be reproduced only in its original entirety [without revision]. TABLE OF CONTENTS 1. MODULE
Microsoft STRIDE (six) threat categories
Risk-based Security Testing: Prioritizing Security Testing with Threat Modeling This lecture provides reference material for the book entitled The Art of Software Security Testing by Wysopal et al. 2007
Towards Security Risk-oriented Misuse Cases
Towards Security Risk-oriented Misuse Cases Inam Soomro and Naved Ahmed Institute of Computer Science, University of Tartu J. Liivi 2, 50409 Tartu, Estonia {inam, naved}@ut.ee Abstract. Security has turn
USB Portable Storage Device: Security Problem Definition Summary
USB Portable Storage Device: Security Problem Definition Summary Introduction The USB Portable Storage Device (hereafter referred to as the device or the TOE ) is a portable storage device that provides
Cryptography and Network Security
Cryptography and Network Security Third Edition by William Stallings Lecture slides by Shinu Mathew John http://shinu.info/ Chapter 1 Introduction http://shinu.info/ 2 Background Information Security requirements
Get Confidence in Mission Security with IV&V Information Assurance
Get Confidence in Mission Security with IV&V Information Assurance September 10, 2014 Threat Landscape Regulatory Framework Life-cycles IV&V Rigor and Independence Threat Landscape Continuously evolving
FACT SHEET: Ransomware and HIPAA
FACT SHEET: Ransomware and HIPAA A recent U.S. Government interagency report indicates that, on average, there have been 4,000 daily ransomware attacks since early 2016 (a 300% increase over the 1,000
Computer and Network Security
Computer and Network Security R. E. Newman Computer & Information Sciences & Engineering University Of Florida Gainesville, Florida 32611-6120 nemo@cise.ufl.edu Introduction to Computer and Network Security
Software & Supply Chain Assurance: Mitigating Risks Attributable to Exploitable ICT / Software Products and Processes
Software & Supply Chain Assurance: Mitigating Risks Attributable to Exploitable ICT / Software Products and Processes Joe Jarzombek, PMP, CSSLP Director for Software & Supply Chain Assurance Stakeholder
Information Technology Security Evaluation Criteria. ITSEC Joint Interpretation Library (ITSEC JIL)
S Information Technology Security Evaluation Criteria ITSEC Joint Interpretation Library (ITSEC JIL) Version 2.0 November 1998 This document is paginated from i to vi and from 1 to 65 ITSEC Joint Interpretation
ANALYSIS OF SOFTWARE THREATS AND SOFTWARE SECURITY. Department of Computer Science & IT University of Jammu, Jammu
ANALYSIS OF SOFTWARE THREATS AND SOFTWARE SECURITY Dr. Deepshikha Jamwal Bhawana Sharma Research Scholar Research scholar jamwal.shivani@gmail.com bhawana32_mca@yahoo.co.in Department of Computer Science
SNAPcell Security Policy Document Version 1.7. Snapshield
SNAPcell Security Policy Document Version 1.7 Snapshield July 12, 2005 Copyright Snapshield 2005. May be reproduced only in its original entirety [without revision]. TABLE OF CONTENTS 1. MODULE OVERVIEW...3
Cryptography and Network Security Overview & Chapter 1. Network Security. Chapter 0 Reader s s Guide. Standards Organizations.
Cryptography and Network Security Overview & Chapter 1 Fifth Edition by William Stallings Lecture slides by Lawrie Brown (with edits by RHB) Chapter 0 Reader s s Guide The art of war teaches us to rely
Deriving a Trusted Mobile Identity from an Existing Credential
Deriving a Trusted Mobile Identity from an Existing Credential Exploring and applying real-world use cases for mobile derived credentials +1-888-690-2424 entrust.com Table of contents Approval of the mobile
Aegis Padlock for business
Aegis Padlock for business Problem: Securing private information is critical for individuals and mandatory for business. Mobile users need to protect their personal information from identity theft. Businesses
7. Public Key Cryptosystems and Digital Signatures, 8. Firewalls, 9. Intrusion detection systems, 10. Biometric Security Systems, 11.
Content 1.Introduction to Data and Network Security. 2. Why secure your Network 3. How Much security do you need, 4. Communication of network systems, 5. Topology security, 6. Cryptosystems and Symmetric
STANDARD. Risk Assessment. Supply Chain Risk Management: A Compilation of Best Practices
A S I S I N T E R N A T I O N A L Supply Chain Risk Management: Risk Assessment A Compilation of Best Practices ANSI/ASIS/RIMS SCRM.1-2014 RA.1-2015 STANDARD The worldwide leader in security standards
Mission Assurance and Security Services
Mission Assurance and Security Services Dan Galik, Chief Federation of Tax Administrators Computer Security Officer Conference March 2007 Security, privacy and emergency preparedness issues are front page
IDENTIFICATION OF BASIC MEASURABLE SECURITY COMPONENTS IN SOFTWARE INTENSIVE SYSTEMS
IDENTIFICATION OF BASIC MEASURABLE SECURITY COMPONENTS IN SOFTWARE INTENSIVE SYSTEMS Reijo M. Savola VTT Technical Research Centre of Finland P.O. Box 1100, 90571 Oulu, Finland ABSTRACT Appropriate information
More effective protection for your access control system with end-to-end security
More effective protection for your access control system with end-to-end security By Jeroen Harmsen The first article on end-to-end security appeared as long ago as 1981. The principle originated in ICT
Negative Risk. Risk Can Be Positive. The Importance of Project Risk Management
The Importance of Project Risk Management Project risk management is the art and science of identifying, analyzing, and responding to risk throughout the life of a project and in the best interests t of
REGULATIONS FOR THE SECURITY OF INTERNET BANKING
REGULATIONS FOR THE SECURITY OF INTERNET BANKING PAYMENT SYSTEMS DEPARTMENT STATE BANK OF PAKISTAN Table of Contents PREFACE... 3 DEFINITIONS... 4 1. SCOPE OF THE REGULATIONS... 6 2. INTERNET BANKING SECURITY
Joint Universities Computer Centre Limited ( JUCC ) Information Security Awareness Training- Session Three
Joint Universities Computer Centre Limited ( JUCC ) Information Security Awareness Training- Session Three Data Handling in University Information Classification and Handling Agenda Background People-Process-Technology
Information Technology Security Training Requirements APPENDIX A. Appendix A Learning Continuum A-1
APPENDIX A Appendix A Learning Continuum A-1 Appendix A Learning Continuum A-2 APPENDIX A LEARNING CONTINUUM E D U C A T I O N Information Technology Security Specialists and Professionals Education and
APPENDIX G ASP/SaaS SECURITY ASSESSMENT CHECKLIST
APPENDIX G ASP/SaaS SECURITY ASSESSMENT CHECKLIST Application Name: Vendor Name: Briefly describe the purpose of the application. Include an overview of the application architecture, and identify the data
Security Attack Testing (SAT) testing the security of information systems at design time $
Information Systems 32 (2007) 1166 1183 www.elsevier.com/locate/infosys Security Attack Testing (SAT) testing the security of information systems at design time $ Haralambos Mouratidis a,, Paolo Giorgini
On Security Evaluation Testing
On Security Evaluation Testing Kerstin Lemke-Rust Hochschule Bonn-Rhein-Sieg Workshop: Provable Security against Physical Attacks Lorentz Center, 19 Feb 2010 Kerstin Lemke-Rust (H BRS) On Security Evaluation
Pursuing Compliance with the FFIEC Guidance Risk Assessment 101 KPMG RISK ADVISORY SERVICES
Pursuing Compliance with the FFIEC Guidance Risk Assessment 101 KPMG RISK ADVISORY SERVICES Contents PART I An Increasing Threat: Identity Theft The FFIEC Response Risk Assessment Fundamentals The FFIEC
Security Levels for Web Authentication using Mobile Phones
Security Levels for Web Authentication using Mobile Phones Anna Vapen and Nahid Shahmehri Department of computer and information science Linköpings universitet, SE-58183 Linköping, Sweden {annva,nahsh}@ida.liu.se
The Road from Software Testing to Theorem Proving
The Road from Software Testing to Theorem Proving A Short Compendium of my Favorite Software Verification Techniques Frédéric Painchaud DRDC Valcartier / Robustness and Software Analysis Group December
REGISTER ME TODAY FOR INTERNET ACCESS
REGISTER ME TODAY FOR INTERNET ACCESS Kindly complete this form and sign where indicated then return to our office via fax: Fax: 416-348-8311 or 1-866-399-3651 You will be contacted vie e-mail when your
Australasian Information Security Evaluation Program
Australasian Information Security Evaluation Program Certification Report Certificate Number: 2010/66 10 Mar 2010 Version 1.0 Commonwealth of Australia 2010. Reproduction is authorised provided that the
Teaching Critical Thinking Skills to English for Academic Purposes Students
Teaching Critical Thinking Skills to English for Academic Purposes Students Agenda 1. What is critical thinking? 2. Critical thinking and culture 3. Critical thinking tasks, Bloom s Taxonomy 4. Structuring
ASIA/PAC AERONAUTICAL TELECOMMUNICATION NETWORK SECURITY GUIDANCE DOCUMENT
INTERNATIONAL CIVIL AVIATION ORGANIZATION ASIA AND PACIFIC OFFICE ASIA/PAC AERONAUTICAL TELECOMMUNICATION NETWORK SECURITY GUIDANCE DOCUMENT DRAFT Second Edition June 2010 3.4H - 1 TABLE OF CONTENTS 1.
TETRA Security for Poland
TETRA ASSOCIATION TETRA Security for Poland Brian Murgatroyd TETRA ASSOCIATION former Chairman Security and Fraud Prevention Group Warren Systems (SFPG) Independent Security Consultant brian@warrensystems.co.uk
Using Contactless Smart Cards for Secure Applications
Using Contactless Smart Cards for Secure Applications Classification: Public (Info Level 1) Document No.: LA-11-005d-en Edition: 2010 www.legic.com LEGIC Identsystems Ltd Binzackerstrasse 41, CH-8620 Wetzikon,
A Blueprint for Universal Trust Management Services
A Blueprint for Universal Trust Management Services Tomasz Kaszuba Krzysztof Rzadca Adam Wierzbicki Grzegorz Wierzowiecki Polish-Japanese Institute of Information Technology Warsaw, Poland adamw@pjwstk.edu.pl
ARCHITECTING HIGH-SECURITY SYSTEMS FOR MULTILATERAL COOPERATION
ARCHITECTING HIGH-SECURITY SYSTEMS FOR MULTILATERAL COOPERATION In cooperation with: Federal Office for Information Security Architecting high-security systems for multilateral cooperation Threats to critical
CSCI 454/554 Computer and Network Security. Topic 8.1 IPsec
CSCI 454/554 Computer and Network Security Topic 8.1 IPsec Outline IPsec Objectives IPsec architecture & concepts IPsec authentication header IPsec encapsulating security payload 2 IPsec Objectives Why
WHITE PAPER COMBATANT COMMAND (COCOM) NEXT-GENERATION SECURITY ARCHITECTURE USING NSA SUITE B
COMBATANT COMMAND () NEXT-GENERATION SECURITY ARCHITECTURE USING NSA SUITE B TABLE OF CONTENTS COMBATANT COMMAND () NEXT-GENERATION SECURITY ARCHITECTURE USING NSA SUITE B NSA COMMERCIAL SOLUTION FOR CLASSIFIED
PCI PA - DSS. Point ipos Implementation Guide. Version 1.01. VeriFone Vx820 using the Point ipos Payment Core
PCI PA - DSS Point ipos Implementation Guide VeriFone Vx820 using the Point ipos Payment Core Version 1.01 POINT TRANSACTION SYSTEMS AB Box 92031, 120 06 Stockholm, Tel. +46 8 566 287 00 www.point.se Page
Analyzing the Security Significance of System Requirements
Analyzing the Security Significance of System Requirements Donald G. Firesmith Software Engineering Institute dgf@sei.cmu.edu Abstract Safety and security are highly related concepts [1] [2] [3]. Both
Combining Security Risk Assessment and Security Testing based on Standards
Jürgen Großmann (FhG Fokus) Combining Security Risk Assessment and Security Testing based on Standards SASSI Workshop Berlin, 2015-09-16 1 Getting guidance that match! Source: https://www.flickr.com/photos/maerskline/8432240103/in/photostream/
CS 203 / NetSys 240. Network Security
CS 203 / NetSys 240 Network Security Winter 2015 http://sconce.ics.uci.edu/203-w15/ 1 Contact Information Instructor: Gene Tsudik Email: gene.tsudik *AT* uci.edu Phone: (949) 824-43410 use only as the
Corbin Del Carlo Director, National Leader PCI Services. October 5, 2015
PCI compliance: v3.1 Key Considerations Corbin Del Carlo Director, National Leader PCI Services October 5, 2015 Today s Presenter Corbin Del Carlo QSA, PA QSA Director, National Leader PCI Services Practice
VASCO Data Security International, Inc. DIGIPASS GO-7. FIPS 140-2 Non-Proprietary Cryptographic Module Security Policy
VASCO Data Security International, Inc. DIGIPASS GO-7 FIPS 140-2 Non-Proprietary Cryptographic Module Security Policy Security Level: 2 Version: 1.7 Date: August 12, 2015 Copyright VASCO Data Security
Risk Assessment and Security Testing Johannes Viehmann 2015 of Large Scale Networked Systems with RACOMAT
Risk Assessment and Security Testing Johannes Viehmann 2015 of Large Scale Networked Systems with RACOMAT Overview Risk Assessment and Security Testing of Large Scale Networked Systems with RACOMAT Table
Security/Privacy Models for "Internet of things": What should be studied from RFID schemes? Daisuke Moriyama and Shin ichiro Matsuo NICT, Japan
Security/Privacy Models for "Internet of things": What should be studied from RFID schemes? Daisuke Moriyama and Shin ichiro Matsuo NICT, Japan 1 Internet of Things (IoT) CASAGRAS defined that: A global
PCI PA - DSS. Point BKX Implementation Guide. Version 2.01. Atos Xenta, Atos Xenteo and Atos Yomani using the Point BKX Payment Core
PCI PA - DSS Point BKX Implementation Guide Atos Xenta, Atos Xenteo and Atos Yomani using the Point BKX Payment Core Version 2.01 POINT TRANSACTION SYSTEMS AB Box 92031, 120 06 Stockholm, Tel. +46 8 566
SECURITY IS EVERYONE S RESPONSIBILITY. Group Security. ATM Card Skimming and PIN Capturing Customer Awareness Guide
SECURITY IS EVERYONE S RESPONSIBILITY Group Security ATM Card Skimming and PIN Capturing Customer Awareness Guide What is ATM Card Skimming and PIN Capturing? ATM Skimming and Personal Identification Number
MF1 IC S50. 1. General description. Functional specification. 1.1 Contactless Energy and Data Transfer. 1.2 Anticollision. Energy
Rev. 5.2 15 January 2007 Product data sheet 001052 PUBLIC 1. General description NXP has developed the Mifare to be used in contactess smart cards according to ISO/IEC 14443A. The communication layer (
Security Failures in Smart Card Payment Systems: Tampering the Tamper-Proof
Security Failures in Smart Card Payment Systems: Tampering the Tamper-Proof Saar Drimer Steven J. Murdoch Ross Anderson www.cl.cam.ac.uk/users/{sd410,sjm217,rja14} Computer Laboratory www.torproject.org
Cybersecurity and Secure Authentication with SAP Single Sign-On
Solution in Detail SAP NetWeaver SAP Single Sign-On Cybersecurity and Secure Authentication with SAP Single Sign-On Table of Contents 3 Quick Facts 4 Remember One Password Only 6 Log In Once to Handle
PCI PA - DSS. Point XSA Implementation Guide. Atos Worldline Banksys XENTA SA. Version 1.00
PCI PA - DSS Point XSA Implementation Guide Atos Worldline Banksys XENTA SA Version 1.00 POINT TRANSACTION SYSTEMS AB Box 92031, 120 06 Stockholm, Tel. +46 8 566 287 00 www.point.se Page number 2 (16)
Applying Common Criteria to a cloud type payment service
1 Applying Common Criteria to a cloud type payment service Kenji Yamaya ECSEC Laboratory Inc. 2 Evaluation of a cloud system Tablet internet cloud Newly developed terminal products Mobile POS Smart Phone
chap18.wireless Network Security
SeoulTech UCS Lab 2015-1 st chap18.wireless Network Security JeongKyu Lee Email: jungkyu21@seoultech.ac.kr Table of Contents 18.1 Wireless Security 18.2 Mobile Device Security 18.3 IEEE 802.11 Wireless
Page 1 of 15. VISC Third Party Guideline
Page 1 of 15 VISC Third Party Guideline REVISION CONTROL Document Title: Author: File Reference: VISC Third Party Guidelines Andru Luvisi CSU Information Security Managing Third Parties policy Revision
A Holistic Approach to Security Attack Modeling and Analysis
A Holistic Approach to Security Attack Modeling and Analysis Tong Li 1, Jennifer Horkoff 2, Kristian Beckers 3, Elda Paja 1, and John Mylopoulos 1 1 University of Trento, Trento, Italy {tong.li,paja,jm}@unitn.it
Northrop Grumman M5 Network Security SCS Linux Kernel Cryptographic Services. FIPS Security Policy Version 2.42. www.northropgrumman.
Northrop Grumman M5 Network Security SCS Linux Kernel Cryptographic Services FIPS Security Policy Version 2.42 www.northropgrumman.com/m5/ SCS Linux Kernel Cryptographic Services Security Policy Version
How To Improve Your Profit From Sales
(APADS) in partnership with & Agenda Overview Current Situation The Services Benefits Experience Atos Predictive Analytics Data Services Overview What is APADS? The Atos Predictive Analytics Data Service
Initial Roadmap: Point-to-Point Encryption Technology and PCI DSS Compliance
Emerging Technology Whitepaper Initial Roadmap: Point-to-Point Encryption Technology and PCI DSS Compliance For Transmissions of Cardholder Data and Sensitive Authentication Data Program Guide Version
How to Drop your Anchor
How to Drop your Anchor Enabling Trust in Cloud-Based Services Andreas Curiger CTO Securosys SA DIGS DC Day, Sep 16, 2015 10:30-10:55 The Promising World of Cloud Computing Cloud computing offers network
CS 4803 Computer and Network Security
Network layers CS 4803 Computer and Network Security Application Transport Network Lower level Alexandra (Sasha) Boldyreva IPsec 1 2 Roughly Application layer: the communicating processes themselves and
SECURITY STORAGE MODEL OF DATA IN CLOUD Sonia Arora 1 Pawan Luthra 2 1,2 Department of Computer Science & Engineering, SBSSTC
SECURITY STORAGE MODEL OF DATA IN CLOUD Sonia Arora 1 Pawan Luthra 2 1,2 Department of Computer Science & Engineering, SBSSTC Ferozepur, Punjab, India Email: 1 soniaarora141@gmail.com, 2 pawanluthra81@gmail.com