Comprehensive security in data processing systems : the state of the art /

"UIUCDCS-R-75-725"

21st National Information Systems Security Conference : building the information security bridge to the 21st century : October 5-8, 1998, Hyatt Regency Crystal City, Arlington, Va.

Cover title.

18th National Information Systems Security Conference : October 10-13, 1995, Baltimore Convention Center, Baltimore, Maryland, proceedings, making security real /

Mode of access: Internet.

Employment and pay rolls in state unemployment compensation systems, 1938. Employment security memorandum no. 6. pt. 1-2.

Pt. 1. Introduction and charts. Pt. 2. Tables.

Information systems : agencies overlook security controls during development : report to the Chairman, Committee on Science, Space, and Technology, House of Representatives /

"B-229223"--p. [1]

Hearing to review the U.S. Department of Agriculture's release of program beneficiaries' social security numbers and the department's information systems, generally : hearing before the Committee on Agriculture, House of Representatives, One Hundred Tenth Congress, first session, May 2, 2007.

Shipping list no.: 2009-0305-P.

Considerations in the selection of security measures for automatic data processing systems /

"Contributed to the Federal Information Processing Standards Task Group 15 - Computer Systems Security" -t.p.

Cryptographic techniques for personal communication systems security

The advent of personal communication systems within the last decade has depended upon the utilization of advanced digital schemes for source and channel coding and for modulation. The inherent digital nature of the communications processing has allowed the convenient incorporation of cryptographic techniques to implement security in these communications systems. There are various security requirements, of both the service provider and the mobile subscriber, which may be provided for in a personal communications system. Such security provisions include the privacy of user data, the authentication of communicating parties, the provision for data integrity, and the provision for both location confidentiality and party anonymity. This thesis is concerned with an investigation of the private-key and public-key cryptographic techniques pertinent to the security requirements of personal communication systems and an analysis of the security provisions of Second-Generation personal communication systems is presented. Particular attention has been paid to the properties of the cryptographic protocols which have been employed in current Second-Generation systems. It has been found that certain security-related protocols implemented in the Second-Generation systems have specific weaknesses. A theoretical evaluation of these protocols has been performed using formal analysis techniques and certain assumptions made during the development of the systems are shown to contribute to the security weaknesses. Various attack scenarios which exploit these protocol weaknesses are presented. The Fiat-Sharmir zero-knowledge cryptosystem is presented as an example of how asymmetric algorithm cryptography may be employed as part of an improved security solution. Various modifications to this cryptosystem have been evaluated and their critical parameters are shown to be capable of being optimized to suit a particular applications. The implementation of such a system using current smart card technology has been evaluated.

Verification and Application of Conceptual Model and Security Requirements on Practical DRM Systems in E-Learning

The paper represents a verification of a previously developed conceptual model of security related processes in DRM implementation. The applicability of established security requirements in practice is checked as well by comparing these requirements to four real DRM implementations (Microsoft Media DRM, Apple's iTunes, SunnComm Technologies’s MediaMax DRM and First4Internet’s XCP DRM). The exploited weaknesses of these systems resulting from the violation of specific security requirements are explained and the possibilities to avoid the attacks by implementing the requirements in designing step are discussed.

STPA-SafeSec: Safety and Security Analysis for Cyber-Physical Systems

Cyber-physical systems tightly integrate physical processes and information and communication technologies. As today’s critical infrastructures, e.g., the power grid or water distribution networks, are complex cyber-physical systems, ensuring their safety and security becomes of paramount importance. Traditional safety analysis methods, such as HAZOP, are ill-suited to assess these systems. Furthermore, cybersecurity vulnerabilities are often not considered critical, because their effects on the physical processes are not fully understood. In this work, we present STPA-SafeSec, a novel analysis methodology for both safety and security. Its results show the dependencies between cybersecurity vulnerabilities and system safety. Using this information, the most effective mitigation strategies to ensure safety and security of the system can be readily identified. We apply STPA-SafeSec to a use case in the power grid domain, and highlight its benefits.