Modelling Security in UML/OCL for C2IS
|
|
|
- Lewis Wade
- 6 years ago
- Views:
Transcription
1 Modelling Security in UML/OCL for C2IS Robert Charpentier & Martin Salois R et D pour la défense Canada Defence R&D Canada Canada
2 Plan Motivation & Objectives Software Certification Techniques Modelling Security in UML and OCL Summary and Perspectives Defence R&D Canada Valcartier # 2
3 Motivations for High-Confidence Software Increasing numbers of critical infrastructures: Banking, medical instruments, emergency services, power distribution, telecommunications, transportation, government archives, etc Real-time and embedded systems: Pacemakers, power plants, avionics, cellular phones, etc Shielding C2IS against attacks and subversive exploits Defence R&D Canada Valcartier # 3
4 Impact of Unreliable Software Inadequate software testing is currently estimated to cost the US between 22 and 60 billion dollars ± 50 % due to development and design flaws ± 50 % due to user behaviour Ref : - The economic Impacts of Inadequate Infrastructure for Software Testing RTI Planning Report 02-3 for NIST and DOC, May Standish Group estimate is 200 billion dollars Defence R&D Canada Valcartier # 4
5 Quantitative Assessment 45 e-business applications analyzed 10 types of defects studied Business Impact (1-5) x Risk of Exploit (1-5) = Business Risk (1-25) Best Quartile scored 4.8 / 25 Worst Quartile scored 23.0 / % of defects were associated with design flaws 47 % of defects were exploitable Ref : Jaquith A, The security of Applications; Not All Are created Equal, Research February Defence R&D Canada Valcartier # 5
6 Impact of Unreliable C2IS Failure of an important mission Significant loss or damage to property Serious environmental damage Injury or illness Loss of life Ref : Rodrique J. P., Market Study Critical Software Certification, GeoAlliance International, May 2003 Defence R&D Canada Valcartier # 6
7 Long Term Vision Craig Mundie (Microsoft) has bet Eric Schmidt (Google) : by 2030, passengers will routinely board commercial airline flights without a pilot flights will be flown entirely by computers! Ref : Wired Magazine May 2002 Defence R&D Canada Valcartier # 7
8 High-Confidence Software -- R&D Reliability and Security enforcement tools MaliCOTS ( ) SOCLe ( ) Modelling Security PoliSEC (~ ) CompoSEC (~ ) Defence R&D Canada Valcartier # 8
9 Software Attacks: Threat and Consequences 1. Survey of exploitations 2. Hacker community 3. Countries and other organisations 4. Consequences of software vulnerabilities 5. Conclusion 6. Bibliography of 121 references 7. Insider threat assessment 8. Cracking tools survey, and more Ref : Salois M. «Software Attacks: Threat and Consequences», DREV ECR , presented at the WP-11 Quadripartite Annual Conference on Information Technologies, Fall 2002, Unclassified or Classified versions Defence R&D Canada Valcartier # 9
10 Wide Spectrum Reliability & Security Policy Narrow Spectrum.mdl UML.src Java.obj bytecode.exe x86.mem Monitor CPU x86 Defence R&D Canada Valcartier # 10
11 Defence R&D Canada Valcartier # 11
12 Monitoring at Runtime PROS : Exploits the knowledge that can be gained by running the program Best technique for user surveillance Acceptable for software vendors CONS : Significant overhead in run-time performance Infinite number of possibilities and conditions Too much information to manage Defence R&D Canada Valcartier # 12
13 Wide Spectrum Reliability & Security Policy Narrow Spectrum stat.mdl UML.src Java.obj bytecode.exe x86.mem Monitor CPU x86 Defence R&D Canada Valcartier # 13
14 Defence R&D Canada Valcartier # 14
15 Defence R&D Canada Valcartier # 15
16 Defence R&D Canada Valcartier # 16
17 Defence R&D Canada Valcartier # 17
18 Defence R&D Canada Valcartier # 18
19 Defence R&D Canada Valcartier # 19
20 Static Analysis PROS: Ideal pre-filter for the monitoring Analysis of program behaviours over all possible execution paths Analyze once, execute everywhere CONS: Undecidability of many interesting properties Hard on binary executables Illegal on most COTS software Defence R&D Canada Valcartier # 20
21 Increasing Complexity Lines of code Win million Win NT million Win million Win NT million Win million Win million Ref: M. Sues, M. Gingras, Secure Programming and Development Practices, Cinnabar Networks, CITSS Symposium, June 2001 Defence R&D Canada Valcartier # 21
22 Software Certification Techniques Static analysis of code Dynamic monitoring of execution Certifying compiler technology Defence R&D Canada Valcartier # 22
23 Wide Spectrum Reliability & Security Policy Narrow Spectrum comp link stat.mdl UML.src Java.obj bytecode.exe x86.mem Monitor CPU x86 Defence R&D Canada Valcartier # 23
24 Two-step Certification Security Policy Critical System S o u r c e Annotating Compiler.asm annot Sec Linker or Verifier.exe Compiler exe exe exe Defence R&D Canada Valcartier # 24
25 Defence R&D Canada Valcartier # 25
26 Defence R&D Canada Valcartier # 26
27 Editor's World User's World SEC Policy SEC Policy SEC Manager Vendor s Software Certifying Compiler Critical System In-house Software.exe Compiler exe exe exe A Open-Source Software Defence R&D Canada Valcartier # 27
28 Certifying compiler PROS: Large COTS certification --- rapidly Detailed and exhaustive enforcement Protect IP Execution not slower Enforcement of security, maintainability, interoperability (...) specs CONS: Emerging technology May need support from the monitor for full enforcement Defence R&D Canada Valcartier # 28
29 Research Outcomes --- MaliCOTS project Market survey MaliCOTS prototypes: SamCOTS --- Static Code Analyser DaMon --- Runtime Monitor TalCC --- ANSI C Certifying Compiler JACC --- Java Certifying Compiler SPCheck --- Security Policy Checker Lots of publications Defence R&D Canada Valcartier # 29
30 Defence R&D Canada Valcartier # 30
31 Conclusion form the MaliCOTS Project Security must be clearly defined by a policy to be manageable Static and dynamic approaches combined in a test-bed: offers a short-term solution may be lengthy and cumbersome processes Certifying compilers: emerging technology for large COTS certification --- rapidly capabilities confirmed by MaliCOTS prototypes Defence R&D Canada Valcartier # 31
32 SOCLe project: Secure OCL expressions for C2IS Modelling Socle is defined by Webster s as: the base of a column, pedestal or a superstructure Defence R&D Canada Valcartier # 32
33 Wide Spectrum Reliability & Security Policy Narrow Spectrum gen comp link stat OCL.mdl UML.src Java.obj bytecode.exe x86.mem Monitor CPU x86 Defence R&D Canada Valcartier # 33
34 UML and OCL UML is the de-facto standard software notation UML v 2 is its final approval stage at the OMG Used for C2IS and other Government critical systems OCL is a complementary constraint language To formulate pre/post conditions and invariants To eliminate ambiguities in software design UML: Unified Modeling Language OCL: Object Constraint Language OMG: Object Management Group Defence R&D Canada Valcartier # 34
35 OCL: a Good Technology OCL improves quality U. Laval (1997) OCL improves greatly software quality Nurun (1999) 10% to 15% additional effort in C2IS design Can be used for security SecureSoft (2001) OCL has the expressivity for security SecureSoft (2001) Constraints can be imposed on user s behaviour UML/OCL can be formalized to a large extent Poly-MTL (2002) OCL is evolving in UML v 2 Poly-MTL (2002) - Model-checking OCL Constraints is feasible Defence R&D Canada Valcartier # 35
36 Secure OCL Demonstration ( ) Design C2IS in the usual way : State-chart, class diagrams, collaboration diagram, etc + OCL constraints for reliability and security OCL checker constructs an underlying model Formally verified by «hidden» model-checking for coherence and completeness Transparent to the designer Detailed risk management delegated to appropriate certification engines Defence R&D Canada Valcartier # 36
37 Technical Conclusions Software certification from design to binary Via multiple certification engines specialized and activated on request Integration of security policy in design Better understanding of security constraints Assignment of responsibilities to the best engine Progressive security enforcement Defence R&D Canada Valcartier # 37
38 Defensive Software Design & Programming Dependence on software steadily increasing Software quality is good to very good but inadequate for C2IS and other critical systems C2IS reliability & security from methodologies ( ) to certification ( ) Defence R&D Canada Valcartier # 38
39 Defence R&D Canada Valcartier # 39
Security Modelling for C2IS in UML/OCL
8 th ICCRTS 17 19 June 2003, Washington DC Track 7: Information Superiority/ Information Operations Security Modelling for C2IS in UML/OCL Robert Charpentier (418) 844-4000 x 4371 robert.charpentier@drdc-rddc.gc.ca
Expression des Besoins et Identification des Objectifs de Sécurité
PREMIER MINISTRE Secrétariat général de la défense nationale Direction centrale de la sécurité des systèmes d information Sous-direction des opérations Bureau conseil Expression des Besoins et Identification
UNCLASSIFIED R-1 ITEM NOMENCLATURE FY 2013 OCO
Exhibit R-2, RDT&E Budget Item Justification: PB 2013 Office of Secretary Of Defense DATE: February 2012 0400: Research,, Test & Evaluation, Defense-Wide BA 3: Advanced Technology (ATD) COST ($ in Millions)
Defence Research and Development Canada. Cyber surveillance of information systems
Defence Research and Development Canada Cyber surveillance of information systems Results from the current DRDC project, and way-ahead (Tutorial/workshop) Mario Couture DRDC Valcartier (SoS/SAR) March
NATIONAL GUIDELINES ON CLOUD COMPUTING FOR GOVERNMENT, MINISTRIES, DEPARTMENTS AND AGENCIES
NATIONAL GUIDELINES ON CLOUD COMPUTING FOR GOVERNMENT, MINISTRIES, DEPARTMENTS AND AGENCIES DOCUMENT DETAIL Security Classification Unclassified Authority National Information Technology Authority - Uganda
Defence Research and Development Canada. Online cyber surveillance of information systems. Overview of current and next DRDC projects
Defence Research and Development Canada Online cyber surveillance of information systems Overview of current and next DRDC projects Mario Couture Defence R&D Canada (DRDC Valcartier) August 30 th, 2011
UNCLASSIFIED. FY 2016 Base FY 2016 OCO
Exhibit R-2, RDT&E Budget Item Justification: PB 2016 Office of the Secretary Of Defense Date: February 2015 0400: Research, Development, Test & Evaluation, Defense-Wide / BA 2: COST ($ in Millions) Prior
White Paper. View cyber and mission-critical data in one dashboard
View cyber and mission-critical data in one dashboard Table of contents Rising cyber events 2 Mitigating threats 2 Heighten awareness 3 Evolving the solution 5 One of the direct benefits of the Homeland
An Introduction to Runtime Application Self-Protection (RASP)
Product Analysis June 2016 An Introduction to Runtime Application Self-Protection (RASP) The Transformational Application Security Technology that Improves Protection and Operations Highly accurate. Easy
Robert Hayes Senior Director Microsoft Global Cyber Security & Data Protection Group
Robert Hayes Senior Director Microsoft Global Cyber Security & Data Protection Group Presentation Objectives Introductions Cyber security context Cyber security in the maritime sector Developing cybersecurity
Cybersecurity, safety and resilience - Airline perspective
Arab Civil Aviation Commission - ACAC/ICAO MID GNSS Workshop Cybersecurity, safety and resilience - Airline perspective Rabat, November, 2017 Presented by Adlen LOUKIL, Ph.D CEO, Resys-consultants Advisory,
Don t Be the Developer Whose Rocket Crashes on Lift off LDRA Ltd
Don t Be the Developer Whose Rocket Crashes on Lift off 2015 LDRA Ltd Cost of Software Defects Consider the European Space Agency s Ariane 5 flight 501 on Tuesday, June 4 1996 Due to an error in the software
10 Cybersecurity Questions for Bank CEOs and the Board of Directors
4 th Annual UBA Bank Executive Winter Conference February, 2015 10 Cybersecurity Questions for Bank CEOs and the Board of Directors Dr. Kevin Streff Founder, Secure Banking Solutions 1 Board of Directors
ITU Asia-Pacific Centres of Excellence Training on Conformity and Interoperability. Session 2: Conformity Assessment Principles
ITU Asia-Pacific Centres of Excellence Training on Conformity and Interoperability Session 2: Conformity Assessment Principles 12-16 October 2015 Beijing, China Keith Mainwaring ITU Expert Agenda 1. Context
Cybersecurity & Risks Analysis
Working Together to Build Confidence Cybersecurity & Risks Analysis Djenana Campara Chief Executive Officer Member, Object Management Group Board of Directors Co-Chair, System Assurance Task Force Cyber
New York Department of Financial Services Cybersecurity Regulation Compliance and Certification Deadlines
New York Department of Financial Services Cybersecurity Regulation Compliance and Certification Deadlines New York Department of Financial Services ( DFS ) Regulation 23 NYCRR 500 requires that entities
Emerging Issues: Cybersecurity. Directors College 2015
Emerging Issues: Cybersecurity Directors College 2015 Agenda/Objectives Define Cybersecurity Cyber Fraud Trends/Incidents FFIEC Cybersecurity awareness initiatives Community Bank expectations FFIEC Cybersecurity
Certification Requirements for High Assurance Systems
for High Assurance Systems Gordon M. Uchenick Senior Mentor/Principal Engineer Objective Interface Systems, Inc. and W. Mark Vanfleet Senior Cryptologic Mathematician/ Senior INFOSEC Analyst National Security
Campus IT Modernization OPERATIONAL CONTINUITY FLEXIBLE TECHNOLOGY MODERNIZED SYSTEMS
Campus IT Modernization OPERATIONAL CONTINUITY FLEXIBLE TECHNOLOGY MODERNIZED SYSTEMS Managing the Complexity of IT Modernization Constructing and modernizing a new campus is a complex undertaking, requiring
NATIONAL DEFENSE INDUSTRIAL ASSOCIATION Homeland Security Symposium
NATIONAL DEFENSE INDUSTRIAL ASSOCIATION Homeland Security Symposium Securing Cyber Space & America s Cyber Assets: Threats, Strategies & Opportunities September 10, 2009, Crystal Gateway Marriott, Arlington,
An Operational Cyber Security Perspective on Emerging Challenges. Michael Misumi CIO Johns Hopkins University Applied Physics Lab (JHU/APL)
An Operational Cyber Security Perspective on Emerging Challenges Michael Misumi CIO Johns Hopkins University Applied Physics Lab (JHU/APL) Johns Hopkins University Applied Physics Lab (JHU/APL) University
Preemptive PREventivE Methodology and Tools to protect utilities
Preemptive PREventivE Methodology and Tools to protect utilities 2014 2017 With the financial support of FP7 Seventh Framework Programme Grant agreement no: 607093 1 Preemptive description Project objectives
CIS 895 agenttool III (Static) Project Plan Version 2.0. Project Plan. For agenttool III (Static) Version 2.0
Project Plan For agenttool III (Static) Version 2.0 Submitted in partial fulfillment of the requirements of the degree of MSE Deepti Gupta CIS 895 MSE Project Kansas State University Page 1 of 9 TABLE
Critical Information Infrastructure Protection Law
Critical Information Infrastructure Protection Law CCD COE Training 8 September 2009 Tallinn, Estonia Maeve Dion Center for Infrastructure Protection George Mason University School of Law Arlington, Virginia.
Risk: Security s New Compliance. Torsten George VP Worldwide Marketing and Products, Agiliance Professional Strategies - S23
Risk: Security s New Compliance Torsten George VP Worldwide Marketing and Products, Agiliance Professional Strategies - S23 Agenda Market Dynamics Organizational Challenges Risk: Security s New Compliance
Introduction of the Industrial Internet Consortium. May 2016
Introduction of the Industrial Internet Consortium May 2016 An Open Membership Consortium now 250 companies strong May 26, 2016 2 IIC Founders, Contributing Members, & Large Industry Members IIC Founding
Conformity Assessment Schemes and Interoperability Testing (1) Keith Mainwaring ITU Telecommunication Standardization Bureau (TSB) Consultant
Conformity Assessment Schemes and Interoperability Testing (1) Keith Mainwaring ITU Standardization Bureau (TSB) Consultant Moscow, 9-11 november 2011 Contents The benefits of conformity assessment Conformity
Courses. X E - Verify that system acquisitions policies and procedures include assessment of risk management policies X X
4016 Points * = Can include a summary justification for that section. FUNCTION 1 - INFORMATION SYSTEM LIFE CYCLE ACTIVITIES Life Cycle Duties No Subsection 2. System Disposition/Reutilization *E - Discuss
Ontology- and Bayesian- based Information Security Risk Management
Ontology- and Bayesian- based Information Security Risk Management Stefan Fenz sfenz@securit 4 th ETSI Security Workshop 13 14 January 2009 ETSI, Sophia Antipolis, France Motivation Almost every business
Position Description. Computer Network Defence (CND) Analyst. GCSB mission and values. Our mission. Our values UNCLASSIFIED
Position Description Computer Network Defence (CND) Analyst Position purpose: Directorate overview: The CND Analyst seeks to discover, analyse and report on sophisticated computer network exploitation
Security by Default: Enabling Transformation Through Cyber Resilience
Security by Default: Enabling Transformation Through Cyber Resilience FIVE Steps TO Better Security Hygiene Solution Guide Introduction Government is undergoing a transformation. The global economic condition,
Certification Report
Certification Report Security Intelligence Platform 4.0.5 Issued by: Communications Security Establishment Certification Body Canadian Common Criteria Evaluation and Certification Scheme Government of
SAMPLE REPORT. Business Continuity Gap Analysis Report. Prepared for XYZ Business by CSC Business Continuity Services Date: xx/xx/xxxx
SAMPLE REPORT Business Continuity Gap Analysis Report Prepared for XYZ Business by CSC Business Continuity Services Date: xx/xx/xxxx COMMERCIAL-IN-CONFIDENCE PAGE 1 OF 11 Contact Details CSC Contacts CSC
Third public workshop of the Amsterdam Group and CODECS European Framework for C-ITS Deployment
Third public workshop of the Amsterdam Group and CODECS European Framework for C-ITS Deployment 14 February 2017 Amsterdam Gerhard Menzel European Commission - DG MOVE EU Policy Tools Large-scale deployment
COMPUTER SECURITY DESIGN METHODOLOGY FOR NUCLEAR FACILITY & PHYSICAL PROTECTION SYSTEMS
NUCLEAR REGULATORY AUTHORITY, GHANA COMPUTER SECURITY DESIGN METHODOLOGY FOR NUCLEAR FACILITY & PHYSICAL PROTECTION SYSTEMS Nelson K. Agbemava ICT and Computer Security Section Head Instrumentation & ICT
AFCEA Welcome/Opening Keynote Speech. Murad Bayar, Undersecretary for Defense Industries, MoND, Turkey
AFCEA Welcome/Opening Keynote Speech Murad Bayar, Undersecretary for Defense Industries, MoND, Turkey A Turkish Perspective on the Challenges of Security in a Network-Enabled Environment I would like to
Computation Independent Model (CIM): Platform Independent Model (PIM): Platform Specific Model (PSM): Implementation Specific Model (ISM):
viii Preface The software industry has evolved to tackle new approaches aligned with the Internet, object-orientation, distributed components and new platforms. However, the majority of the large information
Combating Cyber Risk in the Supply Chain
SESSION ID: CIN-W10 Combating Cyber Risk in the Supply Chain Ashok Sankar Senior Director Cyber Strategy Raytheon Websense @ashoksankar Introduction The velocity of data breaches is accelerating at an
13th Florence Rail Forum: Cyber Security in Railways Systems. Immacolata Lamberti Andrea Pepato
13th Florence Rail Forum: Cyber Security in Railways Systems Immacolata Lamberti Andrea Pepato November 25, 2016 Cyber Security context and Cyber Attacks trend Critical Infrastructures (CIs) are both physical
Cyber Attacks & Breaches It s not if, it s When
` Cyber Attacks & Breaches It s not if, it s When IMRI Team Aliso Viejo, CA Trusted Leader with Solution Oriented Results Since 1992 Data Center/Cloud Computing/Consolidation/Operations 15 facilities,
National Cybersecurity Center of Excellence
National Cybersecurity Center of Excellence Increasing the deployment and use of standards-based security technologies Briefing to ITEA Cyber Workshop 29 March 2017 STRATEGY VISION ADVANCE CYBERSECURITY
Improving SCADA System Security
Improving SCADA System Security NPCC 2004 General Meeting Robert W. Hoffman Manager, Cyber Security Research Department Infrastructure Assurance and Defense Systems National Security Division, INEEL September
Easy Incorporation of OPTIGA TPMs to Support Mission-Critical Applications
Infineon Network Use Case Easy Incorporation of OPTIGA TPMs to Support Mission-Critical Applications Providing Infineon customers with an easy path to integrating TPM support into their products and systems
UNCLASSIFIED R-1 ITEM NOMENCLATURE FY 2013 OCO
Exhibit R-2, RDT&E Budget Item Justification: PB 2013 Office of Secretary Of Defense DATE: February 2012 COST ($ in Millions) FY 2011 FY 2012 Base OCO Total FY 2014 FY 2015 FY 2016 FY 2017 Cost To Complete
An Introduction to the Waratek Application Security Platform
Product Analysis January 2017 An Introduction to the Waratek Application Security Platform The Transformational Application Security Technology that Improves Protection and Operations Highly accurate.
GLobal Action on CYbercrime (GLACY) Assessing the Threat of Cybercrime in Mauritius
GLobal Action on CYbercrime (GLACY) Assessing the Threat of Cybercrime in Mauritius Presented By Mrs K.Gunesh-Balaghee,, Assistant Solicitor General Mr M.Armmogum,, Ag Senior State Counsel Mrs B.Kissoon-Luckputtya,
Secure Development Lifecycle
Secure Development Lifecycle Strengthening Cisco Products The Cisco Secure Development Lifecycle (SDL) is a repeatable and measurable process designed to increase Cisco product resiliency and trustworthiness.
CIS 890: Safety-Critical Systems
CIS 890: Safety-Critical Systems Fall 2007 Lecture 1: Application Areas and SPARK Demo Copyright 2007, John Hatcliff. The syllabus and all lectures for this course are copyrighted materials and may not
How to implement NIST Cybersecurity Framework using ISO WHITE PAPER. Copyright 2017 Advisera Expert Solutions Ltd. All rights reserved.
How to implement NIST Cybersecurity Framework using ISO 27001 WHITE PAPER Copyright 2017 Advisera Expert Solutions Ltd. All rights reserved. Copyright 2017 Advisera Expert Solutions Ltd. All rights reserved.
Securing the End Node in a Cloud World
Securing the End Node in a Cloud World Approved for Public Release: RY-11-0022, 88 ABW-11-0375 Lt Col Ken Edge, PhD Electronic & Net-Centric Warfare Division Air Force Research Laboratory Of Clouds and
Protecting Information Assets - Week 3 - Data Classification Processes and Models. MIS 5206 Protecting Information Assets
Protecting Information Assets - Week 3 - Data Classification Processes and Models Readings In the News MIS5206 Week 3 Data Classification Processes and Models Test Taking Tip Quiz Readings Vacca Chapter
Organizational Readiness for Digital Transformation
IVI Community Event Organizational Readiness for Digital Transformation Dr. Marian Carcary June 22nd 2017 Introduction Digital business transformation goes beyond traditional process optimization, to leveraging
Detecting breach. There are only two types of organisations in the world... Terry Greer-King Director, Cyber security, UK & Africa May 2017
Feeling lucky? Detecting breach There are only two types of organisations in the world... Terry Greer-King Director, Cyber security, UK & Africa May 2017 Industry average is 100 days to detect a breach,
Sustainable Security Operations
Sustainable Security Operations Optimize processes and tools to make the most of your team s time and talent The number and types of security incidents organizations face daily are steadily increasing,
SECURING THE UK S DIGITAL PROSPERITY. Enabling the joint delivery of the National Cyber Security Strategy's objectives
SECURING THE UK S DIGITAL PROSPERITY Enabling the joint delivery of the National Cyber Security Strategy's objectives 02 November 2016 2 SECURING THE UK S DIGITAL PROSPERITY SECURING THE UK S DIGITAL PROSPERITY
Fiscal 2015 Activities Review and Plan for Fiscal 2016
Fiscal 2015 Activities Review and 1. The Ricoh Group s Information Security Activities In response to changes emerging in the social environment, the Ricoh Group is promoting its PDCA management system
La gestione di Security e Safety con un singolo sistema di supporto alle decisioni Baltimore/Washington Airport - USA
La gestione di Security e Safety con un singolo sistema di supporto alle decisioni Baltimore/Washington Airport - USA Filippo Silvestri Sales Manager PS&S Intergraph Italia Security Government & Infrastructure
STUDENT LEARNING OUTCOMES Beacom College of Computer and Cyber Sciences
STUDENT LEARNING OUTCOMES Beacom College of Computer and Cyber Sciences Undergraduate Programs - Bachelor B.S. Computer Game Design Upon completion of the B.S. degree in Computer Game Design, students
Summary of the ATN/OSI Doc Security Validation Report
International Civil Aviation Organization WORKING PAPER ACP-WGM16/WP-09 17 May 2010 AERONAUTICAL COMMUNICATIONS PANEL (ACP) 16h MEETING OF WORKING GROUP M Paris, France 17-19 May 2010 Agenda Item 3a: ATN/OSI
Federation of Tax Administrators Conference Minneapolis, Minnesota September 26, 2001
Federation of Tax Administrators Conference Minneapolis, Minnesota September 26, 2001 Measurement Framework Measurement Activities Overview н Present, Future & Unfunded Lessons Learned Opportunities to
Improving Internet of Things Device Certification with Policy Based Management
Improving Internet of Things Device Certification with Policy Based Management Gianmarco Baldini European Commission DG.JRC.E3 Gianmarco.Baldini@ec.europa.eu 1 IoT Security In beginning of 2015, US Federal
Presenter Jakob Drescher. Industry. Measures used to protect assets against computer threats. Covers both intentional and unintentional attacks.
Presenter Jakob Drescher Industry Cyber Security 1 Cyber Security? Measures used to protect assets against computer threats. Covers both intentional and unintentional attacks. Malware or network traffic
Software Engineering with Objects and Components Open Issues and Course Summary
Software Engineering with Objects and Components Open Issues and Course Summary Massimo Felici Software Engineering with Objects and Components Software development process Lifecycle models and main stages
Using the NIST Framework for Metrics 5/14/2015
Using the NIST Framework for Metrics 5/14/2015 ITD - Public Safety Safety improvements reduced total crashes by 29% and injury crashes by 41% in corridors after GARVEE projects were completed Ads / Commercials
Final Project Report. Abstract. Document information
Final Project Report Document information Project Title SWIM security solutions Project Number 14.02.02 Project Manager THALES Deliverable Name Final Project Report Deliverable ID D01 Edition 00.01.00
Integrated Consortium of Laboratory Networks (ICLN) Brief to the NPDN National Meeting
Integrated Consortium of Laboratory Networks (ICLN) Brief to the NPDN National Meeting January 30, 2007 1 Agenda ICLN Background Information Network Coordinating Group Accomplishments Responsible Federal
Cyber risk management into the ISM Code
Building trust. Shaping Safety No. Subject: Cyber risk management into the ISM Code To: insb auditors/managing companies IMO Resolution incorporates maritime cyber risk management into the ISM Code making
A Cross-Sector Perspective on Product Cyber Security
A Cross-Sector Perspective on Product Cyber Security Dr Robert Oates Software Centre of Excellence, Rolls-Royce plc 2016 Rolls-Royce plc The information in this document is the property of Rolls-Royce
ASSURING DATA INTEROPERABILITY THROUGH THE USE OF FORMAL MODELS OF VISA PAYMENT MESSAGES (Category: Practice-Oriented Paper)
ASSURING DATA INTEROPERABILITY THROUGH THE USE OF FORMAL MODELS OF VISA PAYMENT MESSAGES (Category: Practice-Oriented Paper) Joseph Bugajski Visa International JBugajsk@visa.com Philippe De Smedt Visa
UNCLASSIFIED. R-1 ITEM NOMENCLATURE PE D8Z: Data to Decisions Advanced Technology FY 2012 OCO
Exhibit R-2, RDT&E Budget Item Justification: PB 2012 Office of Secretary Of Defense DATE: February 2011 BA 3: Advanced Development (ATD) COST ($ in Millions) FY 2010 FY 2011 Base OCO Total FY 2013 FY
GRIDS INTRODUCTION TO GRID INFRASTRUCTURES. Fabrizio Gagliardi
GRIDS INTRODUCTION TO GRID INFRASTRUCTURES Fabrizio Gagliardi Dr. Fabrizio Gagliardi is the leader of the EU DataGrid project and designated director of the proposed EGEE (Enabling Grids for E-science
How Boards use the NIST Cybersecurity Framework as a Roadmap to oversee cybersecurity
How Boards use the NIST Cybersecurity Framework as a Roadmap to oversee cybersecurity Why is the NIST framework important? GOH Seow Hiong Executive Director, Global Policy & Government Affairs, Asia Pacific
ENTERPRISE ENDPOINT PROTECTION BUYER S GUIDE
ENTERPRISE ENDPOINT PROTECTION BUYER S GUIDE TABLE OF CONTENTS Overview...3 A Multi-Layer Approach to Endpoint Security...4 Known Attack Detection...5 Machine Learning...6 Behavioral Analysis...7 Exploit
Cyber Security Technologies
1 / Cyber Security Technologies International Seminar on Cyber Security: An Action to Establish the National Cyber Security Center Lisbon, 12 th September 2013 23 / Key highlights - Thales Group Thales
Chapter X Security Performance Metrics
Chapter X Security Performance Metrics Page 1 of 10 Chapter X Security Performance Metrics Background For many years now, NERC and the electricity industry have taken actions to address cyber and physical
STANDARD INFORMATION SHARING FORMATS. Will Semple Head of Threat and Vulnerability Management New York Stock Exchange
STANDARD INFORMATION SHARING FORMATS Will Semple Head of Threat and Vulnerability Management New York Stock Exchange AGENDA Information Sharing from the Practitioner s view Changing the focus from Risk
Advanced Security Tester Course Outline
Advanced Security Tester Course Outline General Description This course provides test engineers with advanced skills in security test analysis, design, and execution. In a hands-on, interactive fashion,
By Derrick H. Karimi Member of the Technical Staff Emerging Technology Center. Open Architectures in the Defense Intelligence Community
Open Architectures in the Defense Intelligence Community By Derrick H. Karimi Member of the Technical Staff Emerging Technology Center This blog post is co-authored by Eric Werner. In an era of sequestration
Understanding the Changing Cybersecurity Problem
Understanding the Changing Cybersecurity Problem Keith Price BBus, MSc, CGEIT, CISM, CISSP Founder & Principal Consultant 1 About About me - Specialise in information security strategy, architecture, and
Institute of Internal Auditors 2019 CONNECT WITH THE IIA CHICAGO #IIACHI
Institute of Internal Auditors 2019 CONNECT WITH THE IIA CHICAGO CHAPTER: @IIACHI #IIACHI WWW.FACEBOOK.COM/IIACHICAGO HTTPS://WWW.LINKEDIN.COM/GROUPS/1123977 1 CAE Communications and Common Audit Committee
Model Driven Architecture
Name: Anish Mehta Year: 3 Lecturer: Dr. Wolfgang Emmerich Supervisor: Dr. Graham Roberts Model Driven Architecture For many years architects have been designing buildings by looking at other architects
Professor Robert Clark Chief Defence Scientist & Chief Executive Officer
Professor Robert Clark Chief Defence Scientist & Chief Executive Officer Defence Science & Technology Organisation Department of Defence Australia 10 th Annual SET Conference 21 April 2009 The Australian
Seventh Framework Programme Security Research. Health Security Committee CBRN Section. 30 September by Clément Williamson
Seventh Framework Programme 2007-2013 Security Research Health Security Committee CBRN Section 30 September 2009 by Clément Williamson clement.williamson@ec.europa.eu Work programme 2009 Info Day European
S1.1: RESEARCH AND DEVELOPMENT IN EUROPE FOR COMPETITIVE MANUFACTURING. Competitiveness of Industry by means of Cross Fertilisation
S1.1: RESEARCH AND DEVELOPMENT IN EUROPE FOR COMPETITIVE MANUFACTURING Competitiveness of Industry by means of Cross Fertilisation STORYLINE: FOCUS ON KEY ENABLERS FOR DISTRIBUTED INDUSTRIALS SYSTEMS HOW
Unit Compliance to the HIPAA Security Rule
HIPAA Risk Analysis Unit Compliance to the HIPAA Security Rule OIT Security Risk and Compliance PURPOSE The purpose of this document is to provide guidance for units on how to perform a Risk Analysis of
Securing Europe's Information Society
Securing Europe's Information Society Dr. Udo Helmbrecht Executive Director European Network and Information Security Agency 16 June 2010 FIRST AGM Miami 16/6/2010 1 Agenda ENISA overview Challenges EU
SECURE INFORMATION EXCHANGE: REFERENCE ARCHITECTURE
SECURE INFORMATION EXCHANGE: REFERENCE ARCHITECTURE MAY 2017 A NEXOR WHITE PAPER NEXOR 2017 ALL RIGHTS RESERVED CONTENTS 3 4 5 6 8 9 10 11 12 14 15 16 INTRODUCTION THREATS RISK MITIGATION REFERENCE ARCHITECTURE
Control System Security for Social Infrastructure
277 Hitachi Review Vol. 63 (201), No. 5 Featured Articles Control System Security for Social Infrastructure Toshihiko Nakano, Ph.D. Katsuhito Shimizu Tsutomu Yamada Tadashi Kaji, Dr. Info. OVERVIEW: The
Descriptions for CIS Classes (Fall 2017)
Descriptions for CIS Classes (Fall 2017) Major Core Courses 1. CIS 1015. INTRODUCTION TO COMPUTER INFORMATION SYSTEMS. (3-3-0). This course provides students an introductory overview to basic computer
INTERNATIONAL CIVIL AVIATION ORGANIZATION ASIA and PACIFIC OFFICE ASIA/PAC RECOMMENDED SECURITY CHECKLIST
INTERNATIONAL CIVIL AVIATION ORGANIZATION ASIA and PACIFIC OFFICE Aeronautical Telecommunication Network Implementation Coordination Group (ATNICG) ASIA/PAC RECOMMENDED SECURITY CHECKLIST September 2009
Critical Systems. Objectives. Topics covered. Critical Systems. System dependability. Importance of dependability
Objectives Critical Systems To explain what is meant by a critical system where system failure can have severe human or economic consequence. To explain four dimensions of dependability - availability,
Training and Certifying Security Testers Beyond Penetration Testing
Training and Certifying Security Testers Beyond Penetration Testing Randall W. Rice, CTAL (Full), CTAL-SEC Director, ASTQB Board of Directors www.astqb.org Most organizations do not know the true status
Department of Homeland Security
Department of Homeland Security Science & Technology Directorate Emergency Preparedness & Response Christopher Doyle Deputy Program Director A Roadmap for Integrated Modeling & Simulation for Emergency
Cyber Espionage A proactive approach to cyber security
Cyber Espionage A proactive approach to cyber security #DeloitteRA To mitigate the risks of advanced cyber threats, organisations should enhance their capabilities to proactively gather intelligence and
2017 RIMS CYBER SURVEY
2017 RIMS CYBER SURVEY This report marks the third year that RIMS has surveyed its membership about cyber risks and transfer practices. This is, of course, a topic that only continues to captivate the
PT Unified Application Security Enforcement. ptsecurity.com
PT Unified Application Security Enforcement ptsecurity.com Positive Technologies: Ongoing research for the best solutions Penetration Testing ICS/SCADA Security Assessment Over 700 employees globally Over
ACARE WG 4 Security Overview
ACARE WG 4 Security Overview ART WS ATM Security and Cybersecurity Kristof Lamont ATM & Cyber Security Expert 23 March 2016 ACARE Advisory Council for Aviation Research and Innovation in Europe http://www.acare4europe.com/
Chapter X Security Performance Metrics
Chapter X Security Performance Metrics Page 1 of 9 Chapter X Security Performance Metrics Background For the past two years, the State of Reliability report has included a chapter for security performance
Practical Guide to Securing the SDLC
Practical Guide to Securing the SDLC Branko Ninkovic Dragonfly Technologies Founder Agenda Understanding the Threats Software versus Security Goals Secure Coding and Testing A Proactive Approach to Secure
Cyber Intelligence Professional Certificate Program Booz Allen Hamilton 2-Day Seminar Agenda September 2016
Cyber Intelligence Professional Certificate Program Booz Allen Hamilton 2-Day Seminar Agenda 21-22 September 2016 DAY 1: Cyber Intelligence Strategic and Operational Overview 8:30 AM - Coffee Reception