Papers

Listed below is a sampling of classic Cybersecurity papers.

As yet the papers remain uncategorised – but subject headings are coming soon.

NSA Winner(s) Of Annual Cybersecurity Research Paper

Honourable mentions:

Increasing Cybersecurity Investments in Private Sector Firms was written by Lawrence Gordon, Martin Loeb, William Lucyshyn and Lei Zhou and was published in the Journal of Cybersecurity. This paper develops an economics-based framework for evaluating governmental approaches to increase private sector investment in cybersecurity.
Quantum-Secure Covert Communication on Bosonic Channels was written by Boulat Bash, Andrei H. Gheorghe, Monika Patel, Jonathan L. Habif, Dennis Goeckel, Don Towsley, and Saikat Guha. It was published last year in Nature Communications. This research adds critical information to the exploration of “covert communications,” which the authors define as the “transmission of information without detection by watchful adversaries.”

The winning paper, Nomad: Mitigating Arbitrary Cloud Side Channels via Provider-Assisted Migration, discusses the “Nomad” system’s defense against certain attacks that remove private information from cloud clients.

Eight distinguished experts were among the external reviewers:

Dr. Whitfield Diffie, cybersecurity advisor
Dr. Dan Geer, In-Q-Tel
Dr. John McLean, Naval Research Laboratory
Professor Angela Sasse, University College London
Professor Fred Schneider, Cornell University
Phil Venables, Goldman Sachs
Professor David Wagner, University of California-Berkeley
Dr. Jeannette Wing, Microsoft Research

Recent Papers on Cybersecurity

1. “Additive and Multiplicative Notions of Leakage and Their Capacities,” is a research paper presented at the 2014 IEEE Computer Security Foundations Symposium written by Prof. Mario S. Alvim, Dr. Kostas Chatzikokolakis, Prof. Annabelle McIver, Prof. Carroll Morgan, Dr. Catuscia Palamidessi and Prof. Geoffrey Smith

2. “Increasing Security Sensitivity with Social Proof: A Large-Scale Experimental Confirmation,” was written by Sauvik Das, Dr. Adam D.I. Kramer, Prof. Laura Dabbish and Prof. Jason Hong.

3. “Quantitative Evaluation of Dynamic Platform Techniques as a Defensive Mechanism,” was written by Dr. Hamed Okhravi, Dr. James Roirdan, and Dr. Kevin Cater and presented at the 17th International Symposium on Research in Attacks, Intrusions and Defenses.

4. Attacks and defenses for the vulnerability of the decade : Page on utexas.edu

5. The geometry of innocent flesh on the bone :
The Geometry of Innocent Flesh on the Bone

6. Interpreter exploitation :
Page on usenix.org

7. Control-flow integrity :
Page on princeton.edu

8. Intrusion detection via static analysis :
Page on sri.com

9. SYN cookies :
Page on cr.yp.to

10. Inferring Internet denial-of-service activity Outwitting the Witty worm : Page on caida.org

11. New directions in cryptography : Page on utexas.edu

12. Intercepting mobile communications: The insecurity of 802.11 :
Page on berkeley.edu

13. Tor : Page on torproject.org

14. Cold boot attacks on encryption keys : Page on jhalderm.com

15. SecKit: A Model-based Security Toolkit for the Internet of Things :
SecKit: A Model-based Security Toolkit for the Internet of Things

16. Security of Software Defined Networks: A survey
Security of Software Defined Networks: A survey

17. Profiling user-trigger dependence for Android malware detection
Profiling user-trigger dependence for Android malware detection

18. Anomaly-based network intrusion detection: Techniques, systems and challenges :
Anomaly-based network intrusion detection: Techniques, systems and challenges

19. The cyber threat landscape: Challenges and future research directions : The cyber threat landscape: Challenges and future research directions

20. A survey of information security incident handling in the cloud:
A survey of information security incident handling in the cloud

21. From information security to cyber security : From information security to cyber security

22. Cyber warfare: Issues and challenges : Cyber warfare: Issues and challenges

23. Digital media triage with bulk data analysis and bulk_extractor:
Digital media triage with bulk data analysis and bulk_extractor

24. A taxonomy for privacy enhancing technologies :
A taxonomy for privacy enhancing technologies

25. Future directions for behavioral information security research:
Future directions for behavioral information security research

26. Understanding information systems security policy compliance: An integration of the theory of planned behavior and the protection motivation theory: Understanding information systems security policy compliance: An integration of the theory of planned behavior and the protection motivation theory

27. Radio frequency identification (RFID) : Radio frequency identification (RFID)

28. Privacy attitudes and privacy behaviour: A review of current research on the privacy paradox phenomenon : Privacy attitudes and privacy behaviour: A review of current research on the privacy paradox phenomenon

29. A situation awareness model for information security risk management : A situation awareness model for information security risk management

30. Permission based Android security: Issues and countermeasures:
Permission based Android security: Issues and countermeasures

Papers on Cybersecurity Science

[1] The Science Of Cybersecurity The Science Of Cybersecurity, By Dan Geer.

[2] Carl Landwehr – “Cybersecurity: From Engineering to Science”, The Next Wave – The National Security Agency’s Review Of Emerging Technologies – Vol 19. No2, 2012.

[3] Carl Landwehr – “Cybersecurity: How did we get here and how do we get out of here?”

Early / Seminal Security Papers [A] (1970-1985)

Anderson, J. P., Computer Security Technology Planning Study, ESD-TR-73-51, ESD/AFSC, Hanscom AFB, Bedford, MA (Oct. 1972) [NTIS AD-758 206]; Volumes I [PDF] and II [PDF]
Seminal paper on computer security mechanisms
Anderson, J. P., Computer Security Threat Monitoring and Surveillance, James P. Anderson Co., Fort Washington, PA (1980) [PDF]
Seminal paper on the use of auditing and logging for security
Bell, D. E., and La Padula, L., Secure Computer System: Unified Exposition and Multics Interpretation, ESD-TR-75-306, ESD/AFSC, Hanscom AFB, Bedford, MA (1975) [DTIC AD-A023588] [PDF]
Biba, K., Integrity Considerations for Secure Computer Systems, ESD-TR-76-372, ESD/AFSC, Hanscom AFB, Bedford, MA (Apr. 1977) [NTIS ADA039324] [PDF]
Seminal paper on integrity
Bisbey II, R., and Hollingworth, D., Protection Analysis: Final Report; USC/ISI, Marina Del Rey, CA 90291 (May 1978) [PDF]
One of two seminal studies of computer system vulnerabilities.
Committee on Multilevel Data Management Security, Multilevel Data Management Security, Air Force Studies Board, Commission on Engineering and Technical Systems, National Research Council, National Academy Press (1983)
Popularly known as the “Woods Hole Report,” this was a major, influential study of database security
Department of Defense Computer Security Evaluation Center, Trusted Computer System Evaluation Criteria (1982)
First version of the TCSEC made available to the public, it is also called the Powder Blue TCSEC
Department of Defense Computer Security Evaluation Center; Trusted Computer System Evaluation Criteria (Orange Book); (1983, 1985) [PDF]
Full version of the TCSEC that influenced study and development of systems
DeWolf, B. and Szulewski, P., Final Report of the 1979 Summer Study on Air Force Computer Security (1979)
Also called the Draper Report, this describes the state of the art at that time
Ford Aerospace, Secure Minicomputer Operating System (KSOS) (1978) [PDF]
Describes an implementation of a provably secure operating system compatible with the UNIX operating system
Hinke, T. H. and Schaefer, M., Secure Data Management System, RADC-TR-75-266, Rome Air Dev. Center, AFSC, Griffiss AFB NY (Nov 1975) [NTIS AD A019201]
Jelen, G., Information Security: An Elusive Goal (1985)
Study arguing that no strategies for making secure products are promising
Karger, P. A., and Schell, R. R., Multics Security Evaluation: Vulnerability Analysis, ESD-TR-74-193 Vol. II, ESD/AFSC, Hanscom AFB, Bedford, MA (June 1974) [PDF]
Described a number of attacks, including the trap-door compiler that Ken Thompson used so effectively in his Turing Award lecture
Lee, T., Processors, Operating Systems and Nearby Peripherals: A Consensus Report (Miami Report) (1980)
First description of evaluation process and criteria
Linden, T., Operating System Structures to Support Security and Reliable Software (1976) [PDF]
Described capability-based architectures
Myers, P., Subversion: The Neglected Aspect of Computer Security (1980) [PDF]
Demonstrated how a Trojan horse could spread to secure system without the attacker having direct access to that system
Neumann, P., et al., A Provably Secure Operating System (1976) [PDF]
First formal design of a system, emphasizing proofs of design before implementation
Nibaldi, G., Proposed Technical Evaluation Criteria for Trusted Computer Systems (1979) [PDF]
First evaluation criteria with levels (5 of them)
Padilla, S. and Benzel, T., Final Evaluation Report of SCOMP (Secure Communications Processor), Department of Defense Computer Security Center (1985)
First A1-rated system
Proceedings of the DoD Computer Security Center Invitational Workshop on Network Security(1985)
Also called the New Orleans Workshop Report, this extensively discussed network security problem
Schacht, J. M., Jobstream Separator System Design, MTR-3022 Vol. 1, The MITRE Corporation, Bedford, MA 01730 (May 1975) [PDF]
Schell, R. R., Downey, P. J., and Popek, G. J., Preliminary Notes on the Design of Secure Military Computer Systems, MCI-73-1, ESD/AFSC, Hanscom AFB, Bedford, MA (Jan. 1973) [PDF]
Schiller, W. L., The Design and Specification of a Security Kernel for the PDP-11/45 (1975) [PDF]
First formal specification of a kernel satisfying the Bell-LaPadula model
Walter, K. G., Ogden, W. F., Gilligan, J. M., Schaeffer, D. D., Schaen, S. L., and Shumway, D. G., Initial Structured Specifications for an Uncompromisable Computer Security System, ESD-TR-75-82, ESD/AFSC, Hanscom AFB, Bedford, MA (July 1975) [NTIS AD-A022 490]
Ware, W., Security Controls for Computer Systems: Report of Defense Science Board Task Force on Computer Security, Rand Report R609-1 (Feb. 1970) [PDF]
The paper that started it all, first raising computer security as a problem
Weissman, C., System Security Analysis/Certification (1973)
Introduced flaw hypothesis methodology
Whitmore, J., Bensoussan, A., Green, P., Hunt, D., Robziar, A., and Stern, J., Design for Multics Security Enhancements, ESD-TR-74-176, ESD/AFSC, Hanscom AFB, Bedford, MA (1074). [PDF]

Early / Seminal Security Papers [B]

Whitfield Diffie and Martin E. Hellman, New Directions in Cryptography, IEEE Transactions on Information Theory, November 1976
R. L. Rivest and A. Shamir and L. M. Adelman, A Method For Obtaining Digital Signatures And Public-Key Cryptosystems, MIT/LCS/TM-82, 1977
Merkle, R. Security, Authentication, and Public Key Systems, PhD Thesis, 1979 Stanford University. (Just read chapter 2, pages 11–15, in which Merkle invents cryptographic hash functions.)
Morris, Robert and Thompson, Ken. Password security: a case history, Communications of the ACM CACM Homepage archive Volume 22 Issue 11, Nov. 1979 Pages 594-597. PDF
Mazurek et al., Measuring password guessability for an entire university, CCS ’13 Proceedings of the 2013 ACM SIGSAC conference on Computer & communications security, Pages 173-186
Saltzer and Schroeder, The Protection of Information in Computer Systems, ACM Symposium on Operating System Principles (October 1973) HTML HTML2
Karger and Schell, Thirty Years later: Lessons from the Multics Security Evaluation, ACSAC 2002
Lamport, Butler. A Note on the Confinement Problem, Communications of the ACM, 16:10 (Oct. 1973), pp. 613–615. PDF
Thompson, Reflections on Trusting Trust, Communications of the ACM, 27:8, Aug 1984
J.E. Forrester and B.P. Miller, An Empirical Study of the Robustness of Windows NT Applications Using Random Testing, 4th USENIX Windows Systems Symposium, Seattle, August 2000.
Whitten, Alma, Why Johnny Can’t Encrypt: A Usability Evaluation of PGP 5.0, Proceedings of the 8th conference on USENIX Security Symposium, Volume 8, Pages 14–28
Garfinkel, Simson and Shelat, Abhi, Remembrance of Data Passed, IEEE Security and Privacy, Volume 1 Issue 1, January 2003, Page 17-27

Most Cited Papers

[1] Most Cited Computers & Security Articles, by Elsevier.