syssec_red_book

Recommendations

Info

Bibliography[309] E. Passerini, R. Paleari, L. Martignoni, and D. Bruschi. Fluxor: Detecting and monitoringfast-flux service networks. In D. Zamboni, editor, DIMVA, volume 5137 of Lecture Notes inComputer Science, pages 186–206. Springer, 2008.[310] PaX Team. Address space layout randomization. http://pax.grsecurity.net/docs/aslr.txt.[311] PaX Team. PaX non-executable pages design & implementation. http://pax.grsecurity.net/docs/noexec.txt.[312] H. Peng, C. Gates, B. Sarma, N. Li, Y. Qi, R. Potharaju, C. Nita-Rotaru, and I. Molloy. Usingprobabilistic generative models for ranking risks of android apps. In CCS, 2012.[313] C. Percival. Stronger key derivation via sequential memory-hard functions. BSDCan 2009,2009.[314] L. Piètre-Cambacédès, M. Tritschler, and G. N. Ericsson. Cybersecurity Myths on PowerControl Systems: 21 Misconceptions and False Beliefs. Power Delivery, IEEE Transactions on,26(1), 2011.[315] M. Pistoia, S. Chandra, S. J. Fink, and E. Yahav. A survey of static analysis methods foridentifying security vulnerabilities in software systems. IBM Syst. J., 46(2):265–288, Apr.2007.[316] PITAC. Cyber Security: A Crisis of Prioritization. Technical report, President’s InformationTechnology Advisory Committee - PITAC, Feb. 2005.[317] I. Polakis, G. Kontaxis, S. Antonatos, E. Gessiou, T. Petsas, and E. P. Markatos. Using socialnetworks to harvest email addresses. In Proceedings of the 9th Annual ACM Workshop onPrivacy in the Electronic Society, pages 11–20. ACM, 2010.[318] I. Polakis, M. Lancini, G. Kontaxis, F. Maggi, S. Ioannidis, A. D. Keromytis, and S. Zanero.All your face are belong to us. In Proceedings of the 28th Annual Computer Security ApplicationsConference on - ACSAC ’12, page 399. ACM Press, 2012.[319] P. Porras, H. Saidi, and V. Yegneswaran. An analysis of conficker’s logic and rendezvouspoints. Technical Report SRI International Technical Report, 2009. http://mtc.sri.com/Conficker.[320] G. Portokalidis, A. Slowinska, and H. Bos. Argos: an Emulator for Fingerprinting Zero-DayAttacks. In Proceedings of the 1st ACM SIGOPS/EuroSys European Conference on ComputerSystems 2006, EuroSys’06, 2006.[321] M. Prasad and T. cker Chiueh. A binary rewriting defense against stack based overflowattacks. In Proceedings of the USENIX Annual Technical Conference, June 2003.[322] R. W. Proctor, M.-C. Lien, K.-P. L. Vu, E. E. Schultz, and G. Salvendy. Improving computersecurity for authentication of users: influence of proactive password restrictions. Behav ResMethods Instrum Comput, 34(2):163–9, 2002.[323] N. Provos and D. Mazières. A future-adaptive password scheme. ATEC 1999.[324] S. J. Prowell, M. Pleszkoch, K. D. Sayre, and R. C. I. S. G. T. I. . I. P. Linger. Automatedvulnerability detection for compiled smart grid software. Innovative Smart Grid Technologies(ISGT), 2012 IEEE PES, 2012.[325] F. Qin, C. Wang, Z. Li, H.-s. Kim, Y. Zhou, and Y. Wu. LIFT: A Low-Overhead PracticalInformation Flow Tracking System for Detecting Security Attacks. In Proc. of MICRO, pages135–148, 2006.[326] C. Queiroz, A. Mahmood, and Z. S. G. I. T. o. Tari. SCADASim—A Framework for BuildingSCADA Simulations. Smart Grid, IEEE Transactions on, 2(4), 2011.[327] M. Raciti and S. Nadjm-Tehrani. Embedded Cyber-Physical Anomaly Detection in SmartMeters. 2012.[328] R. Radvanovsky and J. Brodsky. Handbook of Scada/Control Systems Security. CRC PressI Llc,Feb. 2013.180
Bibliography[329] F. Raja, K. Hawkey, S. Hsu, K.-L. C. Wang, and K. Beznosov. A brick wall, a locked door,and a bandit: a physical security metaphor for firewall warnings. In Proceedings of theSeventh Symposium on Usable Privacy and Security, SOUPS ’11, pages 1:1–1:20, New York,NY, USA, 2011. ACM.[330] V. Reding. the EU Data Protection Reform 2012: Making Europe the Standard Setterfor Modern Data Protection Rules in the Digital Age. http://europa.eu/rapid/pressrelease_SPEECH-12-26_en.htm.[331] A. Reina, A. Fattori, and L. Cavallaro. A system call-centric analysis and stimulationtechnique to automatically reconstruct android malware behaviors. In EuroSec, April 2013.[332] C. Reis and S. Gribble. Isolating web programs in modern browser architectures. InProceedings of the 4th ACM European Conference on Computer Systems (EuroSys), pages 219–232. ACM, 2009.[333] E. Rescorla. Security holes... Who cares? In Proceedings of the 12th USENIX SecuritySymposium, pages 75–90, Aug. 2003.[334] R. Richmond. Stolen Facebook Accounts for Sale. 2010. http://www.nytimes.com/2010/05/03/technology/internet/03facebook.html?_r=0.[335] R. Roberts. Malware Development Life Cycle. Virus Bulletin Conf., (October), 2008.[336] W. Robertson and G. Vigna. Static Enforcement of Web Application Integrity ThroughStrong Typing. In Proceedings of the 18th USENIX Security Symposium, Montreal, Quebec,August 2009.[337] C. Rossow, D. Andriesse, T. Werner, B. Stone-Gross, C. J. Dietrich, and H. Bos. P2pwned— modeling and evaluating the resilience of peer-to-peer botnets. In Security & Privacy(Oakland), San Francisco, CA, USA, May 2013.[338] I. Rouf, H. Mustafa, M. Xu, W. Xu, R. Miller, and M. Gruteser. Neighborhood watch:security and privacy analysis of automatic meter reading systems. In ACM conference onComputer and Communications Security. ACM Request Permissions, Oct. 2012.[339] RSA. Apt summit findings. http://www.rsa.com/innovation/docs/APT_findings.pdf.[340] A. Rubin and D. Geer. A survey of web security. Computer, 31(9):34–41, 1998.[341] G. Sarwar, O. Mehani, R. Boreli, and D. Kaafar. On the Effectiveness of Dynamic TaintAnalysis for Protecting Against Private Information Leaks on Android-based Devices. In10th International Conference on Security and Cryptography (SECRYPT), 2013.[342] P. Saxena, S. Hanna, P. Poosankam, and D. Song. FLAX: Systematic Discovery of ClientsideValidation Vulnerabilities in Rich Web Applications. In Proceedings of the 17th AnnualNetwork and Distributed System Security Symposium (NDSS).[343] Security Focus. Vulnerabilities. http://www.securityfocus.com/bid, 2011.[344] D. Seeley. Password cracking: a game of wits. Commun. ACM, 32(6):700–703, June 1989.[345] R. Sekar. An Efficient Black-box Technique for Defeating Web Application Attacks. InProceedings of the 16th Annual Network and Distributed System Security Symposium (NDSS),San Diego, CA, Feb. 8-11, 2009.[346] F. J. Serna. CVE-2012-0769, the case of the perfect info leak, Feb. 2012. http://zhodiac.hispahack.com/my-stuff/security/Flash_ASLR_bypass.pdf.[347] H. Shacham, M. Page, B. Pfaff, E.-J. Goh, N. Modadugu, and D. Boneh. On the effectivenessof address-space randomization. In Proceedings of the 11th ACM conference on Computer andCommunications Security (CCS), 2004.[348] F. T. Sheldon and C. Vishik. Moving toward trustworthy systems: R&d essentials. IEEEComputer, 2010.[349] Y. Shin and L. Williams. An initial study on the use of execution complexity metrics asindicators of software vulnerabilities. In Proc. of the 7th international workshop on Softwareengineering for secure systems, SESS’11. ACM Press, May 2011.181
Page 1:
SEVENTH FRAMEWORK PROGRAMMETHERED B
Page 4 and 5:
The Red Book. ©2013 The SysSec Con
Page 7 and 8:
PrefaceAfter the completion of its
Page 9 and 10:
Contents1 Executive Summary 32 Intr
Page 11 and 12:
1 Executive SummaryBased on publish
Page 13:
1.2. Grand Challenges4. will have t
Page 16 and 17:
2. Introductionwho want to get at t
Page 18 and 19:
2. Introduction• Although conside
Page 20 and 21:
2. Introductionfuture, where each a
Page 22 and 23:
2. Introductiondrones), such sensor
Page 24 and 25:
2. Introductioncover our energy nee
Page 27:
Part I: Threats Identified
Page 30 and 31:
3. In Search of Lost Anonymity3.2 W
Page 32 and 33:
3. In Search of Lost Anonymityguide
Page 35 and 36:
4 Software VulnerabilitiesExtending
Page 37 and 38:
4.1. What Is the Problem?infrastruc
Page 39 and 40:
4.5. State of the Artparts of criti
Page 41:
4.7. Example Problemstem mitigation
Page 44 and 45:
5. Social Networks5.1 Who Is Going
Page 46 and 47:
5. Social Networksby such an applic
Page 48 and 49:
5. Social Networksdisasters. This r
Page 50 and 51:
6. Critical Infrastructure Security
Page 52 and 53:
Page 54 and 55:
Page 56 and 57:
Page 59 and 60:
7 Authentication and AuthorizationH
Page 61 and 62:
7.2. Who Is Going to Be Affected?so
Page 63 and 64:
7.5. State of the ArtFinally, ident
Page 65 and 66:
7.6. Research Gapshashes and evalua
Page 67 and 68:
8 Security of Mobile DevicesIn an e
Page 69 and 70:
8.3. What Is the Worst That Can Hap
Page 71 and 72:
8.4. State of the ArtAll the other
Page 73:
8.6. Example Problemserated anomaly
Page 76 and 77:
9. Legacy Systemsthe execution of a
Page 78 and 79:
9. Legacy Systemsparts of the progr
Page 81 and 82:
10 Usable SecurityKeys, locks, and
Page 83 and 84:
10.4. What Is the Worst That Can Ha
Page 85 and 86:
10.6. Research Gaps10.6 Research Ga
Page 87:
10.7. Example Problemsof value for
Page 90 and 91:
11. The Botnet that Would not DieNu
Page 92 and 93:
11. The Botnet that Would not Diefa
Page 94 and 95:
11. The Botnet that Would not Dieti
Page 96 and 97:
12. Malwarethan 128 million malware
Page 98 and 99:
12. Malwareequipped with auto-updat
Page 100 and 101:
12. Malwarethe introduction of App
Page 102 and 103:
13. Social Engineering and Phishing
Page 104 and 105:
Page 106 and 107:
Page 108 and 109:
Page 111 and 112:
14 Grand ChallengesOne of the most
Page 113:
Part II: Related Work
Page 116 and 117:
15. A Crisis of Prioritization•
Page 118 and 119:
16. Forwardare accessible from the
Page 120 and 121:
16. ForwardRecommendation 4: “The
Page 122 and 123:
17. Federal Plan for Cyber Security
Page 124 and 125:
17. Federal Plan for Cyber Security
Page 126 and 127:
18. EffectsPlus18.1 Roadmap Structu
Page 128 and 129:
18. EffectsPlus18.6 Identified Prio
Page 130 and 131:
19. Digital GovernmentThe roadmap o
Page 132 and 133:
20. Horizon2020• “Making cyber
Page 135 and 136:
21 Trust in the Information Society
Page 137: 21.2. Recommendationsallows for the
Page 140 and 141: 22. ENISA Threat Landscape2. Malwar
Page 142 and 143: 22. ENISA Threat LandscapeSocial Te
Page 144 and 145: 22. ENISA Threat Landscapewriters w
Page 146 and 147: 23. Cyber Security Research Worksho
Page 149 and 150: 24 Cyber Security Strategy of theEu
Page 151 and 152: 24.2. Strategic PrioritiesProposed
Page 153 and 154: 25 The Dutch National Cyber Securit
Page 155 and 156: 25.1. ContextsInternet (e.g., smart
Page 157 and 158: 25.1. Contextsdefensive approaches
Page 159 and 160: 25.2. Research Themesand radio broa
Page 161 and 162: 25.2. Research Themesconsists of se
Page 163 and 164: 25.2. Research ThemesRisk managemen
Page 165 and 166: AMethodologiesIn this appendix we o
Page 167 and 168: BSysSec Threats Landscape Evolution
Page 169 and 170: B.4. SysSec 2013 Threats LandscapeT
Page 171 and 172: B.4. SysSec 2013 Threats LandscapeS
Page 173 and 174: Bibliography[1] 10 Questions for Ke
Page 175 and 176: Bibliography[45] SCADA & Security o
Page 177 and 178: Bibliography[88] A. Avizienis, J.-C
Page 179 and 180: Bibliography[130] G. Cluley. 600,00
Page 181 and 182: Bibliography[172] D. Evans. Top 25
Page 183 and 184: Bibliography[214] ICS-CERT. Monthly
Page 185 and 186: Bibliography[253] C. Lever, M. Anto
Page 187: Bibliography[291] Mozilla. Browseri
Page 191 and 192: Bibliography[370] T. Telegraph. Bog
Page 193 and 194: Bibliography[407] W. Yang, N. Li, Y
show all

syssec_red_book

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?