DOCSLIB.ORG

The State of IT Security in Germany 2015 the STATE of IT SECURITY in GERMANY 2015 | CONTENT the STATE of IT SECURITY in GERMANY 2015 | CONTENT

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
The State of IT Security in Germany 2015 the STATE of IT SECURITY in GERMANY 2015 | CONTENT the STATE of IT SECURITY in GERMANY 2015 | CONTENT The State of IT Security in Germany 2015 THE STATE OF IT SECURITY IN GERMANY 2015 | CONTENT THE STATE OF IT SECURITY IN GERMANY 2015 | CONTENT Content 2.2.4 Spam 28 2.2.5 Botnets 30 2.2.6 Distributed denial of service (DDoS) attacks 30 Foreword 4 DDoS attacks on Federal Government and the German Bundestag websites 31 1 IT security between the conflicting priorities of innovation, globalisation and complexity 5 2.2.7 Drive-by exploits and exploit kits 32 2 Current exposure 8 Thousands of websites direct users to an exploit kit 33 2.1 Causes and determining factors 9 2.2.8 Identity theft 34 2.1.1 Cloud Computing 9 2.3 Cyber-attacks: Motivation and goals 35 2.1.2 Software vulnerabilities 10 2.3.1 Intelligence-related cyber-attacks 35 Blackmail attempt after the web server was compromised 11 2.3.2 Cyber-crime 36 IT security certification: Confidentiality and security design 12 An attack on the Hacking Team company 36 2.1.3 Hardware vulnerabilities 13 3 Current exposure: Federal Government 37 Vulnerability of Intel Management Systems 14 3.1 Defending against attacks on Government networks 38 2.1.4 User behaviour and manufacturer responsibility 14 3.2 Notifications from the Federal Administration 39 2.1.5 Cryptography 15 Information security in authorities 39 Current attacks on encryption methods 16 4 Protection of critical infrastructures: IT security for public welfare 40 2.1.6 Internet protocols 16 Targeted attacks on the infrastructure of financial institutions 41 2.1.7 Mobile communication 17 4.1 Critical infrastructures depend on functioning IT 42 Stagefright gap in Android: Careless update behaviour on the part of manufacturers 18 4.2 The IT Security Act 42 2.1.8 App security 18 Cyber-attack on the French television broadcaster TV5MONDE 43 2.1.9 Industrial control system security 20 4.3 The threat level for critical infrastructures 44 US researchers hack all-terrain vehicles 21 Extortion: DDoS attacks on critical infrastructure companies 44 2.2 Attack methods and means 22 Spear phishing targeted at critical infrastructure companies in the energy sector 45 2.2.1 Malware 22 5 Overall assessment and summary 46 Ransomware in the hospital 23 5.1 Causes of threats 47 2.2.2 Social engineering 24 5.2 Collective responsibility for IT security in Germany 49 Social engineering by phone 25 Glossary 50 2.2.3 Targeted attacks – APT 26 A cyber-attack on the German Bundestag 26 Dealing with an APT attack 27 2 3 THE STATE OF IT SECURITY IN GERMANY 2015 | FOREWORD FOREWORD IT security between the conflict- The report by the Federal Office for Information However, neither the Government nor economy Security in Germany (BSI) on the current state of alone is able to guarantee IT security in our coun- IT security in Germany in 2015 provides informa- try. Everyone has a contribution to make. We ing priorities of innovation, tion on the type and extent of key IT threats and must therefore strengthen collaboration between resulting risks. The report is based on informa- Government and commerce, as well as finding new globalisation and complexity tion analysed by the BSI relating to weaknesses ways to collaborate. We must work together to help and vulnerabilities in currently used information make citizens aware of the risks and to show them technology, as well as to attacks on IT systems and how to work securely online. The more securely networks. each individual can navigate the internet, the bet- ter the protection for the state and society online. The report shows that the number of weaknesses and vulnerabilities in IT systems is continuing to The digital vulnerabilities of our society will run at a high level. Some of these vulnerabilities ex- continue to place demands on us over the coming pose serious security gaps. The asymmetric threat years. This BSI report on the current state of IT level in cyberspace continues to escalate, meaning security in Germany provides the basis to enable that users’ protection of IT systems cannot always decision-makers in Government, commerce and keep pace with the often highly developed tools for society to properly address the risks to our country exploiting gaps in security. that are associated with digitisation. Therefore, I hope this report will be widely read by people who The following trends are especially clear on reading can then identify the areas that affect them, and the report: take action. Firstly, in view of the high number of identified vulnerabilities, some IT manufacturers tend to no longer provide security updates for their products’ security gaps where they believe that those gaps are less serious. This unnecessarily worsens the current level of exposure. Secondly, the number of attacks on industrial production facilities is rising, generating new com- mercial and economic risks. And thirdly, aspects of IT security are not always properly considered during digitisation, even if the failure of the relevant systems can result in far-reaching individual or societal consequences. The IT Security Act, which entered into force at the end of July 2015, is a key first step in improving the protection of IT systems and digital infrastructure in our country: we want them to be among the world’s most secure. Germany is well prepared for the task with the BSI acting as the statutory centre Dr. Thomas de Maizière of expertise for IT security matters. Federal Minister of the Interior 4 5 THE STATE OF IT SECURITY IN GERMANY 2015 | IT SECURITY BETWEEN CONFLICTING PRIORITIES THE STATE OF IT SECURITY IN GERMANY 2015 | IT SECURITY BETWEEN CONFLICTING PRIORITIES Mobile computing versus protection of Compatibility versus information security 1 IT security between the conflicting priorities of business-critical information innovation, globalisation and complexity When introducing modern and secure solutions, The trend toward the use of mobile IT contin- the justified demand for compatibility with exist- ues apace. In the private user sector, new device ing solutions can become a barrier. It often takes classes are already launching on the market, e.g. as time before improved security-related technol- The continuously high rate of innovation in A number of technological changes and their wrist watches and glasses (‘wearable computing’) ogies become established and obsolete, insecure information technology is expressed by its huge significance to IT security are described below. alongside established smartphones and tablets. solutions can be retired. One example of this is force for change and rapid penetration of all areas This will illustrate how quickly manufacturers and Smartphones and tablets already form part of the TLS/SSL protocol which is used in the internet of life and business. The saturation point of the users will find themselves in the field of conflict standard business equipment. As a result, the and in other networks for the encryption of data potential use of IT has not yet been reached. Quite described above. demand for processing business-critical informa- traffic. Many online servers are configured in such the opposite in fact: significantly higher growth tion on this type of device is growing. However, a way that older, insecure cryptographic methods rates can be expected in the miniaturisation and in view of the increasing risk of cyber-espionage, are approved, for internet users to be able to networking of intelligent systems. Developments many institutions have recognised that they must access the relevant website using older browsers. such as the ‘internet of things’ and ‘Industry 4.0’ Software-defined Everything versus Separation pay particular attention to protecting specific Another example is the use of older operating are just two examples of this. In a phase in which information. The reason for this process is that it systems for which the manufacturer no longer companies are developing their business models The current trend toward software-defined is mostly costly and impractical to establish the provides security updates. In the field of industrial further, or even establishing new ones, industry everything illustrates the conflict between func- same high level of security for the entire insti- controls and automation, IT systems can often and commerce as well as consumers are affected tionality and IT security. The term describes the tution. Instead of this, business-critical data, the simply be upgraded to a new operating system, by the onward march of digitisation. For Germa- trend toward architectures in which systems, ‘crown jewels’ are heavily protected, while proven sometimes because the manufacturer does not ny, this creates economic and social perspectives. networks, storage and – depending on design – standard security measures are implemented in support it or because there is no compatibility. It is increasingly clear, however, that continued also other elements of information processing are all other areas. For many institutions, the question digitisation is essentially determined by function- no longer defined statically by the hardware used, therefore arises of whether – and if yes, how – al and economic factors. Ongoing globalisation but can be configured dynamically (for example, business-critical data can be accessed from mobile increases the financial pressure on all parties to Software-defined Network, Software-defined Data devices. Here, the available modern security succeed. Against this backdrop, IT security is often Centre, or Software-defined Storage). The benefits solutions as well as individual risks should be overlooked. are clear: resources can be moved to where they considered. are needed more quickly and at lower cost. Organ- Providers who lag behind with respect to inno- isational changes can be mapped more easily, such vation and competitiveness run the risk of being as during mergers or acquisitions. Software-defined very quickly forced out of the market. This results Everything however competes with the basic Operational reliability versus protection in pressure to service the needs of a growing global requirement of information security based on against attacks customer base more quickly and functionally the separation of key processes and systems.
Load more

Recommended publications
  • Systematization of Vulnerability Discovery Knowledge: Review
    Systematization of Vulnerability Discovery Knowledge Review Protocol Nuthan Munaiah and Andrew Meneely Department of Software Engineering Rochester Institute of Technology Rochester, NY 14623 {nm6061,axmvse}@rit.edu February 12, 2019 1 Introduction As more aspects of our daily lives depend on technology, the software that supports this technology must be secure. We, as users, almost subconsciously assume the software we use to always be available to serve our requests while preserving the confidentiality and integrity of our information. Unfortunately, incidents involving catastrophic software vulnerabilities such as Heartbleed (in OpenSSL), Stagefright (in Android), and EternalBlue (in Windows) have made abundantly clear that software, like other engineered creations, is prone to mistakes. Over the years, Software Engineering, as a discipline, has recognized the potential for engineers to make mistakes and has incorporated processes to prevent such mistakes from becoming exploitable vulnerabilities. Developers leverage a plethora of processes, techniques, and tools such as threat modeling, static and dynamic analyses, unit/integration/fuzz/penetration testing, and code reviews to engineer secure software. These practices, while effective at identifying vulnerabilities in software, are limited in their ability to describe the engineering failures that may have led to the introduction of vulnerabilities. Fortunately, as researchers propose empirically-validated metrics to characterize historical vulnerabilities, the factors that may have led to the introduction of vulnerabilities emerge. Developers must be made aware of these factors to help them proactively consider security implications of the code that they contribute. In other words, we want developers to think like an attacker (i.e. inculcate an attacker mindset) to proactively discover vulnerabilities.
    [Show full text]
  • Internet Security Threat Report VOLUME 21, APRIL 2016 TABLE of CONTENTS 2016 Internet Security Threat Report 2
    Internet Security Threat Report VOLUME 21, APRIL 2016 TABLE OF CONTENTS 2016 Internet Security Threat Report 2 CONTENTS 4 Introduction 21 Tech Support Scams Go Nuclear, 39 Infographic: A New Zero-Day Vulnerability Spreading Ransomware Discovered Every Week in 2015 5 Executive Summary 22 Malvertising 39 Infographic: A New Zero-Day Vulnerability Discovered Every Week in 2015 8 BIG NUMBERS 23 Cybersecurity Challenges For Website Owners 40 Spear Phishing 10 MOBILE DEVICES & THE 23 Put Your Money Where Your Mouse Is 43 Active Attack Groups in 2015 INTERNET OF THINGS 23 Websites Are Still Vulnerable to Attacks 44 Infographic: Attackers Target Both Large and Small Businesses 10 Smartphones Leading to Malware and Data Breaches and Mobile Devices 23 Moving to Stronger Authentication 45 Profiting from High-Level Corporate Attacks and the Butterfly Effect 10 One Phone Per Person 24 Accelerating to Always-On Encryption 45 Cybersecurity, Cybersabotage, and Coping 11 Cross-Over Threats 24 Reinforced Reassurance with Black Swan Events 11 Android Attacks Become More Stealthy 25 Websites Need to Become Harder to 46 Cybersabotage and 12 How Malicious Video Messages Could Attack the Threat of “Hybrid Warfare” Lead to Stagefright and Stagefright 2.0 25 SSL/TLS and The 46 Small Business and the Dirty Linen Attack Industry’s Response 13 Android Users under Fire with Phishing 47 Industrial Control Systems and Ransomware 25 The Evolution of Encryption Vulnerable to Attacks 13 Apple iOS Users Now More at Risk than 25 Strength in Numbers 47 Obscurity is No Defense
    [Show full text]
  • Compromised Connections
    COMPROMISED CONNECTIONS OVERCOMING PRIVACY CHALLENGES OF THE MOBILE INTERNET The Universal Declaration of Human Rights, the International Covenant on Civil and Political Rights, and many other international and regional treaties recognize privacy as a fundamental human right. Privacy A WORLD OF INFORMATION underpins key values such as freedom of expression, freedom of association, and freedom of speech, IN YOUR MOBILE PHONE and it is one of the most important, nuanced and complex fundamental rights of contemporary age. For those of us who care deeply about privacy, safety and security, not only for ourselves but also for our development partners and their missions, we need to think of mobile phones as primary computers As mobile phones have transformed from clunky handheld calling devices to nifty touch-screen rather than just calling devices. We need to keep in mind that, as the storage, functionality, and smartphones loaded with apps and supported by cloud access, the networks these phones rely on capability of mobiles increase, so do the risks to users. have become ubiquitous, ferrying vast amounts of data across invisible spectrums and reaching the Can we address these hidden costs to our digital connections? Fortunately, yes! We recommend: most remote corners of the world. • Adopting device, data, network and application safety measures From a technical point-of-view, today’s phones are actually more like compact mobile computers. They are packed with digital intelligence and capable of processing many of the tasks previously confined
    [Show full text]
  • Mind the Gap: Dissecting the Android Patch Gap | Ben Schlabs
    Mind the Gap – Dissecting the Android patch gap Ben Schlabs <[email protected]> SRLabs Template v12 Corporate Design 2016 Allow us to take you on two intertwined journeys This talk in a nutshell § Wanted to understand how fully-maintained Android phones can be exploited Research § Found surprisingly large patch gaps for many Android vendors journey – some of these are already being closed § Also found Android exploitation to be unexpectedly difficult § Wanted to check thousands of firmwares for the presence of Das Logo Horizontal hundreds of patches — Pos / Neg Engineering § Developed and scaled a rather unique analysis method journey § Created an app for your own analysis 2 3 Android patching is a known-hard problem Patching challenges Patch ecosystems § Computer OS vendors regularly issue patches OS vendor § Users “only” have to confirm the installation of § Microsoft OS patches Patching is hard these patches § Apple Endpoints & severs to start with § Still, enterprises consider regular patching § Linux distro among the most effortful security tasks § “The moBile ecosystem’s diversity […] OS Chipset Phone Android contriButes to security update complexity and vendor vendor vendor phones inconsistency.” – FTC report, March 2018 [1] The nature of Telco § Das Logo HorizontalAndroid makes Patches are handed down a long chain of — Pos / Negpatching so typically four parties Before reaching the user much more § Only some devices get patched (2016: 17% [2]). difficult We focus our research on these “fully patched” phones Our research question –
    [Show full text]
  • Automating Patching of Vulnerable Open-Source Software Versions in Application Binaries
    Automating Patching of Vulnerable Open-Source Software Versions in Application Binaries Ruian Duan:, Ashish Bijlani:, Yang Ji:, Omar Alrawi:, Yiyuan Xiong˚, Moses Ike:, Brendan Saltaformaggio,: and Wenke Lee: fruian, ashish.bijlani, yang.ji, alrawi, [email protected], [email protected] [email protected], [email protected] : Georgia Institute of Technology, ˚ Peking University Abstract—Mobile application developers rely heavily on open- while ensuring backward compatibility, and test for unin- source software (OSS) to offload common functionalities such tended side-effects. For the Android platform, Google has as the implementation of protocols and media format playback. initiated the App Security Improvement Program (ASIP) [21] Over the past years, several vulnerabilities have been found in to notify developers of vulnerable third-party libraries in popular open-source libraries like OpenSSL and FFmpeg. Mobile use. Unfortunately, many developers, as OSSPolice [15] and applications that include such libraries inherit these flaws, which LibScout [4] show, do not update or patch their application, make them vulnerable. Fortunately, the open-source community is responsive and patches are made available within days. However, which leaves end-users exposed. Android developers mainly mobile application developers are often left unaware of these use Java and C/C++ [1] libraries. While Derr et al. [14] flaws. The App Security Improvement Program (ASIP) isa show that vulnerable Java libraries can be fixed by library- commendable effort by Google to notify application developers level update, their C/C++ counterparts, which contain many of these flaws, but recent work has shown that many developers more documented security bugs in the National Vulnerability do not act on this information.
    [Show full text]
  • Risk Assessment and Knowledge Management of Ethical Hacking In
    Technoethics and Sensemaking: Risk Assessment and Knowledge Management of Ethical Hacking in a Sociotechnical Society by Baha Abu-Shaqra A thesis submitted in partial fulfillment of the requirements for the degree of Doctor of Philosophy in Electronic Business Faculty of Engineering University of Ottawa © Baha Abu-Shaqra, Ottawa, Canada, 2020 ii Abstract Cyber attacks by domestic and foreign threat actors are increasing in frequency and sophistication. Cyber adversaries exploit a cybersecurity skill/knowledge gap and an open society, undermining the information security/privacy of citizens and businesses and eroding trust in governments, thus threatening social and political stability. The use of open digital hacking technologies in ethical hacking in higher education and within broader society raises ethical, technical, social, and political challenges for liberal democracies. Programs teaching ethical hacking in higher education are steadily growing but there is a concern that teaching students hacking skills increases crime risk to society by drawing students toward criminal acts. A cybersecurity skill gap undermines the security/viability of business and government institutions. The thesis presents an examination of opportunities and risks involved in using AI powered intelligence gathering/surveillance technologies in ethical hacking teaching practices in Canada. Taking a qualitative exploratory case study approach, technoethical inquiry theory (Bunge-Luppicini) and Weick’s sensemaking model were applied as a sociotechnical theory
    [Show full text]
  • Deepfakes & Disinformation
    DEEPFAKES & DISINFORMATION DEEPFAKES & DISINFORMATION Agnieszka M. Walorska ANALYSISANALYSE 2 DEEPFAKES & DISINFORMATION IMPRINT Publisher Friedrich Naumann Foundation for Freedom Karl-Marx-Straße 2 14482 Potsdam Germany /freiheit.org /FriedrichNaumannStiftungFreiheit /FNFreiheit Author Agnieszka M. Walorska Editors International Department Global Themes Unit Friedrich Naumann Foundation for Freedom Concept and layout TroNa GmbH Contact Phone: +49 (0)30 2201 2634 Fax: +49 (0)30 6908 8102 Email: [email protected] As of May 2020 Photo Credits Photomontages © Unsplash.de, © freepik.de, P. 30 © AdobeStock Screenshots P. 16 © https://youtu.be/mSaIrz8lM1U P. 18 © deepnude.to / Agnieszka M. Walorska P. 19 © thispersondoesnotexist.com P. 19 © linkedin.com P. 19 © talktotransformer.com P. 25 © gltr.io P. 26 © twitter.com All other photos © Friedrich Naumann Foundation for Freedom (Germany) P. 31 © Agnieszka M. Walorska Notes on using this publication This publication is an information service of the Friedrich Naumann Foundation for Freedom. The publication is available free of charge and not for sale. It may not be used by parties or election workers during the purpose of election campaigning (Bundestags-, regional and local elections and elections to the European Parliament). Licence Creative Commons (CC BY-NC-ND 4.0) https://creativecommons.org/licenses/by-nc-nd/4.0 DEEPFAKES & DISINFORMATION DEEPFAKES & DISINFORMATION 3 4 DEEPFAKES & DISINFORMATION CONTENTS Table of contents EXECUTIVE SUMMARY 6 GLOSSARY 8 1.0 STATE OF DEVELOPMENT ARTIFICIAL
    [Show full text]
  • VULNERABLE by DESIGN: MITIGATING DESIGN FLAWS in HARDWARE and SOFTWARE Konoth, R.K
    VU Research Portal VULNERABLE BY DESIGN: MITIGATING DESIGN FLAWS IN HARDWARE AND SOFTWARE Konoth, R.K. 2020 document version Publisher's PDF, also known as Version of record Link to publication in VU Research Portal citation for published version (APA) Konoth, R. K. (2020). VULNERABLE BY DESIGN: MITIGATING DESIGN FLAWS IN HARDWARE AND SOFTWARE. General rights Copyright and moral rights for the publications made accessible in the public portal are retained by the authors and/or other copyright owners and it is a condition of accessing publications that users recognise and abide by the legal requirements associated with these rights. • Users may download and print one copy of any publication from the public portal for the purpose of private study or research. • You may not further distribute the material or use it for any profit-making activity or commercial gain • You may freely distribute the URL identifying the publication in the public portal ? Take down policy If you believe that this document breaches copyright please contact us providing details, and we will remove access to the work immediately and investigate your claim. E-mail address: [email protected] Download date: 07. Oct. 2021 VULNERABLE BY DESIGN: MITIGATING DESIGN FLAWS IN HARDWARE AND SOFTWARE PH.D. THESIS RADHESH KRISHNAN KONOTH VRIJE UNIVERSITEIT AMSTERDAM, 2020 Faculty of Science The research reported in this dissertation was conducted at the Faculty of Science — at the Department of Computer Science — of the Vrije Universiteit Amsterdam This work was supported by the MALPAY consortium, consisting of the Dutch national police, ING, ABN AMRO, Rabobank, Fox-IT, and TNO.
    [Show full text]
  • Malware Detection Techiniques and Tools for Android Mobile – a Brief Review
    International Journal of Latest Research in Engineering and Technology (IJLRET) ISSN: 2454-5031 www.ijlret.com || Volume 03 - Issue 03 || March 2017 || PP. 102-105 Malware Detection Techiniques and Tools for Android Mobile – A Brief Review Dr. Bhaskar V. Patil#1 #1Bharati Vidyapeeth University Yashwantrao Mohite institute of Management, Karad [M.S.], INDIA Dr. Rahul J. Jadhav#2 21Bharati Vidyapeeth University Yashwantrao Mohite institute of Management, Karad [M.S.], INDIA Abstract: Android has the biggest market share among all Smartphone operating system. The number of devices running with the Android operating system has been on the rise. By the end of 2012, it will account for nearly half of the world's Smartphone market. Along with its growth, the importance of security has also risen. Security is one of the main concerns for Smartphone users today. As the power and features of Smartphone’s increase, so has their vulnerability for attacks by viruses etc. Perhaps android is more secured operating system than any other Smartphone operating system today. Android has very few restrictions for developer, increases the security risk for end users. Antivirus Android apps remain one of the most popular types of applications on Android. Some people either like having that extra security or just want to be extra cautious just in case and there is nothing wrong with that. In this list, we’ll check out the best antivirus Android apps and anti-malware apps on Android! The efficacies of these applications have not been empirically established. This paper analyzes some of the security tools written for the Android platform to gauge their effectiveness at mitigating spyware and malware.
    [Show full text]
  • Cybercrime: Protecting Your Law Firm from the Inevitable by Ben Glass and John Pirkopf
    Glass & Pirkopf | LAW OFFICE MANAGEMENT Cybercrime: Protecting Your Law Firm from the Inevitable By Ben Glass and John Pirkopf ata breach cases have made headlines in recent years, their breach protocol in the event the worst happens. But what Dfrom Yahoo to Marriot to Target to Equifax. While the really should that entail? This article addresses the most com- larger companies tend to attract more public attention, cyber- mon vulnerabilities in a law firm and best practices with crime does not discriminate, and more and more law firms respect to protecting both firm and client information. are impacted by the threat of or actual attacks. According to The Center for Strategic and International Studies (CSIS), the Law Firms and Cyber Security total global cost of cybercrime is closing in on $600 billion, There is more to securing a firm’s network and sensitive and this number is up from the 2014 estimate of $445 billion.1 data than a good password. Security needs to be built into Other estimates make that look conservative. According to Dr. the culture of your workplace. Increasingly, cyber criminals Michael McGuire, Senior Lecturer in Criminology at Surrey are employing clever and sophisticated methods to steal, University in England, the revenues of cybercrime have hit sabotage, or ransom firm data. Law firms are now being $1.5 Trillion annually.2 While this number is staggering in recognized by attackers as a sweet spot for attacks. This is and of itself, it is hard to comprehend exactly what that means due, in part, to the amount of highly sensitive data to which to a law firm.
    [Show full text]
  • Toward Data-Driven Discovery of Software Vulnerabilities
    Rochester Institute of Technology RIT Scholar Works Theses 4-2020 Toward Data-Driven Discovery of Software Vulnerabilities Nuthan Munaiah [email protected] Follow this and additional works at: https://scholarworks.rit.edu/theses Recommended Citation Munaiah, Nuthan, "Toward Data-Driven Discovery of Software Vulnerabilities" (2020). Thesis. Rochester Institute of Technology. Accessed from This Dissertation is brought to you for free and open access by RIT Scholar Works. It has been accepted for inclusion in Theses by an authorized administrator of RIT Scholar Works. For more information, please contact [email protected]. Toward Data-Driven Discovery of Software Vulnerabilities by Nuthan Munaiah A dissertation submitted in partial fulfillment of the requirements for the degree of Doctor of Philosophy in Computing and Information Sciences B. Thomas Golisano College of Computing and Information Sciences Rochester Institute of Technology Rochester, New York April 2020 Toward Data-Driven Discovery of Software Vulnerabilities by Nuthan Munaiah Committee Approval: We, the undersigned committee members, certify that we have advised and/or supervised the candidate on the work described in this dissertation. We further certify that we have reviewed the dissertation manuscript and approve it in partial fulfillment of the requirements of the degree of Doctor of Philosophy in Computing and Information Sciences. Dr. Andrew Meneely Date Dissertation Advisor Dr. Naveen Sharma Date Dissertation Committee Member Dr. Ernest Fokoué Date Dissertation Committee Member Dr. Pradeep K. Murukannaiah Date Dissertation Committee Member Dr. Sharon Mason Date Dissertation Defense Chairperson Certified by: Dr. Pencheng Shi Date Ph.D. Program Director, Computing and Information Sciences ii iii © 2020 Nuthan Munaiah All rights reserved.
    [Show full text]
  • Volume 5: Future Challenges of Cybercrime
    Future Challenges of Cybercrime Volume 5: Proceedings of the Futures Working Group Toby Finnie Tom Petee John Jarvis Editors 1 Acknowledgments The Futures Working Group and the authors that contributed to this volume wish to thank both Police Futurists International and the Federal Bureau of Investigation for supporting the efforts reflected herein. Additionally, the following individuals are recognized for their significant contributions to this volume: FBI Behavioral Science Unit Intern Angela Basso, BSU Visiting Scholar Hayley Daglis Cleary, and other staff of the FBI Training Division who provided significant assistance with the production of this volume including, but not limited to, the editing, organization, and formatting of this volume. Without their generous efforts and sincere commitment to assisting with this project, this work would not have been possible. Suggested Citation: The Future Challenges of Cybercrime: Volume 5 Proceedings of the Futures Working Group. Toby Finnie, Tom Petee, and John Jarvis, editors. Federal Bureau of Investigation: Quantico, Virginia 2010. Initial Release Date: September 22, 2010 Revised: November 4, 2010 Author information: Biographical information pertaining to individual contributors and authors can be found at http://futuresworkinggroup.cos.ucf.edu. The opinions and statements expressed throughout this volume are those of the individual authors and contributors and should not be considered an endorsement or a reflection of the official position of the Federal Bureau of Investigation, the Society of Police Futures International, or any other institution or organization for any policy, program, or service. 2 Table of Contents Acknowledgments............................................................................................................................2 Word from the Chairman………………………………………………………………………….5 Defining “Cyber-Crime”: Issues in Determining the Nature and Scope of Computer-Related Offenses……………………………………………………………………….6 Thomas A.
    [Show full text]