1. Computer Science and Engineering 1 Csilla Farkas Associate Professor Center for Information Assurance Engineering Dept. of Computer Science and Engineering University of South Carolina farkas@cse.sc.edu http://www.cse.sc.edu/~farkas

2. Computer Science and Engineering 2 Attack Sophistication vs. Intruder Technical Knowledge High Low 1980198519901995 2000 password guessing self-replicating code password cracking exploiting known vulnerabilities disabling audits back doors hijacking sessions sweepers sniffers packet spoofing GUI automated probes/scans denial of service www attacks Tools Attackers Intruder Knowledge Attack Sophistication “stealth” / advanced scanning techniques burglaries network mgmt. diagnostics distributed attack tools Cross site scripting Staged attack Copyright: CERT, 2000

3. Computer Science and Engineering 3 CSI Survey 2008 Types of incidents CSI/FBI Computer Crime and Security Survey Computer Security Institute

4. Computer Science and Engineering 4 CSI Survey 2008 CSI/FBI Computer Crime and Security Survey Computer Security Institute

5. Computer Science and Engineering 5 CSI Survey 2008 CSI/FBI Computer Crime and Security Survey Computer Security Institute

6. Computer Science and Engineering 6 CSI Survey 2008 CSI/FBI Computer Crime and Security Survey Computer Security Institute

7. Computer Science and Engineering 7 Systems must be protected against attacks! What can a business do about it? What can IT professionals do about it?

8. Computer Science and Engineering 8 Graduate Certificate Program in Information Assurance and Security (IA&S)

9. Computer Science and Engineering 9 Security Objectives Confidentiality: prevent/detect/deter improper disclosure of information Integrity: prevent/detect/deter improper modification of information Availability: prevent/detect/deter improper denial of access to services Security Needs

10. Computer Science and Engineering 10 Types of Threats Errors of users Natural/man-made/machine disasters Dishonest insider Disgruntled insider Outsiders

11. Computer Science and Engineering 11 Computer Science and Engineering Semantic Web security –Data and meta-data security –Secure information sharing –Web application security Critical Infrastructure Protection –Economic and social aspects of cyber attacks –SCADA systems security Sample Research Directions Organizational Data Confidential Ontology Secure Data Integration and Inferences Public User Web Data Public Access Control Models Offense Defense Other Research – Policy Compliance – Online Privacy – Open source intelligence – Secure VANET communication

12. Computer Science and Engineering 12 Computer Science and Engineering Secure Semantic Web Web Data and Metadata Security –Semantic-Aware XML access control –RDF security policy –Stream data security Web Services (WS) Security –Service-level security across heterogeneous domains –Identity and trust management –Execution correctness, WS transactions

13. Computer Science and Engineering 13 Computer Science and Engineering Damage Assessment and Social Vulnerability Damage Estimation and Social Vulnerability –Damage of the target may not reflect the real amount of damage –Services may rely on the attacked service, causing a cascading and escalating damage –Identify characteristics to evaluate vulnerability of different social strata for cyber attack consequences Support decision makers to –Evaluate risk and consequences of cyber attacks –Support methods to prevent, deter, and mitigate consequences of attacks

14. Computer Science and Engineering 14 IA Jobs Job market –Civil (Join Information Systems Security Association, ISSA, https://www.issa.org/ ) –Government (Internship available at USC-UTS, and SC Dept. of Probation, Parole, and Pardon Services) –Military (Internship available at SPAWAR, Charleston) Education and training requirements (B.S. degree, certification, hands-on experiments) Salary FUN

15. Computer Science and Engineering 15 IA&S Certificate Program Admission Requirements Baccalaureate degree in computer science, computer engineering, or a related field Work experience as information security professional Admission requirements for graduate study at the Department of Computer Science and Engineering http://www.cse.sc.edu/GRADUATE/AdmissionsPage.html

16. Computer Science and Engineering 16 Graduation requirements 18 hours of graduate study with B average –9 hours core courses –9 hours of elective courses IA&S Certificate Program

17. Computer Science and Engineering 17 Core Courses CSCE 522 – Information Systems Security Principles –offered every Fall semester CSCE 715– Network Security –offered every Fall semester CSCE 727 – Information Warfare –offered every 3 rd semester

18. Computer Science and Engineering 18 Elective Courses CSCE 517 – Computer Crime and Forensics CSCE 557 – Introduction to Cryptography CSCE 548 – Secure Software Construction CSCE 716 – Design for Reliability CSCE 717 – Comp. Systems Performance CSCE 790 – Topic Course CSCE 813 – Internet Security CSCE 814 – Distributed Systems Security CSCE 824 – Secure Databases CSCE 853 – Formal Models of Information Security

19. Computer Science and Engineering 19 New undergraduate courses: CSCE 201: Introduction to Information Security

20. Computer Science and Engineering 20 Thank you!