Purdue’s Spafford to Receive Two Top Honors in Cybersecurity

Purdue’s Spafford to Receive Two Top Honors in Cybersecurity


Purdue’s Spafford to Receive Two Top Honors in Cybersecurity

Posted: 17 Sep 2013 06:05 AM PDT

WEST LAFAYETTE, Ind. - Purdue University professor Eugene H. Spafford, a recipient of numerous honors and federal appointments, will soon receive two of the biggest awards in his field. The computer science professor and executive director of Purdue's Center for Education and Research in Information Assurance and Security will be inducted into the National Cyber Security Hall of Fame in Baltimore on Oct. 9. He also has been selected for the Harold F. Tipton Lifetime Achievement Award. The honors are by two separate organizations, but he was informed within hours from both entities of his selection. "What's special about these awards is the value of what I've done is seen outside of academia," said Spafford, a frequent cybersecurity source for national and international news media. "It's evidence that the work here makes a difference in the business and how people live their lives. It encourages others in academia that they can also make a difference and there is value in doing what we do. While succeeding in the academy, as a field, we are having an impact in many areas." Spafford, a Purdue faculty member since 1987, is one of the most recognized leaders in the information security field, having served as an adviser or consultant for major companies, law enforcement, academic and government agencies. He has served in roles with two U.S. presidents, and worked with the U.S. departments of Justice and Energy, the U.S. Air Force, National Security Agency, and Federal Bureau of Investigation. Among his honors, Network World named him in 2006 as one of the 50 most powerful people in networking. The Washington Post profiled him in 2000 as one of the most influential policy experts in information security. He has testified before Congress many times on cybersecurity. He was one of the first Morrill Award recipients at Purdue University, recognizing the significance of his contributions to scholarship, education, and service. The Harold F. Tipton Lifetime Achievement Award honors individuals for their overall contributions to the information security profession, according to the (ISC)2 website. (ISC)2 is a not-for-profit organization that educates and certifies information security professionals throughout their careers. "Dr. Spafford's innovations and advocacy have shaped the information security industry, and we are proud to recognize him for his body of work and lifelong service to our field," commented Board Awards Committee chair professor Corey Schou, Fellow of (ISC)2, CSSLP. "From being the first to analyze the Morris worm to having a prominent role in the Usenet backbone cabal, his work has propelled us light years ahead of where we would be without his contributions." The National Cyber Security Hall of Fame was created and is supported by companies and organizations committed to recognizing those who played a key role in the industry's creation, according to the hall's website. Writer: Jim Bush, 765-494-2077, jsbush@purdue.edu Source: Eugene Spafford, 765-494-7825, spaf@purdue.edu

Cryptographers Have an Ethics Problem (MIT Review)

Cryptographers Have an Ethics Problem (MIT Review)


Cryptographers Have an Ethics Problem (MIT Review)

Posted: 16 Sep 2013 06:44 AM PDT

Eugene Spafford, executive director of the CERIAS institute at Purdue University and an officer of the ACM, cautioned me against reaching simplistic ethical judgments. He said if a person is hacking computers and stealing messages to prevent a terrorist attack, they're not necessarily in violation of the society's code, which allows for "varying interpretations." More information »

Prof. Spafford Receives Lifetime Achievement Award

Posted: 16 Sep 2013 06:40 AM PDT

Press Release - 09/13/2013 (ISC) Security Congress 2013 – Chicago, IL, September 25, 2013 — (ISC) ("ISC-squared"), the world's largest not-for-profit information security professional body and administrators of the CISSP®, announced today that its Board of Directors has selected Dr. Eugene H. Spafford, Ph.D., CISSP, Fellow of the ACM, the AAAS, the IEEE and (ISC)2 and Distinguished Fellow of ISSA, as the recipient of the 2013 (ISC)2 Harold F. Tipton Lifetime Achievement Award, and Diana-Lynn Contesti, CISSP-ISSAP, ISSMP, CSSLP, SSCP, for the 2013 James R. Wade (ISC)2 Service Award. The prestigious Harold F. Tipton Lifetime Achievement Award recognizes an individual for lifelong contributions to the advancement of the information security profession. Named after Harold F. Tipton, CISSP, an industry pioneer and (ISC)2 co-founder, the award is given annually to recognize those who have dedicated themselves to carrying on Mr. Tipton's legacy of passionately promoting and enhancing the information security profession. An innovator and advocate for both technology and professionalism, Dr. Eugene H. Spafford has more than 30 years of experience in computing as a student, researcher consultant and professor, including 26 years as a professor of Computer Sciences at Purdue University. He is also the founder and Executive Director of the Center for Education and Research in Information Assurance and Security. Some of his work is at the foundation of current security practice, including intrusion detection – such as the first free, over the Internet intrusion detection system - Tripwire®, firewalls, and whitelisting. His most recent work has been in cyber security policy, forensics, and future threats. In 2012, he was named as one of Purdue's inaugural Morrill Professors — the university's highest award for the combination of scholarship, teaching, and service. Among many other activities, he is currently the chair of the Public Policy Council of ACM (USACM), is a member of the EPIC Advisory Board, and is editor-in-chief of the journal Computers & Security. In addition to being the selected as this year's Harold F. Tipton Award recipient, Dr. Spafford was just inducted to the National Cyber Security Hall of Fame. "Dr. Spafford's innovations and advocacy have shaped the information security industry, and we are proud to recognize him for his body of work and lifelong service to our field," commented Board Awards Committee chair Prof. Corey Schou, Fellow of (ISC)2, CSSLP. "From being the first to analyze the Morris worm to having a prominent role in the Usenet backbone cabal, his work has propelled us light years ahead of where we would be without his contributions." "I am honored to receive this prestigious and respected award," said Dr. Spafford. "Organizations like (ISC)2 remind us of the evolution the information security industry has seen over the last 30 years. I hope my work continues to contribute to that evolution and serves to bring greater awareness of the essential role information security plays in our society." The annual James R. Wade (ISC)2 Service Award recognizes volunteers who have made a sustained and valuable contribution to (ISC)2. The award's namesake was instrumental in shaping (ISC)2 and the information security profession through his active and tireless volunteerism. With over 25 years of experience in information security, Diana-Lynn Contesti is the Chief Information Security Officer (CISO) for a Global Fortune 100 company headquartered in Luxembourg. In this role, Diana provides oversight on the information security program and develops standards and guidelines that are used internationally. Prior to joining the global staff, she provided Information security best practices to the local organization, including developing policies, security awareness, forensic investigations, and data classification schemas. Diana has delivered many presentations on the security related to SCADA systems, as well as APT, UNIX security and securing Active Directory and is a published author of the Official (ISC)2 Guide to the SSCP® CBK® (first edition). An active (ISC)2 volunteer for 15 years, Ms. Contesti is a former Chair and current member of the (ISC)2 Board of Directors, serves on the (ISC)2 Application Security Advisory Board (ASAB) and recently championed the formation of the (ISC)2 Women in Security initiative, aimed at providing greater support for women in security and increasing awareness of information security as a career option for women at all stages of their lives. Additionally, Ms. Contesti has been a member of the item writing team for the past seventeen years and is an outgoing member of the North American Advisory Board (NAAB). "I knew Mr. Wade personally for many years, and I saw the change he inspired in our organization and the impact he had on the profession," reflected Ms. Contesti. "The honor I feel for being selected to receive this award in his namesake is indescribable. I am grateful to have the opportunity to give back to an industry and an organization that has given me so much." "Ms. Contesti's passion for the mission of (ISC)2 is an inspiration," added Schou. "This award does not begin to demonstrate our gratitude for her contributions, both to the organization and the members we serve. "Both Dr. Spafford's and Ms. Contesti's are inspiring examples for established and aspiring information security professionals alike. We applaud them for their achievements and devotion to furthering the information security profession and to inspiring a safe and secure cyber world for all." For more information on (ISC)2's awards programs, please visit www.isc2.org/awards. About (ISC)2 (ISC)2 is the largest not-for-profit membership body of certified information and software security professionals worldwide, with over 90,000 members in more than 135 countries. Globally recognized as the Gold Standard, (ISC)2 issues the Certified Information Systems Security Professional (CISSP) and related concentrations, as well as the Certified Secure Software Lifecycle Professional (CSSLP), the Certified Cyber Forensics Professional (CCFPSM), Certified Authorization Professional (CAP), and Systems Security Certified Practitioner (SSCP) credentials to qualifying candidates. (ISC)2's certifications are among the first information technology credentials to meet the stringent requirements of ISO/IEC Standard 17024, a global benchmark for assessing and certifying personnel. (ISC)2 also offers education programs and services based on its CBK®, a compendium of information and software security topics. More information is available at www.isc2.org.

Just sayin

Just sayin


Just sayin

Posted: 09 Sep 2013 06:44 PM PDT

In the June 17, 2013 online interview with Edward Snowden, there was this exchange: Question: Mathius1 17 June 2013 2:54pm Is encrypting my email any good at defeating the NSA survelielance? Id my data protected by standard encryption? Answer: Encryption works. Properly implemented strong crypto systems are one of the few things that you can rely on. Unfortunately, endpoint security is so terrifically weak that NSA can frequently find ways around it. I simply thought I'd point out a statement of mine that first appeared in print in 1997 on page 9 of Web Security & Commerce (1st edition, O'Reilly, 1997, S. Garfinkel & G. Spafford): Secure web servers are the equivalent of heavy armored cars. The problem is, they are being used to transfer rolls of coins and checks written in crayon by people on park benches to merchants doing business in cardboard boxes from beneath highway bridges. Further, the roads are subject to random detours, anyone with a screwdriver can control the traffic lights, and there are no police. I originally came up with an abbreviated version of this quote during an invited presentation at SuperComputing 95 (December of 1995) in San Diego. The quote at that time was everything up to the "Further...." and was in reference to using encryption, not secure WWW servers. A great deal of what people are surprised about now should not be a surprise -- some of us have been lecturing about elements of it for decades. I think Cassandra was a cyber security professor....

Prof. Spafford Selected for the National Cyber Security Hall of Fame

Posted: 09 Sep 2013 02:05 PM PDT

NEWS RELEASE Contact: info@cybersecurityhalloffame.com National Cyber Security Hall of Fame releases Final Selectees for the Class of 2013 Baltimore, MD (September 3, 2013): The National Cyber Security Hall of Fame, today released the names of 5 cyber security pioneers who will be enshrined in the National Cyber Security Hall of Fame on Wednesday, October 9th at a gala banquet in Baltimore. In announcing the inductees, Mike Jacobs, the first Information Assurance Director for the National Security Agency (NSA) and Chairman of the National Cyber Security Hall of Fame said, "these honorees continue to represent the best and the brightest of our past. These individuals helped define an industry and secure a nation." Of the more than 250 nominations reviewed, the board of advisors named 5 inductees to the 2013 Cyber Security Hall of Fame: Willis H. Ware – Ph.D., Princeton University, 1951. Pioneer in all aspects of computer technology from hardware and software to public policy and legislation; created the first definitive discussion of information system security, as Chair of a Defense Department committee, treating the subject as both a technical matter and policy issue. James Anderson (posthumously) – Effectively started the field of intrusion detection, invented the concept of the reference monitor and originated the idea of contaminated media and loading an altered OS, the "2-card loader" issue, whose intellectual successors are such things as Stuxnet, and advanced persistent threats(APT) and arguably was the first computer virus. Eugene Spafford –One ofthemost recognized leaders in the field of computing and information security. He has an on-going record of accomplishment as a senior advisor and consultant on issues of security and intelligence, education, cybercrime and computing policy to a number of major companies, law enforcement organizations, academic and government agencies. A pioneer in the field of information security education; inventor, with Eugene Kim developed the first free, over the Internet, intrusion detection system – Tripwire; and renowned for first analyzing the "Morris Worm" one of the earliest computer worms. David Bell – Co-authored the "Bell-La Padula model" (with Leonard J. La Padula), the most widely used security model and the only security model referenced in the Trusted Computer Systems Evaluation Criteria. Extended computer-security principles from the Trusted Computer Systems Evaluation Criteria into other contexts, such as trusted networks and trusted database systems. James Bidzos – Internet and security industry pioneer; He served as CEO of RSA Data Security from 1986 through 1999. Along with RSA co-founder and MIT professor Ron Rivest, Bidzos built RSA into the premier cryptography company in the 80s and 90s, becoming the early standard bearer for authentication and encryption; founded and continues to lead VeriSign; created the RSA Conference in 1991, and was the Chairman of the event until his retirement from that position in 2004. Nominations were made by qualified organizations engaged in cybersecurity and were ranked and reviewed by the board using established criteria in five categories: Technology; Policy; Public Awareness; Education; and Business. The 2013 class is composed of those individuals who collectively invented the technologies, created awareness, promoted and delivered education, developed and influenced policy and created businesses to begin addressing the cybersecurity problem. Biographies for the 5 inductees will be available at our website: www.cybersecurityhalloffame.com. Tickets for the Cyber Security Hall of Fame Dinner event are $250 and available at: www.FBCinc.com/CyberMDconference. The National Cyber Security Hall of Fame was established to honor the individuals and organizations with the vision and leadership to create the foundational building blocks for the cybersecurity industry. In addition to Jacobs, the board of advisors includes:Martin Hellman (Hall of Fame inductee inaugural class, 2012);John Grimes(former Chief Information Officer, Department of Defense); Karl Gumtow (CEO & Founder, Cyberpoint International); Susan Landau (Visiting Scholar,Harvard University); Francis Landolf(former Senior Executive, NSA), Robert Lentz(former Chief Information Security Officer, Department of Defense); Carl Landwehr (Hall of Fame inductee inaugural class, 2012);William Newhouse (Cybersecurity Advisor, NIST); Robert Rodriguez(Founder & CEO, SINET); Richard Schaeffer, (former Information Assurance Director, NSA); Corey Schou (Professor of Informatics, Idaho State University); and Brian Snow (former NSA Information Assurance Directorate technical director). The Hall of Fame motto, Respect the Past: Protect the Future recognizes the history and contributions of those pioneers, innovators and educators who influenced the industry and laid the foundation for the tens of thousands information security and assurance technologists working at universities, federal agencies and businesses today who stand sentry on tomorrow's cyber security challenges and solutions. The 2013 National Cyber Security Hall of Fame Gala is part of a two-day Cyber Security month celebration that includes CyberMaryland 2013 conference. This two-day conference at the epicenter of the nation's cybersecurity innovation and education, will create opportunities for networking and idea sharing amongst the many cyber leaders and professionals across the country, including: federal, state and local government agencies, academic institutions, cybersecurity entrepreneurs, and industry leaders of research and development. About the National Cyber Security Hall of Fame The National Cyber Security Hall of Fame organization has been created and is being supported by companies and organizations committed to recognizing the individuals that played a key role in the creation of the Cyber Security Industry. For more information go to http://www.cybersecurityhalloffame.com/

Prof. Spafford to Keynote ISSA International Conference

Prof. Spafford to Keynote ISSA International Conference


Prof. Spafford to Keynote ISSA International Conference

Posted: 06 Sep 2013 06:12 AM PDT

The Information Systems Security Association (ISSA) announced today a high-profile line-up of speakers for its fourth annual ISSA International Conference (#ISSAConf) to be held October 9-10 at the Nashville Convention Center in Nashville, TN. More information »

Computer Security History Workshop-Call For Papers

Computer Security History Workshop-Call For Papers


Computer Security History Workshop-Call For Papers

Posted: 28 Aug 2013 06:34 AM PDT

The Charles Babbage Institute (CBI) is conducting a three-year NSF funded research project on computer security, which focuses on the years when the field of "computer security" was just emerging, roughly the late 1960s through the early 1990s with the shift to networked computing and the web. We are "building an infrastructure" for future historical research through conducting 30 oral histories with computer-security pioneers, collecting archival documents, creating a knowledge-networking wiki site, and publishing scholarly work in this field. Charles Babbage Institute SRI International scientist and noted computer security pioneer Peter Neumann was quoted last year in the New York Time's article "Killing the Computer to Save It," that he has "…been tilting at the same windmills for 40 years and…[he]…get[s] the impression that most of the folks who are responsible don't want to hear about complexity. They are interested in quick and dirty solutions." Neumann is now heading a major DARPA effort to select the very best computer security ideas from the past to better address today's challenges. Many computer security pioneers emphasize that most of the potentially useful (and often ignored) solutions to the nation and world's many computer security challenges have fruitful seeds in the more distant past (and that today's problems often resulted from yesterday's choices in structuring computing and networking). The Charles Babbage Institute (CBI) is currently engaged in a three year National Science Foundation- sponsored project "Building an Infrastructure for Computer Security History." The project consists of conducting oral histories, creating a computer security wiki, and collecting and making available archival resources to document computer security's past. In conjunction with this project, CBI is hosting a workshop on computer security history on July 11 and 12, 2014 and is seeking paper proposals for the event. Preliminary plans have been laid to publish many of the revised papers from the workshop in a 2015 IEEE Annals of the History of Computing special issue on computer security. All papers must be historical studies—ranging from the technical, scientific, political, legal, social, and cultural history of computer security (contemporary analyses of current issues will not be considered). Potential topics include, but are not limited to the history of pioneering work funded by the military; Bell-LaPadula, Biba, Clark-Wilson and other computer security models; TCSEC/The Orange Book/Rainbow Series; public key encryption/PKI; computer crime/criminal justice; hacking and hackers; intrusion detection; computer security companies; and the computer security industry. Preference will be given for papers on U.S. topics between the mid-1960s and the advent of the Web in the early 1990s. Requirements and logistics To be considered for workshop participation, authors should send a 500-750 word abstract detailing their proposed paper, which includes discussion of the key sources for the study. Authors must also submit a 2-page curriculum vitae. Applications should be sent to cbi@umn.edu as PDF documents no later than Friday September 13, 2013. For accepted proposals, full papers (6000 to 8000 words including footnotes) must be submitted for pre-circulation to the workshop's participants by June 15, 2014. Travel assistance will be provided to all accepted applicants, as well as lunches and an event dinner on July 11, 2014. URL: http://www.cbi.umn.edu/research/cfp.html

Purdue researchers working on missile-defense software

Purdue researchers working on missile-defense software


Purdue researchers working on missile-defense software

Posted: 13 Aug 2013 06:10 AM PDT

Purdue University researchers are peering into the future to help the United States foil enemy missile attacks. Daniel DeLaurentis, left, an associate professor in Purdue University's School of Aeronautics and Astronautics and CERIAS Fellow, and Saurabh Bagchi, a professor in Purdue's School of Electrical and Computer Engineering and CERIAS Fellow, are working with the U.S. Missile Defense Agency to help the United States foil enemy missile attacks. More information »

Dr. Samuel Liles Discusses Digital Forensics, Cyberweapons

Dr. Samuel Liles Discusses Digital Forensics, Cyberweapons


Dr. Samuel Liles Discusses Digital Forensics, Cyberweapons

Posted: 02 Jul 2013 11:35 AM PDT

Professor Sam Liles talks about defining data, digital forensics, cyber weapons, potential responses to being hacked, and briefly touch on legal infrastructure underlying computer crime. TheLoopcast.com Your browser does not support the audio element. Podcast Powered By Podbean