1^st International Conference on Information Systems Security (ICISS 2005)
19-21 December 2005
Organised jointly by the Center For Distributed Computing, Jadavpur University, Kolkata, India,
Center for Secure Information Systems, George Mason University, Fairfax, VA
 & The Birla Institute of Technology, Mesra, Ranchi, India

   Home

   Program

   Registration

   Author Instructions

   Committees

    Tutorials

   Proceedings

   Location

   Accommodation

   Sponsors

   Call For Papers

Exploiting Location-based and Video Information in Negotiated Access Control Policies

Abstract

As the global information infrastructure is becoming more and more pervasive, digital business transactions are increasingly performed using a variety of mobile devices and across multiple communication channels. In this new paradigm of distributed access, a much richer context representation regarding both users and the resources they access could be available to applications, potentially supporting highly expressive and intelligent policies regulating access and fruition. On the other hand, checking advanced context-related information when evaluating a policy involves several unsolved research issues. Predicates representing users' position and posture (e.g., as shown in a video feed), for instance, are semantically different from traditional ones inasmuch their outcome is both highly dynamic and uncertain. The aims of this work are threefold: (i) present some of our our recent work in dynamic context representation, including data streams encoding users location and video images. (ii) discuss the integration of dynamic context representation within current approaches to negotiated access control in a mobile environment.

Macquarie University
NSW 2109
Australia

Authorization and Trust Enhanced Security for Distributed Applications

Abstract

Security issues are becoming even more significant in the age of pervasive mobile networked computing where we have different types of information being used by mobile and fixed large scale distributed applications interacting over wireless and wired networks to deliver useful services to enterprises and users, fixed and mobile. Service oriented architectures and web services are being recognized as one of the key areas to businesses and applications in such a networked computing context.

This talk will begin first by considering some of the security challenges and issues in the area web services. We will outline some of the recent work that is being done in the area of web services security, which deal primarily with secure communications at the transport level. However considerable challenges remain in the design of large scale secure distributed applications based on web services at the higher levels of security policy and management.  The main focus of this talk will address the issues of authorization and trust in a federated distributed environment. In this context, we will describe some of our current work in the area of secure authorization service for practical large scale distributed systems. We will present the design of web services authorization architecture and discuss its implementation within the .NET framework. Then we will describe some of our work in the area of trust in distributed systems. In particular, we will describe the notion of “hybrid” trust models, which bring together the so called “hard” trust (based on traditional security mechanisms) with the “soft” trust based on social control aspects such as recommendations, observations and experience. We will outline some of our work in this area of combining hard and soft trust and integrating them to provide a trust enhanced authorization system for distributed applications.

Model-Carrying Code: A Framework for Safe Execution of Mobile and Untrusted Code

Abstract

Starting from Melissa email virus and continuing to some of the recent phishing attacks, malicious mobile code has become a major security threat facing the Internet today. Yet, the use of such code has continued to expand. Mobile code appears in many forms such as ``active web pages,'' multi-media viewers and players, games, P2P applications and freeware/shareware applications. Current approaches for mobile/untrusted code security haven't been very successful. Virus and malicious code detection techniques rely on attack signatures, and are hence limited to previously known attacks. Behavior confinement ("sandboxing") techniques can cope with unknown malicious behavior, but often end up preventing benign code from carrying out useful functions. In contrast, we describe a new framework, called model-carrying code (MCC), that enables code consumers to benefit from benign mobile code, while minimizing the risk of damage due to malicious or faulty behavior. In this talk, I will describe the MCC framework, and summarize the key techniques that we have developed in intrusion detection, model-checking, security policy enforcement, and isolated program execution in order to realize this framework. We conclude with a discussion of our experiences in incorporating MCC seamlessly into tools that serve as conduits for untrusted code, including software installers, email handlers, and browsers.

Understanding Mutable Internet Pathogens or How I Learned to Stop Worrying and Love Parasitic Behavior

Abstract

Worms are becoming increasingly hostile. The exponential growth of infection rates allows small outbreaks to have worldwide consequences within minutes. Moreover, the collateral damage caused by infections can cripple the entire Internet. While harmful, such behaviors have historically been short-lived. We assert the future holds much more caustic malware. Attacks based on mutation and covert propagation are likely to be ultimately more damaging and long lasting. This assertion is supported by observations of natural systems, where similarly behaving parasites represent by far the most successful class of living creatures. This talk considers a parasite for the Internet, providing biological metaphors for its behavior and demonstrating the structure of pathogens. Through simulation, we show that even with low infection rates, a mutating pathogen will eventually infect an entire community. We posit the inevitability of such parasites, and consider ways that they can be mitigated.

	Prem Chand	Vice President, Mahindra-British Telecom Limited, Sharda Centre, Off Karve Road, Pune 411004, Maharashtra, India.
Building India the Destination for Secure Software Development - Next Wave of Opportunities for the IT Industry Abstract Information and Communications Technology is becoming synonymous with the survival and sustenance of human race in social, economic, political and military terms. As a result of this the security of ICT is becoming a serious global concern. USA alone looses about $38B in security lapses and tracking of virus incidents alone runs into the range of $80B per year worldwide. These losses are incurred despite an estimated security market size of $36B expected by the year 2007-08. There are no foolproof solutions in sight. Software is the lynchpin of information systems. However software is prone to suffer disability, damage, denial, disruption or destruction in information systems. Thus insecure software is the single most serious security concern being faced by the society. The new focus across the global ICT community is therefore to eliminate threats and vulnerabilities to software by removing the root causes of its weaknesses by revisiting the life cycle approach to software engineering, whereby security is built into each stage rather than bolting it down as an after thought. The secure software is a demand of every customer. Efforts are underway in many countries to answer the call for this demand. In this talk I will present how ICT security is emerging a 21 century global nightmare, the new global vision of ICT security, where the world is moving to in the context of cyber security, why and how software is the weakest building block in ICT security journey, how the development of secure or trustworthy software can address majority of the cyber security concerns, what are the challenges of developing secure or trustworthy software, why a global initiative and collaboration is necessary, why should India position itself to be the secure or trustworthy software power house, what will it take India to create secure software development capability, what is India’s value proposition in terms of education, emerging R&D base, quality, manpower etc. to succeed in secure software initiative, how to mobilize India to develop secure software development capability. The analysis presented to build a case for India will cover protection of Information Age Infrastructures as immediate national necessity, standards driven security framework for National Information Infrastructures, life cycle approach to secure software development and outlines of a blue print for India to develop into a secure software development destination.

Vijay Varadharajan: Authorization and Trust Enhanced Security for Distributed Application

Technical Session-1

Trust Management and Delegation

Computer Science Department

University of Hertfordshire

England

School of Electrical Eng. & ComputerScience, Kyungpook National University. Korea

Computer Science Department

Colorado State University, 

Fort Collins, CO 80523

School of Computing and Information Technology,University of Western Sydney, Australia 

Patrick McDaniel: Understanding Mutable Internet Pathogens or How I Learned to stop Worrying and Love Parasitic behavior

Intrusion Detection, Fraud Detection and Cryptographic Applications

Cisco Systems, Inc., Banagalore

A I Lab, University of Hyderabad, Hyderabad, 500 046, INDIA

Department of Computer Science & Engineering, School of Information Technology, Indian Institute of Technology, Kharagpur, India

Dept. of Computer Science & Engineering, Indian Institute of Technology Kharagpur, INDIA-721302

Digital Certification Center,
Korea Financial Telecommunications and Clearings Institute, Korea

Department of Computer Science and Engineering, Mississippi State University, Mississippi State, MS 39762, USA

R Sekar: Model-Carrying Code: A Framework for Safe Execution of Mobile and Untrusted Code

Technical Session-3

Sensor, Ad hoc Network and Wireless Security

Department of Computer Science and Engineering, Indian Institute of Technology, Kharagpur-721 302, India

Department of Computer Science and Engineering, Indian Institute of Technology, Kharagpur-721 302, India

Applied Statistics Unit, Indian Statistical Institute, 203 B T Road, Kolkata 700 108, India

Ernesto Damiani: Exploiting Location based and Video Information in Negotiated Access Control Policies

Technical Session-4

Privacy, Access Control, Database and Network Security

Indian Institute of Technology, Delhi, India

MSIS Department and CIMIC

Rutgers University, Newark, NJ 07012, USA

GET/ENST Bretagne, 2 rue de la Chataigneraie, 35512 Cesson-Sevigne Cedex, France        

Institute for Development and Research in Banking Technology, IDRBT, Reserve Bank of India, Hyderabad, India

Department of Computer Science

Colorado State University

Fort Collins, CO 80523

College of Information Science & Technology, Nanjing University of Aeronautics and Astronautics, Nanjing, China, 210016

Prem Chand: Building India the Destination for Secure Software Development  -  Next Wave of Opportunities for the IT Industry

Lunch

“Whither Information Security Research & Education”

Concluding Session

Farewell Tea

Home   Call For Papers   Registration   Author Instructions   Committees  Tutorials   Proceedings   Location   Accommodation   Sponsors

Center For Distributed Computing Jadavpur University
Kolkata, India

Center for Secure Information Systems, George Mason University, Fairfax, VA

Birla Institute of Technology

Mesra Ranchi