The Center for Education and Research in Information Assurance and Security (CERIAS)

The Center for Education and Research in
Information Assurance and Security (CERIAS)

Reports and Papers Archive


Browse All Papers »       Submit A Paper »

Security Assessment of IP-based Networks: A Holistic Approach

CERIAS TR 1999-02
Mahesh V. Tripunitara,Eugene H. Spafford
Download: PDF
Added 2002-07-26

Security Policy Communication in a Distributed Network Element

CERIAS TR 99-01
Mahesh V. Tripunitara, Eugene H. Spafford
Download: PDF

This paper discusses the distributed network element concept as it pertains to the communication of security policies.  In the context of this paper, a security policy specifies access control rules on network traffic.  We introduce the problem and give a software architecture to solve it.  The solution has four components that form the distributed network element: the controler, adaptor, driver and network element.  We also discuss the application of the solution to two cases: one in which the network element is an ATM switch and the other in which the network element is an IP switch.

Added 2002-07-26

Issues in the Incorporation of Security Services into a Protocol Reference Model

COAST TR 98-03
Mahesh V. Tripunitara, E. H. Spafford
Download: PDF
Added 2002-07-26

The Compression Functions of SHA, MD2, MD4 and MD5 are not Affine

COAST TR 98-01
Mahesh V. Tripunitara, Samuel Wagstaff
Download: PDF
Added 2002-07-26

21st Century InfoSec Management and Beyond

Phil Venables

The world has changes and continues to change at an exponential rate. THis is having a major impact on the effective means to implement information security.  We have to look at some basic often highly regarded principles used successsfully and unsuccessfully in excuting or profession - and be prepared to throw them away.  Ranging from organisation, risk analysis, policy, technology through to the wider issues effecting security, this paper looks at a likely future and presents some of the key changes we need to undertake to ensure security functions at the heart of our businesses and affliliations.  THe conclusion is that is we don\‘t adapt we, as a profession, will be displaced by the correct action from our businesses

Added 2002-07-26


Software Forensics: Can We Track Code to its Authors?

E. H. Spafford, S. A. Weeber
Download: PDF
Added 2002-07-26

Computer Viruses as Artificial Life

E. H. Spafford
Added 2002-07-26

Observing Reusable Password Choices

E.H. Spafford
Download: PDF
Added 2002-07-26

Preventing Weak Password Choices

E.H. Spafford
Added 2002-07-26

Authorship Analysis Identifying the Author of a Program

COAST TR 94-08
Ivan Krsul
Download: PDF

Authorship analysis on computer software is a difficult problem. In this paper we explore the classification of programmers’ style, and try to find a set of characteristics
                            that remain constant for a significant portion of the programs that this programmer might produce. Our goal is to show that it is possible to identify the author of a
                            program by examining programming style characteristics. Within a closed environment the results of this paper support the conclustion that, for a specific set of
                            programmers, it is possible to identify the author of any individual program. Also, based on previous work and our observations during the experiments described herein
                            we believe that the probablity of finding two programmers who share exactly those characteristics should be very small.

Added 2002-07-26

Using the Techniques of a Security Assessment to Guide Technology Development in Education

CERIAS TR 1999-12
Stephanie Miller
Download: PDF

The goal of this thesis is to structure and present the complete process involved in implementing a security assessment.  Our objective is to capture the essence of a successful security assessment.  We will not only document best practices, but will outline such an assessment for a project underway in the School of Education and funded by the State of Indiana.  That project promotes improved evaluation of special needs students. The result of this work has been a concrete example of a security assessment methodology as well as a documented process that can be utilized as a template in future assessments.the assessment techniques we recommend in this thesis include project examination, threat analysis, modeling of data flows, and development of a security architecture. Other topics we will address throughout the document include fundamental security precautions, such as ensuring confidentiality, integrity, and availability. We will offer insight on dissemination of results to project sponsors and users to encourage the effectiveness of the deliverales produced during a security assessment.

Added 2002-07-26


Address Weaknesses in the Domain Name System Protocol

CSD-TR-94-028
Christoph L. Schuba
Added 2002-07-26

Countering Abuse of Name-Based Authentication

CSD-TR-94-029
Christoph L. Schuba, E.H. Spafford
Download: PDF
Added 2002-07-26