Keynote Speaker

Dr. Daphne Yao is an associate professor of computer science at Virginia Tech. In the past decade, she has been working on designing and developing data-driven anomaly detection techniques for securing networked systems against stealthy exploits and attacks. Her expertise also includes data loss prevention, program analysis for security, and Android malware detection. Dr. Yao received her Ph.D. in Computer Science from Brown University. Dr. Yao is an Elizabeth and James E. Turner Jr. '56 Faculty Fellow and L-3 Faculty Fellow. She received the NSF CAREER Award in 2010 for her work on human-behavior driven malware detection, and the ARO Young Investigator Award for her semantic reasoning for mission-oriented security work in 2014. She has several Best Paper Awards (e.g., ICNP '12, CollaborateCom '09, and ICICS '06). She held multiple U.S. patents for her anomaly detection technologies. Dr. Yao is the lead program chair of 2018 IEEE Security Development Conference (SecDev). She is an associate editor of IEEE Transactions on Dependable and Secure Computing (TDSC). She serves as PC members in numerous computer security conferences, including ACM CCS and IEEE S&P. She has over 85 peer-reviewed publications in major security and privacy conferences, journals, and workshops. Daphne is an active member of the security research community. She serves as the Secretary/Treasurer at ACM Special Interest Group on Security, Audit and Control (SIGSAC).

Title: Data Breach and Multiple Points to Stop It Preventing unauthorized access to sensitive data is an exceedingly complex access control problem. In this keynote, I will break down the data breach problem and give insights into how organizations could and should do to reduce their risks. The talk will start with discussing the technical reasons behind some of the recent high-profile data breach incidents (e.g., in Equifax, Target), as well as pointing out the threats of inadvertent or accidental data leaks. Then, I will show that there are usually multiple points to stop a data breach, and give an overview of the relevant state-of-the-art solutions. I will focus on some of the recent algorithmic advances in preventing inadvertent data loss, including set-based and alignment-based screening techniques, outsourced screening, and GPU-based performance acceleration. I will also briefly discuss the role of non-technical factors (e.g., organizational culture on security) in data protection. Because of the cat-and-mouse-game nature of cybersecurity, achieving absolute data security is impossible. However, proactively securing critical data paths through strategic planning and placement of security tools will help reduce the risks. I will also point out a few exciting future research directions, e.g., on data leak detection as a cloud security service and deep learning for reducing false alarms in continuous authentication and the prickly insider-threat detection.

---

Mr. Thomsen's thirty-year career has focused on computer security and specifically understanding how security enforcement policy impacts and controls system. During his sixteen years at Secure Computing, Mr. Thomsen completed the TESLA and DARPA Napoleon projects that looked at very fine grained security policies that spanned an organization and organized them into a design framework that extended role-based access control. Mr. Thomsen’s work addresses the most challenging user interface problems, from increasing information transfer in presentations, to specifying complex security policy. Mr. Thomsen has researched how to understand complex security systems by organizing the hundreds of thousands of permissions into sets that are necessary to complete tasks. At Secure Computing he also researched and developed high assurance operating systems and secure DBMS. While at the Cyber Defense Agency, Mr. Thomsen led the ESPANOLA project, which treated security policy creation as a complex design problem, to capture the reoccurring patterns and share them like open source software. Mr. Thomsen is a senior member of IEEE and was the past program and conference chairs for the Annual Computer Security Applications Conference.

Title: Network Policy Enforcement Using Transactions: The NEUTRON Approach What could you do if you knew exactly what security permissions a network application needed and when it needed them? If you could capture and reason about the requirements of each network application it would open the door to new types of security enforcement. We propose capturing network application requirements in an object-oriented design language. With understanding, you can remove rarely used permissions and allow users to put them back when they need them, greatly reducing the attack surface of the network. This approach makes network enforcement part of a network transaction. Within strict bounds, administrators can give more control to end users, creating user-driven policy. The result is a least privilege in time policy. Refining access control models to distinguish between common behavior and rare behavior will increase security. The increased security comes with costs, such as requiring users to strongly authenticate more often. This talk will discuss those costs and weigh them against the benefits.

---

SACMAT Inaugural Junior Keynote Talk

Dr. Omar Haider Chowdhury is an Assistant Professor of Computer Science at the University of Iowa. Dr. Chowdhury's research focuses on leveraging formal machinery and techniques to solve practically-relevant security and privacy problems of emerging systems and protocols. At Iowa, Dr. Chowdhury currently co-directs the Computational Logic Center (CLC) and is also an active member of the Informatics Initiative (UI3). Before joining the University of Iowa, he held post-doctoral researcher positions at Carnegie Mellon University and Purdue University. He received his Ph.D. in Computer Science from the University of Texas at San Antonio. Dr. Chowdhury's research is currently supported by the National Science Foundation (NSF) and Defense Advanced Research Projects Agency (DARPA).

Title: How Inadequate Specification, Buggy Implementation, and Deficient Platform Support Hinder Security Developing a secure system (or, protocol) in general boils down to having a correct and robust specification which developers faithfully implement with the available platform support. Vulnerabilities can thus crop up due to inadequate specification, buggy implementations, or the lack of appropriate security construct in the platform. In this talk, I will present examples of insecurity due to inadequate specification, wrong implementations, and deficient platform support. In the first example, I will show how 4G LTE telecommunication protocol specification lacks security considerations which can be exploited by adversaries to have catastrophic impacts. Next, I will present how incorrect X.509 certificate validation implementations in open-source SSL/TLS libraries leave users prone to impersonation attacks. Finally, I will conclude my talk with a discussion of how lack of hardware support makes enforcing Digital Rights Management (DRM) policies infeasible for mobile devices.