Konstantin (Kosta) Beznosov news

Security Research Advances in 2009

Mon, 30 Nov 2009 12:45:11 -0800

I presented a 2009 review of academic research in computer security at Vancouver International Security Conference. This presentation reviewed latest scientific conference reports on the cutting edge research in computer security. It presented and explained 2009 highlights from IEEE Symposium in Security and Privacy, ACM Conference in Computer and Communications Security (CCS), Symposium on Network and Distributed Systems Security (NDSS), and Symposium on Usable Privacy and Security (SOUPS).

Secure Web 2.0 Content Sharing Beyond Walled Gardens

Thu, 12 Nov 2009 06:48:52 -0800

My Ph.D. student San-Tsai Sun will be presenting at ACSAC an architecture, design, and implementation of a proposed system for Web 2.0 content sharing across content service providers (CSPs). With our approach, users use their existing email account to login to CSPs, and content owners use their email-based contact-lists to specify access policies. Users are assumed to be equipped only with a Web browser and CSPs do not need to change their existing access-control mechanisms. In addition, policy statements are URI-addressable, and the same access policies can be reused and enforced across CSPs.

Full text of the paper is available.
More information can be found on the project page.

A Case Study of Enterprise Identity Management System Adoption in an Insurance Organization

Mon, 9 Nov 2009 07:08:23 -0800

LERSSE postdoc Kirstie Hawkey presented at CHIMIT a case study on the adoption of an enterprise identity management (IdM) system in an insurance organization. The paper describes the state of the organization before deploying the IdM system, and point out the challenges in its IdM practices. It describes the organization's requirements for an IdM system, why a particular solution was chosen, issues in the deployment and configuration of the solution, the expected benefits, and the new challenges that arose from using the solution. Throughout, the case study identifies practical problems that can be the focus of future research and development efforts. Our results confirm and elaborate upon the findings of previous research, contributing to an as-yet immature body of cases about IdM. Furthermore, our findings serve as a validation of our previously identified guidelines for IT security tools in general.. The work has been led by my Ph.D. student Pooya Jaferian.

Full text of the paper is available.

Revealing Hidden Context: Improving Mental Models of Personal Firewall Users

Thu, 16 Jul 2009 18:14:15 -0700

My Ph.D. student Fahimeh Raja presented a paper at SOUPS on her study of mental models user develop when they use Vista personal firewall.

paper abstract:  The Windows Vista personal firewall provides its diverse users with a basic interface that hides many operational details. However, concealing the impact of network context on the security state of the firewall may result in users developing an incorrect mental model of the protection provided by the firewall. We present a study of participants' mental models of Vista Firewall (VF). We investigated changes to those mental models and their understanding of the firewall's settings after working with both the VF basic interface and our prototype. Our prototype was designed to support development of a more contextually complete mental model through inclusion of network location and connection information. We found that participants produced richer mental models after using the prototype than when working with the VF basic interface; they were also significantly more accurate in their understanding of the configuration of the firewall. Based on our results, we discuss methods of improving user understanding of underlying system states by revealing hidden context, while considering the tension between complexity of the interface and security of the system.

More details can be found in the paper.

Diagnostic Work During the Detection and Investigation of Security Incidents

Fri, 26 Jun 2009 16:25:58 -0700

A study by the HOT Admin project team has been presented at HAISA. This study investigates how security practitioners perform diagnostic work during the identification of security incidents. Based on empirical data from 16 interviews with security practitioners, we identify the tasks, skills, strategies and tools that security practitioners use to diagnose security incidents. Our analysis shows that diagnosis is a highly collaborative activity, which may involve practitioners developing their own tools to perform specific tasks. Our results also show that diagnosis during incident response is complicated by practitioners’ need to rely on tacit knowledge, as well as usability issues with security tools. We offer recommendations to improve technology that supports the diagnosis of security incidents.