2009 Agenda

Monday, July 27

Legal and Regulatory Developments for Privacy and Security
The politics of privacy and security have reached new heights as the Obama administration announces a comprehensive review of cybersecurity. While many in Washington are waiting to see what the White House proposes as the way forward, the Congress and federal agencies continue to craft legislation and regulations designed to combat concerns for identity theft, data protection, and safeguarding of our nation's critical infrastructure. This session will provide an update from Washington, focusing on recommendations from the administration and private sector groups that call for a comprehensive cybersecurity strategy.
Rodney Petersen

"Crimeware" Threats
Phishing has evolved from pure social engineering schemes to crimeware-based phishing systems using sophisticated technical subterfuge, sometimes blending both kinds of schemes in a single attack architecture. In this segment, Mr. Cassidy reviews genres of crimeware, the data they target and the mechanisms by which they propagate.
Peter Cassidy

Campus Life Online: Understanding Student Culture and Facebook
In this talk, the authors of Online Social Networking on Campus: Understanding What Matters in Student Culture (Routledge, 2009) will discuss the results of an empirical study of undergraduate college student use of the social networking site Facebook. They will pay particular attention to the meanings students make of their own use of this site, as well as implications for college administrators.
Ana Martínez Alemán and Katherine Lynk Wartman

Emerging Trends in Enterprise Security Metrics
Managers know that "you can't manage what you don't measure." Budget pressures and the need to demonstrate security effectiveness have led leading enterprises to embrace security metrics as a key discipline. In this talk, Forrester senior analyst and noted author Andrew Jaquith discusses prevailing trends in security metrics and measurement, identifies key best practices, and recommends areas for future research.
Andrew Jaquith

Break-out Session Abstracts

The Higher Education Bridge Certification Authority and the Four Bridges Forum (4BF)
Strong authentication of identity and thorough verification of devices is a mandatory requirement for critical cyber infrastructures. The use of Public Key Infrastructures (PKI) can provide stronger authentication of individuals and devices, and enable a host of security services based on the digital certificates they issue. This break-out session will include a discussion of the benefits of PKI on campus with information on the Higher Education Bridge Certification Authority (HEBCA) and Four Bridges Forum (4BF) which enable PKI certificates to be interoperable across major US federal agencies, US-based pharmaceutical companies, aerospace and defense contractors and colleges and universities.
Scott Rea

Pleasant Skies, or a Gathering Storm: The Good and Evil of Security Services in the Cloud
Staff and students participating with Dartmouth's Cyber Security Initiative (CSI) will discuss their research on performing security services in the cloud. The findings suggest that there are potential technical and cost benefits of using cloud services for a number of tasks including penetration testing, forensic analysis, security monitoring, honeypots, and various processor-intensive security procedures. However, those with malicious intentions could also reap these benefits and the team will address concerns such as anonymous use of cloud services, the risk of easy access to high-powered computing, and potential legal complications in dealing with attacks from the cloud.
Dartmouth's Cyber Security Initiative

The Phishing Education Landing Page
The primary motivation of the APWG/CMU CyLab Phishing Education Landing Page is to instruct credulous email users the moment they have placed themselves at risk: when they have clicked on a link in a phishing email. Why? Because that failure in judgment presents a "teachable moment" for someone who has almost fallen victim of a phishing attack - and is when training is most effective. Mr. Cassidy will introduce the landing page, explain its logistical architecture, and review some of the data about users who have been redirected to it developed by APWG's partners at CMU CyLab. See: http://education.apwg.org/r
Peter Cassidy

Anatomy of an RIAA File-sharing Lawsuit
An attorney for a defendant in an RIAA file-sharing suit and the defense's expert witness dissect aspects of these lawsuits on matters of interest to university computer departments. Put on your latex gloves and bring your scalpel.
Ashlyn Lembree and Sergey Bratus