
11th Colloquium for Information Systems Security Education, Boston University Boston, June 2007
The 2007 CISSE proceedings was produced for the Colloquium for Information Systems Security Education by The Printing House, Inc. Abstracting is permitted with credit to the source. Libraries are permitted to photocopy beyond the limit of U.S. copyright law for private use of patrons those articles in this volume that carry a code at the bottom of the first page. All rights reserved. Copyright ©2007 by the Colloquium for Information Systems Security Education.
Abstract –This paper proposes the inclusion of a required course in information security for university students. College students possess an array of computer hardware, the ability to use Internet resources, and the savvy to find any music, movie, or game online but are ignorant about the fundamentals of information security. Often student computing behavior is reckless and exposes them, their data, and the university network to damage or legal liability. Information security professionals know the value of awareness, training, and education in information security. Awareness programs have not been successful in informing students about the risks they face online and the consequences of their computing behaviors.
Abstract— Experiential learning has been shown to be one of the best methods for learning, especially when combined with other forms of instruction. While much of the literature has illustrated experiential learning techniques for information assurance curriculum in general, the “Cryptography” course has not been studied in great detail with regard to experiential learning. We discuss exercises of multiple forms which demonstrate the intersection of experiential learning and cryptography.
Abstract— Cryptography is an essential component of America’s national security infrastructure. Billions of dollars are spent on cryptosystems every year, in both the public and private sector. Unfortunately, the field is rife with dubious claims, snake oil salesmen, and outright fraud. This paper highlights the importance of skepticism and critical thinking in the role of evaluating and procuring cryptosystems. We discuss our experiences in teaching future leaders about testing extraordinary cryptographic claims by asking hard questions, and show examples from our own experience. We believe that the rigorous application of skepticism and critical thinking in cryptography are absolutely essential to the wise use of America’s resources and the security of the nation.
Abstract— September 11 caused America to recognize the need to secure all parts of the nation’s critical infrastructure, including information technology. In 2002, the President released the National Strategy to Secure Cyberspace, a document that provides direction for strengthening cybersecurity. A key recommendation of the National Strategy to Secure Cyberspace is to build foundations for the development of security certification programs that will be broadly accepted by the public and private sectors. The Department of Homeland Security – National Cyber Security Division (DHS-NCSD) Training and Education Program has been tasked to lead these efforts by effectively articulating the needs of the public and private sector IT security community.
Abstract – To meet the current industry demand for qualified security professionals, we need innovative courseware that can help students apply information assurance theory into practice. This paper describes our experience in designing hands-on information assurance courseware that addresses the current demand. In addition, we have presented a survey instrument to assess our design based on the contents of lectures, the contents of laboratory exercises, the relevance between the lecture and laboratory exercises, and the overall impact of the class on students.
Abstract – This paper discusses aspects of a Network-Centric environment that should be considered as part of an information assurance course for the future.
Abstract – The Federal Information Security Management Act places obligations upon Federal agencies and their contractors, effected through National Institute of Standards and Technology standards and guidelines. FISMA compliance has, however, limited recognition beyond the Federal domain, whereas there is an increasing move in the private sector towards the international standard ISO/IEC 27001 (“Information security management systems – Requirements”), formally-certified conformity to which has widespread acknowledgement and international mutual recognition.
Abstract – A computer forensics course was offered during the 2006 Alaska Summer Research Academy (ASRA) at the University of Alaska Fairbanks. The two-week course provided a small number of high school students with the opportunity to gain experience in and an understanding of the field of digital forensics. Topics covered in the course included ethical issues related to digital forensics, digital footprints, forensics for digital media, and network-based forensics.
Abstract – This article briefly covers the need, feasibility and a potential solution for creating an Internet Portal for INFOSEC [1] professionals – in other words, access to an electronic knowledge base/dynamic. The major components are recommended to cover research, theory and sound practice within a multitude of INFOSEC environments: public, private, and non-profits. The connection to the major categories of the NSTISS 4011 standard is equally critical. The author proposes the establishment of an Internet Portal for INFOSEC professionals under the auspices of a neutral organization.
Abstract – The paper presents a known sequential and a new parallel/concurrent actor-oriented solution of the Dominator problem. The new parallel/concurrent actor-oriented Dominator algorithm computes sets of dominators of nodes of a given control flow graph in a parallel/concurrent actororiented way. The new Dominator algorithm is implemented as the multi-actor system in the Easel programming language. The new Dominator algorithm and its implementation are important contributions to the theory and practice of parallel / concurrent algorithms and actor-oriented programming. Because Dominator algorithm has applications in Information Assurance and Computer Security in detecting and locating program attacks – this novel and innovative Dominator algorithm may greatly influence these disciplines.