|
101.
|
Human, Organizational, and Technological Factors of IT Security
/ Kirstie Hawkey ; David Botta ; Kasia Muldner ; Rodrigo Werlinger ; et al
[LERSSE-RefConfPaper-2008-024]
This paper describes the HOT Admin research project, which is investigating the human, organizational, and technological factors of IT security from the perspective of security practitioners. [...]
Published in Hawkey, K., Botta, D., Muldner, K., Werlinger, R., Gagne, A., Beznosov, K., "Human, Organizational, and Technological Factors of IT Security" In CHI’08 extended abstract on Human factors in computing systems, pages 3639–3644, Florence, Italy, 2008.:
Transfer from CDS 0.99.7:  PDF;
|
|
102.
|
Detecting, Analyzing and Responding to Security Incidents: A Qualitative Analysis
/ Rodrigo Werlinger ; David Botta
[LERSSE-RefConfPaper-2007-024]
This study develops categories of responses to security incidents, based on a grounded theory analysis of interviews with security practitioners, with a focus on the tasks performed during security incidents, and the necessary resources to perform these tasks. [...]
Published in Rodrigo Werlinger,
David Botta, "Detecting, Analyzing and Responding to Security Incidents: A
Qualitative Analysis," in Workshop on Usable IT Security Management (USM'07), July 18, 2007, Pittsburgh, PA, USA.:
Transfer from CDS 0.99.7: PDF;
|
|
103.
|
Towards Understanding IT Security Professionals and Their Tools
/ David Botta ; Rodrigo Werlinger ; André Gagné ; Konstantin Beznosov ; et al
[LERSSE-RefConfPaper-2007-023]
We report preliminary results of our ongoing field study of IT professionals who are involved in security management. [...]
Published in David Botta, Rodrigo Werlinger, André Gagné, Konstantin Beznosov, Lee Iverson, Sidney Fels, Brian Fisher, "Towards Understanding IT Security Professionals and Their Tools" in Proceedings of the Symposium on Usable Privacy and Security (SOUPS), Carnegie Mellon University, Pittsburgh, PA, USA, July 18-20, 2007, pp.100-111.:
Transfer from CDS 0.99.7: PDF;
|
|
104.
|
Cooperative Secondary Authorization Recycling
/ Qiang Wei ; Matei Ripeanu ; Konstantin Beznosov
[LERSSE-RefConfPaper-2007-022]
As distributed applications such as Grid and enterprise systems scale up and become increasingly complex, their authorization infrastructures—based predominantly on the request-response paradigm—are facing challenges in terms of fragility and poor scalability. [...]
Published in Qiang Wei, Matei Ripeanu, and Konstantin Beznosov, "Cooperative Secondary Authorization Recycling," in Proceedings of the 16th Symposium on High Performance Distributed Computing (HPDC'07), June 25–29, 2007, Monterey, California, USA. pp.65-74:
Transfer from CDS 0.99.7: PDF;
|
|
105.
|
On the Imbalance of the Security Problem Space and its Expected Consequences
/ Konstantin Beznosov ; Olga Beznosova
[LERSSE-RefConfPaper-2007-021]
This paper considers the attacker-defender game in the field of computer security as a three-dimensional phenomenon [...]
Published in Konstantin Beznosov, Olga Beznosova "On the Imbalance of the Security Problem Space and its Expected Consequences," To appear in Symposium on Human Aspects of Information Security & Assurance (HAISA), Plymouth, UK, 10 July, 2007, pp.10. :
Transfer from CDS 0.99.7: PDF;
|
|
106.
|
Studying IT Security Professionals: Research Design and Lessons Learned
/ David Botta ; Rodrigo Werlinger ; André Gagné ; Konstantin Beznosov ; et al
[LERSSE-RefConfPaper-2007-020]
The HOT Admin Field Study used qualitative methods to study information technology security administrators. [...]
Published in David Botta, Rodrigo Werlinger, André Gagné, Konstantin Beznosov, Lee Iverson, Sidney Fels, and Brian Fisher, "Studying IT Security Professionals: Research Design and Lessons Learned" position paper at the CHI Workshop on Security User studies: Methodologies and Best Practices, San Francisco, CA, 28 April 2007, 4 pages.:
Transfer from CDS 0.99.7: PDF;
|
|
107.
|
A Security Analysis of the Precise Time Protocol (Short Paper)
/ Jeanette Tsang ; Konstantin Beznosov
[LERSSE-RefConfPaper-2006-019]
This paper reports on a security analysis of the IEEE 1588 standard, a.k.a [...]
Published in Jeanette Tsang, Konstantin Beznosov "A Security Analysis of the Precise Time Protocol (Short Paper)," In Proceedings of Eighth International Conference on Information and Communications Security (ICICS), Raleigh, North Carolina, USA, Springer-Verlag Berlin Heidelberg, LNCS 4307, 4-7 December, 2006, pp.50-59. :
Transfer from CDS 0.99.7: PDF;
|
|
108.
|
Multiple-Channel Security Architecture and Its Implementation over SSL
/ Yong Song ; Konstantin Beznosov ; Victor C.M. Leung
[LERSSE-RefJnlPaper-2006-003]
This paper presents multiple-channel SSL (MC-SSL), an architecture and protocol for protecting client-server communications. [...]
Published in Song, Y., Beznosov, K., and Leung, V. C. Multiple-channel security architecture and its implementation over SSL. EURASIP J. EURASIP Journal on Wireless Communications and Networking. 2006, 2 (Apr. 2006), 78-78.:
Transfer from CDS 0.99.7: PDF;
|
|
109.
|
The Secondary and Approximate Authorization Model and its Application to Bell-LaPadula Policies
/ Jason Crampton ; Wing Leung ; Konstantin Beznosov
[LERSSE-RefConfPaper-2006-017]
We introduce the concept, model, and policy-specific algorithms for inferring new access control decisions from previous ones. [...]
Published in Jason Crampton, Wing Leung, Konstantin Beznosov "The Secondary and Approximate Authorization Model and its Application to Bell-LaPadula Policies," In Proceedings of the ACM Symposium on Access Control Models and Technologies (SACMAT), Lake Tahoe, California, USA, ACM, 7-9 June, 2006, pp.111-120.:
Transfer from CDS 0.99.7: PDF;
|
|
110.
|
Extending XP Practices to Support Security Requirements Engineering
/ Gustav Boström ; Jaana Wäyrynen ; Marine Bodén, ; Konstantin Beznosov ; et al
[LERSSE-RefConfPaper-2006-016]
This paper proposes a way of extending eXtreme Programming (XP) practices, in particular the original planning game and the coding guidelines, to aid the developers and the customer to engineer security requirements while maintaining the iterative and rapid feedback-driven nature of XP. [...]
Published in Gustav Boström, Jaana Wäyrynen, Marine Bodén, Konstantin Beznosov, Philippe Kruchten, "Extending XP Practices to Support Security Requirements Engineering," Proceedings of Workshop on Software Engineering for Secure Systems (SESS), Shanghai, China, ACM, 20–21 May, 2006, pp.11-17.:
Transfer from CDS 0.99.7: PDF;
|
|
111.
|
Towards Agile Security Assurance
/ Konstantin Beznosov ; Philippe Kruchten
[LERSSE-RefConfPaper-2005-015]
Agile development methods are promising to become the next generation replacing water-fall development. [...]
Published in Proceedings of the workshop on New security paradigms, Nova Scotia, Canada: (2004) pp. 47-54
Transfer from CDS 0.99.7: PDF;
|
|
112.
|
Supporting Relationships in Access Control Using Role Based Access Control
/ John Barkley ; Konstantin Beznosov ; Jinny Uppal ; John Barkley ; et al
[LERSSE-RefConfPaper-2005-014]
The Role Based Access Control (RBAC) model and mechanism have proven to be useful and effective. [...]
Published in Proceedings of the Fourth ACM Workshop on
Role-Based Access Control, Fairfax, Virginia, USA: (October, 1999) pp. 55-65
Transfer from CDS 0.99.7: PDF;
|
|
113.
|
SPAPI: A Security and Protection Architecture for Physical Infrastructures and Its Deployment Strategy Using Sensor Networks
/ Hafiz Rahman ; Konstantin Beznosov
[LERSSE-RefConfPaper-2005-013]
In recent years, concerns about the safety and security of critical infrastructures have increased enormously. [...]
Published in Proceedings of 10th IEEE International Conference on Emerging Technologies and Factory Automation (ETFA 2005), Catania, Italy: (19-22 September, 2005) pp. 885-892
Transfer from CDS 0.99.7: PDF;
|
|
114.
|
Performance Considerations for a CORBA-based Application Authorization Service
/ Konstantin Beznosov ; Luis Espinal ; Yi Deng
[LERSSE-RefConfPaper-2005-012]
Resource Access Decision (RAD) Service allows separation of authorization from application functionality in distributed application systems by providing a logically centralized authorization control mechanism. [...]
Published in Proceedings of IASTED International Conference
Software Engineering and Applications, Las Vegas, Nevada: (November, 2000)
Transfer from CDS 0.99.7: PDF;
|
|
115.
|
Object Security Attributes: Enabling Application-specific Access Control in Middleware
/ Konstantin Beznosov
[LERSSE-RefConfPaper-2005-011]
This paper makes two primary contributions toward establishing support for application-specific factors in middleware security mechanisms. [...]
Published in Proceedings of 4th International Symposium on
Distributed Objects and Applications (DOA), Irvine,
California: (October 28 - November 1, 2002) pp. 693-710
Transfer from CDS 0.99.7: PDF;
|
|
116.
|
Implementing Multiple Channels over SSL
/ Yong Song ; Victor C.M. Leung ; Konstantin Beznosov
[LERSSE-RefConfPaper-2005-010]
Multiple-Channel SSL (MC-SSL) is our model and protocol for the security of client-server communication. [...]
Published in Yong Song, Victor C.M. Leung, and Konstantin Beznosov. Implementing multiple channels over SSL. In Proceedings of the 1st International Conference on E-business and Telecom-munication Networks, pages 246–253, Setubal, Portugal, 25-28 August 2004.:
Transfer from CDS 0.99.7: PDF;
|
|
117.
|
Here’s Your Lego™ Security Kit: How to Give Developers All Protection Mechanisms They Will Ever Need
/ Konstantin Beznosov
[LERSSE-RefConfPaper-2005-009]
By presenting a protection architecture for ASP.NET Web services, this paper demonstrates the feasibility of creating middleware mechanisms in the form of composable, flexible, and extensible building blocks. [...]
Published in Konstantin Beznosov, “Here’s Your Lego! Security Kit: How to Give Developers All Protection Mechanisms They
Will Ever Need,” in Proceedings of Software Engineering and Middleware (SEM) Workshop, pp. 3-18,
Linz, Austria, 20-21 September 2004.:
Transfer from CDS 0.99.7: PDF;
|
|
118.
|
eXtreme Security Engineering: On Employing XP Practices to Achieve “Good Enough Security” without Defining It
/ Konstantin Beznosov
[LERSSE-RefConfPaper-2005-008]
This paper examines practices of eXtreme Programming (XP) on the subject of their application to the development of security solutions. [...]
Published in Konstantin Beznosov. Extreme security engineering: On employing xp practices to achieve
"good enough security" without defining it. In First ACM Workshop on Business Driven
Security Engineering (BizSec), Faiffax, VA, USA, 2003. :
Transfer from CDS 0.99.7: PDF;
|
|
119.
|
Supporting End-to-end security Across Proxies with Multiple-channel SSL
/ Yong Song ; Victor C.M. Leung ; Konstantin Beznosov
[LERSSE-RefConfPaper-2005-005]
Secure Socket Layer (SSL) has functional limitations that prevent end-to-end security in the presence of untrusted intermediary application proxies used by clients to communicate with servers [...]
Published in Yong Song, Victor C.M. Leung, and Konstantin Beznosov. Supporting end-to-end security across proxies with multiple-channel SSL. In Proceedings of the 19th IFIP International Information Security Conference, pages 246–253, Toulouse, France, 23-26 August 2004.:
Transfer from CDS 0.99.7: PDF;
|
|
120.
|
Architecting a Computerized Patient Record with Distributed Objects
/ Kent Wreder ; Konstantin Beznosov ; A. Bramblett ; Eric Butler ; et al
[LERSSE-RefConfPaper-2005-004]
Published in Kent Wreder, Konstantin Beznosov, A. Bramblett, Eric Butler, A. D-Empaire, E. Hernandez, Eric Navarro, A. Romano, M. Tortolini-Taylor, E. Urzais, R. Ventura, "Architecting a Computerized Patient Record with Distributed Objects," in Proceedings of Healthcare Information and Management Systems Society Conference, Orange County Convention Center, Orlando, FL, USA, HIMSS, February, 1998, pp.149-158.:
Transfer from CDS 0.99.7: PDF;
|
|
121.
|
Applying Aspect-Orientation in Designing Security Systems: A Case Study
/ Shu Gao ; Yi Deng ; Huiqun Yu ; Xudong He ; et al
[LERSSE-RefConfPaper-2005-003]
As a security policy model evolves, the design of security systems using that model could become increasingly complicated [...]
Published in Shu Gao, Yi Deng, Huiqun Yu, Xudong He, Konstantin Beznosov, Kendra Cooper, "Applying Aspect-Orientation in Designing Security Systems: A Case Study," in Proceedings of The Sixteenth International Conference on Software Engineering and Knowledge Engineering (SEKE 04), Banff, Alberta, Canada, June 20-24, 2004, pp.360-365.:
Transfer from CDS 0.99.7: PDF;
|
|
122.
|
Supporting end-to-end Security Across Proxies with Multiple-Channel SSL
/ Yi Deng ; Jiacun Wang ; Jeffrey J. P. Tsai ; Konstantin Beznosov
[LERSSE-RefJnlPaper-2005-002]
Security system architecture governs the composition of components in security systems and interactions between them [...]
Published in Yong Song, Victor C. M. Leung, Konstantin Beznosov, Supporting end-to-end Security Across Proxies with Multiple-Channel SSL, Security and Protection in Information Processing Systems, Vol 147, 2004, 323-337 :
Transfer from CDS 0.99.7: PDF;
|
|
123.
|
A Resource Access Decision Service for CORBA-based Distributed Systems
/ Konstantin Beznosov ; Yi Deng ; Bob Blakley ; Carol Burt ; et al
[LERSSE-RefJnlPaper-2005-001]
Decoupling authorization logic from application logic allows applications with fine-grain access control requirements to be independent from a particular access control policy and from factors that are used in authorization decisions as well as access control models, no matter how dynamic those polices and factors are [...]
Published in Konstantin Beznosov, Yi Deng, Bob Blakley, Carol Burt, John Barkley, "A Resource Access Decision Service for CORBA-based Distributed Systems," in Proceedings of the Annual Computer Security Applications Conference (ACSAC), Phoenix, Arizona, U.S.A., 6-10 December, 1999, pp.310-319.:
Transfer from CDS 0.99.7: PDF;
|
|
124.
|
A Framework for Implementing Role-based Access Control Using CORBA Security Service
/ Konstantin Beznosov ; Yi Deng
[LERSSE-RefConfPaper-2005-002]
The paper shows how role-based access control (RBAC) models could be implemented using CORBA Security service [...]
Published in Konstantin Beznosov, Yi Deng, "A Framework for Implementing Role-based Access Control Using CORBA Security Service," in Proceedings of the Fourth ACM Workshop on Role-Based Access Control, Fairfax, Virginia, USA, ACM, October, 1999, pp.19-30.:
Transfer from CDS 0.99.7: PDF;
|
|
125.
|
Experience Report: Design and Implementation of a Component-Based Protection Architecture for ASP.NET Web Services
/ Konstantin Beznosov
[TEST-RefConfPaper-2005-001]
This report reflects, from a software engineering perspective, on the experience of designing and implementing protection mechanisms for ASP.NET Web services [...]
Published in Konstantin Beznosov, "Experience Report: Design and Implementation of a Component-Based Protection Architecture for ASP.NET Web Services," in Proceedings of the Eighth International SIGSOFT Symposium on Component-based Software Engineering (CBSE), St. Louis, Missouri, USA, SIGSOFT, 15-21 May, 2005, pp.337-352.:
Transfer from CDS 0.99.7: PDF;
|
|
126.
|
On the Benefits of Decomposing Policy Engines into Components
/ Konstantin Beznosov
[TEST-ARTICLE-2005-004]
In order for middleware systems to be adaptive, their properties and services need to support a wide variety of application-specific policies. [...]
Published in Konstantin Beznosov. Flooding and recycling authorizations. In Proceedings of the New
Security Paradigms Workshop (NSPW’05), pages 67–72, Lake Arrowhead, CA, USA, 20-23
September 2005. ACM Press.
:
Transfer from CDS 0.99.7: PDF;
|
|
127.
|
Flooding and Recycling Authorizations
/ Konstantin Beznosov
[TEST-ARTICLE-2005-003]
The request-response paradigm used for access control solutions commonly leads to point-to-point (PTP) architectures with security enforcement logic obtaining decisions from the authorization servers through remote procedure calls. [...]
Published in Konstantin Beznosov, "Flooding and Recycling Authorizations", in Proceedings of New Security Paradigms Workshop (NSPW), Lake Arrowhead, CA, USA, ACM, 20-23 September, 2005, pp.67-72.:
Transfer from CDS 0.99.7: PDF;
|
guest ::
