We discuss the design and implementation of an interdisciplinary non-majors course Cybersecurity for future presidents, which broadens the types of computational courses available for non-majors. The goal of our course is to build awareness of cybersecurity issues and to promote thinking critically about them. Student debates on controversial cybersecurity issues facing society today motivate the technical and policy content. We present student assessment results, which demonstrate an increase of students' awareness, and outline directions for future course improvements.

Systems of programs control more and more of our critical infrastructures. Forty years of system development and research have taught us many lessons in how to build software that is reliable, relatively free of vulnerabilities, and can enforce security policies. Those years of experience seem not to have taught us how to get these lessons put into practice, particularly with respect to security, except in a few specialized places. This essay suggests an approach to capturing what we know in a way that can make a difference in systems on which we all rely.

The past and the future of privacy and cybersecurity are addressed from four perspectives, by different authors: theory and algorithms, technology, policy, and economics. Each author considers the role of the threat from the corresponding perspective, and each adopts an individual tone, ranging from a relatively serious look at the prospects for improvement in underlying theory and algorithms to more lighthearted considerations of the unpredictable futures of policy and economics.

This paper traces the history of cybersecurity research funding by the U.S. government. Difficulties in accurately measuring the level of U.S. government research funding for cybersecurity are first described. Some of the legislative and bureaucratic mechanisms involved in funding and reporting such research today are reviewed. A qualitative, personal perspective on the ups and downs of US cybersecurity research funding from the late 1960s to 2010 is then provided. The essay is written for the thirtieth anniversary meeting of the IEEE Symposium on Security and Privacy, held in May 2010.

This paper gives the main definitions relating to dependability, a generic concept including a special case of such attributes as reliability, availability, safety, integrity, maintainability, etc. Security brings in concerns for confidentiality, in addition to availability and integrity. Basic definitions are given first. They are then commented upon, and supplemented by additional definitions, which address the threats to dependability and security (faults, errors, failures), their attributes, and the means for their achievement (fault prevention, fault tolerance, fault removal, fault forecasting). The aim is to explicate a set of general concepts, of relevance across a wide range of situations and, therefore, helping communication and cooperation among a number of scientific and technical communities, including ones that are concentrating on particular types of system, of system failures, or of causes of system failures.

"Cyber Trust" is an umbrella term under which NSF/CISE has organized research focused on improving the ability of a computer-based component or system to repel, resist, detect, or tolerate malicious attacks while providing a desired function. Cyber Trust encompasses security (in terms of secrecy, confidentiality, integrity and availability), as well as privacy, correctness, reliability, safety and survivability. Three primary programs support Cyber Trust research: Trusted Computing, Data and Application Security, and Network Security. In addition, the Embedded and Hybrid Systems program is concerned with trust in all types of embedded software and control systems. These programs are coordinated within CISE, and the responsible Program Directors work to assure that proposals submitted to one program that seem more suited to a different one, and proposals in which the work straddles program boundaries, receive appropriate review. This talk will discuss the current Cyber Trust programs and NSF's plans for the area.

We favor an approach to building secure systems that includes an application-based security model. An instance of such a model and its formalization have been presented. Important aspects of the model are: (1) because it is framed in terms of operations and data objects that the user sees, the model captures the system's security requirements in a way that is understandable to users; (2) the model defines a hierarchy of entities and references; access to an entity can be controlled based on the path used to refer to it; (3) because the model avoids specifying implementation strategies, software developers are free to choose the most effective implementation; (4) the model and its formalization provide a basis for certifiers to assess the security of the system as a whole. Simplicity and clarity in the model's statement have been primary goals. The model's statement does not, however, disguise the complexity that is inherent in the application. In this respect, we have striven for a model that is as simple as possible but stops short of distorting the user's view of the system. The work reported demonstrates the feasibility of defining an application-based security model informally and subsequently formalizing it.

Research on access control models was started in the 1960s and 1970s by the two thrusts of mandatory and discretionary access control. Mandatory access control (MAC) came from the military and national security arenas whereas discretionary access control (DAC) had its roots in academic and commercial research laboratories. These two thrusts were dominant through the 1970s and 1980s almost to exclusion of any other approach to access control models. In the 1990s we have seen a dramatic shift towards pragmatism. The dominant access-control model of the 1990s is role-based access control (RBAC). It is now understood that RBAC encompasses MAC and DAC as special cases and goes beyond them in providing a policy-neutral framework. This SACMAT meeting has evolved from a highly successful and productive series of ACM workshops on RBAC. This panel will address the basic question of where do we go next with access control models. Do we need additional models or can we simply evolve the current set of RBAC models? Is RBAC fundamentally deficient in some way? Where should be go in terms of standards? Is there useful formal and theoretical work to be done in the access control models arena? The first meeting with the title SACMAT is a fitting place to address these questions.

In many environments, users log in to workstations and then leave them unattended. Rather than trying to stop users from doing what comes naturally, this paper suggests a simple, hardware-based system that can protect computers in such an environment from unauthorized use by people with physical access to the monitor and keyboard. Requirements for the system are described some design issues are discussed, and a sketch of a design for an initial prototype is provided, together with an assurance argument for it. A prototype implementing many of the concepts described has been built; two dozen copies of a second prototype are soon to be installed in an office environment.

This paper describes the basic principles of designing and administering a relatively secure network. The principles are illustrated by describing the security issues a hypothetical company faces as the networks that support its operations evolve from strictly private, through a mix of Internet and private nets, to a final state in which the Internet is finally integrated into its operations and the company participates in international electronic commerce. At each stage, the vulnerabilities and threats that the company faces, the countermeasures that it considers, and the residual risk the company accepts are noted. Network security policy and services are discussed, and a description of Internet architecture and vulnerabilities provides additional technical detail underlying the scenario. Lastly, a number of building blocks for secure networks are presented that can mitigate some of the vulnerabilities.

Current projects aimed at providing MLS computing services rarely seem to exploit advances in related fields. Specifically, the concepts of data distribution, replication, and interoperation are currently receiving much attention in the commercial database system sector but have yet to be applied to the delivery of MLS computing services. This paper explains how these concepts might kelp deliver MLS computing services relatively, quickly and cheaply, and how they can ease integration of legacy systems and new technology into future MLS cooperative, distributed computing environments.>

Public descriptions of capability-based system designs often do not clarify the necessary details concerning the propagation of access rights within the systems. A casual reader may assume that it is adequate for capabilities to be passed in accordance with the rules for data copying. A system using such a rule cannot enforce either the military security policy or the Bell and LaPadula rules. The paper shows why this problem arises and provides a taxonomy of capability-based designs. Within the space of design options defined by the taxonomy we identify a class of designs that cannot enforce the Bell-LaPadula rules and two designs that do allow their enforcement.

Public descriptions of capability-based system designs often do not clarify the necessary details concerning the propagation of access rights within the systems. A casual reader may assume that it is adequate for capabilities to be psssed in accordance with the rules for data copying. A system using such a rule cannot enforce either the military security policy or the Bell and LaPadula rules. The paper shows why this problem arises and provides a taxonomy of capability-based designs. Within the space of design options defined by the taxonomy we identify a class of designs that cannot enforce the Bell-LaPadula rules and two designs that do allow their enforcement.

This report develops a new set of criteria for evaluating computer architectures that are to support systems with security requirements. Central to these criteria is the concept of a domain, here interpreted as a set of information and authorizations for the manipulation of that information in a comput system. Architectural requirements are grouped in three categories: logical structure, the physical structure. These criteria were developed in order to assess the utility of Navy standard computers as bases for secure embedded systems, but they are not specific to those computers.

To provide a firm foundation for proofs about the security properties of a system specification or implementation, a formal statement of its security model is needed. This paper presents a formal model that corresponds to an informal, application-based security model for military message systems (MMS) that has been documented elsewhere. Following the formal statement, some considerations that led to its present form are discussed. The paper concludes with the statement of a "Basic Security Theorem" for the model.

Military systems that process classified information must operate in a secure manner; that is, they must adequately protect information against unauthorized disclosure, modification, and withholding.A goal of current research in computer security is to facilitate the construction of multilevel secure systems, systems that protect information of different classifications from users with different clearances.Security models are used to define the concept of security embodied by a computer system.A single model, called the Bell and LaPadula model, has dominated recent efforts to build secure systems but has deficiencies.We are developing a new approach to defining security models based on the idea that a security model should be derived from a specific application.To evaluate our approach, we have formulated a security model for a family of military message systems.This paper introduces the message system application, describes the problems of using the Bell-LaPadula model in real applications, and presents our security model both informally and formally.Significant aspects of the security model are its definition of multilevel objects and its inclusion of application-dependent security assertions.Prototypes based on this model are being developed.

Although the use of abstract types has been widely advocated as a specification and implementation technique, their use has often been associated with programming languages that are not widely available, and examples published to date are rarely taken from actual applications. SIMULA is a widely available language that supports the use of abstract types. The purposes of this paper are (1) to demonstrate the application of the concepts of data abstraction to a common problem; (2) to demonstrate the use of data abstraction in a widely available language; and (3) to provide a portable facility for statistics collection that may make the use of SIMULA more attractive. A discussion of the background of and requirements for an abstract type for statistics collection is presented, followed by a specification for the type using traces. A SIMULA implementation, with examples of its use, is given. Finally, implementation of the abstract type in other languages is discussed.

A relatively high level analytical model for computer systems serving both batch and interactive users is presented. The model is unusual in its employment of an endogenous priority scheme to represent a class of strategies for controlling service to the two types of customers. Numerical methods developed by V. L. Wallace are used to generate steady state probability distributions for the infinite state Markov chain formed by the model. Data from the Michigan Terminal System, which includes a load controlling mechanism of the type modelled, is used to validate the model. Finally, additional parameter studies indicate that the model reflects the dynamic behavior of such system in a reasonable way.