As networked devices and applications make their way into our battlefields, their behaviors need to take into account these highly adversarial cyber-physical environments. On the dark side of the spectrum, undesired side-channels put our sensitive data at risk; hence, side-channel-protected devices and implementations should be promoted. On the bright side of the spectrum, side-channel analysis may be correlated with observed and hidden events, and enable causality inference and watermarking. This paper describes some unique risks and benefits that may be obtained from side-channel analyses in battlefields.

We need to greatly expand the community of faculty teaching cybersecurity using hands-on exercises. The number of security-focused competitions and exercises has increased in recent years so that faculty need to choose those that can best be integrated into their courses. As a community, we can contribute to each other/s projects. We would like to bring together both new and experienced faculty to build community. Our Facebook group (https://www.facebook.com/groups/TeachingCyber/) allows us to work together outside of SIGCSE events, and we are developing a critical mass of users. In the BoF, participants can sign up for the closed group. Participants will discuss answers to specific questions on teaching security. One goal of our BoF is to provide support for new members to learn about resources and get help. These resources include exercises, webinars, and slides. We will share experiences, practices and ongoing efforts, including our own (e.g. Security Injections, the Security Knitting Kit project, and EDURange). The BoF also benefits experienced members, helping them to disseminate their work and reach other faculty with similar interests. As a community we have begun to share exercises and discuss what works and what problems students and instructors have encountered. We will discuss ways to integrate security-related exercises into existing courses. The questions we will ask are, What materials and exercises have you tried? What are your experiences? How do we expand and improve cybersecurity education?

Cybersecurity is a topic of growing interest for CS educators. The goal of this workshop is to empower faculty to add hands-on security exercises to their courses. We introduce EDURange, a framework for accessing, developing and assessing interactive cybersecurity exercises. We want to reach and engage all students. The first step is to have interesting challenges that are easy to access. EDURange uses VMs in a public cloud, which also provides flexible resources. No software needs to be installed - students only need an ssh client. Another step is to give students feedback on how they are doing. This is an important role for faculty and is not something to automate. Instead, EDURange provides basic tools to visualize what students are doing as they work on the exercises. This allows instructors to more easily see when students are stuck or heading in the wrong direction. Since cybersecurity exercises are often easy to understand but hard to solve, guidance is especially important so that students don't become frustrated. In this workshop, participants will get to try EDURange and several exercises, including an introduction to ssh. Participants don't need to be security experts. We will provide sample syllabuses for an introductory security course as well as an interdisciplinary security course, and we will show how our exercises can be integrated into these courses. More information at http://www.edurange.org. Laptop required.

We have been teaching cybersecurity using hands-on, interactive exercises that have successfully engaged students. However, in order to meet the increasing demand for security professionals, we need to greatly expand the community of faculty teaching in this area. We would like to bring together new and experienced faculty to do this. Ambareen Siraj has set up a dedicated Facebook group to allow us to work together outside of SIGCSE events, but we need to develop a critical mass of users. During the BoF, we will encourage participants to sign up for the closed group, and we will have an exercise where they ask and answer questions about what they want from this learning community. One benefit of having a learning community is that it will be easier to provide support for new members to learn about resources and get help. These resources include exercises, webinars, and slides. We will share experiences, practices and ongoing efforts, including our own (e.g. Security Injections, the Security Knitting Kit project, and EDURange). The BoF also benefits experienced members, helping them to reach other faculty with similar interests. As a community we have begun to share exercises and discuss what works and what problems students and instructors have encountered. For the last five years, we have been doing that at SIGCSE. We will discuss ways to integrate security-related exercises into existing courses. The questions we will ask are, "What exercises have you tried? What are your experiences? What are you looking for from the community?"

We see teaching cybersecurity through hands-on, interactive exercises as a way to engage students. However, we also want to assess how much students are learning from these exercises, and the exercises themselves could be used to assess what students know. Creating new hands-on exercises requires significant preparation on the part of the instructor. As a community we have begun to share exercises and discuss what works and what problems students and instructors have encountered. The purpose of this BOF is two-fold: 1) to continue to bring together instructors who have developed hands-on exercises with those who would like to use them, and 2) extend the discussion to include assessment of student learning. We recognize that few CS programs can afford new required courses, so we will discuss ways to integrate security-related exercises into existing ones. This could include networking, OS, computer architecture, programming languages, software engineering, algorithms and programming (CS0, CS1, CS2). The questions we will ask are, "What exercises have you tried? What are your experiences? What are you looking for? What are the learning goals for your students? How do you assess them?"

Existing ethical agreements, as applicable in the teaching of information security courses, typically spell out rules on what students should and should not do. The main problem is that the question of what students should or should not do is not a settled issue, because personal stances on questions of morality and ethics fundamentally influence the ethical recommendations that teachers present to their students. In light of the growing level of malice in the computing domain, experts have highlighted the importance of information security ethics by debating the need for a standard code of ethics for information security. Arguably, differences in ethical stance, with the effect of divergent ethical agreements, will not efficiently serve the purpose of effective universal application of ethics in the field of information security education. Examining current ethical policies in information security courses can provide insight about the prevailing ethics within the information security community. Moreover, understanding what the prevailing philosophies on ethics are within the community, in terms of how they actually diverge or converge, will present a good projection of how a standard policy on ethics may be feasibly applicable in a future regulatory environment. This way, we may be able to forecast the nature of ethical norms that future professionals will accept or allow to be imposed on them. Therefore, in our survey, we analyze ethical agreements on information security courses to identify the nature of existing agreements. We determine the commonalities of these agreements and derive an ethical policy prototype that includes the common elements of 329 ethical policies.

Assessing student performance in cybersecurity labs and exercises is a difficult and time-consuming task. Simply recording the number of correct answers is inferior to in-depth assessment. Faculty are often best placed to offer expert feedback, advice, and guidance based on assessing student achievement and quality of performance for time-constrained exercises. Since this often takes place in the context of large classes and complex exercises, it can present obstacles to offering qualitative feedback. Yet, in some cases there is more information available that could simplify this task. This paper explores the use of command line history and visualization to add additional information and simplify the problem.

This paper reports on the experience of using the EDURange framework, a cloud-based resource for hosting on-demand interactive cybersecurity scenarios. Our framework is designed especially for the needs of teaching faculty. The scenarios we have implemented each are designed specifically to nurture the development of analysis skills in students as a complement to both theoretical security concepts and specific software tools.

We see teaching cybersecurity through hands-on, interactive exercises as a way to engage students. Some of the exercises that we have seen require significant preparation on the part of the instructor. Having a community makes it easier to share exercises, knowing what works and what problems students and instructors have encountered. The purpose of this BOF is to bring together instructors who have developed hands-on exercises, those who have used them and those who would like to. We recognize that few CS programs can afford new required courses, so we will discuss ways to integrate security-related exercises into existing ones. This could include networking, OS, computer architecture, programming languages, software engineering, algorithms and programming. The questions we will ask are, "What exercises have you tried? What are your experiences? What are you looking for?"

A panel at the New Security Paradigms Workshop (2014) discussed the topic of regulation and licensing of software developers and information security professionals. This included topics of the current state of certification, future possibilities, and challenges associated with new forms of regulation. This paper presents a brief background on the subject, three opinions presented by the panelists, and finally a summary of the discussion which occurred at the workshop, including input from both the panelists and the workshop attendees.

We see teaching information security through hands-on, interactive exercises as a way to engage students. Some of the exercises that we have tried require significant preparation on the part of the instructor. Having a community makes it easier to share exercises, knowing what works and what problems students and instructors have encountered. The purpose of this BOF is to bring together instructors who have used hands-on exercises and those who would like to. We recognize that few CS programs can afford new required courses, so we would be discussing ways to integrate security-related exercises into existing ones. This could include networking, OS, computer architecture, programming languages, software engineering and algorithms. The questions we will ask are, "What exercises, if any, have you tried" What are your experiences? What are you looking for?

Cybersecurity is a topic of growing interest for CS educators. The goal of this workshop is to provide faculty with tools and interactive exercises that would facilitate adding this topic to their curriculum. We will introduce the EDURange framework for developing interactive cybersecurity exercises. We have several exercises for participants to try, including network scanning and firewall configuration. We will give an introduction to some tools such as nmap, as well as the basic concepts. We have tested our framework several times in classrooms and workshops for students and faculty. One of its advantages is that faculty can use it in their classes with very little set-up. It uses Amazon's EC2/AWS to make the exercises readily available, so instructors will be able to access them with an account. We will also discuss other security exercises, including ones in the RAVE. It also provides each user with a number of VMs with tools and vulnerabilities. We will discuss using exercises as assessment tools. No previous experience in security is necessary. Laptop required. http://blogs.evergreen.edu/edurange

We see teaching cybersecurity through hands-on, interactive exercises as a way to engage students. Some of the exercises that we have seen require significant preparation on the part of the instructor. Having a community makes it easier to share exercises, knowing what works and what problems students and instructors have encountered. The purpose of this BOF is to bring together instructors who have used hands-on exercises and those who would like to. We recognize that few CS programs can afford new required courses, so we would be discussing ways to integrate security-related exercises into existing ones. This could include networking, OS, computer architecture, programming languages, software engineering and algorithms.

This workshop is intended for anyone who would like to use hands-on exercises in cybersecurity for a variety of classes including Networking, OS, Computer Security and Software Engineering. It has received increased attention nationally in the proposed ACM/IEEE CS2013 Curricula Guidelines. The goal of this workshop is to provide faculty with varied backgrounds (including none) in this area with some tools and interactive exercises to facilitate incorporating this knowledge area into their curriculum. We believe that it is important that students develop analytical skills, thus we include an introduction to EDURange1 and the Hacker Curriculum principles: (1) understanding failure modes and (2) seeing across or through layers of abstraction according to a particular scenario. We will guide attendees through exercises tailored to their level and interests. The exercises will include port scanning and setting up a firewall. These can be done at a range of levels from beginner to advanced. We will include an introduction to tools for packet inspection, which is an important part of analysis. Attendees will receive accounts on the RAVE2 with exercises that they can take back and use immediately with their classes. RAVE provides a number of VMs pre-configured for the exercises. RAVE is also a general purpose technology for other hands-on exercises. Laptop required.

One implicit purpose of writing software code is to communicate ideas. Commenting source code helps explain these ideas and provides background on the semantics of a program. Yet, enabling students to acquire good commenting practices remains difficult. Instructors can find it hard to meaningfully discuss such practices in both introductory and advanced undergraduate courses. Furthermore, comment grading is an imprecise, labor-intensive procedure at best. But just what practices should we be encouraging students to emulate? To help address these issues (learning about professional code commenting patterns and best practices, objectively grading student comments), we developed the COMTOR tool as an open source project and web service. COMTOR provides a platform for helping assess source code documentation in an objective, structured fashion. We conducted two experiments using COMTOR: one that examines a set of popular open-source Java code projects and one that measures a baseline of student-generated code comments. The latter are based on three semesters worth of data from two different undergraduate courses. Our aim is to extract knowledge about the state of professional practice in source code comments and how these properties vary over the lifetime of a project. We can then begin to make recommendations and communicate best practices (or a lack thereof) to our students.

Few, if any, pedagogical practices exist for helping students embrace best practices in writing software documentation, particularly source code comments. Although instructors often stress the importance of good commenting, two problems exist. First, it can be difficult to actually define these best practices, and second, it can be difficult to grade or assess students' application of such methods/practices. This Birds-of-a-Feather session focuses on capturing for dissemination a concrete list of code commenting best practices used by the attendees as they teach their classes.

Incorporating information security into the undergraduate curriculum continues to be a topic of interest to SIGCSE attendees. The purpose of this BOF is to help sustain the existing community of educators and researchers interested in bringing ethical hacking skills and an understanding of security into the classroom and relating these topics to the foundations of Computer Science. We would like to bring our colleagues together to share pedagogical practices, stories of hacking and how to use them to inspire our students and communicate complex concepts in computer science and security. We also plan to discuss our own experiences, practices and ongoing efforts (e.g., our infosec teaching experiences, the SISMAT program, EDURange and the dissemination of infosec interactive exercises). SISMAT is one of many alternatives for teaching cybersecurity to undergraduates. It is based on the "Hacker Curriculum" and includes a two-week summer intensive program, a research component and an internship. A description can be viewed at http://www.ists.dartmouth.edu/events/sismat/. An education in computer science can be an important resource in nurturing future leaders in cybersecurity, but only if we enable a community of educators willing to share approaches. This was highlighted by Sally Finch's keynote speech in 2010. At our BOF last year, several people had stories to share, and we plan to focus on that.

Death is an uncomfortable subject for many people, and digital systems are rarely designed to deal with this event. In particular, the wide array of existing digital authentication infrastructure rarely deals with gracefully retiring credentials in a uniform fashion.

Despite advances in software modularity, security, and reliability,offline patching remains the predominant form of updating or protecting commodity software. Unfortunately, the mechanics of hot patching (the process of upgrading a program while it executes) remain understudied, even though such a capability offers practical benefits for both consumer and mission-critical systems. A reliable hot patching procedure would serve particularly well by reducing the downtime necessary for critical functionality or security upgrades. Yet, hot patching also carries the risk -- real or perceived -- of leaving the system in an inconsistent state, which leads many owners to forego its benefits as too risky. In this paper, we propose a novel method for hot patching ELF binaries that supports (a) synchronized global data and code updates and (b)reasoning about the results of applying the hot patch. We propose a format, which we call a Patch Object, for encoding patches as a special type of ELF relocatable object file. Our tool, Katana, automatically creates these patch objects as a by-product of the standard source build process. Katana also allows an end-user to apply the Patch Objects to a running process. In essence, our method can be viewed as an extension of the Application Binary Interface (ABI), and we argue for its inclusion in future ABI standards.

Virtualization has seen a rebirth for a wide variety of uses; in our field, systems security researchers routinely use it as a standard tool for providing isolation and introspection. Researchers' use of virtual machines has reached a level of orthodoxy that makes it difficult for the collective wisdom to consider alternative approaches to protecting computation. We suggest that many scenarios exist where virtual machines do not provide a suitable tool or appropriate security properties. We analyze the use of virtual machines in the systems security space and we highlight other work that questions the current (ab)uses of virtualization.

The "Hacker Curriculum" exists as a mostly undocumented set of principles and methods for learning about information security. Hacking, in our view, is defined by the ability to question the trust assumptions in the design and implementation of computer systems rather than any negative use of such skills.

We describe Instruction-Set Randomization (ISR), a general approach for safeguarding systems against any type of code-injection attack. We apply Kerckhoffs' principle to create OS process-specific randomized instruction sets (e.g., machine instructions) of the system executing potentially vulnerable software. An attacker who does not know the key to the randomization algorithm will inject code that is invalid for that (randomized) environment, causing a runtime exception. Our approach is applicable to machine-language programs and scripting and interpreted languages. We discuss three approaches (protection for Intel x86 executables, Perl scripts, and SQL queries), one from each of the above categories. Our goal is to demonstrate the generality and applicability of ISR as a protection mechanism. Our emulator-based prototype demonstrates the feasibility ISR for x86 executables and should be directly usable on a suitably modified processor. We demonstrate how to mitigate the significant performance impact of emulation-based ISR by using several heuristics to limit the scope of randomized (and interpreted) execution to sections of code that may be more susceptible to exploitation. The SQL prototype consists of an SQL query-randomizing proxy that protects against SQL injection attacks with no changes to database servers, minor changes to CGI scripts, and with negligible performance overhead. Similarly, the performance penalty of a randomized Perl interpreter is minimal. Where the performance impact of our proposed approach is acceptable (i.e., in an already-emulated environment, in the presence of programmable or specialized hardware, or in interpreted languages), it can serve as a broad protection mechanism and complement other security mechanisms.

The efficacy of anomaly detection (AD) sensors depends heavily on the quality of the data used to train them. Artificial or contrived training data may not provide a realistic view of the deployment environment. Most realistic data sets are dirty; that is, they contain a number of attacks or anomalous events. The size of these high-quality training data sets makes manual removal or labeling of attack data infeasible. As a result, sensors trained on this data can miss attacks and their variations. We propose extending the training phase of AD sensors (in a manner agnostic to the underlying AD algorithm) to include a sanitization phase. This phase generates multiple models conditioned on small slices of the training data. We use these "micro- models" to produce provisional labels for each training input, and we combine the micro-models in a voting scheme to determine which parts of the training data may represent attacks. Our results suggest that this phase automatically and significantly improves the quality of unlabeled training data by making it as "attack-free" and "regular" as possible in the absence of absolute ground truth. We also show how a collaborative approach that combines models from different networks or domains can further refine the sanitization process to thwart targeted training or mimicry attacks against a single site.

The increasing centralization of networked services places user data at considerable risk. For example, many users store email on remote servers rather than on their local disk. Doing so allows users to gain the benefit of regular backups and remote access, but it also places a great deal of unwarranted trust in the server. Since most email is stored in plaintext, a compromise of the server implies the loss of confidentiality and integrity of the email stored therein. Although users could employ an end-to-end encryption scheme (e.g., PGP), such measures are not widely adopted, require action on the sender side, only provide partial protection (the email headers remain in the clear), and prevent the users from performing some common operations, such as server-side search. To address this problem, we present secure searchable automated remote email storage (SSARES), a novel system that offers a practical approach to both securing remotely stored email and allowing privacy-preserving search of that email collection. Our solution encrypts email (the headers, body, and attachments) as it arrives on the server using public-key encryption. SSARES uses a combination of identity based encryption and bloom filters to create a searchable index. This index reveals little information about search keywords and queries, even against adversaries that compromise the server. SSARES remains largely transparent to both the sender and recipient.

Polymorphic malcode remains a troubling threat. The ability formal code to automatically transform into semantically equivalent variants frustrates attempts to rapidly construct a single, simple, easily verifiable representation. We present a quantitative analysis of the strengths and limitations of shellcode polymorphism and consider its impact on current intrusion detection practice.

Most attacks on computing systems occur rapidly enough to frustrate manual defense or repair. It appears, therefore, that defense systems must include some degree of autonomy. Recent advances have led to an emerging interest in self-healing software as a solution to this problem. It is not clear, however, if the effort to create self-healing mechanisms is actually worth the cost in terms of development effort, deployment complexity, or runtime supervision and monitoring. Furthermore, no general purpose self-healing mechanisms have been shown to be achievable for general systems; it is hard to know beforehand exactly what an application should do in response to an arbitrary vulnerability. A number of very hard problems remain for researchers to explore before self-healing can be reliably applied to real computing systems. This paper provides a critique of the current state of the art and offers the position that self-healing as a concept should be relegated to the status of autonomic computing: a goal worth aiming for as a way to push the boundary of the possible rather than an achievable end in itself. Along the way, we identify a number of important but unsolved research problems in this space.

While biology has inspired much of the vocabulary in computer security, biologically-inspired security remains a controversial research strategy. This panel was convened to address the issue of biologically-inspired security by raising the question of whether there is anything left to learn. The discussion at NSPW touched on many issues, ranging from the nature of evolved and intelligent systems to whether anything in security works. The final consensus, however, was that while there may be promise in biologically-inspired defenses, we need to clarify our goals and develop better evaluation methodologies if we are to see further successes in such approaches.

In this paper, we present ShieldGen, a system for automatically generating a data patch or a vulnerability signature for an unknown vulnerability, given a zero-day attack instance. The key novelty in our work is that we leverage knowledge of the data format to generate new potential attack instances, which we call probes, and use a zero-day detector as an oracle to determine if an instance can still exploit the vulnerability; the feedback of the oracle guides our search for the vulnerability signature. We have implemented a ShieldGen prototype and experimented with three known vulnerabilities. The generated signatures have no false positives and a low rate of false negatives due to imperfect data format specifications and the sampling technique used in our probe generation. Overall, they are significantly more precise than the signatures generated by existing schemes. We have also conducted a detailed study of 25 vulnerabilities for which Microsoft has issued security bulletins between 2003 and 2006. We estimate that ShieldGen can produce high quality signatures for a large portion of those vulnerabilities and that the signatures are superior to the signatures generated by existing schemes.

This panel highlights a selection of the most interesting and provocative papers from the 2005 New Security Paradigms Workshop. This workshop was held September 2005 - the URL for more information is http://www.nspw.org. The panel consists of authors of the selected papers, and the session is moderated by the workshop's general chairs. We present selected papers focusing on exciting major themes that emerged from the workshop. These are the papers that will provoke the most interesting discussion at ACSAC.

A key problem facing current computing systems is the inability to autonomously manage security vulnerabilities as well as more mundane errors. Since the design of computer architectures is usually performance-driven, hardware often lacks primitives for tasks in which raw speed is not the primary goal. There is little architectural support for monitoring execution at the instruction level, and no mechanisms for assisting an automated response.This paper advocates modifying general-purpose processors to provide both program supervision and automatic response via a policy-driven monitoring mechanism and instruction stream rewriting, respectively. These capabilities form the basis of speculative virtual verification (SVV).SVV is a model for the speculative execution of code based on high-level security and safety constraints. We introduce architectural enhancements to support this framework, including the ability to supply an automated response by rewriting the instruction stream. Finally, given the novelty of the SVV approach to executing software, we briefly consider some important challenges for SVV-based systems.