Table Of ContentLecture Notes in Computer Science 6555
CommencedPublicationin1973
FoundingandFormerSeriesEditors:
GerhardGoos,JurisHartmanis,andJanvanLeeuwen
EditorialBoard
DavidHutchison
LancasterUniversity,UK
TakeoKanade
CarnegieMellonUniversity,Pittsburgh,PA,USA
JosefKittler
UniversityofSurrey,Guildford,UK
JonM.Kleinberg
CornellUniversity,Ithaca,NY,USA
AlfredKobsa
UniversityofCalifornia,Irvine,CA,USA
FriedemannMattern
ETHZurich,Switzerland
JohnC.Mitchell
StanfordUniversity,CA,USA
MoniNaor
WeizmannInstituteofScience,Rehovot,Israel
OscarNierstrasz
UniversityofBern,Switzerland
C.PanduRangan
IndianInstituteofTechnology,Madras,India
BernhardSteffen
TUDortmundUniversity,Germany
MadhuSudan
MicrosoftResearch,Cambridge,MA,USA
DemetriTerzopoulos
UniversityofCalifornia,LosAngeles,CA,USA
DougTygar
UniversityofCalifornia,Berkeley,CA,USA
GerhardWeikum
MaxPlanckInstituteforInformatics,Saarbruecken,Germany
Jan Camenisch Valentin Kisimov
Maria Dubovitskaya (Eds.)
Open
Research Problems
in Network Security
IFIP WG 11.4 International Workshop, iNetSec 2010
Sofia, Bulgaria, March 5-6, 2010
Revised Selected Papers
1 3
VolumeEditors
JanCamenisch
MariaDubovitskaya
IBMResearchZurich,Säumerstr.4
8803Rüschlikon,Switzerland
E-mail:{jca,mdu}@zurich.ibm.com
ValentinKisimov
UniversityofNationalandWorldEconomy
StudentskiGrad"Hr.Botev",1700Sofia,Bulgaria
E-mail:[email protected]
ISSN0302-9743 e-ISSN1611-3349
ISBN978-3-642-19227-2 e-ISBN978-3-642-19228-9
DOI10.1007/978-3-642-19228-9
SpringerHeidelbergDordrechtLondonNewYork
LibraryofCongressControlNumber:2011920837
CRSubjectClassification(1998):K.6.5,K.4,C.2,E.3,D.4.6,H.3.4-5
LNCSSublibrary:SL4–SecurityandCryptology
©IFIPInternationalFederationforInformationProcessing 2011
Thisworkissubjecttocopyright.Allrightsarereserved,whetherthewholeorpartofthematerialis
concerned,specificallytherightsoftranslation,reprinting,re-useofillustrations,recitation,broadcasting,
reproductiononmicrofilmsorinanyotherway,andstorageindatabanks.Duplicationofthispublication
orpartsthereofispermittedonlyundertheprovisionsoftheGermanCopyrightLawofSeptember9,1965,
initscurrentversion,andpermissionforusemustalwaysbeobtainedfromSpringer.Violationsareliable
toprosecutionundertheGermanCopyrightLaw.
Theuseofgeneraldescriptivenames,registerednames,trademarks,etc.inthispublicationdoesnotimply,
evenintheabsenceofaspecificstatement,thatsuchnamesareexemptfromtherelevantprotectivelaws
andregulationsandthereforefreeforgeneraluse.
Typesetting:Camera-readybyauthor,dataconversionbyScientificPublishingServices,Chennai,India
Printedonacid-freepaper
SpringerispartofSpringerScience+BusinessMedia(www.springer.com)
Preface
iNetSec 2010 is the main conference of working group WG 11.4 of IFIP. Orig-
inally, the conference was run in the traditional format where research papers
get submitted, peer-reviewed, and then presented at the conference. Because
there are (far too) many security conferences like that, it was decided in 2009
to change the format into a forum for the discussion of open research problems
and directions in network security.
To enable this more open style, while still remaining focused on particular
topics, we called for two-page abstracts in which the authors were asked to
outlineanopenresearchproblemordirection.Theseabstractswerereviewedby
theentireprogramcommitteewhorankedeachofthemaccordingtowhetherthe
problempresentedwasrelevantandsuitedforadiscussion.Basedonthis,about
half of the submitted abstracts were chosen for presentation and discussion at
the conference. The authors were asked to later write and submit full papers
based on their abstracts and the discussions at the workshop. These are the
papers that you are now holding in your hands.
The conference also hosted two invited talks. Basie von Solms (President of
IFIP) argued in his talk entitled “Securing the Internet: Fact or Fiction?” that
securecomputernetworksareanillusionwithwhichwehavetocope.Thepaper
tothetalkisalsocontainedintheseproceedings.LeonStraus(PresidentElectof
IFIP) shared his insights on “Network and Infrastructure Research Needs from
a Financial Business Perspective” which showed how much research can and
should learn from practitioners from all fields using computer technologies.
Onthelastdayoftheconference,theattendeesgatheredinalivelydiscussion
about security and cloud computing that opened the eyes of quite a few. The
social highlights of the conference were the Bulgarian dinner accompanied by
traditional live music and a guided tour through Sofia that despite the freezing
temperature was delightful and impressive.
We are grateful to the two invited speakers, the authors, the PC members,
and last but certainly not least, the local organizing committee.
September 2010 Jan Camenisch
Valentin Kisimov
iNetSec 2010
Open Research Problems in Network Security
University of National and World Economy, Sofia, Bulgaria
March 5-6, 2010
Organized in cooperation with IFIP WG 11.4
Executive Committee
ProgramChair Jan Camenisch, IBM Research – Zurich
Organizing Chair Valentin Kisimov, UNWE
Program Committee
Jan Camenisch IBM Research
Virgil Gligor Carnegie Mellon University
Jean-Pierre Hubaux EPFL
Simone Fischer-Hu¨bner Karlstad University
Dogan Kesdogan University of Siegen
Valentin Kisimov UNWE
Albert Levi Sabanci University
Javier Lopez University of Malaga
Refik Molva Eurecom
Local Organizing Committee
Valentin Kisimov IFIP TC11, UNWE
Dimiter Velev UNWE
Kamelia Stefanova UNWE
Vanya Lazarova UNWE
Table of Contents
Invited Talk and Scheduling
Securing the Internet: Fact or Fiction?.............................. 1
Basie von Solms
Open Research Questions of Privacy-EnhancedEvent Scheduling....... 9
Benjamin Kellermann
Adversaries
Event Handoff Unobservability in WSN............................. 20
Stefano Ortolani, Mauro Conti, Bruno Crispo, and Roberto Di Pietro
Emerging and Future Cyber Threats to Critical Systems.............. 29
Edita Djambazova, Magnus Almgren, Kiril Dimitrov, and
Erland Jonsson
AdversarialSecurity: Getting to the Root of the Problem ............. 47
Raphael C.-W. Phan, John N. Whitley, and David J. Parish
PracticalExperienceswithPurenet,a Self-learningMalwarePrevention
System ......................................................... 56
Alapan Arnab, Tobias Martin, and Andrew Hutchison
A Biometrics-BasedSolution to Combat SIM Swap Fraud............. 70
Louis Jordaan and Basie von Solms
Are BGP Routers Open to Attack? An Experiment .................. 88
Ludovico Cavedon, Christopher Kruegel, and Giovanni Vigna
Secure Processes
Securing the Core University Business Processes ..................... 104
Veliko Ivanov, Monika Tzaneva, Alexandra Murdjeva, and
Valentin Kisimov
Some Technologies for Information Security Protection in Weak-
ControlledComputerSystems andTheirApplicability foreGovernment
Services Users ................................................... 117
Anton Palazov
VIII Table of Contents
Real-Time System for Assessing the Information Security of Computer
Networks ....................................................... 123
Dimitrina Polimirova and Eugene Nickolov
Evidential Notions of Defensibility and Admissibility with Property
Preservation..................................................... 134
Raphael C.-W. Phan, Ahmad R. Amran, John N. Whitley, and
David J. Parish
Security for Clouds
Cloud Infrastructure Security...................................... 140
Dimiter Velev and Plamena Zlateva
Security and Privacy Implications of Cloud Computing – Lost in the
Cloud .......................................................... 149
Vassilka Tchifilionova
The Need for Interoperable Reputation Systems ..................... 159
Sandra Steinbrecher
Author Index.................................................. 171
Securing the Internet: Fact or Fiction?
Basie von Solms
President: IFIP
University of Johannesburg
Johannesburg, South Africa
[email protected]
1 Introduction
ThenumberofusersoftheInternet,inwhateverway,isgrowingatanexplosive
rate. More and more companies are rolling out new applications based on the
Internet, forcing more and more users to leverage these systems and therefore
becomeInternetusers.Socialnetworkingsites andapplicationsarealsogrowing
at alarming rates, getting more and more users, whom we can call home or
private users, involved and active on the Internet. Corporate companies are
now also integrating social networking as part of their way of doing business,
andgovernmentsareimplementingInternetbasedsystemsrangingfrommedical
applications to critical IT infrastructure protection.
Therefore millions of people are using the Internet for e-commerce, informa-
tion retrieval, research, casual surfing and many other purposes, and this will
just keep growing. One estimate is that the amount of data space needed to
supportthe fast growingonline economywill double every 11hours by 2012[1].
Inmost,ifnotall,oftheseactivitiesontheInternet,dataandinformationare
involved.This mayrangefromthe user’sIPaddressto securepersonalinforma-
tion,tosensitivecorporateinformationtocrucialnationalstrategicinformation.
The big question is, and has always been, how secure is all this information
and data, and can it be properly secured?
This of course has worried experts even since information was stored in elec-
tronic systems many years ago, but has become much more acute the last few
years with the explosive growth of the Internet, and the, in many cases, uncon-
trolled flocking of users to be part of Internet usage in some way or the other.
This paper objectively investigates this question, based on recent reports in
the area of Information Security and Cyber Crime.
In paragraph 2 we will investigate what can we understand under the term
“securing” of the Internet - what do we want to secure and why. In paragraph
3 we will give an overview of recent cyber crime statistics, and in Section 4 we
will give an opinion about the possibility of securing the Internet.
2 What Do We Mean by “Securing” the Internet?
It is important to investigate what we have in mind when we say we want to
secure the Internet, as there surely are different interpretations of this term. In
this paragraphwe will look at possible meanings of the term.
J.Camenisch,V.Kisimov,andM.Dubovitskaya(Eds.):iNetSec2010,LNCS6555,pp.1–8,2011.
(cid:2)c IFIPInternationalFederationforInformationProcessing2011
2 B. von Solms
2.1 The Ideal Interpretation
In the ideal and widest possible interpretation, we can say that securing the
Internetmeansthatalldataandinformationstoredonallwebsitesformingpart
oftheInternet,andalldataandinformationbeingtransportedovertheInternet
aresecuredsothatno unauthorizedpeople cansee (read)orchangethe content
(protecting the confidentiality and integrity of the data and information), and
that the data and information must be available to authorized users whenever
they want to use it (protecting the availability of the data and information.)
Thismeansthatallinformationinalldatabasesandintransitmustbesecured
and only accessible to the authorized users. Apart from extensive encryption
techniques to ensurethis, extensiveidentificationandauthenticationtechniques
must be available to ensure that every user is correctly identified and authen-
ticated, and logical access control is comprehensively enforced. These measures
must ensure that no person can masquerade as another person, and that elec-
tronic identities can only be successfully used by the real owners to which such
identities were issued.
To create this ideal interpretation, the following must be possible:
• we must know precisely what is part of the Internet, ie which computers,
servers and other equipment
• all these infrastructure must be controlled via legal systems to enforce the
required confidentiality, integrity and availability
• no unauthorized system can be connected to the Internet - authorized by
some (central?) managing power
• all users’ identity information must be protected in such a way that it can
never be compromised in any way
• allusersmustbeabsolutelyawareoftherisksofcompromisingtheiridentity
information
• legalsystemsmustexistinternationallywhichcanenforcetheserequirements
• etc etc
Even a person with no information security knowledge at all, will agree
straight forward that this ideal situation is NOT possible, because of the open
and uncontrolled way the Internet is operated and growing.
Therefore, in the light of the ideal interpretation of securing the Internet, as
discussed above, we must conclude
Securing the Internet is fiction - it is just not possible.
2.2 The Realistic Interpretation
Let us now investigate a more realistic interpretation. In this realistic interpre-
tation, we have to accept that
• there is no, and never will be any, central control over the Internet
• there is no way to know what the boundaries of the Internet are, i.e. which
systems are part of the Internet at any point of time
Securingthe Internet:Fact or Fiction? 3
• no legal systems exist (presently) which can enforce any reasonable security
(like enforcing encryption and proper identification and authentication)
• users do not protect their identity information, and are in most cases not
aware of the risk of not doing so
• in no way can masquerading, or unauthorized use of identity information
be prevented, as users are the weakest link in the chain and can always be
seduced to compromise their identity information
• cyber crime is rampant and leveraging any possible chink in the armor of
the Internet
Therefore, in the light of this realistic interpretation of securing the Internet
as discussed above, the author concludes
Securing the Internet is fiction - it is just not possible.
This conclusion will be motivated in the next paragraphs.
3 An Overview of Recent Cyber Crime Statistics
An overview of recent cyber crime statistics, provides a good place on which to
start and base a motivation for the view taken in the previous paragraph. In
this paragraph, we will investigate some recent international reports on cyber
crime, and try to get an impression of what is happening. The paragraph will
be unstructured in the sense that we will provide a few quotes from specific
reports, and then briefly comment on these in paragraph 4. Paragraph 5 will
provide some suggestions for the future.
3.1 The Sophos Security Threat Report - 2009 ([2])
Under the summary, Six Months at a glance:
• 23 500 infected websites are discovered every day. That’s one every 3.6 sec-
onds - four times worse than the same period in 2008
• 15newbogusanti-virusvendorwebsitesarediscoveredeveryday.Thisnum-
ber has tripled, up from averageof 5 during 2008
• 89.7% of all business email is spam
The report further makes the following very worrying statement:
“The vast majority of infected websites are in fact legitimate sites
that have been hacked to carry malicious code. Users visiting the web-
sites may be infected by simply visitingaffected websites, ...The scope
of these attacks cannot be underestimated, since all types of sites -
from government departments and educational establishments to em-
bassies and political parties ...- have been targeted.”
