CRiSIS 2012 security standards tutorial

Setting Standards: Looking to the Internet for Models of Governance

The XML Signature Working Group — a joint technical committee of the Internet Engineering Task Force (IETF) and the World Wide Web Consortium (W3C) — aims at enabling digital signing of documents using XML syntax. This capability is critical for a variety of electronic commerce applications, including payment tools. Signatures can provide integrity, message authentication and/or authentication services for data of any type, whether located within the XML that includes the signature or located elsewhere. XML signatures are generated by a hash function from the collection of references to the objects being signed; its syntax associates the content of resources with a key via a strong one-way transformation. This paper will provide further information on this and the proposed XML encryption standard.

Overviews the challenging 5-year process leading to the design, specification, and implementation of the Internet, Engineering Task Force (IETF) Intrusion Detection Working Group (IDWQ) Intrusion Exchange Protocol (IDXP). IDXP seeks to facilitate the ubiquitous interoperability of intrusion detection components across Internet enterprises. This capability is a critical enabler of successful intrusion detection for large networks. The IETF IDWG was inspired by the DARPA CIDF activity. IDXP was developed and demonstrated in recent IETF meetings and in the IEEE DISCEX (DARPA Information Survivability Conference and EXposition). In the future, we intend to incorporate event correlation into IDXP. The process of achieving technical and organizational consensus among the segmented communities that comprise the information assurance community has been exceedingly challenging. The paper addresses the driving factors for this situation, and analyses the reasons for the ultimate community success in getting the process on the road. It is hoped that this experience would be useful in other technical disciplines facing large collaborative challenges within large secure distributed environments.

The WebRTC activity in the Internet Engineering Task Force (IETF) and World-Wide Web Consortium (W3C) is adding standards-based interactive multimedia conferencing features to web browsers. WebRTC systems are expected to see extremely wide deployment, starting in the next year. This deployment poses a challenge, since congestion control algorithms for interactive multimedia have not been standardised. The nature of interactive multimedia traffic complicates congestion control, and the interactions between WebRTC traffic, TCP flows, and the modern network worsen the problem. The region where congestion-controlled interactive multimedia traffic can feasibly co-exist with TCP is outlined, and areas where additional development seems necessary are highlighted.

This presentation describes Privacy-Enhanced Mail (PEM), a system to provide security for electronic messages. PEM protocols use end-to-end encryption to ensure writer-to-reader security for store-and-forward mail delivery through the Internet. This presentation also describes some of the infrastructure that will support PEM. The Internet is a rapidly growing system of several thousand interconnected computer networks that mainly support science and education. By 1992, the Internet already was serving more than a million host computers in over 100 countries. PEM was designed by a committee that is called the Privacy and Security Research Group (PSRG). A working group of the Internet Engineering Task Force (IETF) is responsible for preparing PEM specifications for publication as Internet standards.

This paper reports the results of an exploratory study on the Internet Engineering Task Force (IETF) specifications corpus in relation to the changes in volume, structure, and production of Internet standards. Using data spanning three decades, the authors examine changes in the production volume and type composition of IETF documents, their interdependency, and the level of collaboration involved in their production. Longitudinal changes in the standards corpus exhibit an increasing trend in interdependency, number of refinement steps, and number of authors, and additionally reveal that standards production is of an episodic nature with regular peaks in output volume. Complementary analysis on the network structure of dependencies highlights a trend toward compartmentalization of the system over the years involving the emergence of relatively isolated subsystems of related standards. The authors suggest that a perspective which considers a system like IETF as an organization itself, rather than a constellation of extra-organizational activities, is needed to understand and manage standardization processes like this one.

The Internet Protocol version 6 (IPv6) protocol represents an emerging networking capability designed to enhance transport, management and security of IP packets through the networks. IPv6 packet header required for this protocol is much larger than that of the current IPv4 protocol. The processing of IPv6 packets can be complex depending on how many packet header options are needed for a given mode of transmission. There are currently no standards available from Internet Engineering Task Force (IETF), the body that develops all Internet networking standards, related to the use of the flow label. The current IETF standards define the concept of flow of IP packets based on the three tuple of source and destination addresses and the flow label. This definition requires that the bit content of flow label be delivered unmodified at the destination end-system. However, this requirement has its disadvantages in that the network treats the flow label as a component of the fixed bit space of the packet header - not unlike the address bits. This paper discusses an emerging flow label technology called 6LSA and then examines the challenges associated with Flow Label implementation as originally conceived and the advantages of the current state of using the Flow Label.

At present, control system security efforts are primarily technical and reactive in nature. What has been overlooked is the need for proactive efforts, focused on the IT security research community from which new threats might emerge. Evaluating cutting edge IT security research and how it is evolving can provide defenders with valuable information regarding what new threats and tools they can anticipate in the future. Only known attack methodologies can be blocked, and there is a gap between what is known to the general security community and what is being done by cutting edge researchers --both those trying to protect systems and those trying to compromise them. The best security researchers communicate with others in their field; they know what cutting edge research is being done; what software can be penetrated via this research; and what new attack techniques and methodologies are being circulated in the black hat community. Standardization of control system applications, operating systems, and networking protocols is occurring at a rapid rate, following a path similar to the standardization of modern IT networks. Many attack methodologies used on IT systems can be ported over to the control system environment with little difficulty. It is extremely important to take advantage of the lag time between new research, its use on traditional IT networks, and the time it takes to port the research over for use on a control system network. Analyzing nascent trends in IT security and determining their applicability to control system networks provides significant information regarding defense mechanisms needed to secure critical infrastructure more effectively. This work provides the critical infrastructure community with a better understanding of how new attacks might be launched, what layers of defense will be needed to deter them, how the attacks could be detected, and how their impact could be limited.

The paper explores the role and legal protection of vulnerability reporters, namely cybersecurity researchers within the evolving EU cybersecurity framework. It examines who these researchers are, the value of their work, and the growing legal risks they face across Europe, as demonstrated by high-profile cases in the Netherlands, Malta, and Germany. Drawing on international human rights frameworks including EU Charter of Fundamental Rights, the paper argues that security research should be protected under the right to science and the freedom to conduct research. The paper advocates for defining ‘good-faith security research’ as a legally recognized safe harbour in EU law. A comparative analysis of selected international and EU legal frameworks, such as the UN Convention Against Cybercrime, Budapest Convention, EU Directive on attacks against information systems, the Cybersecurity Act, the NIS2 Directive, the Cyber Resilience Act, and national policies of a selected group of EU Member States, including the Netherlands, Belgium, France, Germany, Italy, Spain, Poland, Czechia, Slovakia, Malta along with the UK and the USA, reveals fragmented and insufficient protection. To address this, the paper calls for a coherent EU-wide framework based on two interlinked pillars: (i) mandatory coordinated vulnerability disclosure (CVD) procedures, and (ii) substantive legal exemptions for ethical security research. While the recent NIS2 Commission Implementing Regulation (EU) 2024/2690 for entities from digital infrastructure is a step forward, it lacks explicit protection for researchers. Therefore, the paper concludes with a call for integrating legal and technical safe harbours into EU cybersecurity legislation to ensure that vulnerability disclosure policies are not only adopted by entities but are also legally accessible and safe for the researchers, who rely on them.

A key advantage of the IP Multimedia Subsystem (IMS) is that it promotes the development of innovative multimedia services designed to bring an enhanced experience to the end user. The presenceand availability service is viewed as an indispensable feature for these next-generation services to help service providers generate new revenue and reduce churn. Numerous new services are currently being designed to take advantage of this feature. In this paper, we examine presence and availability in the context of IMS and describe its architecture as defined by the 3rd Generation Partnership Project/3rd Generation Partnership Project 2 (3GPP/3GPP2) and the Internet Engineering Task Force (IETF). In addition, we provide an analysis of presence updates and propose a user model and a traffic model to quantify the signaling traffic that such a feature can generate on a network. Through this model, network designers can examine the processing requirements for presence servers and other IMS components (i.e., call session control function [CSCF]) as well as the cost of transporting such traffic in the network.

This research-perspective article reviews and contributes to the literature that explains how to deter internal computer abuse (ICA), which is criminal computer behavior committed by organizational insiders. ICA accounts for a large portion of insider trading, fraud, embezzlement, the selling of trade secrets, customer privacy violations, and other criminal behaviors, all of which are highly damaging to organizations. Although ICA represents a momentous threat for organizations, and despite numerous calls to examine this behavior, the academic response has thus far been lukewarm. However, a few security researchers have examined ICA’s influence in an organizational context and addressed potential means of deterring it. However, the results of these studies have been mixed, leading to a debate on the applicability of deterrence theory (DT) to ICA. We argue that more compelling opportunities will arise in DT research if security researchers more deeply study its assumptions and more carefully recontextualize it. The purpose of this article is to advance a deterrence research agenda that is grounded in the pivotal criminological deterrence literature. Drawing on the distinction between absolute and restrictive deterrence and aligning them with rational choice theory (RCT), this paper shows how deterrence can be used to mitigate the participation in and frequency of ICA. We thus propose that future research on the deterrent effects of ICA should be anchored in a more general RCT, rather than in examinations of deterrence as an isolated construct. We then explain how adopting RCT with DT opens up new avenues of research. Consequently, we propose three areas for future research, which cover not only the implications for the study of ICA deterrence, but also the potential motivations for these types of offenses and the skills required to undertake them.

What are the key topics for Information Systems (IS) security researchers? How have these topics been changing, and what topics are emerging to offer new opportunities for research? We address these questions by analyzing the abstracts of 261 articles focusing on IS security that have appeared in leading IS journals and journals devoted to this area. Using Latent Semantic Analysis (LSA) to analyze the text of these abstracts uncovers five primary research topics: Security Design & Management, Business Operations Security, Behavioral Aspects, Authentication & Integrity Controls, and Prevention & Detection. These five primary topics are aggregates of more granular topics that are utilized to find trends to understand the changing complexion of IS security research. Our study contributes by developing the key topics and their trends in this area using an analytical and replicable method to synthesize the existing research.

The work described in this Ph.D. thesis has been carried out within the context of computer networks and real-time multimedia applications over the Internet. Specifically, we focus on conferencing, a challenging service which experienced a wide growth during the last years. We examine the standardization efforts conducted in this field by the Internet Engineering Task Force (IETF), which are mainly focused on centralized conferencing as defined by the XCON Working Group. We actively contributed to such efforts by designing and implementing the defined framework and protocols, while also writing best current practice documents which are on the path to become Request For Comments (RFCs). The main outcome of such activities has been Meetecho, a standards-compliant multimedia conferencing and collaboration platform we developed. Meetecho has been conceived at the outset to be extensible towards a distributed architecture, yet being fully compliant with the XCON specification, in order to better fulfill scalability requirements resulting from its large-scale deployment. The distributed architecture, which is the subject of the DCON (Distributed Conferencing) proposal we submitted to the IETF, is thoroughly described herein, where we also provide the reader with the results of a scalability analysis we conducted in order to assess the actual performance improvement attainable with distribution. The figures obtained have been encouraging and definitely motivated us in pushing our proposal into the Internet standardization community. Finally, a remarkable part of this dissertation is focused on diagnosing and addressing issues that might arise when deploying multimedia architectures in the actual Internet.

In June 1992, the Internet Activities Board sought to push the Internet Engineering Task Force into a solution for the Internet's address depletion problem. Its actions provoked a management crisis that forced a restructuring of the Internet standards governance process. Although the events have been characterized as a revolt by the Internet Engineering Task Force, this article revisits the preceding five years to show that the IETF, at least initially, sought to avoid the crisis.

Information technology exchange is a very important facet of life to many people in the world today. The biggest contributor to information exchange today is the Internet. Standardizing the Internet become an increasingly central issue as business interoperability demands mount. This paper explains about different standards bodies and the features of Internet standards developed and published under the coordination of different standards organizations. Keywords: ISOC (Internet Society),IETF(Internet Engineering Task Force),RFC(Request For Comment).