Everyone is encouraged (required? expected?) to present their ongoing work to the group. Email Jon McCune (jonmccune AT cmu.edu) with title and abstract if you want control over the date on which you present. We have tried two presenters per meeting (Fall 2007) and found that we generally run short on time. Thus, one presenter per meeting.

Policy change: We will allow practice talks if the talk itself consumes less than 30 minutes of the session, so that we have the remaining time for discussion. However, work-in-progress receives higher priority than practice talks, and we are striving for at least half of our meetings to cover work-in-progress.

All CSS meetings are at noon on Tuesdays and include lunch. We have CIC 2101 reserved but suits and checkbooks have the power to preempt us.

• Jan 15, 2008 CIC 2101
  Kami Vaniea. Visualizing Firewalls.
  Abstract: Much research has gone into creating methods detect, analyze and configure the behavior of firewalls but very little has looked at the best way to present that data in a useful way to network administrators. In this talk I will be covering the current research in firewall visualization and discussing it from a HCI perspective. I will also be presenting several potential research directions involving firewall visualization.
• Jan 29, 2008 CIC 2101
  Adam Pennington. Intrusion Detection Using Self-Securing Devices. Abstract: I'm going to be talking about some of my data gathered using a honeynet system. My work has been to look at the sorts of intrusion indications that IDSs embedded within parts of a computer system are able to see. By looking at what these embedded IDSs could have seen on our honeypot machines, we get an idea of the improvements they could offer.
• Feb 5, 2008 CIC 2101
  Michael Tschantz. Confidentiality Policy Extraction.
• Feb 12, 2008 CIC 2101
  Deepak Garg. A Proof Carrying File System.
• Feb 19, 2008 CIC 1301
  Dilsun Kaynar. Task-PIOA Framework for Analyzing Security Protocols: An Overview
• Feb 26, 2008 CIC 2101
  Juan Caballero. Can we build a general framework to study the robustness of a network?
• Mar 11, 2008 CIC 2101
  Scott Garriss. Trustworthy and Personalized Computing on Public Kiosks
  Abstract: Many people desire ubiquitous access to their personal computing environments. We present a system in which a user leverages a personal mobile device to establish trust in a public computing device, or {\em kiosk}, prior to resuming her environment on the kiosk. We have designed a protocol by which the mobile device determines the identity and integrity of all software loaded on the kiosk, in order to inform the user whether the kiosk is trustworthy. Our system exploits emerging hardware security technologies, namely the Trusted Platform Module and new support in x86 processors for establishing a dynamic root of trust. We have demonstrated the viability of our approach by implementing and evaluating our system on commodity hardware. Through a brief survey, we found that respondents are generally willing to endure a delay in exchange for an increased assurance of data privacy, and that the delay incurred by our unoptimized prototype is close to the range tolerable to the respondents.
  We have focused on allowing the user to personalize a kiosk by running her own virtual machine there. However, our work is generally applicable to establishing trust on public computing devices before revealing any sensitive information to those devices.
• Mar 18, 2008 CIC 2101
  Sasha Romanosky. Vulnerability management and risk analysis, including a live demo of a commercial tool, RedSeal.
• Mar 25, 2008 CIC 2101
  Elaine Shi. Private Google Docs.
  Abstract: I will describe an efficient crypto construction that allows us to build a private version of Google Docs.
• Apr 1, 2008 CIC 2101
  Orathai Sukwong. A Behavior-based Email Filtering System.
• Apr 22, 2008 CIC 2101
  Jason Franklin. Modeling and Analysis of Networked Secure Systems.
• May 6, 2008 CIC 2201
  Kyriaki Levanti. Modeling of Inter-domain Routing Policies.
• May 13, 2008 CIC 2101
  Kami Vaniea. Access-Control Administration: Tips, Tricks and Challenges.

About CSS

The group is semi-formal, in that one person begins by presenting their ongoing work (if it is accepted for publication, it is too polished; we like the rough stuff). Meetings are considered to be a success when discussion takes over and the presentation does not proceed as planned. The main point of CSS is to stay abreast of what our local peers are up to while helping them to refine and improve their work.

We encourage researchers of all abilities to attend, from undergrads to faculty. We encourage people to ask questions, even those that may seem "stupid", as they often lead to interesting discussions and insights. Example discussion and questions may include:

• What exactly is the problem solved? Often it is hard to understand exactly what problem is really being solved by the solution. An intro may have very general statements about a very vague problem, while the solution has many assumptions built in.
• Do you buy the solution? Do you think in reality the solution won't work, is too expensive, etc..
• What improvements can be made?
• What paper/advancement would you expect to be made next in this area?

Mailing Lists

We maintain an Andrew mailing list called "cylab-student-seminar". You can subscribe/unsubscribe/view archives via the CSS mailman site.

The email address is cylab-student-seminar@lists.andrew.cmu.edu. E-mail to the list and archives is restricted to CMU accounts.

Archives

• Fall 2007