Department of Information Systems Colloquium

Beyond Reactive Management of Network Intrusions

Professor Sushil Jajodia
Center for Secure Information Systems
George Mason University

12:00pm Wednesday, 12 October 2011, ITE456, UMBC

This talk will discuss issues and methods for survivability of systems under malicious attacks. To protect from such attacks, it is necessary to take steps to prevent attacks from succeeding. At the same time, it is important to recognize that not all attacks can be averted at the outset; attacks that are successful to some degree must be recognized as unavoidable and comprehensive support for identifying and responding to attacks is required.

In my talk, I will describe the recent research on attack graphs that represent known attack sequences attackers can use to penetrate computer networks. I will show how attack graphs can be used to compute actual sets of hardening measures that guarantee the safety of given critical resources. Attack graphs can also be used to correlate received alerts, hypothesize missing alerts, and predict future alerts, all at the same time. Thus, they offer a promising solution for administrators to monitor and predict the progress of an intrusion, and take appropriate countermeasures in a timely manner.

I will conclude my talk with a demo of the working system.

Sushil Jajodia is University Professor, BDM International Professor, and the director of Center for Secure Information Systems in the Volgenau School of Engineering at the George Mason University, Fairfax, Virginia. He served as the chair of the Department of Information and Software Engineering during 1998-2002. He joined Mason after serving as the director of the Database and Expert Systems Program within the Division of Information, Robotics, and Intelligent Systems at the National Science Foundation. Before that he was the head of the Database and Distributed Systems Section in the Computer Science and Systems Branch at the Naval Research Laboratory, Washington and Associate Professor of Computer Science and Director of Graduate Studies at the University of Missouri, Columbia. He has also been a visiting professor at the University of Milan, Italy; Sapienza University of Rome, Italy; Isaac Newton Institute for Mathematical Sciences, Cambridge University, England; and King's College, London, England.

The UMBC ACM Student Chapter is co-hosting Interdisciplinary Engineering Panel Night at 7:00pm on Thursday 6 October 201 in the Commons Skylight Lounge. This free event is open to both undergraduate and graduate students in all engineering disciplines. Students have a chance to hear the perspective of professionals from industry, socializing and expanding their network. The event is co-sponsored with mechanical engineering (ASME), chemical engineering (AIChE), Device and the National Society of Black Engineers. Hors d’oeuvres will be served. Business casual dress suggested.

“I think it’s more than a jargon,” says Karuna Joshi of Cloud Computing, a topic she will discuss this Friday during a Computer Science and Electrical Engineering Department Colloquium, “It’s an actual paradigm shift.” Ms. Joshi, a Ph.D. candidate in Computer Science at UMBC, has been pursing research on Cloud Computing for the past three years and was recently awarded a prestigious IBM Ph.D. Fellowship (2011-2012) to help fund her efforts. Ms.Joshi explains that with the widespread implementation of Cloud Computing, Computing has the potential to become a utility—such as power or water—that would be widely available over a wireless network.

Though the cloud has the potential to save money and increase efficiency within organizations that choose to implement the new technology, there are still serious concerns about security, she says. What’s revolutionary about the cloud, for example, is that is removes the need to contain software and information on a particular device. Instead, information and services are wirelessly available to a network of users. The risk is that without proper security enforcement, sensitive information could potentially be accessed by hackers.

Nevertheless, Cloud Computing is steadily gaining credence among popular companies, says Joshi. Amazon, Microsoft and Google, for example, have all developed clouds. “I believe it will be strongly adopted by the industry,” says Ms. Joshi, “It’s the fastest growing field in the computing area.”  Even federal agencies have been mandated to move to a cloud system under the Federal Cloud Computing Initiative, as a way to reduce cost by consolidating necessary information and services into a central, easy to manage location.

Ms. Joshi explains that the novelty of the field makes her work exciting. The research allows her to explore issues that have not been addressed, such as the future of negotiation for acquiring services in the cloud. Through her research, Ms. Joshi has developed an ontology for the life cycle of the cloud that is composed of five phases: requirements, discovery, negotiation, composition and consumption. In addition, she is collaborating with the National Institute of Standards and Technology ( NIST) on a web-based prototype system.

Ms. Joshi envisions a future where powerful portable computing devices, like iPads, tablets and smartphones, will replace traditional computers. This future is only possible, explains Joshi,  if the widespread implementation of Cloud Computing and the transformation of computing into a service becomes a reality.

Ms. Karuna Joshi will speak about her research this Friday, October 7^th at 1 p.m. in ITE 227.