Watch a video of an interview with William here.
]]>
The National Science Foundation awarded UMBC a third grant to continue its Scholarship for Service (SFS) cybersecurity scholarship program directed by computer science professors Alan T. Sherman (PI) and Roberto Yus (CoPI). The three-year award will support five new scholars majoring in CS, CE, or IS at the BS, MS, or PhD levels. Each year, scholars receive full tuition and fees and $6000 for professional expenses. In return, they must work for the government for each year of support at the federal, state, local, tribal, or territorial level. Scholars must be US citizens or permanent residents.Prospective scholars may apply by noon, September 12, 2025, via Scholarship Retriever.
Sherman (PI) and Richard Forno (CoPI) have directed UMBC’s SFS program since 2012, bringing over 12 million dollars to support cybersecurity at UMBC, including funds for scholarships and research activities of Sherman’s Cyber Defense Lab (CDL). UMBC has graduated over 100 SFS scholars, placing UMBC fifth in the nation for the number of SFS graduates. UMBC SFS scholars engage actively in research and hands-on learning. For example, each January, SFS scholars participate in a collaborative research project to analyze the security of some aspect of the UMBC network. In 2025, the scholars analyzed the security and privacy of a prototype of the new myUMBC search that integrates ChatGPT. Each summer, SFS scholars carry out an internship with the government.
Reflecting the growing importance of artificial intelligence and changing government funding priorities, new SFS scholars will be required to complete at least four AI courses in addition to completing a cybersecurity track. Previous innovations of UMBC’s SFS program included connecting scholars to local companies and government research labs, and extending SFS scholarships to two partner community colleges: Montgomery College and Prince George’s Community College.
At CDL, SFS scholars contribute to impactful research on several aspects of cybersecurity, including election security, formal-methods analysis of cryptographic protocols, and cybersecurity education. Recently, Sherman and his team have completed a security analysis of the SecureDNA system, which enables DNA synthesis labs to screen order requests against a database of known hazards. Sherman is a coauthor on a paper to be presented this fall at E-Vote-ID on a coercion-resistant voting system. In 2023, Sherman won best research paper at the SIGSCE conference for his paper on the psychometric validation of a cybersecurity concept inventory Drs. Sherman and former SFS scholar Golaszewski are organizing the 2026 Security Standardisation Research conference, which will take place in Baltimore.
CSEE professor Richard Forno writes about the conflicting interests highlighted by reports that prominent American national security officials used freely available encrypted messaging apps Signal and WhatsApp, which prevent anyone, including the government and the app companies, from reading messages they intercept. He explores the complex technical, political, and social issues underlying the topic. You can read the article online on the UMBC Magazine site and The Conversation.
UMBC’s Department of Information Technology (DoIT) has a post and video on graduating computer science senior Ethan Cheung. For several years, he worked as an intern as part of DoIT's Cybersecurity Assurance and Digital Trust team. After graduation, he will take on a new role as a cybersecurity engineer at MITRE, applying the skills and knowledge he acquired at UMBC to real-world scenarios and contributing to the protection of critical data and infrastructure.
Find out more in this news article and a video of Ethan discussing his experiences at UMBC and working on cybersecurity for DoIT.
Joint work with Yuechun Gu and Jiajie He
To appear, 2015 Int. Conf. on Knowledge Discovery and Data Mining
With increasingly deployed deep neural networks in sensitive application domains, such as healthcare and security, it is essential to understand what kind of sensitive information can be inferred from these models. Most known model-targeted attacks assume attackers have learned the application domain or training data distribution to ensure successful attacks. Can removing the domain information from model APIs protect models from these attacks? Our work studies this critical problem. Unfortunately, even with minimal knowledge, i.e., accessing the model as an unnamed function without leaking the meaning of input and output, the proposed adaptive domain inference (ADI) attack can still successfully estimate relevant subsets of training data. We show that the extracted relevant data can significantly improve the performance of model-inversion attacks, for instance. Specifically, the ADI method uses the concept hierarchy extracted from the public and private datasets that the attacker can access, and it applies a novel algorithm to adaptively tune the likelihood of leaf concepts in the hierarchy showing up in the unseen training data. For comparison, we also designed a straightforward hypothesis-testing-based attack called LDI. Among all candidate methods, the ADI attack extracts partial training data at the concept level, converges fastest, and requires the fewest target-model accesses.
Dr. Keke Chen is an associate professor in the UMBC CSEE Department. His recent research focuses on privacy and security issues with AI model training and deployment. He earned his PhD in computer science from Georgia Tech in 2006. Before joining UMBC, he was a Northwestern Mutual associate professor of computer science at Marquette University.
Support for this event was provided in part by the NSF under SFS grant DGE-1753681.
In just its first month of operation, that has disrupted large portions of the federal government, the activities of the so-called Department of Government Efficiency (DOGE) have worried cybersecurity, national security, and information technology experts both inside and outside the federal government. Armed with root-level access and presidential authorization---yet often lacking relevant operational expertise or any meaningful oversight---DOGE’s staff, activities, and the security culture of the current administration in which they operate often seem to violate many time-tested best practices and principles for effective cybersecurity and technology management. They may also violate longstanding federal guidelines and regulations. As such, it is likely that DOGE is creating conditions that can cause operational, cybersecurity, or privacy incidents across the federal IT landscape and subsequently placing government information systems and sensitive citizen data at risk. On the CIA (confidentiality-integrity-availability) triad, this talk will examine DOGE's activities in the context of cybersecurity and technology best practices. Is DOGE truly an “insider threat” to the federal government as some claim? And if so, what countermeasures, if any, are available to address the threat?
Dr. Richard Forno is a teaching professor in the UMBC Department of Computer Science and Electrical Engineering, where he directs the UMBC Graduate Cybersecurity Program, serves as the Assistant Director of UMBC's Cybersecurity Institute, and is an Affiliate Scholar at the Stanford Law School's Center for Internet and Society (CIS). Prior to academia, his twenty-year career includes helping build a formal cybersecurity program for the US House of Representatives, serving as the first Chief Security Officer for Network Solutions (then, the global center of Internet DNS), and other assorted roles with the government, military/defense entities, and private sector. In 2023, he was named a Distinguished Visiting Professor at the Universidad Autónoma del Estado de Hidalgo in Pachuca, Mexico. Along with regular public analysis and commentary, his most recent book is Cybersecurity for Local Governments (Wiley, 2022), coauthored with UMBC Public Policy colleagues Professor Emeritus Don Norris and Ph.D. candidate Laura Mateczun.
Formal methods research involves using mathematical techniques to specify and verify properties of software and hardware systems. In security and privacy research, formal methods can lead to strong, provable security guarantees—and typically leave questions about how humans might interact with these systems unanswered. Indeed, formal methods and usable security are traditionally distinct areas of research. In this talk, I will demonstrate how techniques from both research areas can be applied—or even combined—to create solutions that are simultaneously mathematically rigorous and usable. In one project, we revisit static analysis tools for home IoT users from a usable security lens and investigate the usability and utility of the workflow involved in using the tools. Later in the talk, I will describe a project with a formal methods focus where we propose a new technique for preventing undesirable information flows on the web. We argue that this approach is usable in more realistic scenarios than what is proposed by prior work—without sacrificing security.
McKenna McCall is a postdoctoral researcher in the Software and Societal Systems Department at Carnegie Mellon University supervised by Lorrie Cranor and Lujo Bauer. She received her PhD from Carnegie Mellon University in 2023, advised by Limin Jia. McKenna’s research spans fields from information flow control and programming languages to security and privacy for home IoT and confidential computing. She is particularly interested in research where formal methods and usable security intersect, and combines techniques from both research areas to produce results that incorporate mathematical rigor as well as usability.