Carnegie Mellon CyLab Awarded DHS Contract For Research Into Understanding And Disrupting The Economics Of Cybercrime

Carnegie Mellon University CyLab has been awarded a multi-million dollar contract for research into Understanding and Disrupting the Economics of Cybercrime. Nicolas Christin, CyLab Senior Systems Scientist and Associate Director of the Information Networking Institute (INI), is Principle Investigator (PI). His co-PIs are fellow CyLab researcher Alessandro Acquisti, along with Tyler Moore of Southern Methodist University, Ross Anderson of Cambridge University, and Ryan Williams of NFCTA. Richard Clayton of Cambridge University will also participate as instrumental senior personnel.

Based on the realization that focusing on a particular attack, or a specific set of attacks, is unlikely to provide the detailed level of understanding necessary to design meaningful intervention policies against cybercrime, the methodology developed by Christin and his colleagues holistically combines network measurements with behavioral and economic analysis. The project will consist of four research tasks: designing cybercrime indicators, designing data interchange formats and standards, modeling online-crime supply chains and modeling attackers' behavioral psychology The contract is one of thirty four, totaling $40 million that the U.S. Department of Homeland Security (DHS) Science and Technology Directorate (DHS S&T) has awarded to twenty-nine academic and research organizations. This funding is for research and development of cyber security solutions.

In January 2011, the DHS S&T Cyber Security Division (CSD) issued a Cyber Security R&D Broad Agency Announcement (BAA 11-02) that solicited proposals for 14 Technical Topic Areas (TTAs) aimed at improving security in federal networks and across the Internet while developing new and enhanced technologies for detecting, preventing and responding to cyber attacks on the nation's critical information infrastructure. BAA 11-02 elicited white paper responses from more than 1,000 offerors.

Following extensive review and down-select process, more than 200 offerors were invited to submit full proposals for final review. And of those, new awards were made to the twenty-nine organizations that were announced on October 26, 2012.

"The work to be accomplished through these contracts will significantly advance cyber security and support the mission of the DHS Science and Technology Directorate's Cyber Security Division to create a safe, secure and resilient cyber environment," Dr. Douglas Maughan, director of DHS' S&T Cyber Security Division told Homeland Security Today. "Our goal," said Maughan, "is to transform the cyber-infrastructure to be resistant to attack so that critical national interests are protected from catastrophic damage and our society can confidently adopt new technological advances." (See Homeland Security Today, 10-26-12)

Full DHS press release 

DHS S&T Directorate Awards 34 Contracts For Cybersecurity Research, Development, Homeland Security Today, 10-26-12

Nicolas Christin: "... see if we can follow the money trail to figure out what are the best intervention practices to defeat online crime"

"More and more attacks are motivated by financial gain, so it makes sense to try to see if we can follow the money trail to figure out what are the best intervention practices to defeat online crime." -- Nicolas Christin, CyLab Chronicles, 2010

Nicolas Christin: "... see if we can follow the money trail to figure out what are the best intervention practices to defeat online crime"

CyLab Chronicles is an ongoing feature of CyLab's online presence; it provides periodic interviews with CyLab researchers, and offers insights into vital issues and trends.

Here is a brief excerpt from the latest CyLab Chronicles, an Q and A with Nicolas Christin, a link to the full text follows:

CyLab Chronicles: Many security professionals are looking for answers to important questions, and know that some of those answers can be found in Economics, but most of them would probably find it difficult to get their minds around how mathematical models that can be used to uncover them. Tell us about your research into this area? How can mathematical models be used to analyze security and privacy risks in organizations and prescribe mechanisms for mitigating such risks?

Nicolas Christin: Mathematical models are a useful abstraction that enables us to reason about security in organizations. Having a model of organizational security allows us to test different intervention scenarios on that model and predict which effects they would have on the overall security of the organization. Let me give you an example. Consider you manage a hospital. Obviously, you have to maintain the confidentiality of all of your patients' records. But if you treat a celebrity, for instance, there may be some perverse incentives for some of your staff to sell juicy bits of information to the tabloids. So, you want to put in place some sort of monitoring infrastructure to ensure people do not commit such violations, but at the same time, you cannot monitor everything and everybody, all the time -- it would simply be too expensive, not to mention probably detrimental to employee productivity. How to strike the right balance in practice is a very difficult problem. Now, if I can come up with a reasonable mathematical abstraction for the problem, I can probably show you which strategies are most likely to be effective, so in the end I can provide a formal justification of which policy makes most sense. Having a formal basis on which to reason is really indispensable to make the right decisions. Also, the beauty of mathematical models is that they tend to rid you of political or other considerations that may hamper your judgment. If your model is sound, and if your assumptions are valid, then the model tells you exactly what is going to happen. It can be a powerful predictive tool. CyLab Chronicles: Q & A with Nicolas Christin (2010)

For an archive of all CyLab Chronicles, click here.

-- Richard Power

Android Security, Naked Keystrokes, Selling Viagra, Crying Wolf & More! -- A Report from the 18th USENIX Security Symposium (Montreal, 2009)

Montreal Harbor, 1889


The city proper covers most of the of the Island of Montreal at the confluence of the Saint Lawrence and Ottawa Rivers. The port of Montreal lies at one end of the Saint Lawrence Seaway, which is the river gateway that stretches from the Great Lakes into the Atlantic Ocean.[36] Montreal is defined by its location in between the St. Lawrence river on its south, and by the Rivière des Prairies on its north. The city is named after the most prominent geographical feature on the island, a three-head hill called Mount Royal, topped at 232 m above sea level. Wikipedia

Android Security, Naked Keystrokes, Selling Viagra, Crying Wolf & More! -- A Report from the 18th USENIX Security Symposium (Montreal, 2009)

By Richard Power

The 18th USENIX Security Symposium was held in Montreal, Quebec (August 10-14, 2009). This conference always provides an excellent opportunity to catch up on the thinking of some impressive minds and delivers the most technical content of all the major security-focused IT conferences.

USENIX distinguishes itself by being a non-profit organization, and acting like one. Seventy-nine students were given stipends to attend this year’s Security Symposium, at a cost of approximately $100,000. This is how USENIX spent the contributions of its sponsors, as well as a significant chunk of its own funds. None of the commercial conferences can lay claim to any such altruism.

I asked legendary login editor Rik Farrow (well, he is the Editor, and kept up the publication’s high standards for many years, enough to qualify as a legend in this field, and yes, he is my friend) how he would distinguish USENIX Security Symposium from the other major cyber security conferences?

“USENIX Sec is one of four top tier security research conferences, and certainly my favorite because accepted papers must include an implementation. So this goes well beyond theory.”

Rich Cannings, Android Security Leader at Google delivered the keynote, “Securing a Mobile Platform from the Ground Up.”

Here are my notes from the talk --

Cannings started off by breaking down the numbers:

-- 6.77 billion human beings on the planet.
-- 1.48 billion Internet-enabled PCs
-- 4.10 billion mobile phones, with a 12-18 month average replacement rate.
-- 1 billion mobile phone purchases per year

“And 13.5% of them are smart phones. This number will soon compare with the number of Internet enabled PCs, and they will become major security targets.”

Next, Cannings gave some background on Android:

Google’s Android is free, open source mobile program, intended to “empower both users and developers.”

It has a Linux kernel. It relies upon 90+ open source libraries (e.g., SQLite for structured data storage, OpenSSL, etc.). It supports common codes for sound, image, etc.

Android is also “designed to protect battery life.”

Developers don’t understand battery life
Users do.

In outlining Google’s security philosophy in regard to Android, Cannings articulated some of the premises with which they approach the issue:

-- Finite time and resources
-- Humans have difficulty understanding risk
-- Safer to assume that most developers do not understand security
-- Most users do not understand security

The cornerstones of the Android security philosophy, as formulated by Cannings, emphasize some basic needs:

-- Need to prevent security breaches from occurring
-- Need to detect them when they occur
-- Need to minimize their impact
-- Need to react to both to vulnerabilities and breaches swiftly

Cannings went on to explore each of these elements as they came into play in the development, roll-out and support of Android.

No one with serious experience in cyber security could argue with Cannings’ guiding principle: “Security is an ongoing process, not a checkbox.”

But of course, Android means “five millions lines of new code,” utilizing, as I mentioned earlier, one hundred open source libraries. And since Android is open source, Cannings remarked, it “can’t rely on obscurity.”

There are tremendous challenges ahead.

Farrow elaborates.

“I liked the keynote, as I am very concerned about the security of mobile devices. The obvious trend is for people to use their smart phones as their primary method for interacting with the Internet, and I would love to see the security of phone software fare MUCH better than Windows has in this area. Rich Canning did a good job of describing the Android security model, but I was left feeling that there are real weaknesses in the Android security model largely because the Android team is being rushed, and layering their security on top of ancient UNIX security features. The notion of relying on users to permit applications based on the number and importance of privileges required is flawed, as most people make poor security decisions (and there is lots of research to back this up).

“Android does present a chance to create a secure environment,” Farrow adds, “but it must also satisfy both developers and users if it is to be successful.”

The program committee received one hundred seventy submissions for this year’s Symposium, only twenty-six papers were accepted.

Martin Vuagnoux and Sylvain Pasini of LASEC/EPFL received an “Outstanding Paper” award for “Compromising Electromagnetic Emanations of Wired and Wireless Keyboards.” These students cobbled together a system capable of converting broad spectrum radio emissions of keyboards into actual keystrokes.

Roxana Geambasu, Tadayoshi Kohno, Amit A. Levy, and Henry M. Levy of University of Washington also received an “Outstanding Papers” awards for “Vanish: Increasing Data Privacy with Self-Destructing Data.”

Carnegie Mellon University was represented by Joshua Sunshine, who presented “Crying Wolf: An Empirical Study of SSL Warning Effectiveness,” headline-grabbing research conducted with Serge Egelman, Hazim Almuhimedi, and Neha Atri, under the guidance of Lorrie Cranor, Director of CyLab’s Usability of Privacy and Security Lab.

Of course, CyBlog covered this compelling research, recently, when the story broke. (See CyLab CUPS Researchers Release Study on SSL Warning Effectiveness)

CyLab corporate partners can read my full report on the 2009 USENIX Security Symposium, including my notes on Vern Paxson's “How the Pursuit of Truth Led Me to Selling Viagra” and interview with Metronics 4.0 chair, Jennifer Bayuk, in the Intelligence Briefing section of the CyLab partners-only portal.

CyLab Seminar Series Notes: Why do people and corporations not invest more in security?

CyLab Seminar Series Notes: Why do people and corporations not invest more in security? Nicolas Christin on "Understanding User Investments & Response to Security Threats"

[NOTE: CyLab's weekly seminar series provides a powerful platform for the highlighting vital research. The physical audience in the auditorium is composed of Carnegie Mellon University faculty and graduate students, but CyLab's corporate partners also have access via the World Wide Web. Frequently, CyBlog will wet your appetite by offering brief glimpses into these talks. Here are my notes from a talk on Understanding User Investments and Response to Security Threats delivered by Nicolas Christin on 1-19-09. -- Richard Power]

Why do people and corporations not invest more in security?

After all, CyLab researcher Nicolas Christin notes, there are compelling reasons for spending more on security: users claim they have an interest in secure practices, security technology is, by and large, inexpensively available (e.g., PGP, SSL, AES), and financial losses can be very costly.

The thesis of this research is that economics can help understand and change user behavior.

There are several reasons why Christin and his fellow researchers believe in their thesis:

"First of all, this is the 21st Century, everybody is on the network," Christin explains, "all computers are connected one way or another.

"It is also a competitive environment, e.g., competing Internet service providers (ISPs), competing content providers, even within a single organization you may have different divisions competing for funds.

"In addition, we have strong externalities, i.e., the security of one person affects the whole network, or at least a significant number of other users; for example, when the Code Red Worm or the I Love You virus started to propagate on the Internet, they were passed along by end users who failed to properly secure their systems ... so who should pay for security? The people who financially suffer the most from security problems, or the people who are causing these security problems to flourish in the first place? That is an interesting question...

"Another reason we think economics is a very good complement to technology is that [today] criminals themselves are, by and large, very rational, they are in it for the money."

However, unlike most cyber criminals, end users, whether corporations or individuals, are not, in general, "perfectly rational," nor are they random. "We need to find a way of modeling their behavior" Christin remarks, 'so that we can then impact it."

Using modeling methodology, which includes formal analysis, experimental research and field data measurement, Christin and his fellow researchers are in pursuit of "an abstraction that captures as much as possible the salient features of a host of different security situations"

"When you have a fairly reasonable model," according to Christin, "you can use it to test intervention mechanisms before deploying them in practice." For example, you might ask, what would be the impact of passing some particular law? "You test it on your model, and you can make recommendations to a policymaker, and you have something to substantiate your argument, which hopefully makes it more compelling."

"We have tried to look at simple security games, where people are playing against each other, with an exogenous attacker, so all the people we are looking at are basically defending against a common set of threats. We have separated them into a finite number of canonical security games ... They cover a reasonable range of security situations."

"We decouple security strategies into investments to protect yourself (e.g., setting up a firewall) and self-insurance coverage (e.g., archiving data for back up)."

("Most of the research in the economics of security assumes that you have a single security variable," Christin explains, "but we think that this is a little too rough, and that at least we should consider the two different things that people can do.)

"We also consider those network externalities, i.e., a choice by one person on the network affects other participants on the network."



In the course of his seminar, Christin broke down the elements of the general model as depicted in this post:

"You have your 'Expected utility, which is essentially the amount of money that you can expect to have after the attack has or has not taken place. It is simply the 'Initial endowment' (that is, the money you start out with) minus the potential losses you are going to face, and minus the 'Protection investment.' Say our player invests in security, maybe he buys an anti-virus program: that is going to be captured by this protection cost si(normalized to (0-1) hence the scaling variable bi).

"Then there is 'Insurance purchased,' the amount of insurance that you have purchased, whether it is literally insurance with a provider, or simply back ups, i.e., anything that allows you to recover after a security attack has been successful. So the security expenses are broken down in protection and insurance expenses.'Expected loss' is that lose you would expect to face if you didn't institute any security at all. ...

"The expected loss is mitigated by your security expenses, as you can see from the formula. The insurance expenses only depend on that individual player, which means that if your return on investment doesn't depend on what other people are doing. That is good news for most people.

"But the thing that is going to throw us off and that makes this research interesting is that when it comes to protection, we have these externalities here, 'Network protection level (public good)' ... somehow hidden in that function ... where the level of protection that the individual player picks is part of the level of protection it is going to receive, but the level of protection that the other people pick is also going to impact the bottom line, the 'Expected utility.'

"So, the overall utility H depends on all the players in the network. This is where the actions of others impacts my welfare, and this is the critical point we have to model."

To read a relevant paper, which includes a complete analysis, click on J. Grossklags, N. Christin, and J. Chuang. Secure or Insure? A Game-Theoretic Analysis of Information Security Games. WWW'08.

To read a CyLab Chronicles Q&A with Nicolas Christin, click here.

For information on the benefits of partnering with CyLab, contact Gene Hambrick, CyLab Director of Corporate Relations: hambrick at andrew.cmu.edu