A Caravanaseri at the Crossroads of Alternate Futures: A Report on the CyLab Silicon Valley Briefing
By Richard Power
As we hurtle forward into the 21st Century (a mere synonym for the Information Age), there is a profound challenge before us. Year by year, day by day, moment by moment, the importance of digital information and cyber systems increases in almost all aspects of human life; and likewise, the spectrum of related risks and threats deepens and broadens year by year, day by day.
Will we develop the 21st Century cyber security technologies and strategies required to cope with this runaway risk and threat matrix? Or will we continue to try and make do with 20th Century visions of cyber security and its digital thumb in the dike approach? Which of these alternate futures will we find ourselves in at the end of the second decade of the 21st Century?
Recently, an impressive gathering was held at the Carnegie Mellon Silicon Valley Campus in NASA Research Park. The presenters were all CyLab researchers. The other participants consisted of CEOs, VPs, CTOs, CSOs and leading technologists from a range of companies from Cisco and Microsoft to WhiteHat Security and iSEC, along with regional representatives from the Federal Bureau of Investigations and the U.S. Secret Service, as well as Board of Directors members from the local chapters of Information Systems Security Association (ISSA) and the American Society for Industrial Security (ASIS). The ultimate aim of the gathering was to push for the better of those two possible futures.
Attendance was RSVP, and by my personal invitation; there was no advertising for this event, no marketing, no hype. It was limited to 50 people, and the attendees were selected to provide a cross-section of concerns, knowledge, influence and experience. If you have been in cyber security for any length of time, you know there are many circles, there is the law enforcement circle, the security professional circle, the technical expert circle, the technology vendors circle, etc. It is at the points where these circles intersect that the most vital work is done. At the CyLab Silicon Valley Briefing, all of these circles intersected, and the dialogue that ensured was rich and rewarding.
Jeremiah Grossman, Founder and CTO of WhiteHat Security: "The speakers were highly informative and very qualified. Definitely good data to be had and I'm happy to we attended. I personally learned several things. Even the audience was well qualified, which is not something ones tends to find at smaller events."
Leslie Lambert, former CSO of Sun Microsystems: "The dialogue with the attendees was rich, as well. The event was very valuable and has the opportunity to increase the interactions between industry folks, government folks, and CMU folks. Good use of my time."
The theme of the event was "Harnessing the Future to Secure the Present," and the agenda highlighted four of CyLab's research thrusts: Trustworthy Computing Platforms and Devices, Software Security, Privacy Protection and Mobility. (Driven by over fifty faculty researchers, working with over one hundred graduate students, CyLab's program, is organized around seven research thrusts and seven additional, cross-cutting thrusts.)
Adrian Perrig, CyLab Technical Director spoke on "Building Secure Applications with Attestation."
"The problem I am going to address is how do we trust the computer we are currently using? How do I really know, as a human user? The goal is that we want to provide the user with strong security properties, such as execution integrity, data secrecy and authenticity.
"Virgil Gligor, CyLab Director, has coined the phrase Cyber-Secure Moments (© Virgil Gligor). So when you connect to your bank account, you want to have a Cyber-Secure Moment, you want to make sure that you have connected to the correct bank, that there is no man in the middle attack, no malware on your local system, stealing your credentials.
"You will also want to make sure that there are no transaction generators, that is one of the most recent attacks; malware is on your system, it waits for you to log-in to your bank account, and as soon as you are logged in, it conducts transactions with your secure login. How can you make sure that no one these malicious activities are happening? So how can you live these Cyber-Secure Moments?
"But you also want to be compatible with existing systems ... we can't easily change all the hardware or change all the operating systems ... We also want efficient execution. There are some solutions, which people have proposed that would slow down your system ten-fold, but obviously we want performance.
"So ideally in the presence of malware, we can still perform secure operations ..."
Perrig went on to explore Attestation, a promising approach for building secure systems, based on the recent development of a Trusted Platform Module (TPM) by the Trusted Computing Group (TCG). In particular, Perrig highlighted four related CyLab projects Flicker, XTREC, Sec Visor and Lockdown, and demonstrated the roles each can play in creating those precious Secure Cyber Moments.
CyLab researcher Alessandro Acquisti (who rocked the world last year with his revelations on predicting Social Security Numbers) spoke on "The Economics (and Behavioral Economics) of Privacy." In his talk, Acquisti outlined evolution of the economics of privacy, and highlighted some experiments in investigating privacy valuations and decision making through the lenses of behavioral economics.
"Contrary to the assumption in much social science that people have stable, coherent preferences with respect to personal privacy, we find that privacy valuations and concerns are highly sensitive to contextual and non-normative factors, and even internally inconsistent. This research raises questions about whether individuals are able to navigate in a self-interested fashion increasingly complex issues of privacy, as well as information security."
CyLab researcher David Brumley spoke on "Safe Software and Systems."
"A major focus of my research is developing techniques for protecting vulnerable applications when the program is only readily available as binary (i.e., executable) code. Since most programs are available in binary form, and binary-only analysis does not require cooperation of the source code vendor, this line of research is likely to impact a wide audience."
Brumley described two new security applications of binary code analysis: "automatic patch-based exploit generation, demonstrating how binary analysis can be used to automatically generate exploits based upon patches released from Windows Update, allowing attackers to create new exploits before all vulnerable hosts can receive a patch, and automatic input filter generation, which offers a way to defend against exploits by automatically generating input filters."
After a delicious Middle Eastern buffet luncheon, which was a abuzz with dialogue spinning of the morning's presentations, there were three more sessions.
Martin Griss, Director of the Silicon Valley Campus and the CyLab Mobility Research Center (MRC) spoke on "Creating a Truly Mobile Companion."
Griss' research is focused on the vision of a mobile device, with an integrated suite of applications on the device and services in the cloud and on telecom infrastructure.
"It must be context-aware. It must understand where I am, and what I am doing. It must be adaptable and able to learn, so that I do not have to repeat the same things over and over again. Machine-learning ...
"It should be pro-active; it should do thing for me, but it shouldn't constantly do things for me or to me; so it should be considerate. So we are trying to define what it is to be a proactive but considerate system. There is this balancing act between too helpful and not helpful enough.
"It must be secure and private, of course. Because as people use it for more and more things, and as you carry it more and more of the time, it knows more and more about you.
"It must be social; it must interact well with me and others as well as with other devices and with the social networks. It should be a device that recommends, reminds and advises. The obvious example is having turn by turn driving instructions on your phone, but we can do much more than that.
"And it should act for me, when needed. So, in extreme cases, I tell it to do something, and then I go off and do something else, while the phone, or the phone and the services are doing things for me, it will negotiate in the background. So when I would like to make a meeting, I would rather not go poking around on my calendar, I could just tell it 'meeting with my friends,' and at some point later it would say, 'meeting with your friends.'"
CyLab researcher Collin Jackson spoke on "Securing the Web Platform."
He outlined his work on Browserscope, an ongoing collaboration with browser vendors to improve browser encryption, defend against the most common web application vulnerabilities, and develop building blocks for securing third-party advertisements and applications; Browserscope has been deployed in many of the world's most popular browsers, including Firefox, Google Chrome, and Safari.
Patrick Tague spoke on "Guaranteeing Availability and Reliability in Mobile Wireless
Networks." He delivered an overview of issues related to availability and reliability of service in mobile wireless networks, and presented a variety of vulnerabilities and attacks of interest at the network layer and below, including interference and jamming by external adversaries and data- and control-plane routing attacks by internal adversaries."
Perrig and Brumley flew in from Pittsburgh, PA. where the main campus of Carnegie Mellon University is located. Griss, Jackson and Tague are based at the Silicon Valley Campus. Underscoring the bi-coastal nature of Carnegie Mellon's program, Acquisti spoke via video conference from the Pittsburgh campus.
As the host of the event, I was delighted that the level of engagement between the presenters and the attendees was so genuine that I had to cut-off the Q and A at the end of every session to keep on the event on track.
Indeed, "Harnessing the Future to Secure the Past: A CyLab Silicon Valleuy Briefing" was a compelling re-affirmation of academic research's vital role in helping us choose the better of the alternate futures that stretch out before us, i.e., the one that demands 21st Century responses to 21st Century challenges.
