Pal Research Statement of Ranjan Pal

! Most of the defense, corporate, and civilian systems today are Internet-based. The trustworthiness of these Internet-based systems heavily depends on their security characteristics. It has been forecasted by national defense experts that the next big terrorist threat is a cyber-war, alongside this, the current Obama administration has also given much importance to strengthening cyber-security. Thus, strong data protection and efficient cyber risk management is the need of the hour. According to former CIA director Michael Hayden, cyber-security is a unique critical domain that is the most talked about, but one where people have the least understanding. Studies conducted by security experts show that despite the increasing amount of research in strengthening security solutions, and large body of products being designed to increase security, (e.g., antivirus software, anti-spam software, and firewalls), such self-protection tools can at best reduce the risk of end-users but cannot eliminate it. One of the main reasons for this is the effect of misaligned incentives between security product vendors, network users, software and application developers, and regulatory agencies. Past research efforts on the multiparty incentive alignment problem have taken some piecemeal steps but are yet to holistically solve this open and difficult problem of simultaneously satisfying all the major parties. My research interests lie in analyzing and improving the security and privacy of networked and distributed systems. My approach looks at a system's security and privacy not only from a technical perspective, but also from an interdisciplinary angle because many a time, the major barriers to achieving a secure system come from challenges not specifically related to the domain of traditional networking or security. I develop interdisciplinary security, risk management, and privacy solutions that encompass economic, game-theoretic, algorithmic, stochastic, system optimization, and social graph-theoretic ideas, along with applying traditional networking and security ideas. Improving systems security and privacy encompasses all these disciplines. However, traditional security, privacy, and many of these disciplines have developed separately, and over time this has created a language barrier between them. As cyber-security and privacy becomes a complex field, problems become harder to solve in isolation. My research strives to bridge this communication gap, allowing me to approach basic and difficult networking, security, and privacy problems from an alternate perspective. ! In particular, for my PhD, I carried out an in-depth analysis of cyber-insurance as a risk management tool to solve the difficult multiparty incentive alignment problem, and in turn designed a …