Much of the world's critical infrastructure is at risk from attack through electronic networks connected to control systems. Security metrics are important because they provide the basis for management decisions that affect the protection of the infrastructure. A cyber security technical metric is the security relevant output from an explicit mathematical model that makes use of objective measu...

Functions vital to our society and critical infrastructures — energy, water, transportation, communication, critical information infrastructure — lacks of resilience, typically losing essential functionality following adverse events. In the future, the number of climatic extremes may intensify or become more frequent, and building resilience becomes the optimal course of action for large comple...

We construct a bump-in-the-wire (BITW) solution that retrofits security into time-critical communications over bandwidth-limited serial links between devices in Supervisory Control And Data Acquisition (SCADA) systems. Previous BITW solutions fail to provide the necessary security within timing constraints; the previous solution that does provide the necessary security is not BITW. At a compara...

The widespread use of wireless cellular networks has made security an ever increasing concern. GSM is the most popular wireless cellular standard, but security is an issue. The most critical weakness in the GSM protocol is the use of one-way entity authentication, i.e., only the mobile station is authenticated by the network. This creates many security problems including vulnerability against m...

Cyber security education and outreach is a national priority. It is critical to encourage high school students to pursue studies in cyber security and related fields. High school outreach is a fundamental component of a cohesive cyber security education program. Most high school outreach programs in cyber security focus on short-term events such as a capture the flag contest or the CyberPatriot...

The challenges of managing security have increased substantially with the advent of outsourcing and cloud computing. Service providers need to ensure that security controls correctly address the complex sets of requirements demanded by their clients. Auditors find it difficult to check whether service providers are compliant with standard security guidelines as well as organization-specific sec...