Ceremony Analysis: Strengths and Weaknesses

Radke, Kenneth; Boyd, Colin; Nieto, Juan Manuel González; Brereton, Margot

doi:10.1007/978-3-642-21424-0_9

Cited by 27 publications

(26 citation statements)

References 17 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Thinking of protocols as ceremonies brings new insights in understanding how security does or does not work, and reveals flaws that a sheer reductionist approach to technical security is not able to capture. This is clearly shown in recent work of Radke et al [19]. The authors identify flaws in the Mini Opera browser ceremonies emerging from the HTTPS protocol when used in a certain context, despite the fact that the protocol is correct and secure in the traditional meaning of those terms.…”

Section: Related Workmentioning

confidence: 67%

“…Moreover, also the cues that the user interface should use have not been codified, and are far from being standardised. Notably, a recent release of the Opera Mini browser, with its 144 million users each month worldwide [28], was found to display a padlock when an intermediate server interposes between the client and the server, hence without end-to-end security [19].…”

Section: Example 1 the Formal Analysis Of The Two-layered Security Cmentioning

confidence: 99%

See 1 more Smart Citation

A Socio-technical Methodology for the Security and Privacy Analysis of Services

Bella

Curzon

Giustolisi

et al. 2014

2014 IEEE 38th International Computer Software and Applications Conference Workshops

View full text Add to dashboard Cite

Abstract-There is a widely accepted need for methodologies to verify the security and privacy of services. A typical service requires user data and then makes them available through the Internet independently from access platforms or user locations, but the layman is rarely aware of the entailed risks and seldom acts cautiously. The combined human-and-technology system is complex: it intertwines the technical protocols that establish the technical security and privacy properties, with the social protocols that regulate human attitudes to and behaviour with computers. A number of security and privacy threats are therefore inherently socio-technical. An appropriate methodology to tackle security and privacy of web services from a socio-technical standpoint, namely when the human is in the loop, is still missing. This paper introduces one, termed the ceremony concertina traversal methodology. It advocates that technology is analysed in the presence of the human through the various structural layers that arise, from computer processes to user personas. Layers should be analysed individually then in combination, so as to transmit the guarantees that the technology is sound to its users in practical scenarios.

show abstract

Section: Related Workmentioning

confidence: 67%

Section: Example 1 the Formal Analysis Of The Two-layered Security Cmentioning

confidence: 99%

A Socio-technical Methodology for the Security and Privacy Analysis of Services

Bella

Curzon

Giustolisi

et al. 2014

2014 IEEE 38th International Computer Software and Applications Conference Workshops

View full text Add to dashboard Cite

show abstract

“…Thinking of protocols as ceremonies brings new insights on how security does or does not work, and reveals flaws that a sheer reductionist approach to technical security is not able to capture. This is clearly shown in recent work of Radke et al [65]. The authors identify a flaw in the Opera Mini browser ceremonies emerging from the HTTPS protocol when used in a certain context, despite the fact that the protocol is secure in the traditional sense ( §3.4).…”

Section: The Socio-technical Perspectivementioning

confidence: 68%

“…Moreover, also the cues that the user interface should use have not been codified, let alone standardised. Notably, a recent release of the Opera Mini browser, with its 300 million worldwide users in February 2013 [88], was found to display a padlock when an intermediate server interposes between the client and the server, hence without end-to-end security [65].…”

Section: Example Usesmentioning

confidence: 99%

Service security and privacy as a socio-technical problem

Bella

Curzon

Lenzini

2015

JCS

View full text Add to dashboard Cite

Abstract. The security and privacy of the data that users transmit, more or less deliberately, to modern services is an open problem. It is not solely limited to the actual Internet traversal, a sub-problem vastly tackled by consolidated research in security protocol design and analysis. By contrast, it entails much broader dimensions pertaining to how users approach technology and understand the risks for the data they enter. For example, users may express cautious or distracted personas depending on the service and the point in time; further, pre-established paths of practice may lead them to neglect the intrusive privacy policy offered by a service, or the outdated protections adopted by another.The approach that sees the service security and privacy problem as a socio-technical one needs consolidation. With this motivation, the article makes a threefold contribution. It reviews the existing literature on service security and privacy, especially from the socio-technical standpoint. Further, it outlines a general research methodology aimed at layering the problem appropriately, at suggesting how to position existing findings, and ultimately at indicating where a transdisciplinary task force may fit in. The article concludes with the description of the three challenge domains of services whose security and privacy we deem open socio-technical problems, not only due to their inherent facets but also to their huge number of users.

show abstract

“…Influences have been identified in the configuration of security settings of WiFi access points [30], in the purchase of seat reservations on railways [31], to the percentage of organ donors [32] and to response rates in web surveys [33]. The common theme is that users tend to accept default settings, so that defaults can also be seen as a de facto regulation [30].…”

Section: Theoretical Backgroundmentioning

confidence: 99%

Data Privacy Management, Autonomous Spontaneous Security, and Security Assurance

García-Alfaro¹,

Herrera-Joancomartí²,

Lupu³

et al. 2015

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Abstract. Present malicious threats have been consolidated in past few years by incorporating diverse stealthy techniques. Detecting these malwares on the basis of their dynamic behavior has become a potential approach as it suppresses the shortcomings of static approaches raised due to the obfuscated malware binaries. Additionally, existing behavior based malware detection approaches are resilient to zero-day malware attacks. These approaches rely on isolated analysis environment to monitor and capture the run-time malware behavior. Malware bundled with environment-aware payload may degrade detection accuracy of such approaches. These malicious programs detect the presence of execution environment and thus inspite of having their malicious payload they mimic a benign behavior to avoid detection. In this paper, we have presented an approach using system-calls to identify a malware on the basis of their malignant and environment-reactive behavior. The proposed approach offers an automated screening mechanism to segregate malware samples on the basis of aforementioned behaviors. We have built a decision model which is based on multi-layer perceptron learning with back propagation algorithm. Our proposed model decides the candidacy of a sample to be put into one of the four classes (clean, malignant, guest-crashing and infinite-running). Clean behavior denotes benign sample and rest of the behaviors denote the presence of malware sample. The proposed technique has been evaluated with known and unknown instances of real malware and benign programs.

show abstract

Ceremony Analysis: Strengths and Weaknesses

Cited by 27 publications

References 17 publications

A Socio-technical Methodology for the Security and Privacy Analysis of Services

A Socio-technical Methodology for the Security and Privacy Analysis of Services

Service security and privacy as a socio-technical problem

Data Privacy Management, Autonomous Spontaneous Security, and Security Assurance

Contact Info

Product

Resources

About