Autonomous multi-vehicle systems are becoming increasingly relevant in military operations and have demonstrated potential applicability in civilian environments as well. A problem emerges, however, when logging data within these systems. In particular, potential loss of individual vehicles and inherently lossy and noisy communications environments can result in the loss of important mission data. This paper describes a novel distributed ledger protocol that can be used to ensure that the data in such a system survives and documents verification of the behavioral correctness of this protocol using informal verification methods and tools provided by the Monterey Phoenix project.

To reduce code exploitabilty, techniques for analyzing binaries for potential buffer overflow vulnerabilities are needed. One method is static analysis, which involves inspection of disassembled binaries to identify exploitable weaknesses in the program. Buffer overflows can occur in libc functions. Such functions can be referred to as vulnerable sinks. We present Overflow Detection from Sinks and Sources (ODSS), a script written for the Ghidra API to search for vulnerable sinks in a binary and to find the source of all the parameters used in each sink. We conduct static analysis of ten common libc functions using ODSS, and show that it is possible to both find overflow vulnerabilities associated with functions using stack-allocated strings and to determine the feasibility of a buffer overflow exploitation.

Labtainers are fully provisioned Linux-based computer science lab exercises with an initial emphasis on cybersecurity. Consistent lab execution environments and automated provisioning are provided by Docker containers. With over 50 lab exercises including multi-component networks that all run on a modestly performing laptop computer., Labtainers supports exploratory learning for both local and remote learners. They offer automated assessment of student lab activity and progress as well as individualized lab exercises to discourage sharing solutions. Free and open at: https://nps.edu/web/c3o/labtainers, Labtainers is distributed as a single virtual machine for either VirtualBox or VMWare. On an exercise-specific basis, the framework leverages Docker containers to instantiate one or more networked computers within that single VM. This hands-on workshop covers the basics of creating Labtainer-based labs, whether for security, networking, operating systems, or other computer science classes. The workshop also introduces how this lab framework helps remove three barriers to CS lab exercises: 1) administrative setup and resulting divergent behavior between student environments; 2) sharing of solutions amongst students; 3) assessing student work. Participants should have a computer running either VMWare or VirtualBox, with the Labtainers VM appliance installed.

Autonomous multi-vehicle systems are becoming increasingly relevant for many operations. However, logging data within these systems is difficult. In particular, loss of individual vehicles and inherently lossy and noisy communications environments can result in the loss of important mission data. We present a novel distributed ledger protocol, the Unmanned Vehicle System Logging Protocol (UVSLP), that enhances data survival in such systems. We demonstrate the behavioral correctness of this protocol using informal verification methods and tools provided by the Monterey Phoenix project. We further verified the correctness of this protocol through implementation field tests.

Daily operation and management of complex systems typically include multiple working sessions during which a team presents a set of information and discusses issues relevant to their decision making. A complex set of operational technology (OT) networks installed onboard a Navy ship is an example of such a system. A crew’s ability to effectively communicate OT networks status to the ship commander, visualize, and discuss the options available in a given situation, has a significant impact on mission success. While the complexity of contemporary OT networks has dramatically increased, visualization tools have witnessed little improvement over several decades—they include sets of two-dimensional blueprints that are inherently hard to understand and conceptualize as three-dimensional (3D) information. To address this problem, we designed and implemented an augmented reality (AR) system that allowed a small team to visualize a 3D model of the ship with details of its computer networks. We recruited 30 individuals familiar with network management tasks central to our study and examined the usability of the tool on a set of real-world scenarios focused on network management. Analysis of objective and subjective data suggested that there was a general agreement among the participants that AR portrayal of the network was very supportive of their understanding of the physical-to-logical relationship within the network and that it fostered constructive collaboration among the team members. The reported levels of discomfort associated with oculomotor symptoms made the highest contribution to the total Simulator Sickness Questionnaire score; we believe that those symptoms should be given more attention in future studies with AR setups. The results provided in this empirical study offer early insights into the benefits and challenges of AR approaches applied to the decision making of small teams in high stakes scenarios and real-world situations.

A variety of tools are used to support software vulnerability analysis processes. However, when analysts want to select the optimal tool for a particular use case, or attempt to compare a new tool against others, no standard method is available to do so. In addition, we have determined that although vulnerabilities can be categorized into vulnerability types , these types are often disproportionately represented in current datasets. Hence, when comparative analyses of tools based upon these data sets are conducted, the results are distorted and unrealistic. To address this problem, we are building a Benchmark for Vulnerability Analysis Tools (B-VAT). Representativeness is a key element of a good benchmark. In this paper, we use stratified sampling to identify a representative set of vulnerabilities from over 800 CWE's and 75,000 CVE's. This set becomes the foundation upon which we will build a purpose-based benchmark for vulnerability analysis tools. By using the correlation between current CWE and CVE data, the proposed B-VAT will assess tools using vulnerabilities in the proportions their types occur in the wild.

The ability to secure industrial control systems (ICS) against adversaries relies on defense in depth and implementation of security controls. However, as automation and networking of industrial processes increases, so do the opportunities for adversaries to cause destruction and disruption. Many industrial firewalls are proprietary and often users blindly trust that the firewalls meet vendor security claims. Independent testing can assess these claims. This paper describes the security testing of two commercial ICS firewalls to determine whether or not these firewalls provide protection of resources as advertised. Our test philosophy is guided by the Flaw Hypothesis Methodology (FHM)---a penetration testing technique for discovery of security flaws derived from documentation and other evidence. The test coverage includes functional testing, exception testing, and penetration testing. Testing is conducted on a simulated natural gas compressor system, utilizing two open-source vulnerability analysis tools, Nessus and Metasploit. The testing methodology is the first step toward a general approach for selecting and testing firewalls intended for critical control systems.

Most forensic investigators are trained to recognize abusive network behavior in conventional information systems, but they may not know how to detect anomalous traffic patterns in industrial control systems (ICS) that manage critical infrastructure services. We have developed and laboratory-tested hands-on teaching material to introduce students to forensics investigation of intrusions on an industrial network. Rather than using prototypes of ICS components, our approach utilizes commercial industrial products to provide students a more realistic simulation of an ICS network. The lessons cover four different types of attacks and the corresponding post-incident network data analysis.

Hurdles to creating and assessing exploratory cybersecurity laboratory exercises include their development, setup, and configuration; resource requirements; student sharing of results; and arduous grading. The Labtainers framework supports multi-component networks and simplifies the creation of labs that are consistent and fair, can be parameterized to discourage students from submitting results either created by others or mined from the Internet, and can include practical, instructor-friendly automated assessment. Implemented using Linux Docker containers and easily accommodated on students’ modest computers, each stand-alone cybersecurity lab exercise has one or more associated containers that ensure a consistent execution environment within the lab. Here we discuss three approaches to lab parameterization that encourage individual work and are compatible with automated assessment: watermarks, per-student artifacts, and per-student solutions.

We have created a framework to simplify creation, deployment, and assessment of stand-alone cyber security lab exercises, intended for use on individual student computers. We are implementing this framework using Linux Docker containers. Each lab has one or more associated containers that ensure an execution environment consistent with the requirements of the so‰ware elements and activities within the lab. Lab-speci€c containers are automatically installed and con€gured on the student’s Linux computing platform, (e.g., a VM) when the student starts the lab. Results of student lab activity are automatically collected and packaged when the student completes the lab, and these results are automatically evaluated on an instructor’s computer, using similar Docker containers. Automated assessment of student labs makes it practical, (from an instructor’s perspective), to individualize every instance of each lab such that students cannot easily submit results either created by another student or mined from the Internet.

Successful lab designs are a valuable resource that should be re-used and shared among educators and between institutions. A collaborative, community-sourced design effort maximizes the benefit of the effort and expertise required to build and test an effective lab exercise. Unfortunately, infrastructure requirements, heterogeneous operating environments, and the desire to incentivize individual student work pose significant challenges that necessitate frequent updating, redesigning and retesting of assignments, creating a significant maintenance burden. To address these challenges, we present Labtainers: a container-based framework for the development, deployment and assessment of Linux-based cyber security lab exercises. Docker containers present a consistent environment that reduces the need for frequent updates, but with considerably less overhead than VMbased approaches. This enables a modest laptop to host labs consisting of multiple networked components. As such, the Labtainers framework is able to simulate a variety of security-relevant scenarios on a standalone student machine, without the need for elaborate infrastructure. Moreover, Labtainers’ scripting support allows exercises to be customized on a per-student basis, then collected and evaluated automatically on the instructor machine. This capability enables the instructor to assign exercises where each solution is unique to the student with little or no increase in complexity of lab setup or assessment.

Estimates of the demand for cyber security professionals are as high as 1,000,000 new personnel needed in the global cyber workforce (Cisco, 2014), yet there are insufficient qualified personnel to fill the new positions. Like other organizations, the Navy is also feeling this demand signal. Unless more young people become interested in pursuing cyber security careers, there will be a woeful shortfall of talent.

In this paper, we construct a lattice based (t, n) threshold multi-stage secret sharing (MSSS) scheme according to Ajtai’s construction for one-way functions. In an MSSS scheme, the authorized subsets of participants can recover a subset of secrets at each stage while other secrets remain undisclosed. In this paper, each secret is a vector from a t-dimensional lattice and the basis of each lattice is kept private. A t-subset of n participants can recover the secret(s) using their assigned shares. Using a lattice based oneway function, even after some secrets are revealed, the computational security of the unrecovered secrets is provided against quantum computers. The scheme is multi-use in the sense that to share a new set of secrets, it is sufficient to renew some public information such that a new share distribution is no longer required. Furthermore, the scheme is verifiable meaning that the participants can verify the shares received from the dealer and the recovered secrets from the combiner, using public information. Index Terms IEEE Transactions on Dependable and Secure Computing Volume: PP Year: 2015

We re-evaluate the kernelized, multilevel secure (MLS) relational database design in the context of cloud-scale distributed data stores. The transactional properties and global integrity properties for schema-less, cloud-scale data stores are significantly relaxed in comparison to relational databases. This is a new and interesting setting for mandatory access control policies, and has been unexplored in prior research. We describe the design and implementation of a prototype MLS column-store following the kernelized design pattern. Our prototype is the first cloud-scale data store using an architectural approach for high-assurance; it enforces a lattice-based mandatory information flow policy, without any additional trusted components. We highlight several promising avenues for practical systems research in secure, distributed architectures implementing mandatory policies using Java-based untrusted subjects.

In 2005, the initial version of CyberCIEGE, a network security simulation packaged as a video game, was released. Since then, we have developed a suite of game scenarios and have enhanced and extended the underlying game engine to cover a broad set of cybersecurity concepts. CyberCIEGE includes a Scenario Development Kit to customize existing game scenarios and create new ones. A Scenario Development Language lets instructors express security policies of interest and the circumstances in which these policies must be enforced. This language programs and augments the underlying CyberCIEGE simulation, enabling context-rich interaction with students, while relying on the simulation to assess network security and enterprise productivity. Scenario creation requires both story telling and highlevel programming techniques. Scenario designers use a forms-based integrated development environment to express a scenario in terms of its initial conditions, security policies, economic constraints, and student feedback.

Security Education and Critical Infrastructures presents the most recent developments in research and practice on teaching information security, and covers topics including: -Curriculum design; -Laboratory systems and exercises; -Security education program assessment; -Distance learning and web-based teaching of security; -Teaching computer forensics; -Laboratory-based system defense games; -Security education tools; -Education in security policies, management and system certification; -Case studies.

: This document describes the Life Cycle Management Plan for the development of a high assurance secure product. A high assurance product is one for which its users have a high level of confidence that its security policies will be enforced continuously and correctly. Such products are constructed so that they can be analyzed for these characteristics. Lifecycle activities ensure that the product reflects the intent to ensure that the product is trustworthy and that vigorous efforts have been made to ensure the absence of unspecified functionality, whether accidental or intentional. This document provides policy and process for developing and approving software-related Configuration items (CIs), giving more detail than was covered in the Life Cycle Management Plan (LCMP). This document does not replace the LCMP, it expands on the principles and processes the LCMP defined, and should not conflict with the LCMP in any way. Other documents will describe the standards for hardware development.