Mobile devices have become ubiquitous in almost every sector of both private and commercial endeavors. As a result of such widespread use in everyday life, many users knowingly and unknowingly save significant amounts of personal and/or commercial data on these mobile devices. Thus, loss of mobile devices through accident or theft can expose users—and their businesses—to significant personal and corporate cost. To mitigate this data leakage issue, remote wiping features have been introduced to modern mobile devices. Given the destructive nature of such a feature, however, it may be subject to criminal exploitation (e.g., a criminal exploiting one or more vulnerabilities to issue a remote wiping command to the victim's device). To obtain a better understanding of remote wiping, we survey the literature, focusing on existing approaches to secure flash storage deletion and provide a critical analysis and comparison of a variety of published research in this area. In support of our analysis, we further provide prototype experimental results for three Android devices, thus providing both a theoretical and applied focus to this article as well as providing directions for further research.

Cloud services are now used by many organizations for the computation and storage of both public and sensitive data. Organizations expect that the data stored on clouds will be reasonably protected in terms of confidentiality, integrity and availability (CIA). In this paper, we review the cloud security literature to determine key contemporary attack consequences and mitigation strategies in the cloud environment. We categorize the consequences and mitigation strategies using the people, process and technology (PPT) and CIA classifications. We then construct a taxonomy of consequences and mitigation strategies, and use the themes discovered to present a conceptual privileged access management architecture.

Although system virtualization is not a new paradigm, the way in which it is used in modern system architectures provides a powerful platform for system building, the advantages of which have only been realized in recent years, as a result of the rapid deployment of commodity hardware and software systems. In principle, virtualization involves the use of an encapsulating software layer (Hypervisor or Virtual Machine Monitor) which surrounds or underlies an operating system and provides the same inputs, outputs, and behavior that would be expected from an actual physical device. This abstraction means that an ideal Virtual Machine Monitor provides an environment to the software equivalent to the host system, but which is decoupled from the hardware state. Because a virtual machine is not dependent on the state of the physical hardware, multiple virtual machines may be installed on a single set of hardware. The decoupling of physical and logical states gives virtualization inherent security benefits. However, the design, implementation, and deployment of virtualization technology have also opened up novel threats and security issues which, while not particular to system virtualization, take on new forms in relation to it. Reverse engineering becomes easier due to introspection capabilities, as encryption keys, security algorithms, low-level protection, intrusion detection, or antidebugging measures can become more easily compromised. Furthermore, associated technologies such as virtual routing and networking can create challenging issues for security, intrusion control, and associated forensic processes. We explain the security considerations and some associated methodologies by which security breaches can occur, and offer recommendations for how virtualized environments can best be protected. Finally, we offer a set of generalized recommendations that can be applied to achieve secure virtualized implementations.

Network forensics is a branch of digital forensics which has evolved recently as a very important discipline used in monitoring and analysing network traffic — particularly for the purposes of tracing intrusions and attacks. This paper presents an analysis of the tools and techniques used in network forensic analysis. It further examines the application of network forensics to vital areas such as malware and network attack detection; IP traceback and honeypots; and intrusion detection. Further, the paper addresses new and emerging areas of network forensic development which include critical infrastructure forensics, wireless network forensics, as well as its application to social networking.

Researchers in the growing fields of digital and network forensics require new tools and techniques to stay on top of the latest attack trends, especially as attack vectors shift into new domains, such as the cloud and social networks.

Wireless Personal Area Networks provide a pivotal role in local area network technology complementing traditional Wireless Local Area Network technologies. Bluetooth, ZigBee and NFC (Near Field Communications) have emerged as key WPAN technologies with UWB (Ultra Wide Band) standards currently evolving. They are however subject to the usual range of security vulnerabilities found in wireless LANs such as spoofing, snooping, man-in-the-middle, denial of service and other attacks. However security in WPANs is not as mature as it is in Wireless LANs and further work is needed in order to provide comparable protection. This paper examines a range of WPAN technologies and security issues and proposes protection mechanisms that can mitigate risk in each case.

Recent advances in hardware, software, and communication technologies are enabling the design and implementation of a whole range of different types of networks that are being deployed in various environments. One such network that has received a lot of interest in the last couple of years is the Vehicular Ad-Hoc Network (VANET). VANET has become an active area of research, standardization, and development because it has tremendous potential to improve vehicle and road safety, traffic efficiency, and convenience as well as comfort to both drivers and passengers. Recent research efforts have placed a strong emphasis on novel VANET design architectures and implementations. A lot of VANET research work have focused on specific areas including routing, broadcasting, Quality of Service (QoS), and security. We survey some of the recent research results in these areas. We present a review of wireless access standards for VANETs, and describe some of the recent VANET trials and deployments in the US, Japan, and the European Union. In addition, we also briefly present some of the simulators currently available to VANET researchers for VANET simulations and we assess their benefits and limitations. Finally, we outline some of the VANET research challenges that still need to be addressed to enable the ubiquitous deployment and widespead adoption of scalable, reliable, robust, and secure VANET architectures, protocols, technologies, and services.

Intrusion Detection Systems (IDS) tools are deployed within networks to monitor data that is transmitted to particular destinations such as MySQL, Oracle databases or log files. The data is normally dumped to these destinations without a forensic standard structure. When digital evidence is needed, forensic specialists are required to analyse a very large volume of data. Even though forensic tools can be utilised, most of this process has to be done manually, consuming time and resources. In this research, we aim to address this issue by combining several existing tools to archive the original IDS data into a new container (Digital Evidence Bag) that has a structure based upon standard forensic processes. The aim is to develop a method to improve the current IDS database function in a forensic manner. This database will be optimised for future, forensic, analysis. Since evidence validity is always an issue, a secondary aim of this research is to develop a new monitoring scheme. This is to provide the necessary evidence to prove that an attacker had surveyed the network prior to the attack. To achieve this, we will set up a network that will be monitored by multiple IDSs. Open source tools will be used to carry input validation attacks into the network including SQL injection. We will design a new tool to obtain the original data in order to store it within the proposed DEB. This tool will collect the data from several databases of the different IDSs. We will assume that the IDS will not have been compromised.

Taxonomies have been widely documented in the literature and a number of classical approaches exist. The main problem is that many of these approaches are very general and, for example, apply to all networks and computer systems. The intention of this paper is not to invent a new taxonomy architecture but to create a model which is adaptable to new types of networks and new attack vectors and which can then be applied and be of use in specific situations. When the “classical” taxonomies were developed systems such as cloud computing, 3G malware, VoIP and social engineering vulnerabilities were unheard of. This paper therefore proposes a model which can be readily adapted to be of value in attack classification and vulnerability detection for specific cases such as those illustrated above. Thus the model can be adapted to new types of networks, devices and systems as they evolve as well as being able to incorporate new attack categories and techniques and adapt to new types of protection mechanisms.

The objective of this paper is to provide a managed always best connected service to mobile entities over underlying heterogeneous wireless and mobile platforms while maintaining negotiated security and quality of service (QoS). This paper proposes a new model and its architecture which is based upon Policy-based Management but provides a new framework based on layered-approach for the centralised management of mobile clients. In particular, we propose and implement a new model of a policy-managed mobile client and its architecture to support seamless handoff across multiple access networks. The proposed mobile client supports multi-domain authentication, authorisation and security based on user profiles as well as the ability to negotiate management services over interconnected heterogeneous mobile platforms. We have also proposed a new handoff initiation algorithm to select an optimum time to handoff. This algorithm combines metrics in a novel way using standard deviations without resorting to other computationally intensive methods. Finally, this paper describes a proof-of-concept implementation based upon Microsoft Windows presenting a performance analysis to validate our architectural approach.

Recent years have seen substantial development in computer and network security design. This has been manifested as an every increasing range of new protocols, new encryption algorithms, new methods of authentication, smarter firewalls and intrusion detection techniques, new anti-malware products and many more. During the same period of time increasing demands for more trustworthy network infrastructure have seen the development of sophisticated analysis tools necessary to meet the operational requirements of law enforcement agencies. These include tools for e-discovery, commercial intelligence and national security. Thus the industry has seen equally significant developments in computer forensic tools where methods of searching for and detection of, malicious activity for presentation as evidence and provision of trust have become ever more sophisticated. To a considerable degree the science of security and forensics have seen both rapid but separate developments. This paper proposes that there are areas in common between these two important fields of endeavour and sets out techniques and ideas which demonstrate how they can overlap and work together in order to provide improved security and trustworthiness in critical infrastructures. In particular this paper addresses computer security and forensic analysis from a real-time perspective such that security events can be monitored in a live network while sound forensic data collection, storage and processing can be carried out in a manner which supports real-time security and at the same time still meeting the requirements of sound evidence.

This work in progress paper discusses the development and evaluation of an open source secure web gateway. The proof of concept system uses a combination of open source software (including the Greasyspoon ICAP Server, Squid HTTP proxy, and Clam Antivirus) to perform the various security tasks that range from simple (such as passive content insertion) to more advanced (such as active content alteration) by modules installed on the server. After discussing the makeup of the proof of concept system we discuss our evaluation methodology for both effectiveness and performance. The effectiveness was tested using comparative analysis of groups of self-browsing high interaction client honeypots (employing a variety of security measures) and recording different system alteration rates. Performance was tested across a wide range of variables to determine the failure conditions and optimal set up for the components used.

Network security design has seen significant advances in recent years. This has been demonstrated by a growing number of new encryption algorithms, more intelligent firewall and intrusion detection techniques, new developments in multifactor authentication, advances in malware protection and many more. During a similar period of time the industry has seen the need for network infrastructure which provides a greater degree of trust which has resulted in the development of forensic analysis tools which meet the requirements of law enforcement agencies. Such tools must provide for commercial intelligence and national security. This paper proposes that application of the common ground between security and forensics has great potential to provide for improvements in the effort to achieve real-time adaptive security. This implies an architecture which can detect security breaches and in real-time record and analyse traffic logs in a forensically sound manner, provide corrective feedback to security devices and attempt to trace back to the source of the attack. In addressing computer security and forensic analysis from a real-time perspective, this paper recognises that some of these processes already exist, but proposes methods whereby the ongoing damage and potential risk to critical infrastructure can be reduced. This requires the implementation of a highly integrated approach to security and forensics such that they can inter-work in real-time in order to address the significant security issues which currently face the industry.

In Trusted Network Connect (TNC), a network access decision is based on the security state of an access requesting party. This mechanism is limited to closed environments such as LANs and VPNs. In this paper, we propose solutions based on authentication standards for enabling TNC in open, web-based scenarios. In particular, an architectural model for TNC is proposed that takes additional security and privacy requirements into account. Furthermore, a communication scheme is proposed that is based on standardised protocols and message formats. This approach provides assurance as to the security state of clients accessing security sensitive web-based services.

Acquisition of data stored on mobile network client equipment including 3G devices, Personal Digital Assistants, Pocket PCs running operating systems such as Symbian and Windows Mobile may be required for forensic purposes. Access to such devices across wireless and mobile interfaces raises challenges which do not normally exist when forensic analysis of hard drives and other storage media occurs. Only limited research has been carried out in this area of wireless forensics and this paper discusses the design and proofof- concept testing of a forensic application tool which runs on a desktop computer and can be used to extract data from mobile devices consistent with forensic analysis used on non-mobile equipment. This paper addresses new ideas in data acquisition over wireless networks irrespective of the underlying reason for the acquisition requirements of such information. This project succeeded in demonstrating the mapping of a mobile device's internal and external memory and the copying of folders and files from memory to a computer across a mobile interface.

Conventional security mechanisms providing confidentiality, integrity and authentication are facing new challenges in modern wired and wireless networks. Deniable encryption allows encrypted data to be decrypted to different sensible plaintexts, depending on the key used or otherwise makes it impossible to prove the existence of the real message without the proper encryption key. This allows the sender to have plausible deniability if compelled to give up their encryption key. Deniable file systems allow for the creation of an encrypted volume on a hard disk and a second, hidden deniable file system created inside with access by a second password. The objective of this research is to establish whether or not evidence of a hidden volume can be found in deniable encryption tools using conventional forensic analysis. A testbed is developed using open source deniable encryption software and forensics tools with the objective of proving or disproving this claim.

There have been many changes in the face of computi ng in past decade, one of which is undoubtedly the introductio n of mobile computing. The ability to be connected to the Inter et at all times with the best available access network introd uces an idea of Always-Best-Connected (ABC) services. However, with a wide range of access technologies and mobile-networ ked devices together with increasing demands of mobile us rs, introduces the notion of integration and inter-work ing of these heterogeneous access networks. To realise the mobility requirement of mobile users , network service providers need to dynamically manage their n twork resources and be able to adapt according to the pre s nt network conditions, while continually providing agreed-serv ices to their home and guest users. This requires a centralised m onitoring and management system. Sometimes referred to as 4 th generation (4G) networks, the overall objective is to provide a managed ABC services over underlying heterogeneous w ireless and mobile platforms while maintaining negotiated s curity and Quality of Service in an open and customisable envi ro ment. This paper provides an overview of a proposed layer ed model and its architecture, which is based upon Policy-ba sed Management (PBM). Proposed model provides a framewor k for the centralised management of networks based on bus inesslevel policies, which facilitates the negotiation o f management services over interconnected heterogonous mobile pl atforms thus achieving an always best-connected scenario.

Degradation in performance has been a common reason for the limited use of security in Wireless LAN equipment such as wireless PCs and embedded devices such as PDAs. However, such performance has depended in part upon the technical options chosen for encryption, authentication and re-keying. Thus this paper describes the performance analysis and empirical measurement of a range of security levels based upon variations of WEP, WPA and WPA2 in a variety of Wireless LAN architectures. The paper provides an analysis of performance measured over a range of experiments run on a testbed and builds upon previous work on performance analysis of earlier wireless network security protocols.