What's Significant in the NSA Revelations

Professor Susan Landau
Google

Did the documents released this summer cause irreparable harm, or were these facts that should be publicly examined? What are the facts, anyhow? This talk puts the NSA revelations in context, explaining what's new, why it matters, and what might happen next. This area is so densely overlaid by laws and secret rulings that even the lawmakers who created it can't always see inside. So part of the talk will simply clear the underbrush to get a feel for the general shape of the forest; then I will discuss what's new, what was already known (by anyone paying attention), and what was surprising.

Biography: Dr. Susan Landau is a Senior Staff Privacy Analyst at Google. She works in cybersecurity, privacy, and public policy. Landau was previously a Distinguished Engineer at Sun Microsystems, and has been a faculty member at the University of Massachusetts at Amherst and at Wesleyan University. She has held visiting positions at Harvard, Cornell, and Yale, and the Mathematical Sciences Research Institute.

Dr. Landau is the author of Surveillance or Security? The Risks Posed by New Wiretapping Technologies (MIT Press, 2011), and co-author, with Whitfield Diffie, of Privacy on the Line: The Politics of Wiretapping and Encryption (MIT Press, 1998, rev. ed. 2007). She has written numerous computer science and public policy papers and op-eds on cybersecurity and encryption policy, and she has testified in Congress on the security risks of wiretapping and on cybersecurity activities at NIST's Information Technology Laboratory.

Dr. Landau currently serves on the Computer Science Telecommunications Board of the National Research Council. A 2012 Guggenheim fellow, Dr. Landau was a 2010-2011 fellow at the Radcliffe Institute for Advanced Study, the recipient of the 2008 Women of Vision Social Impact Award, and also a fellow of the American Association for the Advancement of Science and the Association for Computing Machinery. She received her BA from Princeton, her MS from Cornell, and her PhD from MIT.

Visions on a new Emancipated Internet

Professor Germano Caronni
Google

In its original design, the Internet was intended to provide connectivity between diverse autonomous networks. Survivability in the face of loss of components, universal applicability, ease of adding components, distributed resource management, cost effectiveness and accountability were also strong goals. In the past 40 years, the Internet has grown ubiquitous, voluminous, highly commercial, and in general crucial to modern society. The current daily traffic volume easily surpasses 3 PB, with strong continued growth. However, in its current form, and despite the initial design goals, the Internet lacks resilience, has become much less survivable in the face of catastrophic events, is heavily controlled by national and regional interests, and is highly challenged by the lack of security and privacy as original design principles. In my talk, I'll quickly explore the forces and developments that led to the current state of the Internet. I'll then outline a few scenarios in which the Internet as we know it would fail, but where a working communication infrastructure would be critical to have. Finally I'll give a vision statement for an Emancipated Internet, and explore a representative set of new and emerging efforts that may move us in that direction, by providing new avenues of communication, and enhancing the availability and trustworthiness of crucial services.

Biography: Dr. Germano Caronni (IEEE SM/ACM/ISOC) received his PhD on QoS-based Dynamic Security in 1999, from ETH Zürich. He was one of the first to invent a process to watermark images, and led the independent implementation effort for SKIP/IPSEC, and its integration into an adaptive firewall. From 1997 to 2006, Dr. Caronni was with Sun Microsystems, where he introduced a novel solution to secure multicasting, worked on authentication frameworks, participated in the design of an overall security architecture for Sun's products, and co-invented the concept of "Public Utility Computing". He was a member of the Security Research Group at Sun Laboratories, and as senior staff engineer he worked in the realm of rights management, P2P secure networking and secure storage. Since 2006, Dr. Caronni has worked at Google, where he led the imap for Gmail project, coordinated company-wide security reviews, spearheaded an effort to encrypt all user-data at rest, co-led the creation of a breakthrough new architecture for company-wide incident response and forensics. He currently works on another undisclosed security-relevant project.

Towards Automatic Detection of Novel Security Threats

Dr. Pavel Laskov
University of Tübingen

Computer security is a never-ending race between attack and defense. What makes this race particularly challenging nowadays is the value of assets targeted by cyberattacks. On a "mass-market" of cybercrime lie personal credentials of millions of Internet users such as credit card and bank account numbers, email and social network accounts, virtual currencies in online games and many other kinds of personal information that can be exploited for monetary profit. On the other end of computer attack spectrum lies targeted penetration of highly sensitive corporate or governmental sites, with the aim of stealing corporate know-how and classified data, or even carrying out acts of sabotage. The strong "economic motivation" behind modern cyberattacks fuels a rapid development of novel attack methods and raises a major challenge for security technologies: to detect previously unseen threats.

A powerful instrument for effective protection against novel security threats is data analysis tools. An almost unlimited amount of data can be collected by monitoring various security-related indicators such as audit logs and network traffic. Using such data, predictive models can be built by machine learning methods and subsequently deployed to assess previously unseen data. In this talk, I will review the general principles of building learning-based security techniques and present examples of several successful reactive security systems built on these principles. As a future challenge, I will discuss the problem of secure data analysis, the importance of which transcends the field of computer security and has a potential impact on many crucial Internet applications.

Biography: Dr. Pavel Laskov graduated from the Moscow Institute of Radio, Electronics and Automation (Russia) in 1994 with a diploma in computer engineering. He received a M.Sc. and a Ph.D. in computer science from the University of Delaware (Newark, DE, USA) in 1996 and 2001 respectively. In 1997 he visited AT&T Research where he was involved in the pioneering work on kernel methods of machine learning headed by V. Vapnik, the inventor of Support Vector Machines. From 2001 to 2010 he was a senior researcher at the Fraunhofer Institute FIRST in Berlin. In 2004 he started investigation of machine learning methods for intrusion detection and has lead the development of the self-learning intrusion detection system ReMIND. In 2009 he was awarded a Heisenberg Fellowship of the German Science Foundation and moved to the University of Tübingen. His research interests span intrusion detection, static and dynamic malware analysis, security of machine learning algorithms and many other related topics. He has published over 50 articles in refereed journals and conference proceedings and has served in program committees of several international conferences.