Cybersecurity
-

Location-based services from are quickly gaining popularity. Many such services track the user's location and make use of it as needed. While tracking raises privacy concerns, it is believed to be unavoidable if users want the benefits of location-based services. In this talk I will give several examples of services that provide location-based functionality without learning the user's location. Our goal is to show that privacy and functionality are not always in conflict. We will also discuss our experiences with deploying these mechanisms in the real world. This is joint work with Arvind Narayanan, Mike Hamburg, and Narendran Thiagarajan.


About the speaker: Dr. Boneh heads the applied crypto group at the Computer Science
department at Stanford University. Dr. Boneh's research focuses on applications of cryptography to computer security. His work includes cryptosystems with novel properties, security for mobile devices, web security, digital copyright protection, and cryptanalysis. He is the author of over a hundred technical publications in the field and a recipient of the Packard Award, the Alfred P. Sloan Award, the RSA award, and the Terman Award.

CISAC Conference Room

Not in residence

0
Rajeev Motwani Professor in the School of Engineering and Professor of Electrical Engineering
Co-director of the Stanford Computer Security Lab
Co-director of the Stanford Cyber Initiative
Affiliate Faculty at CISAC
dabo.jpg MA, PhD

Professor Boneh heads the applied cryptography group and co-direct the computer security lab. Professor Boneh's research focuses on applications of cryptography to computer security. His work includes cryptosystems with novel properties, web security, security for mobile devices, and cryptanalysis. He is the author of over a hundred publications in the field and is a Packard and Alfred P. Sloan fellow. He is a recipient of the 2014 ACM prize and the 2013 Godel prize. In 2011 Dr. Boneh received the Ishii award for industry education innovation. Professor Boneh received his Ph.D from Princeton University and joined Stanford in 1997.

Dan Boneh Professor of Computer Science and Electrical Engineering, Stanford University and CISAC Affiliate Speaker
Seminars
-

The Stuxnet computer worm is perhaps the most complicated piece of malicious software ever built - roughly 50 times the size of the typical computer virus. This threat leveraged a huge array of new techniques to spread itself, conceal itself and to attack Iranian nuclear enrichment centrifuges. This talk will provide a detailed dissection of the Stuxnet worm, answering such questions as how it spread, how it evaded detection, what it did once it found its target, and ultimately, how successful it was.


About the speaker: Carey Nachenberg is a Fellow and Chief Architect at Symantec corporation, the world's largest computer security provider. As Chief Architect, Mr. Nachenberg drives the technical strategy for all of Symantec’s core security technologies and security content, which in total protect hundreds of millions of customers around the world. During his time at Symantec, Mr. Nachenberg has led the design and development of Symantec’s core antivirus, intrusion prevention and reputation-based security technologies; his work in these areas have garnered over fifty United States patents.

He holds BS and MS degrees in Computer Science and Engineering from University of California at Los Angeles, where he continues to serve as an Adjunct Assistant Professor of Computer Science and a member of UCLA’s Computer Science Alumni Advisory Board.

CISAC Conference Room

Carey Nachenberg Vice President and Symantec Fellow Speaker Symantec Corporation
Seminars
-
     Vast resources are devoted to predicting human behavior in domains such as economics, popular culture, and national security, but the quality of such predictions is usually poor. It is tempting to conclude that this inability to make good predictions is a consequence of some fundamental lack of predictability on the part of humans. However, our recent work offers evidence that the failure of standard prediction methods does not indicate an absence of human predictability but instead reflects: 1.) misunderstandings regarding which features of human dynamics actually possess predictive power, and 2.) the fact that, until recently, it has not been possible to measure these predictive features in real world settings.
 
     This talk introduces some of the science behind this basic observation and demonstrates its utility through three case studies. We begin by considering social groups in which individuals are influ- enced by the behavior of others; in these situations, social influence is known to decrease the ex ante predictability of the ensuing social dynamics. We show that, interestingly, these same social forces can increase the extent to which the outcome of a social process can be predicted in its very early stages. This finding is then leveraged to design prediction methods which outperform existing techniques for predicting social group dynamics.
 
     The second case study involves analysis of the predictability of adversary behavior in the coevo- lutionary “arms races” that exist between attackers and defenders in many domains, including cyber security, counterterrorism, fraud prevention, and various markets. Our analysis reveals that conventional wisdom regarding these coevolving systems is incomplete, and provides insights which enable the development of proactive cyber defense methods that are much more effective than standard techniques. Finally, we consider the task of predicting human behavior at the level of individuals. In particular, we show that a given individual’s mobility patterns can be predicted with surprising accuracy, and conversely that knowledge of even a small portion of a person’s travel patterns permits reliable identification of that individual. 

About the speaker: Rich Colbaugh received his Ph.D. in Mechanical Engineering from The Pennsylvania State University in 1986. He presently holds a joint appointment with the New Mexico Institute of Mining and Technology, where he is Chief Scientist of ICASA and a Professor in both the Mechanical Engineering and Management Departments, and Sandia National Laboratories, where he is a member of the Analytics and Cryptography Department. His research activities have focused on the modeling, analysis, and control of dynamical systems of importance in nature and society. Much of this work involves the study of very large, complex networks, including those of relevance to national security, socioeconomic systems, advanced technology, and biology.
 
Dr. Colbaugh spent 2001-2006 with the U.S. Intelligence Community in Washington DC advising senior leadership on counterterrorism and counterproliferation programs. Since 2007 he has concentrated his research and development efforts on social media analytics, attracting support for this program from agencies such as the Department of Defense, the Department of Homeland Security, the Department of Energy, and the National Science Foundation.

Reuben W. Hills Conference Room

Rich Colbaugh Sandia National Laboratory; Chief Scientist, Institute for Complex and Adaptive Systems, New Mexico Institute of Mining and Technology Speaker
Seminars

Not in residence

0
Rajeev Motwani Professor in the School of Engineering and Professor of Electrical Engineering
Co-director of the Stanford Computer Security Lab
Co-director of the Stanford Cyber Initiative
Affiliate Faculty at CISAC
dabo.jpg MA, PhD

Professor Boneh heads the applied cryptography group and co-direct the computer security lab. Professor Boneh's research focuses on applications of cryptography to computer security. His work includes cryptosystems with novel properties, web security, security for mobile devices, and cryptanalysis. He is the author of over a hundred publications in the field and is a Packard and Alfred P. Sloan fellow. He is a recipient of the 2014 ACM prize and the 2013 Godel prize. In 2011 Dr. Boneh received the Ishii award for industry education innovation. Professor Boneh received his Ph.D from Princeton University and joined Stanford in 1997.

Authors
News Type
Q&As
Date
Paragraphs

As the Internet evolves, people around the world have faster, easier ways to connect. Innovative plans and economic opportunities are being hatched online, but so are ideas that challenge governments. Voices of dissent are amplified by social media tools like Facebook, Twitter and YouTube, leaving some countries confused about how to balance free expression rights against perceived threats to national security and government stability.

Working with the Center for International Security and Cooperation at Stanford’s Freeman Spogli Institute for International Studies, Eileen Donahoe is trying to make government officials feel more comfortable with online technology. Donahoe, the U.S. ambassador to the United Nation’s Human Rights Council, recently brought about 35 diplomats from around the world to Stanford. The group met with academics, Internet developers and technology business leaders to address the questions posed by a free and open Internet.

“I know the technology feels mysterious and challenging,” says Donahoe, who was an affiliated scholar at CISAC before becoming an ambassador. “So part of what we tried to do was demystify it. But we also conveyed the message that you’re not going to control technological change. And you’d better get used to it. It’s part of our world.”

In the following interview, Donahoe and CISAC co-director Mariano-Florentino Cuéllar discuss the challenges and potential promised in the online frontier.

Why did you arrange this meeting of diplomats in Silicon Valley?

Donahoe: Some ambassadors who are otherwise very committed to human rights have started to feel that the protections for freedom of expression and freedom of assembly could be weakened or lessened when you bring technology into the mix. There was a sense that governments could legitimately squelch free speech and free assembly when it happened in the online world. That’s a problem because so much of what happens today happens online. The Internet is now so central to the ability to speak freely. It was our responsibility to call them out and make them understand that technology should not change the equation in the protection of human rights.

How has the Internet changed the way we need to think about human rights and free expression?

Donahoe: In some ways, it hasn’t changed anything – free speech is free speech. But new technology has created new media, and that’s all changing at an exponential pace. People are being required to adjust in timeframes that were unimaginable before, and governments can’t keep up. Individuals can hardly keep up. It’s the pace and innovation that’s challenging. But there’s no change in our responsibility to protect the longstanding values of free expression.

What does a free and open Internet have to do with global security?

Cuéllar:  Some governments lack a commitment to basic rights and the rule of law. Technology can help people respond by raising their voices. They can organize and respond when their own government threatens citizens’ security.  Cyber technologies can also empower law enforcement officials, intelligence agencies and armed forces, raising fundamental questions about the role of government and the nature of conflict in the years to come. The Internet is an evolving technology that reflects vulnerability and enormous potential. Societies depend on government and private sector systems that face a variety of threats.  For all these reasons, the future of cyberspace is an important security issue at the very center of our agenda at CISAC.

Why do some governments feel threatened by the Internet?

Donahoe: It comes from the volume of voices you can have online. It comes from the pace of change. And there’s another aspect to online technology that’s intriguing: It is inherently democratizing. Citizens are becoming journalists. Anyone with a cell phone can broadcast live to the planet anything they’re observing. That can be threatening, but I believe it’s ultimately going to be a very positive force for transparency and government accountability.

How do you convince governments worried about those threats that open Internet access is ultimately in their best interest? 

Cuéllar: If the leaders of a state see it merely as a vehicle for control and stability, then much of the technology we have been discussing will appear profoundly threatening.  States seeking to build or maintain lasting institutions capable of meeting the needs of their citizens will tend to take a different approach, focused on the value of the public’s feedback and participation in governance.

Donahoe: A compelling point – especially for developing countries that may not otherwise place emphasis on the benefits to freedom from technology – is the recognition that there’s an economic upside to a free and open Internet. It can be framed as a development issue. Many government leaders can see that the future of all our economies is so intricately connected to this technology that if they try to squelch or shut down Internet development for political reasons, there will be dramatically negative effects for their economies. And that will lead to political problems. The economic value isn’t my primary human rights emphasis, but it helps to remind governments they run the risk of shutting themselves out of economic development if they don’t get comfortable with the technology.

What role, if any, should governments play in regulating the Internet?

Donahoe: Governments do need to play a role in regulation, just as they do in the offline world. But just because technology is brought into the equation doesn’t mean governments and regulators should be free to regulate too broadly or without concern for the costs to freedom. Just like in the offline world, regulation must be narrowly tailored and serve important government interests. Part of the challenge comes from the sense that governments can’t keep up with the technological advances. So they’re inclined to regulate more – and more bluntly – rather than in a more tailored way. This is where governments need to get more sophisticated about how to adjust to technological change.

What do policymakers need to know and understand before passing regulations?

Cuéllar: The future of cyberspace implicates security, economic development and the protection of civil and political rights – and all of these challenges are deeply interrelated.  A country's decision to restrict certain forms of Internet traffic can discourage economic innovation. Internet access in poor communities can lead to new economic opportunities, changing the larger context in which governance and security problems arise.  It is crucial to recognize these connections as societies think through the future of cyberspace.

Hero Image
internet 2
All News button
1
-

About the topic: Mr. Painter will discuss the cyber threats we are facing, and U.S. diplomatic efforts to achieve an open, interoperable and secure cyberspace.

About the Speaker: Christopher M. Painter has been on the vanguard of cyber issues for twenty years.  Most recently, Painter served in the White House as Senior Director for Cybersecurity Policy in the National Security Council Staff.  During his two years at the White House, Painter was a senior member of the team that conducted the President's Cyberspace Policy Review and subsequently served as Acting Cybersecurity Coordinator. He coordinated the development of a forthcoming international strategy for cyberspace and chaired high-level interagency groups devoted to international and other cyber issues.

He began his federal career as an Assistant U.S. Attorney in Los Angeles where he led some of the most high profile and significant cybercrime prosecutions in the country, including the prosecution of notorious computer hacker Kevin Mitnick.  He subsequently helped lead the case and policy efforts of the Computer Crime and Intellectual Property Section in the U.S. Department of Justice and served, for a short time, as Deputy Assistant Director of the F.B.I.'s Cyber Division.  He is a graduate of Stanford Law School and Cornell University.


CISAC Conference Room

Christopher M. Painter Coordinator for Cyber Issues, U.S. Department of State Speaker
Seminars
News Type
News
Date
Paragraphs

Computers and the networks that connect them are powerful storehouses of information. They're also vulnerable to sabotage, and the data they handle can be stolen, altered or erased. President Obama has called cyberattacks "one of the most serious economic and national security threats our nation faces." 

To help tackle the problem, researchers at Stanford’s Center for International Security and Cooperation are exploring issues in cybersecurity and keeping a close eye on the policy discussions. Earlier this month, CISAC brought together a group of lawmakers and industry leaders from Silicon Valley to discuss new efforts to prevent cyberespionage and related crimes. 

Rep. Mike Rogers (R-Mich.) talked about a bill he’s introduced to safeguard technology. "The intelligence community believes strongly that it's just a matter of time before we have a catastrophic cyberattack," said Rogers, chairman of the House Permanent Select Committee on Intelligence. "We have admired this problem for a very long time and it's time to do something." 

Among the other speakers were Rep. Anna Eshoo (D-Calif.), Intel Chief Executive Officer Paul Otellini, and security experts from Google, Cisco Systems and Oracle. 

After the invitation-only event, CISAC's Mariano-Florentino Cuéllar, Otellini and Rogers discussed the future of the Internet, the scope of the cyberthreat and government's role in defending against it. Excerpts: 

 

There are core questions about where the world is going  

"Cybersecurity problems are real and they’re immediate. And the threats are probably growing and the problems we face require solutions. But it’s just as important to think about where we’re going to be 20 to 30 years from now as it is to deal with the immediate problems. That’s because the choices we make about how to secure cyberspace are going to be choices about what your identity will be online, what powers government will have, what nation states will be able to do to each other, what companies will be able to do when they deal with cyberthreats, how aggressively they will be able to respond on their own -- those are essentially choices about the architecture of the world. So it's useful for us to understand as scholars and as people engaged in policy, that choices about cybersecurity are not just technical. They’re really core questions about where is the world going."

-- Mariano-Florentino Cuéllar, co-director, Center for International Security and Cooperation

 

Preventing electronic pickpockets 

"On the commercial side it's no secret that there's industrial espionage going on through cyberhacking. There are also rogue groups that are not nation states, but people who just want to steal your identity. So the ability to see those attacks coming, to see those profiles coming, and to be able to improve the quality of the computer network and the phone networks and the phones themselves will also allow us to protect our own intellectual property as companies, and protect the identity and potentially the financial assets of our collective customers. When your cell phone is your wallet -- as it will be in the not-too-distant future -- all of a sudden that's like having an electronic pickpocket. An attack is going to compromise everything you have. Beyond that, many large technology firms feel that as good corporate citizens and as good local citizens, we have a responsibility to try and make sure the world's computer networks are not disrupted. If computers aren’t trusted, we don't have much of a business. We are commercially incentivized to make all this stuff so much better."

-- Paul Otellini, chief executive officer, Intel. 

 

We can be a partner with industry 

"Individually, a company gets hacked for espionage purposes -- that's a criminal event. Collectively, it becomes a national security issue because of the sheer volume of intellectual property that would be compromised. You also have the other level: a disruptive cyberattack that shuts down certain capabilities, whether it's financial, in the energy sector or otherwise. We've fought this fight with dot-gov and dot-mil for quite a long time. Dot-com has, too, but they've been a bit on their own. This proposal has the government weighing in and saying, 'Hey, maybe we can be a partner.'"

-- Mike Rogers, chairman of the House Permanent Select Committee on Intelligence. 

All News button
1
-

Christopher Painter has been on the vanguard of cyber issues for twenty years. Most recently, Mr. Painter served in the White House as Senior Director for Cybersecurity Policy in the National Security Staff. During his two years at the White House, Mr. Painter was a senior member of the team that conducted the President's Cyberspace Policy Review and subsequently served as Acting Cybersecurity Coordinator. He coordinated the development of a forthcoming international strategy for cyberspace and chaired high-level interagency groups devoted to international and other cyber issues.

Mr. Painter began his federal career as an Assistant U.S. Attorney in Los Angeles where he led some of the most high profile and significant cybercrime prosecutions in the country, including the prosecution of notorious computer hacker Kevin Mitnick. He subsequently helped lead the case and policy efforts of the Computer Crime and Intellectual Property Section in the U.S. Department of Justice and served, for a short time, as Deputy Assistant Director of the F.B.I.'s Cyber Division. For over ten years, Mr. Painter has been a leader in international cyber issues. He has represented the United States in numerous international fora, including Chairing the cutting edge G8 High Tech Crime Subgroup since 2002. He has worked with dozens of foreign governments in bi-lateral meetings and has been a frequent spokesperson and presenter on cyber issues around the globe. He is a graduate of Stanford Law School and Cornell University.

Sloan Mathematics Center

Christopher Painter Coordinator for Cyber Issues Speaker US State Department
Seminars
Subscribe to Cybersecurity