Security and Privacy

Conferência ao IV Congresso Interativo Virtual "Humanos Direitos Máquinas - amigos ou inimigos". Universidad Nacional de Lanús / E-Justicia Latinoamérica, Argentina. Dia 20 de novembro de 2019.
A mesma retoma a comunicação apresentada na "Nordic Conference on Legal Informatics - 2019", na Universidade da Lapónia, Rovaniemi, dia 14 de novembro de 2019.

With the pace of increasing online transactions and communication, the demand for security and privacy increases. To protect confidential information and to authenticate people electronically, several solutions already introduced. Traditional biometric systems that are based on single biometric usually suffer from problems like impostors' attack or hacking, unacceptable error rates. To improve security and privacy and system's reliability two or more biometrics of the same identity could be combined in a method that enhances the efficiency of the system. The biometric information, however, is irreplaceable information, when it is compromised. Thereby, one must give a special attention to protection of such information. We propose a novel protection technique for the biometric information, especially the feature information and the templates. The point of our proposal is securely embeds and extracts an iris template in a fingerprint image using a combined DWT and LSB based biometric watermarking algorithm in each authentication. The embedded data travel through insecure communication line like the internet, and they are used in matching process. This technique causes security against eavesdropping and replay attacks on the internet, because the watermark embedded transmitted data are used in the authentication session after watermark extraction.

This paper summarizes the ideas and results of three working groups that convened during the 1st International Conference on Security in Pervasive Computing. The scope of the workshop was to identify and discuss security and privacy issues specific to pervasive computing and how to address these issues with appropriate means.

This essay aims to address a general conception of what privacy is, as well as an analysis of the challenges and dangers of living without privacy and the importance of data protection against the breakdown of traditional paradigms by new technologies disruptive, concluding that cyber literacy and cyber hygiene are fundamental pillars to combat threats, disclosures, risks and vulnerabilities that could become security incidents that threaten arbitrary interference with private life.

Radio-Frequency Identification (RFID) is going to be the preferred technology for the realization of Machine Readable Travel Documents (MRTDs), and has been deployed in the last generation of e-passports. The proposed technical specifications for e-passport systems have been analyzed and criticized by security experts showing various functional, security and privacy deficiencies. The next generation of e-passports will implement more advanced cryptographic mechanisms, collectively known as Extended Access Control, and in particular a protocol referred to as Chip Authentication that protects an e-passport against cloning and transferability attacks. The Extended Access Control suite of protocols has found minor attention in the literature until now. In this paper we point out possible attacks against Chip Authentication as proposed in the current specifications for Extended Access Control. In particular, we show that the possibility of transferability and reset attacks weaken the claimed security of the underlying Chip Authentication protocol. We also discuss the shortcomings of the existing literature on the security definitions for resettable identification protocols and propose a new definition that is more suited for real world scenarios. Based on known cryptographic techniques we finally propose an efficient protocol that is instead secure against such attacks.

... for FISMA (Federal Information Security Management Act) compliance for its Cloud-Computing services in order to be acceptable for the public sector[17]. ... 17. Howard, AB, FISMA compliance for federal cloud computing on the horizon in 2010. SearchComplaince.com, 2009. 18. ...

Este livro é destinado a estudantes, pesquisadores, profissionais e demais interessados em comércio eletrônico (e-commerce), e faz um resgate histórico do surgimento das compras on-line, sua evolução no decorrer dos anos, além de explanar sobre as vantagens e as desvantagens de se utilizar as ferramentas e os recursos do ambiente virtual. Um dos principais objetivos do autor é apresentar como se relacionam alguns aspectos que, via de regra, estão presentes em tal ambiente, como a privacidade, a segurança, a qualidade das informações, a confiança, a propaganda boca a boca eletrônica e a intenção de recompra. Trata-se de uma leitura envolvente, ilustrada com diversas evidências empíricas nacionais e internacionais, complementada por uma ampla pesquisa realizada entre consumidores brasileiros que costumam realizar compras no formato on-line.

Anomaly detection in a wireless sensor network (WSN) is an important aspect of data analysis in order to identify data items that significantly differ from normal data. A characteristic of the data generated by a WSN is that the data distribution may alter over the lifetime of the network due to the changing nature of the phenomenon being observed. Anomaly detection techniques must be able to adapt to a nonstationary data distribution in order to perform optimally. In this survey, we provide a comprehensive overview of approaches to anomaly detection in a WSN and their operation in a nonstationary environment.

Despite years of heavy criticism, privacy self-management (i.e., the principle that people individually manage their privacy via notice and choice) remains the standard of privacy protection throughout the Western world. Building on previous research, this paper provides an overview and classification of the manifold obstacles that render privacy self-management largely useless in practice. People's privacy choices are typically irrational, involuntary and/or circumventable due to human limitations, corporate tricks, legal loopholes and the complexities of modern data processing. While, at first glance, privacy self-management appears to embody fundamental values such as liberalism and individualism, in reality it rather deprives than strengthens people's autonomy. Moreover, the selfmanagement approach ignores the consequences that individual privacy choices have on other people and society at large. Regarding future research, we argue that the focus should not be on whether privacy self-management can be fixed by making it more user-friendly or efficient-it cannot. The concept is based on fundamentally wrong assumptions. To meaningfully address the potentials and dangers of personal data processing in the 21st century, a shift away from relying so heavily on individual control is inevitable. We discuss potential ways forward, stressing the need for government intervention to regulate the social impact of personal data processing.

Current mechanisms for authenticating communication between devices that share no prior context are inconvenient for ordinary users, without the assistance of a trusted authority. We present and analyze Seeing-Is-Believing, a system that utilizes 2D barcodes and cameraphones to implement a visual channel for authentication and demonstrative identification of devices. We apply this visual channel to several problems in computer security, including authenticated key exchange between devices that share no prior context, establishment of a trusted path for configuration of a TCG-compliant computing platform, and secure device configuration in the context of a smart home.

Public opinion is the belief or thought of a group of people regarding a particular topic, especially on politics, religion, social issues, demographic diversity, etc. The opinion of the individual may be sensitive since it reflects the perception, understanding, belief, conflict, and desire of that individual. The traditional mechanisms of collecting public opinions (e.g., survey, questionnaire, interviewer, mailing) are often compromising individual's privacy. Those mechanisms do not anonymize the individual's identity. Therefore people are often abstained from expressing their rational opinions. The electronic opinion collection systems are designed with a central server that keeps all the user's profiles, which may be linked the opinions, thereby compromises the privacy. In this paper, we present a multiparty opinion collecting and publishing protocol that preserves the user's identity. The protocol does not rely on any trusted third party (e.g. central server). It rather forms quorums to execute the process. Party independently cannot learn the individual's opinions. Moreover, the protocol publishes the opinions anonymously, thereby preserves the privacy of the individuals.

Intrusion detection system (IDS) is essential for the network; the intruder can steal sensitive information about networks. The IDS must have the ability to take care of large and real-time data. The predicted rate must be high based on the available attribute. This work deals with a real intrusion detection problem, by its behavior. In this paper, we developed a hybrid model, which can detect intrusion by its action. We used an NSL-KDD data set, the multiclass problem and binary problems are 25% tested. This model can be used to guess the availability of intrusion, able to determine the scope of intrusions based on the transaction of data in the network; training requires optimal features of a network transaction. The accuracy of the model is better for both binary class for the multiclass in NSL-KDD data set. The complication of false data alarm rates is the most significant challenge in the IDS system, and it may be the low false rate or high false rate. Proposed work also addresses this problem. The first step that data will be filtered by Vote algorithm, the Information Gain will get associated with a base learner, to choose the necessary features, which directly affects the accuracy of the model. It uses the following classifier: Ran-domTree, REPTree, RandomForrest AdaBoostM1, Meta Pagging, DesicionStump, J48, LMT, Bagging, and Naive Bayes. On the based on the proposed model, it is observed as low false rate, high accuracy.

Medical cyber-physical systems (MCPS) are lifecritical, context-aware, networked systems of medical devices. These systems are increasingly used in hospitals to provide highquality continuous care for patients. The need to design complex MCPS that are both safe and effective has presented numerous challenges, including achieving high assurance in system software, intoperability, context-aware intelligence, autonomy, security and privacy, and device certifiability. In this paper, we discuss these challenges in developing MCPS, some of our work in addressing them, and several open research issues.

Abstract: - Radio Frequency Identification (RFID) technology is emerging as an important tool with applications in a variety of fields. The major concern regarding RFID is the ubiquitous nature of its deployment that extends far beyond the capabilities of any of the tools available ...

Wireless Sensor Network (WSN) is an emerging technology that shows great promise for various futuristic applications both for mass public and military. The sensing technology combined with processing power and wireless communication makes it lucrative for being exploited in abundance in future. The inclusion of wireless communication technology also incurs various types of security threats. The intent of this paper is to investigate the security related issues and challenges in wireless sensor networks. We identify the security threats, review proposed security mechanisms for wireless sensor networks. We also discuss the holistic view of security for ensuring layered and robust security in wireless sensor networks.

Within the next year, travelers from dozens of nations may be carrying a new form of passport in response to a mandate by the United States government. The e-passport, as it is sometimes called, represents a bold initiative in the deployment of two new technologies: Radio-Frequency Identification (RFID) and biometrics. Important in their own right, e-passports are also the harbinger of a wave of next-generation ID cards: several national governments plan to deploy identity cards integrating RFID and biometrics for domestic use. We explore the privacy and security implications of this impending worldwide experiment in next-generation authentication technology. We describe privacy and security issues that apply to e-passports, then analyze these issues in the context of the International Civil Aviation Organization (ICAO) standard for e-passports. * RSA Laboratories, [email protected]

Cloud computing is one of the fastest emerging technologies; it gains wide acceptance from various Business organizations & Information Technology (IT) Industries. Cloud computing provides various services to users through the internet; those services are like Applications, computation, and storage etc. In spite of these advantages, cloud technology faces different types of privacy and security related issues. These issues become major barriers to adopt cloud technology into various organizations. This survey paper addresses the cloud architecture, various security and privacy issues, challenges and threats, attacks, and future research directions to overcome the security and privacy related problems in the cloud environment.

JSTOR is a not-for-profit service that helps scholars, researchers, and students discover, use, and build upon a wide range of content in a trusted digital archive. We use information technology and tools to increase productivity and facilitate new forms of scholarship. For more information about JSTOR, please contact [email protected].

Cloud Computing holds the potential to eliminate the requirements for setting up of high-cost computing infrastructure for the IT-based solutions and services that the industry uses. It promises to provide a flexible IT architecture, accessible through internet for lightweight portable devices. This would allow many-fold increase in the capacity or capabilities of the existing and new software. In a cloud computing environment, the entire data reside over a set of networked resources, enabling the data to be accessed through virtual machines. Since these data centers may lie in any corner of the world beyond the reach and control of users, there are multifarious security and privacy challenges that need to be understood and taken care of. Also, one can never deny the possibility of a server breakdown that has been witnessed, rather quite often in the recent times. There are various issues that need to be dealt with respect to security and privacy in a cloud computing scenario. This ...

In recent years, deceptive content such as fake news and fake reviews, also known as opinion spams, have increasingly become a dangerous prospect for online users. Fake reviews have affected consumers and stores alike. Furthermore, the problem of fake news has gained attention in 2016, especially in the aftermath of the last U.S. presidential elections. Fake reviews and fake news are a closely related phenomenon as both consist of writing and spreading false information or beliefs. The opinion spam problem was formulated for the first time a few years ago, but it has quickly become a growing research area due to the abundance of user-generated content. It is now easy for anyone to either write fake reviews or write fake news on the web. The biggest challenge is the lack of an efficient way to tell the difference between a real review and a fake one; even humans are often unable to tell the difference. In this paper, we introduce a new n-gram model to detect automatically fake contents with a particular focus on fake reviews and fake news. We study and compare 2 different features extraction techniques and 6 machine learning classification techniques. Experimental evaluation using existing public datasets and a newly introduced fake news dataset indicate very encouraging and improved performances compared to the state-of-the-art methods.

Cloud consumers are hesitant in choosing an appropriate cloud service as they are under the assumption that clouds are not safe for their data and operations. This is due to the presence of a trust gap between cloud service consumers and cloud service providers (CSP) as well as a lack of understanding among consumers about what security and privacy (S&P) attributes best fit their requirements. In this paper, we propose a framework to assist consumers in making educated decisions when shopping for cloud S&P . First, the framework illustrates a list of potential S&P issues and recommends evaluative S&P attributes. Second, it enables consumers to assess the degree of security in two or more cloud services against the recommended attributes. Third, it enables consumers to compare their assessments using various instructive graphs. The proposed framework improves S&P of clouds by following a scenario-based and a stakeholder-oriented approach to enable consumers to comprehend their interaction with the cloud for better security. With this tool, we aim to raise the bar for security awareness in cloud computing (CC) and also form the basis for cloud S&P metrics against a standard benchmark in the future.

Privacy is currently at the centre of a fierce battle. On one side, powerful data companies like Google, Facebook, and major data brokers are collecting and analysing as much personal data as they can. They are lobbying governments around the world, and trying to get governments to depend on them. During the coronavirus lockdown, for instance, governments depended on platforms to conduct their meetings online. The analysis of data is increasingly outsourced to companies like Palantir, which has contracts with American and British public institutions. Intelligence agencies and public health authorities argue they need as much data as possible to keep us as safe as possible. On the other side of the privacy battles, a techlash from consumers, human rights organisations, privacy experts, a few businesses, and new regulation such as Europe’s General Data Protection Regulation (GDPR) and California’s Consumer Privacy Act, represent forces that are pushing corporations and governments to respect our privacy. It is up to citizens to decide what kind of future we want.

... For example, tourists need indoor navigation services in some large museums to see the artifacts in different places in sequence. In addition, posi-tion information brings benefits to self-organization and self-formation of ad hoc networks in the future communications systems. ...

Primeira Palestra / Conferência de duas sobre "A Anonimização, Pseudonimização e Cifragem: alguns apontamentos comparativos entre o RGPD e a LGPD", para a Comissão de Direito Digital da Subseção de Campinas da Ordem dos Advogados do Brasil. Dia 5 de julho de 2019.

"In The Crowdsourced Panopticon: Conformity and Control on Social Media, Jeremy Weissman explores the role of ‘peer-to-peer’ surveillance through social media and how this is increasingly shaping our behaviour. This is a welcome addition to the scholarly work on surveillance and privacy, writes Matt Bluemink, with a clear, approachable writing style and a wealth of empirical examples."

Intrusion detection faces a number of challenges; an intrusion detection system must reliably detect malicious activities in a network and must perform efficiently to cope with the large amount of network traffic. In this paper, we address these two issues of Accuracy and Efficiency using Conditional Random Fields and Layered Approach. We demonstrate that high attack detection accuracy can be achieved by using Conditional Random Fields and high efficiency by implementing the Layered Approach. Experimental results on the benchmark KDD '99 intrusion data set show that our proposed system based on Layered Conditional Random Fields outperforms other well-known methods such as the decision trees and the naive Bayes. The improvement in attack detection accuracy is very high, particularly, for the U2R attacks (34.8 percent improvement) and the R2L attacks (34.5 percent improvement). Statistical Tests also demonstrate higher confidence in detection accuracy for our method. Finally, we show that our system is robust and is able to handle noisy data without compromising performance.

Topics of interest include but are not limited to:
 Social media/networks literacy (e.g., critical thinking, scams, phishing)
 Social media/networks users (e.g., QOL, FOMO, addiction, cyberbullying, trolling, social distancing, loneliness, anxiety, depression, children, older adults...)
 Ethical and privacy concerns
 Social identity and social polarization (e.g., populism, democracy, social identity frames, catfishing)
 Social media/networks marketing (e.g., social media influencers)
 Social media/networks as a tool for misinformation (e.g., Fake news,
hoaxes, conspiracies, trustworthiness)
 Social media/networks sentiment, public opinion (e.g. hate speech,
immigration, COVID-19, policy issues, elections, climate crisis)
 Unconventional views on social networks (e.g., historical ...)

This paper aims to review and evaluate the vision, the objectives and the strategic framework of e-Government in Singapore. Rapidity, Reliability, Efficiency, Cost-effectiveness, Customer-orientation and Accessibility are the main guidelines for the development of egovernment in Singapore in order to provide quality services to users in the digital economy. There are five thrusts and six programs of egovernance in Singapore. The development of e-Government involves three main relationships: Government to Citizen (G2C), Government to Business (G2B) and Government to Employees/Public Servants (G2E). This paper employs the SWOT (Strengths, Weaknesses, Opportunities and Threats) analysis and PEST (Political, Economic, Social and Technological) determinants to evaluate the current state of e-Government in Singapore and its preparedness.

Angeles (UCLA). Thank you to the dedicated Federal Communications Law Journal staff for bringing this Note to publication. Special thanks to Meredith Rose, Journal Adjunct, and Atena Sheibani-Nejad, Notes Editor, for their patience and encouragement from start to finish. I would also like to express my gratitude to Professor Daniel J. Solove for his guidance during the writing process and mentorship throughout my law school career. Finally, many thanks to my family for their unconditional love and support.

Cloud Computing is increasingly becoming popular as many enterprise applications and data are moving into cloud platforms. However, a major barrier for cloud adoption is real and perceived lack of security. In this paper, we take a holistic view of cloud computing security -spanning across the possible issues and vulnerabilities connected with virtualization infrastructure; software platform; identity management and access control; data integrity; confidentiality and privacy; physical and process security aspects; and legal compliance in cloud. We present our findings from the points of view of a cloud service provider, cloud consumer, and third-party authorities such as Govt. We also discuss important research directions in cloud security in areas such as Trusted Computing, Information Centric Security and Privacy Preserving Models. Finally, we sketch a set of steps that can be used, at a high level, to assess security preparedness for a business application to be migrated to cloud.

Il trattamento dei cd. Big Data, per conformarsi al Regolamento europeo sulla protezione dei dati personali, richiede un'indagine preliminare volta a individuare quali siano le misure organizzative e tecniche idonee alla corretta valutazione e, poi, alla mitigazione del rischio per la privacy dei consumatori. L'articolo offre una prima ricognizione dell'apparato normativo applicabile ai Big Data e, rilevando l'inadeguatezza del tradizionale schema negoziale - basato sul binomio "informativa-consenso" - a tutelare i diritti del data owner, propone una riflessione su scenari regolamentari futuribili.

Internet banking is a form of self service technology. The numbers of Internet users have increased dramatically, but most of them are reluctant to provide sensitive personal information to websites because they do not trust e-commerce security. This paper investigates the factors influencing of e-services on senior citizens buying behaviour and also indicates level of concern regarding security and privacy issues in Indian context. Primary data was collected from 200 respondents, above the age of 60, through a structured questionnaire. were used to know trend of internet use and factors affecting e-banking services among senior citizen customer in Bangalore, India. The finding depicts many factors like security & privacy, trust, innovativeness, familiarity, awareness level increase the acceptance of e-banking services among Indian customers. The finding shows that in spite of their security and privacy concern, senior citizen customers are willing to adopt online banking if banks provide him necessary guidance. Based on the results of current study, Bank's managers would segment the market on the basis of age group and take their opinion and will provide them necessary guidance regarding use of online banking.

2007 was the year of online gaming fraud-with malicious programs that specifically target online games and virtual worlds increasing by 145% and the emergence of over 30,000 new programs aimed at stealing online game passwords. Such malware is ...

Wireless sensor networks (WSNs) have attracted a lot of interest over the last decade in wireless and mobile computing research community.  Applications of WSNs are numerous and growing, which range from indoor deployment scenarios in the home and office to outdoor deployment in adversary’s territory in a tactical battleground. However, due to distributed nature and their deployment in remote areas, these networks are vulnerable to numerous security threats that can adversely affect their performance. This problem is more critical if the network is deployed for some mission-critical applications such as in a tactical battlefield. Random failure of nodes is also very likely in real-life deployment scenarios. Due to resource constraints in the sensor nodes, traditional security mechanisms with large overhead of computation and communication are infeasible in WSNs. Design and implementation of secure WSNs is, therefore, a particularly challenging task. This chapter provides a comprehensive discussion on the state of the art in security technologies for WSNs. It identifies various possible attacks at different layers of the communication protocol stack in a typical WSN and presents their possible countermeasures. A brief discussion on the future direction of research in WSN security is also included.