Automating End User Security Tasks
Speaker: Eunsuk Kang, MIT
Date: Monday, November 26 2012
Time: 4:00PM to 5:00PM
Refreshments: 4:00PM
Location: 32-G575
Host: Security seminar, CSAIL, MIT
Contact: Raluca Ada Popa, 3-6098, ralucap@mit.edu
Relevant URL: This is joint work with Prof. Daniel Jackson in CSAIL.
Abstract: Many systems continue to fail due to vulnerabilities that are well-understood by the security community. This is perhaps not surprising, since most users who configure and use these systems have little or no background in security, with a vague sense of what information should be protected, and how to go about doing so.
I will describe an approach to building tools that can help users avoid common security mistakes. The key part of our approach is a set of declarative models that encode domain-specific knowledge about different types of vulnerabilities and their effects on the system. An underlying analysis engine leverages the information in these models to check the system against a user-specified policy, generating concrete feedback if a violation is detected. I will describe some applications of our approach (including web servers, routers, social networks), and a case study where we analyzed configuration of web sites in CSAIL for security vulnerabilities.
See other events that are part of CSAIL Security Seminar 2012/2013
See other events happening in November 2012
