IEEE Security & Privacy, Volume 3

Volume 3, Number 1, January-February 2005

From the Editors

• 
  Carl E. Landwehr:
  Changing the Puzzle Pieces. 3-4
• 
  Letters to the Editor. 4

News

• 
  Greg Goth:
  Phishing Attacks Rising, But Dollar Losses Down. 8
• 
  Eric Goetz, Garrett Jones, Brent Kesler:
  News Briefs. 9-10

Book Reviews

• 
  Martin R. Sytz:
  Studying Attacks to Improve Software Defense. 11

Economics of Information Security

• 
  Ross J. Anderson, Bruce Schneier:
  Guest Editors' Introduction: Economics of Information Security. 12-13
• 
  Eric Rescorla:
  Is Finding Security Holes a Good Idea? 14-19
• 
  Ashish Arora, Rahul Telang:
  Economics of Software Vulnerability Disclosure. 20-25
• 
  Alessandro Acquisti, Jens Grossklags:
  Privacy and Rationality in Individual Decision Making. 26-33
• 
  Hal R. Varian, Fredrik Wallenberg, Glenn Woroch:
  The Demographics of the Do-Not-Call List. 34-39
• 
  Stuart E. Schechter:
  Toward Econometric Models of the Security Risk from Remote Attack. 40-44
• 
  George Danezis, Ross J. Anderson:
  The Economics of Resisting Censorship. 45-50

Data Privacy

• 
  John Linn:
  Technology and Web User Data Privacy: A Survey of Risks and Countermeasures. 52-58

Education

• 
  Alec Yasinsac, Mike Burmester:
  Centers of Academic Excellence: A Case Study. 62-65

Basic Training

• 
  Herbert H. Thompson:
  Application Penetration Testing. 66-69

Attack Trends

• 
  Iván Arce:
  Bad Peripherals. 70-73

Secure Systems

• 
  Carlisle M. Adams:
  Building Secure Web-Based Environments: Understanding Research Interrelationships through a Construction Metaphor. 74-77

Digital Protection

• 
  Roland L. Trope:
  Directors' Digital Fiduciary Duties. 78-82

Building Security In

• 
  Brad Arkin, Scott Stender, Gary McGraw:
  Software Penetration Testing. 84-87

Clear Text

• 
  Bruce Schneier:
  Authentication and Expiration. 88

Volume 3, Number 2, March-April 2005

From the Editors

• 
  Marc Donner:
  What's in a Name? 4-5

News

• 
  Benjamin Alfonsi:
  FBI's Virtual Case File Living in Limbo. 7
• 
  Eric Goetz, Garrett Jones, Brent Kesler:
  News Briefs. 8-10

Conference Reports

• 
  Stephen A. Weis:
  Crypto 2004. 11-13

Book Reviews

• 
  Roy Iverson:
  A Framework to Consider. 14

Trusted Computing

• 
  Rolf Oppliger, Ruedi Rytz:
  Does Trusted Computing Remedy Computer Security Problems? 16-19
• 
  Alexander Iliev, Sean W. Smith:
  Protecting Client Privacy with Trusted Computing at the Server. 20-28

Online Privacy

• 
  Dawn N. Jutla, Peter Bodorik:
  Sociotechnical Architecture for Online Privacy. 29-39

Spam Solutions

• 
  Shari Lawrence Pfleeger, Gabrielle Bloom:
  Canning Spam: Proposed Solutions to Unwanted Email. 40-47

Education

• 
  Ronald Dodge, Daniel Ragsdale:
  Technology Education at the US Military Academy. 49-53

On the Horizon

• 
  Roy A. Maxion, Rachel R. M. Roberts:
  Methodological Foundations: Enabling the Next Generation of Security. 54-57

Basic Training

• 
  Peter Oehlert:
  Violating Assumptions with Fuzzing. 58-62

Attack Trends

• 
  Elias Levy:
  Worm Propagation and Generic Attacks. 63-65

Secure Systems

• 
  Sean W. Smith:
  Turing is from Mars, Shannon is from Venus: Computer Science and Computer Engineering. 66-69

Digital Protection

• 
  E. Michael Power, Roland L. Trope:
  Averting Security Missteps in Outsourcing. 70-73

Building Security In

• 
  Sean Barnum, Gary McGraw:
  Knowledge for Software Security. 74-78

Clear Text

• 
  Daniel E. Geer Jr.:
  The Problem Statement is the Problem. 80

Volume 3, Number 3, May-June 2005

From the Editors

• 
  Fred B. Schneider:
  It Depends on What You Pay. 3

Book Reviews

• 
  Martin R. Stytz:
  Under the Black Hat. 5

Interview with Tom Leighton

• 
  Laurianne McLaughlin:
  Interview: Holistic Security. 6-8

PITAC Cybersecurity Report

• 
  Susan Landau, Martin R. Stytz, Carl E. Landwehr, Fred B. Schneider:
  Overview of Cyber Security: A Crisis of Prioritization. 9-11

News

• 
  Garrett Jones, Brent Kesler:
  NewsBriefs. 12-14

Infrastructure Security

• 
  Massoud Amin:
  Guest Editor's Introduction: Infrastructure Security--Reliability and Dependability of Critical Systems. 15-17
• 
  Mehmet Sahinoglu:
  Security Meter: A Practical Decision-Tree Model to Quantify Risk. 18-24
• 
  Min Cai, Kai Hwang, Yu-Kwong Kwok, Shanshan Song, Yu Chen:
  Collaborative Internet Worm Containment. 25-33

Radio Frequency Identification

• 
  Simson L. Garfinkel, Ari Juels, Ravikanth Pappu:
  RFID Privacy: An Overview of Problems and Proposed Solutions. 34-43

Voice over IP

• 
  Thomas J. Walsh, D. Richard Kuhn:
  Challenges in Securing Voice over IP. 44-49

Video Privacy

• 
  Andrew W. Senior, Sharath Pankanti, Arun Hampapur, Lisa M. Brown, Ying-li Tian, Ahmet Ekin, Jonathan H. Connell, Chiao-Fe Shu, Max Lu:
  Enabling Video Privacy through Computer Vision. 50-57

Biblio Tech

• 
  Marc Donner:
  A Young Geek's Fancy Turns to...Science Fiction? 58-60

Education

• 
  Cynthia E. Irvine, Michael F. Thompson, Ken Allen:
  CyberCIEGE: Gaming for Information Assurance. 61-64

On the Horizon

• 
  Brian D. Snow:
  Four Ways to Improve Security. 65-67

Crypto Corner

• 
  Peter Gutmann, David Naccache, Charles C. Palmer:
  When Hashes Collide. 68-71

Basic Training

• 
  Richard Ford:
  Malcode Mysteries Revealed. 72-75

Attack Trends

• 
  Thorsten Holz:
  A Short Visit to the Bot Zoo. 76-79

Secure Systems

• 
  Christian Skalka:
  Programming Languages and Systems Security. 80-83

Digital Protection

• 
  Michael E. Lesk:
  Salute the Broadcast Flag. 84-87

Building Security In

• 
  Dan Taylor, Gary McGraw:
  Adopting a Software Security Improvement Program. 88-91

Clear Text

• 
  Steven M. Bellovin:
  Security and Privacy: Enemies or Allies? 92

Volume 3, Number 4, July-August 2005

From the Editors

• 
  George Cybenko:
  The One-Eyed Man Is King. 4-5

Book Reviews

• 
  Nathanael Paul:
  A Closer Look at Viruses and Worms. 7

News

• 
  Benjamin Alfonsi:
  Alliance Addresses VoIP Security. 8

Software Development

• 
  Axelle Apvrille, Makan Pourzandi:
  Secure Software Development by Example. 10-17

Attack Models

• 
  Helayne T. Ray, Raghunath Vemuri, Hariprasad R. Kantubhukta:
  Toward an Automated Attack Model for Red Teams. 18-25
• 
  Michael D. Bailey, Evan Cooke, Farnam Jahanian, David Watson, Jose Nazario:
  The Blaster Worm: Then and Now. 26-31

Vulnerability Disclosure

• 
  Dimitrios Lekkas, Diomidis Spinellis:
  Handling and Reporting Security Advisories: A Scorecard Approach. 32-41

Conference Reports

• 
  Urs E. Gattiker:
  EICAR 2005. 45-48

Education

• 
  Matt Bishop, Deborah A. Frincke:
  A Human Endeavor: Lessons from Shakespeare and Beyond. 49-51

On the Horizon

• 
  James Mulvenon:
  Toward a Cyberconflict Studies Research Agenda. 52-55

Crypto Corner

• 
  Peter Gutmann, Ian Grigg:
  Security Usability. 56-58

Basic Training

• 
  William H. Allen:
  Computer Forensics. 59-62

Attack Trends

• 
  Iván Arce:
  The Land of the Blind. 63-67

Secure Systems

• 
  Sara Sinclair, Sean W. Smith:
  The TIPPI Point: Toward Trustworthy Interfaces. 68-71

Digital Protection

• 
  Martin R. Stytz:
  Protecting Personal Privacy: Hauling Down the Jolly Roger. 72-74

Building Security In

• 
  Nancy R. Mead, Gary McGraw:
  A Portal for Software Security. 75-79

Volume 3, Number 5, September-October 2005

From the Editor

• 
  Marc Donner:
  There Ain't No Inside, There Ain't No Outside... 4-5

Book Reviews

• 
  Katharine W. Webb:
  Biometric Security Solutions. 7

News

• 
  Heather Drinan, Brent Kesler:
  News Briefs. 8-10

Interview

• 
  Laurianne McLaughlin:
  From AWK to Google: Peter Weinberger Talks Search. 11-13

The Value of Privacy

• 
  Barbara Carminati, Elena Ferrari, Patrick C. K. Hung:
  Exploring Privacy Issues in Web Services Discovery Agencies. 14-21
• 
  Bernardo A. Huberman, Eytan Adar, Leslie R. Fine:
  Valuating Privacy. 22-25

Cyberexercises

• 
  Lance J. Hoffman, Timothy Rosenberg, Ronald Dodge, Daniel Ragsdale:
  Exploring a National Cybersecurity Exercise for Universities. 27-33

Distributed Trust

• 
  Fred B. Schneider, Lidong Zhou:
  Implementing Trustworthy Services Using Replicated State Machines. 34-43

Conference Reports

• 
  Robert W. Reeder, Fahd Arshad:
  Soups 2005. 47-50

Industry Trends

• 
  Peter Kuper:
  The State of Security. 51-53

Education

• 
  Matt Bishop, Deborah A. Frincke:
  Teaching Secure Programming. 54-56

On the Horizon

• 
  Ann Miller:
  Trends in Process Control Systems Security. 57-60

Crypto Corner

• 
  David Naccache:
  Finding Faults. 61-65

Basic Training

• 
  Peter Torr:
  Demystifying the Threat-Modeling Process. 66-70

Secure Systems

• 
  David M. Nicol:
  Modeling and Simulation in Security Evaluation. 71-74

Building Security In

• 
  Kenneth R. van Wyk, Gary McGraw:
  Bridging the Gap between Software Development and Information Security. 75-79

Clear Text

• 
  Daniel E. Geer Jr.:
  When Is a Product a Security Product? 80

Volume 3, Number 6, November-December 2005

From the Editors

• 
  Carl E. Landwehr:
  Green Computing. 3

Interface

• 
  Letters to the Editor. 5

Book Reviews

• 
  Martin Libicki:
  Are RFIDs Coming to Get You? 6

News

• 
  Heather Drinan, Nancy Fontaine, Brent Kesler:
  News Briefs. 7-8

Interview

• 
  Laurianne McLaughlin:
  Winning the Game of Risk: Neumann's Take on Sound Design. 9-12

Communications Security

• 
  Micah Sherr, Eric Cronin, Sandy Clark, Matt Blaze:
  Signaling Vulnerabilities in Wiretapping Systems. 13-25

CALEA and Network Security

• 
  Susan Landau:
  Security, Wiretapping, and the Internet. 26-33

System Defense

• 
  Philip L. Campbell:
  The Denial-of-Service Dance. 34-40

Network Worms

• 
  Stelios Sidiroglou, Angelos D. Keromytis:
  Countering Network Worms Through Automatic Patch Generation. 41-49

Denial of Information

• 
  Gregory J. Conti, Mustaque Ahamad:
  A Framework for Countering Denial-of-Information Attacks. 50-56

Conference Reports

• 
  Faith M. Heikkila:
  SecureWorld Expo 2005. 57-60

Education

• 
  Pinny Sheoran, Oris Friesen, Barbara J. Huffman de Belón:
  Developing and Sustaining Information Assurance: The Role of Community Colleges (Part 1). 61-63

On the Horizon

• 
  Scott Borg:
  Economically Complex Cyberattacks. 64-67

Basic Training

• 
  Gerald A. Marin:
  Network Security Basics. 68-72

Secure Systems

• 
  Sean W. Smith:
  Pretending that Systems Are Secure. 73-76

Digital Protection

• 
  E. Michael Power, Roland L. Trope:
  Acting Responsibly with Geospatial Data. 77-80

Building Security In

• 
  Katrina Tsipenyuk, Brian Chess, Gary McGraw:
  Seven Pernicious Kingdoms: A Taxonomy of Software Security Errors. 81-84

Emerging Standards

• 
  Ted S. Phillips, Tom Karygiannis, Rick Kuhn:
  Security Standards for the RFID Market. 85-89

Clear Text

• 
  Bruce Schneier:
  The Zotob Storm. 96