20th National Information Systems Security Conference

Table of Contents

Special Features

Monday October 6, 199

Optional Workshops
11:00 am-5:30 pm

Pre-registration required Cost: $100.00

II Common Criteria Protection Profile

III How to Establish an Incident Handling Capability

IV Connecting to the Internet

Tuesday October 7, 1997

Early Bird Sessions
8:30 am-10:00 am

Conference Overview

• Christopher Bythewood, National Security Agency
• Recommended for first time attendees. Provides an overview of topics being presented this year.

• Paul Woodie, National Security Agency, Chair
• Information Security is Information Security-Ira S. Winkler, National Computer Security Association
• Secrets, Lies, and IT Security-Guy King, Computer Sciences Corporation
• The NPS CISR Graduate Program in INFOSEC: Six Years of Experience-Cynthia E. Irvine, Naval Postgraduate School

Student Papers in Electronic Commerce

Nick Pantiuk, IITRI, Chair

Cellular Technology and Security
Ryan Jones, University of Maryland

The Security of Electronic Banking
Yi-Jen Yang, University of Maryland

Extranet Security: A Technical Overview from a Business Perspective
Jennifer Jordan, University of Maryland

Digital Coins Based on Hash Chain 
Khanh Quoc Nguyen, University of Western Sydney, Nepean, Australia

Information Security Videos

• A selection of videos used in our training programs will be shown.

Wednesday  October 8, 1997

Banquet

• Hyatt Regency Hotel
• Cash Bar 6 p.m.
• Dinner 7 p.m.
• Dinner Speaker-Bran Ferren, Executive Vice President, Walt Disney Imagineering.

Best Paper and Best Student Paper Award

Ceremony and Reception

Best paper and best student paper awards will be presented at the National Cryptologic Museum at Fort Meade, Maryland. Directions and bus information will be available at the conference Information Booth. An awards reception will begin at 6:30 p.m. and end at 8:00 p.m. in the museum.

Friday  October 10, 1997

Closing Plenary

This panel begins at 10:30 a.m.

Retun to table of contents

Optional Workshops   Monday  October 6^th  11:00 am - 5:30 pm
Pre-registration is required.
Baltimore Convention Center
Cost: $100 per workshop

Workshop I:  Risk Management for Information Systems: A Quantitative Solution  Greg Adams, Trident Data Systems During this course, the instructor uses a series of tutorials and interactive class exercises to give the student a comprehensive overview of the quantitative risk analysis process. At the end of the day, the student will have a thorough understanding of the phases which make up the risk assessment process and the algorithms used to calculate vulnerability, asset, threat, and risk-measures.

Workshop III:  How to Establish an Incident Handling Capability  Sandy Sparks, CIAC - Lawrence Livermore Kathy Fithen, CERT/CC and FedCIRC/EAST Marianne Swanson, NIST This workshop, which is sponsored by the Federal Computer Incident Response Capability (FedCIRC), will address many of the technical and administrative issues involved in establishing an incident handling capability. Topics to be covered include: organizational structure, roles and responsibilities, technology platforms, incident handling methods, sample policy; reporting and issuing alerts, administrative and incident handling procedures, communications (users, other), lessons learned.

Workshop II:  Common Criteria Protection Profile  Lynn Ambuel, BDM International Andy Weber, Logica, UK This workshop will provide information and instruction on using the Common Criteria to build Protection Profiles to express information technology security requirements. Community experience in building Protection Profiles will be used for this instruction. Alternative sets of related technologies will be compared and contrasted in the hopes of harmonizing like requirements into generic Protection Profiles for given technologies (i.e., firewalls). In addition, issues arising from attempting to create Protection Profiles representing non-classic requirement sets will be discussed.

Workshop IV:  Connecting to the Internet  Tom Christian, CIAC - Lawrence Livermore This Workshop will address many of the technical issues involved in connecting to and managing systems and sites that are parts of the Internet. Current threats on the Internet and how to work with incident response teams and obtain sources for more information will be explored. Administrative information also will be given, such as the importance of setting up policies with management support. Topics to be covered include: current Internet threats, securing the system, detecting intrusions, and security on the Internet.

 
Retun to table of contents
 
Early Bird Sessions

Tuesday, October 7, 1997 8:30 am - 10:00 am

Conference Overview   Christopher Bythewood, National Security Agency   This session is recommended for first time attendees. It provides an overview of topics being presented this year.

Information System Security Videos   Roger Quane, National Security Agency   A selection of videos used in our training programs will be shown.

Planning Information Security   Paul Woodie, National Security Agency, Chair   Information Security is Information Security   Ira S. Winkler, National Computer Security Association   Secrets, Lies, and IT Security   Guy King, Computer Sciences Corporation   The NPS CISR Graduate Program in INFOSEC: Six Years of Experience   Cynthia E. Irvine, Naval Postgraduate School

Student Papers in Electronic Commerce   Nick Pantiuk, IITRI, Chair   Cellular Technology and Security   Ryan Jones, University of Maryland   The Security of Electronic Banking   Yi-Jen Yang, University of Maryland   Extranet Security: A Technical Overview from a Business Perspective   Jennifer Jordan, University of Maryland   Digital Coins Based on Hash Chain   Khanh Quoc Nguyen, University of Western Sydney, Nepean, Australia

 
Retun to table of contents

Opening Plenary

• Robert T. Marsh, Chairman, Presidential Commission on Critical Infrastructure Protection

 
Award Ceremony and Reception
Awards will be presented to vendors that have successfully developed security product lines that have been approved by the NIST Validation Program or the NCSC Trusted Computer System Evaluation Program. Certificates also will be presented to participants in the Systems Security Engineering Capability Maturity Model.
 

Tuesday October 7^th 2:00 - 3:30 PM

Track A Internet Internet  Critical Elements of Security Frameworks  Judith Furlong, MITRE Corporation, Chair  Panelists: Michael Willett, IBM  Dave Aucsmith, Intel  Keith Klemba, Hewlett Packard  The panelists will examine the critical elements of security frameworks being proposed by computer industry leaders. They will also discuss issues to include interoperability and gaps among the different frameworks and products.	Track D  Debate  Legal & Liability Issues for the Use of Cryptography  Joan Winston, TIS, Chair  Panelists: Michael Scott Baum, Verisign, Inc.  Hoyt L. Kesterson II, Bull HN Information Systems Inc.  Robert L. Meuser, Attorney at Law  This session will debate the following topics: Increasingly, encryption is seen  as a major tool for safeguarding information as it is stored or transmitted in electronic form. What will constitute business "best practice" for use of encryption? What will be required for  "due care" in the use of encryption to safeguard stored files and records? What are the liability concerns for the use of powerful encryption products and who will bear the risks? How can these risks be mitigated?	Track G Policy / Administration / Management  Multilevel Security  Ronda Henning, Harris Corporation, Chair  A Multi-Level Secure Object-Oriented Database Model  George Durham, University of Maryland Baltimore County  Use of SSH on a Compartmented Mode Workstation  Johnny S. Tolliver, Oak Ridge National Laboratory  Multilevel Architectures for Electronic Document Retrieval  James A. Rome, Oak Ridge National Laboratory
Track B Electronic Commerce  Business Models for Electronic Commerce  Erik Brynjolfsson, Stanford University, Chair  A basic issue in the world of Commerce on the Internet is the development of an appropriate business model. Some examples are entertainment (Cable TV), Telecoms, Computing, and Publishing. Each industry has different views based on history, economics, and technology. This session will discuss their industryís experience and their applicability to Electronic Commerce.	Track E Assurance / Criteria / Testing  Security Test Center  Tim Grance, NIST, Chair  Panelists: Wayne Jansen, NIST  Others: TBD  The panelists will discuss the goals, current projects, progress to date, and how users and industry may partner with the NIST/NSA sponsored Security Test Center.	Track H Tutorials  Introduction to Information Security  Mary Opalensky, National Security Agency  Diana Strickland, National Security Agency  This tutorial presents a computer-based-training overview of the multi-disciplined practice of Information Systems Security (INFOSEC) guidelines and policies as well as the basic INFOSEC elements of Communications Security (COMSEC) and Computer Security (COMPUSEC). There is also a review on the information processing and outlines user responsibilities for handling data being stored, transmitted, or processed.
Track C Information Infrastructure  Infrastructure Vulnerabilities  John P. L. Woodward, MITRE, Chair  Panelists: John Davis, Commisioner PCCIP; Director, NCSC  Irwin M. Pikus, Department of Commerce  David A. Jones, Department of Energy  Peter H. Daly, U.S. Treasury  Thomas J. Falvey, Department of Transportation  This panel will discuss information vulnerabilities of infrastructures on which our national security depends, including telecommunications/networks, transportation systems, banking/finance systems, and electric power distribution. Audience participation - asking questions and sharing points of view - will be encouraged.	Track F R & D  Role Based Access Control  David Ferraiolo, NIST, Chair  Role Based Access Control for the World Wide Web  Richard Kuhn, NIST  Observations on the Real-World Implementation of Role-Based Access Control  Burkhard Hilchenbach, Schumann Security Software, Inc.	Track I Professional Development  Dockmaster II, A Lessons Learned: Balancing Security Technology Advancements & the Desire to Field a System  Steve Kougoures, NSA, Chair  Panelists: Cindy Hash, NSA  Mark Ridenour, NSA  William Dawson, BDM  The panelists will share the lessons the the Dockmaster II PMO has learned during its development.

 
3:30 - 4:00 PM

Session Break & Social Networking

 Retun to table of contents
 
Tuesday October 7^th 4:00 - 5:30 PM

Track A Internet  Security and Trust on the World Wide Web  J. Miller, World Wide Web Consortium(W3C), Chair  Panelists: Phil DesAutels, W3C  Winn Treese, Open Market, Inc.  Brian O'Higgins, Entrust  John Wankmueller, MasterCard  Panel and Status Report to include activities of the World Wide Web Consortium (W3C) and other Web Community happenings (Digital Signature Initiative, Security Working Group, and Electronic Payments Working Group).	Track D Debate  Cryptography Debate  Ed Roback, NIST, Chair  Panelists: TBD  The panelists will debate the impact of the Administrations Crypto Policies, including export controls. Industry and Government perspectives will be presented and approaches to change will be discussed and created.	Track G Policy / Administration / Management  Year 2000 (Y2K)  Richard Lefkon, Year 2000 Committee of AITP SIG-Mainframe, Chair  Panelists: Gregory Cirillo, JD, Williams, Mullen, Christian & Dobbin  Daniel Miekh, Consultant, Terasys  Sanford Feld, President, TBI  This panel will discuss the security implications of the Year 2000 problems. What is the effect of "clock roll-over?" The panelists will provide an overview of problems and solutions with a seven step process. Additionally, attendees responsible for Y2K issues in their organization are eligible for complementary copies of "Year 2000: Best Practices for Millennium Y2K Computing: Panic in Year Zero".
Track B Electronic Commerce  Security Architectures for Electronic Commerce  Clinton C. Brooks, National Security Agency, Chair  Panelists: Bruce Schneier, Counterpane Systems  Tony Lewis, VISA International  Jerome Solinas, National Security Agency  This panel will discuss architectural requirements and examine the comparisons and applications of existing security architectures (NII & GII). Users will engage in electronic commerce only if they have confidence that their communications and information are protected from unauthorized access or modification. Providing this requisite security is a significant challenge. This panel will address security architecture considerations to enable our dreams for electronic commerce.	Track E Assurance / Criteria / Testing  The Systems Security Engineering Capability Maturity Model  Karen Ferraiolo, Arca Systems, Inc.  This session will provide an overview of security and security engineering, describe the need for a capability maturity model (CMM) for security engineering, present the current SSE-CMM, and illustrate the application of the SSE-CMM using a hypothetical case study.	Track H Tutorials  A Systems Approach to INFOSEC  Jim Urbanski, National Security Agency  This tutorial provides a perspective of systems methodologies with applications to INFOSEC principles and disciplines. Attendees will gain an appreciation for the systems approach to problem solving, a technique that applicable to both technical and non-technical problems within and outside your organization.
Track C Information Infrastructure  Information Warfare and the Civilian Population  Charles Abzug, Institute for Computer and Information Sciences, Inc., Chair  Panelists: TBD  This panel will explore to what extent must the U.S. civilian population be concerned regarding the possibility of adversaries of the United States carrying out acts of Information Warfare against our information systems.	Track F R & D   New Security Paradigms Workshop '97  Robert Blakley, IBM, Chair  Panelists: TBD  This panel will select topics from the 1997 New Security Paradigms Workshop reflecting one or two important themes.	Track I Professional Development  Network Security Framework  Dave Luddy, NSA, Chair  Panelists: TBD  The panelists will describe the scope and intent of the Framework, how the framework aggregates and addresses user requirements for operational capabilities, the philosophy of protection which drives the framework to define security solutions, and the role of this framework as a solution-building tool for system security engineers.

 
Retun to table of contents

 
Tuesday, 5:45 PM
Conference Awards Reception
Baltimore Convention Center

Awards will be presented to vendors that have successfully developed security product lines that have been approved by the NIST Validation Program or the NCSC Trusted Computer System Evaluation Program. Certificates also will be presented to participants in the Systems Security Engineering Capability Maturity Model.

Retun to table of contents

 Wednesday, October 8^th 8:30 - 10:00 AM

Track A Internet  Experiences with Intrusion Detection Systems  Jill Oliver, Citibank, Chair  Panelists: Dan Esbensen, Touch Technologies;   Lee Sutterfield, WheelGroup  Intrusion detection (ID) systems are coming of age. Today's products include capabilities to look at intrusion detection at a system-of-systems level, report suspected intrusions to a home office, and react locally to suspected intrusions by automatically denying access to the suspected attacking node. The panelists, with experience as architects and users of these ID products, will discuss what's important and why it is for current and future capabilities.	Track D Debate     (Open)	Track G Policy / Administration / Management  Certification & Accreditation  Jack Eller, DISA, Chair  Panelists: David Murphy, NATO  Warner Brake, DISA   Barry Stauffer, Corbett Technologies  Mark Loepker, NSA  The panelists will discuss the current perspective on strategies for the certification and accreditation process.
Track B Electronic Commerce  Secure Payment Protocols  Taher ElGamal, Netscape Communications Corporation, Chair  Panelists: Steve Crocker, Cybercash  John Wankmueller, Mastercard  Mark Linehan, IBM  Cliff Newman, University of Southern California  This panel will discuss implementation experiences in electronic payment systems ranging from macropayment protocols, micropayment protocol design and analysis. Example applications of electronic malls will highlight the use of electronic payment mechanisms.	Track E Assurance / Criteria / Testing  Alternate Assurances: Implementation of Better Ways!  Mary Schanken, NSA, Chair  Panelists:   Todd. D. Schucker, LT. Renell D. Edwards, Charles G. Menk, III, NSA  The panelists will discuss the Trusted Capability Maturity Model, Network Rating Model, and Systems Security Engineering Capability Maturity Model. The audience will be provided a brief overview, current status, and future goals of the 3 models. Time is provided for audience interaction in discussing details about these models.	Track H Tutorials  Risk Management I: A Systems Approach to Threat  Anne Brooker-Grogan, National Security Agency  This tutorial provides the first of three foundation tutorials of Risk Management. The session is designed to help attendees answer the questions: what do we really need to protect, and who or what are we protecting it from? It takes a systems analysis approach to looking at the tangible and intangible things we value and the threats to them. The tutorial provides an overview of multi-disciplined threat, threat to information systems, and an overview to Information Warfare. The tutorial prepares the attendee for the Risk Management II and Risk Management III sessions later this week.
Track C Information Infrastructure  Infrastructure Protection: Can Government and the Private Sector Work Together?  Michelle Van Cleave, Staff Director and Chief Counsel, Senate Judiciary Subcommittee on Technology, Terrorism, and Government Information,Chair   Panelists: TBD  This panel will discuss and debate information sharing and cooperation among the government and private sector infrastructure providers that will be necessary to protect our Critical Infrastructures in the future. Audience participation-asking questions and sharing points of view-will be encouraged.	Track F R & D   Non-Military Cryptography: Opportunities, Threats, and Implementations   Bruce Schneier, Counterpane Systems  From encryption to digital signatures to electronic commerce to secure voting-cryptography has moved out of the military and into the world. The speaker will address the future of non-military cryptography, the business opportunities, the risks, and work that needs to be done. Mr. Schneier will also address some of the common mistakes companies make implementing cryptography and provide tips on how to avoid them.	Track I Professional Development  National Colloquium for Information Systems Security Education  W. V. Maconachy, National Security Agency, Chair  Panelists: Matthew Bishop, University of California at Davis  Larry R. Leibrock, University of Texas  William H. Murray, Deloitte & Touche  The panelists will discuss the highlights of the Colloquium Workshop held in April and the goals of the National Colloquium for Information Systems Security Education.

 
 
10:00 - 10:30 AM
Session Break & Social Networking

 Retun to table of contents
 

Wednesday, October 8^th 10:30 AM - 12 noon

Track A Internet  CAPIs: Current Conventions & Commercial Capabilities-The Developers Point of View  Peter G. Neumann, SRI International, Chair  Panelists: Dave Balenson, TIS  Taher Elgamal, Netscape Communications Corp.  George Fox, Intel Architecture Labs  Li Gong, Javasoft, Sun Microsystems   John Marchioni, Cylink  Tim Moses, Entrust  Amy Reiss, NSA  This panel session will track progress in the emerging field of Cryptographic Application Programming Interfaces(CAPIs). Status of the major CAPIs in development and use today will be provided. In addition, vendors will discuss their lessons learned from the development and utilization of these CAPIs in their products.	Track D Debate  Issue for Discussion: Should the Computer Security Act be Repealed?  Lynn McNulty, RSA Data Security, Inc., Chair  Panelists: TBD  This session will be devoted to a debate of the future of the Computer Security Act. Such issues as its applicability to the existing government systems environment, the impact of information warfare concepts, and the concerns of civil agencies with respect to the mandated adoption of national security community driven standards and technologies will be examined.	Track G Policy / Administration / Management  Public Key Certificate Policies   Noel Nazario, NIST, Chair  Panelists: Santosh Chokhani, Cynacom Solutions Inc.  Warwick Ford, Verisign Inc.  Michael Jenkins, NSA  The panel will discuss the current status of Public Key (PK) Certificates as defined by ITU Recommendation X.509 version 3. This discussion will be of interest to representatives from Federal Agencies interested in the use of PK technology to provide services to conduct their internal operations, industry participants interested in using or providing certificate management services, and people interested in the future of electronic communications and electronic commerce.
Track B Electronic Commerce  Legislative Issues Associated with Electronic Commerce  Steven J. Ross, Deloitte and Touche, Chair  Panelists: Todd J. Mitty, NetDox  Nigel Hickson, Department of Trade and Industry (UK)  Electronic commerce is a matter of public policy. To that extent, it is legitimate for governments to set the terms and conditions under which electronic commerce (like its non-electronic counterparts) is conducted. This session will address the experience of those in the public and private sectors to establish laws and regulations that enable electronic commerce. Particular emphasis will be placed on the issues of security and reliability addressed in framing the laws.	Track E Assurance / Criteria / Testing  Integrity Engineering  Donald Evans, CISSP, Space Flight Operations Center, Chair  Panelists: TBD  This panel will discuss the identification and deployment of protection mechanisms, reduction of residual risks, and the determination of metrics of protective effectivity and efficiency for inter/intra-networked systems of systems. These systems are comprised of heteromorphic major applications and general support systems requiring disparate levels of integrity, consistency, and operational continuity.	Track H Tutorials  Risk Management II: Introduction to Vulnerabilities  Bill Unkenholz, NSA  This tutorial provides the second of three foundation tutorials of Risk Management. This tutorial continues with the methodology from Risk Management I, using a systems analysis approach to identify, analyze, and quantify system vulnerabilities.
Track C Information Infrastructure  R&D for Infrastructure Protection  Richard Brackney, NSA, Chair  Panelists: Nancy Wong, President's Commission on Critical Infrastructure Protection  Teresa Lunt, Defense Advanced Research Projects Agency  Steve Kent, BBN  John Kimmons, Bellcore  Ted Humphries, XiSEC Consultants  This panel will present a discussion of R&D activities needed or underway to focus technology in solving infrastructure assurance problems.	Track F R & D   Database Security: Browsers, Encryption, Certificates and More  John Campbell, NSA, Chair  Panelists: Tim Ehrsam, Oracle Corporation  Carl Landwehr, Naval Research Laboratory   Tom Parenty, Sybase Inc.  This session explores security problems and solutions with "new" database systems: those including web browsers and servers, systems requiring strong identification and authentication, single signon, multilevel systems and large mainframe and large warehouse systems.	Track I Professional Development  NGI: Next Generation Internet for the 21st Century  Richard Bloom, NCSC, Chair  Panelists: TBD  The panelists will discuss the Next Generation Internet (NGI) concept and the security requirements. The U.S. Government's investments in Internet technology has been very successful. Internet usages has dramatically expanded since 1988. In the 21st Century, the NGI will be the focus and environment for government, industry and the academia, as well as for individuals. Whether at home, office, or travel, people will use the Internet for working, anking, shopping, entertainment and communications. The security, privacy, integrity, reliability, and availability requirements will be developed, integrated and transparent to the users.

 
 
Visit the vendor exposition!
Over 100 INFOSEC vendors in the Convention Center Exhibition Hall. Sponsored by AFCEA

Retun to table of contents
 

Wednesday, October 8^th 2:00 - 3:30 PM

Track A Internet  Public Key Infrastructures (PKIs)  Warwick Ford, Verisign, Chair  Panelists: Taher ElGamal, Netscape Communications Corporation  Donna Dodson, NIST  Tom Manessis, VISA  Ted Humphries, XiSEC Consultants, Ltd.  This panel examines the significant issues and challenges in the development and deployment of PKIs from the perspectives of the PKI vendor and the PKI implementer.	Track D Debate  Civilizing Cyberspace  Steven Miller, CPSR, Chair  Panelists: Dorothy Denning, Georgetown University  Ruth Nelson, Information Systems Security  Others: TBD  The panelists will discuss the sociological effects twenty years from now of the INFOSEC technology, law, and customs we are putting into place now.	Track G Policy / Administration / Management  Technical Internet Security Policy  Robert Bagwill, NIST, Chair  Panelists: John Pescatore, TIS;   Others: TBD  This panel will discuss a new NIST special publication on technical internet security policy. Technical policy issues include the use and configuration of firewalls, virtual private networks , and interactive software. The panel will provide an overview of the NIST publication and will then discuss methods for using the guideline within organizations.
Track B Electronic Commerce  Is Digital Cash the Futire of Money?  Kawika Daguio, Federal Representative, American Bankers Association, Chair  Panelists: Eric Hughes, Simple Access  Carl Ellison, Cybercash  This Session will discuss the pros and cons of digital money from a security perspective as well as a societal/public policy perspective. Among the topics under discussion will be the tensions between demands for secrecy and security and between security and economic efficiency.	Track E Assurance / Criteria / Testing  Future Strategies  Harold Highland, FICS, Chair  A New Strategy for COTS in Classified Systems  Simon Wiseman, Defense Research Agency, UK  Outsourcing: A Certification & Accreditation Dilemma  Harold Gillespie, CISSP, CTA, Incorporated  The Department of Defense Information Assurance Support Environment  Barry C. Stauffer, Corbett Technologies	Track H Tutorials  Network Security   Jack Wool, Arca Systems, Inc.  This tutorial focuses on network security fundamentals and threats and provide a summary of traditional computer security concerns and objectives, relating the concepts to network security concerns. Security properties required of a trusted network are described in detail per the OSI security services model.
Track C Information Infrastructure  Information Privacy and Human Rights  Wayne Madsen, Senior Fellow, Privacy International, Chair  Panelists: David Banisar, Electronic Privacy Information Center (EPIC)  Other Panelists: TBD  This session will examine various information age threats to personal privacy and the means by which Government and business can provide for the common privacy of all.	Track F R & D   Law Enforcement  Dave Icove, Tennessee Valley Authority, Chair  Panelists: Mark Pollitt, Federal Bureau of Investigation   Wayne Williams, Department of Justice  Jim Christie, President's Infrastructure Protection Task Force	Track I Professional Development  National Training Standards  John Tressler, Department of Education  This session will present the final draft of the rewrite of the NIST publication 500-172. This document outlines the training standards which are referenced in Public Law 100-235. This is a complete rewrite of the previous publication and the contents has significant impact on all US Government agency personnel.

 

3:30 - 4:00 PM

Session Break & Social Networking

Retun to table of contents
 

Wednesday, October 8^th 4:00 - 5:30 PM

Track A Internet  Developing a PKI Solution for Web Transactions:  Lessons Learned  Judith A. Spencer, General Services Administration, Chair  Panelists: Phil Mellinger, First Data;   Monette Respres, Mitretek;   Stanley Choffee, General Services Administration  Isadore Schoen, Cygnacom Solutions  The Federal Information Security Infrastructure Program is running a pilot initiative, Paperless Federal Transactions for the Public, involving PKI and applications. This panel discusses the philosophy of the pilot, how it works, what has been learned, and its future direction.	Track D Debate  Copyright: Should Media Matter? (How Much?)  Joan Winston, TIS, Chair  Panelists:   Prue Adler, Association of Research Libraries  Jonathan Band, Morrison & Foerster LLP  This session will debate the following topics: The ease of copying material in digital form continues to exacerbate the historical tensions between copyright proprietors and users of copyrighted materials. WIPO recently rejected copyright proposals that would have greatly extended copyright protections on electronic information and databases, potentially curtailing the traditional U.S. copyright provisions for fair use. To what extent can we continue to rely on traditional notions that evolved in an analog paper-based world? Can principles such as fair use and the first-sale doctrine endure in the digital Global Information Infrastructure?	Track G Policy / Administration / Management  Metrics of Requirements  Charles Pfleeger, Arca Systems, Inc., Chair  Security Modeling for Public Safety Communication Specifications   Dan Gambel, Mitretek, Inc.  Towards a Framework for Security Measurement  Chenxi Wang, University of Virginia  Connecting Classified Nets to the Outside World:  Costs and Benefits   Christopher P. Kocher, Lockheed Martin Corporation
Track B Electronic Commerce  Who Pays if Things Go Wrong?  Paul Dorey, Barclays Bank, UK, Chair  Panelist: Chuck Miller, General Counsel, Certco  It is inevitable that even the best designed and operated electronic commerce systems will suffer errors and operational failures which can cause loss. In such cases where does liability lie? In a series of presentations and an audience debate, the panelists will raise the issues, citing examples of how things have worked for existing systems like payment systems, and how such models may evolve. In the final 30 minutes, the audience will participate in a structured/open debate.	Track E Assurance / Criteria / Testing  Awareness & Concerns  Les Fraim, ANS, Chair   Cyberterrorism - Fact or Fancy?   Mark Pollitt, Federal Bureau of Investigation   Protecting American Assets, Who is Responsible  Anthony C. Crescenzi, Defense Investigative Service  Who Should Really Manage Information Security in the Federal Government?   Alexander D. Korzyk, Sr., Virginia Commonwealth University, Ph.D. Program	Track H Tutorials
Track C Information Infrastructure  INFOSEC Technology Profession: A Moving Bus  Virgil Gibson, CISSP, Computer Sciences Corporation, Chair   Panelists: TBD   The panelists will address the question: Is INFOSEC a scientific or technical profession? Representatives from academia, who develop INFOSEC curricula in graduate degree programs will discuss the options for their graduates. Practitioners will address the pro's and con's of degreed programs vice other paths of becoming an INFOSEC professional.	Track F R & D   Research in Intrusion Detection  Gene Spafford, Purdue University, Co-Chair   Karl Levitt, UC Davis, Co-Chair   EMERALD: Event Monitoring Enabling Responses to Anomalous Disturbances   Phillip Porras, SRI International   An Application of Machine Learning to Anomaly Detection   Terran Lane, Purdue University    A Process of Data Reduction in the Examination of Computer Related Evidence   Mary F. Horvath, Federal Bureau of Investigation    Automated Information System (AIS) Alarm System   William Hunteman, Los Alamos National Laboratory	Track I Professional Development  How To Find and What to Buy: Current COTS Security Products  Joan Pohly, DISA/IPMO, Co-Chair  Pat Cuiffreda, Department of Justice, Co-Chair  This workshop will review currently available products which can be used in the computer security awareness or training programs without modification and major costs. The emphasis of this workshop is to help people get the awareness program going with current materials on the marketplace. Active audience participation will be encouraged.

 

 Retun to table of contents
 

 
7:00 PM
Conference Banquet
Hytatt Regency Inner Harbor Hotel

 Speaker: Bran Ferran
Walt Disney Imagineering

 

Session Break & Social Networking

 Retun to table of contents
 

Thursday, October 9^th 10:30 AM - 12 noon

Track A Internet  Web Security Problems  Peter Coffee, PC Week Labs, Chair  Go Ahead, Visit Those Web Sites, You Can't Get Hurt, Can You?  James S. Rothfuss, Lawrence Livermore National Laboratory  Web Spoofing: An Internet Con Game  Edward W. Felton, Princeton University  When JAVA Was One: Threats from Hostile Byte Codes   Mark D. Ladue, Georgia Institute of Technology  Vulnerability of "Secure" Web Browsers  Richard Kemmerer, University of California Santa Barbara	Track D Debate  The Data Encryption Standard: 20 Years Later  Dorothy E. Denning, Georgetown University, Chair  Panelists:   William J. Caelli, Queensland University of Technology, Australia;  Stephen T. Kent, GTE   William H. Murray, Deloitte & Touche  This panel will review the significance of DES to the information security field and to infosec products and practices. Panelists will discuss the impact of DES on academic research, cryptanalysis, algorithm and product development, standards, network security, application-level security, and business practices.	Track G Policy / Administration / Management  Risk Management  Christine Trently, Lockheed Martin, Chair  A New Paradigm for Performing Risk Assessment  Judith L. Bramlage, Computer Associates, Inc.   INFOSEC Risk Management: Focused, Integrated & Sensible  Donald R. Peeples, NSA  Role-Based Risk Analysis  LT Amit Yoran, USAF
Track B Electronic Commerce  Internet Commerce Security for Electronic Malls, COINs and Commerce Service Providers  Win Treese, Director of Security, OpenMarket, Inc., Chair  Panelists: TBD  In this discussion, representatives from each of the three main Internet business models, commerce service providers, online malls, and Community of Interest Networks, will discuss the security issues they are facing, and the unique strategies and tactics in place that ensure a safe shopping experience for the hosted businesses and customers. The discussion will focus mainly on each model's key security strategy, the pros and cons of key standards such as SET for each business model, and how each business is using the technologies and standards available to benefit their customers today.	Track E Assurance / Criteria / Testing  Criteria: International Views  Marshall Abrams, The MITRE Corporation, Chair  Application of the IT Baseline Protection Manual  Angelika Plate, BSI, Germany  The Use of Information Technology Security Assessment Criteria to Protect Specialized Computer Systems  Ronald Melton, Pacific Northwest National Laboratory  The Extended Commercially Oriented Functionality Class for Network-based IT Systems  Alexander Herrigel, r3 Security Engineering ag, Switzerland	Track H Tutorials  Database Security  William Wilson, Arca Systems, Inc.  This tutorial focuses on database security issues from the standpoint of using database management systems to meet an organizationís security requirements. Topics include data security requirements, vulnerabilities, database design considerations, and implementation issues. Several architectural approaches to building multilevel database systems are presented including integrity lock, kernalized, layered, partitioned, and distributed. Other database security issues discussed include view versus relation discretionary controls, mandatory controls, inference, aggregation, and statistical inferences.
Track C Information Infrastructure  Viruses: Today's Threats  Kenneth Van Wyk, SAIC, Chair  Practical Defenses Against Storage Jamming  John McDermott, Naval Research Laboratory  What is Wild?  Sarah Gordon, IBM  Secure Software Distribution System  Laura Dobbs, Lawrence Livermore National Laboratory	Track F R & D  Internet: Surviving the Future  Joseph Lisi, National Security Agency, Chair  Security Tools - A "Try Before You Buy" Web-Based Approach  Sheila Frankel, NIST  Stupid Java Script Security Tricks  Walter Cooke, CISSP, W. J. Cooke & Associates  Internet Protocol Next Generation: Saving the Internet in the New Millennium  Robert A. Kondilas, MCI	Track I Professional Development     (OPEN)

 

Visit the vendor exposition!

Over 100 INFOSEC vendors in the Convention Center Exhibition Hall sponsored by AFCEA.

 Retun to table of contents
 

Thursday, October 9^th 2:00 - 3:30 PM

Track A Internet   Internet Discussion: Tomorrow's Security Issues   Jon David, The Fortress, Chair   Panelists: A. Padgett Peterson, P.E., Lockheed-Martin Corp.   Fred Cohen, Sandia National Laboratories   Drew Dean, Princeton University   Richard Ward, Microsoft Corporporation   Steven M. Bellovin, AT&T Labs Research   Peter G. Neumann, SRI International   Jim Roskind, Netscape Communications Corporation   Frederick A. Kolbrener, The Analysis Corporation   Paul A. Karger, IBM Corporation   Taher ElGamal, Netscape Communications Corporation   Free flowing debate of the security issues concerning World Wide Web such as discussed in the 10:30 session earlier today.	Track D Debate   Crime in the 21st Century: Wireless Fraud  James R. Wade, CISSP, CISA, AirTouch Cellular, Chair  Panelists: Dennis Walters, Comcast Cellular Communications  Angel Morales, Professional Security Bureau, Inc.  Dave Daniels, AirTouch Cellular  The panelists will discuss and debate various issues regarding wireless fraud, emerging as the number 1 crime for the 21st century.	Track G Policy / Administration / Management  Cryptographic Standards for the Next Century  Miles Smid, NIST, Chair  Panelists: Burt Kaliski, RSA Laboratories  Don Johnson, Certicom  James Foti, NIST  Cryptography is an important tool of electronic information. It can be used to provide many security services including confidentiality, integrity, authentication and non-repudiation. The Federal Government has increased the scope of their research to include confidentiality. The panelists will discuss their efforts to include: Adding support for confidentiality in the Public Key Infrastructure, Developing the Advanced Encryption Standard, Key Agreement and Management Standard, Key Recovery Demonstration Project.
Track B Electronic Commerce  Critical Components for an Electronic Solution  Christine Varney, Partner Hogan & Hartson LLP, Chair  Panelists: Daniel Poneman, Partner Hogan & Hartson LLP  Ian Angell, London School of Economics  Deborah Triant, President and CEO, Check Point Software Technologies  While other sessions have examined the critical security issues associated with particular Ecommerce environments and transactions, this session will examine more generally what are the security policy requirements from a governmental point of view, what are the consequences of governmental positions in an international, borderless market, are there "technological solutions" to these concerns? What are the requirements from a commercial perspective, can this perspective be reconciled with governmental views, does it need to be? How do the critical security components of Ecommerce get to market and embedded in systems?	Track E Assurance / Criteria / Testing  Common Criteria  Stu Katzke, NIST, US, Chair  Tony Mason, CESG, UK  Lou Giles, NSA, US  Dietra Kimpton, CSE, Canada  Hartwig Kreutz, BSI, Germany  Jean Vialle, SCSSI, France  This panel will discuss the major changes being made to the CC's structure and contents in version 2, the sponsoring organizations' implementation and maintenance plans, the status and results achieved by related implementation projects, the planned internationalization of the CC via ISO, and the expected impact of the CC project on the US and international IT security community.	Track H Tutorials  How to be a Better Security Officer  Chris Breissinger, Department of Defense Security Institute   This tutorial focuses on the continued protection and accreditation of operational information systems. Topics include: virus prevention and eradication; access control evaluation and configuration; media clearing and purging; intrusion detection and handling; and dealing with risk.
Track C Information Infrastructure  Practical Views of Network Protocols  William H. Murray, Deloitte & Touche, Chair  A Methodology for Mechanically Verifying Protocols Using an Authentication Logic   J. Alves-Foss, University of Idaho  A Practical Approach to Design and Management of Secure ATM Networks   Vijay Varadharajan, University of Western Sydney, Australia  Distributed Network Management Security  Paul Meyer, Secure Computing Corporation	Track F R & D   Wrappers, Composition, Architecture Issues for Security and Survivability  Teresa Lunt, DARPA, Chair  Panelists: Lee Badger, TIS;   Franklin Webber, Key Software;   John Knight, University of Virginia;   Rich Feiertag, TIS  This panel will provide a brief summary of the DARPA security program goals and plans for wrappers, composition, architecture issues for security and survivability.	Track I Professional Development     (OPEN)

 
 
 
3:30 - 4:00 PM
Session Break & Social Networking

 
 Retun to table of contents

 
Thursday, October 9^th 4:00 - 5:30 PM

Track A Internet  Practical Experience with Virtual Private Networks  Steve Kent, BBN, Chair  Panelists: Paul Lambert, Oracle  Naganand Doraswamy, Bay Networks, Inc.  Roy Pereira, Timestep  Dan McDonald, Sun Microsystems, UK  This panel will discuss experiences with and lessons learned from developing and implementing VPNs, and challenges (e.g., scalability, widespread deployment) and future needs (automated key management protocols, administration tools) for VPN solutions. Although there are multiple protocols that can be used to create VPNs (e.g., IPSEC, PPTP, SSH, SSL), the focus of the panel will be on the Network Layer (IP-level) VPNs.	Track D Debate  Can the Internet be Controlled?  Vin McClelland, The Privacy Guild, Chair  Panelists: James Bidzos, RSA Data Security, Inc.  Thomas Black, Smith System Engineering, Ltd.  Patricia Edfors, US Government's PKI Steering Committee  David J. Farber, University of Pennsylvania  David Harper, National Computer Security Association  When national boundaries are permeable, national INFOSEC policy may be irrelevant.	Track G Policy / Administration / Management  Cyber Terrorism: Risk Assessment and Response  Christine Axsmith, Esq., The Oakland Corporation, Chair  Panelists: Mark Pollitt, FBI;   Tim Corcoran, The Oakland Group;   Kim Johnson, State Department  This panel will highlight the realities of Cyber Terrorism and educate the audience on its impact. The panel will provide an educated framework in which informed analysis can take place. The types of environments that are subject to attack will be discussed. The audience will also be presented with solutions from both industry and government perspectives to Cyber Terrorism issues.
Track B Electronic Commerce  Consumer Privacy Issues in Electronic Commerce  Marc Rotenberg, Electronic Privacy Information Center, Chair  Panelists: TBD	Track E Assurance / Criteria / Testing  COTS Criteria-Based Evaluation and Assessment Programs   Michael G. Fleming, NSA, Chair  Panelists:, Thomas J. Bunt, Louis Giles, David E. Luddy,NSA  The Common Criteria is the result of an integrated attempt to align the trusted product evaluation criteria and activities of Canada, France, Germany, the Netherlands, the United Kingdom, and the United States into a single document. This panel will provide critical U.S. evaluation program status information to groups that will be directly impacted as a result of the CC implementation efforts.	Track H Tutorials  Risk Management III: Introduction to Risk Assessment  Tom Peltier, Computer Security Institute   This tutorial provides the third of three foundation tutorials of Risk Management. This tutorial continues with the methodology from Risk Management I & II, using a systems analysis approach to identify, analyze, and quantify risks.
Track C Information Infrastructure  Case Study: Computer Security Program Management Partnership: A Success Story   Mark Wilson, NIST, Chair  Panelists:  William D. Tate, Daniel T. Crowley, Northrup Grumman Corporation;  John McWhorter, Defense Investigative Service  This panel will discuss how to create effective partnerships between an organization's computer security program management office, users and with auditors. This panel will help participants to fully integrate computer security awareness and responsibility throughout a business or agency.	Track F R & D   Survivability Technologies  Teresa Lunt, DARPA, Chair  Panelists: Phil Porras, SRI; Dan Schnackenberg, Boeing; Maureen Stillman, ORA; Stuart Staniford-Chen, University of California Davis  This panel will provide a brief summary of the DARPA security program goals and plans for wrappers, composition, and architecture issues for security and survivability.	Track I Professional Development    (OPEN)

 

 Retun to table of contents

 
6:00 - 8:00 PM
Best Paper Awards
National Cryptologic Museum
Fort Meade, MD

Buses will be available.

 Retun to table of contents
 

Friday, October 10^th 8:30 - 10:00 AM

Track A Internet  Network Security - From a User & Vendor Perspective  Ken Heist, NSA, Chair  Panelists: Frank Hecker, Netscape Communications, Inc.; Gregory Gilbert, NSA;   Robert Gray, Litronic, Inc.; Richard Parker, NATO Consultation, Command, and Control Agency  This panel will consider questions related to the implementation of Multi-level Information System Security Initiative (MISSI) products, applications, and infrastructure. The panelists have experience with current MISSI Beta Test activity, MISSI in NATO, Defense Message System pilot tests, the mid-1997 FORTEZZA infrastructure change, emerging FORTEZZA-compatible applications, and the MISSI product evaluation and approval process.	Track D Debate  Controlling Employees' Use of the Internet  Christine Axsmith, Esq., The Oakland Corporation, Chair  Panelists: Andy Grosso, Esq., Washington, DC  Tom Guidoeoni, Michaels, Wishner, and Bonner  Wayne Madsen, Privacy International  This panel will debate the pros and cons of controlling employees' use of the Internet.	Track G Policy / Administration / Management  Keeping Pace with Threats in Networked Client/Server Environments  G. Mark Hardy, AXENT Technologies, Inc., Chair  Panelists: Jim Mork, BSG, Inc.;  This panel will discuss how information security managers can leverage technology to keep pace with the threat posed in the networked client/server environment.
Track B Electronic Commerce   Copyright & Intellectual Property Issues Associated with Electronic Commerce  Jessica Litman, Professor of Law, Wayne State University, Chair  Panelists:  Shira Perlmutter, Assistant Register of Copyrights   Adam Eisgrau, American Library Association  This Session will discuss the legal issues associated with Electronic Commerce regarding Copyright and IP from a local, national, and international perspective.	Track E Assurance / Criteria / Testing  Vendor Dialog on Evaluation Programs  Jeremy Epstein, Tracor, Co-Chair  Casey Schaufler, Silicon Graphics, Co-chair  The Co-Chairs will lead the audience in a discussion of their experiences in performing TCSEC/TNI/TDI evaluations, opinions of TPEP and TTAP programs, use of the RAMP program, interpretations of the TCSEC, ITSEC evaluations, and the forthcoming Common Criteria evaluations.	Track H Tutorials  Infrastructure Security  John T. Egan, National Defense University  This session will cover the fundamentals of encryption and the security services that are proposed for large infrastructures such as the NII and the DII. There is a movement in some quarters for providing a common set of security services that will support both types of infrastructures even though their missions are quite different.
Track C Information Infrastructure  Case Study: An Architecture & Approach  Willis Ware, Chair  Panelists: David Van Wie, Olin Sibert, James Horning, InterTrust Technologies Corporation  This panel will discuss how one company executed their vision of electronic commerce, an architecture, and research directions.	Track F R & D  Manhattan Cyber Project  Mark Gembicki, War Room, Chair  Panelists: Jim Christy, DoD Representative, Infrastructure Protection Task Force  two other Manhattan Cyber Project members  A few select members of the Manhattan Cyber Project will discuss their findings to date and future initiatives. Their mission is to improve on the availability and effectiveness of technology, people, and processes that safeguard critical infrastructure areas and U.S. corporations from the "cyber threat." The approach to accomplish this mission is based on developing and facilitating a coordinated "outreach" program with industry, government, and academia.	Track I Professional Development     (OPEN)

 
 
10:00 - 10:15 AM
Session Break & Social Networking

 
 Retun to table of contents
 

Closing Plenary

Friday October 10, 1997 10:15 AM

1997 System Security Award Winner Presentation
Presented by John Davis, NCSC & Stuart Katzke, NIST

followed by the Closing Plenary

The Future of Electronic Commerce   Risks, Realities, and Expectations     Chair Peter G. Neumann SRI International   Distinguished Panelists:   Larry Stewart Chief Technology Officer, Open Market   Steve Walker President, Trusted Information Systems, Inc.   Rick Hite Director, Risk Management and Security, Visa International   Helmut Kurth IAGB, Germany The future of computer-communication security will to a large extent be driven by the urgent needs of electronic commerce, while at the same time being hindered by the realities of the emerging computer and networking infrastructures. This session will address those realities, and will attempt to see into the future. Its scope will be fairly broad, encompassing systems, networks, financial applications, and digital commerce generally, from the primary viewpoint of security risks and their avoidance, but also cognizant of the social issues. It will also recognize that the problems are international, not just national.   Many questions might arise in the course of the discussion. What is achievable? What is likely? What are the most difficult obstacles to be overcome? What research areas are not being adequately stressed? What can we expect of technology? What are the intrinsic limitations? What are the weakest links? What non-technological issues must be defended against, such as human compromisibility? What are the tradeoffs (for example, among cost-effectiveness, integrity, confidentiality, anonymity, accountability, and law enforcement needs)? What residual risks will necessarily remain? What should or should not governments do to ensure that electronic commerce and related applications can take place dependably? What impacts are national cryptological policies having on electronic commerce? What can be done to ensure that critical components of the national infrastructure (including telecommunications and electrical power) remain adequate?

 
 Retun to table of contents