Heather Maria Hinton

Wired versus wireless security: the Internet, WAP and iMode for E-commerce

The perceived lack of security in the wireless environment has delayed many initiatives in providing access to E-commerce applications from wireless devices. Many organizations are skeptical that the same kind of security protections that they are used to in the current Internet (wired) E-commerce environment are also available for wireless transactions. We show that these perceptions are misplaced. We describe the security properties and mechanisms available for Internet (wired), WAP based and iMode E-commerce. We find that both WAP and iMode provide excellent security features and are geared to provide other security provisions over and above those commonly available in a wired environment.

SAM: Security Adaptation Manager

In the trade-offs between security and performance, it seems that security is always the loser. If we allow for adaptive security, we can at least ensure that security and performance are treated somewhat equally. Using adaptive security, we can allow a system to exist in a less secure, more performant state until it comes under attack. We then adapt the system to a more secure, less performant implementation. In this paper, we introduce the Security Adaptation Manager, or SAM. We describe SAM and how we have implemented SAM to take advantage of the different protection strengths offered by the StackGuard compiler. Using SAM to provide StackGuard-based adaptive security provides a form of misuse-based intrusion detection, capable of detecting known and novel attacks.

Identifying Patterns of Federation Adoption

“I don’t see that [federation identity] happening this year, I don’t see it happening next year or the year after that--that leaves 2009, and I’ll leave that one open... There are a lot of issues, but basically it boils down to trust and antitrust.” [PennO6]. Despite this pessimism, federation technology and models are being deployed and are in production now, only not in those areas that they were originally expected. In this paper, we describe several adoption patterns that we have observed and the characteristics that have driven these deployments. Existing business relationships between companies are often strong enough to support federated relationships and are being used as the foundation of present-day federated identity deployments.