Continuous monitoring and sharing of threat intelligence have become a priority for organizations, as the cyberthreat landscape is evolving. Cybersecurity vendors regularly publish threat-related documents, which describe how sophisticated cyberattacks are performed and how the threat landscape is changing. However, threat-related documents are written in natural language and there are often documents published by multiple vendors discussing the similar set of cyberattacks.

Modern software makes extensive use of third-party open source packages and libraries, referred to as dependencies ^[12]. However, the use of open source has opened up new attack vectors, as malicious or vulnerable code can sneak into a software through these third-party dependencies ^[11]. Further, practitioners recommend keeping dependencies up to date with the latest version ^[1], resulting in developers to keep pulling in new code through frequent dependency updates ^[4], often automatically and without a security review ^[10].

Payment Service Providers (PSP) enable application developers to effortlessly integrate complex payment processing code using software development toolkits (SDKs). While providing SDKs reduces the risk of application developers introducing payment vulnerabilities, vulnerabilities in the SDKs themselves can impact thousands of applications. In this work, we propose a static analysis tool for assessing PSP SDKs using OWASP’s MASVS industry standard for mobile application security.

The development of a science is an iterative and systematic process that requires rigor and validity both in the conduct of the research and the reporting of the research. Using input from the SoSL community, we developed a set of guidelines describing the information a research report should contain to maximize the contribution of the work and to facilitate the development of a science of security. Then, to gather feedback on the usability of the guidelines, we hosted a workshop at the SoSL Fall quarterly meeting where participants applied the guidelines to their own papers.

Cyber-physical systems (CPS) are a vital component of the modern way of life. The public has only recently become aware of their importance and fragility, via events like the Colonial Pipeline at-tack. Increasing the expertise and size of the CPS work force is critical for the operation, modernization, and defense of the United States’ most critical infrastructure. This paper explores the state of undergraduate CPS higher education in the literature and practice on college campuses. A large disparity in CPS definitions, course structure, and implementation of these courses is discussed.

In order to achieve ’Security by Design’ ^[10] there needs to be a solution to the problem of security verification in the early phase of a software development life cycle. This paper proposes a system to assist with this verification in the context of composable systems, such as cloud based solutions. The system verifies functional specifications, such as TOSCA templates commonly used in cloud systems. The verification is performed using logic rewriting in the Maude language.

This presentation is part of the Works-in-Progress session, which aims to provide authors with early feedback to adjust on-going research. Manuscript titles are redacted until the work has been published.

This presentation is part of the Works-in-Progress session, which aims to provide authors with early feedback to adjust on-going research. Manuscript titles are redacted until the work has been published.

Intel Trust Domain Extensions (TDX) is the upcoming trusted execution environment offering of Intel. One of the most critical processes of Intel TDX is the remote attestation mechanism. In this talk, we expose some of the discrepancies in Intel’s specifications of remote attestation that may potentially lead to design and implementation flaws. We explain how formal specification and verification using ProVerif could help avoid these flaws.