Secure by default : a behavioral approach to cyber security
Abstract/Contents
- Abstract
- Most computer systems that interface with the internet today presume that users will adopt additional security measures to protect themselves against phishing and malware attacks, and are capable of configuring software to obtain optimal security. This assumption is worrying, as prior work has repeatedly shown that not all computer users face similar levels of risk, and at-risk users may not have the resources or know-how to adopt obtain optimal levels of security. The first part of this thesis conducts an empirical analysis of the HTTPS configuration of over 4 million websites in order to assess the security posture of the ecosystem, as well as the factors that influence operators' security decisions. We show that while most websites have secure configurations, this is largely due to major cloud providers that supply secure defaults. Individually configured servers are more often insecure than not. We show that both server software defaults and online configuration recommendations are frequently insecure, and conclude with lessons for improving the HTTPS ecosystem. Among these, is the recommendation that server software should provide optimal security by default, thereby removing the burden of achieving optimal security from users. As technologies to defend against phishing and malware (e.g., two factor authentication or security keys) often impose an additional financial and usability cost on users, a key question is who should adopt these heightened protections. The second part of the thesis uses computational and survey methods to construct data-driven tools that identify at risk users for (1) malware, with a special focus on ransomware, and (2) for e-mail based phishing and malware. We measure over 287 phishing and malware attacks against Gmail users to identify the factors place a user at heightened risk of attack. Secondly, we present a machine learning model that draws on detailed web browsing behavior to predict users at risk of malware infection the following month; lastly, we develop and administer a survey to a representative sample of the U.S. population to first, provide a representative estimate of the prevalence of ransomware attacks within the general population, and second, to develop a proof-of-concept self-assessment of future ransomware risk
Description
| Type of resource | text |
|---|---|
| Form | electronic resource; remote; computer; online resource |
| Extent | 1 online resource |
| Place | California |
| Place | [Stanford, California] |
| Publisher | [Stanford University] |
| Copyright date | 2020; ©2020 |
| Publication date | 2020; 2020 |
| Issuance | monographic |
| Language | English |
Creators/Contributors
| Author | Simoiu, Camelia Valentina |
|---|---|
| Degree supervisor | Goel, Sharad, 1977- |
| Thesis advisor | Goel, Sharad, 1977- |
| Thesis advisor | Durumeric, Zakir |
| Thesis advisor | Mitchell, John C |
| Degree committee member | Durumeric, Zakir |
| Degree committee member | Mitchell, John C |
| Associated with | Stanford University, Department of Management Science and Engineering |
Subjects
| Genre | Theses |
|---|---|
| Genre | Text |
Bibliographic information
| Statement of responsibility | Camelia Simoiu |
|---|---|
| Note | Submitted to the Department of Management Science & Engineering |
| Thesis | Thesis Ph.D. Stanford University 2020 |
| Location | electronic resource |
Access conditions
- Copyright
- © 2020 by Camelia Valentina Simoiu
- License
- This work is licensed under a Creative Commons Attribution Non Commercial 3.0 Unported license (CC BY-NC).
Also listed in
Loading usage metrics...