Sergiy Popovych will present his general exam on Monday, October 24, 3:30pm in CS 301. The members of his committee are David August (adviser), Nick Feamster, and Arvind Narayanan. His abstract and reading list are below. Everyone is invited to attend his talk, and those faculty wishing to remain for the oral exam following are welcome to do so. __________________________________ As has been demonstrated time and again, almost all systems can be compromised. Connecting to an external network through a unidirectional gateway physically disallows any outgoing traffic, and thus prevents data theft. Existing unidirectional gateways act as stateless links, only supporting inherently unidirectional applications. In an attempt to support applications that require request/response behavior (e.g. web browsing), Starlight adds a second, bidirectionally connected machine not entrusted with sensitive information, which improves usability. However, with Starlight an attacker can observe user actions on the external machine, which enables him to learn information about the enterprise, as well as mount attacks targeting the user (e.g. phishing) . This work proposes Moonshine, a system that uses content prefetching in order to prevent user-caused leakage, and presents usability and security evaluation of this approach. Books: * Ross J. Anderson. 2008. Security Engineering: A Guide to Building Dependable Distributed Systems (2 ed.). Wiley Publishing. (Chapters 1, 3, 6, 8, 13, 21) * Asaf Shabtai, Yuval Elovici, Lior Rokach. 2012. A Survey of Data Leakage Detection and Prevention Solutions. Springer US. Papers: * R. T. Barker and C. J. Cheese. "The application of data diodes for securely connecting nuclear power plant safety systems to the corporate IT network". System Safety, incorporating the Cyber Security Conference, 7th IET International Conference on, Edinburgh, 2012. * B. S. Jeon and J. C. Na. "A study of cyber security policy in industrial control system using data diodes", 18th International Conference on Advanced Communication Technology (ICACT), Pyeongchang, 2016. * Eric Byres. The air gap: SCADA's enduring security myth. Communications, 2013. * Arthur Gervais, Reza Shokri, Adish Singla, Srdjan Capkun, and Vincent Lenders. "Quantifying Web-Search Privacy". In Proceedings of the 2014 ACM SIGSAC Conference on Computer and Communications Security , 2014. * M. Anderson, C. North, J. Griffin, R. Milner, J. Yesberg and K. Yiu. "Starlight: Interactive Link". Computer Security Applications Conference, 12th Annual, San Diego, CA, 1996. * Shuo Chen, Rui Wang, XiaoFeng Wang, and Kehuan Zhang. "Side-Channel Leaks in Web Applications: A Reality Today, a Challenge Tomorrow". In Proceedings of the 2010 IEEE Symposium on Security and Privacy, 2010. * Bracha Shapira, Yuval Elovici, Adlay Meshiach, and Tsvi Kuflik. "PRAW - A PRivAcy model for the Web" Research Articles. J. Am. Soc. Inf. Sci. Technol, 2005. * Panagiotis Papadopoulos, Antonis Papadogiannakis, Michalis Polychronakis, Apostolis Zarras, Thorsten Holz, and Evangelos P. Markatos. "k-subscription: privacy-preserving microblogging browsing through obfuscation". In Proceedings of the 29th Annual Computer Security Applications Conference, 2013.