Search

Due to the complex dynamical properties of chaos, designing chaos-based hash functions emerged as a new research direction to reinforce information security of data sent through the Internet. This paper aims at developing a novel methodology to construct keyed hash functions based on chaotic iterations, which can avoid dynamic degradation caused by finite precision. The chaotic iterations are used first in the design of strategies thanks to particular pseudorandom number generators. They are also used in hash value computation, by iterating on state-of-the-art hash functions. Security investigations related to sensitiveness, diffusion and confusion, and collision analysis validate the proposed systematic methodology, showing that such post-processing on standard hash functions will preserve their security properties. [ABSTRACT FROM AUTHOR]

Security incidents detected by organizations are escalating in both scale and complexity. As a result, security incident response has become a critical mechanism for organizations in an effort to minimize the damage from security incidents. The final phase within many security incident response approaches is the feedback/follow-up phase. It is within this phase that an organization is expected to use information collected during an investigation in order to learn from an incident, improve its security incident response process and positively impact the wider security environment. However, recent research and security incident reports argue that organizations find it difficult to learn from incidents. A contributing factor to this learning deficiency is that industry focused security incident response approaches, typically, provide very little practical information about tools or techniques that can be used to extract lessons learned from an investigation. As a result, organizations focus on improving technical security controls and not examining or reassessing the effectiveness or efficiency of internal policies and procedures. An additional hindrance, to encouraging improvement assessments, is the absence of tools and/or techniques that organizations can implement to evaluate the impact of implemented enhancements in the wider organization. Hence, this research investigates the integration of lightweight agile retrospectives and meta-retrospectives, in a security incident response process, to enhance feedback and/or follow-up efforts. The research contribution of this paper is twofold. First, it presents an approach based on lightweight retrospectives as a means of enhancing security incident response follow-up efforts. Second, it presents an empirical evaluation of this lightweight approach in a Fortune 500 Financial organization's security incident response team. [ABSTRACT FROM AUTHOR]