Lecture series: IT Security in the winter

Interessted in IT security?

Would you like more background information or are you interested in understanding in what areas IT security also plays a role?

Then our lectures are just the thing for you!

23.11.2016: How I know you printed my email, Prof. Dr. Alexander Pretschner

Date/time: Wednesday, 23.11.2016, 18:30 Uhr

Location: Lecture hall 1100 (main campus)

Lecturer: Prof. Dr. Alexander Pretschner- Lehrstuhl für Software Engineering der TUM

Language: Englisch

Lecture content:

This overview talk tackles the problem of specifying, monitoring and enforcing data usage requirements of the kind, “print my email at most twice,” “notify me upon dissemination of my address,” “no more than three copies of a confidential document in the company,” “delete all copies of a movie within thirty days,” “keep financial record for five years,” and the like.We discuss typical policies as well as an enforcement infrastructure that can act both after the fact, for accountability purposes, and preventively. It builds on two main ideas. First, requirements come at various levels of abstraction: prohibiting screenshots, writing files, playing songs, and copying database rows can most conveniently observed and controlled by monitors at different layers of a system: window manager, operating system, application, database. Second, when data is to be protected, usually all of its representations are meant to be protected: a picture comes as network packets, pix map, cache file, Java object. This requires information flow tracking technology across the layers of a system and across systems.We will conclude with a discussion on the circumstances under which such an infrastructure seems desirable.

Vortragstermin: Mittwoch, 23.11.2016, 18:30 Uhr

Ort: Hörsaal 1100 (Stammgelände)

Vortragender: Prof. Dr. Alexander Pretschner- Lehrstuhl für Software Engineering der TUM

Vortragssprache: Englisch

Vortragsinhalt:

This overview talk tackles the problem of specifying, monitoring and enforcing data usage requirements of the kind, “print my email at most twice,” “notify me upon dissemination of my address,” “no more than three copies of a confidential document in the company,” “delete all copies of a movie within thirty days,” “keep financial record for five years,” and the like.We discuss typical policies as well as an enforcement infrastructure that can act both after the fact, for accountability purposes, and preventively. It builds on two main ideas. First, requirements come at various levels of abstraction: prohibiting screenshots, writing files, playing songs, and copying database rows can most conveniently observed and controlled by monitors at different layers of a system: window manager, operating system, application, database. Second, when data is to be protected, usually all of its representations are meant to be protected: a picture comes as network packets, pix map, cache file, Java object. This requires information flow tracking technology across the layers of a system and across systems.We will conclude with a discussion on the circumstances under which such an infrastructure seems desirable.

Vortragstermin: Mittwoch, 23.11.2016, 18:30 Uhr

Ort: Hörsaal 1100 (Stammgelände)

Vortragender: Prof. Dr. Alexander Pretschner- Lehrstuhl für Software Engineering der TUM

Vortragssprache: Englisch

Vortragsinhalt:

This overview talk tackles the problem of specifying, monitoring and enforcing data usage requirements of the kind, “print my email at most twice,” “notify me upon dissemination of my address,” “no more than three copies of a confidential document in the company,” “delete all copies of a movie within thirty days,” “keep financial record for five years,” and the like.We discuss typical policies as well as an enforcement infrastructure that can act both after the fact, for accountability purposes, and preventively. It builds on two main ideas. First, requirements come at various levels of abstraction: prohibiting screenshots, writing files, playing songs, and copying database rows can most conveniently observed and controlled by monitors at different layers of a system: window manager, operating system, application, database. Second, when data is to be protected, usually all of its representations are meant to be protected: a picture comes as network packets, pix map, cache file, Java object. This requires information flow tracking technology across the layers of a system and across systems.We will conclude with a discussion on the circumstances under which such an infrastructure seems desirable.

14.12.2016: IT-Sicherheit im (scheinbar) Privaten: Was muss ich rechtlich beachten?, Johannes Nehlsen

Date/time: Wednesday, 13 December 2016, 6:30 p.m.

Location: Lecture hall 1100 (main campus)

Lecturer: Johannes Nehlsen, Universität Würzburg, Stabsstelle "IT-Recht, Lizenzmanagement, E-Procurement"

Language: German

Lecture content:

Fast täglich sind IT-Sicherheitsvorfälle in den Nachrichten. Die Politik übt sich in Aktionismus rechtliche Rahmenbedingungen für IT-Sicherheit zu schaffen. In der Regel trifft die neue Regulierung aber nur Atomkraftwerke oder Internetriesen. Die Frage welche Verantwortung eine jede und ein jeder in seinem privaten Umfeld zu tragen hat bleibt unbeantwortet.

Doch die Stimmen aus der Politik werden lauter. Erst kürzlich sprach Innenminister Thomas de Maizière vom Mythos des "armen Nutzers". Auch könnten viele User ihre Geräte perfekt bedienen und dürften daher nicht aus der Verantwortung für die IT-Sicherheit entlassen werden. Es steht die Forderung nach Schadenersatzanspruch bei IT-Sicherheitsversagen im Raum.

Der Vortag möchte aufzeigen, wo dieser Schadensersatzanspruch bereits jetzt für jeden besteht. Es wird ein Blick geworfen auf:

Vertragliche Pflichten zu IT-Sicherheit
Haftungsrisiken auf Facebook oder für das eigene Blog
IT-Sicherheit als Verkehrssicherungspflicht
Mitverschulden wegen mangelhafter IT-Sicherheit

11.1.2017: Mobile Schädlinge - Vergangenheit und Zukunft, Dr. Michael Spreitzenbarth

Date/time: Mittwoch, 11.1.2017, 18:30 Uhr

Location: Lecture hall 1100 (main campus)

Lecturer: Dr. Michael Spreitzenbarth, Siemens CustomerCERT

Language: German

Lecture content:

Smartphones und Tablets mit Googles Android sind eine nicht zu unterschätzende Gefahrenquelle für die Unternehmens-IT. Spionage-Apps und Erpressungs-Trojaner können massiven Schaden anrichten, wie auch die jüngste Vergangenheit gezeigt hat. Im Rahmen dieses Vortrags erhalten interessierte Zuhörer einen Überblick über die Gefahren durch mobile Schädlinge und erste Einblicke wie man sich davor schützen kann. Dabei geht es hauptsächlich um die folgenden Fragestellungen:

Wie sieht die Entwicklung mobiler Malware aus?
Wie sehen Funktion und Wirkungsweise bekannter RATs und APTs aus?
Was sind Erkennungsmechanismen für infizierte Smartphones?
Wie ist das richtige Vorgehen im Verdachtsfall?

Cryptoptarties

Cryptoparty for freshmen in Electrical and Computer Engineering and friends: 9.11.2016, starting at 16:00 in 2750 (Arcisstr. 21) - held in German
Cryptoparty for freshmen in Maths/Physics/Computer Science and friends: 7.12.2016, starting at 16:00 at LRZ (Seminarraum 1) - held in German