@conference {18677,
	title = {How secure are networked office devices?},
	year = {2011},
	month = {2011/06//},
	pages = {465 - 472},
	abstract = {Many office devices have a history of being networked (such as printers) and others without the same past are increasingly becoming networked (such as photocopiers). The modern networked versions of previously non-networked devices have much in common with traditional networked servers in terms of features and functions. While an organization may have policies and procedures for securing traditional network servers, securing networked office devices providing similar services can easily be overlooked. In this paper we present an evaluation of privacy and security risks found when examining over 1,800 networked office devices connected to a large university network. We use the STRIDE threat model to categorize threats and vulnerabilities and then we group the devices according to assessed risk from the perspective of the university. We found that while steps had been taken to secure some devices, many were using default or unsecured configurations.},
	keywords = {computer network security, data privacy, networked office device security, privacy risk assessment, Risk management, security risk assessment, STRIDE threat model, university network},
	doi = {10.1109/DSN.2011.5958259},
	author = {Condon,E. and Cummins,E. and Afoulki,Z. and Michel Cukier}
}
@conference {12098,
	title = {A trend analysis of exploitations},
	booktitle = {2001 IEEE Symposium on Security and Privacy, 2001. S\&P 2001. Proceedings},
	year = {2001},
	month = {2001///},
	pages = {214 - 229},
	publisher = {IEEE},
	organization = {IEEE},
	abstract = {We have conducted an empirical study of a number of computer security exploits and determined that the rates at which incidents involving the exploit are reported to CERT can be modeled using a common mathematical framework. Data associated with three significant exploits involving vulnerabilities in phf, imap, and bind can all be modeled using the formula C=I+S{\texttimes}√M where C is the cumulative count of reported incidents, M is the time since the start of the exploit cycle, and I and S are the regression coefficients determined by analysis of the incident report data. Further analysis of two additional exploits involving vulnerabilities in mountd and statd confirm the model. We believe that the models will aid in predicting the severity of subsequent vulnerability exploitations, based on the rate of early incident reports},
	keywords = {Computer science, computer security exploits, Data analysis, data mining, Educational institutions, exploitations, Performance analysis, Predictive models, Regression analysis, Risk management, security of data, software engineering, system intrusions, System software, trend analysis, vulnerabilities, vulnerability exploitation},
	isbn = {0-7695-1046-9},
	doi = {10.1109/SECPRI.2001.924300},
	author = {Browne,H. K and Arbaugh, William A. and McHugh,J. and Fithen,W. L}
}
@article {18435,
	title = {Striving for correctness},
	journal = {Computers \& Security},
	volume = {14},
	year = {1995},
	month = {1995///},
	pages = {719 - 738},
	abstract = {In developing information technology, you want assurance that systems are secure and reliable, but you cannot have assurance or security without correctness. We discuss methods used to achieve correctness, focusing on weaknesses and approaches that management might take to increase belief in correctness. Formal methods, simulation, testing, and process modeling are addressed in detail. Structured programming, life-cycle modeling like the spiral model, use of CASE tools, use of formal methods, object-oriented design, reuse of existing code are also mentioned. Reliance on these methods involves some element of belief since no validated metrics on the effectiveness of these methods exist. Suggestions for using these methods as the basis for managerial decisions conclude the paper.},
	keywords = {Assurance, belief, correctness, Formal Methods, MATHEMATICAL MODELS, metrics, Process models, Risk management, Security testing, Silver bullets, simulation, Trustworthiness},
	isbn = {0167-4048},
	doi = {10.1016/0167-4048(95)00022-4},
	url = {http://www.sciencedirect.com/science/article/pii/0167404895000224},
	author = {Abrams,Marshall D. and Zelkowitz, Marvin V}
}
