BUSINESS INTELLIGENCE

N.S.A. & BUSINESS NETWORKING

ECHELONS

[ Click Image (above) To Learn More About EPM ]

National Information Systems Security

U.S.A., Washington, D. C. - November 1, 2001: The National
Information Systems Security Conference (aka) NISSC holds special
annual conferences where handpicked representatives of top corporate
America and top intelligence agencies get together on a variety of
subjects which relates to industrial modeling information systems and
security management. Such a curious intertwining of business leaders
channeling and brainstorming directly with intelligence hierarchy
officials is absolutely amazing, as shown in detail here.

This think tank of sorts, conducts its business intelligence

brainstorming in any one of a variety of pre-scheduled meeting
places around the World. As an example, one year it met be held at
what once was (until 2001) one of the many U.S. National Security
Agency (aka) N.S.A. listening post for the global ECHELON
telecommunication satellite surveillance intelligence station at Bad
Aibling Station (aka) BAS, located inside the little village of
Mietraching, Germany while the following year, it could meet at the
Hyatt Regency Hotel & Convention Center in Orlando, Florida.

The National Security Agency (aka) N.S.A., is NISSC's "host" and

working participant along with a few "handpicked" American and
foreign firms, i.e. I.B.M., FUJITSU, BOEING, SIEMENS, LOCKHEED-
GRUMAN, SAAB, ARINC, BAES SYSTEMS, PTC, AIRBUS, ROCKWELL-
COLLINS, MICROSOFT, MITRE, and even ESTEE LAUDER (a cosmetics
firm), to name just a few.

The collective, goes over "in detail", what they submitted in their
lengthy papers sent ahead of time to, the N.S.A. for its review. The
N.S.A. with a few sponsored firms then select their specific personnel
to study the reports these handpicked firms address. Some topics may
have an N.S.A. mission need and/pr, impact so in most all instances of
these meetings, NSA staff are present. Security is tremendous, to say
the least.

The focus on "information system security" a subject matter the N.S.A.

no doubt has already written the book on - provides this co-joint think
tank workshop exercises the time to study how a new information
security management system will best serve their future needs.

The prime subject matter's intelligence, deals with encryption codes,

dictionary standards and, methods for using and/or modifying a new
form of high-technology information management transference which,
is already designed to provide heightened security when handshaking
of data occurs over the internet and other means via satellite system
links for all these firm's current and future information requirements.
 EPM - The Software Mastermind Firm
The purpose of EPM TECHNOLOGY, a JOTNE firm, based out of Oslo, Norway,
is distributing - with the blessing of the N.S.A. - its form of modularly innovative
high-tech data management technology throughout global organizations in a
variety of industries.

Specifically, the focus is on EPM Technology's, EXPRESS Data Manager (aka)

EDM based tools, designed for the many uses for its global multi-user customer's
Management Information Systems (aka) M.I.S..

These organizations are now gradually moving away from managing information
"on paper" and toward, being able to exchange and share huge amounts of data
electronically via extremely fast digital formats using computers which, the N.S.A.
has an interest in.

EPM's technology creation management system tools enable product data to be

effectively managed, exchanged and shared across radically different systems,
independent of location, type or network design. It allows access to this data
throughout the life cycle of the product and ensures that the information is in a
form that can be accessed and interpreted for decades to come.

It is already quick, easy and inexpensive to transfer or access basic, everyday

information via Databases, E-Mail, Internet Websites and, Intranet.

It is nearly impossible, however, to accurately and reliably exchange, share and

manipulate complex, technical data about a product - its design, properties and
structures, its development and history, its costs and maintenance, etc..
Problems arise because:

1. Different systems are used to design, analyze, manufacture and document a

product.;

2. Each system has its own way of representing data.;

3. Each group or organization tends to choose its own systems.;

4. Systems in use change over time, making some data inaccessible.; and,

5. Different hardware and software environments are a fact of computer life.

The ability to efficiently transfer and translate sophisticated product data,

independent of hardware and software environments, is now recognized
worldwide as the next, natural and vital step in the evolution of product data
technology and product information management. This ability is considered
essential for effective communication and cooperation, not only within work
groups and among colleagues but with customers, suppliers, users and business
partners. It is considered absolutely critical if an organization wants to archive
and maintain a competitive advantage well into the 21st century.

EPM sees the 21st century as significant for the deployment of its EDM set of
tools for Electronic Commerce and Product Data Technology standards - in
particular ISO 10303 - the international standard for the representation and
exchange of product model data, also known as STEP and EXPRESS-compliant
products EXPRESS, is a product suite that contains the tools needed to begin
implementing the product data technology standards for the 21st century by,
creating and managing EXPRESS schemata, customizing data models, and
establishing product-data databases and archives. EXPRESS products from
EPM Technology are available today to meet crucial needs for future success.
EDM is modular by design, enabling a firm to mix and match the products and
options they want, and to easily expand or update the system as their needs
change and as the standard continues to evolve. EDM products are available for
UNIX or Microsoft Windows platforms.

EDM is designed to make all product details, not just visual details, available to a
variety of users during all phases of engineering, development, production,
operation and maintenance. Ultimately, the EXPRESS Data Manager helps
transform many business theories into realistic business goals; goals which will
ensure a strategic, competitive edge for projects and companies, large or small:

1. Minimize product life-cycle costs.;

2. Provide continuous acquisition and life-cycle support (CALS).;

3. Ensure data integrity.;

4. Collaborate in virtual or extended enterprises;

5. Shorten product development cycles.;

6. Support concurrent product and process development.; and,

7. Respond with agility to changing customer needs.

The information handled by the EXPRESS Data Manager is contained in data

models rather than in paper-based blueprints or application-specific programs,
databases or texts. These models are created and defined in EXPRESS, the
information modeling language specified in STEP (ISO 10303-11).

Like other computer languages, EXPRESS has a well-defined syntax, structure

and set of language rules. In sharp contrast to other languages, however, in an
EXPRESS-based approach to product data the models are totally independent of
any underlying implementation tools.
As the foundation for EPM Technology's EDM, EXPRESS makes it possible to
link pieces of information that were once isolated from one another by
incompatible formats. Together, EXPRESS and the EXPRESS Data Manager
make it possible to overcome one of the main obstacles in true business and
process integration for the future.

NSA-EDM Cast Of Business Character Interests

To demonstrate a few examples of which EDM character firms might be

represented and how they might interact with the N.S.A. in being
casted for tutorials in an N.S.A. workshop workgroup and, in what the subject
areas of information management security focus might specifically be, is
ascertained by reviewing the minutes of previous meetings, studying a 1997
NISSC pre-scheduled meeting’s itineraries, topics and subject matter along with
their chairman's and panelists, as follows:

The Secret and Below Interoperability (aka) SABI Process

Continuing the Discovery of Community Risk

Monday, 1:30 Rooms: ____ - ____

Chairman: Mark Loepker, National Security Agency

Panelists: Curtis Dukes, National Security Agency; Charles Schreiner, National

Security Agency; Willard Unkenholz, National Security Agency; Corky Parks,
National Security Agency; Dallas Pearson, National Security Agency; Warner
Brake, Defense Information Systems Agency.

Topic Chairman and Panelist's Biographies

Mark Loepker: The Chief, Information Assurance Process Special Project Office,
Information Assurance Solutions, National Security Agency. He is responsible for
all matters impacting the development, refinement, and implementation of the
information assurance solution process. In this capacity, Mr. Loepker leads the
Secret and Below Interoperability (SABI) project. He last served with the
Command, Control, Communications, and Computer Systems Directorate, U.S.
European Command, as Chief, Information Systems Security Division,
responsible for all European theater policy and policy enforcement concerning
information warfare and communications and computer security. During this tour,
he led INFOSEC actions in support of Operation Provide Comfort, Joint
Endeavor, and Combined Endeavor (Partnership for Peace).;

Curtis Dukes: is the Deputy Chief, Architectures and Applications Division of the
Systems and Network Attack Center, National Security Agency. He is responsible
for the technical direction of the Intrusion Detection and Enterprise Management
System's vulnerability research within the Center. In this capacity, he leads the
Joint Vulnerability Assessment Process of the Secret and Below Interoperability
(SABI) Initiative. He previously served in an Intelligence Community assignment
in the Directorate of Operations, Central Intelligence Agency.;

Chuck Schreiner: the Chief of the Solution Security Analysis Division, National
Security Agency, which provides customers with vulnerability analysis and test
services to support their local risk decisions. He has held previous positions as
NSA Representative to the Pentagon, Technical Director for Fielded Systems,
and Deputy Chief of the RF Communications Division. ;

Willard Unkenholz: a Technical Director for the System Security Guidance and
Evaluation Division, National Security Agency. His current duties involve
developing and leading the DoD risk analysis capabilities applied to the Secret
and Below Interoperability Initiative.;

Corky Parks: a risk analyst in the System Security Guidance and Evaluation
Division, National Security Agency. His areas of interest include the theory and
practice of information risk management, and decision theory.;

Dallas Pearson: the Technical Director for Security and Evaluations in National
Security Agency’s Office of Information Assurance Solutions Deployment and
Maintenance. All of Dallas’ 29 years at NSA have been in technical roles in
COMSEC and INFOSEC. He received a Bachelor of Science in Physics from the
University of Southern Mississippi in 1970 and a Master of Science in Systems
Engineering from Johns Hopkins University in 1995. He is a co-author of NSA’s
Information Systems Security Engineering (ISSE) Handbook and teaches an in-
house introduction to ISSE course.;

Warner Brake: the Deputy Chief, Information Assurance Implementation Branch

of the Information Assurance Program Management Office, Defense Information
Systems Agency. He is the senior certification test director and advisor for
certification team members, who perform in-depth technical certification testing
and compliance validation of DISA pillar, Joint, and NATO programs. He is also
responsible for the periodic review and update of DOD Instruction 5200.40, DOD
Information Technology Security Connection Approval Process (DITSCAP), and
the operation of the Information Assurance Support Environment information
desk and website.

Secret and Below Interoperability (aka) SABI, is an Information Assurance

initiative mandated by the Assistant Secretary of Defense for Command, Control,
Communications, and Intelligence (ASD/C3I) and sponsored by the Joint Chiefs
of Staff, Command, Control, Communications, and Computer Systems (JS/J6).
SABI improves the security posture of all secret and below DoD systems by
using a community-based risk acceptance approach. SABI utilizes proven
system security engineering to address the risks to the community, and employs
mission-oriented risk management in making sound community decisions.

The goal of SABI is to ensure secure secret and below interoperability solutions
for the Warfighter within community-acceptable risks. It is a network-centric
process with procedures to review interconnections and leverage proven solution
reuse. It is founded on information system security engineering (ISSE) principles
whereby information systems security (INFOSEC) is integrated as a part of
systems engineering and systems acquisition processes, strong customer
participation in support of mission needs, and the optimal use of INFOSEC
disciplines to provide security solutions. Documentation implements the DoD
Instruction 5200.40, Defense Information Technology Security Certification and
Accreditation Process (DITSCAP).

The SABI process teams the local site customer with appropriate engineering,
risk, vulnerability, training and programmatic community risk-focused support
necessary to develop the right solution for the customer's SABI requirement.
SABI maintains this community team throughout the system security engineering
process. This strengthens the community risk acceptability of a specific site
solution through continued dialog and participation of all relevant stakeholders.

During the discussion about the current status of the SABI program, the panel
will focus on the progress and impact of the National Information Assurance
Certification and Accreditation Process (NIACAP), NSTISSI 1000.
 Topic Workgroup Meeting Examples

Depicted below, are just some examples only, of how an NISSC topic workgroup
itinerary meeting outline might appear which, could also begin with a background
of information, as follows:

National Computer Security Center (aka) NCSC

In 1978, the Assistant Secretary of Defense for Command, Control,

Communications, and Intelligence (aka) C3I, established the Department of
Defense, Computer Security Initiative (aka) CSI, to ensure the widespread
availability of trusted Automatic Data Processing (aka) ADP systems for use
within the DoD.

In January 1981, the National Computer Security Center (aka) NCSC, was
established and assumed responsibility for the activities of the Initiative. The
NCSC encourages the development of trusted computing system products,
develops computer security standards and guidelines for interested users, and
sponsors basic research in this robust field.

In order to encourage the widespread availability of trusted systems, the NCSC

has developed an industry-government relationship, called the Trusted Product
Evaluation Program (aka) TPEP. This effort focuses on the technical protection
capabilities of commercially produced and supported systems, based on the
Department of Defense, Trusted Computer Security Evaluation Criteria (aka)
TCSEC.

Three (3) important interpretations are used to assist in this program:

1. Trusted Network Interpretation (aka) TNI;

2. Computer Security Subsystem Interpretation (aka) CSSI; and,

3. Trusted Database Interpretation (aka) TDI.

The NCSC also promotes information security education and cooperates with the
National Institute of Standards and Technology (aka) NIST, to provide computer
security assistance to other government departments and agencies.

In support of the above, the NCSC operates a B2 Level Of Trust computer

system, i.e. DOCKMASTER, which provides on-line service to the information
security [intelligence] community.

NIST built a new Information Technology Laboratory (aka) ITL, in response to the
growing need for measurement and testing technology to support the
development of computing and communications systems that are usable,
scalable, interoperable, and secure. This need has come into sharper focus in
recent years with the national effort to develop an information infrastructure and
to support U. S. Industry in a global information marketplace.

The lTL seeks to enable the usability, scalability, interoperability, and security of
information technology through a focus on three (3) areas:

1. Development of tests for human-machine interfaces, software diagnostics and

performance, mathematical software, security, and conformance to standards.;

2. Collaborating, consulting and operational services for other NIST laboratories

in computational sciences and information services; and,

3. Federal government activities, especially security.

Since 1972, NIST has played a vital role in protecting the security and integrity of
information in computer systems in the public and private sectors. The Computer
Security Act of 1987 reaffirmed NIST's leadership role in the federal government
for the protection of unclassified information. NIST assists industry and
government by promoting and supporting better security planning, technology,
awareness, and training. In addition, NIST fosters the development of national
and international standards for security technology and commercial off-the-shelf
(aka) COTS security products.

Finally, NIST has an active, laboratory-based research program in computer and

network security with special technical emphasis in cryptography, authentication,
public-key infrastructure, internetworking, and security criteria and assurance.
NIST also has a special program in support of government key escrow activities.

On October 24, 2001 a conference was held at the Hyatt Regency and the
itinerary was scheduled as follows:

Track A Criteria & Assurance Ballroom 2

PANEL: Trust Technology Assessment Program (aka) TTAP (643)

Chairman: T. Anderson, National Security Agency

Panelists: P. Toth, N.I.S.T. (644); TTAP Working Group Members

This panel will focus on the progress of the TTAP initiative including the lessons
learned from the prototype effort to validate the process, procedures, and
documentation to support the program in a commercial environment.

Track B Electronic Commerce Ballroom 3

PANEL: Using Security to Meet Business Needs - An Integrated View From the
United Kingdom (677)

Chairman: A. McIntosh, PC Security, Ltd.

Panelists: D. Brewer, Gamma Secure Systems, Ltd. (679); N. Hickson,

Department of Trade & Industry (682); D. Anderton, Barclays Bank PLC (684); J.
Hodsdon, CESG (685); M. Stubbings, Government Communications
Headquarters (aka) G.C.H.Q. [ British agency equivalent to the U.S. National
Security Agency (NSA) ], UK (686)

This panel discusses the use of risk management techniques in the identification,
accreditation, and maintenance of appropriate security profiles for single
organization systems dispersed across a wide range of sites.

Track C In Depth Room: ___ - ___

Best of the New Security Paradigms Workshop

Chairman: T. Haigh, Secure Computing Corporation (693)

Panelists: R. Blakely, International Business Machines (694); S. Greenwald,

Naval Research Laboratory (698); S. Janson, Swedish Institute of Computer
Science, Sweden (701); W. Wulf, University of Virginia (704)

This year's workshop focuses on the need to identify new approaches for proving
security in very heterogenous, highly internetworked environments.

Track D--Internet--Ballroom 1

OVERVIEW

Chair: C. Bythewood, NCSC

Introduction to Infowarfare Terminology (718): F. Bondoc, Klein & Stump

This overview is aimed at the newcomer to Information Warfare (IW), and

introduces the terminology, threats and countermeasures of Information Warfare
(aka) IW.
Track E Legal Perspectives Ballroom 4

Legal Issues for the User

Chairman: Special Agent John Lewis, United States Secret Service

Intellectual Property Rights and Computer Software (296): D. Bowman,

University of Maryland

Case Study of Industrial Espionage Through Social Engineering (306): I. Winkler,

National Computer Security Association

Legal Aspects of Ice-Pick Testing (313): B. Gabrielson, Department of the Navy

Track F Management & Administration Room: ___ - ___

PANEL: Ethical and Responsible Behavior for Children to Senior Citizens in the
Information Age - Community Responsibilities

Chairman: J. Lisi, National Security Agency

Panelists: R. Koenig, ISC2; G. Warshawsky, International Community

Interconnected Computing eXchange

Track G Research & Development Room: ___ - ___

PANEL: Database Systems Today - Safe Information at My Fingertips? (842)

Chairman: J. Campbell, National Security Agency

Panelists: T. Ehrsam, Oracle; R. O'Brien, SCC; T. Parenty, Sybase; J.

Worthington, Informix Software Company; Lt. Colonel Pointdexter, D.I.S.A.; S.
Sahni, 3S Group Incorporated
This panel will address distributed and web database system security issues and
solutions.

Track H--Solutions Room--343-344

Future Activities

Chairman: J. Tippett, National Security Agency

Computer Virus Response Using Autonomous Agent Technology (471): C.

Trently, MITRETEK Systems

Security Across the Curriculum - Using Computer Security to Teach Computer

Science Principles (483): Major General White, USAF Academy

U.S. Government Wide Incident Response Capability (489): M. Swanson, NIST

Track I--Tutorials Room--327-328

Introduction to Information System Security: L. Smith and D. Strickland, National

Cryptologic School

This tutorial will use an interactive computer-based training course to present the
basics of information system security (INFOSEC). The course is composed of
five instructional units: information systems overview, threats, INFOSEC
solutions, INFOSEC techniques, and risks management.

A CD-ROM with this and other courses will be provided to attendees.

Tuesday, October 22nd------------4:00 P.M. -- 6:00 P.M.

Track A--Criteria & Assurance--Ballroom 2

Gaining Assurance though Evaluations

Chairman: H. Holm, National Security Agency

E4 ITSEC Evaluation of PR/SM on ES/9000 Processors (1): R. Nasser,

International Business Machines

A High-Performance Hardware-Based High Assurance Trusted Windowing

System (12): J. Epstein, Cordant, Inc.

WWW Technology in the Formal Evaluation of Trusted Systems (22): E.

McCauley, Silicon Graphics, Inc.

Track B--Electronic Commerce--Ballroom 3

Electronic Commerce: International Security

Chairman: V. Gibson, Computer Science Corporation

EDI Moves from the VAN to the Internet (98): B. Bradford, University of Maryland

An International Standard for the Labeling of Digital Products (109): V. Hampel,

Hampel Consulting

The Business-LED Accreditor - OR...How to Take Risks and Survive (123): M.

Stubbings, Government Communications Headquarters (aka) G.C.H.Q., UK

Integration of Digital Signatures into the European Business Register (131): H.

Kurth, Industricanlagen Betriebsghesellschaft mbH (IABG), Germany
Track C--In Depth Room--349-350

PANEL

Best of the New Security Paradigms Workshop (continued from 2:00) (693)

Chairman: T. Haigh, Secure Computing Corporation

Panelists: R. Blakely, International Business Machines (694); S. Greenwald,

Naval Research Laboratory (698); S. Janson, Swedish Institute of Computer
Science, Sweden (701); W. Wulf, University of Virginia (704)

This year's workshop focuses on the need to identify new approaches for proving
security in very heterogenous, highly internetworked environments.

Track D--Internet-- Ballroom 1

PANEL

Information Warfare: Real Threats, Definition Changes, and Science Fiction

(725)*

Chairman: W. Madsen, Computer Sciences Corporation

Panelists: M. Hill, Office of the Assistant Secretary of Defense C3/Information

Warfare; F. Tompkins, Science Applications International Corporation; S. Shane,
The Baltimore Sun; J. Stanton, Journal of Technology Transfer

This panel will discuss the Information Warfare scenario, which has received a
great deal of attention from national security planners, legislators, the military,
intelligence agencies, the media, and industry.
Track E--Legal Perspectives--Ballroom 4

PANEL: Electronic Data: Privacy, Security, Confidentiality Issues

Chairman: K. Blair, Esq., Duvall, Harrington, Hale and Hassan (740)

Panelists: The Honorable L. Alden, Judge, Fairfax County Circuit Court (741); S.
Mandell, Esq., The Mandell Law Firm (749); R. Palenski, Esq., Gordon and
Glickson, P.C. (749); S. Ray, Esq., Kruchko & Fries (800)

This panel will discuss how the legal system is dealing with crimes involving the
use of computers. Because computers are relatively new in the world of
established criminal law, many of the illegal events associated with the use of
computers did not come with definitions established by legislation or case law.

Track F--Management & Administration--Room 341-342

New Workplace Paradigms for Security

Chairman: C. Hash, National Security Agency

Security Through Process Management (323): J. Bayuk, Price Waterhouse

Malicious Data and System Security (334): O. Sibert, Oxford Systems, Inc.

Security Issues for Telecommuting (342): L. Carnahan, NIST

Track G--Research & Development Room--345-346

PANEL
Webware: Nightmare or Dream Come True? (844)

Chairman: P. Neumann, SRI International

Panelists: S. Bellovin, AT&T Laboratories (845); E. Felten, Princeton University

(846); P. Karger, International Business Machines (847); J. Roskind, Netscape
(849)

This panel will discuss the risks involved in the open-ended security problem
introduced by world-wide web browsers and programming languages sauch as
Java and JavaScript, as well as other languages with similar problems - such as
ActiveX, Microsoft WORD macros, and PostScript. Specific attention will be
spent on how to intelligently succeed.

Track H Solutions Room: ___ - ___

PANEL: Information Systems Security Research Joint Technology Office

Chairman: R. Schaeffer, National Security Agency

Panelists: T. Lunt and H. Frank, Defense Advanced Research Projects Agency

(aka) DARPA; R. Meushaw, National Security Agency

This panel will discuss its successes since the first (1st) year of this joint
partnership to develop and integrate security technology. The partnership will
maximize security solutions for building the DII & NII.

Track I Tutorials Room: 327-328

Trusted Systems Concepts: C. Abzug, Institute for Computer and Information

Sciences
This tutorial focuses on the fundamental concepts and terminology of trust
technology. It includes descriptions of the Trusted Computer System Evaluation
Criteria (TCSEC) classes, how the classes differ, and how to determine the
appropriate class for your operation environment.

Wednesday, October -----------23rd 8:30 A.M. -- 10:00 A.M.

Track A--Criteria & Assurance--Ballroom 2

PANEL: Alternative Assurance: There's Gotta Be a Better Way! (644)*

Chairman: D. Landoll, ARCA Systems, Inc.

Panelists: J. Adams, NSA; Speaker TBD, WITAT System Analysis & Operational
Assurance Subgroup Chair; M. Abrams, The MITRE Organization, WITAT Impact
Mitigation Subgroup Chair; Speaker TBD, WITAT Determining Assurance Mix
Subgroup Chair

A Workshop report about the evolving development of practical solutions for

business and industry in need of confidence in their information systems.

Track B--Electronic Commerce--Ballroom 3

PANEL

Information Security - Transforming the Global Marketplace: D. Gary, Booz-Allen

& Hamilton

Panelists: J. M. Anderson, Morgan Stanley; K. Panker, American Bankers

Association; P. Freund, CertCo
Technology resources are means to achieve organizational goals --- not solutions
in their own right. New dimensions will be discussed of commercial interchange
in a highly networked marketplace.

Track C--In Depth Room--349-350

PANEL

Public Key Infrastructure: From Theory to Implementation

Public Key Infrastructure Technology (707)

Chairman: D. Dodson, NIST

Panelists: R. Housley, Spyrus; C. Martin, Government Accounting Office; W.

Polk, NIST; S. Chokani, Cygnacom Solutions, Inc.; V. Hampel, Hampel
Consulting; W. Ford, Independent Consultant

This panel will familiarize the audience with PKI standards, interoperability
solutions, and implementation issues. This session will concentrate on technical
specifications and standards; the session that follows will review lessons learned
during implementation of existing PKIs.

Track D--Internet--Ballroom 1

PANEL

Security in World Wide Web Browsers - More than Visa cards? (737)

Chairman: R. Dobry, N.S.A.

Panelists: C. Kolcun, Microsoft; B. Atkins, NSA; K. Rowe, NCSA; Speaker TBD,
Netscape

This panel will discuss the security problems and solutions required to handle
electronic commerce via the Internet.

Track E--Legal Perspectives--Ballroom 4

PANEL

Computer Crime on the Internet - Sources and Methods (817)

Chairman: C. Axsmith, The Orkand Corporation

Panelists: Special Agent M. Pollitt, Federal Bureau of Investigation (F.B.I.); P.

Reitinger, Esq., Department of Justice; B. Fraser, CERT, Carnegie Mellon
University

This panel will discuss some case studies of system break-ins, what information
system administrators should focus on saving for the evidentiary trail, and some
resources available to the system administrator should a break-in be attempted.

Track F--Management & Administration Room--341-342

PANEL

Current Challenges in Computer Security Program Management (828)

Chairman: M. Wilson, NIST

Panelists: L. McNulty, McNulty and Associates; P. Connelly, White House
Communications Agency; A. Miller, Fleet and Industrial Supply Center; B.
Gutmann, NIST

This panel will discuss managing a computer security program in light of budget
constraints, reorganizing and downsizing, and the continuous decentralization of
ever increasing complex computing and communications environments.

Track G--Research & Development--Room 345-346

PANEL

Availability Policies: The Forgotten INFOSEC Pillar

Chairman: V. Gligor, University of Maryland

Panelists: H. Hosmer, Data Security, Inc.; J. Millen, The MITRE Corporation; R.

Nelson, Information System Security; M. Reiter, AT&T

This panel will discuss various kinds of availability policies, highlighting impact
assumptions and potential conflicts with other kinds of security policies.

Track H--Solutions--Room343-344

PANEL

Security Management Infrastructure Deployment and Operations (871)

Chairman: A. Arsenault, N.S.A.

Panelists: D. Heckman, NSA; S. Capps, NSA; S. Hunt, NSA

This panel will focus on lessons learned from the deployment of MISSI security
management infrastructure at NSA and GSA.

Track I--Tutorials--Room 327-328

OS Security: M. Weidner, ARCA Systems

This tutorial focuses on security issues for commercial operating systems. Topics
include common vulnerabilities, security services, and potential safeguards.
Specific capabilities of several commercially available operating systems will be
discussed.
Wednesday, October 23rd------------10:30 A.M.-- 12:00 Noon

Track A---Criteria & Assurance--Ballroom 2

PANEL

Current Perspective on Strategies for the (646) Certification & Accreditation

Processes

Chairman: B. Stauffer, CORBETT Technologies, Inc. (653)

Panelists: P. Wisniewski, NSA (647); C. Stark, Computer Science Corporation

(648); R. Snouffer. NIST (652); J. Eller, DISA, CISS (ISBEC) (646)

Paper

The Certification of the Interim Key Escrow System (26): R. Snouffer, NIST

Track B--Electronic Commerce--Ballroom 3

PANEL

Security APIs: CAPIs and Beyond (687)

Chairman: A. Reiss, N.S.A.

Panelists: J. Centafont, NSA; Speaker TBD, Microsoft; L. Dobranski,

Communications Security Establishment (aka) C.S.E., Canada; D. Balenson,
Trusted Information Systems, Inc.

The panelists will discuss Cryptographic Application Program Interfaces,

FORTEZZA, Public Key Infrastructures, the International Cryptography
Experiment, and the Microsoft Internet Security Framework.

Paper

NIST Proposal for a Generic Authentication Module Interface: J. Dray, NIST

Track C-In Depth--Room 349-350

PANEL

Public Key Infrastructure: From Theory to Implementation (continued from 8:30)

(707)

Public Key Infrastructure Implementations

Chairman: W. Polk, NIST

Panelists: P. Edfors, Government Information Technology Services (GITS) Board;

D. Heckman, NSA; D. Dodson, NIST; J. Galvin, CommerceNet; W. Redden,
Communications Security Establishment (aka) C.S.E.; R. Kemp, General
Services Administration SI-PMO

Track D--Internet--Ballroom 1

OVERVIEW

Chairman: M. Schaffer, ARCA Systems

Secure Business on the Internet: Looking Ahead with Electronic Data

Interchange: D. Federman, Premenos

The speaker will discuss the history of Electronic Data Interchange and how
today's marketplace on the Internet needs cost effective and secure business
solutions to function over the World Wide Web.

Track E--Legal Perspectives--Ballroom 4

PANEL

Legal Liability for Information System Security Compliance Failures - New

Recipes for Electronic Sachertorte Algorithms (818)

Chairman: F. Smith, Esq., Private Practice, Santa Fe, New Mexico

Panelists: J. Montjoy, BBN Corporation; E. Tenner, Princeton University; D.

Loundy, Esq., Private Practice, Highland Park, Illinois

This panel will discuss the liabilities associated with the increased expansion of
increasingly complex computer networks and associated services.
Track F--Management & Administration--Room 341-342

PANEL

Achieving Vulnerability Data Sharing (830)*

Chairman: L. Carnahan, NIST

Panelists: M. Bishop, University of California, Davis, CA.; J. Ellis, CERT,

Carnegie Mellon University; I. Krsul, COAST Laboratory, Purdue University

This panel will discuss security issues to be addressed when building a data
repository that will be shared by different communities of interest.

Track G--Research & Development--Room 345-346

PANEL

Secure Systems and Access Control (851)

Chairman: T. Lunt, Defense Advanced Research Projects Agency (DARPA)

Panelists: D. Sterne, Trusted Information Systems, Inc. (852); R. Thomas, ORA

(854); M. Zurko, OSF (855); J. Lepreau, University of Utah (857); J. Rushby, SRI
International

The panelists will discuss their respective security programs.

Track H--Solutions--Room 343-344

Future of Trust in Commercial Operating Systems (872)

Chairman: T. Inskeep, NSA

Panelists: K. Moss, Microsoft; J. Alexander, Sun Microsystems; J. Spencer, Data

General; M. Branstad, Trusted Information Systems, Inc.; G. Liddle, Hewlett
Packard

This panel will discuss where assurance and functionality in commercial systems
are going.

Track I--Tutorials--Room 327-328

Network Security: J. Wool, ARCA Systems

This tutorial focuses on basic issues in network security and gives an overview of
the implementing process. Topics include network security concerns and
services, vendor qualification issues, system composition and interconnection,
and cascading.

Wednesday, October 23rd---------12:45 p.m. -- 1:45 p.m.

Midday Seminar--Room 327-328

War Stories

Speaker: James P. Anderson, J. P. Anderson & Co.

Wednesday, October 23rd-----------2:00 P.M. -- 3:30 P.M.

Track A--Criteria & Assurance--Ballroom 2

PANEL

Firewall Testing and Rating (655)

Chairman: J. Wack, NIST

Panelists: I. Winkler, National Computer Security Association; K. Dolan, NSA; J.

McGowen, National Computer Security Association; C. Costack, Computer
Science Corporation

This panel will discuss whether firewalls can be effectively rated, what the rating
criteria is, characteristics of firewalls that don't lend themselves to rating, and
how well rating and testing actually work.

Track B--Electronic Commerce--Ballroom 3

PANEL

Are Cryptosystems Really Unbreakable? (691)

Chairman: D. Denning, Georgetown University

Panelists: S. Bellovin, AT&T Research; P. Kocher, Independent Cryptography

Consultant; A. Lenstra, Citibank (692); E. Thompsom, AccessData Corporation

The panelists will explore the strengths of existing cryptosystems in terms of

potential weaknesses in algorithms, protocols, implementation, and application
environments.

Track C--In Depth--Room 349-350

Chairman: T. Zmudzinski, Defense Information Systems Agency

Establishing an Enterprise Virus Response Program (709): C. Trently,

MITRETEK Systems; Laboratory Assistants: E. Hawthorn, MITRETEK Systems;
D. Black, MITRETEK Systems

The speakers will provide practical information that can be used to understand
the virus threat; institute low cost preventative mechanisms; develop and
implement enterprise response mechanisms, including when to contact the
experts; and monitor the effectiveness of the tools and program within the
enterprise. Thirty attendees will be able to get hands-on practice in the lab in
Room 330 during Part 2 of the lecture.

This In-depth tutorial will be repeated at 8:30 a.m. on Thursday.

Track D--Internet--Ballroom 1

Security Issues in a Networked Environment

Chairman: D. Branstad, Trusted Information Systems, Inc.

The Advanced Intelligent Network -- A Security Opportunity (221): T. Casey, Jr.,

GTE Laboratories, Inc.

Security Issues in Emerging High Speed Networks (233): V. Varadharajan,

University of Western Sydney, Australia

A Case Study of Evaluating Security in an Open Systems Environment (250): D.

Tobat, TASC

Track E--Legal Perspectives--Ballroom 4

PANEL

The Next Generation of Cyber Criminals

Chairman: M. Gembicki, WARROOM RESEARCH LLC.

Panelists: J. Christie, AFOSI; K. Geide, Federal Bureau of Investigation ( FBI );

D. Waller, Time Magazine

The panelists will address cybercrime issues and how it affects legal competitive
intelligence, the National Information Infrastructure, information warriors, and the
commercial business environment. Examples of traditional organized crime
elements to individual "Cyber-Terrorists" as well as proposed changes in
Government strategies will be presented.

Track F--Management & Administration--Room 341-342

PANEL

Incident Handling Policy, Procedures, and Tools (831)

Chairman: M. Swanson, NIST

Panelists: K. Cooper, BBN Planet; T. Longstaff, Computer Emergency Response

Team; P. Richards, Westinghouse Savannah River Company; K. van Wyk,
Science Applications International Corporation ( SAIC )

This panel will discuss the incident handling policy and procedures that have
been implemented within their organizations. They will also discuss a new
methodology that system administrators can use for characterizing network
security tools.

Track G--Research & Development--Room 345-346

Network Attacks, Protections, and Vulnerabilities

Chairman: W. Murray, Deloitte & Touche

An Isolated Network for Research (349): M. Bishop, University of California,

Davis, CA.

GrIDS-A Graph-Based Intrusion Detection System for Large Networks (361): S.

Staniford-Chen, University of California, Davis, CA.

Attack Class - Address Spoofing (371): T. Heberlein, University of California,

Davis, CA.

Track H--Solutions--Room 343-344

PANEL

Vendors Experience with Security Evaluations (873)

Chairman: J. DeMello, Oracle Corporation

Panelists: J. Caywood, Digital Equipment Corporation (DEC); D. Harris, Oracle

Corporation (874); K. Moss, Microsoft Corporation (876); I. Prickett, Sun
Microsystems (877)

This panel will discuss their experiences in achieving successful evaluations,

identifying what has worked well for them, and not-so-well, in the process.
Track I--Tutorials--Room 327-328

Database Security: W. Wilson, Arca Systems

This tutorial focuses on database security issues from the standpoint of using
database management systems to meet the organization's security requirements.
Topics include data security requirements, vulnerabilities, database design
considerations, and implementation issues.
Wednesday, October 23rd----------4:00 P.M. -- 6:00 P.M.

Track A Criteria & Assurance--Ballroom 2

PANEL

The Trusted Product Evaluation Program: Direction for the Future (656)

Chairman: J. Pedersen, N.S.A.

Representatives from various initiatives within the Trusted Product Evaluation

Program will discuss the overall strategy for the future of TPEP, including specific
steps for moving the program to a new evaluation criteria, mechanisms for
commercial advice to vendors, and new types of products which will be
evaluated.

Track B--Electronic Commerce--Ballroom 3

Information Security in the Business World

Chairman: N. Pantiuk, IIT Research Institute

Industrial Espionage Today and Information Wars of Tomorrow (139): P. Joyal,
INTEGER Inc.

B is for Business - Mandatory Security Criteria & the OECD Guidelines for
Information Systems Security (152): W. Caelli, Queensland University of
Technology, Australia

Marketing & Implementing Computer Security (163): M. Wilson, NIST

Secure Internet Commerce - Design and Implementation of the Security

Architecture of Security First Network Bank, FSB (173)
N. Hammond, NJH Security Consulting, Inc.

Track C--In Depth--Room 349-350

Concerns in the Cryptographic Arenas

Chairman: P. Woodie, NSA

Automatic Formal Analyses of Cryptographic Protocols (181): S. Brackin, ARCA

Systems, Inc.

Surmounting the Effects of Lossy Compression on Steganography (194): C.

Irvine, Naval Postgraduate School

Key Escrowing Systems and Limited One Way Functions (202): W. T. Jennings,
E-Systems

The Keys to a Reliable Escrow Agreement (215): R. Sheffield, Fort Knox Escrow
Services, Inc.
Track D--Internet--Ballroom 1

WWW: The Case for Having a Security Policy and Measuring It

Chairman: R. Wood, National Cryptologic School

Internet Firewalls Policy Development and Technology Choices (259): L. D'Alotto,

GTE Laboratories

A Case for Avoiding Security-Enhanced HTTP Tools to Improve Security for Web
Based Applications (267): B. Wood, Sandia National Laboratories

Applying the Eight Stage Risk Assessment Methodology to Firewalls (276): D.

Drake, Science Applications International Corporation

Lessons Learned: An Examination of Cryptographic Security Services in a

Federal Automated Information System (288): J. Foti, NIST

Track E--Legal Perspectives--Ballroom 4

PANEL

Legal Aspects of the Internet - Rights and Obligations of Users and Vendors

Chairman: C. Castagnoli, Esq., Haystack Labs

Panelists: C. Merrill, Esq., Carter & English; M. Lemley, Esq., Professor of Law,
University of Texas; M. Godwin, Esq., Electronic Frontier Foundation

The panelists will discuss digital signatures, on-line contracting and the liability
issues for the operator and the user.
Track F--Management & Administration--Room 341-342

PANEL

Interdisciplinary Perspectives on INFOSEC: Mandatory Reporting (833)

Chairman: M. Kabay, National Computer Security Association

Panelists: B. Butterworth, Federal Aviation Administration; B. Smith Jacobs,

Securities and Exchange Commision (SEC); R. Whitmore, Occupational Health
and Safety Administration (OSHA); S. Wetterhall, Centers for Disease Control
and Prevention
(C.D.C.&P.)

This panel will discuss their experiences from other disciplines with mandatory
reporting of security incidents and accidents, with an eye to avoiding known
pitfalls and benefiting from their years of experience.

Track G--Research & Development--Room 345-346

PANEL

Facing the Challenge: Secure Network Technology for the 21st Century (867)

Chairman: R. Schaeffer, NSA

Panelists: R. Meushaw, NSA; C. McBride, NSA; D. Muzzy, NSA; B. Burnham,

NSA

This panel discusses current initiatives and collaborations within the research
communities in government, industry, and academia. Additionally, room 347-348
is set up to demonstrate examples of core technologies to include Token
Technology, Voice Verification, Real-time Encrypted Voice, Firewalls, Secure
Wireless Communications, and others.

Track H--Solutions--Room 343-344

Security with COTS (Commercial-Off-The-Shelf) Products

Chairman: S. Kougoures, N.S.A.

MLS DBMS Interoperability Study (495): R. Burns, ESC/ENS

MISSI Compliance for Commercial-Off-The-Shelf Firewalls (505): M. Hale, NSA

Designing & Operating a Multilevel Security Network Using Standard Commercial

Products (515): M. McGregor, Air Force C4 Technology Validation Office

Track I--Tutorials--Room 327-328

Information Systems Security Officer's Challenges: C. Breissinger, Department of

Defense Security Institute

This tutorial focuses on the continued protection and accreditation of operational

information systems. Topics include: virus prevention and eradication; access
control evaluation and configuration; media clearing and purging; intrusion
detection and handling; and dealing with risk.
Thursday, October 24th-----------------8:30 A.M. -- 10:00 A.M.

Track A--Criteria & Assurance--Ballroom 2

PANEL

Common Criteria Project Implementation Status (657)

Chairman: L. Ambuel, BDM International

Panelists: M. Donaldson, Communications-Electronics Security Group, UK; R.

Harland, Communications Security Establishment (aka) C.S.E., Canada; K.
Keus, BSI/GISA, Germany; F. Mulder, Netherlands National Communications
Security Agency; J. Smith, Gamma Secure Systems, UK

The panelists will discuss the Common Criteria trial version's structure and
content, the status and results to date of the trial-use and implementation
activities, the planned future of the project, and the expected impact of all this
work on US and international IT security communities.

Track B--Electronic Commerce--Ballroom 3

OVERVIEW

Security Concerns in the Private Sector - Banking: S. Ross, Deloitte & Touche

Track C--In Depth--Room 349-350

OVERVIEW

Chairman: S. Lipner, Trusted Information Systems, Inc.

Establishing an Enterprise Virus Response Program (709): C. Trently,

MITRETEK Systems; Laboratory Assistants: E. Hawthorn; MITRETEK Systems;
D. Black, MITRETEK Systems
The speakers will provide practical information that can be used to understand
the virus threat; institute low cost preventative mechanisms; develop and
implement enterprise response mechanisms, including when to contact the
experts; and monitor the effectiveness of the tools and program within the
enterprise. Thirty attendees will be able to get hands-on practice in the lab in
Room 330 during part 2 of the lecture.

This In Depth tutorial is a live encore presentation from Wednesday at 2:00.

Track D--Internet--Ballroom 1

PANEL

Secure Use of the World Wide Web: Moving From Sandbox to Infrastructure

Chairman: R. Bagwill, NIST

Panelists: J. Pescatore, IDC Government; S. Smaha

This panel will explore the current state of practice in WWW security practices
and standards, and provide predictions for the evolution of these security
services in the commercial environment.

Track E--Legal Perspectives--Ballroom 4

PANEL

V-Chip: Policies and Technology (822)

Chairman: H. Hosmer, Data Security, Inc.

Panelists: D. Moulton, Esq., Chief of Staff, Office of Congressman Markey, HR;
D. Brody, MD, American Academy of Child and Adolescent Psychiatry; S.
Goering, Esq., American Civil Liberties Union; W. Diffie, Sun Microsystems

This panel will address a variety of legal and technical issues concerning the V-
chip, a hardware device inserted into new televisions which can identify labels
attached to movies, etc.

Track F--Management & Administration--Room 341-342

PANEL

Industrial Espionage Today and Information Wars of Tomorrow

Chairman: P. Joyal, Interger, Inc.

Panelists: Ret. Major General O. Kalugin, Russia; S. Baker, Esq.; M. Lajman,

Author on French Intelligence; E. O'Malley, retired F.B.I..

This panel will discuss the perspectives of Industrial Espionage as the focus of a
multi-national problem which affects everyone.

Track G--Research & Development--Room 345-346

Implementations of the Security Policy

Chairman: D. Gambel, General Research Corporation

Generic Model Interpretations: POSIX.1 and SQL (378): D. Elliott Bell,

MITRETEK Systems
The Privilege Control Table Toolkit: An Implementation of the System Build
Approach (389): T. Woodall, Hughes Aircraft Company

Use of the Zachman Architecture for Security Engineering (398): R. Henning,

Harris Corporation

Track H--Solutions--Room 343-344

New Test Methodologies

Chairman: R. Lau, N.S.A.

Real World Anti-Virus Product Reviews and Evaluation - The Current State of
Affairs (526): S. Gordon, Command Systems, Inc.

Security Proof of Concept Keystone (SPOCK) (539): J. McGehee, COACT, Inc.

Use of a Taxonomy of Security Faults (551): I. Krsul, Coast Laboratory, Purdue

University

Track I--Tutorials--Room 327-328

Information Systems Security Engineering: P. Boudra, NSA; D. Pearson, NSA

Thursday, October 24th-----------10:30 A.M. -- 12:00 Noon

Track A--Criteria & Assurance--Ballroom 2

Views of Assurances
Chairman: D. Kinch, N.S.A.

Configuration Management in Security related Software Engineering Processes

(34): K. Keus, Bundesamt fur Sicherheit in der Informationstechnik, Germany

The Department of Defense Information Technology Security Certification and

Accreditation Process (DITSCAP)(46): B. Stauffer, CORBETT Technologies, Inc.

Trusted Process Classes (54): W. Steffan, Tracor Applied Science, Inc.

Track B--Electronic Commerce--Ballroom 3

OVERVIEW

Security Concerns in the Private Sector: Brokerage: D. Gary, Booz-Allen &

Hamilton

Track C--In Depth--Room 349-350

PANEL

Information Security Policy: There has to be a Better Way

Chairman: J. Pescatore, Trusted Information Systems, Inc.

Panelists: K. Kasprzak, Maryland Bancorp; S. Smaha, Haystack Labs; R.

Stratton, Wheelgroup Inc.

The panelists will discuss new ideas for transforming organizational needs into
security controls and policies.
Track D--Internet--Ballroom 1

PANEL

Attack/Defense (738)

Chairman: J. David, The Fortress

Panelists: S. Bellovin, AT&T; W. Cheswick, AT&T; P. Peterson, Lockheed-Martin;

M. Ranum, V-One

The panel will discuss how the role of the Internet security practitioner has
changed. Keep-ing the bad guys out is no longer the prime goal of security,
rather the prompt and accurate identification of intrusions (or, preferably, intrusion
attempts) and minimizing the damages. This session examines these "popular"
attacks and presents ways to effectively defend your site against them.

Track E--Legal Perspectives--Ballroom 4

PANEL

Protecting Medical Records and Health Information (824)

Chairman: J. Winston, Trusted Information Systems, Inc.

Panelists: G. Belles, VA Medical Information Security Service; B. Braithwaite, US

Department of Health and Human Services*; P. Bruening, Information Policy
Consultant; P. Taylor, US General Accounting Office

This panel will examine the technical, policy, and legal issues involved in
establishing and implementing appropriate protections for patient medical
records and other types of health information.

Track F --Management & Administration --Room 341-342

PANEL

International Perspectives on Cryptography Policy (835)

Chairman: D. Denning, Georgetown University

Panelists: P. Ford, Attorney General's Office, Australia; D. Herson, Commission

of the European Communities, Belgium; N. Hickson, Department of Trade and
Industry, UK

Panelists from outside the United States will discuss their views on cryptography
policy and national and international proposals and initiatives.

Track G--Research & Development--Room 345-346

Mechanisms in Understanding Security

Chairman: H. Weiss, SPARTA, Inc.

Developing Secure Objects (410): D. Frincke, University of Idaho

Deriving Security Requirements for Applications on Trusted Systems (420): R.

Spencer, Secure Computing Corporation

Security Implications of the Choice of Distributed Database Management

Systems Model: Relational vs. Object-Oriented: S. Coy, University of Maryland
Track H--Solutions--Room 343-344

Defenses in Networks

Chairman: M. Woodcock, National Cryptologic School

Protecting Collaboration (561): G. Wiederhold, Stanford University

Design and Management of A Secure Networked Administration System: A

Practical Solution (570): Prof. V. Varadharajan, University of Western Sydney,
Australia

Information Warfare - INFOSEC and Dynamic Information Defense (581): V.

Winkler, PRC Inc.

Track I--Tutorials--Room 327-328

Systems Security Engineering Capability Maturity Model: K. Ferraiolo, ARCA

Systems

A capability maturity model (CMM) has been developed to help organizations

improve their security engineering capability. This tutorial will describe the model,
why it was developed, how it is being used, and plans for its use in the future.
Thursday, October 24th----------12:45 P.M. -- 1:45 P.M.

Midday Seminar--Room 343-344

PANEL

Security Protocols/Protocol Security

Chairman: D. Maughan, N.S.A.

Panelists: TBD

This panel will discuss why standards and protocols are needed for the increased
use of the Internet by personal as well as business ventures.
Thursday, October 24th --------------2:00 P.M. -- 3:30 P.M.

Track A--Criteria & Assurance--Ballroom 2

Evolution of Criteria Requirements and User Needs

Chairman: J. Arnold, Science Applications International Corporation

Design Analysis in Evaluations Against the TCSEC C2 Criteria (67): D. Bodeau,

The MITRE Corporation

System Security Engineering Capability Maturity Model and Evaluations -

Partners within the Assurance Framework(76): C. Menk III, NSA

Applying the TCSEC Guidelines in a Real-Time Embedded System Environment

(89): D. Frincke, University of Idaho

Track B--Electronic Commerce--Ballroom 3

OVERVIEW

Security Concerns in the Private Sector - Communications: J. Klein, Wizards

Keys

Track C--In Depth--Room 349-350

OVERVIEW & PANEL

Data Warehousing I: An Introduction to Data Warehousing, Data Mining and

Security (711)

Chairman: J. Campbell, N.S.A.

Panelists: B. Thuraisingham, The MITRE Corporation; J. Worthington, Informix

Software, Inc.; P. Lambert, Oracle Corporation

These sessions will investigate Data Warehousing from what it is to what are the
security issues associated with it. These sessions will provide a basis for a Friday
afternoon workshop co-sponsored by the IEEE Mass Storage Committee. The
goal of the workshop is to provide direction in future R&D efforts ensuring optimal
security for Data Warehousing and Data Mining environments.

Track D--Internet--Ballroom 1

PANEL

The Web - What is it? Why/How is it Vulnerable? (739)*

Chairman: J. David, The Fortress

Panelist: J. Freivald, Charter Systems, Inc.; P. Peterson, Lockheed-Martin; D.

Dean, Department of Computer Science, Princeton University

The speakers will formally describe what the web is/does, indicate how it differs
from "normal" Internet use, show it is used in typical/popular operational modes,
and point out the nature and magnitude of primary vulnerabilities.
Track E--Legal Perspectives--Ballroom 4

PANEL

Crimes in Cyberspace: Case Studies (827)

Chairman: W. Galkin, Esq., Law Office of William S. Galkin

Panelists: A. Weiner, Esq., Weiner, Astrachan, Gunst, Hillman & Allen; K. Bass,
III, Venable, Baetjer, Howard & Civeletti

The panel will present, discuss, and analyze the legal issues involving several
actual criminal incidents that have occurred in Cyberspace.

Track F--Management & Administration--Room 341-342

PANEL

Surviving the Year 2000 Time Bomb (839): G. Hammonds, AGCS, Inc.

Panelists: J. White, OAO Corporation; A. Hodyke, ESC/AXS/USAF

This panel will identify the complexity and magnitude of the Year 2000 Problem,
why so many people will likely be affected, and some practical near and long-
term solutions.

Track G--Research & Development--Room 345-346

PANEL
Toward a Common Framework for Role-Based Access Control (868)*

Chairman: D. Ferraiolo, NIST

Panelists: R. Sandhu, George Mason University; V. Gligor, University of

Maryland; R. Kuhn, NIST

This panel will discuss the issues related to the development of a common
reference model for Role-Based Access Control.

Track H--Solutions--Room 343-344

PANEL

Workshop Report on the Role of Optical Systems and Devices for Security (879)

Chairman: T. Mayfield, Institute for Defense Analyses

Panelists: M. Medard, MIT Lincoln Laboratory; J. Ingles, NSA; M. Krawczewicz,

NSA; B. Javidi, University of Connecticut

This panel will address security and vulnerabilities in all-optical networks, discuss
the use of optics for information encoding, and introduce some applications that
might take advantage of optical technology.

Track I--Tutorials--Room 327-328

Common Criteria: K. Britton, NSA; L. Ambuel, BDM International

The Common Criteria has been developed as the next generation of IT Security
Criteria replacing the TCSEC, ITSEC, and CTCPEC. This session will provide a
working knowledge of the concepts and contents of the Common Criteria.

Thursday, October 24th------------4:00 P.M. -- 6:00 P.M.

Track A-- Criteria & Assurance--Ballroom 2

PANEL

Assurance Measures in Evaluation Assurance Level 3 of the Common Criteria

(660)*

Chairman: M. Schanken, N.S.A.

Panelists: S. Katzke, NIST; K. Keus, GISA; Y. Klein, France

The Common Criteria Sponsoring Organizations are investigating alternative

approaches for gaining assurance that products and systems meet their security
requirements. The initial phase of the activity maps several alternative assurance
approaches to Evaluation Assurance Level 3 (EAL 3) of the Common Criteria.

Track B--Electronic Commerce--Ballroom 3

OVERVIEW

Security Concerns in the Private Sector - Manufacturing: S. Meglathery, Estee

Lauder (Cosmetics)

Track C--In Depth--Room 349-350

OVERVIEW & PANEL

Data Warehousing II: The Security Issues

Chairman: D. Kinch, N.S.A.

This session continues discussing current data warehousing security issues.

Track D--Internet--Ballroom 1

PANEL

Securing the Web (739)

Chairman: J. David, The Fortress

Panelist: J. Freivald, Charter Systems, Inc.; P. Peterson, Lockheed-Martin; D.

Dean, Department of Computer Science, Princeton University

The speakers will show how to treat the vulnerabilities uncovered in the first
session in and of themselves, and as a part of both Internet security programs
and total security programs.

Track E--Legal Perspectives--Ballroom 4

(OPEN)

Track F--Management & Administration --Room 341-342

PANEL

Security Siblings
Chairman: C. Pfleeger, Trusted Information Systems, Inc.

Panelist: W. Agresti, MITRETEK Systems

This panel will discuss other venues of assurance developed in the reliability,
safety critical, fault-tolerant as well as the security communities. By working
together, we can reduce the expense of repeating each other errors and share
our successes.

Track G--Research & Development--Room 345-346

Security Policy & PKI Certification

Chairman: H. Highland, FICS

Management Model for the Federal Public Key Infrastructure (438): N. Nazario,
NIST

Security Policies for the Federal Public Key Infrastructure (445): N. Nazario,
NIST

A Proposed Federal PKI using X.509 V3 Certificates (452): W. Burr, NIST

A Security Flaw in the X.509 Standard (463): S. Chokani, Cygnacom Solutions,

Inc.

Track H--Solutions--Room 343-344

PANEL

Cryptography's Role in Securing the Information Society

Chairman: H. Lin, National Research Council (N.R.C.)

Panelists: W. Ware, The Rand Corporation, Emeritus; P. Neumann, SRI

International

The panel will discuss the National Research Council (N.R.C.) report on
Cryptography and its role.

Track I--Tutorials--Room 327-328

Education Technology: R. Quane, National Cryptologic School

Friday, October 25th------------8:30 A.M. -- 10:00 A.M.

Track A--Criteria & Assurance--Ballroom 2

PANEL

Secure Networking and Assurance Technologies (661)*

Chairman: T. Lunt, Defense Advanced Research Projects Agency (D.A.R.P.A.)

Panelists: K. Levitt, University of California, Davis, CA; J. McHugh, Portland

State University (663); S. Kent, BBN; J. Voas, Reliable Software Technologies
(669); D. Weber, Key Software (666); L. Badger, Trusted Information Systems,
Inc. (667)

The speakers will discuss their goals for secure networking and assurance
technologies in the following areas: Intrusion Detection, Secure Mobile
Computing, and new inroads to Internet Security.
Track C--In Depth--Room 349-350

PANEL

ISSO as a Vendor Partner in a Changing World

Chairman: B. Snow, N.S.A.

Panelists: C. Baggett, NSA, S. Barnett, NCSC, M. Fleming, NSA, R. George,

NSA, R. Marshall, Esq., NSA, H. Novitsky, NSA, R. Schaffer, NSA

This panel of technical leaders from the Information Systems Security

Organization will discuss their organizational plans for vendor interaction and
support, and under what terms, with the stress on how the ISSO is changing to
better accomplish the ISSO mission.

Track F--Management & Administration--Ballroom 4

PANEL

The Assessment Methodology in the Corporate Sector

Chairman: R. Lopez, N.S.A.

Panelists: J. Jackson, N.S.A., V. Moseley, N.S.A.. G. Hale, N.S.A., S.

Dombkowski, NSA

The panelists will provide a background of the methodology and tools used by
reviewers of information assets in the corporate environment.

Track H--Solutions--Room 343-344

Execution of Security Policies

Chairman: D. Arnold, N.S.A.

Security for Mobile Agents: Issues and Requirements (591), V. Swarup, The
MITRE Corporation

Extended Capability: A Simple Way to Enforce Complex Security Policies in

Distributed Systems (598), I-Lung Kao, IBM Corporation

IGOR: The Intelligence Guard for ONI Replication (607), R. Shore, The ISX
Corporation
Friday, October 25th-----------------10:20 A.M. -- 12:30 P.M.

Closing Plenary Ballrooms 1 & 3

Information Systems Security - Directions and Challenges

Moderator: Willis H. Ware, Corporate Research Staff, Emeritus -- The Rand

Corporation

Distinguished Panelists: C. Thomas Cook (889)*, Executive Vice President --

Banc One Services Corporation; William P. Crowell, Deputy Director -- National
Security Agency; John Lainhart (890), Inspector General -- U.S. House of
Representatives; J. F. Mergen, Principal Scientist -- BBN; Stephen Smaha, Chief
Executive Officer/President -- Haystack Labs; Charles Stuckey, Chief Executive
Officer -- Security Dynamics

The need for seamless value-added, yet end-to-end secure and cost-effective,
information systems and networks in a rapidly evolving technological world that is
globally competitive, has created extraordinary demands and challenges for the
public, academic, and private sectors. Each is asking itself how to meet the
future with a stalwart information infrastructure, and wondering what roles and
contributions of the other two sectors will or should be.

This distinguished panel is convened to address such over-arching issues and to

engage the audience in a dialogue on such questions as the following:

* What challenges do you perceive for your own business or end-user community
with respect to information system security?

* What are the security-relevant challenges for your organization? What is

security's strategic role in your organization? How are you making the tradeoffs?

* As you move into new technology, how do you see the challenges changing,
evolving, or growing more serious?

* How do you think these challenges can best be dealt with -- from a
management view; from a public policy view; from a technical view; from a
business view?

* What do you see as the respective roles for government, industry, and
academia as the country and the world move into an ever more information-
intensive future?

* What do you see that industry, government, and academia should be doing in
computer security? What is each doing well or not so well now?
Demonstrations and Activities

Wednesday - Thursday ---Information Systems Security Exposition -----Hall G

The Armed Forces Communications and Electronics Association will host, in

parallel with the Conference, an exhibition of security products and services. This
exposition provides a forum for industry to showcase information systems
security technology and hands-on demonstrations of products and services that
are potential solutions to many network and computer security products.

Wednesday - Friday -----Research and Development Demonstrations -----Room

347-348

As a follow-up to the "INFOSEC Research and Technology, Facing the

Challenge: Secure Network Technology for the 21st Century," the National
Security Agency will demonstrate some of the techniques coming down the future
trails. Conference attendees are invited to see the demonstration of future
solutions to the 21st Century challenges.

Tuesday - Friday ------European Community ------Registration Area

The Information Technology Security Evaluation Facilities (ITSEF) in Europe and

the European Certification Bodies invite the attendees to learn about the
European system and security product evaluations and will demonstrate the
product evaluation methodology.

Tuesday - Friday -----NIST Clearinghouse -----Room 347-348

A wide variety of information security information is available to federal agencies

and to the public through the NIST Clearinghouse. Information posted to this
system include an events calendar, computer-based training, software reviews,
publication, bibliographies, lists of organization with points of contact, and other
government bulletin board numbers and WWW pointers.

Tuesday - Friday -----NSA INFOSEC Awareness ------Booth Registration Area

The booth offers a variety of INFOSEC publications most frequently requested by

users, developers, operators, and administrators of products and services.
Publications available include the INFOSEC Products and Services Catalog and
the National Computer Security Center's computer security technical guidelines --
the RAINBOW Series. The National Cryptologic Museum is also represented at
this booth.

Tuesday - Friday------DOCKMASTER I ------Room 347-348

The National Computer Security Center, DOCKMASTER I, is a focal point for

nationwide dissemination and exchange of information security data through
electronic mail and bulletin boards. Over 2,000 users from federal government,
private companies, and academic institutions participate in its electronic forums
and retrieve data on INFOSEC products, conferences, and training.

Tuesday - Friday ------Information Systems Security Association Booth ------

Registration Area

The Information Systems Security Association (ISSA) is an international

association of information security practitioners whose aim is to enhance
professionalism through education, information exchange, and sharing among
those who do INFOSEC day-to-day. The booth contains newsletters, resource
guides, Guidelines for Information Valuation, and the Draft of "Generally
Accepted System Security Principles."

Tuesday - Friday ------NIST Publication --------Booth Registration Area

NIST's Publication Booth will distribute information and publications on a variety

of information systems security issues, including the latest issues of the CSL
Bulletin. Each bulletin discusses a relevant information security topic in depth. A
catalog of our current publications will also be available, as well as instructions
for accessing our Computer Security Resource Clearinghouse electronically.

Tuesday - Thursday -------Book Exhibition --------Registration Area

A book exhibit display representing selections from leading worldwide publishers
dealing specifically with information security is presented by: Association Book
Exhibit, 693 S. Washington Street, Alexandria, VA 22314

Wednesday - Thursday ---Establishing an Enterprise Virus Response Program ----Laboratory

Room 330

MITRETEK Systems is providing a hands on demonstration of tools discussed in the

overview session for "Establishing an Enterprise Virus Response Program." The
Enterprise Virus Response is designed to help the organization develop a proactive
program for the prevention, detection, containment, management, and recovery of
computer virus incidents. The workshop will demonstrate the processes needed to prepare
for an incident or infection, to detect and contain a virus exposure or infection, to recover
from an infection, and to manage the response program.

Friday -----IEEE Data Warehouse Security Workshop -----Room 349-350

The Workshop follows from the two Thursday sessions on Data Warehousing. The output
of the workshop should be research directions for future Data Warehousing security
solutions. The workshop is co-sponsored by the IEEE Mass Storage Committee and will
become a component of the next IEEE Mass Storage Symposium.

General Information

Meeting Site: The conference will be held at the Baltimore Convention Center, 1 West
Pratt Street. Baltimore, Maryland, close to Baltimore Inner Harbor area. The Opening
Plenary Session will be held in Ballroom I, on the Ballroom Level (enter the Pratt Street
lobby). Registration and information services, and all technical sessions, will be held on
the third floor Meeting Room Level and the fourth floor Ballroom Level. The Convention
Center is conveniently located close to hotels, major highways, and numerous restaurants,
shops, and sightseeing attractions.
Transportation: For those attendees not staying in Baltimore, daily bus service will be
provided from the parking lot across from the National Computer Security Center
(NCSC) Fanx III, 840 Elkridge Landing Road, Linthicum, MD. The buses will run in a
round-robin fashion from the NCSC from 7:00 a.m. to 8:30 a.m. Buses will return to the
NCSC at the end of the sessions each day, following the banquet, and periodically
throughout the awards reception.

Communications: Messages will be taken for conference attendees between the hours of
8 a.m. and 5 p.m. Tuesday through Thursday, and between the hours of 8 a.m. and 12
noon on Friday. Messages will be posted on a message board adjacent to the
Registration/Information Area. Attendees will not be called out of a meeting except for
emergencies. The phone numbers for leaving messages will be posted on the message
board.

Evaluation Forms: Evaluation forms are provided in your conference folder for your
comments. Please leave the completed forms in the boxes provided at the registration
area. We thank you in advance for your comments since your comments help the
committee to develop and improve the conference program each year.

Volunteers: If you would like to serve as a referee for the 20th National Information
Systems Security Conference being planned for October 1997 please E-MAIL:
NISSConference@dockmaster.ncsc.mil or call (410) 850-0272.

Special Interest Rooms: There will be a limited number of rooms available for special
interest discussions ("Birds of a Feather," etc.). These rooms may be reserved in one-hour
increments and must not be used for commercial purposes. To reserve a room, please stop
at the registration area. Breaks and Lunches

Coffee service: Provided to all the attendees during registration each morning and at mid-
morning and mid-afternoon breaks. Attendees will be free at lunch time to explore the
convenient restaurants or other sites near the Convention Center.
On Wednesday, box lunches will be provided to the first 1,500 attendees on a first-come,
first-served basis at the AFCEA exhibit in Hall G.

Banquet: The conference banquet will be held on Wednesday, October 23, beginning with
a cash bar reception at 6 p.m. and followed by dinner at 7 p.m. The dinner speaker is
Kenneth Chenault, Vice Chairman, American Express Co., Inc. A coupon for this event,
which may be exchanged for a dinner ticket on a first-come first-served basis, will be
included in each attendee's registration kit.

Awards Ceremony and Reception: On Thursday, October 24, at 2:00 pm in rooms 337-
338, awards will be presented to vendors that have successfully developed security
product lines that have been approved by the NIST Validation Program or the NCSC
Trusted Computer System Evaluation Program. Following the award presentation,
conference participants will have an opportunity to learn more about these products as
each vendor hosts a display. Awards also will be presented to companies that have
participated in Systems Security Engineering Capability Maturity Model (SSE-CMM)
pilot appraisals. You are invited to visit the SSE-CMM project display for more
information regarding this community-supported initiative. An awards reception will
begin at 6 p.m. in the lower lobby. A ticket for the reception will be included in the
registration kit of each registered attendee.

Housing: See map of the conference hotels in the area

20th National Information Systems Security Conference ( October 6 - 9, 1997 in

Baltimore, MD )