ORD Discussion Schedule
4 March 1997
Administrative
Stolen Computer
Admin support
Graduate students (Spring Qtr)
History ProjectBibliography
stuff of interest w/ comments (working document)The Insider Problem
Due to limited events in NT Auditing, detection of misuse of authority may require additional information; (eg type of data available in fraud detection)
Sources of examples of misuse
scenarios
categorized audit dataNT Auditing
Event list Audit API and audit log abstractions Disabling NT audit Lunch-Dos Coyotes or Pub
Macro Virsus in the Large
- should we recognize all known, or generic recognition of any w/ some missclassifications
- false positive/negative rates
- which applications:
Mobile Code
- MS Word, Excel
- Netscape: Java
- Internet Explorer: ActiveX
- HTML: Frames
- Proofs
- Virtual Machines
Meeting Notes taken by Chris Wee Action items
Add "UC Davis" to monthly status reports
The History project will cover papers from 1964 (e.g., Burroughs) to 1975. After 1975, there are conference proceedings.
There are classified penetration studies. Since some of these systems do not exist anymore, it may be possible to de-classify these reports and disseminate them to the research community.
Contact Brant Allen of Univ. Virginia. Perhaps he has written a book.Technical Exchange Meeting after-hours @ Sudwerks
![]()
![]()
![]()
![]()