64 citations · 157 across the 17 of their papers we have counts for
8 papers · 1 filter
Who Falls for SMiSh? Learning Through Survey Data Where to Best Target Awareness Training for Mobile Messaging Attacks
Cori Faklaris, Sarah Tabassum, Heather Richter Lipford
As mobile phone adoption has surged, so have scams involving these devices. One such scam, known as SMiShing (or smishing) after Short Message Service (SMS), involves fraudsters se…
The Everyday Security of Living with Conflict
Jessica McClearn, Reem Talhouk, Rikke Bjerg Jensen
When `cyber' is used as a prefix, attention is typically drawn to the technological and spectacular aspects of war and conflict -- and, by extension, security. We offer a different…
Using AI Assistants in Software Development: A Qualitative Study on Security Practices and Concerns
Jan H. Klemmer, Stefan Albert Horstmann, Nikhil Patnaik +10
Following the recent release of AI assistants, such as OpenAI's ChatGPT and GitHub Copilot, the software industry quickly utilized these tools for software development tasks, e.g.,…
Security policy audits: why and how
Arvind Narayanan, Kevin Lee
Information security isn't just about software and hardware -- it's at least as much about policies and processes. But the research community overwhelmingly focuses on the former o…
Automated Detecting and Repair of Cross-Site Scripting Vulnerabilities
Mahmoud Mohammadi, Bei-Tseng Chu, Heather Richter Lipford
The best practice to prevent Cross Site Scripting (XSS) attacks is to apply encoders to sanitize untrusted data. To balance security and functionality, encoders should be applied t…
Detecting Cross-Site Scripting Vulnerabilities through Automated Unit Testing
Mahmoud Mohammadi, Bill Chu, Heather Richter Lipford
The best practice to prevent Cross Site Scripting (XSS) attacks is to apply encoders to sanitize untrusted data. To balance security and functionality, encoders should be applied t…
Automatic Web Security Unit Testing: XSS Vulnerability Detection
Mahmoud Mohammadi, Bill Chu, Heather Richter Lipford +1
Integrating security testing into the workflow of software developers not only can save resources for separate security testing but also reduce the cost of fixing security vulnerab…
Using Unit Testing to Detect Sanitization Flaws
Mahmoud Mohammadi, Bill Chu, Heather Richter Lipford
Input sanitization mechanisms are widely used to mitigate vulnerabilities to injection attacks such as cross-site scripting. Static analysis tools and techniques commonly used to e…