CERIAS Weekly Security Seminar - Purdue University

Military, intelligence and critical infrastructure systems increasingly run AI and mission workloads at the edge. That means contested, disconnected, and physically exposed environments where the usual cloud security assumptions fail. You can't count on a reachable identity provider. You can't trust the host operator. You can't patch on demand.This talk is a case study in building a defense-in-depth model for that environment. It follows the stack from the bottom up: Confidential computing. Intel TDX and AMD SEV-SNP isolate workloads even from a compromised host, and remote attestation verifies them. Software supply chain assurance. Immutable, signed OS images ship with SBOMs, continuous vulnerability scanning using Trivy and Grype, and STIG compliance reporting. Policy-as-code authorization. Cedar provides fine-grained, analyzable access control across compute, storage, networking and AI agents. Policies keep enforcing when the link to the enterprise is gone. Identity lifecycle. SCIM federates with enterprise directories without making them a runtime dependency.We'll examine the design tradeoffs, the threat models behind each layer, and where the gaps remain. Examples are drawn from Mainsail's work on Starlight. About the speaker: Brad Sollar is Co-Founder and CTO of Mainsail Industries, a veteran-owned defense technology company. Mainsail builds secure edge compute and AI infrastructure for the DoD, the intelligence community and critical infrastructure. Before Mainsail, Brad was a solutions architect at Red Hat, focused on OpenShift, automation and cloud platforms. He served as an enlisted soldier in the U.S. Army and holds a master's degree in information assurance.

GPS was formally approved as a U.S. Department of Defense program in December 1973 and developed as a military system for precise three-dimensional positioning, navigation, and timing—driven in large part by requirements for accurate munitions and missile guidance. The first developmental satellite launched in 1978; the system reached full operational capability in 1995. Civilian access was authorized beginning in the 1980s and later expanded widely into aviation, maritime shipping, and consumer devices. Its radio-frequency signals in the L-band enable global positioning through time-of-flight ranging, yet the same open, relatively weak signals that made GPS ubiquitous have become a systemic vulnerability. Recent incidents illustrate the stakes: a man jamming the Denver International Airport in January 2022 disrupted GPS over a roughly 50-nautical-mile radius for about 33 hours, affecting aircraft and other critical infrastructure; GPS jamming contributed to the 2024 Azerbaijan Airlines crash (38 fatalities) after loss of navigational aids near Grozny; AIS anomalies linked to GPS interference preceded the 2025 Front Eagle–Adalynn tanker collision near the Strait of Hormuz; and widespread jamming in Ukraine has driven the rapid adoption of fiber-optic-controlled drones. Mitigation efforts range from stronger LEO signals (Xona Space Systems' Pulsar) to physical tethers that bypass radio entirely, multi-modal feature fusion architectures that incorporate optical flow and geo-registration (such as Northrop Grumman's ANAGDA), and inertial/photonic systems. This talk examines these approaches as partial mitigations of a radio-based paradigm and contrasts them with fundamentally different sensing modalities—such as visual and topological fingerprinting of environmental features developed by Xphera—that reframe the positioning problem itself. Ultimately, this illustrates a broader cybersecurity lesson: every technology has inherent weaknesses, and it is common to develop tunnel vision focused solely on mitigating the risks of the original solution. Sometimes the most effective path forward is to return to identify the problem at a foundational level and apply different technologies to achieve the same outcomes. About the speaker: JohnGabriel is a Saint Louis University alumnus with a bachelor's degree in Forensic Science. Growing up and helping his Vietnamese refugee parents navigate new cities and airports, he pivoted to his passion in spatial navigation and founded Xphera in 2021. At Xphera, he spearheaded partnerships with airports and local government and managed LiDAR surveys at international airports ranging from 20K to 1M+ square feet. Xphera's offline Visual GPS/AltPNT system xEarth restores positioning and navigation in GPS-denied environments at ±15 cm accuracy using computer vision, LiDAR, and terrain maps. The system is currently deployed at the Indianapolis International Airport (IND) to enable spatial positioning in GPS-denied, TSA-secure zones. xEarth offers a resilient, offline ground layer that closes the most critical gap in the United States' multi-source PNT strategy. JohnGabriel is a Forbes 30 Under 30 lister, and his work with GPS and navigation has been featured by the European Business Review.

Modern communication networks face growing challenges in performance, security, and resilience as superintelligence,the Internet of Things, and high-performance computing continue to evolve. This talk explores how AI-driven techniques can transform network data into actionable intelligence to improve efficiency, adaptability, and security. It highlights three interconnected research areas: intelligent congestion control, network traffic fingerprinting, and resilient computing systems. First, machine learning techniques, including Gated Recurrent Units (GRUs), are examined for identifying TCP congestion control protocols and analyzing network behavior. Second, deep learning approaches for browser and IoT device fingerprinting using encrypted traffic are discussed, emphasizing their applications in network security. Third, fault-tolerant and adaptive mechanisms for improving the reliability of heterogeneous computing environments are explored. The talk concludes by discussing emerging opportunities for integrating large language models, knowledge graphs, and intelligent decision-making to develop more efficient, secure, and self-adaptive communication networks. About the speaker: Dr Sandhya Aneja is an Assistant Professor of Computer Science at Marist College in Poughkeepsie, New York. Her primary areas of interest include Wireless Networks, High-Performance Computing, the Internet of Things, and Artificial Intelligence technologies—machine Learning, machine Translation, and deep Learning.

Twenty years ago, the first post on the CERIAS blog took apart the rule that passwords must be changed every month. NIST retired the practice in 2017; some standards still require it. That is how a security myth works: a plausible claim, repeated in enough checklists, becomes infrastructure, and nobody audits infrastructure that seems to be working. The newest myth is that AI makes security professionals optional. This talk separates the three claims that marketing bundles together. AI tools do find flaws in shipped code, and the evidence from Google, DARPA, Mozilla, and Microsoft is real. Autonomous agents do add kinds of risk that no deployed security architecture was designed for. Neither fact implies that fewer people are needed. The vulnerability flood of 2026 is an audit of forty years of deferred engineering, not a crisis AI created, and the bottleneck has moved to the human capacity to verify, coordinate, and fix. The organizations that bet on replacement are already rehiring, often at a premium, the judgment they discarded. Open positions in the field number in the hundreds of thousands. For students, the message is direct: AI is not replacing you; it is generating your workload. The talk closes with what grows, what shrinks, and  how to prepare. The capacities that make you a professional are the ones that do not become obsolete with the next model release. About the speaker: Eugene H. Spafford is a Distinguished Professor of Computer Science at Purdue University and the founder and Executive Director Emeritus of CERIAS. He is co-author of*Cybersecurity Myths and Misconceptions *(Addison-Wesley, 2023).

In contemporary digital environments, individuals increasingly exchange personal privacy for the convenience afforded by online services, often without full awareness of the breadth or implications of this trade-off. This study examines this phenomenon through a comparative analysis of the data practices of major communication, social networking, and dating applications, including Meta, Instagram, WhatsApp, TikTok, LinkedIn, Google,WeChat, Signal, Telegram, Snapchat, and others. By systematically reviewing privacy policies and related disclosures, the research evaluates how these platforms collect, process, and utilize a wide range of user data, encompassing identifiers such as IP address, location information, demographic attributes,behavioral telemetry, device metadata, and access to sensitive content. The analysis reveals substantial heterogeneity in data collection practices - both in terms of scope and transparency - across different categories of applications and geopolitical ecosystems. Notably,privacy-oriented services such as Signal demonstrate markedly reduced data gathering compared to mainstream or commercially driven platforms. An illustrative comparison between high-privacy and low-privacy application models highlights the extent to which features that enhance user convenience,including personalization algorithms and streamlined authentication, are frequently enabled by extensive behavioral tracking. The findings underscore the imperative for security professionals to advocate for stronger privacy standards, promote informed consent, and encourage data-minimizing design principles. Ultimately, the study argues that safeguarding privacy is not solely a technical undertaking but also a cultural and ethical responsibility requiring leadership within the securitycommunity. About the speaker: Dr. Tzvetanov has served as a Graduate Researcher at Purdue University for the past six years, focusing on Homeland Security, Cyber Threat Intelligence (CTI), and Influence Operations. Concurrently, he has served as Instructor of Record for graduate-level courses in Cybersecurity and Homeland Security.For the past three years, Dr. Tzvetanov has also served as CISO and Director of Security Engineering at Hydrolix. Prior to this role, he held positions including CTI Lead, Principal Security Engineer and Architect,and Red Team Operator at major technology companies such as Cisco, Yahoo!, and Google. Throughout his career, he has authored training materials, whitepapers, and academic publications covering distributed denial-of-service (DDoS)attack mitigation and investigation, cyber threat intelligence, privacy, and influence operations. He has also contributed to numerous law enforcement investigations, including providing expert witness testimony in federal court.Dr. Tzvetanov is an active contributor to the global cybersecurity research and incident response communities. He has served on program committees for ShmooCon, FIRST, NANOG, BayThreat, and the Underground Economy. He is an active participant in several Special Interest Groups within the Forum of Incident Response and Security Teams (FIRST), has contributed to the Honeynet Project, and was a principal organizer of the Bay Threat security conference. He also led the Radio Communications Department at DEF CON.Dr. Tzvetanov holds a Ph.D. and an M.S. in Technology, both with a concentration in Homeland Security; an M.S. in Digital Forensics and Investigations; and a B.S. in Electrical Engineering with a concentration in Radio Communications.

Internet users increasingly interact through emerging digital platforms and communities, which create complex online safety, security and privacy challenges that aredifficult to navigate. This talk will present insights from our research to understand the rising online safety landscape and improve online safety governance. I will first present our work characterizing online community responses to globalized scam-driven human trafficking, which received a Best Paper Award at ACM CHI 2026. Scam-driven cross-border human trafficking has become a long-standing societal crisis in Asia. Through our analysis of community responses on RedNote, a major Chinese social media platform, we identify several key challenges, including cultural values that can both enable trafficking and hinder survivors' recovery. Although online communities develop and share protective strategies, these efforts are complicated by uncertainty about the reliability of available support and difficulties in cross-border coordination. I will discuss the implications of these findings for prevention, platform governance, and international cooperation against scam-driven trafficking. Building on this work, I will then highlight opportunities for more proactive approaches to governing digital platforms and online communities, drawing on insights from our parallel research efforts. Finally, I will reflect on methodological lessons from our research and motivate discussion about future opportunities for studying and improving online safety, security and privacy in emerging digital environments. About the speaker: Jingjie Li is a Lecturer (Assistant Professor) in the School of Informatics, University of Edinburgh. His work spans privacy, security, and online safety,with the goal of seamlessly integrating these principles into emerging human-centered technologies such as smart homes, augmented and virtual reality, and AI-enabled systems. He published impactful work at premier conferences in security and privacy (IEEE S&P, USENIX Security, and ACM CCS), human-computer interaction (ACM CHI and ACM CSCW), and computer systems (IEEE/ACM ISCA, IEEE TMC and IEEE TVLSI). His interdisciplinary work received multiple best paper awards and has informed industry development and policymaking with key stakeholders across countries. Before joining the University of Edinburgh, Jingjie obtained a Ph.D. degree from the University of Wisconsin-Madison in 2023. For more information, please visit his homepage: www.jingjieli.me 

In the past few years, blockchains have emerged as a new class of decentralized systems with wide-ranging applications. But the promise of blockchains has been marred by hype, speculation, and a plethora of high-profile attacks.The purpose of this talk is to demonstrate, through examples from my research, why blockchain security is challenging. Blockchains operate in a radically new, highly adversarial environment where subtle protocol flaws can be immediately monetized by anonymous actors. This fundamentally intertwines an assortment of fields---cryptography, distributed systems, and mechanism design, among many others. Blockchain security should no longer be thought of from a single lens.In this talk, I will show powerful new attacks, motivated by blockchains, that erode security through the very same tools typically used to build secure protocols. These attacks provide valuable insights on existing, well-studied security and cryptographic models. In turn, this shows why understanding blockchain security has broader utility and how it can serve as a guiding principle when designing secure systems.The first part of my talk challenges assumptions in cryptographic models of knowledge by showing powerful bribery attacks in bribery-resistant voting---fixing these attacks requires a stronger notion of knowledge. The second part will discuss new techniques for collusion using blockchains, and how it impacts incentives and models in accountable cryptography. About the speaker: Mahimna Kelkar is an assistant professor of computer science at Purdue University. His research designs and builds secure systems using techniques from applied cryptography, blockchain technology, and game theory. Before joining Purdue, he received his PhD in computer science from Cornell University and spent a year as a postdoctoral fellow at Columbia University. More details can be found on his websitehttps://mahimnakelkar.github.io/

Modern machine learning systems are only as reliable as the data and pipelines that support them, yet improving their behavior often requires navigating enormous spaces of possible data and system configurations. These systems are complex enough that improving them by changing everything at once is both inefficient and unreliable. This talk explores a simple principle for building smarter data and machine learning systems: identify which intervention is most likely to change the outcome, and act there.  I will first introduce DataSift that applies this principle to model behavior, identifying the most influential data to expand the training data when the goal is to improve fairness without sacrificing predictive performance. By combining data valuation, influence functions, and multi-armed bandits, DataSift identifies small, high-impact subsets of candidate data rather than indiscriminately adding data to the training set. Next, I will present PipeLens that applies the same principle to data science pipelines, identifying the components and parameters whose intervention is most likely to repair a malfunctioning pipeline. By learning from successful and failed pipeline executions, PipeLens identifies causally relevant root causes and efficiently searches for interventions that restore pipeline utility. Despite addressing different problems, both systems replace brute-force search with targeted intervention using principled reasoning about influence and causality to determine what to change, why it matters, and how to change it efficiently. About the speaker: Romila Pradhan is an Assistant Professor in the School of Applied & Creative Computing at Purdue University and leads the Responsible DataScience Lab, where she and her students build trustworthy and responsible data-driven decision-making systems. Her research is in the broader areas of databases and data management and is driven by the need to design algorithms and develop solutions that enable system explainability, fairness, and robustness.  Her research is supported by NSF, Google, and Underwriters Laboratories. She is a recipient of a Google Research Scholar award and an NSF CAREER award. Romila earned her Ph.D. in Computer Science from Purdue University and graduated with M.S. and B.S. in Mathematics and Computing from the Indian Institute of Technology (IIT) Kharagpur, India.

In this talk, I will provide an overview of our NSF-sponsored award, TianoShield, focused on enhancing the security posture and the software maintenance process of the open-source core of the UEFI Firmware, called EDK II, and maintained by the TianoCore community. The talk will highlight our ongoing collaborations with our industrial partners, including Intel Corporation, Arm, AMI, Insyde Software, GitHub, Phoenix Technologies, Binarly, etc. First, we will discuss our methods and techniques for rapid triaging of existing bug reports that have remained open for a long time due to a lack of resources in the community. Second, we will introduce our security analysis tools and their enhancements for static and dynamic analysis of the UEFI firmware, thus discovering many new vulnerabilities. Finally, we will present our suggestions and improvements for software maintenance, specifically bug handling, and DevOps/DevSecOps practices in TianoCore. A key pillar of TianoShield is leveraging the state of the art in Artificial Intelligence (AI), including Large Language Models (LLMs) for software security and software maintenance. As part of the dissemination practices in TianoShield, we have organized/will organize a full-day workshop, called FirmVuln26, at VulnCon26 in Scottsdale, AZ, in April 2026, and another full-day workshop, called FTA 2026, at ISSTA 2026 in Oakland, CA, in October 2026. The TianoShield project started in October 2025 and is expected to run until September 2027. About the speaker: Dr. Armin Moin is a Tenure-Track Assistant Professor and Director of the Purdue Quantum-Classical AI and Software Engineering (QCASE) Lab at the School of Applied and Creative Computing (ACC) in the Polytechnic Institute at Purdue University in West Lafayette and Indianapolis, Indiana, USA. He previously (2023-2026) held a Tenure-Track Assistant Professor position in the Computer Science (CS) department of the University of Colorado Colorado Springs (UCCS). Before starting his faculty position, he worked as a Postdoctoral Scholar-Employee in the CS Department of the University of California, Santa Barbara (UCSB) in the U.S. and as a Postdoctoral Scholar in the CS Department of the University of Antwerp and FlandersMake in Belgium. Dr. Moin obtained his Ph.D. in CS from the Technical University of Munich (TUM), Germany, one of the world's top universities, in 2022. He also has a Master's in CS and an Executive MBA in Innovation and Business Creation. His research focuses on the intersection of Artificial Intelligence (AI) and Software Engineering (SE), particularly AI4SE and SE4AI, with an emphasis on hybrid quantum-classical computing and software security. Grants from various sources, including the U.S. National Science Foundation (NSF) and the Colorado Office of Economic Development and International Trade (OEDIT), have funded his lab. Besides conducting research and teaching at Purdue University, Dr. Moin reviews top academic conferences and journals. He is passionate about encouraging and empowering students to start their ventures based on what they learn at the university. Please refer to his academic homepage at https://web.ics.purdue.edu/~moin/index.html or his professional profile at https://polytechnic.purdue.edu/profile/moin for more information. 

You may find yourself attending a CERIAS Security Seminar, and you may ask yourself "Well, how did we get here?" Once upon a time, not long ago, there was no cybersecurity industry or careers. This talk transports attendees on a retrospective journey through time to highlight the advancements which paved the way here. We further explore historic attack vectors to understand how they relate to the cyberattacks of today. Topics include when Social Engineering first intertwined with technology following previous milestones in telecommunications. Our expedition highlights the technological origins of Phone Phreaking, Computer Hacking, Social Engineering, and how these activities relate to modern attacks. The speaker pulls out numerous hardware relics from the past to show attendees and demo them throughout this presentation. Come learn about what the underground phone phreak and early computer hacker scenes were like, and get ready for some "Show & Telecom"! About the speaker: Matt Scheurer is the show host of the ThreatReel Podcast, and Vice President of Computer Security and Incident Response in a large enterprise environment. He has many years of hands-on technical experience. Matt is an official "Hacking is NOT a Crime" Advocate, serves on the Advisory Board for the Warren County (Ohio) Career Center "Information Technology and Cybersecurity" program, and also volunteers as a technical mentor for the Women's Security Alliance (WomSA). He has presented numerous Information Security topics at countless technology meetup groups, and prominent Information Security conferences, including keynotes at the Cybersecurity Collaboration Forum Cincinnati Leadership Exchange, the Information Security Summit in Cleveland, Queen City Con (0x1, 0x2, and 0x3) in Cincinnati, and SecureWV in Charleston. He is awarded with delivering lifetime conference Keynote Addresses at Queen City Con. Matt is also a 2019 comSpark "Rising Tech Stars Award" winner, named a "Top 12 Hacking Influencer" by Bishop Fox in 2023, and awarded a "Black Badge" for continuous community engagement at Queen City Con in 2024.