Paula DeWitte's guest appearances

Paula DeWitte

CERIAS Weekly Security Seminar - Purdue University

Ryan Henry

Cory Doctorow

Doug Smith

Larry Ponemon

George Heron

Laura Thomas

Eli Lilly

Stephen Elliott

Tony Sager

David Carroll

Jack Daniel

Joe Judge

Chris Reed

Richard III

John Richardson

OwlTail

Anecdotally, most cybersecurity curricula is based on the technical aspects of protecting, defending, and responding to cyber attacks.  While these courses establish a solid foundation in the technical aspects of cybersecurity, what is often missing is establishing a foundation in cybersecurity law. Every individual who puts their hands on a keyboard operates within an uncertain ethical and legal framework. What we do not need is the type of education to produce more lawyers, but rather the type of education to produce more legal-savvy technical workers. Today's tech workers are exposed to more personal information as well as intellectual property – both targets in cyber attacks. They are expected to protect critical infrastructure and design with security "built in." Yet, we do a poor job teaching the legal requirements as well as limitations imposed by law on building in privacy protections.For the past four years, the speaker has taught Cybersecurity Law &amp; Policy to several hundred computer science and engineering students as well as those from business, architecture, technology management, and government policy. I began this course by conducting a data analytics exercise on the NIST NICE Framework to determine what work roles require legal training. The results were quite surprising as even very technical roles such as Threat Analysis and System Architecture require knowledge of laws, policies,and ethics as they relate to cybersecurity and privacy as well as knowledge of investigations.  The feedback from graduating students who take on cybersecurity roles is that they are uniquely qualified to understand the necessity of compliance within their respective roles. This presentation will discuss the basis for legal education as well as a roadmap for how to incorporate such legal education within a cybersecurity curriculum to build the workforce necessary for the current cybersecurity environment. About the speaker: Paula S. deWitte, J.D., Ph.D,. P.E., is an Associate Professor of Practice in the Computer Science and Engineering Department at Texas A&amp;M University, College Station and the Maritime Business Administration Department at Texas A&amp;M University, Galveston where she is building the maritime cybersecurity program. As well, she is an Adjunct Professor of Law at the Texas A&amp;M University Law School, Fort Worth.  She is a licensed attorney (Texas) and a registered patent attorney (USPTO). She holds a Bachelors and Masters from Purdue University where in 2015 she was honored as the Distinguished Alumna in the Department of Mathematics, School of Science.  She obtained her Ph.D. in Computer Science from Texas A&amp;M University (1989) and a law degree from St. Mary's University (2008).  She holds a patent on drilling fluids optimization [US Patent US 8812236 B1]. She teaches Cybersecurity Law, Cybersecurity Risk, and Marine Insurance Law. Her research interests are in those areas as well as in building resilient systems especially in the supply chain.

<p>Anecdotally, most cybersecurity curricula is based on the technical aspects of protecting, defending, and responding to cyber attacks.  While these courses establish a solid foundation in the technical aspects of cybersecurity, what is often missing is establishing a foundation in cybersecurity law. Every individual who puts their hands on a keyboard operates within an uncertain ethical and legal framework. What we do not need is the type of education to produce more lawyers, but rather the type of education to produce more legal-savvy technical workers. Today's tech workers are exposed to more personal information as well as intellectual property – both targets in cyber attacks. They are expected to protect critical infrastructure and design with security "built in." Yet, we do a poor job teaching the legal requirements as well as limitations imposed by law on building in privacy protections.For the past four years, the speaker has taught Cybersecurity Law &amp; Policy to several hundred computer science and engineering students as well as those from business, architecture, technology management, and government policy. I began this course by conducting a data analytics exercise on the NIST NICE Framework to determine what work roles require legal training. The results were quite surprising as even very technical roles such as Threat Analysis and System Architecture require knowledge of laws, policies,and ethics as they relate to cybersecurity and privacy as well as knowledge of investigations.  The feedback from graduating students who take on cybersecurity roles is that they are uniquely qualified to understand the necessity of compliance within their respective roles. This presentation will discuss the basis for legal education as well as a roadmap for how to incorporate such legal education within a cybersecurity curriculum to build the workforce necessary for the current cybersecurity environment. About the speaker: Paula S. deWitte, J.D., Ph.D,. P.E., is an Associate Professor of Practice in the Computer Science and Engineering Department at Texas A&amp;M University, College Station and the Maritime Business Administration Department at Texas A&amp;M University, Galveston where she is building the maritime cybersecurity program. As well, she is an Adjunct Professor of Law at the Texas A&amp;M University Law School, Fort Worth.  She is a licensed attorney (Texas) and a registered patent attorney (USPTO). She holds a Bachelors and Masters from Purdue University where in 2015 she was honored as the Distinguished Alumna in the Department of Mathematics, School of Science.  She obtained her Ph.D. in Computer Science from Texas A&amp;M University (1989) and a law degree from St. Mary's University (2008).  She holds a patent on drilling fluids optimization [US Patent US 8812236 B1]. She teaches Cybersecurity Law, Cybersecurity Risk, and Marine Insurance Law. Her research interests are in those areas as well as in building resilient systems especially in the supply chain.</p>

Paula deWitte, The Need for Legal Education within a Cybersecurity Curriculum

Systems are composed of multiple complex levels including the physical infrastructure, personnel or "humans-in-the-loop", administration policies and procedures, computers, networks, and the communication protocols for connectivity that tie the system into a workable unit.  Each aspect is in itself a complex system.  When we consider system security, we tend to focus on the electronic components—the connectivity, computers, and network—over the non-electronic.  Although we rigorously implement security in the various system components, the security is rarely integrated across the boundaries of the entire system spectrum.  We tend to implement security on the distinct levels of the system without considering the impact or interaction with other system levels.  For example, we may fully implement encryption, passwords, and firewalls and feel that our electronic systems are secure, while the weakest link may be staff members who fall victim to social engineering techniques and unknowingly reveal sufficient information to allow a perpetrator to circumvent our best security.  Or we may have fortified computer systems and well trained personnel, but neglect the fact that we are being monitored through the building's walls, floors, and windows.  Without true understanding of the nature of the interactions of the system, we cannot fully understand how vulnerabilities in one level of the system such as the physical infrastructure can be exploited to allow attacks on another level such as the computer networks.  By taking advantage of these vulnerabilities, perpetrators are able to circumvent even the most effective computer and network security, breach that security, and achieve their goals.  We only need to consider the current challenges of insider threats or threats from coordinated attacks on the physical infrastructure and the computer networks to appreciate the need for better integrated system security.  Our goal is to provide analytical tools for the real world, focusing on the decision makers who implement security policies across the system spectrum.  Further, to be effective, these analytical tools must be implemented within an organizing framework that provides both an integrated view of security as well as the insight and understanding necessary to make effective security issues.  This necessitates the development of step-by-step processes for analyzing and implementing security decisions.  While this may seem to be a soft and less complete technical solution, it is actually implementing technology at the highest level because of the integration required to address each aspect of the system as well as the multi-disciplinary approach blending computer science, engineering, psychology, linguistics, and management in developing such analytic tools.  This presentation will discuss work in progress in developing these analytical tools as well as the overarching framework for implementing integrated system security.  Our intention is to understand "what can be" or "what could happen".  With this insight, they can more effectively provide prevention, protection, or remediation strategies. About the speaker: Paula deWitte received a Ph.D. in Computer Science from Texas A&amp;M University in 1989 where her dissertation work focused on retrieving useful information from physician-dictated medical records.  For over twenty years, she has engaged in various research and technology development endeavors in natural language processing applications as well as systems and information integration.  She has significant success in commercializing research results into fielded applications and analysis products.  Her current research interests are in building natural language based tools for reducing the time required for certifying and accrediting security systems.  As a mid-career redefinition, she is currently pursuing a law degree at St. Mary's Law School in San Antonio, TX where she intends to focus on technology and privacy issues.  She also holds a B.S. and M.S. from Purdue University.

<p>Systems are composed of multiple complex levels including the physical infrastructure, personnel or "humans-in-the-loop", administration policies and procedures, computers, networks, and the communication protocols for connectivity that tie the system into a workable unit.  Each aspect is in itself a complex system.  When we consider system security, we tend to focus on the electronic components—the connectivity, computers, and network—over the non-electronic.  Although we rigorously implement security in the various system components, the security is rarely integrated across the boundaries of the entire system spectrum.  We tend to implement security on the distinct levels of the system without considering the impact or interaction with other system levels.  For example, we may fully implement encryption, passwords, and firewalls and feel that our electronic systems are secure, while the weakest link may be staff members who fall victim to social engineering techniques and unknowingly reveal sufficient information to allow a perpetrator to circumvent our best security.  Or we may have fortified computer systems and well trained personnel, but neglect the fact that we are being monitored through the building's walls, floors, and windows.  Without true understanding of the nature of the interactions of the system, we cannot fully understand how vulnerabilities in one level of the system such as the physical infrastructure can be exploited to allow attacks on another level such as the computer networks.  By taking advantage of these vulnerabilities, perpetrators are able to circumvent even the most effective computer and network security, breach that security, and achieve their goals.  We only need to consider the current challenges of insider threats or threats from coordinated attacks on the physical infrastructure and the computer networks to appreciate the need for better integrated system security.  Our goal is to provide analytical tools for the real world, focusing on the decision makers who implement security policies across the system spectrum.  Further, to be effective, these analytical tools must be implemented within an organizing framework that provides both an integrated view of security as well as the insight and understanding necessary to make effective security issues.  This necessitates the development of step-by-step processes for analyzing and implementing security decisions.  While this may seem to be a soft and less complete technical solution, it is actually implementing technology at the highest level because of the integration required to address each aspect of the system as well as the multi-disciplinary approach blending computer science, engineering, psychology, linguistics, and management in developing such analytic tools.  This presentation will discuss work in progress in developing these analytical tools as well as the overarching framework for implementing integrated system security.  Our intention is to understand "what can be" or "what could happen".  With this insight, they can more effectively provide prevention, protection, or remediation strategies. About the speaker: Paula deWitte received a Ph.D. in Computer Science from Texas A&amp;M University in 1989 where her dissertation work focused on retrieving useful information from physician-dictated medical records.  For over twenty years, she has engaged in various research and technology development endeavors in natural language processing applications as well as systems and information integration.  She has significant success in commercializing research results into fielded applications and analysis products.  Her current research interests are in building natural language based tools for reducing the time required for certifying and accrediting security systems.  As a mid-career redefinition, she is currently pursuing a law degree at St. Mary's Law School in San Antonio, TX where she intends to focus on technology and privacy issues.  She also holds a B.S. and M.S. from Purdue University.</p>

Paula DeWitte, Developing an Operational Framework for Integrated System Security