Speaking

• Home
• About me
• • » Resume / CV
  • » Schedule
  • » My Academic Webpage
  • » Speaking
• Writing
• • » Academic publications
  • » Mailman documentation
  • » Other writings
• Photos
• » Artemis
• » Baby O'Byrne sweater
• » Portland Apr 22-24, 2013
• » Art around Albuquerque
• » More Photos...
• Maker
• » Crochet Pony pattern
• » Curiousity? : my maker blog
• Toys
• » Linux laptop
• Other
• » Older Photos
• » 2008-04-21 Kens Birthday
• » 2008-04-20 Susan
• » 2008-04-19 Cute With Chris

www.flickr.com Go to Terriko's photostream

Presentations and Speaking Engagements

I actually give presentations fairly regularly as part of my academic work, and didn't bother to list them since it's assumed that most academics do the same. However, since I also speak on other topics to communities where constant presentations are not the norm, I thought this page might be helpful for those curious in my speaking venues and topics.

Because many of my presentations are on works in progress, slides cannot always be publicly made available. And some of these presentations are simply old and I didn't see much value in putting the slides online at this junction. If you are interested in seeing a particular slide deck, please contact me by email to terri(at)zone12.com.

2011

• "Simple security policy for the web." PhD Thesis Defense, Carleton University, October 2011.
• "Web Security for the Masses." Job talk, Univeristy of New Mexico, May 2011.

  Abstract: If web security were a siege, the attackers would be winning through attrition: it is relatively easy to compromise a site, but it takes significant resources for a defender to ensure that it is even moderately secure. There is a need for security policy languages to improve control over the behaviour of web pages, but security policy can be overwhelming and confusing to web designers who may have backgrounds in art, not security. As such, I have developed Security Style Sheets, a language rooted in existing web standards and visual design that allows designers to mitigate common attacks such as cross-site scripting without requiring extensive page rewrites. This alleviates some of the barriers to better web security, but the language could be even more powerful combined with adaptive techniques for inferring policy, giving web users the ability to browse more safely even when an expert is not available.

  Notes: As is apparently typical for a job talk, this also included more information about me, my background and previous research.

• "Using Facebook for Evil (and other bad things that happen online)." CU-WISE Celebration of Women in Computing, Carleton University, Ottawa, ON, April 6, 2011

  Notes: A general-level talk intended for the public as well as students and staff.

  Abstract: People like to share. Photos, links, stories, feelings, or even what you had for dinner might end up online... it all seems harmless, but is it really? Learn here about some of the crafty things a mean person might do using your information, and how you can try to avoid getting burned.

• "Enhancing Web Page Security with Security Style Sheets, " Research Day, Carleton University, March 25, 2011

  Brief talk description (25-40 words): The web is dangerously insecure, but solutions are often so prohibitively time consuming that they are not implemented. Security Style Sheets, a policy language based in existing web standards, unites disparate techniques to make security mitigation more straightforward for busy developers.

  Talk abstract (150-200 words): Although the web security community now has a variety of techniques that could help web developers to defend against common attacks such as cross-site scripting and cross-site request forgery, this work is not in a form suitable for general use. What is needed is a web standard that unites these techniques using syntax and semantics that are easy for web developers to learn and straightforward for browser makers to implement. Here we propose such a standard, Security Style Sheets, a browser-enforced policy language modelled on Cascading Style Sheets. Security Style Sheets provides an extensible policy framework that allows for policy to be separated from content and to be specified at both coarse and fine levels of granularity. In this paper we present the syntax and semantics of Security Style Sheets, explain its relationship with past web security proposals and CSS, and give examples of how it could be used to protect mainstream websites such as Facebook. Also in the model of CSS and the Acid3 tests, we present a conformance suite for Security Style Sheets.

2010

• "Getting Started in Free and Open Source Software." Grace Hopper Celebration of Women in Computing, Atlanta, GA, September 30, 2010.

  Session Description: Are you interested in contributing to a Free or Open Source software project, but you're not sure how to get started? Wondering about some of the social aspects of participating in the community, as well as the technical details? During this panel discussion, key contributors to several Free and Open Source Software projects will discuss tips for successfully engaging with the project of your choice. Panelists will share their own experiences getting started in Free and Open Source development. They will also share best practices with audience members, helping newcomers understand the basics of contributing to Open Source so their initial foray is most effective.

  Notes: I was part of a panel discussing this topic as part of the new open source track at Grace Hopper. I also helped out with the Codeathon that followed our session.

• "GNU Mailman 3: Mailing lists of the future." LinuxCon, Boston, MA, August 12, 2010.

  Abstract: GNU Mailman forms the backbone of many online communities, including many open source projects. It provides free software for managing electronic mail discussion and e-newsletter lists which are often used to coordinate development, communities and events. Mailman 3, currently in alpha, is an extensive rewrite to use modern architecture, address user issues, and bring new ideas into the way we use mailing lists. Learn about what the upcoming Mailman 3 will offer to end users and communities, and hear a little bit about what is changing under the hood. Audience members can expect to learn about new features and changes in Mailman 3, both for users and for list/community administrators. Only basic understanding of email and mailing lists will be required.

  Notes: A talk on the upcoming features of Mailman 3 (in alpha at the time of the talk). As it turned out, my audience was largely composed of system administrators with significant experience using Mailman 2.1 on a large scale.

  Notice how this was two days after the HotSec presentation, and in a different city. It was a busy week!

• "Visual Security Policy for the Web." USENIX Hot Topics in Security (HotSec 2010), Washington, DC, August 10, 2010.

  Abstract: Many web security vulnerabilities allow parts of a page to interact when they should be isolated. Such vulnerabilities can be mitigated by implementing protection boundaries between web page elements. Several methods exist for creating such boundaries, but existing methods require relatively sophisticated knowledge of web technologies. To make protection mechanisms available to a wider audience, we propose a simple web page security policy language, ViSP, modelled on mechanisms for specifying page layout. Here we characterise ViSP and describe a simple Firefox-based prototype that allows interactive, graphical specification of per-page security policies. We also show how these tools can be used to protect against cross-site scripting (XSS) attacks on common web applications.

• "Visual Security Policy for the Web." CCSL Meeting, August 4, 2010

  Notes: Complete trial run for HotSec

• "Web security for regular folk" COMP1001 class, June 7, 2010.

  Notes: I was invited to give a general-level talk on web security for an intro-level computer science course. This version of the talk included an intro to web security, a small overview of my research, and tips for staying safe online.

• "No Website Left Behind: Are We Making Web Security Only For the Elite?" Web 2.0 Security and Privacy, Oakland, CA, May 20, 2010.

  Abstract: The web is riddled with flaws that make it unsafe. Protection methods exist, but current web security solutions are often designed to be deployed by programmers and security experts. Unfortunately, programmers and web security experts are not always available: many sites are created by graphic designers with more artistic backgrounds, and others involve web applications installed by non-programmers who want a website to fit a targeted need. These non-expert page creators may find web security solutions confusing and difficult to implement because they assume significant technical expertise. While solutions designed for experts are valuable, solutions for non-experts are needed to make the web safer.

• "No Website Left Behind: Are We Making Web Security Only For the Elite?" ABA meeting, May 12, 2010.

  Notes: Complete trial run for W2SP

• "No Website Left Behind: Are We Making Web Security Only For the Elite?" ISSNet Annual Workshop, May 27-30, 2010.

  Notes: Shortened Sneak Preview of my W2SP talk

• "Visual Security Policies for Web Pages." Thesis proposal defence, April 9, 2010.

  Notes: Yes, I passed.

• "Web security for regular folk." Carleton Celebration of Women in Science and Engineering, April 8, 2010.

  The web is not a safe place: little flaws found in a large number of web pages can be exploited by attackers to do harm, from installing viruses to stealing passwords to infecting all your friends. There are new attacks showing up all the time. Being safe on Facebook is not limited to "don't share your password," but many people are unaware of the risks. And unfortunately, even the people who make websites may not understand how to make them safe! This talk will describe some of the modern safety concerns on the web, as well as my own research to make the web safer. If part of the problem is that web designers are artists, not security experts, can we make it so that art provides security? How can we make the web safer, but still usable?

  Notes: A general-level talk on my web security research.

• "How does biology explain the low numbers of women in computer science? Hint: it doesn't." Carleton Celebration of Women in Science and Engineering, April 8, 2010.

  A snarky but mathematically informed look at one of the common myths of ability regarding women in technical fields. Simple, short, back-of-the-napkin style presentation.

  This was prepared and put online in November 2009, and parts of it have been used by others, but this was my first live "performance" of the presentation.

• Joint with Gail Carmichael. Interview with CBC Ottawa Morning. Aired April 8, 2010.
• "Visual Web Security Policies." Carleton Computer Security Laboratory, January 28, 2010.

  Notes: Precursor to a potential poster.

2009 (Highlights)

• "Computer Security." Outreach presentation for careers class at Lisgar Collegiate Institute, December 1, 2009.
• "Using Layout Information to Enhance Security on the Web." Grace Hopper Celebration of Women in Computing, September 30 - October 3, 2009.
• "Attracting women to open source" Birds of a Feather session, Linux Symposium, Montreal, July 13-17, 2009.

  In 2006, GNOME put out the call for students to participate in the Google Summer of Code project, where students get paid to work on open source projects. They received 181 applicants -- and not a single one from a woman. Seeking to attract a female applicants, they did a Women's Summer Outreach Programme, and got 100 applicants. There are capable women out there, but how can we attract them to open source projects? Do women need an invitation? What makes an open source project attractive to women? What drives otherwise talented people away from a project? The goal of this BOF is to talk about some of the issues, and brainstorm ways to increase involvement. (And yes, the BOF is open to both women and men.)

• "Mitigating Cross Site Scripting Using Web Page Layout" ISSNet Annual Workshop, June 15 - 18, 2009.

  Web security lies primarily in the hands of those who create the pages. Unfortunately many people and organizations who run web sites do not have the time, security knowledge, or motivation to produce secure sites. As a result, users are exposed to insecure pages daily. This talk investigates ways to protect users by leveraging existing information from the page layout to produce good security policy without requiring an expert.

• "Mitigating Cross Site Scripting Using Web Page Layout" MITACS annual conference, June, 2009.
• "Web Security" Private government meeting, February, 2009.
• "SOMA: Mutual Approval for Included Content in Web Pages", Ottawa-Carleton Institute for Computer Science Seminar Series (OCICS), January 9, 2009.

2008 (Highlights)

• Joint presentation with Glenn Wurster. "SOMA: Mutual Approval for Included Content in Web Pages" ACM Computer and Communications Security (CCS'08), October 27-31, 2008. Pages 89-98.

  Notes: [Associated Paper] [SOMA Mozilla Firefox Add-On]

• Joint presentation with Glenn Wurster. "SOMA: Mutual Approval for Included Content in Web Pages", Carleton Computer Security Laboratory, October 21, 2009.

  Notes: Trial run for CCS presentation

• Joint presentation with Anil Somayaji. "The Ottawa Linux Symposium: Update on the world of Linux." Carleton Computer Security Laboratory, July 29, 2008.

  We will present an overview of the Ottawa Linux Symposium: its history, who attends, and what it is about. We'll give some highlights of the symposium, discussing issues such as SELinux, virtualization, and issues with P2P distribution of free software. We'll then discuss security research problems that seem to be relevant to the OLS audience.

  Notes: Bringing some highlights of OLS back to our research group.

• "Women in Open Source." Birds of a Feather session, Ottawa Linux Symposium, Ottawa, July 23rd - 26, 2008.
• "SSP, SOMA, and Web Security" Carleton Computer Security Laboratory, July 8, 2008.

  Notes: A short presentation to stimulate discussion on the design of SSP (which later became Mozilla's CSP) and how it compared with SOMA.

• "SOMA: Mutual Approval for Included Content In Web Pages" Private industry meeting, June, 2008.
• "Content Provider Conflict on the Modern Web" Symposium on Information Assurance (New York State Cyber Security Conference), Albany, NY, June 4-5, 2008.

  Today many web pages include externally sourced content. Advertisements, video, blog ``trackbacks,'' search---these and other features of the modern web are provided by third-party servers. Such external content is so popular that content is often incorporated from more than one source. In this paper we argue that such multiple inclusions are a significant security risk because of the potential for conflict between included elements. In particular, the use of JavaScript to provide external content means that providers can observe and interfere with each other. Financial incentives and competitive advantage provide motivation for such conflicts, both for criminals and for legitimate enterprises. To prevent users and web content providers from becoming collateral damage, we must develop and deploy techniques for isolating externally provided web content.

  Notes: [Associated Paper], [HTML version]

• "When Elephants Dance, Mice Must be Careful: Content Provider Conflict on the Modern Web" Carleton Computer Security Laboratory, March 18, 2008.

  Notes: Trial run for Albany presentation

2007 (Highlights)

• "The Same Origin Mutual Approval Policy" MITACS research group meeting, December 7, 2007.
• "Upsides and downsides of the Tahoma sandboxed browser model" Carleton Computer Security Laboratory, September 27, 2007.

  This talk discusses the 2006 paper "A Safety-Oriented Platform for Web Applications" by Cox et al, which proposes a "Browser Operating System" called Tahoma. The idea is to use virtual machine sandboxes to contain separate web applications -- protecting the computer from them, and them from each other. I will be covering some of the interesting ideas in their approach, and I hope to inspire discussion about the parts of this approach that lead themselves to exploitation or confusion on the part of the user.

  Notes: This marked some early discussion into related work for SOMA.

• "Sharks in the Sandbox: Security and Privacy on the Modern Web" Private industry meeting, May 7, 2007.
• "Sharks in the Sandbox: Security and Privacy on the Modern Web" Carleton Computer Security Laboratory, April 17, 2007.

  Notes: Trial run for the industry presentation

• Discussion on JavaScript Security. IDS discussion group, Carleton Univeristy, January 22, 2007.

2006 (Highlights)

I was finishing coursework and studying for my comprehensive exams this year. I almost certainly did presentations, but I don't remember the details. Sorry!

2005 (Highlights)

• "Immunity from spam: an analysis of an artificial immune system for junk email detection" Artificial Immune Systems: 4th International Conference, ICARIS 2005, Banff, AB, Canada, August 14-17, 2005.

  Notes: [Associated Paper]

2004 (Highlights)

• "A Spam-Detecting Artificial Immune System." Master's thesis defence, December 2004.

  Notes: [Master's Thesis]

2003 (Highlights)

• "Developing an Immunity to Spam." Genetic and Evolutionary Computation - GECCO 2003. Genetic and Evolutionary Computation Conference, Chicago, IL, USA, July 12-16, 2003.

  Notes: [Associated paper]

• "Revisiting Elitism in Ant Colony Search." Genetic and Evolutionary Computation - GECCO 2003. Genetic and Evolutionary Computation Conference, Chicago, IL, USA, July 12-16, 200a.3

  Notes: [Associated paper]

© Terri Oda.
Last modified: March 2, 2012