The National Institute of Environmental Health Sciences (NIEHS) published a feature on Dr. Ghosh's research and translation over the last 15 years funded through the R01 program. Dr. Ghosh is a professor of chemical, biochemical, and environmental engineering at UMBC, where his research group explores the fundamental processes that control pollutant fate in soils, sediments, and aquatic environments.

By exploring how chemical contaminants move through the environment and affect aquatic food webs, Upal Ghosh, Ph.D., of the University of Maryland, Baltimore County (UMBC), aims to develop and implement technologies to help ecosystems recover from pollution.

With consistent NIEHS funding since 2007, Ghosh studies contaminants called polychlorinated biphenyls (PCBs), which can build up in organisms over time and along the food chain. Ghosh assesses pollutant bioavailability, or the amount of a contaminant available for uptake by fish and other organisms, with a particular focus on PCBs.

“During my undergraduate studies in chemical engineering, I got to visit different industrial sites and understand how we produce chemicals in bulk,” Ghosh said. “Although chemical industries provide many benefits for people — producing thousands of consumer products we use today — I was disappointed to see the problems that occur when chemicals like PCBs are mismanaged and enter the environment.”

His goal is to use nature-based strategies to clean up contaminants and reduce exposures in aquatic organisms and humans alike.

PCBs Pose a Public Health Issue

PCBs are a group of chemicals formerly used in many industrial and consumer products, such as electrical equipment, insulation, paint, and plastics. Although the federal government banned PCB production in 1979, the compounds persist in soils, sediments, and water bodies due to their stable chemical structure.

Exposure to PCBs has been associated with a wide variety of health effects, including liver problems, poor birth outcomes, hormone disruption, and cancer. In general, people are exposed to PCBs by eating contaminated fish, meat, or dairy products.

“If we can limit the amount of PCBs bioavailable to fish, we can also help protect human health,” Ghosh explained.

To better understand PCB accumulation in organisms, Ghosh’s team has been studying the Anacostia River in Washington, D.C., which faces ongoing PCB contamination. The river’s long history of urbanization and industrialization has resulted in pollution, poor water quality, and contaminated sediments in the riverbed.

The team deployed passive samplers and freshwater mussels into the Anacostia River as dual methods to identify PCB sources. Mussels are sedentary, long-lived filter feeders that have been shown to accumulate contaminants without metabolizing them. They then developed models to accurately predict PCB accumulation in mussels and different fish species in the river.

According to Ghosh, this research demonstrated that controlling ongoing PCB inputs from one heavily impacted tributary was critical for the reduction of PCB levels in fish.

“At many contaminated sites, we found that PCB hotspots were located near disadvantaged communities, which poses an environmental justice and health equity issue for the people who live there,” Ghosh said.

read full article

image credits: 

Photo courtesy of Upal Ghosh

CWIT Student Council is looking for applicants for the Public Relations Chair.

If interested apply by April 1st. Using the link below

And if you missed the first deadline and wanted to apply for a position, also apply by April 1sr.

12-1pm, Friday, 31 March 2023, via WebEx

We introduce a new key-generation mechanism where a user generates a "backup key", securely nested inside the secret key of a cryptocurrency wallet.  Our main motivation is that, in case the secret key is leaked, established techniques such as digital signatures or zero-knowledge proofs of knowledge become void since the secret key is exposed. A well-established result in this key-compromise setting is that an adversary who gained access to the leaked secret key, and an honest secret key owner, effectively become indistinguishable, because both parties have access to the same key.  Our design does not have this limitation.

Using our construction, which relies on a "backup key" that is kept secret, users can generate "proofs-of-ownership" that can be produced only by the true owners of the key pair.  When instantiated properly, our design offers the ability of integrating a quantum secure fallback securely nested in the ECDSA secret key.

To our knowledge, this extra level of security is novel. If used in digital wallets for cryptocurrencies, our mechanism could mitigate losses from leaks of account private keys. Blockchain bridges or high-value NFT collections can also benefit from this construction, because it provides more security to the owners and potentially prevents funds from being immediately stolen, even when the secret key of the cryptocurrency wallet is compromised. Furthermore, this construction represents a step towards simplifying the migration of traditional public-key pairs to post-quantum cryptography.

We introduce our novel construction, provide tight proofs of security for the key generation and signing components, and a formal-methods analysis using Verifpal to ensure that the formal-methods results match our initial security results. This construction is compatible with the main cryptocurrency wallet designs based on ECDSA and is modular to allow for the hiding of any quantum secure key pair.

Mario Yaksetig (mario@xx.network) is a former MS student intern at UMBC under the supervision of Alan T. Sherman. Presently, Mario works with David Chaum on the design and analysis of cryptographic protocols.

Host: Alan T. Sherman, sherman@umbc.edu. Support for this event was provided in part by the National Science Foundation under SFS grant DGE-1753681. The UMBC Cyber Defense Lab meets biweekly Fridays 12-1pm.  All meetings are open to the public.

Check your inbox Adult Learners for all the details and links to RSVP! I look forward to see you all there. 

Monday April 17th
Adult Learners Week Kick-off Dinner

Friends, Food, and Fellowship
Help us kick off Adult Learner's Week with a family dinner. Get a chance to meet other Adult Learner Students. 

Tuesday April 18th
Good Morning Commuters (GMC) And Professional Headshot Workshop
 

GMC - 8:30am - 10: 30 am | Commons Sports Zone. 
Headshots| 12-2pm

Wednesday April 19th Online Workshops

The Biden administration released its first National Cybersecurity Strategy on March 2, 2023. The last version was issued in 2018 during the Trump administration.

As the National Security Strategy does for national defense, the National Cybersecurity Strategy outlines a president's priorities regarding cybersecurity issues. The document is not a directive. Rather, it describes in general terms what the administration is most concerned about, who its major adversaries are and how it might achieve its goals through legislation or executive action. These types of strategy statements are often aspirational.

As expected, the 2023 Biden National Cybersecurity Strategy reiterates previous recommendations about how to improve American cybersecurity. It calls for improved sharing of information between the government and private sector about cybersecurity threats, vulnerabilities and risks. It prescribes coordinating cybersecurity incident response across the federal government and enhancing regulations. It describes the need to expand the federal cybersecurity workforce. It emphasizes the importance of protecting the country's critical infrastructure and federal computer systems. And it identifies China, Russia, Iran and North Korea as America's main adversaries in cyberspace.

However, as a former cybersecurity industry practitioner and current cybersecurity researcher, I think that the 2023 document incorporates some fresh ideas and perspectives that represent a more holistic approach to cybersecurity. At the same time, though, some of what is proposed may not be as helpful as envisioned.

Some of the key provisions in the current National Cybersecurity Strategy relate to the private sector, both in terms of product liability and cybersecurity insurance. It also aims to reduce the cybersecurity burden on individuals and smaller organizations. However, I believe it doesn't go far enough in fostering information-sharing or addressing the specific tactics and techniques used by attackers.

Acting National Cybersecurity Director Kemba Walden discusses the Biden administration's National Cybersecurity Strategy.

The end of vendor indemnification?

For decades, the technology industry has operated under what is known as "shrink-wrap" licensing. This refers to the multiple pages of legal text that customers, both large and small, routinely are forced to accept before installing or using computer products, software and services.

While much has been written about these agreements, such licenses generally have one thing in common: They ultimately protect vendors such as Microsoft or Adobe from legal consequences for any damages or costs arising from a customer's use of their products, even if the vendor is at fault for producing a flawed or insecure product that affects the end user.

In a groundbreaking move, the new cybersecurity strategy says that while no product is totally secure, the administration will work with Congress and the private sector to prevent companies from being shielded from liability claims over the security of their products. These products underpin most of modern society.

Removing that legal shield is likely to encourage companies to make security a priority in their product development cycles and have a greater stake in the reliability of their products beyond the point of sale.

In another noteworthy shift, the strategy observes that end users bear too great a burden for mitigating cybersecurity risks. It states that a collaborative approach to cybersecurity and resiliency "cannot rely on the constant vigilance of our smallest organizations and individual citizens." It stresses the importance of manufacturers of critical computer systems, as well as companies that operate them, in taking a greater role in improving the security of their products. It also suggests expanded regulation toward that goal may be forthcoming.

Interestingly, the strategy places great emphasis on the threat from ransomware as the most pressing cybercrime facing the U.S. at all levels of government and business. It now calls ransomware a national security threat and not simply a criminal matter.

Backstopping cyber insurance

The new strategy also directs the federal government to consider taking on some responsibility for so-called cybersecurity insurance.

Here, the administration wants to ensure that insurance companies are adequately funded to respond to claims following a significant or catastrophic cybersecurity incident. Since 2020, the market for cybersecurity-related insurance has grown nearly 75%, and organizations of all sizes consider such policies necessary.

This is understandable given how many companies and government agencies are reliant on the internet and corporate networks to conduct daily operations. By protecting, or "backstopping," cybersecurity insurers, the administration hopes to prevent a major systemic financial crisis for insurers and victims during a cybersecurity incident.

However, cybersecurity insurance should not be treated as a free pass for complacency. Thankfully, insurers now often require policyholders to prove they are following best cybersecurity practices before approving a policy. This helps protect them from issuing policies that are likely to face claims arising from gross negligence by policyholders.

Looking forward

In addition to dealing with present concerns, the strategy also makes a strong case for ensuring the U.S. is prepared for the future. It speaks about fostering technology research that can improve or introduce cybersecurity in such fields as artificial intelligence, critical infrastructure and industrial control systems.

The strategy specifically warns that the U.S. must be prepared for a "post-quantum future" where emerging technologies could render existing cybersecurity controls vulnerable. This includes current encryption systems that could be broken by future quantum computers.

Practical quantum computers, when they arrive, will force a change in how the internet is secured.

Where the strategy falls short

While the National Cybersecurity Strategy calls for continuing to expand information-sharing related to cybersecurity, it pledges to review federal classification policy to see where additional classified access to information is necessary.

The federal government already suffers from overclassification, so if anything, I believe less classification of cybersecurity information is needed to facilitate better information-sharing on this issue. It's important to reduce administrative and operational obstacles to effective and timely interaction, especially where collaborative relationships are needed between industry, academia and federal and state governments. Excessive classification is one such challenge.

Further, the strategy does not address the use of cyber tactics, techniques and procedures in influence or disinformation campaigns and other actions that might target the U.S. This omission is perhaps intentional because, although cybersecurity and influence operations are often intertwined, reference to countering influence operations could lead to partisan conflicts over freedom of speech and political activity. Ideally, the National Cybersecurity Strategy should be apolitical.

That being said, the 2023 National Cybersecurity Strategy is a balanced document. While in many ways it reiterates recommendations made since the first National Cybersecurity Strategy in 2002, it also provides some innovative ideas that could strengthen U.S. cybersecurity in meaningful ways and help modernize America's technology industry, both now and into the future.

Richard Forno, Principal Lecturer in Computer Science and Electrical Engineering, University of Maryland, Baltimore County

This article is republished from The Conversation under a Creative Commons license. Read the original article.

Our Habitat for Humanity build that was supposed to be tomorrow has been rescheduled due to rain. It will now be taking place on May 6th. 

Thanks,

EWB E-board