The Growing Cyber Security Industry in San Antonio

MYSA.com has an interesting article covering some of the recent growth in cyber security in San Antonio. In addition to the Institute for Cyber Security, the city has grown in both the public and private sector, with the Air Force Cyber Command award only the latest in a series of moves by government and private entities to the Alamo city.

Of note, the article mentions something not commonly known: the NSA has designated University of Texas at San Antonio as one of the two schools in San Antonio (and less than one hundred in the country) as a national center of excellence in information assurance education. Of course, the NSA is well familiar with the richness of the city's cyber security credentials as it has 2,000 employees at its Texas Cryptology Center in San Antonio.

Erhan J. Kartaltepe,
erhan.kartaltepe-at-utsa.edu

Visual Studio 2010 Beta 1 Released

Last week Microsoft announced the much anticipated release of its beta version of Visual Studio 2010. Along with Visual Studio's release came the beta to .NET Framework 4.0. Besides a new GUI, Some of its most promising features are in parallel programming and its cloud computing tools for Microsoft's Azure project (which we recently covered). .NET languages like C# and F# are in heavy use at the Institute for Cyber Security, and we look forward to testing it out.

Erhan J. Kartaltepe,
erhan.kartaltepe-at-utsa.edu

SafeMashups and Kerberos Interoperability Mention on Microsoft's Interoperability Site

The MIT Kerberos Consortium held its first Interoperability Testing Workshop a few weeks ago, hosted by Microsoft Corporation on their Redmond, Washington campus. Representatives from MIT, Microsoft, Sun, Cornell, and the Institute for Cyber Security were in attendance, with a lot of folks interested in Kerberos and trust security participating. The slide deck from our talk at the is now up online.

Microsoft's Interoperability Site has a great article covering some of the background and collaboration of the event. ICS was there with its first startup, SafeMashups, Inc., to introduce MashSSL and how the protocol can seamlessly work with Kerberos. As a supplement to Jean-Christophe Cimetiere's interesting coverage, SafeMashups also discussed MashSSL as a new standard for establishing trust in mashups and how it can provide application-level trust for Kerberized web applications, and non-Kerberized applications that want to make use of a KDC.

For those interested in the Safemashups solution to Kerberize web applications, a new tutorial on mashing MashSSL with Kerberos on its YouTube channel. Other demos on mashing MashSSL with OpenAJAX, Flash, OAuth, and Cross-Domain XHR, and more can be found there, too.

Erhan J. Kartaltepe,
erhan.kartaltepe-at-utsa.edu

DigiCert and SafeMashups Partner to Secure Web 2.0 Protocols

SafeMashups, Inc., the latest startup from the Institute for Cyber Security to go live, has teamed up with DigiCert to further secure web 2.0 protocols. DigiCert is a large provider of SSL certificates and now interoperates with SafeMashup's free Web Toolkit and SafeMashups Community Service.

As Ravi Ganesan, founder and CEO of SafeMashups states, "The recent session fixation vulnerability discovered in OAuth is a perfect example of the sort of vulnerabilities that arise when two web services have to communicate via a potentially untrusted user. " Luckily, both companies reiterated their commitment to work through the standards process with other partners to make the MashSSL specification an open standard.

For more about the recent OAuth security hole that exposed a man-in-the-middle vulnerability in Twitter and how MashSSL can be used as a workaround to it, visit our post on the subject here.

Look for more good news from SafeMashups soon!

Erhan J. Kartaltepe,
erhan.kartaltepe-at-utsa.edu

Facebook Now an OpenID Relying Party

As covered previously on this blog, Facebook announced its Facebook Connect feature a few months ago. Similar to OpenID and OAuth, Facebook is attempting to solve the single sign-on (SSO) problem in a proprietary way. Perhaps due to Facebook's joining of OpenID's Foundation Board, Facebook has announced that it will also be a relying party to OpenID, allowing users to login using OpenIDs from familiar providers.

What would be really interesting is if Facebook became an OpenID provider, allowing other sites to use Facebook as their OpenID provider.While Facebook Connect usage statistics are not readily available, it is unlikely that Facebook would cannibalize their competing SSO solution, unless OpenID became a de facto standard, which it has yet to do.

Erhan J. Kartaltepe,
erhan.kartaltepe-at-utsa.edu

Air Force Taps San Antonio for Cyber Command

The Institute for Cyber Security is headquartered in San Antonio, in no small part to help germinate the area's cyber security startups and research. Ravi Ganesan, founder of SafeMashups, the latest startup from ICS to go live, states it like this. "San Antonio has the second-highest concentration of intelligence and classified work after Washington, D.C., and a large military presence," Ravi said. The goal is to...make San Antonio a go-to place for entrepreneurs and jobs."

Today, the U.S. Air Force has selected San Antonio as its preferred location for its new cyber command. Known formally as the the 24th Air Force command, it's expected to have nearly a billion dollar budget, create up to 400 military and civilian jobs, and have an annual payroll of $40 million to $45 million once fully funded.

Good news locally for San Antonio, but it also demonstrates ICS's prime location for startup incubation and security research.

Erhan J. Kartaltepe,
erhan.kartaltepe-at-utsa.edu