ICS in the New York Times

Ravi Sandhu, executive director of the Institute for Cyber Security, and Dwayne Williams, associate director of special projects at ICS, were covered in an article for the New York Times. The article covers the San Antonio involvement in Cyberwarfare, and discusses the Institute and, our "Dark Screen" exercise for different municipalities across the country, and the Air Force 24th Command. An interesting read on San Antonio's involvement with DHS, NIS, ICS, and other acronyms, the full article can be found here.

Erhan J. Kartaltepe, PMP
erhan.kartaltepe-at-utsa.edu

Cyber Security Awareness: Free Training and Webcasts

David Pickens posted an article about free cyber security awareness training and webcasts. This is quite appropriate considering October is Cyber Security Awareness Month.

While all are great and each of the eight organizations listed we at the Institute for Cyber Security couldn't help but notice one in particular, highlighting our operational division. From the article: "The operational division of the UTSA Institute for Cyber Security...is designed to leverage its infrastructure assurance and security strengths as part of the solution to the nation's homeland security needs."

To learn more about the training and webcasts, check out the article. For more information on ICS and its operations, commercialization, and research divisions, visit the  ICS site.

Erhan J. Kartaltepe, PMP
erhan.kartaltepe-at-utsa.edu

Speaking at InnoTech 2009 on October 29

Jeff Reich, our director of research operations, will be representing the Institute for Cyber Security at the InnoTech 2009 conference, speaking on securing the present and future of cloud computing on Thursday, October 29. Folks in the Austin area who are interested in cloud computing or security (or both!) should plan to attend the talk on Thursday afternoon.

From the InnoTech site: 

"In April of 2009, the Cloud Security Alliance published version 1 of Security Guidance for Critical Areas of Focus in Cloud Computing. Version 2 of this guidance is scheduled for release in October of 2009.

In this session, Jeff Reich and Josh Zachry will provide an overview of the updated guidance and identify some of the key security risks being introduced to the enterprise by the rapid adoption of cloud computing, a look ahead to how cloud computing will transform business and the nature of IT."

Date: Thursday, October 29th, 2009
Location: Austin Convention Center, 500 East Cesar Chavez Street Austin, TX 78701

For more details, go to the chapter site.

Erhan J. Kartaltepe,
erhan.kartaltepe-at-utsa.edu

Edify Friday: Death Star Threat Modeling

The Institute for Cyber Security, as one may suspect, deals with security issues on a daily basis. Whether it's with our startups in incubation, internal research projects, presentations at conferences, or something else entirely, security vocabulary is used to describe very specific situations. When using terms like "vulnerability" or "threat", which have precise meanings in an information security context, it helps when everyone is on the same page with the vocabulary. Thus, today's Edify Friday covers threat modeling at a high level, with an object lesson at the end:

• An asset is a resource of some value. This value could be real or perceived, and could be different from the owner and the attacker.
• A vulnerability is a weakness that could be exploited to harm the asset. This could be unintended, like a software bug, or intended, such as an assumption that the vulnerability is unlikely to be exploited.
• A threat is something that can harm the asset, usually by exploiting the vulnerability. The intent of the threat is irrelevant, and could be man-made, automated, or natural.
• A risk is the likelihood that the harm will occur. Risk is present in any system, and is a function of an asset's value, the vulnerability's severity, and threat's probability.
• A countermeasure is a control that reduces risk to some level. This must be balanced against the risk probability and the asset's value.

Put another way, risk is the chance that a threat will attack or exploit a vulnerability. My favorite view of this is the "Death Star Threat Model" (shamelessly translated from Kevin William's presentation last year at the Last Hope conference). Here, the asset was the Death Star; the vulnerability of the Death Star was the two meter-wide thermal exhaust port that's shaft lead directly to the reactor system; the threat to the Death Star was the Rebel Alliance's X-wing star-fighters; the risk was the slim chance that a small one-man fighter could penetrate the outer defenses, use a proton torpedo to score a precise hit, and start a chain reaction that will destroy the battle station; and the countermeasure was a deployment of Imperial tie fighters around the Death Star.

That's threat modeling in a nutshell.

Got a topic that you'd like to see covered in Edify Friday? Leave a comment below or email me!

Erhan J Kartaltepe,
erhan.kartaltepe-at-utsa.edu

WASC 2008 Web Application Security Statistics

The Web Application Security Consortium (WASC) released its 2008 report on web application security statistics. Reminiscent of the OWASP Top 10, this discusses in detail data on over 12,000 web applications with over 97,000 detected vulnerabilities. Of note is that despite effort to reduce it, cross-site scripting and information leakage still account for the lion's share of web vulnerabilities.

Most startling from their report is the following:

"The analysis shows that more than 13%* of all reviewed sites can be compromised completely automatically. About 49% of web applications contain vulnerabilities of high risk level (Urgent and Critical) detected during automatic scanning."

The full report can be found here.

Erhan J. Kartaltepe,
erhan.kartaltepe-at-utsa.edu

Visual Studio 2010 Beta 2 Released

Today Microsoft announced the much anticipated release of its second beta version of Visual Studio 2010. The release is available today for MSDN subscribers, and will be available to all on Wednesday. Along with Visual Studio's release beta comes the second beta to .NET Framework 4.0.

Besides a new GUI, Some of its most promising features are in parallel programming and its cloud computing tools for Microsoft's  Azure project (which we recently covered). .NET languages like C# and F# are in heavy use at the Institute for Cyber Security, and we look forward to testing it out in more detail.

Erhan J. Kartaltepe,
erhan.kartaltepe-at-utsa.edu

Edify Friday: GPS Using MonoTouch Tutorial

As readers of this blog know, we at the Institute for Cyber Security are enjoying developing .NET applications for the iPhone using MonoTouch. Since GPS information is so intrinsic to privacy in cyber security, today's Edify Friday covers how easy it is to incorporate GPS data from your iPhone into your MonoTouch applications.

To start off, we'll create a new iPhone MonoTouch Project called HelloWorldGps, which gives us a simple project to start from. To keep things simple, we'll just add a button and label to our MainWindow.xib in Interface Builder. If you're unfamiliar with how to do this, there is a great  "Hello World" tutorial found on the MonoTouch site, as well as a whitepaper on using OpenTK with MonoTouch found in an earlier post. We'll call our label "label" and button "button" and give the button a "Click me" text as shown in Figure 1 below:

Figure 1: MainWindow.xib in Interface Designer

Next, we'll click on the "App Delegate" to give the label and button class outlets under the Identity Inspector, then connect the outlets to the UI elements under the Connections Inspector (see Figure 2).

Figure 2: App Delegate Identity and Connection View

That's all we have to do in the Inspector Builder, so we’ll save our file and go back to MonoDevelop. It should compile without issue.

Now we'll want to create our class that handles the GPS updates. We'll create a class called MyLocationManagerDelegate and have it extend one of the MonoTouch.CoreLocation classes named CLLocationManagerDelegate. This is what will give us our GPS functionality and will do our heavy lifting. All we'll do is override the UpdatedLocation method with a message letting us know when we've received a new location (including our first). See Listing 1 below:

using MonoTouch.CoreLocation;
using System;

namespace HelloWorldGps {
  public class MyLocationManagerDelegate : CLLocationManagerDelegate {
    public override void UpdatedLocation (CLLocationManager manager, CLLocation newLocation, CLLocation oldLocation) {
      Console.WriteLine("Found location.");
    }
  }
}

Listing 1: MyLocationManagerDelegate.cs

Finally, in our AppDelegate class in Main.cs, we'll tie everything together. We'll create a CLLocationManager member (also found in MonoTouch.CoreLocation) and in the method, we'll set its FinishedLaunchingDelegate property to our MyLocationManagerDelegate and call its StartUpdatingLocation method. Lastly, we'll add a delegate to our button so that when it is clicked, it updates our field with our location (or a "No location" message if we haven't received one yet). The AppDelegate class is displayed inListing 2 below.

// The name AppDelegate is referenced in the MainWindow.xib file.
public partial class AppDelegate : UIApplicationDelegate {
  private CLLocationManager lm = new CLLocationManager();

  public override bool FinishedLaunching (UIApplication app, NSDictionary options) {
    lm.Delegate = new MyLocationManagerDelegate();
    lm.StartUpdatingLocation();

    button.TouchDown += delegate {
      string message = "No location update yet";
      if (lm.Location != null) {
        message = "I am at " + lm.Location.Coordinate.Latitude + " " + lm.Location.Coordinate.Longitude;
      }
      label.Text = message;
    };
   
    // If you have defined a view, add it here:
    // window.AddSubview (navigationController.View);
    window.MakeKeyAndVisible ();
    return true;
    }
  }

  // This method is required in iPhoneOS 3.0
  public override void OnActivated (UIApplication application) {
  }
}

Listing 2: AppDelegate class in Main.cs

Don't forget to include using "MonoTouch.CoreLocation;" at the top of Main.cs. At this point, our code should compile without issue, and if we compile and run, the iPhone Simulator should fire up, and once the GPS begins broadcasting a message, the application should give you a location similar to Figure 3 below:

Figure 3: GPS Data in your iPhone

That's all there is to it!

Got a topic that you'd like to see covered in Edify Friday? Leave a comment below or email me!

Erhan J. Kartaltepe,
erhan.kartaltepe-at-utsa.edu

San Antonio Picked to Host Cyber Security Conference

Texas Lyceum has selected San Antonio to host the its first cyber security conference, according to an article in the San Antonio Business Journal. From the article:

“San Antonio’s growing cyber security industry, coupled with the Air Force’s announcement to locate its Cyber Command in the city, makes San Antonio an ideal location to host a conference tackling these issues,” says Texas Lyceum President-Elect John James.

Registration for the conference will open in early January. This should be a cool conference and hopefully the first of more for cyber security events in San Antonio.

Erhan J. Kartaltepe,
erhan.kartaltepe-at-utsa.edu

UTSA Cyber Security Lecture Series This Month

UTSA invites the public to attend free cyber security lectures in observance of Cyber Security Awareness Month. This is its third straight year of observance, and they have a dedicated site for the event that is definitely worth checking out.

As mentioned previously, Ravi Sandhu, executive director for the Institute for Cyber Security, will be speaking at one of these lectures on Friday, October 30. All of these events are free and open to the public, and anyone interested interested in any facet of cyber security should make it one (or all) of them.

Below is the press release for the series:

UTSA Invites Public to Attend Free Cyber Security Lectures

October is Cyber Security Awareness Month

San Antonio … For the third straight year, The University of Texas at San Antonio’s Office of Information Technology (OIT) will observe Cyber Security Awareness Month (CSAM), created by the U.S. Dept of Homeland Security and the National Cyber Security Alliance to raise awareness of information security issues.

During CSAM, UTSA’s Information Security Office will sponsor a variety of lectures designed to underscore the importance of being safe online.  The lectures, which are free and open to the public, will be given by speakers from UTSA, government agencies and the private sector.

UTSA’s Cyber Security Awareness Month 2009 Lecture Series

Kickoff meeting, UTSA Information Security Office
October 19, 3:00 p.m., Retama Auditorium (University Center, 2.02.02, Main Campus)

“Child Safe – Protecting Kids Online” – Lee Carsten, ISSA
October 21, 3:00 p.m., Retama Auditorium (University Center, 2.02.02, Main Campus)

“The Wall of Sheep” – Joseph Mlodzianowski
October 23, 3:00 p.m., Retama Auditorium (University Center, 2.02.02, Main Campus)

“Identity Theft and Protection” – Special Agent Chris Lamb, FBI
October 26, 3:00 p.m., Retama Auditorium (University Center, 2.02.02, Main Campus)

“Automated Vulnerability Attacks” – Billy Austin, SAINT Corp.
October 28, 2:30 p.m., Retama Auditorium (University Center, 2.02.02, Main Campus)

“Child Safe – Protecting Kids Online” – Lee Carsten, ISSA
October 29, 3:00 p.m., FS 1.402 (Downtown Campus)

“Cyber Security- What You Need to Know” – Ravi Sandhu, Ph.D., UTSA Institute for Cyber Security
October 30, 3:00 p.m., Retama Auditorium (University Center, 2.02.02, Main Campus)

In addition to UTSA’s 2009 cyber security lecture series, UTSA students may participate in a Web-based game that will reward them for attending sessions and learning more about information security.  Winners in the “Treasure Island” game may win prizes: an iPod Touch, iPod Shuffle or a Google backpack. The game begins October 16.

“Through CSAM, we hope to increase awareness of information security so that each individual at UTSA can protect themselves and the UTSA community,” said Carolyn Ellis, assistant director, OIT Customer Relations and Communications.

For more information about the lectures or the “Treasure Island” game, please visit the official UTSA cyber security Web site: http://www.utsa.edu/cybersecurity.

#  #  #

About the University of Texas at San Antonio

The University of Texas at San Antonio is one of the fastest growing higher education institutions in Texas and the second largest of nine academic universities and six health institutions in the UT System.  As a multicultural research and teaching institution of access and excellence, UTSA aims to be a premier public research university, providing access to educational excellence and preparing citizen leaders for the global environment.

UTSA serves more than 29,100 students in 64 bachelor’s, 47 master’s and 21 doctoral degree programs in the colleges of Architecture, Business, Education and Human Development, Engineering, Honors, Liberal and Fine Arts, Public Policy, Sciences and Graduate School.  Founded in 1969, UTSA is an intellectual and creative resource center and a socioeconomic development catalyst for Texas and beyond.

Erhan J. Kartaltepe,
erhan.kartaltepe-at-utsa.edu

Speaking at UTSA's Cyber Security Awareness Month Event on October 30

Ravi Sandhu, executive director for the Institute for Cyber Security, will be speaking at UTSA as part of its cyber security awareness month event on Friday, October 30. This event is open to the public and all folks in the San Antonio area who are interested in cyber security should make it to the talk.

Below is the release for the talk.

Title: The Future of Cyber Security
Speaker: Ravi Sandhu
Location: University Center Retama Room (UC 2.02.02) UTSA Main Campus
Date/Time: Friday, October 30, 3:00PM to 4:00PM

Bio: Ravi Sandhu is the Founding Executive Director of the Institute for Cyber Security at the University of Texas at San Antonio, where he holds the Lutcher Brown Chair in Cyber Security. Prior to joining UTSA in 2007 he served on the faculty at George Mason University (1989-2007) and Ohio State University (1982-1989). He holds BTech and MTech degress from IIT Bombay and Delhi and MS and PhD degrees from Rutgers University. He is a Fellow of ACM, IEEE and AAAS, and has received awards from ACM, IEEE, NSA and NIST. His 180+ technical papers have accumulated 10,000+ Google Scholar citations. His research has been funded by NSF, NSA, NIST, DARPA, AFOSR, ONR, AFRL and others. His seminal papers on role-based access control (RBAC) led to RBAC becoming the dominant form of access control in commercial systems. His current projects include his seminal Usage Control model, new models for group-centric information sharing, security in social networking, botnet analysis and defense, high assurance security and the PEI method for secure systems design. He served as founding Editor-in-Chief of ACM TISSEC and Chairman of ACM SIGSAC, and is incoming Editor-in-Chief of IEEE TDSC. He has consulted for numerous industry and government organizations, and has lectured all over the world. He is an inventor on 16 security technology patents. His web site is at www.profsandhu.com.

Erhan J. Kartaltepe,
erhan.kartaltepe-at-utsa.edu