ICS Startup SafeMashups Forms MashSSL Alliance

The latest Institute for Cyber Security startup to go live, SafeMashups, Inc., has just announced the launch of the MashSSL alliance. Read the press release below:

MOUNTAIN VIEW, CA--(Marketwire - November 12, 2009) - A consortium of leading technology companies today announced the creation of the MashSSL Alliance, an organization dedicated to evangelizing the use of the MashSSL technology and specification. MashSSL is an innovative way to use the proven and trusted SSL protocol and trust infrastructure to solve the tricky and serious problem of trust establishment between web applications communicating through an end user at a browser. This is a hard problem as the web applications have to assume that the user in the middle could be a malicious hacker or a legitimate user with a malware infected browser.

The founding members of the Alliance include leading SSL certificate vendors Comodo, DigiCert, Entrust and VeriSign; leading providers of security technology and services Arcot, Cenzic, ChosenSecurity, Denim Group, OneHealthPort, QuoVadis, SafeMashups and Venafi; leading security research institutions Institute for Cyber Security, UTSA, MIT Kerberos Consortium and Secure Business Austria, and noted industry security experts.

"Having been both a vendor and security practitioner, what makes MashSSL such an innovative and elegant solution is the fact that it sits on top of SSL at the application layer and does not disrupt the existing ecosystem -- no new crypto protocols to analyze, no changes to the browser and no new types of credentials," said Lynn Terwoerds, Former Head of Security Architecture & Standards, Barclays GRCB, former Senior Security Strategist, Microsoft, and member of the Cloud Security Alliance. "The ability to significantly reduce the risk involved with online collaboration and transactions opens up a whole new realm of opportunities to both product developers and to security practitioners who need to live in a highly virtualized and cloud based world, where applications and data no longer reside in a single location."

"End users' Web experiences, be it in healthcare or any other vertical, are increasingly an aggregation of data and processing from cooperating Web applications that communicate wholly or partially through the user's browser," said Sue Merk, vice president of business development and product management at OneHealthPort, a coalition of health plans, physicians and hospitals that joined together to build a trusted community where business and clinical information could be shared securely. "Unfortunately, a malicious man-in-the-middle attack or a user infected with man-in-the-browser malware can easily subvert such communications. An open standard to solve this universal problem once, and not in a piece meal ad hoc fashion, has been a long time coming. That it is based on the trusted and familiar SSL certificate infrastructure is a bonus."

MashSSL, which was first developed by application authentication pioneer SafeMashups, has now become an open specification with an open source reference implementation, and is in the process of being standardized.

"Using different proprietary security methods and a multitude of quasi-trusted credentials to solve this fundamental problem is clearly inefficient and will lead to administrative errors which underlie many vulnerabilities," said Siddharth Bajaj, Principal in the Innovation Group at VeriSign and steering committee chair of both the MashSSL Alliance and W3C MashSSL XG. "MashSSL repurposes SSL to create a secure application layer pipe through which open protocols like OAuth, OpenID, OpenAJAX, etc., and proprietary applications like payment provider interfaces can flow in a more secure fashion while leveraging the already existing trust and credential infrastructure."

While MashSSL was originally developed for use with newer mashup technologies, it became rapidly apparent that the protocol can be used in any situation where two Web applications need to communicate through a user's browser, where the user may be malicious or the browser infected with malware. Consequently, the potential field of use for MashSSL is very broad, including potentially underlying identity federation protocols, payment button interfaces, etc.

The initial MashSSL specification and open source reference implementation have been made generally available at www.mashssl.org.

Erhan J. Kartaltepe, PMP
erhan.kartaltepe-at-utsa.edu

ICS in the News: ICS Advises the Air Force Association on its Cyber Defense Competition

Reuters had an interesting article on the operations division at ICS, covering the Air Force Association's Cyber Defense Competition. In the article, the AFA mentions that competition benefits greatly through the advice and assistance of ICS's Greg White, director of ICS's operations division. Through Greg's efforts, ICS also created and conducts the National Collegiate Cyber Defense Competition.

Additionally, The Journal covered the announcement as well, covering how the 125,000-member AFA is geared to promote public understanding of aerospace power and its critical relationship to national security. The article also describes Greg White as a "cyber security expert" and discusses his service as an advisor for the competition.

For more information on ICS and its operations, commercialization, and research divisions, visit the ICS site.

Erhan J. Kartaltepe, PMP
erhan.kartaltepe-at-utsa.edu

Cyber Security Awareness: Free Training and Webcasts

David Pickens posted an article about free cyber security awareness training and webcasts. This is quite appropriate considering October is Cyber Security Awareness Month.

While all are great and each of the eight organizations listed we at the Institute for Cyber Security couldn't help but notice one in particular, highlighting our operational division. From the article: "The operational division of the UTSA Institute for Cyber Security...is designed to leverage its infrastructure assurance and security strengths as part of the solution to the nation's homeland security needs."

To learn more about the training and webcasts, check out the article. For more information on ICS and its operations, commercialization, and research divisions, visit the  ICS site.

Erhan J. Kartaltepe, PMP
erhan.kartaltepe-at-utsa.edu

Texas Emerging Technology Fund Proposals Due in Three Weeks

The Texas Emerging Technology Fund commercialization application deadline is October 20. The Emerging Technology Fund assists startups and other entities helping fund new ideas ripe for commercialization. From the site:

"The goal of the ETF Commercialization Awards is to grow new small businesses and existing businesses to accelerate new products and services to the marketplace...Commercialization awards provide selected, early-stage investments in new, technology-based, private entrepreneurial entities that collaborate with public or private institutions of higher education in Texas, and which, if successful, may provide significant economic benefit to the state.

If you have an idea related to or requiring software engineering, cyber security, cloud computing, or mobile development and would like to collaborate with UTSA's Institute for Cyber Security, contact me at the email address below.

Erhan J. Kartaltepe,
erhan.kartaltepe-at-utsa.edu

Edify Friday: Introduction to MonoTouch Development Using the OpenTK Package

We at the Institute for Cyber Security develop mobile applications and use the .NET Framework with for startups in incubation and our in‐house projects, so when MonoTouch was released last week, it seemed like the perfect marriage of those skill sets. Naturally, as we learned more about it, some things were straightforward and other things left us wanting to learn more. This seemed like the perfect time to introduce a new feature to the ICS Blog: Edify Friday, where we'll take a topic related to cyber security, application development, or technology startups and flesh out a walkthrough or tutorial.

Today's Edify Friday is in whitepaper form and covers how to use the OpenTK package for MonoTouch deployment (click here to read).

Got a topic that you'd like to see covered in Edify Friday? Leave a comment below or email me!

9/28/2009 Update: The whitepaper has now been updated to include a second example using the iPhoneOSGameView class, which greatly simplifies graphics programming. An animation example is now included.

Erhan J. Kartaltepe,
erhan.kartaltepe-at-utsa.edu

ICS in the News: Cyber Startups on the Hunt in Security Arena

Ravi Sandhu, the executive director of the Institute for Cyber Security, was interviewed in an article on how startups are fighting the growing threat of botnets. From the article:

"It's sharing across organizations, within organizations, and increasingly through modes of sharing that people have not been classically doing," says Ravi Sandhu. "What does it even mean to secure a social network? It's not clear. Startups remain fertile ground for [these] new ideas."

As the article states, in addition to this issue, ICS concentrates on security protection for cloud computing, security startups in incubation, and better systems for the military. The article quotes other experts in the realm of startup security, and you can find the full article here.

Erhan J. Kartaltepe,
erhan.kartaltepe-at-utsa.edu

UTSA a Top 10 University Preparing Future Cyber Security Professionals

The New New Internet, about the "many news-makers in the Cyber Security community that also have broad-based market appeal", named UTSA as one of the "Top 10 Universities Preparing Future Cyber Security Professionals".

From the article:

"University of Texas, San Antonio, TX

With the help of several DOD scholarships and a long-standing partnership with the National Defense University, the University of Texas [at San Antonio] provides a steady stream of highly skilled and qualified graduates to the information security sector. Many faculty members have also received federal research grants."

Each listed university is certified National Centers of Academic Excellence in Information Assurance Education by the National Security Agency and Department of Homeland Security. Schools must meet a number of stringent criteria in order to receive certification. In addition, with the Institute for Cyber Security Incubator and the Center for Infrastructure Assurance and Security on campus helping startups and mature companies take their ideas forward, ICS not only helps educate cyber security professionals, we grow them at each stage of their professional lives.

Erhan J. Kartaltepe,
erhan.kartaltepe-at-utsa.edu

PowerPoint with SmartArt, and Other Videos from "Office Casual"

At the Institute for Cyber Security, our architects and developers have the opportunity to present their ideas to a in a number of venues, whether it's for our security startups in incubation, meetup groups and conferences, and even internal project updates. Suffice it to say, we present a lot of PowerPoint slides, and maybe you do, too!

While checking out blogs.msdn.com I came across this video from Office Casual on how to translate your ideas to slides better and thought it was worth passing on to my staff. The videos are short and a little zany, but Doug Thomas from Microsoft covers everything from slides to resume building to SharePoint, generally using Microsoft Office as a platform in a unique way, and it's definitely worth checking out.

Erhan J. Kartaltepe,
erhan.kartaltepe-at-utsa.edu

Design for Startups: The Aesthetics of Web Apps in 6 Questions

Yesterday, ReadWriteWeb ran an article on a web aesthetics and how important that is for a startup. The article covers questions about trends, aesthetics importance, and meaning signals to users and investors. At the Institute for Cyber Security, we focus on the security and technology of the startups we accept into our incubator program, and facilitate website aesthetics with our graphic design partners. Many of these questions are on the minds of "stealth mode" startup CEOs, but is a great read for any web developer thinking about their website aesthetics. View the article at their site.

Erhan J. Kartaltepe,
erhan.kartaltepe-at-utsa.edu

ICS Startup SafeMashups Named Top 11 Security Company to Watch

SafeMashups, Inc., the latest startup from the Institute for Cyber Security Incubator to go live, has been named one of the eleven security companies to watch by NetworkWorld.

According to the article, SafeMashups is worth watching because its free Web Toolkit and SafeMashups Community Service can change today's mashups' lack of security controls. MashSSL is a protocol to allow one web app to talk to another through a browser in "mashups. There is a neat accompanying slideshow as well.

Look for more from SafeMashups in the coming months!

Erhan J. Kartaltepe,
erhan.kartaltepe-at-utsa.edu