Speaking at InnoTech 2009 on October 29

Jeff Reich, our director of research operations, will be representing the Institute for Cyber Security at the InnoTech 2009 conference, speaking on securing the present and future of cloud computing on Thursday, October 29. Folks in the Austin area who are interested in cloud computing or security (or both!) should plan to attend the talk on Thursday afternoon.

From the InnoTech site: 

"In April of 2009, the Cloud Security Alliance published version 1 of Security Guidance for Critical Areas of Focus in Cloud Computing. Version 2 of this guidance is scheduled for release in October of 2009.

In this session, Jeff Reich and Josh Zachry will provide an overview of the updated guidance and identify some of the key security risks being introduced to the enterprise by the rapid adoption of cloud computing, a look ahead to how cloud computing will transform business and the nature of IT."

Date: Thursday, October 29th, 2009
Location: Austin Convention Center, 500 East Cesar Chavez Street Austin, TX 78701

For more details, go to the chapter site.

Erhan J. Kartaltepe,
erhan.kartaltepe-at-utsa.edu

Speaking at UTSA's Cyber Security Awareness Month Event on October 30

Ravi Sandhu, executive director for the Institute for Cyber Security, will be speaking at UTSA as part of its cyber security awareness month event on Friday, October 30. This event is open to the public and all folks in the San Antonio area who are interested in cyber security should make it to the talk.

Below is the release for the talk.

Title: The Future of Cyber Security
Speaker: Ravi Sandhu
Location: University Center Retama Room (UC 2.02.02) UTSA Main Campus
Date/Time: Friday, October 30, 3:00PM to 4:00PM

Bio: Ravi Sandhu is the Founding Executive Director of the Institute for Cyber Security at the University of Texas at San Antonio, where he holds the Lutcher Brown Chair in Cyber Security. Prior to joining UTSA in 2007 he served on the faculty at George Mason University (1989-2007) and Ohio State University (1982-1989). He holds BTech and MTech degress from IIT Bombay and Delhi and MS and PhD degrees from Rutgers University. He is a Fellow of ACM, IEEE and AAAS, and has received awards from ACM, IEEE, NSA and NIST. His 180+ technical papers have accumulated 10,000+ Google Scholar citations. His research has been funded by NSF, NSA, NIST, DARPA, AFOSR, ONR, AFRL and others. His seminal papers on role-based access control (RBAC) led to RBAC becoming the dominant form of access control in commercial systems. His current projects include his seminal Usage Control model, new models for group-centric information sharing, security in social networking, botnet analysis and defense, high assurance security and the PEI method for secure systems design. He served as founding Editor-in-Chief of ACM TISSEC and Chairman of ACM SIGSAC, and is incoming Editor-in-Chief of IEEE TDSC. He has consulted for numerous industry and government organizations, and has lectured all over the world. He is an inventor on 16 security technology patents. His web site is at www.profsandhu.com.

Erhan J. Kartaltepe,
erhan.kartaltepe-at-utsa.edu

Speaking at ISSA South Texas Chapter on October 8

Jeff Reich, our director of research operations, will be representing the Institute for Cyber Security at the Information Systems Security Association (ISSA) South Texas chapter , speaking on cloud computing and security on Thursday, October 8. Folks in the Houston area who are interested in cloud computing or security (or both!) should plan to attend the talk.

From the ISSA site: 

"In April of 2009, the Cloud Security Alliance published version 1 of Security Guidance for Critical Areas of Focus in Cloud Computing.  Version 2 of this guidance is scheduled for release in October of 2009.  In this session, Jeff Reich will provide an overview of the updated guidance and identify some of the key security risks being introduced to the enterprise by the rapid adoption of cloud computing with a look ahead to how cloud computing will transform business and the nature of IT."

Date: Thursday, October 8th, 2009
Location: Houston Engineering & Scientific Society (HESS), 5430 Westheimer at Yorktown, Houston, TX 77001

For more details, go to the chapter site.

Erhan J. Kartaltepe,
erhan.kartaltepe-at-utsa.edu

PowerPoint with SmartArt, and Other Videos from "Office Casual"

At the Institute for Cyber Security, our architects and developers have the opportunity to present their ideas to a in a number of venues, whether it's for our security startups in incubation, meetup groups and conferences, and even internal project updates. Suffice it to say, we present a lot of PowerPoint slides, and maybe you do, too!

While checking out blogs.msdn.com I came across this video from Office Casual on how to translate your ideas to slides better and thought it was worth passing on to my staff. The videos are short and a little zany, but Doug Thomas from Microsoft covers everything from slides to resume building to SharePoint, generally using Microsoft Office as a platform in a unique way, and it's definitely worth checking out.

Erhan J. Kartaltepe,
erhan.kartaltepe-at-utsa.edu

Speaking at ArcSight Protect 2009 on September 14

Jeff Reich, our director of research operations, will be representing the Institute for Cyber Security at the ArcSight Protect 09 Conference as a panelist in their "Innovators Panel" on Monday, September 14. Folks in the DC or Maryland area who are interested in cloud computing or security should plan to attend the conference in general and the panel in specific as they will discuss security in the cloud.

From the brochure:

"With the increased adoption of cloud computing, many companies are evaluating what type of cloud services and offerings might be attractive to them. But there also seems to be a broad spectrum of potential security concerns when choosing a cloud service or provider that comes into play. How does a potential customer ask a cloud provider the right questions, make sure that the right security controls are in place? What level of transparency about the cloud provider’s security controls and architecture is expected? How can a security team continue to assure the confidentiality and integrity of data and assets if some of them move “into the cloud”? And are there potential security benefits by using cloud based services? In this panel we will ask experts to talk about some of the most common security concerns around cloud computing and will provide guidance on how to address and understand them."

Dates: Sunday, September 13th through Wednesday, September 16th, 2009
Location: Gaylord National Resort & Convention Center, 201 Waterfront Street National Harbor, MD 20745
Phone: 301-861-0650

For more details, go to the conference site.

Erhan J. Kartaltepe,
erhan.kartaltepe-at-utsa.edu

Ravi Sandhu Presenting on Access Control in Lyon, France

Dr. Ravi Sandhu, Executive Director of the Institute for Cyber Security, will be in Lyon, France on August 28, to give a talk for the 6th VLDB Workshop on Secure Data Management. His talk will be on an Access Control Language for a General Provenance Model, alongside fellow ICS colleague Shouhuai Xu. More on the workshop can be found here.

Erhan J. Kartaltepe,
erhan.kartaltepe-at-utsa.edu

ICS Startup SafeMashups Inc. Covered in the News

As covered previously, SafeMashups, Inc., the latest startup from the Institute for Cyber Security, will be speaking at the RSA conference Innovator's Sandbox and has been selected as a finalist in the "Most Innovative Company at RSA Conference 2009" contest they are hosting.

BusinessWire caught the initial press release that discusses each of the ten companies and SafeMashups in specific. From the article:

SafeMashups Inc. is an application authentication pioneer that has developed the MashSSL protocol  which provides a standardized way for web applications to securely identify each other when mashing through a potentially untrusted user or browser. MashSSL allows web applications running emerging Web 2.0 protocols like OAuth, XHR, OpenAJAX, OpenID, etc. to authenticate each other securely using their existing SSL credentials.

SearchSecurity also covered SafeMashups in an article describing how security budget issues may resonate at the RSA Conference, and how vendors that address application security issues are beginning to gain more attention, such as SafeMashups, where its software tools help developers build Web applications more securely. The aricle also mentions the free MashSSL Web Toolkit and free SafeMashups Community Service.

Nemertes Research also highlighed the need for enterprise mashups security in a brief on SafeMashups. In their study, they found 42% of participants are already using mashups, but that for the enterprise, they must implement strong security controls to protect internal mashup applications from insider threats. To this end, SafeMashups has the opportunity to boost enterprise mashup platforms.

More news to come in the following week. Stay tuned!

Erhan J. Kartaltepe,
erhan.kartaltepe-at-utsa.edu

ICS Startup SafeMashups Inc. a Finalist as Most Innovative Company at RSA Conference

For folks who are attending The RSA Conference is the likely the largest and most prestigious cyber security event of the year, the Institute for Cyber Security will be speaking Monday April 20th about ICS's Incubation program in particular and SafeMashups, the first and most mature startup in incubation, in specific.

As it turns out, this year RSA is holding an Innovation Sandbox Monday afternoon, showcasing this year's promising startups. Nearly two hundred entries were submitted as the "Most Innovative Company at RSA® Conference 2009", and of those, only ten were selected as a finalist, one of which was us!

Definitely swing by our booth and listen to our talk as we will cover how server-side and client-side mashup security currently works and how to use two-party protocols such as TLS in a multi-party environment.

Erhan J. Kartaltepe,
erhan.kartaltepe-at-utsa.edu

TRISC Conference Slide Deck Online

The slide deck from my talk at the Texas Regional Infrastructure Security Conference (TRISC) is now up online.

The talk discusses MashSSL as a new standard for establishing trust in mashups. MashSSL is the core product from SafeMashups, Inc., the first startup from the ICS Incubator to go live.

If your applications use cross-domain XHR, OpenAJAX, OAuth, Kerberos, or other technologies, then this talk can help you secure your applications at the application level, even through the browser.

At TRISC 2009: I'm explaining MashSSL to a riveted audience!

Erhan J. Kartaltepe,
erhan.kartaltepe-at-utsa.edu

ICS Startup SafeMashups, Inc. Tutorials and Demos

The latest startup from the Institute for Cyber Security to go live, SafeMashups, Inc., launched this week to excellent reviews!

Emerging as the first trust infrastructure for mashups, SafeMashups has an education center to familiarize the audience on how MashSSL can interoperate with Cross-Domain XHR, OpenAjax, Kerberos, and OAuth, to name a few.

SafeMashups has also created a YouTube channel where all the demos and videos can be found.

Erhan J. Kartaltepe,
erhan.kartaltepe-at-utsa.edu