ICS Facilitating Inaugural ACM Conference on Data and Application Security and Privacy

The Institute for Cyber Security will be facilitating a conference for the SIGSAC in the Association of Computing Machinery in February 2011 in San Antonio, Texas. The conference, called the Conference on Data and Application Security and Privacy (Or CODASPY) will cover topics on cyber security, data privacy, access control, and other fields related to security.

See the announcement below, and at the the CODASPY site.

1st ACM Conference on Data and Application Security and Privacy

February 2011, San Antonio, Texas
Pending ACM Approval

Announcement: ACM SIGSAC announces the creation of a new annual ACM Conference on Data and Applications Security. The inaugural conference will be held in February 2011 in San Antonio, Texas (exact dates and hotel to be announced). With rapid global penetration of the Internet and smart phones and the resulting productivity and social gains, the world is becoming increasingly dependent on its cyber infrastructure. Criminals, spies and predators of all kinds have learnt to exploit this landscape much quicker than defenders have advanced in their technologies. Security and Privacy has become an essential concern of applications and systems throughout their lifecycle. Security concerns have rapidly moved up the software stack as the Internet and web have matured. The security, privacy, functionality, cost and usability tradeoffs necessary in any practical system can only be effectively achieved at the data and application layers. This new conference provides a dedicated venue for high-quality research in this arena, and seeks to foster a community with this focus in cyber security.

Scope: Data and the applications that manipulate data are the crucial assets in today's information age. With the increasing drive towards availability of data and services anytime anywhere, security and privacy risks have increased. Vast amounts of privacy-sensitive data are being collected today by organizations for a variety of reasons. Unauthorized disclosure, modification, usage or denial of access to these data and corresponding services may result in high human and financial costs. New applications such as social networking and social computing provide value by aggregating input from numerous individual users and/or the mobile devices they carry with them and computing new information of value to society and individuals. To achieve efficiency and effectiveness in traditional domains such as healthcare there is a drive to make these records electronic and highly available. The need for organizations and government agencies to share information effectively is underscored by rapid innovations in the business world that require close collaboration across traditional boundaries and the dramatic failure of old-style approaches to information protection in government agencies in keeping information too secret to connect the dots. Security and privacy in these and other arenas can be meaningfully achieved only in context of the application domain. Data and applications security and privacy has rapidly expanded as a research field with many important challenges to be addressed. The goal of the conference is to discuss novel exciting research topics in data and application security and privacy and to lay out directions for further research and development in this area. The conference seeks submissions from diverse communities, including corporate and academic researchers, open source projects, standardization bodies, governments, system and security administrators, software engineers and application domain experts.

Topics: Include but not limited to

• Application layer security policies
• Authorization /Access Control for Applications
• Authorization/Access Control for Databases
• Data dissemination controls
• Data forensics
• Enforcement layer security policies
• Privacy preserving techniques
• Private information retrieval
• Search on protected/encrypted data
• Secure auditing
• Secure collaboration
• Secure data provenance
• Secure electronic commerce
• Secure information sharing
• Secure knowledge management
• Secure multiparty computations
• Secure software development
• Securing data/apps on untrusted platforms
• Securing the semantic web
• Security and Privacy in GIS/Spatial Data
• Security and Privacy in Healthcare
• Security policies for databases
• Social computing security and privacy
• Social networking security and privacy
• Application, data and user trust metrics
• Web application security

General Chair: Ravi Sandhu, Institute for Cyber Security (ICS), University of Texas at San Antonio

Program Chair: Elisa Bertino, Center for Education and Research in Information Assurance and Security (CERIAS), Purdue U.

Local Arrangements Chair: Jeffrey Reich, Institute for Cyber Security (ICS), University of Texas at San Antonio

Program Committee: To be announced

Conference Web Site: www.codaspy.org

Important Dates: To be announced

Interested Volunteers: Contact Ravi Sandhu at ravi.sandhu@utsa.edu or Elisa Bertino at bertino@purdue.edu as appropriate

Erhan J. Kartaltepe, PMP
erhan.kartaltepe-at-utsa.edu

Edify Friday: GPS Using MonoTouch Tutorial

As readers of this blog know, we at the Institute for Cyber Security are enjoying developing .NET applications for the iPhone using MonoTouch. Since GPS information is so intrinsic to privacy in cyber security, today's Edify Friday covers how easy it is to incorporate GPS data from your iPhone into your MonoTouch applications.

To start off, we'll create a new iPhone MonoTouch Project called HelloWorldGps, which gives us a simple project to start from. To keep things simple, we'll just add a button and label to our MainWindow.xib in Interface Builder. If you're unfamiliar with how to do this, there is a great  "Hello World" tutorial found on the MonoTouch site, as well as a whitepaper on using OpenTK with MonoTouch found in an earlier post. We'll call our label "label" and button "button" and give the button a "Click me" text as shown in Figure 1 below:

Figure 1: MainWindow.xib in Interface Designer

Next, we'll click on the "App Delegate" to give the label and button class outlets under the Identity Inspector, then connect the outlets to the UI elements under the Connections Inspector (see Figure 2).

Figure 2: App Delegate Identity and Connection View

That's all we have to do in the Inspector Builder, so we’ll save our file and go back to MonoDevelop. It should compile without issue.

Now we'll want to create our class that handles the GPS updates. We'll create a class called MyLocationManagerDelegate and have it extend one of the MonoTouch.CoreLocation classes named CLLocationManagerDelegate. This is what will give us our GPS functionality and will do our heavy lifting. All we'll do is override the UpdatedLocation method with a message letting us know when we've received a new location (including our first). See Listing 1 below:

using MonoTouch.CoreLocation;
using System;

namespace HelloWorldGps {
  public class MyLocationManagerDelegate : CLLocationManagerDelegate {
    public override void UpdatedLocation (CLLocationManager manager, CLLocation newLocation, CLLocation oldLocation) {
      Console.WriteLine("Found location.");
    }
  }
}

Listing 1: MyLocationManagerDelegate.cs

Finally, in our AppDelegate class in Main.cs, we'll tie everything together. We'll create a CLLocationManager member (also found in MonoTouch.CoreLocation) and in the method, we'll set its FinishedLaunchingDelegate property to our MyLocationManagerDelegate and call its StartUpdatingLocation method. Lastly, we'll add a delegate to our button so that when it is clicked, it updates our field with our location (or a "No location" message if we haven't received one yet). The AppDelegate class is displayed inListing 2 below.

// The name AppDelegate is referenced in the MainWindow.xib file.
public partial class AppDelegate : UIApplicationDelegate {
  private CLLocationManager lm = new CLLocationManager();

  public override bool FinishedLaunching (UIApplication app, NSDictionary options) {
    lm.Delegate = new MyLocationManagerDelegate();
    lm.StartUpdatingLocation();

    button.TouchDown += delegate {
      string message = "No location update yet";
      if (lm.Location != null) {
        message = "I am at " + lm.Location.Coordinate.Latitude + " " + lm.Location.Coordinate.Longitude;
      }
      label.Text = message;
    };
   
    // If you have defined a view, add it here:
    // window.AddSubview (navigationController.View);
    window.MakeKeyAndVisible ();
    return true;
    }
  }

  // This method is required in iPhoneOS 3.0
  public override void OnActivated (UIApplication application) {
  }
}

Listing 2: AppDelegate class in Main.cs

Don't forget to include using "MonoTouch.CoreLocation;" at the top of Main.cs. At this point, our code should compile without issue, and if we compile and run, the iPhone Simulator should fire up, and once the GPS begins broadcasting a message, the application should give you a location similar to Figure 3 below:

Figure 3: GPS Data in your iPhone

That's all there is to it!

Got a topic that you'd like to see covered in Edify Friday? Leave a comment below or email me!

Erhan J. Kartaltepe,
erhan.kartaltepe-at-utsa.edu

ICS in the News: Ravi Sandhu Interviewed by CNN

Ravi Sandhu, executive director for the Institute for Cyber Security, was recently interviewed in an article by CNN on cyber security, privacy, and identity theft. From the article:

"Online attackers have information on millions of consumers," said Ravi Sandhu... "Still, even visiting a legitimate Web site has its share of risks, because online attackers may inject malicious content onto them by hacking them or placing advertisements that deliver malware."

For more on ICS's work on identity theft, cyber security and privacy, visit the ICS site.

Erhan J. Kartaltepe,
erhan.kartaltepe-at-utsa.edu