ICS Facilitating Inaugural ACM Conference on Data and Application Security and Privacy

The Institute for Cyber Security will be facilitating a conference for the SIGSAC in the Association of Computing Machinery in February 2011 in San Antonio, Texas. The conference, called the Conference on Data and Application Security and Privacy (Or CODASPY) will cover topics on cyber security, data privacy, access control, and other fields related to security.

See the announcement below, and at the the CODASPY site.

1st ACM Conference on Data and Application Security and Privacy

February 2011, San Antonio, Texas
Pending ACM Approval

Announcement: ACM SIGSAC announces the creation of a new annual ACM Conference on Data and Applications Security. The inaugural conference will be held in February 2011 in San Antonio, Texas (exact dates and hotel to be announced). With rapid global penetration of the Internet and smart phones and the resulting productivity and social gains, the world is becoming increasingly dependent on its cyber infrastructure. Criminals, spies and predators of all kinds have learnt to exploit this landscape much quicker than defenders have advanced in their technologies. Security and Privacy has become an essential concern of applications and systems throughout their lifecycle. Security concerns have rapidly moved up the software stack as the Internet and web have matured. The security, privacy, functionality, cost and usability tradeoffs necessary in any practical system can only be effectively achieved at the data and application layers. This new conference provides a dedicated venue for high-quality research in this arena, and seeks to foster a community with this focus in cyber security.

Scope: Data and the applications that manipulate data are the crucial assets in today's information age. With the increasing drive towards availability of data and services anytime anywhere, security and privacy risks have increased. Vast amounts of privacy-sensitive data are being collected today by organizations for a variety of reasons. Unauthorized disclosure, modification, usage or denial of access to these data and corresponding services may result in high human and financial costs. New applications such as social networking and social computing provide value by aggregating input from numerous individual users and/or the mobile devices they carry with them and computing new information of value to society and individuals. To achieve efficiency and effectiveness in traditional domains such as healthcare there is a drive to make these records electronic and highly available. The need for organizations and government agencies to share information effectively is underscored by rapid innovations in the business world that require close collaboration across traditional boundaries and the dramatic failure of old-style approaches to information protection in government agencies in keeping information too secret to connect the dots. Security and privacy in these and other arenas can be meaningfully achieved only in context of the application domain. Data and applications security and privacy has rapidly expanded as a research field with many important challenges to be addressed. The goal of the conference is to discuss novel exciting research topics in data and application security and privacy and to lay out directions for further research and development in this area. The conference seeks submissions from diverse communities, including corporate and academic researchers, open source projects, standardization bodies, governments, system and security administrators, software engineers and application domain experts.

Topics: Include but not limited to

• Application layer security policies
• Authorization /Access Control for Applications
• Authorization/Access Control for Databases
• Data dissemination controls
• Data forensics
• Enforcement layer security policies
• Privacy preserving techniques
• Private information retrieval
• Search on protected/encrypted data
• Secure auditing
• Secure collaboration
• Secure data provenance
• Secure electronic commerce
• Secure information sharing
• Secure knowledge management
• Secure multiparty computations
• Secure software development
• Securing data/apps on untrusted platforms
• Securing the semantic web
• Security and Privacy in GIS/Spatial Data
• Security and Privacy in Healthcare
• Security policies for databases
• Social computing security and privacy
• Social networking security and privacy
• Application, data and user trust metrics
• Web application security

General Chair: Ravi Sandhu, Institute for Cyber Security (ICS), University of Texas at San Antonio

Program Chair: Elisa Bertino, Center for Education and Research in Information Assurance and Security (CERIAS), Purdue U.

Local Arrangements Chair: Jeffrey Reich, Institute for Cyber Security (ICS), University of Texas at San Antonio

Program Committee: To be announced

Conference Web Site: www.codaspy.org

Important Dates: To be announced

Interested Volunteers: Contact Ravi Sandhu at ravi.sandhu@utsa.edu or Elisa Bertino at bertino@purdue.edu as appropriate

Erhan J. Kartaltepe, PMP
erhan.kartaltepe-at-utsa.edu

ICS in the News: Ravi Sandhu Interviewed by SC Magazine and San Antonio Busiess Journal

Ravi Sandhu, executive director for the Institute for Cyber Security, was interviewed in an article by SC Magazine yesterday on risk management and security assurance. From the article:

"Just deploying products that have achieved a certain level of security doesn't mean your overall system is going to be secure. Let's say you buy a product that does encryption. Encryption can be very strong and resistant to cryptographic attacks, but if you don't manage the keys, your overall system can be compromised...At the end of the day, security is about risk management and risk mitigation at the system level.

Additionally, Ravi was interviewed today by the San Antonio Business Journal on extending the reach of cyber security. From the article:

“Ultimately, (cyber security) will have to develop as a separate field,” Sandhu says. “Right now it is embedded within the computer science field, but it needs to be treated as a discipline by itself.” Sandhu also says most computer science graduates today are coming out with very superficial knowledge of cyber security. Because the field of cyber security is changing and evolving at such a rapid pace, it is not enough for universities to be teaching just the old ideas about cyber security.

For more on ICS's work on risk management, cyber security and assurance, visit the ICS site.

Erhan J. Kartaltepe,
erhan.kartaltepe-at-utsa.edu

Ravi Sandhu Q&A on Information Assurance

Ravi Sandhu, the executive director of the Institute for Cyber Security, was recently interviewed by the good folks at Help Net Security, discussing information assurance and cyber security. In the short interview, he covers such topics as insider threats, managing information-related risks, recommendations for those interested in getting deep infosec/cyber security knowledge. Click here for the full interview.

Erhan J. Kartaltepe,
erhan.kartaltepe-at-utsa.edu

Implications of the Department of Defense Reviewing Social Network Security Implications

TechNewsWorld has an article on how the Department of Defense (DoD) will conduct an overall review of the security implications of allowing members of the military to interact with social networks. According to the article, marines have been banned from using military networks to access FaceBook, MySpace, and Twitter, while the army has complete freedom in that regard. In the meantime, the DoD will review the security risks and values of social networking sites, with a new policy expected by the end of the year.

Of course, banning only three popular social networking sites only from military networks is treating a symptom rather than a cause. As Michael Sutton, vice president of Zscaler's security research department, mentions, "Banning three social networking sites is going to have a negligible impact on network security...and in the end, you're throwing the baby out with the bath water."

This is an interesting case of threat modeling, where one wants to manage risk instead. It'll be interesting to see where the new policy goes.

Erhan J. Kartaltepe,
erhan.kartaltepe-at-utsa.edu