ICS Facilitating Inaugural ACM Conference on Data and Application Security and Privacy

The Institute for Cyber Security will be facilitating a conference for the SIGSAC in the Association of Computing Machinery in February 2011 in San Antonio, Texas. The conference, called the Conference on Data and Application Security and Privacy (Or CODASPY) will cover topics on cyber security, data privacy, access control, and other fields related to security.

See the announcement below, and at the the CODASPY site.

1st ACM Conference on Data and Application Security and Privacy

February 2011, San Antonio, Texas
Pending ACM Approval

Announcement: ACM SIGSAC announces the creation of a new annual ACM Conference on Data and Applications Security. The inaugural conference will be held in February 2011 in San Antonio, Texas (exact dates and hotel to be announced). With rapid global penetration of the Internet and smart phones and the resulting productivity and social gains, the world is becoming increasingly dependent on its cyber infrastructure. Criminals, spies and predators of all kinds have learnt to exploit this landscape much quicker than defenders have advanced in their technologies. Security and Privacy has become an essential concern of applications and systems throughout their lifecycle. Security concerns have rapidly moved up the software stack as the Internet and web have matured. The security, privacy, functionality, cost and usability tradeoffs necessary in any practical system can only be effectively achieved at the data and application layers. This new conference provides a dedicated venue for high-quality research in this arena, and seeks to foster a community with this focus in cyber security.

Scope: Data and the applications that manipulate data are the crucial assets in today's information age. With the increasing drive towards availability of data and services anytime anywhere, security and privacy risks have increased. Vast amounts of privacy-sensitive data are being collected today by organizations for a variety of reasons. Unauthorized disclosure, modification, usage or denial of access to these data and corresponding services may result in high human and financial costs. New applications such as social networking and social computing provide value by aggregating input from numerous individual users and/or the mobile devices they carry with them and computing new information of value to society and individuals. To achieve efficiency and effectiveness in traditional domains such as healthcare there is a drive to make these records electronic and highly available. The need for organizations and government agencies to share information effectively is underscored by rapid innovations in the business world that require close collaboration across traditional boundaries and the dramatic failure of old-style approaches to information protection in government agencies in keeping information too secret to connect the dots. Security and privacy in these and other arenas can be meaningfully achieved only in context of the application domain. Data and applications security and privacy has rapidly expanded as a research field with many important challenges to be addressed. The goal of the conference is to discuss novel exciting research topics in data and application security and privacy and to lay out directions for further research and development in this area. The conference seeks submissions from diverse communities, including corporate and academic researchers, open source projects, standardization bodies, governments, system and security administrators, software engineers and application domain experts.

Topics: Include but not limited to

• Application layer security policies
• Authorization /Access Control for Applications
• Authorization/Access Control for Databases
• Data dissemination controls
• Data forensics
• Enforcement layer security policies
• Privacy preserving techniques
• Private information retrieval
• Search on protected/encrypted data
• Secure auditing
• Secure collaboration
• Secure data provenance
• Secure electronic commerce
• Secure information sharing
• Secure knowledge management
• Secure multiparty computations
• Secure software development
• Securing data/apps on untrusted platforms
• Securing the semantic web
• Security and Privacy in GIS/Spatial Data
• Security and Privacy in Healthcare
• Security policies for databases
• Social computing security and privacy
• Social networking security and privacy
• Application, data and user trust metrics
• Web application security

General Chair: Ravi Sandhu, Institute for Cyber Security (ICS), University of Texas at San Antonio

Program Chair: Elisa Bertino, Center for Education and Research in Information Assurance and Security (CERIAS), Purdue U.

Local Arrangements Chair: Jeffrey Reich, Institute for Cyber Security (ICS), University of Texas at San Antonio

Program Committee: To be announced

Conference Web Site: www.codaspy.org

Important Dates: To be announced

Interested Volunteers: Contact Ravi Sandhu at ravi.sandhu@utsa.edu or Elisa Bertino at bertino@purdue.edu as appropriate

Erhan J. Kartaltepe, PMP
erhan.kartaltepe-at-utsa.edu

Google's Go Programming Language

Google just announced the release of a new, open sourced programming language called Go. The language is experimental, but attempts to combines the performance of C with the development speed of Python. From their blog:

"Go attempts to combine the development speed of working in a dynamic language like Python with the performance and safety of a compiled language like C or C++. In our experiments with Go to date, typical builds feel instantaneous; even large binaries compile in just a few seconds. And the compiled code runs close to the speed of C. Go is designed to let you move fast.

We’re hoping Go turns out to be a great language for systems programming with support for multi-processing and a fresh and lightweight take on object-oriented design, with some cool features like true closures and reflection."

Check out their site, golang.org, for more.

Erhan J. Kartaltepe, PMP
erhan.kartaltepe-at-utsa.edu

The Four Types of Aspect-Oriented Programming (AOP) Weavers

At the Institute for Cyber Security, we use many different technologies to help accomplish our goals. One such technology is Aspect-Oriented Programming (AOP)., where one can "weave" cross-cutting concerns into source code, separating them from core concerns.

While compile-time weaving is common, the weaving process itself can take place at one of four different times: compile-time, post-compile time, load-time, and run-time. The run-time behavior of an application are the same regardless of the approach chosen.

• Compile-time weaving: this is the simplest approach. A compile-time weaver will compile from source and produce woven class files as output. The aspects themselves may be in source or binary form.
• Binary-weaving (also called post-compile-time weaving): this is used to weave existing class files and JAR files. As with compile-time weaving, the aspects used for weaving may be in source or binary form, and may themselves be woven by aspects.
• Load-time weaving: here, binary weaving is defered until the point that a class loader loads a class file and defines the class to the system. To support this, one or more "weaving class loaders", either provided explicitly by the run-time environment or enabled through a "weaving agent" are required. 
• Run-time weaving: this is the weaving of classes that have already been defined to the system without reloading those classes, making it a more dynamic load-time weaver.

Erhan J. Kartaltepe,
erhan.kartaltepe-at-utsa.edu

Aspect-Oriented Programming and AspectJ

At the Institute for Cyber Security, we use many different technologies to help accomplish our goals at ICS Labs and the Incubator. One such technology is Aspect-Oriented Programming (AOP), a programming paradigm allowing the separation of cross-cutting concerns from core concerns. Although many software frameworks such as Spring allow for limited aspect-oriented development, I've always been fond of the AspectJ language as it provides a better pedagogy for aspects and how they differ from objects.

Object-oriented programming (OOP) guides developers into exploiting the expressive power of the object model and uses classes as their fundamental building blocks. Generally, classes may be too specialized for general “drop” reuse, are "tangled" (implementing many requirements of a system), or are used in many places ("scattered" in many classes), such as security or session expiration mechanisms.

Because scattering and tangling defy the OOP paradigm, they are symptoms of “crosscutting concerns”, as they cut across many modules in a program. AOP is an attempt to corral these naturally, with aspects being well-modularized crosscutting concerns. Gregor Kiczales and his team at Xerox PARC originated the concept of AOP and its most popular general purpose language, AspectJ. AspectJ is the most well-known and is a superset of Java (i.e., all AspectJ programs compile to Java bytecode).

In AOP, points in the code where we would want to run our code (instead of writing it in the class itself) are called "join points". A join point can be almost any line of code—a method or constructor call, a field get or set, object initialization, or exception handler execution. AspectJ intercepts program execution flow at these join points and runs the code we want to run instead, called advice, which can happen before, after, or instead of the join point. An aspect describes these join points as pointcuts, which can describe one or more join points.

An example Java program using a simple logging mechanism is shown below. In MainClass.java, two methods are being called, and with code from Logger.java being executed when each method (save the main method) is entered and left.

MainClass class (left) and Logger aspect (right)

In the AspectJ program below, any reference to logging in MainClass.java is removed. In place of the Logger class, the Logger aspect encapsulates the logging concern. It has one pointcut called SayAnything that describes all join points that are methods being called (using the call keyword) that starts with “say” and has any number of parameters. Two advice are associated with the pointcut. The before advice gets the signature of the join point it is in, and prints “Entering” with the signature’s name. The after advice does the same, printing “Leaving” with the signature's name instead. Thus, whenever any of these join point is reached in the execution of the program, it calls the code in the before advice, executes as normal until the end of the join point, and calls the after advice.

MainClass class (left) and Logger aspect (right)

At compile time, the compiler "weaves" the code from an aspect’s advice into the join points their pointcuts describe, leaving .class files that any Java runtime may execute. Because aspects are a superset of classes, they can contain members and methods, and can even extend other aspects or classes, although classes cannot extend aspects. Also, aspects can be quite powerful, able to read and process code with around advice, affecting the execution of the program at runtime in dynamic and very interesting ways. By the same token, AOP and AspectJ's power lend itself to augment code outside its boundaries, possibly leading to software contract-breaking. Like in any paradigm, a little knowledge is a dangerous thing (but a little more knowledge can do wonders).

For more on AOP and AspectJ, the seminal paper on AOP is a great start. There is also a classic series of tutorials on AOP by Ramnivas Laddad online.

Picture at the top shows the difference between core and corss-cutting concerns, pulled from an older version of Apache Tomcat. Red shows the relevant lines of code. The XML parsing capability of the project is well-modularized in one file, whereas the project's logger is used in a large number of places.

Erhan J. Kartaltepe,
erhan.kartaltepe-at-utsa.edu

Amazon Announces Third Annual Startup Challenge

At the Institute for Cyber Security, our Incubator focuses on helping security startups benefit from the expertise and resources of our technical staff. As a result, we're always interested in new ways to advance a startup's mission. And of course, ICS loves contests. So when Amazon announced its new AWS startup challenge, we thought it sounded great!

First prize is $50,000 plus other accouterments provideed by Amazon. More information on the contest, as well as a link to their rules, can be found at their contest site. Maybe after collecting your winnings, your startup can be the next great idea to emerge from the ICS Incubator!

Erhan J. Kartaltepe,
erhan.kartaltepe-at-utsa.edu

ICS Startup SafeMashups, Inc. in the News Again

Hot on the heels of Monday's announcement, the latest startup from the Institute for Cyber Security to go live, SafeMashups, Inc., has been covered quite positively in the news!

Dave Kearns , who knows more than a thing or two about identity management, wrote a great piece at Network World about mashups in general and SafeMashups in specific. He also included a basic truth to the Internet, which is that "everything on our networks has an identity: the devices, the services, the applications--even the data packets," and identity of web applications is what SafeMashup's MashSSL provides. From Dave Kearns: "This is the protocol which will bring safe, trusted mashups to the enterprise."

The information security blog Roer.com penned (or is that typed?) an overwhelmingly positive article on SafeMashups and how it and MashSSL can do for mashups what the original SSL did for the internet a decade ago. The author discusses what MashSSL offers to the B2B market space and states "If you are into mashups, MashSSL is a must-have!", which speaks to how fundamental a technology MashSSL looks to be.

IT Web wrote a great article on SafeMashups and how MashSSL, its application-level authentication protocol, can accelerate the deployment of mashups. It covers both the free MashSSL Web Toolkit being offered by SafeMashups, as well as the free SafeMashups Community Service to add authorization to one's mashups.

Undoubtedly, there will be more news to come! Visit the ICS site to learn more about ICS, the SafeMashups site to learn about MashSSL, and the incubator for how to apply.

Erhan J. Kartaltepe,
erhan.kartaltepe-at-utsa.edu

NSA Updates its Top 25 Programming Security Errors

The NSA, in partnership with MITRE Corp., SANS, and dozens of industry experts from many other organizations, recently updated its Top 25 list of Programming Errors. Similar to the OWASP Top Ten Project, which attempts to categorize programming errors in an effort to provide awareness on web application security, this paper outlines the Top 25 and how they were selected, what makes them insecure, and how to defend against them. Of note are the appendices at the end, especially on threat modeling, which we covered in a recent blog post.

Erhan J. Kartaltepe,
erhan.kartaltepe-at-utsa.edu

Speaking at TRISC Conference Next Month

Folks in Texas who are interested in information security should plan to attend the Texas Regional Infrastructure Security Conference (TRISC) in March. There are a number of great speakers, and if it's anything like last year's, it should be a blast.

I will be speaking Tuesday March 24th about Cross Domain XHR. The talk will cover how server-side and client-side mashup security currently works with cross-domain XHRs and how to use two-party protocols such as TLS in a multi-party environment.

Dates: Monday, March 23 through Wednesday, March 25th, 2009
Location: AT&T Executive Education and Conference Center, Austin, TX (512) 404-1900

For more details, go to www.trisc.org.

Erhan J. Kartaltepe,
erhan.kartaltepe-at-utsa.edu

Free Online JavaFX Class

Sun released JavaFX last month, to overall positive reviews. JavaFX differs slightly from applets in that they aim to allow rapid application development of slick RIA apps like those produced by Flash or Silverlight, but also allow developers to program apps that will run on meager devices such as cell phones and other handheld devices.

If you're interested in JavaFX, and JavaFX tutorials aren't enough for you, there is a free fifteen week JavaFX class being offered by Jim Weaver and Sang Shin. It's an online course that starts next Friday (January 30) and "meets" weekly. Enjoy!

Erhan J. Kartaltepe,
erhan.kartaltepe-at-utsa.edu

Top Five Software Security Myths

Just in time for the New Year, Network World has a five part series called the Top Five Software Security Myths. The series attempts to separate fact from fiction in the software security space. It's an excellent read and reminds one of the practical matters we're involved in at the Institute for Cyber Security. And don't forget, keeping your software and IT infrastructure as secure as possible is a great New Year's resolution.

Erhan J. Kartaltepe,
erhan.kartaltepe-at-utsa.edu