ICS Startup SafeMashups Forms MashSSL Alliance

The latest Institute for Cyber Security startup to go live, SafeMashups, Inc., has just announced the launch of the MashSSL alliance. Read the press release below:

MOUNTAIN VIEW, CA--(Marketwire - November 12, 2009) - A consortium of leading technology companies today announced the creation of the MashSSL Alliance, an organization dedicated to evangelizing the use of the MashSSL technology and specification. MashSSL is an innovative way to use the proven and trusted SSL protocol and trust infrastructure to solve the tricky and serious problem of trust establishment between web applications communicating through an end user at a browser. This is a hard problem as the web applications have to assume that the user in the middle could be a malicious hacker or a legitimate user with a malware infected browser.

The founding members of the Alliance include leading SSL certificate vendors Comodo, DigiCert, Entrust and VeriSign; leading providers of security technology and services Arcot, Cenzic, ChosenSecurity, Denim Group, OneHealthPort, QuoVadis, SafeMashups and Venafi; leading security research institutions Institute for Cyber Security, UTSA, MIT Kerberos Consortium and Secure Business Austria, and noted industry security experts.

"Having been both a vendor and security practitioner, what makes MashSSL such an innovative and elegant solution is the fact that it sits on top of SSL at the application layer and does not disrupt the existing ecosystem -- no new crypto protocols to analyze, no changes to the browser and no new types of credentials," said Lynn Terwoerds, Former Head of Security Architecture & Standards, Barclays GRCB, former Senior Security Strategist, Microsoft, and member of the Cloud Security Alliance. "The ability to significantly reduce the risk involved with online collaboration and transactions opens up a whole new realm of opportunities to both product developers and to security practitioners who need to live in a highly virtualized and cloud based world, where applications and data no longer reside in a single location."

"End users' Web experiences, be it in healthcare or any other vertical, are increasingly an aggregation of data and processing from cooperating Web applications that communicate wholly or partially through the user's browser," said Sue Merk, vice president of business development and product management at OneHealthPort, a coalition of health plans, physicians and hospitals that joined together to build a trusted community where business and clinical information could be shared securely. "Unfortunately, a malicious man-in-the-middle attack or a user infected with man-in-the-browser malware can easily subvert such communications. An open standard to solve this universal problem once, and not in a piece meal ad hoc fashion, has been a long time coming. That it is based on the trusted and familiar SSL certificate infrastructure is a bonus."

MashSSL, which was first developed by application authentication pioneer SafeMashups, has now become an open specification with an open source reference implementation, and is in the process of being standardized.

"Using different proprietary security methods and a multitude of quasi-trusted credentials to solve this fundamental problem is clearly inefficient and will lead to administrative errors which underlie many vulnerabilities," said Siddharth Bajaj, Principal in the Innovation Group at VeriSign and steering committee chair of both the MashSSL Alliance and W3C MashSSL XG. "MashSSL repurposes SSL to create a secure application layer pipe through which open protocols like OAuth, OpenID, OpenAJAX, etc., and proprietary applications like payment provider interfaces can flow in a more secure fashion while leveraging the already existing trust and credential infrastructure."

While MashSSL was originally developed for use with newer mashup technologies, it became rapidly apparent that the protocol can be used in any situation where two Web applications need to communicate through a user's browser, where the user may be malicious or the browser infected with malware. Consequently, the potential field of use for MashSSL is very broad, including potentially underlying identity federation protocols, payment button interfaces, etc.

The initial MashSSL specification and open source reference implementation have been made generally available at www.mashssl.org.

Erhan J. Kartaltepe, PMP
erhan.kartaltepe-at-utsa.edu

Edify Friday: Death Star Threat Modeling

The Institute for Cyber Security, as one may suspect, deals with security issues on a daily basis. Whether it's with our startups in incubation, internal research projects, presentations at conferences, or something else entirely, security vocabulary is used to describe very specific situations. When using terms like "vulnerability" or "threat", which have precise meanings in an information security context, it helps when everyone is on the same page with the vocabulary. Thus, today's Edify Friday covers threat modeling at a high level, with an object lesson at the end:

• An asset is a resource of some value. This value could be real or perceived, and could be different from the owner and the attacker.
• A vulnerability is a weakness that could be exploited to harm the asset. This could be unintended, like a software bug, or intended, such as an assumption that the vulnerability is unlikely to be exploited.
• A threat is something that can harm the asset, usually by exploiting the vulnerability. The intent of the threat is irrelevant, and could be man-made, automated, or natural.
• A risk is the likelihood that the harm will occur. Risk is present in any system, and is a function of an asset's value, the vulnerability's severity, and threat's probability.
• A countermeasure is a control that reduces risk to some level. This must be balanced against the risk probability and the asset's value.

Put another way, risk is the chance that a threat will attack or exploit a vulnerability. My favorite view of this is the "Death Star Threat Model" (shamelessly translated from Kevin William's presentation last year at the Last Hope conference). Here, the asset was the Death Star; the vulnerability of the Death Star was the two meter-wide thermal exhaust port that's shaft lead directly to the reactor system; the threat to the Death Star was the Rebel Alliance's X-wing star-fighters; the risk was the slim chance that a small one-man fighter could penetrate the outer defenses, use a proton torpedo to score a precise hit, and start a chain reaction that will destroy the battle station; and the countermeasure was a deployment of Imperial tie fighters around the Death Star.

That's threat modeling in a nutshell.

Got a topic that you'd like to see covered in Edify Friday? Leave a comment below or email me!

Erhan J Kartaltepe,
erhan.kartaltepe-at-utsa.edu

Texas Emerging Technology Fund Proposals Due in Three Weeks

The Texas Emerging Technology Fund commercialization application deadline is October 20. The Emerging Technology Fund assists startups and other entities helping fund new ideas ripe for commercialization. From the site:

"The goal of the ETF Commercialization Awards is to grow new small businesses and existing businesses to accelerate new products and services to the marketplace...Commercialization awards provide selected, early-stage investments in new, technology-based, private entrepreneurial entities that collaborate with public or private institutions of higher education in Texas, and which, if successful, may provide significant economic benefit to the state.

If you have an idea related to or requiring software engineering, cyber security, cloud computing, or mobile development and would like to collaborate with UTSA's Institute for Cyber Security, contact me at the email address below.

Erhan J. Kartaltepe,
erhan.kartaltepe-at-utsa.edu

ICS in the News: Cyber Startups on the Hunt in Security Arena

Ravi Sandhu, the executive director of the Institute for Cyber Security, was interviewed in an article on how startups are fighting the growing threat of botnets. From the article:

"It's sharing across organizations, within organizations, and increasingly through modes of sharing that people have not been classically doing," says Ravi Sandhu. "What does it even mean to secure a social network? It's not clear. Startups remain fertile ground for [these] new ideas."

As the article states, in addition to this issue, ICS concentrates on security protection for cloud computing, security startups in incubation, and better systems for the military. The article quotes other experts in the realm of startup security, and you can find the full article here.

Erhan J. Kartaltepe,
erhan.kartaltepe-at-utsa.edu

PowerPoint with SmartArt, and Other Videos from "Office Casual"

At the Institute for Cyber Security, our architects and developers have the opportunity to present their ideas to a in a number of venues, whether it's for our security startups in incubation, meetup groups and conferences, and even internal project updates. Suffice it to say, we present a lot of PowerPoint slides, and maybe you do, too!

While checking out blogs.msdn.com I came across this video from Office Casual on how to translate your ideas to slides better and thought it was worth passing on to my staff. The videos are short and a little zany, but Doug Thomas from Microsoft covers everything from slides to resume building to SharePoint, generally using Microsoft Office as a platform in a unique way, and it's definitely worth checking out.

Erhan J. Kartaltepe,
erhan.kartaltepe-at-utsa.edu

Design for Startups: The Aesthetics of Web Apps in 6 Questions

Yesterday, ReadWriteWeb ran an article on a web aesthetics and how important that is for a startup. The article covers questions about trends, aesthetics importance, and meaning signals to users and investors. At the Institute for Cyber Security, we focus on the security and technology of the startups we accept into our incubator program, and facilitate website aesthetics with our graphic design partners. Many of these questions are on the minds of "stealth mode" startup CEOs, but is a great read for any web developer thinking about their website aesthetics. View the article at their site.

Erhan J. Kartaltepe,
erhan.kartaltepe-at-utsa.edu

Comodo and SafeMashups Partner on MashSSL Technology

SafeMashups, Inc., the latest startup from the Institute for Cyber Security to go live, has teamed up with Comodo to further secure web 2.0 protocols. Comodo is a large SSL certificate authority and only the latest in growing number of SSL CAs to interoperate with SafeMashup's free Web Toolkit and SafeMashups Community Service.

As Ravi Ganesan, founder and CEO of SafeMashups states, "MashSSL has the potential to fill a significant hole in the fabric of the Internet with a secure and standard protocol. MashSSL will also drive the adoption of SSL certificates, including EV-SSL certificates in a significant fashion." Both companies reiterated their commitment to work with other partners to rapidly make the standard completely open.

Look for more good news from SafeMashups soon!

Erhan J. Kartaltepe,
erhan.kartaltepe-at-utsa.edu

ICS Startup SafeMashups Named Top 11 Security Company to Watch

SafeMashups, Inc., the latest startup from the Institute for Cyber Security Incubator to go live, has been named one of the eleven security companies to watch by NetworkWorld.

According to the article, SafeMashups is worth watching because its free Web Toolkit and SafeMashups Community Service can change today's mashups' lack of security controls. MashSSL is a protocol to allow one web app to talk to another through a browser in "mashups. There is a neat accompanying slideshow as well.

Look for more from SafeMashups in the coming months!

Erhan J. Kartaltepe,
erhan.kartaltepe-at-utsa.edu

Amazon Announces Third Annual Startup Challenge

At the Institute for Cyber Security, our Incubator focuses on helping security startups benefit from the expertise and resources of our technical staff. As a result, we're always interested in new ways to advance a startup's mission. And of course, ICS loves contests. So when Amazon announced its new AWS startup challenge, we thought it sounded great!

First prize is $50,000 plus other accouterments provideed by Amazon. More information on the contest, as well as a link to their rules, can be found at their contest site. Maybe after collecting your winnings, your startup can be the next great idea to emerge from the ICS Incubator!

Erhan J. Kartaltepe,
erhan.kartaltepe-at-utsa.edu

Firefox 3.5 Released

The good folks behind Mozilla's Firefox made its highly anticipated Firefox 3.5 available today.

As we've discussed before, One of the most interesting advancements to come out of Firefox 3.5 (and IE8) is mainstream cross-domain XHR. Due to the same origin policy concept that all major browsers adhere to, web applications are only allowed to make AJAX-style requests from the browser to their own server Cross-domain XHR provides mainstream support for mashups, but without security underlying it, most enterprises will not adopt them.

The latest startup from the Institute for Cyber Security to go live, SafeMashups, Inc., provides such a authentication and authorization framework in its free web toolkit and SafeMashups Community Service.

Along with enhanced JavaScript enhancements in both mainstream browsers (and Safari 4's recent release), the language's prominence and status has grown. It'll be worthwhile to see what improvements come down the pipes in the next few years.

Erhan J. Kartaltepe,
erhan.kartaltepe-at-utsa.edu