ICS in the News: Ravi Sandhu on Security Threats to Smart Grid Technologies

Ravi Sandhu, executive director of the Institute for Cyber Security, was covered in a release on security threats to smart grid technologies. From the article:

"'Public Utility Commissions have the unique opportunity to determine the security and integrity of the security metering system,' [said] Ravi Sandhu, Executive Director of The University of Texas at San Antonio’s Institute for Cyber Security. 'Historically, the stand-alone, proprietary nature of the mechanical metering system provided a level of security but limited options for expanded utility and flexibility. Networking these systems requires all parties to re-think the security impact on closed networks and their ecosystems. The integrity of the system network must be maintained and the privacy of the consumers’ data must remain confidential'."

The rest of the release can be found here: http://java.sys-con.com/node/1194413.

Erhan J. Kartaltepe, PMP
erhan.kartaltepe-at-utsa.edu

ICS Facilitating Inaugural ACM Conference on Data and Application Security and Privacy

The Institute for Cyber Security will be facilitating a conference for the SIGSAC in the Association of Computing Machinery in February 2011 in San Antonio, Texas. The conference, called the Conference on Data and Application Security and Privacy (Or CODASPY) will cover topics on cyber security, data privacy, access control, and other fields related to security.

See the announcement below, and at the the CODASPY site.

1st ACM Conference on Data and Application Security and Privacy

February 2011, San Antonio, Texas
Pending ACM Approval

Announcement: ACM SIGSAC announces the creation of a new annual ACM Conference on Data and Applications Security. The inaugural conference will be held in February 2011 in San Antonio, Texas (exact dates and hotel to be announced). With rapid global penetration of the Internet and smart phones and the resulting productivity and social gains, the world is becoming increasingly dependent on its cyber infrastructure. Criminals, spies and predators of all kinds have learnt to exploit this landscape much quicker than defenders have advanced in their technologies. Security and Privacy has become an essential concern of applications and systems throughout their lifecycle. Security concerns have rapidly moved up the software stack as the Internet and web have matured. The security, privacy, functionality, cost and usability tradeoffs necessary in any practical system can only be effectively achieved at the data and application layers. This new conference provides a dedicated venue for high-quality research in this arena, and seeks to foster a community with this focus in cyber security.

Scope: Data and the applications that manipulate data are the crucial assets in today's information age. With the increasing drive towards availability of data and services anytime anywhere, security and privacy risks have increased. Vast amounts of privacy-sensitive data are being collected today by organizations for a variety of reasons. Unauthorized disclosure, modification, usage or denial of access to these data and corresponding services may result in high human and financial costs. New applications such as social networking and social computing provide value by aggregating input from numerous individual users and/or the mobile devices they carry with them and computing new information of value to society and individuals. To achieve efficiency and effectiveness in traditional domains such as healthcare there is a drive to make these records electronic and highly available. The need for organizations and government agencies to share information effectively is underscored by rapid innovations in the business world that require close collaboration across traditional boundaries and the dramatic failure of old-style approaches to information protection in government agencies in keeping information too secret to connect the dots. Security and privacy in these and other arenas can be meaningfully achieved only in context of the application domain. Data and applications security and privacy has rapidly expanded as a research field with many important challenges to be addressed. The goal of the conference is to discuss novel exciting research topics in data and application security and privacy and to lay out directions for further research and development in this area. The conference seeks submissions from diverse communities, including corporate and academic researchers, open source projects, standardization bodies, governments, system and security administrators, software engineers and application domain experts.

Topics: Include but not limited to

• Application layer security policies
• Authorization /Access Control for Applications
• Authorization/Access Control for Databases
• Data dissemination controls
• Data forensics
• Enforcement layer security policies
• Privacy preserving techniques
• Private information retrieval
• Search on protected/encrypted data
• Secure auditing
• Secure collaboration
• Secure data provenance
• Secure electronic commerce
• Secure information sharing
• Secure knowledge management
• Secure multiparty computations
• Secure software development
• Securing data/apps on untrusted platforms
• Securing the semantic web
• Security and Privacy in GIS/Spatial Data
• Security and Privacy in Healthcare
• Security policies for databases
• Social computing security and privacy
• Social networking security and privacy
• Application, data and user trust metrics
• Web application security

General Chair: Ravi Sandhu, Institute for Cyber Security (ICS), University of Texas at San Antonio

Program Chair: Elisa Bertino, Center for Education and Research in Information Assurance and Security (CERIAS), Purdue U.

Local Arrangements Chair: Jeffrey Reich, Institute for Cyber Security (ICS), University of Texas at San Antonio

Program Committee: To be announced

Conference Web Site: www.codaspy.org

Important Dates: To be announced

Interested Volunteers: Contact Ravi Sandhu at ravi.sandhu@utsa.edu or Elisa Bertino at bertino@purdue.edu as appropriate

Erhan J. Kartaltepe, PMP
erhan.kartaltepe-at-utsa.edu

Edify Friday: Death Star Threat Modeling

The Institute for Cyber Security, as one may suspect, deals with security issues on a daily basis. Whether it's with our startups in incubation, internal research projects, presentations at conferences, or something else entirely, security vocabulary is used to describe very specific situations. When using terms like "vulnerability" or "threat", which have precise meanings in an information security context, it helps when everyone is on the same page with the vocabulary. Thus, today's Edify Friday covers threat modeling at a high level, with an object lesson at the end:

• An asset is a resource of some value. This value could be real or perceived, and could be different from the owner and the attacker.
• A vulnerability is a weakness that could be exploited to harm the asset. This could be unintended, like a software bug, or intended, such as an assumption that the vulnerability is unlikely to be exploited.
• A threat is something that can harm the asset, usually by exploiting the vulnerability. The intent of the threat is irrelevant, and could be man-made, automated, or natural.
• A risk is the likelihood that the harm will occur. Risk is present in any system, and is a function of an asset's value, the vulnerability's severity, and threat's probability.
• A countermeasure is a control that reduces risk to some level. This must be balanced against the risk probability and the asset's value.

Put another way, risk is the chance that a threat will attack or exploit a vulnerability. My favorite view of this is the "Death Star Threat Model" (shamelessly translated from Kevin William's presentation last year at the Last Hope conference). Here, the asset was the Death Star; the vulnerability of the Death Star was the two meter-wide thermal exhaust port that's shaft lead directly to the reactor system; the threat to the Death Star was the Rebel Alliance's X-wing star-fighters; the risk was the slim chance that a small one-man fighter could penetrate the outer defenses, use a proton torpedo to score a precise hit, and start a chain reaction that will destroy the battle station; and the countermeasure was a deployment of Imperial tie fighters around the Death Star.

That's threat modeling in a nutshell.

Got a topic that you'd like to see covered in Edify Friday? Leave a comment below or email me!

Erhan J Kartaltepe,
erhan.kartaltepe-at-utsa.edu

Implications of the Department of Defense Reviewing Social Network Security Implications

TechNewsWorld has an article on how the Department of Defense (DoD) will conduct an overall review of the security implications of allowing members of the military to interact with social networks. According to the article, marines have been banned from using military networks to access FaceBook, MySpace, and Twitter, while the army has complete freedom in that regard. In the meantime, the DoD will review the security risks and values of social networking sites, with a new policy expected by the end of the year.

Of course, banning only three popular social networking sites only from military networks is treating a symptom rather than a cause. As Michael Sutton, vice president of Zscaler's security research department, mentions, "Banning three social networking sites is going to have a negligible impact on network security...and in the end, you're throwing the baby out with the bath water."

This is an interesting case of threat modeling, where one wants to manage risk instead. It'll be interesting to see where the new policy goes.

Erhan J. Kartaltepe,
erhan.kartaltepe-at-utsa.edu

Ruminations on the Recent OAuth Security Issue

You may have heard about the recent OAuth security hole that left Twitter vulnerable to cross-site scripting attacks. The first response someone looking at the details of the attack and its high media coverage might be to throw up their hands and give up on OAuth altogether.

This is to the wrong way to look at these recent events. The OAuth specification is a great one. Like all great standards, it is easy to read and simple to implement. For example, one of the developers here at the Institute for Cyber Security wrote a robust Java implementation of it in three days from his first look at the specification; there just are not many specs that do something so useful but can be put into practice so easily.

What needs to be understood is that this is exactly how the crypto protocols process works. Any standard worth its salt takes years and years to mature. As an example, SSL was first developed in 1993; people far smarter than I are still improving it a decade and a half later! Yet no one would argue that SSL is not a secure or well-thought-out spec. The fact that this attack even detected shows OAuth is under scrutiny and is gaining traction, which is really a good thing for OAuth. Would you rather use a spec which smart people are trying to break, or a no name spec that only the "wrong smart people" know how to break.

In the end, we do not know what OAuth's fix to this vulnerability will be, but if developers want a quick solution, they may want to consider using the MashSSL protocol that ICS developed with SafeMashups. SafeMashups is our most mature company in incubation, and integrates with OAuth. as well as other popular Web 2.0 standards.

MashSSL a multi-party version of SSL running in the application layer, and from an OAuth-centric standpoint, MashSSL first runs between the Consumer and the Service Provider through the user's browser (using standard SSL certificates for each server; no certificate on the browser is needed or expected). We then set the OAuth credential type to "PLAINTEXT", but all the OAuth messages are encrypted with the SSL "master secret" (the session key the two parties share at end of any SSL session). Except for the first go-round which involves public key operations, all subsequent sessions use the SSL abbreviated handshake, which is very efficient and only uses symmetric key crypto. The session fixation attack will not work as the Service Provider won't operate with a site with which it cannot establish or share an SSL session. So when the "good" URL is moved to "bad" site (as in this OAuth vulnerability), the attack is detected and stopped.

More info on how OAuth can interoperate with MashSSL can be found here. Additionally, a video on MashSSL/OAuth interoperation can be found on the SafeMashups YouTube channel. and in the the education center on the SafeMashups site.

Disclaimers:

1. MashSSL is moving towards becoming an open standard, but is not there yet (and I suppose that there is an infinitely small but non-zero probability that it may not, although the more people that cloamor for it, the sooner that will occur).
2. The software though is available under a perpetual royalty free license so you do not have to pay anything to use it.
3. At the moment it only works with certs from VeriSign (and our own free CA which we absolutely do NOT recommend you use except for testing).

Erhan J. Kartaltepe,
erhan.kartaltepe-at-utsa.edu

Image is a graph of SSL's growth over time. Just as SSL was improved via a battery of tests over time, new cryptographic protocols like OAuth can certainly persevere to become ubiquitous standards.

NSA Updates its Top 25 Programming Security Errors

The NSA, in partnership with MITRE Corp., SANS, and dozens of industry experts from many other organizations, recently updated its Top 25 list of Programming Errors. Similar to the OWASP Top Ten Project, which attempts to categorize programming errors in an effort to provide awareness on web application security, this paper outlines the Top 25 and how they were selected, what makes them insecure, and how to defend against them. Of note are the appendices at the end, especially on threat modeling, which we covered in a recent blog post.

Erhan J. Kartaltepe,
erhan.kartaltepe-at-utsa.edu

Kevin Williams on Death Star Threat Modeling

With the recent news of Internet Explorer's latest Zero Day exploit, I thought it was worth reviewing the notion of threat modelng. Kevin Williams, an old colleague of mine, gives a great introduction to the topic that is friendly even to the non-tech oriented, a difficult feat! He most recently gave the talk at this summer's Last HOPE conference, and gives threat modeling the Star Wars treatment. Enjoy!

Watch Part One here.

Watch Part Two here.

Watch Part Three here.

Erhan J. Kartaltepe,
erhan.kartaltepe-at-utsa.edu