Tag Archives: conference

Linux Security Summit 2011 – Schedule Published

For those that didn’t catch the email announcement, the schedule for the 2011 Linux Security Summit is now published.

The format of the conference is refereed talk sessions, followed by in-depth roundtable discussions.

Here’s a summary of the programme:

Refereed talks:

  • “Smack is Alive and Well”
    Casey Schaufler

  • “MeeGo Security Update”
    Ryan Ware, Intel

  • “An Overview of the Linux Integrity Subsystem: Use Cases and Demonstration”
    David Safford and Mimi Zohar, IBM

  • “Digital Signature support for IMA/EVM”
    Dmitry Kasatkin and Ryan Ware, Intel

  • “Protecting the Filesystem Integrity of a Fedora 15 Virtual Machine from Offline Attacks using IMA/EVM”
    Peter Kruus, The Johns Hopkins University Applied Physics Laboratory

  • “Efficient, TPM-free system integrity checking with device mapper: dm-verity”
    Will Drewry and Mandeep Baines, Google

Roundtable discussions:

  • Kernel Hardening
    Lead by Kees Cook, Canonical and Will Drewry, Google

  • LSM Architecture
    Lead by Kees Cook, Canonical and Casey Schaufler

See the full schedule for more detail.

Attendance is open to all registered attendees of the Linux Plumbers Conference.  Early-bird registration is available for LPC until the end of today (US time).

Linux Security Summit 2011 – CFP reminder: 2 weeks!

Calling all Linux security folk!
 

the CFP closes in two weeks...

 

Just a reminder that the CFP for the 2011 Linux Security Summit closes on the 27th of May — two weeks away. Please get your submissions in soon.

Note again that we are co-located with the Linux Plumbers Conference in Santa Rosa, and that all Security Summit attendees, including speakers, will need to register for Plumbers. Earlybird registration is available until 31st May.

Trivia question: which Alfred Hitchcock film was shot on location in Santa Rosa in 1943?

(Hint: click on the image)

Linux Security Summit 2011 (Santa Rosa) – CFP Open

The 2011 Linux Security Summit has been announced, and the CFP is open until the 27th of May.

Following last year’s successful event in Boston, the 2011 Linux Security Summit (LSS2011) will be held on the 8th of September this year in conjunction with the Linux Plumbers Conference.

The program committee is looking for submissions from developers, researchers, and implementors.

If you’ve done anything interesting in Linux security over the last year, it’s time to get a proposal ready and send it in!

Linux Security Summit 2010 – Wrapup

The first Linux Security Summit (LSS) was held last Monday, 9th August in Boston, in conjunction with LinuxCon 2010 North America.

This event has its roots in the Linux security development community which emerged in the early 2000s, following the development of LSM and with the incorporation of a wide range of new security features into Linux. We’d previously met, as a community, in OLS BoF sessions, various conference hallway tracks, and at project-specific events such as the SELinux Symposium. There have also been very successful security mini-summits at LCA in 2008 and 2009, and a double security track at the 2009 Plumbers Conference.

This year, we tried to broaden the scope of the event as far as possible — to situate it with a more general Linux conference (than Plumbers, for example), and bring in not only developers, but the wider end-user community as well. We had great attendance from the security developer community, with pretty much all major areas of development represented, although not as many end-users as we’d hoped for. We were, however, easily able to fill up a days worth of bleeding edge technical discussions, with around 70 developers in attendance throughout.

Presentations were limited to thirty minutes, including discussion, to help ensure an interesting and stimulating event, aimed at fostering ongoing discussion and engagement. In this sense, it seems we were generally successful, with several strong discussions arising during presentations. There were many follow-up meetings between developers, end users and vendors during the remainder of LinuxCon, which was very gratifying to see.

Z. Cliffe Schreuders sparking a lively debate about security usability
Z. Cliffe Schreuders sparking a lively debate about security usability

Mobile security was one of the core issues discussed at LSS (and during the rest of the week), with the year of the Linux desktop now apparently permanently canceled due to smartphones and similar devices. There are certainly many very difficult and exciting challenges to be met in this area over the coming years, and it was great to be able to have the MeeGo security folk present on their work.

Another important area (as always), is security usability, with new high-level policy language work presented by Josh Brindle (lolpolicy). Z. Cliffe Schreuders presented the results of a comparative usability vs. efficacy study from his FBAC-LSM project, sparking some very robust and productive discussion. (Certainly from an SELinux point of view, we are trying to learn as much as possible from this kind of research, which is otherwise very thin on the ground).

Stephen Hemminger presented on the topic of integrating security into a router (Vyatta). This kind of presentation is really very useful to have when there are so many security developers present — it helps us better understand the nature & scope of security requirements for a wider range of real-world users.

Brad Spengler’s presentation addressed the difficult area of protecting the kernel itself, arising from his experiences developing grsecurity. As most of our protection mechanisms operate within the kernel, attacks on the kernel can render these mechanisms useless, so it is important to try and harden the kernel as much as possible. Brad outlined some areas which we still need to address upstream (or in distros, at least), a topic which was further developed by Kees Cook in his talk on Out of Tree security features.

IMHO, we face a number of challenges in this area: 1) core kernel developers are not always receptive to enhanced security, 2) the solutions proposed often are technically not acceptable to upstream (and require a lot of persistent reworking) and 3) we don’t have a huge pool of available expertise upstream in these areas. Kees has taken on some of the challenges here, and any additional contributors here would certainly be welcome, although I would not anticipate any smooth sailing.

We also had project updates from Mimi Zohar on EVM, Karl MacMillan on security management, Dan Walsh on SELinux Sandbox, and Stephen Gallagher on SSSD.

The panel discussion kicked off with a session on the viability of a standard Linux security API. It was good to get a discussion going here, with well-considered input from key developers. It seems the consensus is that our various security models are too fundamentally different to develop the kinds of APIs you might see in proprietary OSes, although the issues are certainly recognized (e.g. hindered ISV and end user adoption of security) and people are thinking about solutions. There are many difficult, open issues in this area, although we really don’t have the option of not solving them — as a society we’re ever increasingly reliant on computing, and thus also on its security.

Casey Schaufler leading the security API panel discussion
Casey Schaufler leading the security API panel discussion

 

There’s already been quite a lot of feedback from attendees on the format and co-location of future events. There was some talk of aiming at a more purely technical conference (e.g. Plumbers), although it seems to me that there was a great benefit in being able to assemble a critical mass of security developers alongside the other LinuxCon developer mini-summits, as well as general end users, vendors etc. A couple of people also mentioned the Collab summit, although I wonder if being invite-only may limit the overall scope of participation. We may also look at a two-day event next year, to allow for keynotes, a few selected longer talks for major new projects, and break-out sessions.

If anyone has feedback or ideas, please join the LSS mailing list and post your thoughts.

Slides from the presentation are now linked from the schedule (where available), and I’ve posted a brief photo set on flickr. If you post any photos or blogs from the event, please tag them with #lss2010, and drop me an email, so I can link to them from the web site.

Overall, it seems that we had a very productive and collaborative event, bringing together key people to discuss ongoing and emerging challenges in Linux security. Indications thus far are that we should expect to see useful developments arise out of discussions begun at this summit, in some of the areas mentioned above.

The Linux Foundation organizers seamlessly provided us with everything we could need in terms of a venue and support — allowing us to concentrate on the program itself. Many folk worked behind the scenes, but I’d like to especially thank Angela Brown, C. Craig Ross and Amanda McPherson.

Also thanks to everyone who presented and attended, and to the program committee, who worked quickly to review and evaluate all the proposals.

Linux Security Summit 2010 (Boston) – Schedule Published

For those who missed the mailing list announcements and tweets, the schedule for the upcoming Linux Security Summit has now been published: click here for the timetable and links to talk abstracts.

The summit is to be held on Monday, 9th of August in conjunction with LinuxCon.   Remember that you need to be registered for LinuxCon to attend the Security Summit (see my last post for details on a registration discount code).  You do not need to pay anything further for the Security Summit.

We had a very strong field of proposals for the summit, and the voting process was reasonably tough.  Proposals required a minimum average score of 4/5 from the program committee to be accepted as a main talk.  We had to reject several good proposals which did not make this grade, and they now have priority as lighting talks.  (Lightning talks will otherwise to be allocated on a first-come first-served basis on the day).

Here’s a summary of the accepted main talks:

  • Recent Advances in the SELinux Sandbox – Dan Walsh, Red Hat
  • in ur webserver, writin ur logs – Joshua Brindle, Tresys
  • Integrating Security into Vyatta – Stephen Hemminger, Vyatta
  • MSF Security Framework Overview – Elena Reshetova, Nokia
  • Access Control in the MSF Security Framework – Janne Karhunen, Nokia
  • Linux Security in 10 Years – Brad Spengler, grsecurity
  • Using EVM to protect security extended attributes – Mimi Zohar, IBM
  • Secstate: Integrating SCAP and Puppet for System Lockdown – Karl MacMillan, Tresys
  • Widely Used But Out-Of-Tree, Kees Cook – Canonical
  • Linux Security Usability, Z. Cliffe Schreuders – Murdoch University
  • System Security Services Daemon (SSSD) – Stephen Gallagher, Red Hat

These talk sessions are intended to be as collaborative and interactive as possible.  They’re thirty minutes each, with at least ten minutes of discussion included. The pace will be fairly brisk, and hopefully leave people wanting more and generating subsequent discussions.  Many people will be there for the week, and it’s been my experience over the years that much of the best discussion ends up happening after the talks in the various hallway and dinner tracks.

We’ll also have a panel session and, as mentioned, lightning talks.  See the schedule page for more details, and for any updates.

I hoped we’d see more proposals from folk on the operational side of things — we probably need to reach out in that direction better next time.  A significant aim of the summit is to foster collaboration between the development community and those running real systems, so if you’re in the latter group, definitely consider attending.  This will be a great opportunity to catch up on current developments in Linux security, and to provide your input and feedback.

Also, please join the event mailing list if you’re planning on attending in any capacity, so we can get any updates out to you, as well as better estimate attendance.  There’s also a Facebook page (which I don’t seem to be able to make public, ironically).

See you there!

Linux Security Summit 2010 – CFP closing this week

Just a reminder that the CFP for the Linux Security Summit ends this Friday, 4th of June.

If you have something interesting to discuss, send your proposal to the program committee via plain text email per the CFP announcement.

We have some very interesting proposals so far — if you have any interest in Linux security, you should probably try and be there.

Note that you need to be registered for LinuxCon to attend. As a speaker at the main conference, I’ve been given a discount code to hand out to people “in my network”. If you’re reading this, you’re in :-) Using the code, you can save 20%, which is currently $80 USD.

That’s enough to buy a Red Sox ticket and a hot dog.

Boston v. NY, 1912
Boston vs. NY, 1912 World Series (LOC).

Email me directly for the code at jmorris@namei.org.

Linux Security Summit 2010 (Boston) – CFP Open

The Call for Participation (CFP) for the 2010 Linux Security Summit has been announced and is open until the 4th of June.

The aim of the Linux Security Summit is to bring developers, researchers and end users together to analyze and solve Linux security challenges.

This is not just for “security people” — it’s intended to be a forum for collaboration between the wider community (sysadmins, operations, architects, developers etc.) and Linux security developers.

Aerial view of Boston

Boston

The format of the event is expected to be a mix of brief technical talks, panel discussions, and lightning talks. It will be held on Monday 9th August, 2010 in Boston, co-located with LinuxCon.

The program committee is currently seeking proposals for talks and panel discussion topics: see the CFP for details.

In particular, we’d like to encourage folks with significant real-world deployments to attend and discuss what they’re doing and what they need in terms of security from the OS.

From a security developer point of view, much effort over the last decade has gone into adding security features to Linux and integrating them into distributions. End users have now been through a few product release cycles with these features, so it seems like a good opportunity now to get together and discuss what’s working, what’s not, and how we can work together to continue improving Linux security.

Attendance is open to all registered LinuxCon delegates.

Videos from the LPC security track

Several videos from the 2009 Linux Plumbers Conference security track have been published at the Linux Foundation video site.   Here’s a listing with the relevant slides:

Many thanks to the folk at LF and the LPC organizers, especially Niv (also for the HTML listing above).

If you attended LPC, or make use of the videos or slide, please drop by this thread at LWN to say thanks.   If you have any suggestions for improvements, feel very free to volunteer your time at the next event.

KCA slides, photos and videos

I was in Brisbane last week to talk about Linux Kernel Security at Kernel Conference Australia (KCA).

The aims of the talk were to provide a general overview of security features in the Linux kernel, and to examine historical context around Unix security and how Linux is evolving to address modern security requirements.

People may be interested in my slides. They’re available as a PDF download and via Slideshare. Note that full speaker notes are included in the slides, in the second half of the deck.

The conference was streamed live online, and the video from my talk may be viewed here. I’m watching to see how the talk, and my speaking in general, might be improved. As painful as this may be, it seems very effective in understanding what worked and what didn’t. I think I can tighten this talk up for possible future use, and focus more on how our development process—not merely the technology—helps address evolving security requirements.

I later participated in an OS security panel with Cristina Cifuentes and Fernando Gont, the video of which is also online.

I’ve also uploaded a flickr photo set. Brisbane is a great location for a conference, especially in the southern hemisphere winter.

It was unusual being the only Linux speaker at a conference. I hope the talk was useful, if at least to encourage more thinking about security in operating systems.

The primary organizer of KCA, James MacPherson, has posted an initial wrap-up of the conference. If the conference continues—I hope it does; it has a lot of potential for the Australian kernel R&D community—I think it would be highly advantageous to more actively seek speakers (and even organizers), from the broader community. One major local Linux kernel developer had a Linux kernel video talk rejected, which seemed odd given that similar talks were accepted (e.g. the new OpenSolaris sound system), and that an additional OpenSolaris talk was added to the program after the CfP closed.

I understand that organizing conferences is difficult, so I hope this is taken as constructive feedback. I’d certainly be interested in helping review papers or otherwise help out in the future if the conference is held again, and if it is aimed at the broader community.