European Roadmap for Research on Web Security

The Web platform is a hotbed of innovation that will affect deployment of technologies and applications for the next decade, and will influence the security and privacy that European users and service providers can achieve. The STREWS project will link European security and trust related research and development with ongoing standards and development work for the Web in IETF and W3C. The project will develop a technical state of practice document for Web Security as a basis for case studies on selected Web security topics. A roadmap for future research and standardization in the Web security field will provide guidance for ongoing and future research. Over the course of the project, STREWS will reach out to European industry and projects, and organize a series of workshops to collect broad input into its roadmapping and case study work, and to create a European Web security community across academia and practice

Feeds from partners

From OWASP: OWASP Committees 2.0

22 July 2014, 9:32 pm

OWASP Committees 2.0 Operational ModelPassed by a vote of the OWASP Board of Directors on July 16, 2014. I. IntroductionThere is a disconnect amongst OWASP Leadership in terms of determining who is empowered to make decisions for our organization. It is our belief that the Board has expressed the desire to empower our leaders, but has, at...

>> Read more...

From W3C: First Draft of Mixed Content Published

22 July 2014, 2:19 pm

The Web Application Security Working Group has published a First Public Working Draft of Mixed Content. This specification details how user agents can mitigate risks to security and privacy by limiting a resource???s ability to inadvertently communicate in the clear, or to expose non-public resources to the web at large. This specification...

>> Read more...

From OWASP: AppSec USA 2014 Offers World-Class Training Sessions

15 July 2014, 5:19 pm

“Something that looks like a protocol but does not accomplish a task is not a protocol—it’s a waste of time.”  ― Bruce Schneier, Applied Cryptography You won’t want to miss Bruce Scheier’s keynote at the AppSec USA 2014 conference September 16-19 in Denver.  But you also can’t afford to miss AppSec USA’s two full days of...

>> Read more...

From OWASP: OWASP July 8, 2014 Connector

8 July 2014, 11:35 pm

July 9, 2014 | | www.owasp.org | Contact Us | Brought to you by the OWASP Foundation Featured OWASP ProjectOWASP Java Encoder Project The OWASP Java Encoder is a Java 1.5+ simple-to-use drop-in high-performance encoder class with no dependencies and little baggage. This project will help Java web developers defend...

>> Read more...

From OWASP: Another Staff Update - GK's Last Day

8 July 2014, 6:50 pm

OWASP Leaders - Our Community Manager, GK Southwick, gave her 2 week notice to OWASP on June 27, 2014.  GK's  last day will be this upcoming Friday, July 11.   Although GK has only been with us a short time, we appreciate the hard work and dedication she has had in trying to make headway in managing requests for new and existing...

>> Read more...

From OWASP: AppSec USA 2014 - Denver, CO September 16-19

7 July 2014, 11:03 am

As you know, AppSec USA 2014 is going to be held in Denver, CO September 16-19.  If you have not registered yet, be sure to do so HERE Do not forget that chapter leaders can attend the conference free of charge by using a discount code when registering.  Additionally, there are discount codes for the...

>> Read more...

From W3C: Last Call: Content Security Policy Level 2

3 July 2014, 4:30 pm

The Web Application Security Working Group has published a Last Call Working Draft of Content Security Policy Level 2. This document defines a policy language used to declare a set of content restrictions for a web resource, and a mechanism for transmitting the policy from a server to a client where the policy is enforced. […]

>> Read more...

From Nessos: QASA 2014 - New deadlines

24 June 2014, 9:44 am

QASA 2014 3rd International Workshop on Quantitative Aspects in Security Assurance Affiliated workshop with ESORICS 2014 Wroclow, Poland, September 10-11, 2014 www.iit.cnr.it/qasa2014 *Important dates*: Submission deadline for papers:        July  8 2014 (new!) Notification:                                         July 30 2014 ...

>> Read more...

From Nessos: The 14th edition of the summer school on Foundations of Security Analysis and Design (FOSAD)

21 May 2014, 4:46 pm

14  Edition of the summer school on Foundations of Security Analysis and Design (FOSAD 2014)http://www.sti.uniurb.it/events/fosad14/ The 14th edition of the summer school on Foundations of Security Analysis and Design will be held in in the fascinating Rock of Bertinoro, Italy. This year edition is co-sponsored by NESSoS and...

>> Read more...

From STREWS: First draft of STRINT workshop report available

15 May 2014, 5:53 pm

The first draft of the STRINT workshop report was published by the IETF as the Internet Draft draft-iab-strint-report-00. The same text is also available, with different formatting, from the STRINT Web site as draft-iab-strint-report.html. Co-chair Stephen Farrell summarizes the points on the projection screen during the concluding plenary...

>> Read more...

From STREWS: CfP IEEE Internet Computing special issue on security and the real-time Web

31 March 2014, 6:39 pm

The STREWS project is guest editor for a special issue of the IEEE Internet Computing magazine. The theme is security and the real-time Web. This is a copy of the Call for Papers: Call for Papers The real-time Web (WebRTC) is a maturing technology involving many players in what could be a significant evolution or revolution for voice and...

>> Read more...

From STREWS: A successful STRINT workshop

13 March 2014, 1:18 pm

The STRINT workshop concluded with some preliminary recommendations: Encryption works and needs to be used more, despite its cost (which is steadily going down anyway). Data minimization is worthwhile, too, but difficult: Traffic analysis research and protocol development need to work together. The threat models discussed in the workshop...

>> Read more...

From STREWS: STRINT workshop papers published

8 February 2014, 6:31 pm

The first version of the agenda and the list of submitted papers of the STRINT workshop were published today. The agenda has seven sessions, three on Friday and the rest on Saturday: Threats, COMSEC (part 1), Policy, COMSEC (part 2), Metadata, Deployment, and Break-out sessions There are 66 papers. Together they give an overview of current...

>> Read more...

From Nessos: The Final version of the NESSoS research roadmap is available

2 February 2014, 9:45 pm

The final version of the NESSoS research roadmap is available at the URL:  http://www.nessos-project.eu/media/deliverables/y3/NESSoS-D4.3-PartII-Roadmap.pdf

>> Read more...

From STREWS: Submissions to STRINT workshop closed

21 January 2014, 5:49 pm

The deadline for position papers for the STRINT workshop has passed and submission is now closed. We are pleased with the large number of papers we received. The Program Committee is currently reviewing them and we expect to inform the authors of the results around January 31. The complete workshop program will be published around February 7.

>> Read more...

From Nessos: Project description

12 November 2010, 1:39 pm

The Network of Excellence on Engineering Secure Future Internet Software Services and Systems (NESSoS) aims at constituting and integrating a long lasting research community on engineering secure software-based services and systems.

>> Read more...

From Recent RFCs: RFC 7301: Transport Layer Security (TLS) Application-Layer Protocol Negotiation Extension

This document describes a Transport Layer Security (TLS) extension for application-layer protocol negotiation within the TLS handshake. For instances in which multiple application protocols are supported on the same TCP or UDP port, this extension allows the application layer to negotiate which protocol will be used within the TLS connection.

>> Read more...