The CyberWire Daily Briefing for 7.19.2013

Cyber Attacks, Threats, and Vulnerabilities

'Hangover' Persists, More Mac Malware Found (Dark Reading) Attackers behind the Operation Hangover cyberspying campaign out of India found dropping OS X malware, covering their tracks online. Researchers who this spring unearthed details of a diverse cyberespionage campaign out of India recently also discovered it using additional malware targeting Mac OS X machines, as well as telltale signs that some of the suspected actors behind the hacks know they are being watched online

Former CIA boss says aware of evidence Huawei spying for China (Reuters) Michael Hayden, also the former head of the U.S. National Security Agency (NSA), said in an interview with the paper that Huawei had "shared with the Chinese state intimate and extensive knowledge of the foreign telecommunications systems it is

Confronting Chinese Cyber Espionage (Cyberwarzone) The U.S. and China opened high-level security and economic discussions last week in Washington, and critical cybersecurity concerns are on the agenda. The Administration's diplomatic efforts on cybersecurity, however, have so far failed to deter aggressive Chinese cyber attacks against the U.S. public and private sectors

Amazing quotes from former NSA and CIA boss Michael Hayden on Snowden and China (Quartz) Former CIA and NSA boss Michael Hayden has given a remarkably candid interview with the Australian Financial Review, directly accusing Chinese telecommunications company Huawei of spying for Beijing, condemning Edward Snowden's unprecedented leaks and comparing China's espionage efforts to Germany's unrestricted submarine warfare during World War I. It's an interview worth reading in full, but here are a few key excerpts: Giving China its due

Taiwan Testing ground for China hacking (Cyberwarzone) Taiwan is the frontline in an emerging global battle for cyberspace, according to elite hackers in the island's IT industry, who say it has become a rehearsal area for the Chinese cyber attacks that have strained ties with the US

More Details on EXPIRO File Infectors (TrendLabs Security Intelligence Blog) We recently reported on an unusual attack involving exploit kits and file infectors. What makes the attack even more notable is that the file infectors used also have information theft routines, a behavior uncommon among file infectors. These file infectors are part of the PE_EXPIRO family, which was first spotted in 2010. It's possible that this specific attack was intended to steal information from organizations or to compromise websites

Huawei slammed for locking GCHQ personnel out of security cell (V3) The UK government has welcomed the Intelligence and Security Committee's (ISC) call for a further investigation into Huawei's network security, questioning the effectiveness of its Cyber Security Evaluation Centre (the Cell), and calling for GCHQ personnel to run the unit. The ISC called for the review in a public report, claiming the firm is failing to provide sufficient evidence to prove its network hardware and services are secure, potentially leaving UK telecoms vulnerable to a crippling cyber attack

Researchers warn of WordPress data leak flaw (Cyberwarzone) A vulnerability in the way blogging platform WordPress manages uploaded media files could put users at risk of data leaks, say researchers. A report from security firm WhiteHat claims that the blogging service may not properly protect media files from prying eyes in the same way it guards blog text

Android backup sends unencrypted Wi-Fi passwords to Google (Help Net Security) The recent revelations on how Internet giants such as Google, Yahoo, Apple and others are compelled by the US government to give its agencies access to user data have understandably made researcher

Apps exploiting Android "Master Key" bug offered on Google Play (Help Net Security) Researchers from security firm Bitdefender have unearthed two relatively popular apps on Google Play that leverage the infamous Android "Master Key" bug, but luckily for users who downloaded them

Android security holes just keep on coming (FierceITSecurity) This has not been a good year for the Android mobile operating system from an IT security perspective. Earlier in the year, a survey of more than 103 IT decision makers conducted by Infonetics Research found that roughly one million malicious or high-risk Android apps are expected to be introduced into the enterprise this year

Banking Criminals Zero in on Cellphones (The Street) Plain facts: more of us are doing a lot more reading of email, surfing of web pages and clicking on text messages on smartphones than ever before - duh. Obvious of course

Most enterprise networks riddled with vulnerable Java installations, report says (NetworkWorld) Most enterprise systems have more than one version of Java installed, and the vast majority of them are outdated, security firm Bit9 said

'Write Once, Pwn Anywhere': Less Than 1 Percent Of Enterprises Run Newest Version Of Java (Dark Reading) Most businesses have multiple, outdated versions of the app on their endpoints, new report finds

New vulnerability found in Java 7 opens door to 10-year-old attack (CSO) The vulnerability allows attackers to bypass the Java security sandbox, researchers from Security Explorations said

Newly Found Malware Might Point to Another Windows Zero-Day (Softpedia) Security researchers from an Belarusian antivirus company called VirusBlokAda have found a new piece of malware, which appears to take advantage of a previously undisclosed Windows vulnerability in order to propagate. The flaw allows for arbitrary files to be executed by simply opening a folder containing a malformed shortcut file

Rex Mundi Hackers Leak Numericable Data (eSecurity Planet) The hackers published 6,000 customers' names, e-mail addresses, phone numbers and addresses after the company refused to pay them 22,000 Euros

Anonymous Africa hackers bid to copy Arab Spring (Cyberwarzone) A hacktivist group claiming responsibility for a string of cyber attacks wants to recreate the Arab Spring in Africa, it appears

Anonymous hacked U.S. Congresspeople Accounts,Gave 7 Lesson in Password (Cyberwarzone) Anonymous claims to have hacked the emails and passwords of some Congress persons and a bunch of their staffers, revealing that the members of our esteemed government have terrible password habits

Nasdaq Community Forums Hacked, Passwords Compromised (Cyberwarzone) Computer hackers penetrated a section of the Nasdaq OMX Group's Internet site used as a community forum for discussing stocks, the exchange said Tuesday

Anonymous exposes additional information on FEMA contacts (SC Magazine) Hacker collective Anonymous has taken credit for accessing and releasing a second list containing information for Federal Emergency Management Agency (FEMA) contacts - less than 12 hours after an initial list was released publicly

Anonymous To FEMA: Shall We Play A Game? (InformationWeek) Offended by FEMA's portrayal of fictional hacktivists as anti-American and easily defeated, Anonymous strikes back with data dump

Jay-Z's 'Magna Carta' mobile app is too snoopy, privacy advocates complain (Naked Security) EPIC's filed a complaint with the FTC over the app, a permissions-hungry little beast that wants to know who we're talking to and forces us to hype Jay-Z's latest album on Twitter or Facebook if we want to get song lyrics

The Use of Code Mutation to Produce Multi-use Cyber Weapons (Cyberwarzone) The increasing use of CYBER weapons is creating the inevitable situation in which sophisticated versions ofCYBER weapons capable of generating strategic damage will fall into the hands of states that support terrorism, terrorist organizations, and criminal organizations. CYBER weapons will no longer be the exclusive province of the few. The Stuxnet virus attack on the Iranian nuclear facilities is one such example. For years it operated undetected, but the moment it was discovered the virus code was subjected to in-depth analysis. The results of this research can immediately be put to use to develop new viruses operating similarly to the Stuxnet virus. In other words, once a secret is out, weapons spread

DDoS attacks are getting bigger, stronger and longer (Help Net Security) Prolexic Technologies announced that the average packet-per-second (pps) rate reached 47.4 Mpps and the average bandwidth reached 49.24 Gbps based on data collected in Q2 2013 from DDoS attacks launch

Enterprises turn to DDoS prevention appliances to fend off increasing number of attacks (FierceITSecurity) Distributed denial-of-service attacks, which are intended to bring down a web site by overwhelming it with bogus traffic, have been on the rise over the last few years. DDoS attacks are the weapon of choice for hacktivist groups such as Anonymous. Last fall, financial institutions found themselves in the cross-hairs of DDoS attackers

Security Patches, Mitigations, and Software Updates

Google patches QR code vulnerability in Glass (Threatpost) A Google Glass feature that gives the device the ability to automatically read text also leaves it vulnerable to malicious wireless networks

Cyber Trends

How Does Cyber Warfare Work? (Forbes) What is cyber warfare? Simply put, cyber warfare is the use of hacking to conduct attacks on a target's strategic or tactical resources for the purposes of espionage or sabotage

From cyber espionage to new era of cyber attack (Australian Financial Review) The next generation of cyber threats will have physical ramifications on networks and other assets, says an espionage expert."Most of the unpleasant cyber events we've experienced to date are most accurately described as 'cyber espionage'," says Michael Hayden

Transcript: Interview with former CIA, NSA chief Michael Hayden (Australian Financial Review) The Australian Financial Review held an exclusive interview with General Michael Hayden on a wide range of national security issues. Mr Hayden is the only American to have led both the Central Intelligence Agency and the National Security Agency. He served as director of the NSA between 1999 and 2005, having been appointed by President Bill Clinton. He was appointed director of the CIA by President George W. Bush in 2006 and retired in 2009. Between his NSA and CIA roles Mr Hayden was the Principal Deputy Director of National Intelligence over 2005 and 2006, which meant he was the highest-ranking military intelligence officer in the US armed forces

The Danger of Mixing Cyberespionage With Cyberwarfare (Wired) China has recently been accused of intense spying activity in cyberspace, following claims that the country uses cyber tactics to gain access to military and technological secrets held by both foreign states and corporations. In this context, the rhetoric of cyberwar has also raised its head. Experts are questioning whether we are already at war with China

Video: How NATO's Supreme Commander thinks about global security (Cyberwarzone) Imagine a global security driven by collaboration among agencies, government, the private sector and the public. That's not just the distant hope of open-source fans, it's the vision of James Stavridis, the Supreme Commander of NATO, who shares vivid moments from recent military history to explain why security of the future should be built with bridges rather than walls

Companies admit they are aware of ISO 27001, but only a third are compliant (SC Magazine) The ISO 27001 security compliance standard is well recognised, but only adopted by a third of companies, according to a recent survey

Marrs Maddocks Announces the Importance of Using Insurance to Mitigate Cyber Security Risks (Digital Journal) Business executives around the world are increasingly concerned about the threat of cyber attack - to their companies and their countries. As reported by John Mello, Jr. on CSO, nearly 80% of executives participating in Cyber Ark's Global Advanced Landscape Threat survey felt their nations were at greater risk from cyber attacks than physical attacks. According to Marrs Maddocks and Associates (MM&A), a San Diego insurance agency, the survey results underscore the need for businesses to be more vigilant than ever in protecting their computer systems and in finding ways to mitigate cyber risk

A Y2K Moment For App Security? Don't Hold Your Breath! (VeraCode) A question for debate: SQL injection is as big a threat to the security and integrity of U.S. businesses as the Year 2000 (Y2K) date calculation flaw fifteen years ago. Discuss

DISA Mobile Decision Sends Potent Signal (InformationWeek) Defense Information System Agency's commitment to off-the-shelf mobile tech is likely to ripple across the government as well as health, financial and other security-sensitive industries. The Defense Information System Agency's just-awarded $16 million mobile device management (MDM) and mobile application store (MAS) contract award represents a seminal moment in the history of federal mobile computing and quite possibly the mobile industry at large

BYOD runs wild at most global companies (CSO) More than three quarters in survey said their organizations had not trained employees to understand the privacy risks of BYOD

India, China among world's top spam relaying countries: Sophos (The Economic Times) India and China, which boasts of the world's largest Internet usersbase, are among the most spam-relaying countries in globally, a report by cyber security firm Sophos said today

Will IT GRC Become IRM? (Dark Reading) Analysts report a shift toward Integrated Risk Management across the enterprise, but IT risk management experts argue on how it'll happen. The differences in risk management information gathering, tools, and processes used by business operations and IT teams is at once introducing redundancies in the way that these two groups operate and gaps in how they communicate. According to a recent analysis by Enterprise Strategy Group (ESG), many enterprises are examining how to better roll up IT governance, risk and compliance (GRC) into a broader framework called integrated risk management (IRM)

Marketplace

White-Hat Hackers: Meet the geeks who make computing safer by exposing its flaws (Riverfront Times) For his next trick, Wayne Burke will demonstrate how to begin hacking NATO. Theoretically, of course. If one were into that sort of thing. But first, a mic check. "Are there any government guys in the audience?" asks Burke as he scans the dozens of computer geeks assembled in a conference room at the Ameristar Casino in St. Charles last month

Fortinet Wins Frost & Sullivan APAC Network Security Vendor of the Year Award (Fortinet) Industry leading market strategy, technological innovation and customer support gives Fortinet the crown in Asia Pacific

SCADA vendor faces public backlash over bug bounty program (CSO) IntegraXor offers unique bug bounty program, receives stiff criticism for prize offering

Dell shareholders face uncertain near-term future (FierceFinance) The Dell special committee, as expected, elected to adjourn the scheduled special meeting without voting on the $13.65 a share deal that the committee had been backing. It would appear that there are just too many shareholders unwilling to support it. In the past few days, the likes of BlackRock, Vanguard, T. Rowe and others have made clear that they think the deal shortchanges them

Network Solutions Loses Customers Over Outage (Wall Street Journal) The outage, which left many small and medium-sized companies without a website or email, was caused by a cyber attack similar in type to the ones that have impacted banking websites. Some customers who use Network Solutions' domain name hosting

INFOSEC's Rising Stars and Hidden Gems: the Defenders (Tripwire) In the run-up to Black Hat, Defcon, and BsidesLV, we thought it pertinent to highlight some of the best and brightest infosec pros in the business - some of whom are long-standing veterans who deserve more attention, and some are emerging influencers we should all be paying attention to

Products, Services, and Solutions

Risk assessment and workflow improvement in new version of Stream (SC Magazine) According to the company, features include an unlimited enterprise tree structure for organising risk registers and reporting views, as well as improved workflow to support planning and control of risk assessment and acceptance activities. Also contained within this release are multiple risk assessment schemes, a flexible hierarchical asset management capability and a simplified menu structure based on risks, controls, events and actions

New Check Point 13500 Appliance Combines Multi-Layer Data Center Security With Market-Leading Performance (Productivity Applications) Introduces 13000 Appliance Family for High-Performance Data Center Cyber Security

Advanced Log Intelligence Enables Faster Breach Detection (Tripwire) Tripwire has announced the availability of Tripwire Log Center (TLC) 7.0 featuring the first phase of integration with IP360™, as well as Tripwire's new VIA Agent advanced log intelligence and analytics, and enhanced correlation analytics designed to drive improved log intelligence

How Firefox OS plans to kill — not reinvent — the app store (VentureBeat) Mozilla has posted another video about Firefox OS. Intended for app developers, the clip explains a bit about how and why distribution will workRead more at

Technologies, Techniques, and Standards

Cyber Intelligence Tsunami (Internet Storm Center) This week fellow handler Chris posted about gathering intelligence from Blog Spam, and the SANS ISC has posted a number of times about Cyber Intelligence as a valuable resource, and as by now you all should know that Russ may have posted on his Blog about CIF, the Collective Intelligence Framework

Wall Street batters defenses in make-believe cybercrisis (CSO) War games, dubbed Quantum Dawn 2, designed to test preparedness for cyberattacks aiming to disrupt the nation's economy

Wall Street Is Mock-Hacking Itself to Prepare for a Potential Massive Cyberattack (Motherboard) When 50 major financial firms, the Department of Homeland Security, the US Treasury, and the Federal Reserve team up to see if they could to keep the market from crashing in the event of a major cyberattack, you know people are starting to get nervous

Combating A New Era of Cybercrime (Fox Business) Correct and and essentially they have the best people from the incident response team so the heads of cyber security from fifty various -- associations as well as department of homeland security and the regulators. Partaking in the simulation with a

'Quantum Dawn 2' Is a Cyber-Attack Bank Drill (Bloomberg) Trustedsec CEO David Kennedy and Security Compass Managing Director Sahba Kazerooni discuss testing banks readiness for cyber-attacks

Tackling Cybersecurity Risk at Financial Institutions (Security Management) Risk management is an inherent component of any financial institution's business operations, whether it be market risk, credit risk, or reputational risk. Cyber attacks are a rapidly growing threat that can affect those other risks, said Thomas Sanzone, executive vice president at Booz Allen Hamilton, at a webinar on the topic presented jointly by his firm and the Financial Services Information Sharing and Analysis Center (FS-ISAC). Sanzone leads the firm's commercial financial services business. During the webcast, he emphasized that many financial services companies don't prioritize cyber risk as high on the scale as they should. "In an average financial institution they're looking at risk as market risk, credit risk, and operational risk--and the cyber risk can affect all three, and that's not as well understood as it could be," he said

Endgame Gets Piggish With Malware Data Samples At Black Hat (Silicon Angle) In just over a week, Black Hat USA 2013 will be convening at Caesar's Palace in Las Vegas. In this series, intended to preview many of the talks and presentations scheduled for the event, SiliconANGLE will focus on the exploitative vulnerabilities associated with big data and how those vulnerabilities can be limited

Metrics: Valuable security indicator or noise? (Help Net Security) Many organisations believe that IT, and by association IT Security, is a wasted expense. They recognize that the financial investment needs to be made but few truly understand what they're rubber-stamped

Five ways to protect your supply chain from cyber attacks (Australian Defence Magazine) BAE Systems Detica has released what they consider the top five ways about how businesses can protect supply chains from cyber attacks

Seven clues to identify who is behind advanced cyber attacks (Cyberwarzone) Although cyber attacks have grown more advanced and tenacious in recent years, there is still no such thing as the perfect crime. Every stage of the attack kill chain—reconnaissance, weaponization, delivery, exploitation, installation, command and control, and actions on objectives (usually exfiltration)—can leave behind a digital paper trail

The Price of Privacy (Kaspersky Lab Daily) We always talk about the need to leave no trace of your activities on the Internet. Some folks may call us a little bit paranoid, after all, what could be wrong with a site remembering you were there and clicked through to another site? Well, let us tell you

Design and Innovation

Freedom Of Information Act Machine Fights Government Secrecy By Automating Transparency Requests (TechCrunch) The Freedom of Information Act Machine, an open online platform that automates Freedom of Information Act (FOIA) requests, launched on Kickstarter two days ago and has already surpassed its funding goal. At the time of publication, it had cleared $20,000 in funding from over 600 backers

Academia

With universities under attack, security experts talk best defenses (CSO) Like U.S. corporations, universities are battling a growing number of cyberattacks, believed to be mostly from China

Norwich Leadership Summit pairs graduate students with business organizations (The Northfield News) How can students from a wide swath of professional expertise, including leadership, information assurance, business, nursing and history, contribute? Last month, 36 graduate students from Norwich University's online College of Graduate and Continuing

Rensselaer Polytechnic Institute To Train U.S. Navy Officers in Information Technology and Web Sciences (RPI News) The U.S. Navy is turning to the Information Technology and Web Science (ITWS) Program at Rensselaer Polytechnic Institute to prepare a select group of U.S. Navy officers with skills needed for military cyberspace operations. Under a three-year agreement, the Navy will enroll a group of five to 10 officers yearly in a new "information dominance" concentration within the Master of Science in Information Technology degree program at Rensselaer

Trend Micro Launches New Intern Program, Offers Cyber Security Scholarships, Performance Incentives (Herald Online) Trend Micro Incorporated (TYO: 4704; TSE: 4704), a global leader in security software and solutions, announced a new global internship program today. Inspired by CEO Eva Chen, the initiative will offer a behind the scenes look at a global pioneer in security and privacy technology. These interns - known as, "TrendTerns" - will also have the opportunity to earn academic scholarships and other performance incentives while gaining real-world experience

Outsmarting hackers (UDaily) "Cryptography enables you to send secret code and hide information within a network to keep it secure," Billy Bednar, a University of Delaware senior, told U.S. Sen. Tom Carper during a conference call Wednesday, July 18

University of Virginia gets failing grade in information security (FierceITSecurity) The University of Virginia, while an elite academic school, gets failing marks when it comes to information security. In its latest gaffe, the university supplied social security numbers and other personal information to Aetna Health Care, which sent out health insurance brochures to 18,700 students with the SSNs appearing on the mailing address label

Legislation, Policy, and Regulation

Change Ahead for Global Governance of the Internet (SIGNAL) With news headlines about the United States spying on allies creating distrust, Internet governance issues could continue to be contentious at next year's International Telecommunications Union meeting, according to Google's Vint Cerf

Hostile Hill territory on NSA surveillance issue (Philly.com) At a House Intelligence Committee hearing just a month ago on highly controversial National Security Agency surveillance issues, administration officials were well treated by both Republicans and Democrats. Wednesday's return trip to

US: National Security Agency admits to spying on more people than previously thought (Codewit Global Network) Quizzed about the government's investigative methods during a House of Representatives Judiciary Committee hearing early Wednesday, National Security Agency Deputy Director Chris Inglis said that the government obtains basic information pertaining to

50 Politico to Watch: Chris Inglis (Politico) Chris Inglis has spent a long time making a case for the National Security Agency behind the scenes -- but recently found himself in the spotlight. The agency's deputy director has spent his professional life inside America's largest spy agency

Anti-NSA Campaign Could Lead to Another 9/11 (Accuracy in Media) The first Assistant Secretary for Policy at the United States Department of Homeland Security warned Congress on Wednesday that "hyped and distorted press reports" about the NSA's terrorist surveillance programs "may cause us--or other nations--to construct new restraints on our intelligence gathering, restraints that will leave us vulnerable to another security disaster"

House Vets Cybersecurity Executive Order (Multichannel News) Hearing witnesses from the National Institute of Standards and Technology (NIST) and the Department of Homeland Security assured the subcommittee that the they were still focused on a voluntary framework and that the "buy-in" from industry stakeholders

Apple, Google, Facebook Join Civil Liberties Groups for NSA Transparency Push (TIME) The largest Internet companies in the United States have joined forces with top civil liberties groups to call on the White House and Congress to increase the transparency surrounding the government's controversial National Security Agency surveillance

Lift The Veil Of Secrecy On The Nation's Security Court (USA Today) Until recently, few Americans had ever heard of the Foreign Intelligence Surveillance Court, or the FISC as it's known by national security insiders. And that was just fine with the government

'The System Works Well As It Is' (USA Today) Changing the court process to approve Foreign Intelligence Surveillance Act (FISA) orders into an adversary proceeding may sound reasonable, but the system works well as it is and the proposed change wouldn't make it better

NSA Chief Suggests Phone Companies Could Store Calling Records (Washington Post) The director of the National Security Agency said Thursday that he is open to the idea of allowing telephone companies, rather than the NSA, to store vast pools of calling records that could be used in counterterrorism cases

N.S.A. Imposes Rules To Protect Secret Data Stored On Its Networks (New York Times) Hours before General Alexander described the new defenses, Ashton B. Carter, the deputy secretary of defense, said the conditions that allowed Mr. Snowden to download and remove data without detection amounted to "a failure to defend our own networks"

U.S. Overhauling Intel Access In Bid To Prevent Another Snowden (Reuters) U.S. intelligence agencies conducting a forensic review of the activities of Snowden, a former National Security Agency contractor, are close to pinning down the extent of the classified documents he accessed and the means by which he removed materials from a secure environment, according to intelligence and security officials close to the investigation. Carter declined to delve into details, saying the assessment was still ongoing. But he added: "I can just tell you right now the damage was very substantial"

Germany backs away from claims NSA program thwarted five attacks (Cyberwarzone) German Interior Minister Hans-Peter Friedrich is backing off his earlier assertion that the Obama administration's NSA monitoring of Internet accounts had prevented five terror attacks in Germany, raising questions about other claims concerning the value of the massive monitoring programs revealed by NSA leaker Edward Snowden

Are the government's cyber-security schemes working? An insider's view (ITProPortal) 2013 has been awash with government initiatives to tackle cyber-security, and the regularity of attacks on major public and private sector organisations suggests the vast sums of money being pumped into the schemes is vindicated. But raw investment and end results are two very different things, so we spoke to someone at the top of his tree in the IT security industry to see just how effective state action has been in reducing threat levels in the UK

Tavenner confirms controversial data hub complete (FierceHealthIT) The controversial data hub that will connect state health insurance exchanges created under the Affordable Care Act with federal agencies--including the Internal Revenue Service--has been completed, according to Centers for Medicare & Medicaid Services Administrator Marilyn Tavenner (pictured). The hub will be used to help determine who will qualify for government subsidies when purchasing individual health insurance plans

Defining R&D across DHS could save money (FierceHomelandSecurity) Unlike NASA and the Defense Department, the Homeland Security Department has no common definition for research and development, David Maurer of the Government Accountability Office said during a Senate hearing July 17

Another Senior Cybersecurity Leader to Exit DHS (BankInfoSecurity.com) Bruce McConnell, acting deputy undersecretary for cybersecurity, says he'll resign from the Department of Homeland Security on Aug. 10, making him the … Imagine, McConnell said, a cyber-attack that disables electrical power in a major metropolitan area

Worldwide cyber Strategies & cyber Policies (Cyberwarzone) The listed countries like Australia, Austria, Canada, Denmark and Luxembourg have published their national cyber strategies online. The collected cyber strategies are all PDF files and they are hosted on the owners website. We do have an backup of all the cyber strategies that have been published online. In 2009 Australia published their Cyber Security Strategy — since then there has not been a new publication by the government of Australia. Austria published their strategy here in 2013 and Canada published their report for a stronger and more prosperous Canada

Litigation, Investigation, and Law Enforcement

MIT Moves to Intervene in Release of Aaron Swartz's Secret Service File (Wired) Lawyers representing MIT are filing a motion to intervene in a FOIA lawsuit over thousands of pages of Secret Service documents about the late activist and coder Aaron Swartz

Fighting the Industrialization Of Cyber Crime (UN Chronicle) Five years is a very long time in cybercrime. In this period, we have witnessed the maturity of the digital underground economy, the emergence of hacktivism and the rise of botnets

Judge Denies Manning Defense Request to Dismiss Charges (U.S. News & World Report) Manning's trial began at Fort Meade, Md. in early June and may continue as long as late August. The charge for aiding the enemy is among the most serious of the 21 against Manning, who faces life in prison without the possibility of parole if found

Putin Critic Gets 5-Year Jail Term, Setting Off Protests (New York Times) Russia's most prominent opposition leader was sentenced to five years in prison on Thursday for embezzlement, setting off protests that condemned the verdict as part of a campaign by President Vladimir V. Putin to corral the opposition and block the rise of a popular challenger

Why Putin Despises Snowden (Moscow Times) When Edward Snowden, with the assistance of his curators in the Russian government, held his makeshift news conference last Friday in Sheremetyevo Airport's transit zone, it was no surprise that pro-Kremlin opinion makers dominated the short, invitation-only list of attendees. Among them were prominent lawyer and Public Chamber member Anatoly Kucherena, political analyst and State Duma Deputy Vyacheslav Nikonov and human rights ombudsmen Vladimir Lukin. Basking in the spotlight amid Snowden's sudden reappearance after nearly a month of being incognito in the airport's transit zone, they took full advantage of this PR opportunity, explaining to several hundred journalists on hand that Russia should offer Snowden political asylum because he is a refugee of U.S. repression

A Shortage Of Courage (Washington Post) Edward Snowden is no Socrates and no Martin Luther King

For a complete running list of events, please visit the Event Tracker.

Upcoming Events

2013 World Comp (Las Vegas, Nevada, USA, Jul 22 - 23, 2013) 2200 leading researchers, academics, and executives from government, academia and industry will come together at this annual event which facilitates communication among researchers in different fields of computer science, computer engineering, and applied computing.

EAGB Summer Quarterly Webinar (Webinar, Jul 24, 2013) Join us Wednesday, July 24 from 10:00-11:00 AM as Patrick Dougherty discusses the EAGB's two newest reports: the Summer 2013 Quarterly Regional Economic Update and Cyber Security in Greater Baltimore: State of the Market Report. The EAGB is pleased to welcomespecial guest Karl Gumtow, Co-Founder and CEO of CyberPoint International, to discuss trends in the Cyber Security market and the future of the industry.

Black Hat 2013 (Las Vegas, Nevada, USA, Jul 27 - Aug 1, 2013) Black Hat USA is a major international security conference, featuring learning, networking, and skill-building. Sessions include training, briefings, technical presentations, and more.

SECRYPT 2013 (Reykjavik, Iceland, Jul 29 - 31, 2013) The 10th International Conference on Security and Cryptography (SECRYPT 2013) will take place from 29 to 31 July 2013 in Reykjavik, Iceland…The conference will focus on information systems and network security, including applications within the scope of knowledge society in general and information systems development in particular, especially in the context of e-business, internet and global enterprises. It will bring together researchers, mathematicians, engineers and practitioners interested in security aspects related to information and communication.

AFCEA Global Intelligence Forum (Washington, DC, USA, Jul 30 - 31, 2013) During this day and one half unclassified conference in the National Press Club in downtown Washington, D.C., leaders from across the government, military, and industry will explore the role that the Intelligence Community can play in helping to ensure free and secure cyberspace operations -- from setting requirements, to collecting and analyzing data, to delivering insights and recommendations. In the end, the discourse will look at where industry can partner with the government to provide cyber situational awareness, indications, and warning. Eugene Kaspersky will deliver the keynote. As of July 17, twenty-five seats remain available.

International Conference on Cyber Security (New York, New York, USA, Aug 5 - 8, 2013) The Federal Bureau of Investigation and Fordham University will host the fourth International Conference on Cyber Security (ICCS 2013) on August 5 - 8, 2013 in New York City. ICCS, the White Hat Summit, is an unparalleled opportunity for global leaders in cyber threat analysis, operations and law enforcement to coordinate their efforts to create a more secure world. With the number of cyber threats escalating worldwide, the need for comprehensive security analysis, assessment, and actions has never been greater. Join those working on the front-lines of secure cyber networks at ICCS for the opportunity to learn useful knowledge and share critical intelligence on issues shaping the future of cyber security.

SINET Innovation Summit (New York, New York, USA, Aug 6, 2013) The purpose of the Innovation Summit is to reinvigorate public private partnership efforts and increase relationships between industry, government and academia that fosters sharing of information and collaboration on mutual Cybersecurity research projects.

3rd Annual Cyber Security Training Forum (Colorado Springs, Colorado, USA, Aug 6 - 7, 2013) The Information Systems Security Association (ISSA) - Colorado Springs Chapter and FBC, Inc. will once again host the 3rd Annual Cyber Security Training Forum (CSTF). Formerly known as the Cyber Security Training Conference, CSTF is set to convene from Tuesday August 6, 2013 to Wednesday, August 7, 2013 at the DoubleTree by Hilton, Colorado Springs, Colorado.CSTF 2013 will bring together cyber experts from the DoD, federal government, business, research, and academia to address: the latest DoD and government cyber policies, remediation strategies and best practices, the growing impact, and evolution, of cyber threats and how to continue to protect and defend the Global Information Grid (GIG), mobility strategies, cloud & virtualization advancements, and emerging technologies. This will be accomplished through a number of in-depth cyber sessions, hands on live demonstrations, the yearly cyber challenge and government and industry exhibits. Don't miss this educational, and cost effective, cyber event in Colorado Springs, CO..

AFCEA Tinker AFB Information Technology & Cyber Security Expo (Oklahoma City, Oklahoma, USA, Aug 8, 2013) Commercial vendors are invited to Tinker Air Force Base on Thursday, August 8th to exchange information and provide products demonstrations to the military and civilian personnel on base. IT and Information Assurance professionals from Tinker AFB are looking forward learning about the latest cyber security trends and best practices, networking with peers, and sharing remediation strategies.

AIAA Aviation 2013 (Los Angeles, California, USA, Aug 12 - 14, 2013) Leading cybersecurity experts will speak at AIAA AVIATION 2013, being held August 12-14 at the Hyatt Regency Century Plaza, Los Angeles, Calif. Hosted by the American Institute of Aeronautics and Astronautics, the conference will address the risk of the evolving cyber threats to the world's $2.2 trillion commercial aviation enterprise.

A Cloud Computing Introduction for Manager (Columbia, Maryland, Sioux Falls, Aug 13, 2013) Cloud computing is becoming popular. More and more Technical Managers and Project Managers will be interacting with cloud computing, either developing clouds, using clouds, or selecting among cloud and non-cloud alternatives to accomplish their projects. This talk provides a brief and basic introduction to cloud computing, what managers need to know about cloud computing, what are some of the myths, and what they need to ask about cloud computing from service providers. The presentation will include selected questions specific to managers associated with government projects and security risks of cloud computing. This non-technical presentation will help managers understand cloud basics and how to ask better questions when a cloud becomes part of your project. Dr. Patrick Allen of Johns Hopkins University Applied Physics Lab will be the presenter.

Resilience Week 201 (San Francisco, California, USA, Aug 13 - 15, 2013) 2013 Resilience Week brings together colleagues across government, academia and industry to facilitate an exchange of ideas dedicated to promising research in resilient systems that will protect cyber-physical infrastructures from unexpected and malicious threats - securing our way of life. Four different symposia will be offered: Resilient Control Systems, Resilient Cyber Systems, Resilient Cognitive Systems, and Resilient Communication Systems. Keynotes will be provided by numerous leading subject matter experts - from agencies including: NSA, DARPA, Sandia National Laboratory, and Office of the Assistant Secretary of Defense for Research and Engineering.

Kirtland AFB/Sandia/DOE Cyber Security Seminar & IT Expo (Albuquerque, New Mexico, USA, Aug 15, 2013) This expo is designed to stimulate exchanges of information between industry partners and Kirtland AFB Information Management Officers', Information Technology personnel, Contracting Officers' as well as end-users, developers, scientists, researchers and project managers in the areas of cyber security and information technology.

National SCADA Conference (Melbourne, Victoria, Australia, Aug 15 - 16, 2013) The 12th Annual National SCADA Conference, Australia's largest and longest running SCADA conference, will bring together many of the luminaries of the Australian and International SCADA community to evaluate and find solutions for the increasing demands of the SCADA environment. The theme for 2013 will be delivering intelligence and improved performance to SCADA networks. The SCADA conference program will deliver fantastic first-hand knowledge from leading international and local SCADA experts with a great mix of burning SCADA issues, case studies, security and real world implementations together with practical advice. The networking opportunities provided coupled with the largest SCADA exhibition in the Southern Hemisphere ensure the National SCADA Conference is a must attend event for Australia's and New Zealand's SCADA Communit.

First International Conference on Cyber-Physical Systems, Networks, and Application (Taipei, Taiwan, Aug 19 - 20, 2013) CPSNA 2013 will focus on core challenges of cyber-physical systems. Given a tight integration of computation and the physical world, cyber-physical systems must compose robust systems, networks, and applications built upon predictable, analyzable, and certifiable models and abstractions. CPSNA 2013 will serve as a forum to discuss new ideas for such core challenges of cyber-physical systems.

SANS Thailand 201 (Bangkok, Thailand, Aug 19 - 31, 2013) SANS hands-on advanced Information Security training is coming to Thailand this August! SANS is bringing our Web App Penetration Testing course to the Crowne Plaza Bangkok Lumpini Park in Bangkok, Thailand.

Human Cyber Forensics Forum (Washington, DC, USA, Aug 21, 2013) This forum brings together subject matter experts to discover and share new means of recognizing the human indicators related to cyber intrusions, and the evolution of these human indicators in the coming decades.