The CyberWire Daily Briefing for 10.4.2013

Cyber Attacks, Threats, and Vulnerabilities

Iran Guard Says Dead Official Wasn't Assassinated (Bloomberg) Iran's Revolutionary Guards rejected reports that the head of the country's cyber warfare program had been assassinated, saying only that it was probing the death of an employee it didn't identify. "This statement denies all the news about assassinating one of our workers after a very sudden incident happened to him," the Imam Hassan Mojtaba division of the Revolutionary Guards Corps said in a statement on the Alborz website. "We are investigating the incident and the intention of the attacker or attackers"

Iran's cyber–warfare chief killed. 'Real' murders and online warfare are merging — and we're not ready (Telegraph) Motjaba Ahmadi is dead. Killed with two bullets to the heart. At least, that's if Alborz, a website linked to Iran's Revolutionary Guard Corps, is to be believed. He was the commander of Iran's Cyber War Headquarters and the chatter is that he was assassinated. Since 2007, five Iranian nuclear scientists and the head of the country's ballistic missile programme have been killed. That sound you can hear is the Mossad whistling nonchalantly

Death of Iranian Revolutionary Guards officer shrouded in mystery (The National) The death of an Iranian Revolutionary Guards officer was shrouded in mystery and the subject of intense speculation on Thursday as the force denied claims he had been assassinated. Alborz, an Iranian website, reported this week that Mojtaba Ahmadi had left his house on Monday morning and was found dead with a bullet in his heart a few hours later in a wooded area near the town of Karaj, north-west of Tehran

Important Customer Security Announcement (Adobe Featured Blogs) Cyber attacks are one of the unfortunate realities of doing business today. Given the profile and widespread use of many of our products, Adobe has attracted increasing attention from cyber attackers. Very recently, Adobe's security team discovered sophisticated attacks on our network, involving the illegal access of customer information as well as source code for numerous Adobe products. We believe these attacks may be related

Adobe reports massive security breach (PCWorld) Adobe reported what it called a "sophisticated" cyberattack on its network where hackers gained unauthorized access to confidential customer information including IDs and encrypted passwords. The hack affects some 2.9 million customers worldwide, the company estimates

Source code and 2.9 million accounts raided by attackers in Adobe breach (CSO) Adobe has confirmed that source code, as well as information belonging to 2.9 million customers, was raided during a breach discovered on September 17

The Adobe Breach FAQ (Internet Storm Center) You have probably seen now the stories about Adobe being breached, customer data being exposed and source code leaked. Excellent work by Brian Krebs in uncovering these breach and he has a great write-up about this [at Krebs on Security]. But what does this mean for you? Does this affect you as an Adobe customer? Here are a couple of questions that keep coming up

Vote Wisely Says Anonymous Hacker after Hacking United Nations Honduras Website (HackRead) The official website of United Nations Honduras has been hacked and defaced by a hacker going with the handle of Ch4FeR, which seems to be a part of Anonymous movement as reported by Pinoy Hack News. Hacker left a deface page along with a message on the hacked website in Spanish language, bashing the government and asking people of Honduras to vote wisely in upcoming election in November

BitcoinTalk Website Defaced, 150,000 Emails and Passwords for Sale (HackRead) A group of hackers going with the handle of "The Hole Seekers" have hacked and defaced a famous Bitcoin discussion forum on Wednesday. Forum administrators were quick to restore the website before it was taking offline but it seems as if the damage has already been done as the group is selling 150,000 user emails and hashed passwords online. Theymos who is BitcoinTalk.org's administrator said in a note on

Bitcoin forum hacked in aftermath of Silk Road takedown (Naked Security) The popular Bitcoin discussion forum, Bitcointalk, was hacked and defaced on Wednesday. The site continues to be unavailable following a decision by administrators to take it down to investigate the full extent of the hack

Hackers blamed for NY's ObamaCare breakdown (New York Post) The numbers just don't add up. The "abnormally high traffic" that crippled New York's ObamaCare Web site for two days may have resulted from a malicious attack by hackers, computer-security experts said Wednesday

Obamacare Insurance Exchange Websites: Tech Critique (InformationWeek) State and federal websites' failure to work as advertised in first days of insurance availability can be blamed on software bottlenecks due to poor design. This is what happens when government decides it can provide an online shopping experience to rival Expedia. The online insurance exchanges mandated by the Affordable Care Act choked on a surge of traffic when they launched Tuesday to begin signing up consumers for policies that will take effect in January

Here comes the government shutdown and Obamacare spam (ZDNet) A recent predictable surge of domain name registrations related both the US government shutdown and the new health care law, a.k.a. Obamacare, is a sign that malicious emails and web sites are to come. John Bambanek is reporting on the SANS Internet Storm Center that there has been a rush of domain name registrations in recent days related to the US government partial shutdown. There have also been many recent registrations related to the recently implemented Patient Protection and Affordable Care Act, better known as Obamacare

McAfee research shows sharp rise in malware signed with legitimate digital certificates (CSO) McAfee research indicates that a steep rise in the amount of malware signed with legitimate digital certificates — not forged or stolen ones — is a growing threat that raises the question whether there should be some kind of "certificate reputation services" or other method to stop certificate abuse

Commercially available Blackhat SEO enabled multi–third–party product licenses empowered VPSs spotted in the wild (Webroot Threat Blog) Standardization is the cybercrime ecosystem's efficiency-oriented mentality to the general business 'threat' posed by inefficiencies and lack of near real-time capitalization on (fraudulent/malicious) business opportunities. Ever since the first (public) discovery of managed spam appliances back in 2007, it has become evident that cybercriminals are no strangers to basic market penetration/market growth/market development business concepts. Whether it's the template-ization of malware-serving sites, money mule recruitment, spamming or blackhat SEO, this efficiency-oriented mentality can be observed in virtually each and every market segment of the ecosystem

Another Darkleech Campaign (FireEye) Last week got us up close and personal with Darkleech and Blackhole with our external careers web site compromise as described here…The fun didn't end there, this week we saw a tidal wave of Darkleech activity linked to a large-scale malvertising campaign identified by the following URL

Mobile Malware Hits the 1M Mark (InfoSecurity Magazine) Android-based mobile malware and high-risk apps have reached the one million mark, according to a study from Trend Micro

Professional Cyber Espionage Rings To Grow (TechWeek Europe) Espionage on demand hacking groups are set to increase, warn experts. The reality of the cyber espionage world has been exposed by independent research efforts from Kaspersky Lab and Symantec. Both found evidence of two separate espionage groups, which are making highly targeted attacks on the networks of government agencies and private corporations in search of military, political and industrial secrets

EU government telco provider was subjected to major attack (ComputerWeek) The Internet service and telecommunications provider to all the European Union's official institutions was subjected to a malware attack that "no single company or authority could withstand on its own" the company's secretary general admitted on Thursday

Belgian telecoms chief refuses to comment on GCHQ role in 'cyber attack' (BBC) Directors of the Belgian telecoms company Belgacom have refused to comment on allegations that Britain's intelligence agency, GCHQ, was behind a cyber attack on its network

Cyber 'mass shooter' poses future threat to computer security, ex–intel official says (Washington Times) The fastest-growing cyber threat is from a kind of digital mass shooter, a deranged or outraged hacker able to obtain cyberweapons currently available only to nation-states and organized crime, a former senior U.S. intelligence official said Thursday. "They're just mad, they're mad at the world," said retired Air ForceGen. Michael Hayden. "They may have demands that you or I cannot understand"

Credit card selfies making thieving easy (Storefront Backtalk) From the "duh" files: consumers are sharing photos of their debit cards on Facebook, and their credit card CVV numbers on Twitter. Plus, nearly 10 percent of consumers have shared their Social Security number on a social media platform. So says Ellen Richey, chief enterprise risk officer for Visa Inc., who is very concerned about how the new social media atmosphere creates global security risks. The payment industry must accept consumers' lax practices as the "new normal" and boost its defenses, Richey said during her October 2 keynote address at Visa's Global Security Summit in Washington, D.C. The industry's proposed new "token" standards need to "become business as usual" to combat potential fraud, Richey says

Security Patches, Mitigations, and Software Updates

Microsoft to unveil eight bulletins on Tuesday (Help Net Security) October is turning out to be a busy month for patches. Next week is Patch Tuesday, and both Adobe and Microsoft have published their advance notices, with one and eight bulletins respectively. In addition, on October 15th we are getting the Critical Patch Update from Oracle, which will include a new version for Oracle enterprise software, plus a new version of Java 7

Cyber Trends

Despite risk of aiding hackers, experts favor disclosing vulnerabilities (CSO) Vulnerability disclosure gives users a chance to defend themselves. A recent Microsoft presentation on the ethics of disclosing vulnerabilities before a patch is available sparked a debate Thursday among experts who tended to lean in favor of releasing information sooner than later

Will CDO Steal CIO's Leadership Role? (InformationWeek) Nicholas Carr was wrong; IT does matter. But the tech that matters most now is data, leading to a possible leadership coup by chief data officers and chief digital officers. Asking whether CIOs have a future isn't a new question. Nicholas Carr in 2003 famously challenged whether we needed IT at all. He compared IT to the spread of electric power: at some point, it becomes a commodity that gives no competitive advantage. The CIO is thus in the same lights-out position as those early CEOs (chief electricity officers)

Cisco CEO: Internet Of Things Will Reshape IT (InformationWeek) John Chambers thinks IT departments can get their CEOs excited about the Internet of Things in the same way CEOs got excited about e-commerce — because it has potential to either boost their revenues or threaten their business models. Cisco CEO Chambers, speaking at Interop New York Tuesday, said it will lead to the "next wave of relevance" for IT

Information security policy management for emerging technologies (SearchSecurity) In my time in the trenches as a chief information security officer (CISO) for several organizations, there was often a stigma associated with security when it came to implementing new technologies and business practices. My security teams, when given the opportunity to provide input, were often viewed as saying "No!" to new ideas. For many infosec practitioners in many organizations, that stigma still remains in place today

The Costs of Financial Crime (RedOwl Analytics) With President Obama naming former prosecutor Mary Jo White to head the SEC, there is speculation that the administration will crack down on corporate misdeeds. A simple analysis of penalties that garnered newspaper headlines shows at least $22 billion in fines during 2012. UBS, HSBC and Bank of America all lost over a billion dollars in penalties in 2012. The damage went beyond the penalties themselves, hurting stock prices and institutional reputation, and perhaps sparking a change in the way big banks do business and absorb penalties

Are workers drowning in a sea of ineffective technology? (Help Net Security) With the rise of mobile, the cloud and multiple device use, today's workers are more connected than ever before, giving them access to high-volume streams of information on a 24-7 basis. But is this helping or hurting their productivity? New research from Cornerstone OnDemand and Kelton, reveals that U.S. employees are feeling overloaded, whether by work (50 percent), information (34 percent) or technology (25 percent)

Bruce Schneier: The battle for power on the Internet (Help Net Security) Bruce Schneier gives us a glimpse of the future of the internet, and shares some of the context we should keep in mind, and the insights we need to understand, as we prepare for it

Half of UAE smartphones are hacked (The National) As many as half of the UAE's smartphone users have been victims of some form of cybercrime in the last year, according to computer security experts

Cyber criminals target SMEs (ITWeb) Cyber crime in SA is increasing at epidemic proportions, and small to medium-sized enterprises (SMEs) have become key targets. So says Doros Hadjizenonos, sales manager at Check Point Software Technologies, who notes that SMEs rarely recover from cyber attacks, but that there are simple steps they can take to protect their businesses

Marketplace

Verizon says when it comes to protecting your data, 'don't look at us' (BGR) As some high-profile technology companies make an effort to shed more light on issues surrounding user privacy in light of recent NSA spying revelations, most have remained quiet so as to avoid fueling the fire. Verizon was one such company until recently, and now the fire has been fueled — while speaking with Tom's Guide during the Cyber Security Summit 2013 security conference in New York City last week, Verizon's vice president of national security policy Marcus Sachs said all the wrong things

Is the NSA ripping a $35 billion hole in US business? (Naked Security) The "Made in the USA" label has become tainted by fallout from revelations about US surveillance, industry watchers say, while overseas governments are working to build data-privacy havens that are giving US technology services and products a run for their money

Phorm soars after Chinese debut (IFA Magazine) In its first week of Chinese operations, internet monitoring company Phorm said it had averaged 4.3m users per day. Shares in the AIM-listed company, which was threatened with court action in the UK over its controversial Deep Packet Inspection internet browsing interception technology, soared on Thursday as it announced operations in China had begun successfully

Twitter files for $1 billion IPO (Fierce CIO) Twitter filed its S-1 form with the U.S. Securities Exchange Commission Friday. The most highly anticipated filing since Facebook's, the filing said that Twitter plans to raise $1 billion

Lockheed Opens Australia Cyber Defense Center (ExecutiveBiz) Lockheed Martin has opened a new information technology hub for cyber defense efforts in Australia as part of a strategy to extend the company's IT and cyber footprint in the country

Thales and Schneider Electric sign cyber–security agreement (Jane's) Thales and automation specialist Schneider Electric have announced the formation of a partnership to develop cyber-security services to defend command and control systems from malicious attacks

Former DHS Technology Chief Paul Benda Joins GSIS (MarketWired) Global Security & Intelligence Strategies (GSIS) has named Paul Benda, former Director of the U.S. Department of Homeland Security's (DHS) Advanced Research Projects Agency (HSARPA) and the Department's former Acting Deputy Under Secretary for the of Science and Technology Directorate, as Partner and Chief Technology Officer

Products, Services, and Solutions

Boeing Releases Upgraded Secure Data Transfer Technology (Hispanic Business) Boeing [NYSE: BA] has upgraded its cross-domain technology, eXMeritus HardwareWall, with a simpler, more powerful software configuration for easier use

The safest cloud apps for the enterprise (Help Net Security) Enterprises today no longer have a choice about whether they embrace the cloud as their employees are already using cloud apps to perform critical business functions, often without IT's involvement

1Password 4 for Mac released (Help Net Security) 1Password, the most popular password manager for the Mac, has been updated today with the launch of version 4

Technology eliminates bot–infected traffic from advertising campaigns (Help Net Security) White Ops introduced a systematic solution for eliminating bot-infected traffic from advertising campaigns. "We have spent over a year tracking the bad guys attacking advertising," says White Ops CEO, Michael Tiffany. "This code started out robbing online banks--but apparently, it's easier, safer, and more profitable to steal from the $36 billion spent yearly on online advertising"

Aruba Networks releases cloud Wi–Fi solution (Help Net Security) Aruba Networks announced a new cloud-managed Wi-Fi solution that combines the simplicity of a cloud service with the performance, manageability and reliability of enterprise-grade WLANs

McAfee solution remediates advanced malware (Help Net Security) McAfee announced an end-to-end solution to help organizations combat the increasing challenges of advanced malware. McAfee goes beyond single-feature, static analysis sandboxing products to address all three key requirements needed to counter today's stealthy threats: the ability to find advanced malware with the new McAfee Advanced Threat Defense appliance, the ability to freeze the threats with McAfee network solutions, and the ability to initiate a fix with McAfee Real Time

As Its Partner Ecosystem Expands, Box Taps Google Health Founder To Lead Its Cloud-Based Assault On Healthcare (TechCrunch) Over the last year, Box has been ramping up its efforts to bring its cloud storage platform into new verticals. That began in April, when the seven-year-old company began making a major push to bring its cloud collaboration and storage tools to the healthcare industry, which, given the mayhem around the launch of the new healthcare exchanges yesterday, seems like it couldn't have come at a better time

The Big Three Credit Card Cos. Aim to Revamp Security (Storefront Backtalk) Consumers' security will be better protected as Visa, MasterCard and American Express proposed new global standards to replace traditional account numbers with a digital payment "token" for online and mobile transactions. In addition to boosting security, the tokens would eliminate the need for merchants to store consumers' sensitive payment data

Technologies, Techniques, and Standards

At Interop, Plethora Of New Services Leaves Questions About Risk (Dark Reading) GRC tools may offer security, risk answers as enterprises rely more heavily on service providers. Here at one of the networking industry's best-known trade shows, you can get help with cloud networking, mobile device deployment, virtual private networks, email security, and much more. But finding a provider that can help you manage your enterprise's risk, compliance, or security posture is not so easy

Securing More Vulnerabilities By Patching Less (Dark Reading) Companies need to focus on not just fixing known vulnerabilities, but closing potential attack vectors. As a penetration tester, Mauricio Velazco frequently looked for information on the latest attacks because corporate information systems were rarely patched against the exploitation of just-reported vulnerabilities

CISO Shares Strategies For Surviving The Inevitability Of Attacks (Dark Reading) Chief information security officer Jay Leek says today's reality that you can't stop all cyberattacks means security teams must double down on smarter detection of threats and attacks rather than the traditional approach of mainly trying to prevent them

Confronting the Insider Threat (Security Mangement) Edward Snowden, who has leaked classified information about intelligence collection activities of the National Security Agency (NSA), reportedly told the South China Morning Post that he sought a job as a contractor at government consulting firm Booz Allen Hamilton with a goal: to collect proof about the NSA's domestic surveillance programs and alert the public to the programs. However, Snowden is not the typical insider threat. Most insiders who later betray their employer's trust don't start out with that intent. The change from benign employee to malicious insider can be spurred by anything from home-life stress to frustration at being passed over for a promotion to the thought that the company does not appreciate one's contributions

Redefining the Insider Threat (GovInfoSecurity) What is an insider threat? Randy Trzeciak has an answer, but he and his colleagues at Carnegie Mellon University's CERT Insider Threat Center are working to broaden the definition of the insider threat to incorporate not just the risk to information and technology but to facilities and people, too

Why CIOs should encourage rogue clouds (InfoWorld) Though most CIOs hate the idea of their users moving to cloud computing without IT, there's a case for letting them experiment

The Seven Deadly Social Engineering Vices (Knowbe4 Security Awareness Training Blog) You may not be aware that there is a scale of seven deadly vices connected to social engineering. The deadliest social engineering attacks are the ones that have the highest success rates, often approaching 100%. What is the secret of these attacks, how come they succeed so well

Design and Innovation

Everything you know about Steve Jobs and design is wrong, according to one man who should know (Quartz) Harmut Esslinger was already a big name in the field of industrial design in 1982, when his firm, Frog Design, bid on a secret project to help Apple become the company that would transform computers from "business machines" into consumer goods

Research and Development

New Cryptographic Device Destined for Drones (SIGNAL Magazine) U.S. Navy researchers are developing a state-of-the-art encryption device for integration onto KC-130 tankers and unmanned aerial systems. An existing version of the device is being installed onto B-52 bombers, E–4s, which serve as airborne command centers for the U.S. president and other National Command Authority officials, and E–6s, which are command and control centers for nuclear weapons. The encryption system can be integrated into virtually any platform and offers backward-compatible, software-definable algorithms that can be updated during operations without downtime

Academia

Cyber Security Awareness — Why Higher Education Institutions Need To Address Digital Threats (Huffington Post) Prior to the first Cyber Security Awareness Month in October 2004, discussions on national security had very little to do with technology. However, due to the increasing threat of domestic and international cyber attacks on America's public and private infrastructure after 9/11, a need arose to promote cyber security beyond simple computer password protection. Sponsored by the Department of Homeland Security's National Cyber Security Division (NCSD) and the nonprofit National Cyber Security Alliance, Cyber Security Awareness Month is a time to promote security awareness among all participants in the digital sphere. Of course, the concept is much more advanced than merely password protecting computers and mobile devices. A recent article in Computer Weekly reported that cyber attacks, whether like recent ones by the Syrian Digital Army or various groups of computer hackers, will rise significantly in the next decade

Legislation, Policy, and Regulation

NSA reveals more about its spying efforts at home (ABC Local) Top U.S. intelligence officials are revealing more about their spying in an effort to defend the National Security Agency from charges that it has invaded the privacy of Americans on a mass scale. Yet the latest disclosure - the NSA tried to track Americans' cellphone locations - has only added to the concerns of lawmakers

Hacking Summit Names Nations With Cyberwarfare Capabilities (McAfee) In 2009, I read with great interest a paper published in the Journal of International Security Affairs titled The Art of (Cyber) War. In this paper, Brian M. Mazanec explained the People's Republic of China was interested in cyberwarfare and had improved its capabilities to conduct military operations in the cyberspace

Litigation, Investigation, and Law Enforcement

Espionage: Cyber Crime Treaty Could Be Used to Track Cyber Spies (TMC) Governments of countries that engage in large-scale electronic espionage, like the United States, and companies that develop spying software could theoretically face legal action for violating the Convention on Cybercrime

How Internet Censorship Actually Works in China (Atlantic) Studies show that the government permits some dissent online—but strikes down hard on calls for collective action

How to beat China's Great Firewall, one salvaged Weibo message at a time (Quartz) The rollicking conversation on Sina Weibo, the popular Chinese microblogging service with more than 50 million active users, has gotten a little strained in the last few months, as the government's escalating online crackdown has landed popular online commentators and regular citizens in jail. But even as the government and private companies like Sina intensify their censorship of Weibo posts that criticize Beijing or discuss controversial issues like the Bo Xilai trial, the so-called Great Firewall of China is showing a few cracks

Bitcoins, Web–Exchanges Make Following Money Near Impossible (Threatpost) Cybercriminals' use of Bitcoins and Web-based currency exchanges has made a tried-and-true law enforcement strategy of following the money to arrest criminals close to impossible

DeepWeb and Cybercrime — It Is Not Just the Silk Road (TrendLabs Security Intelligence Blog) The infamous Silk Road marketplace is probably the most well–known place online for anyone wanting to purchase all sorts of illegal goods — ranging from illicit drugs, to firearms and all the way up to hitmen–for–hire

Lawmaker: Snowden may have had help with leaks (PCWorld) Edward Snowden may not have acted alone, and may have had outside assistance, when he leaked information about the U.S. National Security Agency's data collection and surveillance programs earlier this year. Snowden's access to information he shouldn't have known existed raises questions about whether he had help in collecting information about NSA programs, Representative Mike Rogers, a Michigan Republican and chairman of House Intelligence Committee, said Thursday

GCHQ Faces Legal Action Over Mass Surveillance (Big Brother Watch) Today Big Brother Watch, working with the OToday Big Brother Watch, working with the Open Rights Group, English PEN and German internet activist Constanze Kurz, has announced legal papers have been filed alleging that GCHQ has illegally intruded on the privacy of millions of British and European citizens

13 members of Anonymous indicted (News Observer) federal grand jury on Thursday indicted 13 members of the Internet hacking group Anonymous for allegedly carrying out cyber-attacks worldwide, including targets that refused to process payments for WikiLeaks, the anti-secrecy website founded by Julian Assange

For a complete running list of events, please visit the Event Tracker.

Upcoming Events

The Monktoberfest (Portland, Maine, USA, Oct 4, 2013) Our speakers will explore how social trends can change the way we build and use technology, and how technology in turn can change the way we socialize.

Suits and Spooks NYC 2013 (New York, New York, Oct 5, 2013) Since the landscape is foggy, the threat actors numerous and hard to identify, and the attacks proliferating on a daily basis, the focus of the next Suits and Spooks conference will be to identify non-state aggressors in cyberspace. About twenty speakers will present briefings over two days on hackers, citizen militias, and other non-state entities operating in the Middle East, China, Russia, Pakistan, India, Iran, Africa, South America, the United States (yes - we have non-gov threat actors domestically), and other parts of the world. One of our panel moderators will be Joel Brenner (former National Counterintelligence Executive at the Office of the Director of National Intelligence and former Senior Counsel at the NSA).

Forensics and Incident Response Summit EU (Prague, Czech Republic, Oct 6 - 13, 2013) The Summit will focus on high quality and extremely relevant content as well as panel discussions in Digital Forensics and Incident Response. In addition, we encourage you to take every opportunity to make the most of this event from attending the Summit to registering for one or more of the post-summit training classes taught by SANS' top-rated instructors and course authors. Additional events such as DFIR Netwars, evening talks and the SANS Community Night will be taking place during that week too. This event promises to bring together the leading minds in digital forensics and incident response in the EU, as well as many other practitioners from a wide cross section of industries and company sizes. You will be able to share with all of them your challenges and find out new solutions that work, techniques and approaches you didn't even know existed.

CyberMaryland 2013 (Baltimore, Maryland, USA, Oct 8 - 9, 2013) Join cybersecurity leaders, luminaries and rising stars at CyberMaryland 2013. This two-day event at the epicenter of the nation's cybersecurity innovation and education, will create opportunities for networking and idea sharing amongst the many cyber leaders and professionals across the country, including: federal, state and local government agencies, academic institutions, cybersecurity entrepreneurs, and industry leaders of research and development. CyberMaryland 2013 will address the biggest challenges facing America, including future innovation to meet the security challenges facing our country; collaboration across industry, government and educational institutions; and the development of a generation of cyber-warriors. Surrounding all of these issues is a constantly evolving business framework to provide efficient and effective solutions in a time frame that anticipates and mitigates current and future threats.

2013 Maryland Cyber Challenge (Baltimore, Maryland, USA, Oct 8 - 9, 2013) Held in conjunction with Cyber Maryland and intended to let students and young professionals showcase their cybersecurity skills, Maryland Cyber Challenge offers competition in three divisions: high school, college, and professional. Orientation sessions for teams in each of three divisions -- high school, collegiate and industry and government professionals -- will be held at UMBC in July and August. Two qualifying rounds will be conducted online using SAIC's Cyber Network Exercise System.

AFCEA Hill AFB Technology & Cyber Security Expo (Ogden, Utah, USA, Oct 9, 2013) The purpose of this first-time event is to allow base personnel the opportunity to learn about the latest computer security trends, network with peers, share remediation strategies and to view and demo some of the latest cyber security and information technology products/services available today..

NSU's Raising Savvy Cyber Kids with Ben Halpert (Fort Lauderdale, Florida, USA, Oct 10, 2013) Ben Halpert is an award-winning author of several books for diverse audiences. The Savvy Cyber Kids At Home: The Family Gets A Computer (October, 2010) is a picture book that teaches the concepts of online safety and privacy to preschool children. The Savvy Cyber Kids At Home: The Defeat of the Cyber Bully (October, 2011) teaches children how to appropriately respond to a cyber bully before playing in the virtual world. All Savvy Cyber Kids books are available in English, Spanish, German, and French. For those in the business field, Ben has published Auditing Cloud Computing: A Security and Privacy Guide (July 2011) through John Wiley & Sons. RSVP at the link.

International Conference on Cyber–Enabled Distributed Computing and Knowledge Discovery (Shanghai, China, Oct 10 - 12, 2013) International Conference on Cyber-enabled distributed computing and knowledge discovery -promotes research and development of the cyber-related technology. It is unique and significant that spans through cyber-enabled data mining and knowledge discovery, distributed and parallel computing, cyber security, cloud computing, pervasive computing, mobile computing, Internet, wireless networks, cognitive systems, cyber information process, information discovery, e-health via cyber network, e-science, web technology, and network performance and tools. The research and development in these areas have received extensive attention in both the academia and industry to provide ubiquitous services for users. Various hardware and software designs, algorithms, protocols, simulations, and test-bed, and implementations are developed for distributed computing in an interconnected and distributed network environment. The purpose of CyberC is to provide a forum for presentation and discussion of innovative ideas, research results, applications and experience from around the world as well as highlight activities in the related areas.

VizSec 2013 (Atlanta, Georgia, USA, Oct 14, 2013) VizSec brings together researchers and practitioners in information visualization and security to address the specific needs of the cyber security community through new and insightful visualization techniques.

Hack-in-the-Box Security Conference 2013 (Kuala Lumpur, Malaysia, Oct 14 - 17, 2013) The 11th annual HITB Security Conference (16th/17th October) will be a triple track offering featuring keynotes by Andy Ellis, Chief Security Officer at Akamai and Joe Sullivan, Chief Security Officer at Facebook. This year's event also features all new 2-day training courses (14th/15th October) on a wide variety of topics including Android exploitation, extreme web hacking, infrastructure security, exploiting injection flaws and a special iOS security course by the world famous Evad3rs team. The full speaker list and conference agenda will be released after the Call for Papers closes on the 25th of July.

USDA Cyber Security Symposium and Expo 2013 (Washington, DC, USA, Oct 15, 2013) The Cybersecurity Expo, running in conjunction with the Summit, will allow exhibitors the opportunity to provide live demos and share information with government personnel and industry partners. Summit topics will focus on today's vulnerabilities, incidents, security lifecycle, risks and mitigations; it will also identify ways to work together and build a solid security foundation program to meet future challenges and trends in cyber security..

SNW Fall 2013 (Long Beach, California, USA, Oct 15 - 17, 2013) SNW is the world's largest independently produced conference series focused on the evolution of architecture for a new world of mobility, Big Data and business agility. Produced by Computerworld -- and co-owned by Computerworld and the Storage Networking Industry Association (SNIA) -- SNW remains unbiased and vendor agnostic. Unlike events focused on a specific vendor agenda and product portfolio, SNW provides a forum of open thought leadership and practical education that defines the spectrum of storage, data and infrastructure solutions available to a highly qualified audience of enterprise technology decision-makers.

Hexis Exchange (Athens, Greece, Oct 16 - 17, 2013) Attendees will have the opportunity to participate in a knowledge exchange of the latest enterprise security topics through expert led business and technology forums, hands-on sessions, and training. Such topics will include: emerging cybersecurity threats, big data management, advanced analytics, government regulation & compliance, and data retention challenges & solutions.

Cybersecurity Symposium: "Protect. Defend. Educate." (Linthicum, Maryland, USA, Oct 16 - 17, 2013) The Cybersecurity Symposium being held October 16-17, 2013, will deliver first-class training for government and industry security professionals while simultaneously offering high-level keynote speakers, essential networking opportunities, and an informative technology exposition. The Symposium sessions will have a special emphasis on security challenges facing today's security professionals and cyber awareness training for security professionals responsible for protecting sensitive and classified information from the ever increasing threats of mobile devices, espionage, terrorism, and cyber-attacks to ensure our national security. Register by August 31 to ensure the reduced early bird registration fee. This event is free for government employees and active-duty military personnel. Exhibit space and sponsorship opportunities are also available.

NSU Healthcare Cyber Security Summit (Fort Lauderdale, Florida, USA, Oct 17, 2013) In today's modern healthcare systems, data is everywhere, including sensitive patient data that needs to be secured and monitored. Join top healthcare security professionals from Nova Southeastern University, AccessData, and RSA to hear about current regulations that affect healthcare companies of all sizes, ways to protect sensitive data, and learn techniques to monitor access for suspicious activity. If you are responsible for the privacy or security of your company's healthcare data, you will benefit from presentations from these leading experts in the field. NSU's Chief Information Security and HIPAA Security Officer, John Christly, will examine the threats to the privacy and security of todays' modern healthcare operations. You will also hear from experts from AccessData and RSA on how to detect and prevent data breaches. RSVP at the link.

Nuclear Regulatory Commission Cyber Security Conference & Expo (Rockville, Maryland, USA, Oct 17, 2013) This one-day conference will consist of cyber sessions in the NRC Auditorium given by government and industry speakers. Exhibit tables will be set-up just outside the Auditorium and companies will have the opportunity to demo their latest technologies to NRC's IT personnel.

Securing the Internet of Things Summit (San Francisco, California, USA, Oct 21, 2013) The Internet of Things is still in its infancy and the security community has a chance to build in new approaches to security if we get started now. More secure embedded operating systems and applications, more scalable approaches to continuous monitoring and threat mitigation and new ways of detecting and blocking active threats are evolving and can be tremendously effective. SANS is looking to bring together community talent and ideas to develop new solutions, demonstrate security technology that already works and to provide a force multiplier to making the Internet of Things be more secure than the first phases of Internet evolution.

13th Industrial Control Systems Cyber Security Conference (Atlanta, Georgia, USA, Oct 21 - 22, 2013) Industrial Control Systems (ICS) operate the infrastructures of electric power, water, chemicals, manufacturing, transportation, defense, etc. and link the digital and physical worlds. Their cyber security presents challenges that are distinct from securing traditional IT systems. The conference is attended by control & operations engineers and their IT counterparts from critical infrastructure industries, by ICS and security vendors, and by universities. Run under the Chatham House rules of confidentiality, the conference discusses ICS cyber incident case studies, provides regulatory updates, discusses solutions in the form of policies and procedures, presents demonstrations of hacking ICS and ICS protocols, and provides a status of ICS security solution field demonstrations.

Cloud Connect (Chicago, Illinois, USA, Oct 21 - 23, 2013) Cloud Connect returns to Chicago October 21-23, 2013 with an all new program built around the leading cloud platforms. Cloud Connect provides the independent guidance IT professionals need to successfully build, operate and manage the cloud, and the tools to measure application performance and business metrics.

cybergmut Technical Tuesday: Cyber Security Strategy — Why We're Losing and What's Needed to Win (Columbia, Maryland, USA, Oct 22, 2013) CrowdStrike's Steve Chabinsky of CrowdStrike explains the situation. Everybody seems to be spending more on cybersecurity, but with questionable return on investment. In fact, the problem clearly is getting worse, and current strategies show no indication of reversing that trend. This non-technical presentation explores the typical cyber risk environment, considers the proper balance and likely effectiveness of threat deterrence, vulnerability mitigation, and consequence management to reduce cyber risk, and examines the current and evolving roles of government agencies and the private sector in addressing the problem. Backed by powerful, real-world examples of threat actor tactics, this presentation will help managers develop a better understanding of how their current security approach is most likely to succeed or fail over time, and what strategies are the most likely to shift the advantage to the good guys. cybergamut is co-hosting this event with the Maryland Chapter of InfraGard.

Cyber Security Seminar and IT Expo at Peterson AFB (Colorado Springs, Colorado, USA, Oct 22, 2013) The Cyber Security Seminar and IT Expo is a one-day event held on-site where industry vendors will have the opportunity to display their products to personnel attending briefings concerning the latest updates in Cyber Security Awareness. This is an excellent and unique opportunity to meet IT personnel from USNORTHCOM, NORAD, Army Space Command, USSPACECOM, and the 21st Space Wing all in one day.

Hack.lu 2013 (Luxembourg, Oct 22 - 24, 2013) Hack.lu is an open convention/conference where people can discuss about computer security, privacy, information technology and its cultural/technical implication on society.

Joint Federal Cyber Summit 2013 (Washington, DC, USA, Oct 23 - 24, 2013) This collaborative government wide event is truly one of a kind, with speakers and attendees anticipated to represent more than 10 federal government agencies. Information sharing will be accomplished through keynote speakers on both days, along with numerous targeted breakout sessions (including a session with a federal CISSO panel), hands on live demonstrations, and industry exhibits.

NSU's 12 Simple Cybersecurity Rules For Your Small Business (Fort Lauderdale, Florida, USA, Oct 24, 2013) In this presentation twelve simple and inexpensive techniques for protecting small businesses from cyber threats will be discussed. While complex and expensive solutions exist to improve the security of information technology most of these products are not designed for the specific needs of small businesses. The techniques that will be discussed in the presentation are designed to address the most common threats encountered by small businesses without requiring significant expertise and expense. RSVP at the link.

BREAKPOINT 2013 (Melbourne, Australia, Oct 24 - 25, 2013) Over two days, 14 world-renowned speakers front Breakpoint to share their knowledge on a full range of security issues, from unpublished research to the latest trends in information security.

Ruxcon (Melbourne, Australia, Oct 26 - 27, 2013) Ruxcon is a computer security conference that aims to bring together the best and the brightest security talent within the Aus-Pacific region. The conference is a mixture of live presentations, activities and demonstrations presented by security experts from the Aus-Pacific region and invited guests from around the world. Ruxcon is widely regarded as a leading computer security conference within Australia attracting all facets of the security landscape from industry, academics, to enthusiasts.

2013 ACT–IAC Executive Leadership Conference (Williamsburg, Virginia, USA, Oct 27 - 29, 2013) Advances in technology and massive increases in data available can both challenge and transform Government mission performance. ELC-2013 focuses on how to make this transformation a reality, in and for agencies. We will hear from nationally prominent speakers and work across government and industry to learn new ideas and techniques. Four mission-oriented tracks will focus on initiatives for driving results using data and the "Innovate, Deliver, Protect and Analyze" paradigm that is at the heart of the Government's strategic vision.

SAP NS2: National Security Solutions Summit (Falls Church, Virginia, USA, Oct 29, 2013) Join us for a day of learning and networking focused on how to advance U.S. national security and homeland security through I.T. innovation. Top-notch speakers will address the new challenges facing U.S. national security and critical infrastructure -- as well as powerful, affordable technologies that are available today to tackle those challenges while saving money and simplifying operations. Learn how your organization can run faster, smarter, leaner in the most secure environments -- with world-class, breakthrough solutions that are bold alternatives to business as usual.

RSA Conference Europe (Amsterdam, the Netherlands, Oct 29 - 31, 2013) Information security today isn't optional. It's business-critical. Over three days, RSA® Conference Europe 2013 imparts the must-know actions to manage growing cyber threats. With over 60 sessions spanning 10 hours, attend the educational and networking event that builds your knowledge and furthers your career.

Regional Cyber Security Forum & IT Day (CSFI) — Hawaii (Honolulu, Hawai'i, USA, Oct 30, 2013) 2013 marks the 10th anniversary of National Cyber Security Awareness Month and FBC will host the 1st Annual Cyber Security Forum & IT Day (CSFI) at Fort Shafter - Club Hale Ikena to coinside with the anniversary, and activities surrounding this month. The goal of CSFI is to raise cyber security awareness, and to promote best practices in cyber while allowing DoD personnel and industry partners the opportunity to share the most up to date remediation strategies. The event will feature four educational cyber sessions to go along with an exhibit hall..

NSA Hawaii — Cyber Security, Intelligence & IT Day (Honolulu, Hawai'i, USA, Oct 30, 2013) Be a part of the 1st Annual Cyber Security, Intelligence and IT Day set to take place at the new National Security Agency (NSA) Hawaii Rochefort facility. The event will be hosted by NS/CCS Hawaii Technology Directorate and will focus on Cyber Security, Big Data and Cloud Computing. There are other areas of interest listed below as well. This is an extremely unique opportunity to network with NSA personnel in Hawaii at their location. Educational sessions will be provided to attendees to coincide with government and industry exhibits.