The CyberWire Daily Briefing 10.14.14

Cyber Attacks, Threats, and Vulnerabilities

Suspected Russian "Sandworm" cyber spies targeted NATO, Ukraine (Ars Technica) Microsoft patches 0day vulnerability after attackers use it to hack targets

Russian 'Sandworm' Hack Has Been Spying on Foreign Governments for Years (Wired) A cyberespionage campaign believed to be based in Russia has been targeting government leaders and institutions for nearly five years, according to researchers with iSight Partners who have examined code used in the attacks

Fighting in the cyber trenches (Fortune) Relations between the U.S. and China and Russia are tense, but no shot has been fired. Online, it's a different story

Hong Kong democracy activist websites compromised (IDG via CSO) Four websites promoting democracy in Hong Kong have been rigged to deliver malicious software, according to a Washington, D.C.-based security company

China ramps up spying on Australian business (Financial Review) Hackers are avoiding detection by working Australian business hours (except during Chinese holidays). Mandiant, a cyber security firm famous for identifying a Chinese military group called "APT1" that spied on hundreds of global targets, claims it has "definitive new evidence" that high-end Chinese hackers have been stealing secrets from Australian companies this year

State Department concerned about Chinese spying at Waldorf Astoria after sale to insurance company with possible Communist Party ties (New York Daily News) The State Department said it is reviewing the sale of the hotel to Beijing-based Anbang Insurance Group, and that it may stop leasing space for the U.S. ambassador to the UN or the General Assembly. Anbang is reportedly linked to China's Communist Party, which has overseen a massive effort to use cyberspying to steal U.S. trade and military secrets

Snowden Attacks "Anything Goes" Privacy Intrusions Of British Spy Agencies (TechCrunch) In what amounts to a wake up call directed at a British public generally considered apathetic on privacy issues, NSA whistleblower Edward Snowden has warned that U.K. spy agencies are using digital technology to conduct mass population surveillance without any checks and balances at all — overreaching and encroaching on privacy rights in a way that he characterized as even worse than the U.S. National Security Agency's inroads into citizens' rights

NZ faces claims of spying on friends (New Zealand Herald) New documents released by NSA whistle-blower Edward Snowden suggest New Zealand's embassies have been involved in spying on friendly nations on behalf of the United States, just as this country is seeking all the support it can get to win a seat on the United Nations Security Council

SEANux — a version of Linux from the Syrian Electronic Army (Graham Cluley) About an hour ago, the notorious Syrian Electronic Army (SEA) posted an interesting tweet

While Ground War is Building, Cyber War Has Begun; An Indian Hacks Pak Railways Website (iamwire) The tension between India — Pakistan is building up, as the firing goes on at the border. While people are predicting a battle on the grounds, online war has already begun. An Indian hacker hacked Pakistan People's Party's official website and taking down Pakistan Railways website

Army: Messaging leads to mass defections from Kony (Army Times) Defections from Joseph Kony's Army spiked in the summer of 2014, in large part due to U.S. messaging from the air and across the radio waves

Shellshock Bug Hits Siemens Industrial Products (CBR) Hackers can remotely execute code and escalate privilege in select software

6 security threats more deadly than Heartbleed or Shellshock (Techradarpro) Experts are concerned about other potential vulnerabilities

Kmart confirms month-old data breach, payment card data stolen (Help Net Security) First via a filing with the US Securities and Exchange Commission, and then via a press release, Sears Holding Corporation has confirmed a month-old breach that affected POS systems at its Kmart stores

Cyber Security Woes Continue To Haunt Companies (Bidness etc.) Sears Holdings Corp's (SHLD) discount department store chain, Kmart, got its name added to the list of companies molested by hackers this year. The retailer claims to have lost debit and credit card data in a cyber breach that is reported to have started in September. The company is yet to discover the exact extent of the hacking incident

Europol Warns of Russian Gangs Plotting Billion Dollar Attack (VPN Creative) Europol has warned that criminals are planning a billion dollar cyber attack on major financial institutions in the world. This warning comes at a time when banks in the US are already reeling from the security breach at JPMorgan Chase

Insider Threats Could Rise as Hackers Troll Social Media (SIGNAL) The recent rash of cyberattacks on major U.S. companies has drawn renewed focus on network vulnerabilities, both in commercial and governmental sectors, and not just on external attackers but on potentially more ominous threats posed by insiders

The number of JPMorgan hackers' targets rises (Help Net Security) The distressing news that the JPMorgan Chase breach resulted in the compromise of data of some 76 million households and 7 million small businesses may be soon followed by more unwelcome announcements of the same kind

Researcher Uncloaks 'Zero-Day' Worm That Can Spread Over All Your Social Networks (Forbes) Imagine it's possible to force a victim's browser to effectively create malware "on-the-fly" that would hand over control of the PC, phone or tablet to a hacker. Now imagine this could be done by having the target click on a link for a domain as popular and trusted as Google GOOGL -0.81%.com, and then executing an ostensibly legitimate file. This is, according to Trustwave SpiderLabs security researcher Oren Hafif, a real possibility

Researcher blames vulnerable code re-use for zero-day in Android's CyanogenMod (Computerworld) A security researcher claimed Android's CyanogenMod developers re-used vulnerable code that puts millions of users at risk of man-in-the-middle attacks

YouTube Ads Lead To Exploit Kits, Hit US Victims (TrendLabs Security Intelligence Blog) Malicious ads are a common method of sending users to sites that contain malicious code. Recently, however, these ads have showed up on a new attack platform: YouTube

Snapchat Hack Involved Undocumented API (ProgrammeableWeb) Snapchat is blaming unofficial, unauthorized apps for an apparent hack that has resulted in thousands of nude photos of users being released on 4chan, the same online forum where nude celebrity photos taken from hacked iCloud accounts were released

A Closer Look at DYRE Malware, Part 2 (TrendLabs Security Intelligence Blog) In the first part of this series, we discussed both the routines and entry point of the banking malware DYRE. However, information theft isn't the last step for this malware. It turns out this malware is also involved in yet another scheme — the parcel mule scam

FinFisher Malware Analysis — Part 3 (Last) (Coding and Security) I've already covered most parts of FinFisher malware in last two articles (part1, part2). This time, in this article, which is last article related to FinFisher, I'll cover last important tricks, methods and techniques used by FinFisher

Bahraini Activists Hacked by Their Government Go After UK Spyware Maker (Wired) Mohammad "Moosa" Abd-Ali Ali sensed something was wrong when he looked down at the Facebook history on his phone. It was in 2011, during the time of the Arab Spring, and the app showed that he'd exchanged a series of messages with a friend. The messages asked his friend where she was, what the location and time of a planned meeting with a group of their friends was, and who would be at the meeting

Who's Watching Your WebEx? (KrebsOnSecurity) KrebsOnSecurity spent a good part of the past week working with Cisco to alert more than four dozen companies — many of them household names — about regular corporate WebEx conference meetings that lack passwords and are thus open to anyone who wants to listen in

Malware analysts tell crooks to shape up and write decent code (Register) Who writes their own crypto these days? Seriously!

Hackers hold 7 million Dropbox passwords ransom (C/Net) Dropbox denies it has been compromised as hackers leak hundreds of passwords online, promising to release almost 7 million more if they're paid for the information

Dropbox bug left some users without their stored files (Help Net Security) Popular file cloud hosting service Dropbox has been sending out emails to a "small number" of its customers, explaining that some of their files have been irretrievably lost because of a bug in its Selective Sync feature

Being a script kiddie easier than ever (SC Magazine via IT News) The recent unravelling of a phishing email campaign shows that even less skill and effort is required today to exploit thousands of users via canned code traded on Facebook and other internet forums

Bulletin (SB14-286) Vulnerability Summary for the Week of October 6, 2014 (US-CERT) The US-CERT Cyber Security Bulletin provides a summary of new vulnerabilities that have been recorded by the National Institute of Standards and Technology (NIST) National Vulnerability Database (NVD) in the past week

Security Patches, Mitigations, and Software Updates

Patch Tuesday for October 2014 — bigger than usual as Microsoft, Adobe and Oracle align (Naked Security) Get ready for a bigger-than-usual Patch Tuesday this month

Palo Alto fixes issues identified by NSS Labs (CRN) Next-generation-firewall vendor thanks testing house for its assistance in applying fix just days after questioning its objectivity and accuracy

HP to revoke certificate that mistakenly signed malware (SC Magazine via IT News) Will re-issue new digital signature

Cyber Trends

Kingdom of Saudi Arabia and UAE Report Highest Level of Malware Threats in Middle East (Zawya) The Kingdom of Saudi Arabia and the UAE posted the highest levels of malware detections in the Middle East over the past year, Trend Micro Incorporated (TYO: 4704; TSE: 4704) announced today

Marketplace

Cyber-insurance becomes popular among smaller, mid-size businesses (Washington Post) More than 3,000 American businesses were hacked last year, many of them small and midsize firms that are often less protected than their multinational counterparts, according to the Center for Strategic and International Studies

J.P. Morgan CEO: Cybersecurity Spending to Double (Wall Street Journal) J.P. Morgan Chase & Co. Chairman and Chief Executive James Dimon said the bank would double spending on cybersecurity over the next five years, his first public remarks following the data breach that hit the nation's largest bank this summer

HP strayed from its strengths long before its recent dysfunction (Quartz) Finally! HP did what everyone but its CEO and board thought inevitable: It spun off the commoditized PC and printing businesses. This is an opportunity to look deeper into HP's culture for roots of today's probably unsolvable problems

NetScout to Buy Danaher's Communications Business (Wall Street Journal) Deal to create global cybersecurity, IT management firm

Merck's VC unit invests in data security business (FierceBioTechIT) With report after report finding flaws in the data security practices of healthcare and life science organizations, Exostar has decided to accelerate its expansion into the sector. And the company has snagged funding from the Merck Global Health Innovation Fund to support its plans

How malware writers' laziness is helping one startup predict attacks before they even happen (ZDNet) Siemens is impressed at what Israeli security startups CyActive can do — developing ways of mitigating attacks before they can take place

As mobile device privacy hits the spotlight, Silent Circle zips ahead (Washington Post) Silent Circle was never your regular tech start-up

Law firm Jenner & Block hones in on data privacy, an uncharted but lucrative field (Washington Post) Two years ago, law firm Jenner & Block tapped Mary Ellen Callahan, the former chief privacy officer of the U.S. Department of Homeland Security, to create the firm's first formal privacy and data protection practice

Washington wants to become a hub for cybersecurity companies. Can it be done? (Washington Post) Montgomery County will be home to the first federally funded research and development center focused solely on advancing cybersecurity technology, a facility that officials recently said will be operated by McLean-based Mitre and Maryland's top research universities

Products, Services, and Solutions

Startup Exabeam Adds Insider Intelligence to Big Data Security (eWeek) CEO says Exabeam users can detect both insider threats and cyberattacks in real time while simultaneously optimizing their security operations

ESET announces new versions of flagship products (Channelline) Security software vendor ESET has launched the newest versions of its flagship security software products: ESET NOD32 Antivirus 8, which is the entry level product, and ESET Smart Security 8. Version 8 adds two significant changes, an improved Exploit Blocker which now adds protection against Java-based attacks, and a new Botnet Protection feature

New Early Warning System for Health Cyber Threats (Health Data Management) HITRUST, a healthcare industry stakeholder coalition working to improve cybersecurity, has launched its third major service during 2014

Meet Anonabox, the tiny WiFi router that can anonymize everything you do online (BGR) Users looking to anonymize everything they do online in order to protect their privacy and/or hide from advertisers can always use the Tor browser, although their online experience might completely change once the switch to Tor is made. However, users who don't want to change their Internet surfing habits while making them more private should check out Anonabox, a tiny WiFi router that directs all data through the Tor network, protecting everything you do online, not just your browsing activity

Focus on IT Security: N-able by SolarWinds (MSPMentor) N-able offers three IT security products for MSPs: Audit Manager, Patch Manager and Security Manager: AV Defender

CipherCloud Announces Industry Solution Packs on Salesforce AppExchange, the World's Leading Enterprise Apps Marketplace (PRNewswire) Customers can now quickly access and apply industry-specific solutions to meet data privacy and compliance needs

Technologies, Techniques, and Standards

13 steps through a data breach (CSO) Here is what an organization should do after a security breach occurs

Cyberattacks trigger talk of 'hacking back' (Washington Technology) The recent rash of cyberattacks on major U.S. companies has highlighted the scant options available to the victims, who often can do little more than hunker down, endure the bad publicity and harden their defenses in hopes of thwarting the next assault

Returning cyber fire (C4ISR & Networks) The topic of returning cyber fire has been discussed for years and continues to come up at a much more frequent pace. With all the high visibility cyber attacks that have occurred over the past several months, no one could blame people for being upset

In AppSec, 'Fast' Is Everything (Dark Reading) The world has shifted. The SAST and DAST tools that were invented over a decade ago are no longer viable approaches to application security

Can CDM change the game? (FCW) The Continuous Diagnostics and Mitigation program represents a dramatic shift from the government's traditional focus on certifying systems as secure and then rechecking them every so often

Identifying deceptive behavior in user-generated content (Help Net Security) In this interview, JT Buser, Manager of Authenticity and Fraud at Bazaarvoice, talks about challenges involved in identifying deceptive behavior in user-generated content as well as interesting techniques he's seen scammers use

VeraCrypt a Worthy TrueCrypt Alternative (eSecurity Planet) A fork of TrueCrypt's code, VeraCrypt strengthens the open source encryption software's transformation process and addresses other weaknesses

What you should consider when choosing a password manager (IDG via CSO) Many security experts feel that passwords are no longer sufficient to keep online accounts safe from hackers, but we're still a long way from widespread adoption of biometrics and alternative methods of authentication

11 open source security tools catching fire on GitHub (IT World) Malware analysis, penetration testing, computer forensics — GitHub hosts a number of compelling tools for securing computing environments of all sizes

CSAM: Be Wary of False Beacons (Internet Storm Center) Hunting for evil in network traffic depends on the analysts ability to locate patterns and variances in oceans of data. This can be an overwhelming tasks and relies on fundamental knowledge of what is considered normal on your network as well as your experienced-based intuition

For or Against: Port Security for Network Access Control (Internet Storm Center) I had an interesting discussion tonight with fellow handler Manuel on the pros and cons on port security as it relates to Network Access Control. I thought it would be interesting to see where others in the security field stand on the issue. Is it worth the effort or not? Is it a valuable tool in Defense in Depth? Here are some of the For and Against arguments we discussed

12 Tips for Responding to Rising Healthcare IT Security Threats (CSO) Healthcare faces a growing breadth and depth of security threats (both intentional and accidental). These 12 steps will help IT leaders prepare for, respond to and perhaps even stay ahead of the latest dangers

EFF Launches New Anti-Surveillance Site (Threatpost) The EFF has launched a new site dedicated to educating users about how to resist pervasive surveillance online, through the promotion of encryption and other tools and the publication of first-person stories from people around the world who have fought surveillance in various ways

Twenty five years of firewall innovation (Help Net Security) When the internet was first launched on a mass scale back in the late 80s, it is understandable that the technology industry got more than a little excited — the way we communicate and thus the entire world around us was being changed for good. But there was one problem: the internet was not designed with security in mind

10 Ways to Protect Your Home Network from Hackers (Yahoo! Tech) Protecting your family's digital assets used to be easy. You just turned on your PC's built-in firewall settings and turned on an antivirus program. As long as you didn't install strange software or do anything stupid, you were usually OK

Research and Development

Researcher builds system to protect against malicious insiders (CSO) Algorithms to spot attacks coming from inside the network gets Army support

Academia

The NSA Wants to Recruit Teen Hackers for Good (New York Magazine) Does your 13-year-old need something to do next summer? Here's a novel idea: Send her to a special cybersecurity camp run by the NSA

Middle school students to become cybersleuths for a day (University at Buffalo News Center) Program promotes digital literacy and Internet safety during National Cybersecurity Awareness Month

Nova Southeastern University Designated a National Center of Academic Excellence in Information Assurance/Cybersecurity (Virtual-Strategy) Nova Southeastern University has been designated a National Center of Academic Excellence in Information Assurance/Cyber Defense (CAE IA/CD) by the National Security Agency (NSA) and the U.S. Department of Homeland Security (DHS). The designation will cover academic years 2014 -2021

Legislation, Policy, and Regulation

North Korea Doubles Size of Cyber Force (The Diplomat) North Korea has nearly doubled the size of its Strategic Cyber Command over the last two years

ASIO powers are no threat to journalists (The Australian) The National Security Legislation Amendment Bill (No 1), which was passed by the House of Representatives a fortnight ago, is the most important single reform to the powers of ASIO in a generation. It is 35 years since the last time the powers of our principal national security agency were the subject of a comprehensive review, following the Hope royal commission, in 1979

White House working around cyber bill impasse (Federal Times) As time runs out for Congress to pass cyber legislation before next year, White House officials are looking for ways around Capitol Hill's inability to enact policies to secure government networks and critical infrastructure

Recruitment, retention focus of Fort Gordon's new cyber command (Augusta Chronicle) Under the pressure of a rapidly changing cyber network, the military needs to come up with innovative practices to recruit and ensure retention of highly-skilled and trained soldiers, the commanding general of Army Cyber Command said Monday

AUSA: Army wrestles with talent amid cyber force build-up (C4ISR & Networks) As the Army assembles a 6,000-person-strong cyber mission force in the next two years, officials are trying to determine the best way to attract, organize and maintain the cyber talent required to secure Defense Department networks

Litigation, Investigation, and Law Enforcement

FBI director wants cyber criminals 'looking over their shoulders' (The Hill) FBI Director James Comey said in an interview broadcast Sunday night that the bureau wants cyber criminals "looking over their shoulders when they're sitting at a keyboard"

Meet the UK's PRISM program (ZDNet) British police can access millions of UK mobile customers' data without a warrant

I want government to have access to your data. Here's why. (ITProPortal) ITProPortal is in Brussels at the 27th annual Information Security Solutions Europe Conference (ISSE), one of Europe's largest gatherings of cyber security experts. Troels Oerting of the Danish police gave a fascinating opening keynote defending the right of the police to use surveillance over the Internet. It certainly ruffled some feathers in Brussels, but here are some of the highlights so you can make up your own mind

Even a Golden Key Can Be Stolen: Inside Apple's Encryption Decision (Gizmodo) Since Apple first announced three weeks ago that it was expanding the scope of what types of data would be encrypted on devices running iOS 8, law enforcement has been ablaze with indignation. When Google followed suit and announced that Android L would also come with encryption on by default, it only added fuel to the fire

Cops and spies should blame THEMSELVES for smartphone crypto 'problem' — Hyppönen (Register) Spooks are 'imperfect' warns top securo-bod

Google reports on "right to be forgotten" requests (Help Net Security) Nearly a month after the release of the latest Google Transparency Report, which showed that government demands for user information have risen 150% over the last five years, a new section has been added that shows how many European privacy requests for search removals have been received by the company

Meet Profile Engine, the "spammy" Facebook crawler hated by people who want to be forgotten (Quartz) Google's latest report on its implementation of the European "right to be forgotten," which allows people to petition to have search results on them removed, shows a backlash against the ubiquity of information about people and their lives floating around on social networks. Facebook had the most Google search results expunged. The second-most requested site is possibly one you have never heard of

Google ordered to forget 'endangered' man's search results by Tokyo court (Naked Security) Takedown-rights fever has hit Tokyo, where a District Court on Thursday issued an injunction forcing Google to take down about 120 of 230 search results that implicated a Japanese man in past crimes

Judge Rejects Defense That FBI Illegally Hacked Silk Road — On a Technicality (Wired) Lawyers for Ross Ulbricht have spent the last two months shifting the focus from their client, charged with creating the billion-dollar drug market the Silk Road, and putting it onto the potential illegality of the FBI's investigation. Now the judge in that case has spoken, and it's clear she intends to put Ulbricht on trial, not the FBI

For a complete running list of events, please visit the Event Tracker.

Newly Noted Events

Cybergamut Tech Tuesday: Receiver Operating Characteristic (ROC) statistics and their successful use in medical studies, Nigerian scams, and APT detection (Columbia, Maryland, USA, Dec 2, 2014) Receiver Operating Characteristic (ROC) statistics have been a practical tool in the field of clinical medicine for more than 50 years, an area where stakes can be very high and test results are understood to be inherently uncertain. ROC statistics and that half-century body of knowledge also usefully inform networked system security across a range of activities including system design, analytics tuning, and operational tactics. This discussion first introduces ROC statistics in the context of clinical medicine, uses those concepts to explain why you can shortly expect a very well written Nigerian scam email, and then examines how ROC statistics can be used for practical improvements to networked system defense against Advanced Persistent Threat activity

Upcoming Events

Hack-in-the-Box Malaysia (Kuala Lumpur, Malaysia, Oct 13 - 16, 2014) HITBSecConf or the Hack In The Box Security Conference is an annual must attend event in the calendars of security researchers and professionals around the world. Held annually in Kuala Lumpur, Malaysia and Amsterdam in The Netherlands, HITBSecConf is a platform for the discussion and dissemination of next generation computer security issues. Our events routinely feature two days of trainings and a two-day multi-track conference featuring cutting-edge hardcore technical talks delivered by some of the most respected names in the computer security industry. HITBSecConf is a place where ideas are exchanged, talent discovered and genius celebrated

FS-ISAC Fall Summit 2014 (Washington, DC, USA, Oct 13 - 16, 2014) The Financial Services Information Sharing and Analysis Center (FS-ISAC), is a non-profit association comprised of financial institution members, that is dedicated to protecting the global financial services sector from physical and cyber threats that impact the resilience, integrity and stability of member institutions through dissemination of trusted and timely information. Its Fall Summit will feature sessions of interest to both security professionals and the financial sector

CYBERSEC 2014 (, Jan 1, 1970) CYBERSEC is a 4-day event geared toward helping you achieve your cybersecurity goals. Whether your focus is on cybersecurity management, investigation, defense, or offense we are offering specialty cybersecurity information tracks just for you.

Black Hat Europe 2014 (, Jan 1, 1970) The premier conference on information security returns to the beautiful city of Amsterdam, Netherlands in October, 2014. Professionals from all over the world gather for two days of intense Trainings and two thought-provoking days of Briefings brought to you by some of the brightest minds in the industry.

Social Security Administration Security Awareness Day (Baltimore, Maryland, USA, Oct 15, 2014) This event, hosted by the Office of Information Security is intended to raise general computer security awareness for the end-users at SSA

Denver SecureWorld (Denver, Colorado, USA, Oct 16, 2014) A day of cyber security education. Earn 6-8 CPE credits, network with industry peers, and take advantage of more than thirty educational events. Over the past decade SecureWorld has emerged as one of North America's most vital cyber-security conference, providing globally relevant education, training and networking for cyber-security professionals on a regional level. SecureWorld provides more content and facilitates more professional connections than any other event in the cyber-security industry. Established in 2002, SecureWorld offers many different continuing professional education sessions over two days in 14 cities throughout the United States.

TechCrunch Disrupt Europe Hackathon (London, England, UK, Oct 18 - 19, 2014) For the second year in a row, TechCrunch is jumping across the pond and bringing the iconic Disrupt and our Hackathon to Europe. We're heading your way, London

U.S. Army ITA Security Forum (Fort Belvoir, Virginia, USA, Oct 20, 2014) The U.S. Army Information Technology Agency Security Forum is taking place at the Ft. Belvoir site and will be a one day event focusing on cyber security education and training for the workforce. The exhibits will take place in the Warrior Conference Room and the training sessions will take place in the Heroes Auditorium

CSEC 2014 Cyber Security Summit (Kingdom of Bahrain, Oct 20 - 22, 2014) At the Inaugural Cyber Security Summit 2014, you will have the opportunity to seek ways to reset your IT security and risk strategy for success; stay relevant as IT security and risk are redefined; implement BCM best practices for threat resilience; mitigate the risks of new social collaboration tools; craft strategy for emerging BYOD and mobile threats; learn new regulatory compliance requirements; and more. This year's CSEC Summit attendees will: hear the latest presentations from the Information Security community on today's most pressing topics, attend workshops run by expert analysts and industry leaders, hear real-life experiences during peer case studies, engage in analyst-user roundtables and one-on-one meetings with industry experts, and check out the latest solutions in our Solution Showcase

2014 ICS Cyber Security Conference (, Jan 1, 1970) The 14th ICS Cyber Security Conference (sometimes known as "Weisscon") will be held October 20-23, 2014 at Georgia Tech in Atlanta, GA. Cyber Security is becoming a critical infrastructure issue with implications that go far beyond the plant fence. Plant engineers, corporate officers, insurance company executives and more will be handling cyber security issues in the coming years. This conference is essential attendance for people in the manufacturing or utility environment.

National Archives and Records Administration (NARA) IT Security Day (College Park, Maryland, USA, Oct 21, 2014) FBC and NARA are working together to coordinate the 6th Annual National Archives and Records Administration (NARA) Information Technology Day. Exhibitors will be on-site to share information and demonstrate their latest security products

Cyber Security Summit 2014 (, Jan 1, 1970) Cyber security breaches have a profound impact on all areas of society. Join the discussion at Cyber Security Summit 2014. For two days, leaders from the public and private sectors meet to identify cyber threat issues and their countermeasures.

Collaborative Approaches for Medical Device and Healthcare Cybersecurity; Public Workshop (Arlington, Virginia, USA, Oct 21 - 22, 2014) The Food and Drug Administration (FDA) is announcing the following public workshop entitled "Collaborative Approaches for Medical Device and Healthcare Cybersecurity." FDA, in collaboration with other stakeholders within the Department of Health and Human Services (HHS) and the Department of Homeland Security (DHS), seeks broad input from the Healthcare and Public Health (HPH) Sector on medical device and healthcare cybersecurity

Secure 2014 (Warsaw, Poland, Oct 21 - 23, 2014) NASK and CERT-Polska offer this conference on telecommunications and IT security. Speakers from government, industry, and universities around the world will offer insights into research, policy, and security trends

Hack.lu 2014 (Dommeldange, Luxembourg, Oct 21 - 24, 2014) Hack.lu is an open convention/conference where people can discuss about computer security, privacy, information technology and its cultural/technical implication on society

ISSA International Conference (Orlando, Florida, USA, Oct 22 - 23, 2014) Join us for solution oriented, proactive and innovative sessions focused on security as a vital part of the business.

ToorCon San Diego (San Diego, California, USA, Oct 22 - 26, 2014) For hackers like you, because what could possibly go wrong?

DOE Germantown Cybersecurity Awareness Day (Germantown, Maryland, USA, Oct 23, 2014) The Department of Energy Germantown Building will be hosting a Cyber Security Awareness Day featuring a technology expo. DoE will be looking for a wide range of cyber security industry experts to showcase their latest technologies. Reaching the professional community within this location can be extremely challenging and this event will provide a great opportunity to provide product demonstrations to this hard-to-reach group, as well as position your company's information to the Department of Energy

Library of Congress Cybersecurity Awareness Expo (Washington, DC, USA, Oct 23, 2014) The Library of Congress (LOC)is hosting its annual cyber security awareness days during October and the exposition is an important part of their education and outreach effort to industry

NASA Glenn Research Center Cyber Security Expo (Cleveland, Ohio, USA, Oct 23, 2014) In recognition of National Cyber Security Awareness Month, an Awareness Day event will be held at Glenn Research Center in Cleveland, Ohio. This event will provide participants with information and resources on today's vulnerabilities, incidents, and security threats, as well as how to protect against them. Live demos and informational booths by top vendors will give participants a look at current trends in cyber security. Exhibitors will have the opportunity to network with government personnel and industry partners to discuss critical issues

FOCUS 14: Empowering the Connected World (Las Vegas, Nevada, USA, Oct 26 - 27, 2014) FOCUS will offer you a unique opportunity to learn directly from other McAfee users. Hear real-world scenarios from McAfee customers and learn how they maintain the highest standards of security while reducing costs, streamlining processes, and driving efficiencies in the daily administration of their networks and systems. Network with security peers who share your challenges, concerns and issues, and learn more about their own success strategies

Cybergamut Tech Tuesday: Software-Defined Networking Security (Columbia, Maryland, USA, Oct 28, 2014) Security-Defined Routing combines cyber analytics and SDN to protect the network: SDR technology assists organizations in scaling the delivery of network traffic to analytic security applications. When incidents are detected, changing the network forwarding tables through SDR techniques can provide an immediate remediation to network attacks, while automating the delivery of suspect traffic for transaction monitoring and archiving data for regulatory compliance and advance troubleshooting

USDA Cyber Security Symposium and Expo 2014 (Washington, DC, USA, Oct 28 - 29, 2014) The Summit will provide participants with information and resources on today's vulnerabilities, incidents, security lifecycle, risks and mitigations; it will also identify ways to work together and build a solid security foundation program to meet future challenges and trends in cyber security. The Cybersecurity Expo, running in conjunction to the Summit, will provide live demos and informational booths focused around the summit topics

Cyber Security and IT Day at Fort Carson (Colorado Springs, Colorado, USA, Oct 28, 2014) The Information Systems Security Association (ISSA) Colorado Springs Chapter ill once again host the 5th Annual Cyber Security & Information Technology Days set to take place at Fort Carson on Tuesday, October 28, 2014 and at Peterson AFB on Wednesday, October 29, 2014. Both events are being conducted in October to coincide with National Cyber Security Awareness Month as a way to encourage collaboration between local military personnel and industry partners. Government and Industry experts will be on hand to brief attendees on the latest trends, best practices and remediation strategies, in the cyber security field. These one day forums will offer Cyber Security & Information Technology personnel a unique, local opportunity to get up-to-date informaton on rapidly evolving security security challenges

Cyber Security and IT Days at Peterson AFB (Colorado Springs, Colorado, USA, Oct 29, 2014) The Information Systems Security Association (ISSA) Colorado Springs Chapter will once again host the 5th Annual Cyber Security & Information Technology Days. Government and Industry experts will be on hand to brief attendees on the latest trends, best practices and remediation strategies, in the cyber security field. These one day forums will offer Cyber Security and Information Technology personnel a unique, local opportunity to get up-to-date informaton on rapidly evolving security security challenges

Dallas SecureWorld (Dallas, Texas, USA, Oct 29 - 30, 2014) Offering two days of cyber security education. Earn 12-16 CPE credits, network with industry peers, and take advantage of more than sixty educational events. Over the past decade SecureWorld has emerged as one of North America's most vital cyber-security conference, providing globally relevant education, training and networking for cyber-security professionals on a regional level. SecureWorld provides more content and facilitates more professional connections than any other event in the cyber-security industry. Established in 2002, SecureWorld offers many different continuing professional education sessions over two days in 14 cities throughout the United States.

Cyber Job Fair (Baltimore, Maryland, USA, Oct 29, 2014) ClearedJobs.Net is partnering with CyberMaryland to present the Cyber Job Fair at the CyberMaryland 2014 conference. The Cyber Job Fair is a hiring event for cleared and non-cleared cybersecurity professionals held the first day of the conference

CyberMaryland 2014 (Baltimore, Maryland, USA, Oct 29 - 30, 2014) Entrepreneurs, investors, academia and government will convene in Maryland — the nation's epicenter for cybersecurity for the fourth annual CyberMaryland Conference.

ekoparty Security Conference 10th edition (Buenos Aires, Argentina, Oct 29 - 31, 2014) ekoparty — Electronic Knock Out Party — Security Conference, is a one of a kind event in South America; an annual security conference held in Buenos Aires, where security specialists from all over Latin America (and beyond) have the chance to get involved with state-of-art techniques, vulnerabilities, and tools in a relaxed environment never seen before.

Cyber Risk Summit (Washington, DC, USA, May 22, 2014) This one-day leadership conference will provide a discussion forum for business executives, insurance companies and policymakers on more effective private and public responses to cyber risk management. Topics to be discussed by expert speakers will include state and federal regulatory and legislative initiatives, efforts to develop a common cyber security framework, the threats from cyber espionage and terrorism, and the development of public and private mechanisms to finance and transfer losses from cyber events.

Senior Executive Cyber Security Conference (Baltimore, Maryland, USA, Oct 30 - Nov 1, 2014) North Star Group, LLC and the Johns Hopkins University's Whiting School of Engineering and Information Security Institute sponsor this senior executive focused cyber security conference.This event is designed for non-technical and technical executives who seek to gain a deeper understanding of not just the technical aspects of data breach prevention, but also the important role that insurance, crisis management, legal and human resources play. Speakers include Dr. Ed Schlesinger, Dean of Johns Hopkins University's Whiting School of Engineering, Dr. Andy Ozment, Assistant Secretary of the Office of Cybersecurity and Communications, Department of Homeland Security, and Mr. Eric Joost, Chief Operating Officer, Willis North America