The CyberWire Daily Briefing 10.16.14

Cyber Attacks, Threats, and Vulnerabilities

FBI warns industry of Chinese cyber campaign (Washington Post) The FBI on Wednesday issued a private warning to industry that a group of highly skilled Chinese government hackers was in the midst of a long-running campaign to steal valuable data from U.S. companies and government agencies

Military expert: US is top cyber thief and attacker (China Military Online) Foreign media recently reported that former U.S. National Security Agency (NSA) contractor Edward Snowden once again disclosed a top-clearance NSA "secret" action, including its espionage and cyber attacks against China. This reveals to the international community the true color of the US, which has regarded itself as the world cop in the cycler space

'Hurricane Panda' Cyberspies Used Windows Zero-Day For Months (Dark Reading) The vulnerability is one of multiple issues patched this week by Microsoft that have been targeted by attackers

Brazen Chinese company tried to beat the NSA at its own game…by hacking into the spy agency (Washington Times) Chinese telecommunications equipment giant Huawei Technologies sought to gain access to National Security Agency computer networks this year in a failed cyberespionage attack, U.S. officials said

RATs threatening democracy activists in Hong Kong (F-Secure) Hong Kong has been in the headlines lately thanks to the Occupy central campaign (#occupycentral, #OccupyHK) and the umbrella revolution (#umbrellarevolution, #UmbrellaMovement). DPHK, Democratic Party Hong Kong and Alliance for True Democracy (ATD) are central players in this movement

Windows zero-day used in targeted attacks (Virus Bulletin) Vulnerability used to download BlackEnergy trojan — as discussed during VB2014

POODLE Vulnerability Puts Online Transactions At Risk (TrendLabs Security Intelligence Blog) Earlier today, Google researchers Bodo Möller, Thai Duong, and Krzysztof Kotowicz released a paper discussing a serious bug in SSL 3.0 that allows attackers to conduct man-in-the-middle attacks and decrypt the traffic between Web servers and end users

POODLE attack takes bytes out of your encrypted data — here's what to do (Naked Security) Imagine that you're a hacker who has taken over a Wi-Fi access point at a coffee shop

Ghost in the (Bourne Again) Shell: Fallout of Shellshock far from over (Ars Technica) Patches for Shellshock alone won't fix already-compromised systems

4 million UPnP devices may be vulnerable to attack (Help Net Security) Akamai has observed the use of a new reflection and amplification DDoS attack that deliberately misuses communications protocols that come enabled on millions of home and office devices, including routers, media servers, web cams, smart TVs and printers

KnowBe4 Issues Alert: CryptoWall 2.0 Ransomware Moves to TOR Network (InsuranceNewsNet) KnowBe4 issued an alert to IT Managers that a new version of the world's most widespread ransomware CryptoWall has migrated to the TOR network. It has been upgraded to version 2.0, and continues to encrypt files so that a ransom can be extracted if there are no backups or if the backup process fails, often a common occurrence

Java Reflection API Woes Resurface in Latest Oracle Patches (Threatpost) Problems with the maligned Java Reflection API, the molten core of far too many exploited Java vulnerabilities in 2013, have surfaced again

XXE Attacks (Infosec Institute) XXE (XML External Entity attack) is now increasingly being found and reported in major web applications such as Facebook, PayPal, etc. For instance, a quick look at the recent Bug Bounty vulnerabilities on these sites confirms this. Although XXE has been around for many years, it never really got as much attention as it deserved. Most XML parsers are vulnerable to it by default, which means it is the responsibility of a developer to make sure that the application is free from this vulnerability. In this article we will explore what XML external entities are and how they can be attacked

eBay is still feeling the effects of a damaging cyber-attack (Quartz) The numbers: eBay posted earnings of $673 million (or $0.54 per share) on revenue of $4.4 billion, which was up 12% from a year ago. But for the second straight quarter, the online auction site was forced to cut its revenue forecast. It continues to feel the effects of a huge security breach it suffered in May. The stock has fallen by about 3% in after-hours trading

Windows XP Is Still a Favorite Among Hackers (MIT Technology Review) Microsoft no longer supports Windows XP, but it remains popular, and is a juicy target for cybercriminals

Russian Hackers Made $2.5B Over The Last 12 Months (Dark Reading) The big bucks are in selling credit card data — not using it for fraud — and PoS and ATM attacks are on the rise

Security Patches, Mitigations, and Software Updates

Browser Vendors Move to Disable SSLv3 in Wake of POODLE Attack (Threatpost) With details of the new POODLE attack on SSLv3 now public, browser vendors are in the process of planning how they're going to address the issue in their products in a way that doesn't break the Internet for millions of users but still provides protection

Drupal Fixes Highly Critical SQL Injection Flaw (Threatpost) Drupal has patched a critical SQL injection vulnerability in version 7.x of the content management system that can allow arbitrary code execution

OpenSSL Patches Four Vulnerabilities (US-CERT) OpenSSL has released updates patching four vulnerabilities, some of which may allow an attacker to cause a Denial of Service (DoS) condition or execute man-in-the-middle attacks

Microsoft Extends SHA-2, TLS Support for Windows (Threatpost) One by one, tech companies have been tossing aside the SHA-1 cryptographic algorithm like the unreliable collision-prone mess that it is

Google adds security and flexibility to latest Android mobile OS (ComputerWeekly) Google is to begin rolling out the latest, most enterprise-friendly version of its Android mobile operating system from 17 October 2014

Snapchat to address sketchy third-party apps with public API…at some point (Naked Security) Oh, those darn third-party apps, their home-brewed APIs and their photo-leaking ways, Snapchat moaned on Wednesday morning, promising to cook up a public API to fix the situation…sooner or later

Cyber Trends

Hackers Shake Confidence in 1980s Free Software Idealism (Bloomberg) Hackers have shaken the free-software movement that once symbolized the Web's idealism

Cybercrime: The Next Entrepreneurial Growth Business? (Wired) Cyberspace is constantly evolving and presenting organizations with new opportunities, as the desire of businesses to quickly adopt new technologies, such as using the Internet to open new channels and adopting cloud services, provides vast opportunity. But, it also brings unanticipated risks and inadvertent consequences that can have a potentially negative impact

How Cybercrime Can Impact Medical Devices (MED Device Online) Concerns have been raised by European law enforcement about the hijacking of digital information, which could include computer-driven medical devices. The FDA also recently instituted cybersecurity guidelines in response to what is perceived as a growing threat

What Is ICS Cybersecurity — You Don't Need Digital Assets (Control) I am in Las Vegas attending the IEC TC45A Nuclear Plant Cyber Security Standards meetings as a designated US Expert. As mentioned, in my earlier blog, I have a great concern about many people in nuclear (and other) industries only focusing on malicious cyber attacks to the exclusion of unintentional cyber incidents

UK prime cyber attack target of Europe and Middle East (Financial Times) Britain suffered significantly more sophisticated cyber attacks in the first half of the year than any other state in Europe or the Middle East

Marketplace

Why CISOs Are Investing in Cyber Threat Intelligence (Recorded Future) Recently, we had the wonderful opportunity to host a webinar featuring Threat Intelligence Expert and Principal Analyst, Rick Holland of Forrester Research, Inc. Rick discussed why a chief information security officer (CISO) should invest in cyber threat intelligence. Here are some highlights from the webinar

Threat Intelligence (Accuvant) To improve detection, response, and resolution of relevant threats to their business, security leaders and their teams are turning to the promise of intelligence-driven security. An intelligence-driven approach to security is different than other methods because it seeks to provide defenders with key data and capabilities exactly when they are needed, to maximize resource effectiveness and minimize damage incurred

With data breaches part of daily life, banks seek freedom to robotext (Quartz) The daily threat of cyberattacks has prompted US banks to ask for freedom from restrictions on reaching out to consumers in the event of data breaches

U.S.-Japan Defense Industry Cyber Cooperation (The Diplomat) Both countries will need to pool resources to meet a rising threat

Does Your Cyber Risk Policy Protect You In the Event of an Insider Attack or Data Breach? (ReedSmith) Protecting a company against data breaches requires not only measures to prevent the adverse cyber event, but also adequate insurance to minimize the financial impact should such an event occur

For small biz, cybercrime can be deadly (Philly.com) I trust that my readers are appropriately honoring October as National Cyber Security Awareness Month, sponsored by the U.S. Department of Homeland Security and the National Cyber Security Alliance

Security firms have created the next dot com bubble by 'scaring their customers' (Beta News) There are too many security firms offering insufficient security. At least that's what Ilia Kolochenko, CEO and founder of High-Tech Bridge thinks. He points to the splitting of Symantec as proof that security companies are struggling, and suggests that the emergence of so many firms competing for attention is the start of a new dot com bubble that could burst at any moment

Exclusive: Tech firms HP, EMC call off merger talks — sources (Reuters) Hewlett-Packard Co has ended merger talks with EMC Corp and may announce this development as soon as Wednesday, deciding to walk away after months of fruitless negotiations, people briefed on the matter told Reuters

Analysis: Symantec split was a long time coming (TechTarget) The long-anticipated Symantec split will leave one company focused entirely on security, but experts caution that it's just the first step in fix

Top 4 NASDAQ Stocks In The Security Software & Services Industry With The Highest Gross Margin (Benzinga) Below are the top security software & services stocks on the NASDAQ in terms of gross margin

Gartner Ranks Check Point the Worldwide Market Share Leader in the Firewall Equipment Market, Based on Revenue for Q2 2014 (MarketWatch) Check Point® Software Technologies Ltd. CHKP, +0.80% the worldwide leader in securing the Internet, today announced that the company leads with the top position in worldwide market share for Firewall Equipment in Q2 2014, according to research published by Gartner. Check Point led with 22% of the Firewall Equipment market, a 6.2% and 11.2% lead over the two nearest competitors

Cyber security coalition aims to change the game against malware (Help Net Security) It's good to see that "collaboration" is not just an empty word for the cyber security industry

Mobile security partnership opens between AVG and Sony (Mobile Commerce News) This recent three year deal will mean that the company will be Sony's exclusive protection provider

AVG plans acquisition of Location Labs (Financial News) AVG Technologies N.V. (NYSE: AVG) said that shareholders have approved its acquisition of privately-held Location Labs

Router that anonymises internet activity raises $300,000 on Kickstarter (Guardian) Anonabox, a device that re-routes data through the cloaking Tor network, is tool for freedom of information, developer says

The Sophia Antipolis-based start-up SecludIT raises €740K (Invest in Côte d'Azur) This investment will enable the start-up to escalate its commercial deployment and R&D

Carmel business Emerging Threats set to expand, add high-wage jobs (Current in Carmel) Emerging Threats Pro LLC, a commercial and open source threat intelligence provider, announced plans today to expand its operations here, creating up to 84 new high-wage jobs by 2019

Palantir secures 77K sf lease on West 15th Street (The Real Deal) California-based data-protection firm already occupies 47K square feet in the area

Products, Services, and Solutions

Protegrity Announces Data Protection & Monitoring in Hortonworks Data Platform (MarketWired) Optimized, license-free HDP solution for sensitive data protection using enterprise-class encryption, tokenization and key management

Sticky Password Powers VIPRE® to Enhance Online Security (MarketWired) Sticky Password, a leading password management software provider, has announced a licensing agreement to power ThreatTrack Security's new password management software, VIPRE® Password Vault

BAE Systems Applied Intelligence unveils IndustrialProtect in the Middle East (Zawya) Military-grade solution will protect critical industrial control systems from cyber attack

Boeing Delivers Maritime Signals Intelligence System Early (PCB Design 007) Boeing has delivered the first system in the U.S. Navy's latest order of the Ship's Signal Exploitation Equipment Increment F (SSEE-F) program ahead of schedule

Electronic Armor protects military drones in dangerous world of hacking and crashing (Washington Times) The Pentagon has begun putting an anti-hacking system known as Electronic Armor onto high-tech drones to prevent adversaries from digitally penetrating and potentially crashing the unmanned aircraft from anywhere around the world, military officials said

Kaspersky offers Webcam Protection in Internet Security suite (Infotech Lead) In the wake of recent incidents of cyber crimes through webcam, Kaspersky Lab now offers Webcam Protection module integrated it into Kaspersky Internet Security — Multi-Device

Malcovery Security Delivers Unified Threat Intelligence Services that Enable Network and Brand Protection (PRWeb) New SaaS investigation tools released to facilitate phishing and malware investigations

McAfee's Next Generation Firewall spies greatness in security integration (TechWorld) Is there a limit to what firewalls should do? McAfee wants to find out

Alert Logic Introduces ActiveWatch For Alert Logic Log Manager (Dark Reading) New managed service debuts

A10 Networks forms grand alliance to defend against cyber criminals (Business-Cloud) A10 Networks has formed a grand alliance including RSA, Arista, FireEye, FlowTraq, IBM Security, Ping Identity, Pulse Secure, Symantec, Vectra, Venafi, Webroot to defend companies from the cyber security threat

Viscount Systems awarded U.S. patent for Freedom security technology (SecurityInfoWatch) Freedom Access Control solution is fully compliant with FICAM under the program's PACS 13.02 topology

Technologies, Techniques, and Standards

No Easy Fix for Point-of-Sale Security (eSecurity Planet) Why is securing point-of-sale systems so hard, and what can retailers do to improve their PoS security postures?

Tech firms, associations lead response to cybersecurity framework (FedScoop) The nation's critical infrastructure is massive in its size, diversity and geographic spread — literally tens of thousands of financial, transportation, power, telecommunications, manufacturing, health care and government organizations from coast to coast. So it may have been a surprise to some when the National Institute of Standards and Technology posted a mere 53 responses last week to the Obama administration's voluntary framework for improving critical infrastructure cybersecurity

Manipulating Hackers as a Cyberdefense (GovInfoSecurity) Exploiting cultural values to help thwart attacks

Targeted Attack Protection via Network Topology Alteration (TrendLabs Security Intelligence Blog) When it comes to targeted attacks, attackers are not omniscient. They need to gather information in the early stages to know the target they may gather information from various sources of intelligence, like Google, Whois, Twitter, and Facebook. They may gather data such as email addresses, IP ranges, and contact lists. These will then be used as lure for phishing emails, which inevitably result in gaining access in the targeted organization's network

MindshaRE: Statically Extracting Malware C2s Using Capstone Engine (Arbor DDoS and Security Reports) It's been far too long since the last MindshaRE post, so I decided to share a technique I've been playing around with to pull C2 and other configuration information out of malware that does not store all of its configuration information in a set structure or in the resource section

Research and Development

The Big Mystery: What's Big Data Really Worth? (Wall Street Journal) A lack of standards for valuing information confounds accountants, economists

Academia

Web-Era Trade Schools, Feeding a Need for Code (New York Times) A new educational institution, the coding boot camp, is quietly emerging as the vocational school for the digital age, devoted to creating software developers

Legislation, Policy, and Regulation

South Korean ID system faces overhauls following 10 years of data thefts (Naked Security) The South Korean government is considering reissuing national identity card ID numbers for every citizen over the age of 17, at the cost of billions of US dollars

Army Eyes Coordinated Land-Cyber Missions (Defense News) Seven years ago, the Israeli military's Operation Orchard is believed to have employed an electronic warfare-delivered cyber attack to shut down Syrian anti-air defenses before its jets bombed Syria's Al Kibar nuclear reactor

Litigation, Investigation, and Law Enforcement

Internet Organised Crime Threat Assessment (iOCTA) (EC3) The Internet Organised Crime Threat Assessment (iOCTA) informs decision makers at strategic, policy and tactical levels about on-going developments and emerging threats of cybercrime affecting governments, businesses and citizens in the EU. It draws on highly valuable contributions from law enforcement authorities in the EU and from other countries. Partners in the private sector and academia also provided important input to the report

Seleznev Arrest Explains '2Pac' Downtime (KrebsOnSecurity) The U.S. Justice Department has piled on more charges against alleged cybercrime kingpin Roman Seleznev, a Russian national who made headlines in July when it emerged that he'd been whisked away to Guam by U.S. federal agents while vacationing in the Maldives. The additional charges against Seleznev may help explain the extended downtime at an extremely popular credit card fraud shop in the cybercrime underground

For a complete running list of events, please visit the Event Tracker.

Upcoming Events

Hack-in-the-Box Malaysia (Kuala Lumpur, Malaysia, Oct 13 - 16, 2014) HITBSecConf or the Hack In The Box Security Conference is an annual must attend event in the calendars of security researchers and professionals around the world. Held annually in Kuala Lumpur, Malaysia and Amsterdam in The Netherlands, HITBSecConf is a platform for the discussion and dissemination of next generation computer security issues. Our events routinely feature two days of trainings and a two-day multi-track conference featuring cutting-edge hardcore technical talks delivered by some of the most respected names in the computer security industry. HITBSecConf is a place where ideas are exchanged, talent discovered and genius celebrated

FS-ISAC Fall Summit 2014 (Washington, DC, USA, Oct 13 - 16, 2014) The Financial Services Information Sharing and Analysis Center (FS-ISAC), is a non-profit association comprised of financial institution members, that is dedicated to protecting the global financial services sector from physical and cyber threats that impact the resilience, integrity and stability of member institutions through dissemination of trusted and timely information. Its Fall Summit will feature sessions of interest to both security professionals and the financial sector

CYBERSEC 2014 (, Jan 1, 1970) CYBERSEC is a 4-day event geared toward helping you achieve your cybersecurity goals. Whether your focus is on cybersecurity management, investigation, defense, or offense we are offering specialty cybersecurity information tracks just for you.

Black Hat Europe 2014 (, Jan 1, 1970) The premier conference on information security returns to the beautiful city of Amsterdam, Netherlands in October, 2014. Professionals from all over the world gather for two days of intense Trainings and two thought-provoking days of Briefings brought to you by some of the brightest minds in the industry.

Denver SecureWorld (Denver, Colorado, USA, Oct 16, 2014) A day of cyber security education. Earn 6-8 CPE credits, network with industry peers, and take advantage of more than thirty educational events. Over the past decade SecureWorld has emerged as one of North America's most vital cyber-security conference, providing globally relevant education, training and networking for cyber-security professionals on a regional level. SecureWorld provides more content and facilitates more professional connections than any other event in the cyber-security industry. Established in 2002, SecureWorld offers many different continuing professional education sessions over two days in 14 cities throughout the United States.

TechCrunch Disrupt Europe Hackathon (London, England, UK, Oct 18 - 19, 2014) For the second year in a row, TechCrunch is jumping across the pond and bringing the iconic Disrupt and our Hackathon to Europe. We're heading your way, London

U.S. Army ITA Security Forum (Fort Belvoir, Virginia, USA, Oct 20, 2014) The U.S. Army Information Technology Agency Security Forum is taking place at the Ft. Belvoir site and will be a one day event focusing on cyber security education and training for the workforce. The exhibits will take place in the Warrior Conference Room and the training sessions will take place in the Heroes Auditorium

CSEC 2014 Cyber Security Summit (Kingdom of Bahrain, Oct 20 - 22, 2014) At the Inaugural Cyber Security Summit 2014, you will have the opportunity to seek ways to reset your IT security and risk strategy for success; stay relevant as IT security and risk are redefined; implement BCM best practices for threat resilience; mitigate the risks of new social collaboration tools; craft strategy for emerging BYOD and mobile threats; learn new regulatory compliance requirements; and more. This year's CSEC Summit attendees will: hear the latest presentations from the Information Security community on today's most pressing topics, attend workshops run by expert analysts and industry leaders, hear real-life experiences during peer case studies, engage in analyst-user roundtables and one-on-one meetings with industry experts, and check out the latest solutions in our Solution Showcase

2014 ICS Cyber Security Conference (, Jan 1, 1970) The 14th ICS Cyber Security Conference (sometimes known as "Weisscon") will be held October 20-23, 2014 at Georgia Tech in Atlanta, GA. Cyber Security is becoming a critical infrastructure issue with implications that go far beyond the plant fence. Plant engineers, corporate officers, insurance company executives and more will be handling cyber security issues in the coming years. This conference is essential attendance for people in the manufacturing or utility environment.

National Archives and Records Administration (NARA) IT Security Day (College Park, Maryland, USA, Oct 21, 2014) FBC and NARA are working together to coordinate the 6th Annual National Archives and Records Administration (NARA) Information Technology Day. Exhibitors will be on-site to share information and demonstrate their latest security products

Cyber Security Summit 2014 (, Jan 1, 1970) Cyber security breaches have a profound impact on all areas of society. Join the discussion at Cyber Security Summit 2014. For two days, leaders from the public and private sectors meet to identify cyber threat issues and their countermeasures.

Collaborative Approaches for Medical Device and Healthcare Cybersecurity; Public Workshop (Arlington, Virginia, USA, Oct 21 - 22, 2014) The Food and Drug Administration (FDA) is announcing the following public workshop entitled "Collaborative Approaches for Medical Device and Healthcare Cybersecurity." FDA, in collaboration with other stakeholders within the Department of Health and Human Services (HHS) and the Department of Homeland Security (DHS), seeks broad input from the Healthcare and Public Health (HPH) Sector on medical device and healthcare cybersecurity

Secure 2014 (Warsaw, Poland, Oct 21 - 23, 2014) NASK and CERT-Polska offer this conference on telecommunications and IT security. Speakers from government, industry, and universities around the world will offer insights into research, policy, and security trends

Hack.lu 2014 (Dommeldange, Luxembourg, Oct 21 - 24, 2014) Hack.lu is an open convention/conference where people can discuss about computer security, privacy, information technology and its cultural/technical implication on society

ISSA International Conference (Orlando, Florida, USA, Oct 22 - 23, 2014) Join us for solution oriented, proactive and innovative sessions focused on security as a vital part of the business.

ToorCon San Diego (San Diego, California, USA, Oct 22 - 26, 2014) For hackers like you, because what could possibly go wrong?

DOE Germantown Cybersecurity Awareness Day (Germantown, Maryland, USA, Oct 23, 2014) The Department of Energy Germantown Building will be hosting a Cyber Security Awareness Day featuring a technology expo. DoE will be looking for a wide range of cyber security industry experts to showcase their latest technologies. Reaching the professional community within this location can be extremely challenging and this event will provide a great opportunity to provide product demonstrations to this hard-to-reach group, as well as position your company's information to the Department of Energy

Library of Congress Cybersecurity Awareness Expo (Washington, DC, USA, Oct 23, 2014) The Library of Congress (LOC)is hosting its annual cyber security awareness days during October and the exposition is an important part of their education and outreach effort to industry

NASA Glenn Research Center Cyber Security Expo (Cleveland, Ohio, USA, Oct 23, 2014) In recognition of National Cyber Security Awareness Month, an Awareness Day event will be held at Glenn Research Center in Cleveland, Ohio. This event will provide participants with information and resources on today's vulnerabilities, incidents, and security threats, as well as how to protect against them. Live demos and informational booths by top vendors will give participants a look at current trends in cyber security. Exhibitors will have the opportunity to network with government personnel and industry partners to discuss critical issues

2014 Omaha Cyber Security Event (Omaha, Nebraska, USA, Oct 23, 2014) Better Business Bureau and its partners present a panel discussion on how to stay safe online — it's our shared responsibility! Learn the risks, how to spot potential problems and how our online actions impact our safety. Panelists include professionals from the: US Secret Service, FBI, National Cyber Security Alliance and Nebraska Sate Information Office

FOCUS 14: Empowering the Connected World (Las Vegas, Nevada, USA, Oct 26 - 27, 2014) FOCUS will offer you a unique opportunity to learn directly from other McAfee users. Hear real-world scenarios from McAfee customers and learn how they maintain the highest standards of security while reducing costs, streamlining processes, and driving efficiencies in the daily administration of their networks and systems. Network with security peers who share your challenges, concerns and issues, and learn more about their own success strategies

Cybergamut Tech Tuesday: Software-Defined Networking Security (Columbia, Maryland, USA, Oct 28, 2014) Security-Defined Routing combines cyber analytics and SDN to protect the network: SDR technology assists organizations in scaling the delivery of network traffic to analytic security applications. When incidents are detected, changing the network forwarding tables through SDR techniques can provide an immediate remediation to network attacks, while automating the delivery of suspect traffic for transaction monitoring and archiving data for regulatory compliance and advance troubleshooting

USDA Cyber Security Symposium and Expo 2014 (Washington, DC, USA, Oct 28 - 29, 2014) The Summit will provide participants with information and resources on today's vulnerabilities, incidents, security lifecycle, risks and mitigations; it will also identify ways to work together and build a solid security foundation program to meet future challenges and trends in cyber security. The Cybersecurity Expo, running in conjunction to the Summit, will provide live demos and informational booths focused around the summit topics

Cyber Security and IT Day at Fort Carson (Colorado Springs, Colorado, USA, Oct 28, 2014) The Information Systems Security Association (ISSA) Colorado Springs Chapter ill once again host the 5th Annual Cyber Security & Information Technology Days set to take place at Fort Carson on Tuesday, October 28, 2014 and at Peterson AFB on Wednesday, October 29, 2014. Both events are being conducted in October to coincide with National Cyber Security Awareness Month as a way to encourage collaboration between local military personnel and industry partners. Government and Industry experts will be on hand to brief attendees on the latest trends, best practices and remediation strategies, in the cyber security field. These one day forums will offer Cyber Security & Information Technology personnel a unique, local opportunity to get up-to-date informaton on rapidly evolving security security challenges

Cyber Security and IT Days at Peterson AFB (Colorado Springs, Colorado, USA, Oct 29, 2014) The Information Systems Security Association (ISSA) Colorado Springs Chapter will once again host the 5th Annual Cyber Security & Information Technology Days. Government and Industry experts will be on hand to brief attendees on the latest trends, best practices and remediation strategies, in the cyber security field. These one day forums will offer Cyber Security and Information Technology personnel a unique, local opportunity to get up-to-date informaton on rapidly evolving security security challenges

Dallas SecureWorld (Dallas, Texas, USA, Oct 29 - 30, 2014) Offering two days of cyber security education. Earn 12-16 CPE credits, network with industry peers, and take advantage of more than sixty educational events. Over the past decade SecureWorld has emerged as one of North America's most vital cyber-security conference, providing globally relevant education, training and networking for cyber-security professionals on a regional level. SecureWorld provides more content and facilitates more professional connections than any other event in the cyber-security industry. Established in 2002, SecureWorld offers many different continuing professional education sessions over two days in 14 cities throughout the United States.

Cyber Job Fair (Baltimore, Maryland, USA, Oct 29, 2014) ClearedJobs.Net is partnering with CyberMaryland to present the Cyber Job Fair at the CyberMaryland 2014 conference. The Cyber Job Fair is a hiring event for cleared and non-cleared cybersecurity professionals held the first day of the conference

CyberMaryland 2014 (Baltimore, Maryland, USA, Oct 29 - 30, 2014) Entrepreneurs, investors, academia and government will convene in Maryland — the nation's epicenter for cybersecurity for the fourth annual CyberMaryland Conference.

ekoparty Security Conference 10th edition (Buenos Aires, Argentina, Oct 29 - 31, 2014) ekoparty — Electronic Knock Out Party — Security Conference, is a one of a kind event in South America; an annual security conference held in Buenos Aires, where security specialists from all over Latin America (and beyond) have the chance to get involved with state-of-art techniques, vulnerabilities, and tools in a relaxed environment never seen before.

Cyber Risk Summit (Washington, DC, USA, May 22, 2014) This one-day leadership conference will provide a discussion forum for business executives, insurance companies and policymakers on more effective private and public responses to cyber risk management. Topics to be discussed by expert speakers will include state and federal regulatory and legislative initiatives, efforts to develop a common cyber security framework, the threats from cyber espionage and terrorism, and the development of public and private mechanisms to finance and transfer losses from cyber events.

Senior Executive Cyber Security Conference (Baltimore, Maryland, USA, Oct 30 - Nov 1, 2014) North Star Group, LLC and the Johns Hopkins University's Whiting School of Engineering and Information Security Institute sponsor this senior executive focused cyber security conference.This event is designed for non-technical and technical executives who seek to gain a deeper understanding of not just the technical aspects of data breach prevention, but also the important role that insurance, crisis management, legal and human resources play. Speakers include Dr. Ed Schlesinger, Dean of Johns Hopkins University's Whiting School of Engineering, Dr. Andy Ozment, Assistant Secretary of the Office of Cybersecurity and Communications, Department of Homeland Security, and Mr. Eric Joost, Chief Operating Officer, Willis North America

FS-ISAC EU Summit 2014 (London, England, UK, Nov 3 - 5, 2014) The Financial Services Information Sharing and Analysis Center (FS-ISAC), is a non-profit association comprised of financial institution members, that is dedicated to protecting the global financial services sector from physical and cyber threats that impact the resilience, integrity and stability of member institutions through dissemination of trusted and timely information. Its EU Summit will feature sessions of interest to both security professionals and the financial sector

POC2014 (Seoul, Republic of Korea, Nov 4 - 7, 2014) POC (Power of Community) started in 2006 and has been organized by Korean hackers & security experts. It is an international security & hacking conference in Korea. POC doesn't pursue money. POC concentrates on technical and creative discussion and shows real hacking and security. POC wears both black hat and white hat. POC will share knowledge for the sake of the power of community. POC believes that the power of community will make the world safer.

Open Source Digital Forensics Conference 2014 (Herndon, Virginia, USA, Nov 5, 2014) This conference focuses on tools and techniques that are open source and (typically) free to use. It is a one day event with short talks packed with information. There are both tool developers and users in attendance, and this is a unique opportunity to learn about new tools and provide feedback

Bay Area SecureWorld (Santa Clara, California, Nov 5, 2014) A day of cyber security education. Earn 6-8 CPE credits, network with industry peers, and take advantage of more than thirty educational events. Over the past decade SecureWorld has emerged as one of North America's most vital cyber-security conference, providing globally relevant education, training and networking for cyber-security professionals on a regional level. SecureWorld provides more content and facilitates more professional connections than any other event in the cyber-security industry. Established in 2002, SecureWorld offers many different continuing professional education sessions over two days in 14 cities throughout the United States.

Managing BYOD & Enterprise Mobility USA 2014 (San Francisco, California, USA, Nov 5 - 6, 2014) The Managing BYOD & Mobility USA 2014 conference will provide a unique networking platform, bringing together top executives from USA and beyond. They come together not only to address mobility challenges and set the precautions framework, but most importantly to provide the necessary tools, insights and methodological steps for constructing a successful mobility policy. These policies will fulfill the BYOD prophecy of increased productivity, employee satisfaction, cost savings and corporate competitive advantage

Journal of Law and Cyber Warfare First Annual Cyber Warfare One Day Symposium (New York, New York, USA, Nov 6, 2014) The Journal of Law and Cyber Warfare is proud to present the First Annual Cyber Warfare One Day Symposium. Join us as senior lawyers, technology chiefs, government officials, and academics discuss the current threat of cyber security and how it is affecting US corporations. CLE credit is available on certain panels

RiseCON 2014 (Rosario, Santa Fe, Argentina, Nov 6 - 7, 2014) Rosario Information Security Conference: es el primer y mayor evento de seguridad informática y hacking realizado en la ciudad de Rosario, con nivel y trascendencia internacional

Israel HLS 2014 (Tel Aviv, Israel, Nov 9 - 12, 2014) The third International Conference on Homeland Security will bring together government officials, public authorities, and HLS industry leaders from around the world to share their knowledge and experience. They will participate in high-level discussions on securing the safety of citizens and protecting critical infrastructure and property, and explore Israel's advanced HLS technologies and systems.

Critical Infrastructure Cyber Community (C3) Voluntary Program Meeting (San Diego, California, USA, Oct 13, 2014) Join stakeholders from across the cyber community to discuss building a cyber risk management program, using DHS resources, and to learn how organizations of all sizes are using the Cybersecurity Framework

i-Society 2014 (London, England, UK, Nov 10 - 12, 2014) i-Society 2014 is a global knowledge-enriched collaborative effort that has its roots from both academia and industry. The conference covers a wide spectrum of topics that relate to information society, which includes technical and non-technical research areas.

Seattle SecureWorld (Seattle, Washington, USA, Nov 12 - 13, 2014) Offering two days of cyber security education. Earn 12-16 CPE credits, network with industry peers, and take advantage of more than sixty educational events. Over the past decade SecureWorld has emerged as one of North America's most vital cyber-security conference, providing globally relevant education, training and networking for cyber-security professionals on a regional level. SecureWorld provides more content and facilitates more professional connections than any other event in the cyber-security industry. Established in 2002, SecureWorld offers many different continuing professional education sessions over two days in 14 cities throughout the United States.

AVAR 2014 (, Jan 1, 1970) The 17th Association of anti-Virus Asia Researchers International Conference: Security Down Under. Topics will include case studies of targeted attacks, real-life attack demonstrations, web-inject attacks/code insertion attacks, man-in-the-browser attacks, targeted advanced persistent threats, dedicated advanced evasion techniques, and mitigations to all of these. The conference will also take up identification and investigation of targeted threats, how to spot targeted attacks in collections, COINTEL (counter intelligence) on determined adversaries (e.g, detecting the attacker, running honeypots, etc.), mobile malware, and security policies.

ZeroNights 2014 (Moscow, Russia, Nov 13 - 14, 2014) ZeroNights is an international conference dedicated to the practical side of information security. It will show new attack methods and threats, showcase new possibilities of attack and defense, and suggest out-of-the-box security solutions. ZeroNights gathers experts, infosecurity practitioners, analysts, and hackers from all over the world

Cyber Security Awareness Week Conference (New York, New York, USA, Nov 13 - 15, 2014) Get ready for CSAW: the largest student-run cyber security event in the nation, with a research conference that attracts some of the biggest names in the industry, and a career fair with an impressive list of corporate partners. It's a weekend of competitions, keynote talks and cyber security events, designed to prepare best-performing students with the skills and knowledge to shape the future of the industry

Ground Zero Summit, India (New Dehli, India, Nov 13 - 16, 2014) Ground Zero Summit (GOS) 2014 in its second year promises to be Asia's largest Information Security gathering and proposes to be the ultimate platform for showcasing researches and sharing knowledge in the field of cyber security. GOS rationale: The increasing volume and complexity of cyber threats - including phishing scams, data theft, and online vulnerabilities, demand that we remain vigilant about securing our systems and information. Enterprises and governments worldwide are grappling the grim reality of data and critical systems being exploited. This summits aims at addressing these new forms of cyber attack and formulate solutions

Deepsec 2014 (Vienna, Austria, Nov 18 - 21, 2014) DeepSec is an annual European two-day in-depth conference on computer, network, and application security. This is a non-product, non-vendor-biased conference event. Our aim is to present the best research and experience from the fields' leading experts.

BugCON (Mexico City, Mexico, Nov 19, 2014) BugCON Security Conference is hardcore technical conference focused on the technical side of the security. Running since 2008 BugCON is the oldest forum where researchers, students and professionals shows their latest research and projects

International Cyber Warfare and Security Conference (Ankara, Turkey, Nov 19 - 20, 2014) In-depth discussions will cover: new emerging threats and challenges on cyber warfare, the policy of leading cyber nations in cyber warfare and security, legal aspects of cyber warfare, industrial perspective in cyber warfare and security, new trends, new developments, technologies and solutions, and the next generation of cyber attacks—mapping the future threat environment.

EDSC 2014 (Seattle, Washington, USA, Nov 20 - 21, 2014) EDSC is a security conference focusing on embedded systems, hardware, and anything behind the silicon curtain. Embedded testing is a rapidly expanding area of the security industry staying current is important for engineers, researchers, and testers alike. EDSC will bring the top thought leaders in the embedded security field together for two days to share knowledge, techniques, and research.

Ethiopia Banking and ICT Summit (Addis Ababa, Ethiopia, Nov 21, 2014) he one day summit is designed to highlight the key Investment opportunities especially in the Banking & ICT Sectors. As an emerging economic capital for the region, Ethiopia is leading the way in industrial growth, international trade and global integration for sub-Saharan Africa as a whole.

BSidesVienna (Vienna, Austria, Nov 22, 2014) BSidesVienna will open it's doors again in 2014. Be part of it and stay tuned