The CyberWire Daily Briefing for 3.11.2014

Cyber Attacks, Threats, and Vulnerabilities

Ukrainian authorities suffer new cyber attacks (Reuters via Yahoo! News) Ukraine's top security body said on Saturday that it and the national news agency had been hit by cyber attacks, the latest suffered by state organizations since the start of the crisis over Crimea

Russia suspected of Ukraine cyber attack (SC Magazine) Government mobile phone hacks, viruses, leaks and website defacement are all reportedly underway in Ukraine following the takeover of Crimea

Ukraine faced at least 22 cyber-attacks since January 2013: Security firm (NDTV) Ukraine was repeatedly attacked by sophisticated cyberspies as tensions between pro-Russian and Western-leaning factions escalated in recent months, according to a report from U.K.-based defense contractor BAE Systems

Crimea — Is Russia adopting the same cyber strategy used in Georgia? (Security Affairs) Experts that are monitoring the escalation of tension in Crimea recognized a military strategy similar to the one adopted in Georgia

Russian Cyber Warfare Capabilities in 2014 (We aren't in Georgia anymore) (Digital Dao) Russia's latest offensive against Ukraine over Crimea has revealed how little Russian expertise the U.S. has (see this New York Times article) as well as the failure of the U.S. Intelligence Community to anticipate Russian military actions against Georgia in 2008 and Ukraine in 2014 (See former DCI Michael Hayden here)

With Russia and Ukraine, is all really quiet on the cyber front? (Ars Technica) Unlike recent conflicts, RUS hasn't used high-profile, public cyberattacks yet. Reports in recent days of cyber incidents involving Russia and Ukraine are largely unconfirmed and inconsistent. The scale and frequency of website defacements—of the kind the Russian government broadcaster RT reported over a week ago—is barely distinguishable from the ordinary background noise of hostile activity against any high-profile site. This is a vastly different situation to the mass denial of service (DoS) and hacking attacks that targeted Estonia in 2007 and Georgia in 2008

Cyber-Weapons' Deployment Uncertain in Ukraine, Russia Standoff (eWeek) Russia and Ukraine have well-developed cyber skills, prompting security experts to wonder to how they could come into play in the standoff between the two former Soviet bloc nations

EXPERT: The Ukraine-Russia Cyberwar Is 'More Serious And Damaging' Than The Annexation Of Crimea (Business Insider) The Russian-Ukrainian cyber war could be "far more serious and damaging" than any actions taken involving the annexation of Crimea, according to computer security and forensics expert Darren Hayes

Anti-Israel Hackers Plan Mass Attack for April 7 (Video) (Jewish Press) The cyber hackers are crawling out of the woodwork for "Hacktivists month" in April. Hackers attacked an out-of-date Israel credit card website Monday and are planning a massive attack on websites and mobile phones on April 7, according to experts of the Aman group, ClearSky and Terrogence

Cybercriminals entrenched in 'Dark Web': researchers (AFP via Yahoo! News) Cybercriminals are settling into a comfortable place in the "Dark Web" where they test, refine and distribute malware for online thievery

Techniques used in high-profile data breaches (Help Net Security) McAfee Labs released a new report, highlighting the role of the "dark web" malware industry as a key enabler of the high-profile POS attacks and data breaches in the fall of 2013

The Dark Web: Boogie men, Cyber Crime Lords and/or both? (Trend Micro Simply Security) Massive IT transformation has been happening to the enterprise significantly since the advent of machine virtualization in the mid 2000's. This set the wheels in motion for Cloud Computing. We are at the precipice with Cloud and mobile computing

Criminals on Tor is the price of global liberty (CSO via NetworkWorld) Research pointing to rising criminality on Tor shows the cost of having a network that provides anonymity to whistleblowers, journalists, political dissidents and others trying to avoid government surveillance

How Tor Works (MIT Technology Review) A video demonstrating how Tor uses a series of relays to protect anonymity online

Online Anonymity in a Box, for $49 (MIT Technology Review) A cheap device called the Safeplug makes it easy to use the Tor anonymity network at home

'Perfect' ransomware is the scariest threat to your PC (PC World) Nothing spurs malware development like success, and that's likely to be the case in the coming months with ransomware

Cyber criminals expand use of CVE-2014-0322 before Patch Tuesday (Websense Security Labs Blog) In advance of the Internet Explorer zero-day referenced by the CVE-2014-0322 patch that will commence on patch Tuesday the March 11, we thought it would be helpful to look at how this exploit was utilized in the lure stage, since this may unveil some of the tactics used by crimeware and targeted attack actors in this day and age. We've seen this latest zero-day employed by targeted attacks involving a cybersquatted domain that appeared to target the French Aerospace Association, as we described in our previous blog post on the subject. Since then, exploit instances utilizing CVE-2014-0322 have been carried out in crimeware attacks in the wild, and it seems that the exploit source code used in the initial attacks was made available publicly, which contributed to the usage of the zero-day

Hackers hoarding Windows XP exploits for cut-off bonanza (V3) With just less than a month until support for Windows XP ends, the security community has warned that hackers are hoarding exploits to let loose on unsuspecting firms once support ends

IPv6 could open networks up to zero-day attacks (NetworkWorld) NIST warns that attackers are preparing to hit networks when IPv6 is turned on

Malware peddlers are trying out different exploit kits (Help Net Security) Websense researchers have been following several recent email spam campaigns targeting users of popular services such as Skype and Evernote, and believe them to be initiated by the infamous ru:8080 gang, which a history of similar spam runs impersonating legitimate Internet services such as Pinterest, Dropbox, etc.

Possible scam? "Ponzicoin" seems to have made off with $7,000 in bitcoins (Ars Technica) "As more players make deposits, older ones are [repaid] at 120%." A website calling itself Ponzicoin appears to have stayed true to its word—taking bitcoins from "players" and running with them. Since Sunday, 37 people have sent a total of just over 10 bitcoins (worth around $7,000 at present exchange rates) to the site and are still waiting to be paid. Previously, the site had paid out to hundreds of people

50,000 Statista users affected by data breach (Help Net Security) Customers of the biggest online statistics portal Statista are being notified that the company's systems have been breached and the hackers likely made away with its user database

Experian Lapse Allowed ID Theft Service Access to 200 Million Consumer Records (Krebs on Security) In October 2013, KrebsOnSecurity published an exclusive story detailing how a Vietnamese man running an online identity theft service bought personal and financial records on Americans directly from a company owned by Experian, one of the three major U.S. credit bureaus. Today's story looks deeper at the damage wrought in this colossal misstep by one of the nation's largest data brokers

Report: Cyber Criminals Bank Nearly $4 Billion On Tax Fraud (Dark Reading) Attackers collect almost $4 billion by filing fraudulent tax returns, stealing taxpayer identities, ThreatMetrix report says

Iowa DHS data breach dates back 2008, more than 2,000 impacted (SC Magazine) Information on more than 2,000 individuals — including Social Security numbers — leaked outside a secure network because, since 2008, two employees with the Iowa Department of Human Services (DHS) used personal online accounts and storage devices to maintain the data, which goes against department policy

Got a Netgear router from Virgin Media? Change your admin password NOW (The Register) Wi-Fi cred-baring vuln lets attackers take full control

Debian Security Advisory: Wireshark security update (Debian) Multiple vulnerabilities were discovered in Wireshark

Target hackers showed intimate knowledge of firm's network, suggests McAfee (TechWorld) What might have stopped them? The attack that planted malware on Target's point of sale (POS) terminals in November's huge data breach used inside knowledge of the network rather than a vulnerability in its retail software, McAfee has said in its latest quarterly analysis

How massive DDoS attacks leverage the Internet's DNA (The Last Watchdog) The bad guys are taking full advantage of the squishy parts of the Internet's DNA. The result: massive DDoS attacks are disrupting Internet commerce, and slowing down the speed of the web

Justin Bieber's Twitter account hacked (SC Magazine) An unknown attacker gained access to Justin Bieber's Twitter account this past weekend and remained in control for about 15 minutes

Why You Need To Rip The Mailing Label Off Magazines As Soon As They Arrive (Forbes) Until last week, if you wanted to see the password that New Yorker subscribers use to access their accounts online, all you needed was their name and address. That information, of course, is not hard to find; it's on the label of every issue mailed out, meaning that a magazine with the label still attached passed on to someone on an airplane or in a waiting room is suddenly a security risk

Brazilian Blackout Traced to Sooty Insulators, Not Hackers (Wired) A massive 2007 electrical blackout in Brazil has been newly blamed on computer hackers, but was actually the result of a utility company's negligent maintenance of high voltage insulators on two transmission lines. That's according to reports from government regulators and others who investigated the incident for more than a year

Security Patches, Mitigations, and Software Updates

Critical Windows And IE Vulnerabilities: Microsoft to Dispatch Updates; Fix For 'Zero-Day Vulnerability' on the Way (International Business Times) Windows XP is set to get its penultimate patch on Tuesday. According to the Microsoft Security Bulletin Advance Notification (March 2014), there will be a total of five updates released this week, two of them addressing "critical" vulnerabilities

iOS 7.1 released, patching bugs and fixing the White Screen of Death (Graham Cluley) Apple has just released iOS 7.1, the latest versions of its mobile operating system for iPhone and iPad users, and owners of the devices are recommended to upgrade as soon as possible

Windows XP: 30 days until game over (CSO Salted Hash) Not to long ago I wrote a missive about the death of Windows XP and the inevitable end of support from Microsoft approaching in less than 30 days now. There is still a large swath of users our there have are on this platform even now. Tomorrow, Microsoft will release what I believe is the last patch for Windows XP. Will this make it secure? Not a chance. This is an unsupported platform. If you're still using this and have not already started transitioning off it you'd better start polishing up your resume

Cyber Trends

Secret Service Agent Says Many Cyber Breaches Go Unreported (Insurance Journal) Many breaches in data security may be going unreported by American businesses. That's according to Kirk Arthur, supervisory special agent for the U.S. Secret Service's San Francisco field office. "Businesses simply don't report it," said Arthur, who was speaking in front of a crowd of insurance professionals on Thursday at the behest of the Golden Gate Chapter of the Chartered Property Casualty Underwriters Society

Machine learning, embedded analytics and big data march ahead in 2014 (TechTarget) Will we look back on 2014 as the year that marked a new era in business? According to faculty at the International Institute for Analytics (IIA), advances in big data, along with machine learning and embedded analytics, will drive new products, reinvent old business processes, and quite possibly mean a lot more work for lawyers

5 "Actionable Intelligence" Questions Enterprises Should Ask Before Being Breached (SecurityWeek) From ongoing threat research, to crowd sourcing information, to Big Data analytics, and the list goes on, some security solutions provide mountains of data that are getting higher all the time. And while all of this "intelligence" is important (and potentially overwhelming), enterprises need to take a step back and ask a significant question before they find themselves breached; not after: is the intelligence supplied by our security solution truly actionable? At first glance, this question may seem redundant

Dynamic Monitoring: Products Influencing Products (Tripwire: The State of Security) For as long as I can remember, there has been a driving goal amongst security product consumers to up-level data to some form of management dashboard. Ideally, this dashboard will tell everyone from the top to the bottom of the organisation exactly what they want to know, the way they want to know it

New Data From PerspecSys Shows Without Security, Clouds Can't Reign (Dark Reading) Survey results from RSA Conference show companies are not being proactive enough to protect sensitive data in the cloud

Stop Glorifying Hackers (New York Times) I was at the Museum of Modern Art in New York not long ago, soaking in Edward Hopper's retro downer mystique, when I got a call that opened up brave new all-night-diners of doom and gloom

Mining only 'digital exhaust', Big Data 1.0 won't revolutionize information security (Exploring Possibility Space) I was asked during this interview whether 'Big Data' was revolutionizing information security. My answer was, essentially, 'No, not yet'. But I don't think I did such a great job explaining why and where the revolution will come from, if it comes

Mobile apps, mixed business-personal device use fueling enterprise demand for mobile security products (FierceMobileIT) A majority of enterprises surveyed by Infonetics Research said that they are deploying mobile device security products in order to "effectively handle mobile application control and mixed personal and business use"

Bitcoin: Laying the foundation for a real-world Skynet? (ZDNet) It's not about bitcoin as a currency. It's about bitcoin as a technology, a highly-distributed, leaderless, jurisdictionless, identityless, nearly anonymous decentralized architecture for managing ownership

Eugene Kaspersky on the cyber jungle (IT Pro) Eugene Kaspersky, CEO of Kaspersky Lab. You'd be hard pushed to find a more bubbly, cheerful and occasionally explosive presenter on the depressing, inescapable and often implausible field of cyber security. Then again, I guess he should be pretty jolly, since he's in the business of plugging the leaks, Wiki or otherwise, in companies and home-user computer networks

A New Approach, A New Era for Security (SecurityWeek) I just got back from another year at the RSA Conference with my colleagues and peers talking about all that is new and upcoming in security. While some continue to debate the time and resources invested in conferences such as these, what cannot be discounted is the value in spending time with, and talking to, other 20+-year veterans of the industry. Though there is never a shortage of information in the security business, what can sometimes be missing is the context. These types of interactions and information exchanges are where new ideas are shaped and where new strategies are formed

Majority of smaller businesses do not believe they are at risk of cyber attacks (Real Business) Kaspersky Lab research reveals that 59 per cent of small businesses believe the information they hold isn't of any interest or value to cyber criminals at all. However, this most certainly isn't the case

Big Data Analytics: Fighting Cyber Crime (Midsize Insider) Big data analytics may be the key to fighting the growing threat of cyber crime, at least according to the 18 government IT leaders surveyed for MeriTalk's recent "Balancing the Big Data Cyber Equation" survey. A new look at how advanced analytics can help improve network security is important as midsize firms decide how they will protect their data going forward

Marketplace

Cebit: Volkswagen CEO tells auto industry to protect data in connected cars (The Inquirer) Also says European IT firms should join Google in the automotive sector

Stealing the show: Cybersecurity stock valuations on the rise (CNBC) Smart investors seem to have fallen in love with cybersecurity. And it's no wonder, given the incredible need to protect data

Pentagon tries again on cyber intelligence-sharing contract (Nextgov) The Defense Department will recompete a $26 million contract to support a classified cyber intelligence network, after federal authorities determined the Pentagon failed to properly evaluate contractor proposals, Defense official said late Friday

Retail Industry Mulls Forming Its Own ISAC For Intel-Sharing (Dark Reading) Breaches at Target and other retailers sound the alarm for retail industry to establish a cyber-threat Information-Sharing and Analysis Center

BRTRC bolsters cyber chops with acquisition of SecureForce (Washington Technology) BRTRC Federal Solutions has acquired SecureForce LLC in a move that bolster's BRTRC's cybersecurity presence

Petrobras Director Seeks Amazon Review After US Spy Claim (Bloomberg) Petroleo Brasileiro SA (PETR4)'s incoming board member will urge the state-run oil company to reconsider its use of Amazon.com Inc. (AMZN) as a service provider in light of allegations that the National Security Agency spies on foreign targets through data compiled by U.S. corporations

Yahoo! Names Alex Stamos as New CISO (SecurityWeek) Yahoo! announced on Monday that Alex Stamos has taken the role of VP of Information Security and CISO at the company

Products, Services, and Solutions

A clear-eyed guide to Mac OS X's actual security risks (ComputerWorld) Apple has improved its security in recent years, but is it enough? Apple's Mac computers and its OS X operating system have enjoyed a reputation of being relatively secure over the years. But in fact, experts say, the Apple OS has had security issues that might have been downplayed only because the vulnerabilities were not exploited

MTN Government Launches Industry's First Social Media Threat Intelligence Managed Service (Broadway World) This service is a predictive cyber solution that enables U.S. government agencies using social networking, mobile devices and distributed workforces to protect against the onslaught of cyber threats. The solution identifies and analyzes malicious actors, threats and targeted attacks against U.S. government leaders and agencies, and provides proactive, actionable threat analytics and intelligence in advance of any network compromise. The service uses a patented enterprise-security platform powered by ZeroFOX, a social risk and cyber threat intelligence solutions company

Ribose first to achieve CSA STAR Certification under new CCM 3.0 cloud security standard (gnomes) Ribose, a start-up that redefines the way people collaborate, is the first to achieve STAR Certification from the Cloud Security Alliance (CSA) fully compliant to the new cloud security standard: Cloud Controls Matrix (CCM) 3.0

Miniaturized Crypto Module from ViaSat Receives NIST Certification (MarketWatch) Protects critical information and command and control links

Technologies, Techniques, and Standards

Wake-Up Call From the Largest Data Breach in History (Epoch Times) As the largest breach in history unfolded, most executives were both disappointed that it occurred to a great American brand and relieved that it missed them—for now

Third-party application security must be tested for vulnerabilities (TechTarget) As our developers incorporate more and more third-party software components and partner APIs that we don't have direct control over, how do we test for third-party application security? It's hard enough to find and fix security flaws in your own code

Swiping ID cards to logon to mobile devices? Maybe not, says NIST (FierceGovIT) What's worked for laptops and desktops won't work for mobile devices when it comes to verifying users' identity, says the National Institute of Standards and Technology

IT Security Skills Anyone Can and Should Learn (Tripwire: The State of Security) I've been teaching IT security awareness for several years and I try to get those in attendance of the classes to learn some basic IT security skills. These basic skills build on each other and there is some cross over, but ultimately this blended set of security skills can help anyone stay safe online

Virtual machine (VM) security still a work in progress (NetworkWorld) Catbird, Hytrust, TrendMicro and Dome9 all offer interesting approaches, but no one product does it all

Understanding the top 20 Critical Security Controls (Help Net Security) In this podcast recorded at RSA Conference 2014, Wolfgang Kandek, CTO at Qualys, talks about the 20 Critical Security Controls, which outline a practical approach to implementing security technologies by providing proven guidelines for protecting IT environments

Defending Against Targeted Attacks Requires Human Touch, Speakers Say (Dark Reading) Targeted attacks involve a human element that can be detected and stopped, speakers say at Dark Reading event

SAML Promises to Boost Cloud Security (eSecurity Planet) IT administrators are struggling to deal with the implications that cloud services have on security. SAML and related technologies such as single sign-on can help

GnuTLS Bug Exposes Shortcomings in TLS Test Suites (Threatpost) A code audit is the best way to throw back the covers on errors like the one reported last week in GnuTLS, an open source crypto library used in a number of different Linux distributions

Design and Innovation

Can this $70 dongle stem the epidemic of password breaches? (Ars Technica) Maybe not, but its approach could improve the security of password databases

Federal Hill incubator Betamore forms partnership with D.C. incubator 1776 (Technical.ly Baltimore) Washington, D.C.-based incubator 1776 announced a "regional partnership" with Federal Hill incubator and coworking space Betamore

Research and Development

You Won't Be Needing These Any More: On Removing Unused Certificates From Trust Stores (Leibniz Universität Hannover) SSL and HTTPS is currently a hotly debated topic {particularly the weakest link property of the CA based system has been heavily criticized. This has become even more relevant in the light of recent spying revelations. While there are several proposals how the CA system could be improved or replaced, none of these solutions is receiving widespread adoption, and even in a best case scenario it would take years to replace the current system. In this paper we examine a root problem of the weakest-link property and propose a simple stop-gap measure which can improve the security of HTTPS immediately. Currently, over 400 trusted entities are contained in each of the common trust stores of various platforms and operating systems. To find out which of these trusted root certificates are actually needed for the HTTPS ecosystem, we analyzed the trust stores of Windows, Linux, MacOS, Firefox, iOS and Android, discuss the interesting differences and conduct an extensive analysis against a database of roughly 47 million certificates collected from HTTPS servers. We found that of the 426 trusted root certificates, only 66% were used to sign HTTPS certificates. We discuss the benefits and risks involved in removing the other 34% of trusted roots. On the whole, we argue that this removal is an important first step to improve HTTPS security

Academia

Yik Yak banned as schools grapple with toxic anonymous social chat (Naked Security) Some Chicago schools have banned the location-based mobile app, causing the developers to turn it off throughout the city as they seek a way to keep it off of school grounds. Yik Yak has lead to multiple school lockdowns in the wake of bomb threats, as well as a new way to perpetrate cyberbullying

Canadian high school students learn about online privacy (CSO Salted Hash) Now this is a story that I rather enjoyed. At a high school in Winnipeg Manitoba the students are learning about the implications of social media and privacy. The exercise was to help demonstrate to students what their social media profiles were allowing access to their personal information. Students were surprised at how many applications had rights to their Facebook profiles

Legislation, Policy, and Regulation

Is privacy undermining trade in digital services? (ComputerWeekly) Since Edward Snowden lifted the lid on the US National Security Agency's (NSA) surveillance secrets there has been a lot of fretting about spies. It is not a new issue, but more people are now talking about keeping data in places beyond the legal reach of any foreign government

Germany rejects Snowden claim it bowed to NSA (AP via the Washington Post) Germany on Monday dismissed a claim by NSA leaker Edward Snowden that it had bowed to U.S. demands to water down privacy rights for German citizens

Critical infrastructure insecurity too sensitive to discuss at CANSECWEST (Tripwire: The State of Security) A session examining vulnerabilities in critical infrastructure that was slated to be delivered at the CanSecWest conference by Eric Filiol, head of the French Operational Cryptography and Computer Virology lab, has been cancelled over security concerns

Navy admiral relays concerns about NSA changes (AP via the Washington Post) The Navy admiral nominated to be the next head of the troubled National Security Agency is expressing concerns about the U.S. government turning over the bulk collection of telephone data to an independent third party, saying it could result in higher costs and delays identifying potential threats

The Third-Party Metadata Idea Is Fourth-Rate (Wall Street Journal) Entrusting surveillance information to an outside contractor means less accountability

Snowden says encryption and oversight are key to protecting the public from surveillance (Engadget) Speaking to a packed exhibit hall through a Google Hangout, which was passed through seven proxies, Edward Snowden said the keys to protecting the public from government surveillance is encryption and civilian oversight. The world's most famous whistleblower has said it before, but reiterated it for the SXSW crowd, that end-to-end encryption would go a long way towards protecting user data from both spying and attackers

Snowden has shown the 'huge disparity of surveillance and power', says Gellman (The Guardian) Government needs reminding that they work for us, says Pulitzer-winning reporter Barton Gellman, who describes Edward Snowden as ending an era of indifference to surveillance

'You can't opt out of being spied on by the NSA' (KVAL) The Patriot Act allows the National Security Agency to record telephone call records. Some groups fear the NSA may be collecting more than that

Leveraging Emerging Technologies in the Security Clearance Process (INSA Security Policy Reform Council) Recent compromises of U.S. government national security information highlight the need to focus on the periodic reinvestigation (PR) process and make fundamental improvements. Policy makers have a unique opportunity to make long overdue adjustments

Cybersecurity Efforts Accelerate (American News Report) The Obama administration's new voluntary Cybersecurity Framework for critical infrastructure providers is getting good marks as a necessary first step in protecting the country from cyber attacks

No Digital Government Strategy 2.0 waiting in the wings (FierceGovIT) Anyone anticipating a formal follow-up to the Digital Government Strategy should stop doing so, senior federal information technology officials told a March 7 conference audience

A Non-Trivial Editing Matter at U.S. Strategic Command? (Lawfare) Here's a random tidbit. U.S. Cyber Command is a subcommand of the U.S. Strategic Command. On the Stratcom web site is a fact sheet about U.S. Cyber Command

Litigation, Investigation, and Law Enforcement

Snowden: "Would I do this again? The answer is yes" (VentureBeat) Speaking live at SXSW, NSA whistleblower Edward Snowden stated that "every society in the world has benefited" from NSA leaks

Pinterest's First Transparency Report Shows Minimal Government Requests (Threatpost) Pinterest, the social image-sharing site known predominately for wedding planning and recipe dissemination, released its first transparency report on Friday. While the government — unsurprisingly — makes few requests of this most bubbly of social networks, the report seems to carry a broader message: If your company stores user data, the government is likely to ask for it at some point

MtGox files for US bankruptcy protection to put lawsuits on hold (Ars Technica) Once-popular Bitcoin exchange had already filed for such protection in Japan

Leader of ID Theft Ring Targeting Government Employees Sentenced to 12 Years in Jail (Softpedia) 31-year-old Jenaro Blalock of Clinton, Maryland, has been sentenced to 12 years in prison. Blalock is said to be the leader of an identity theft ring that caused losses of between $1 million (€730,000) and $2.5 million (€1.8 million) after stealing the identities of over 600 individuals

For a complete running list of events, please visit the Event Tracker.

Upcoming Events

Cybersecurity Tax Credits Webinar (Online, Mar 11, 2014) Learn about tax credits designed to help your cybersecurity company grow in Maryland. Details will be presented by Jeffrey Wells, Executive Director of Cyber Development and Mark Vulcan, Esq., CPA, Program Manager, Tax Incentives for the Maryland Department of Business & Economic Development. 2-3:00 p.m. EDT.

CanSecWest (, Jan 1, 1970) CanSecWest, the world's most advanced conference focusing on applied digital security, is about bringing the industry luminaries together in a relaxed environment which promotes collaboration and social networking. The conference lasts for three days and features a single track of thought provoking presentations, each prepared by an experienced professional and talented educator who is at the cutting edge of his or her field. We give preference to new and innovative material, highlighting important, emergent technologies, techniques, or best industry practices.

Security Policy Reform Implications for Industry: Maintaining Momentum for Transformational Change (Chantilly, Virginia, USA, Mar 20, 2014) Join INSA's Security Policy Reform Council for Security Policy Reform Implications for Industry: Maintaining Momentum for Transformational Change at the SI Organization in Chantilly, VA. This unclassified, but sensitive Symposium will be off the record, and will bring together stakeholders from the executive and legislative branches as well as their counterparts in the private sector. Following unprecedented attention on the security clearance process in 2013, 2014 promises to be a year of consequence to a fundamental aspect of how the IC carries out its mission. This Symposium will provide attendees an opportunity to participate in the current debate and learn about future technologies that will influence security policies and procedures.

CANSEC (, Jan 1, 1970) CANSEC is Canada's foremost defence tradeshow. A two-day event, CANSEC will feature 120,000 square feet of indoor exhibits by Canada's leading edge defence companies, as well as an outdoor static display. This tradeshow targets a wide audience of customers that includes Government agencies and departments with an interest in the defence sector.

Reducing the Nation's Cyber Risk: White House Insights on the President's Critical Infrastructure Framework (New York, New York, USA, Mar 11, 2014) The Fordham School of Professional and Continuing Studies and the Fordham Computer and Information Science Department present this informative panel, open and free to the public.

cybergamut Technical Tuesday: Virtualization Technologies in Cyberwarfare (Columbia, Maryland, USA, Mar 11, 2014) Virtualization is often talked about in the context of cloud computing, cost savings and enterprise environments. In this talk, Jason Syversen of Siege Technologies will introduce Intel, AMD and ARM virtualization architectures and describe novel approaches to implementing virtualization technology / hypervisors for offensive and defensive cyber security applications. Case studies will be presented for malware detection, reverse engineering, code protection, security testing, stealthy code and other applications.

Nuclear Regulatory Commission ISSO Security Workshop (, Jan 1, 1970) Exhibitors will have the opportunity to showcase cutting-edge products and services available in today's market. All companies specializing in products and services that would benefit the NRC workforce are encouraged to exhibit at this one-day expo. Topics of the workshop and of high interest to attendees include: computer security policy, standards and guidance, cybersecurity, FISMA compliance, and training updates.

ICS Summit 2014 (Lake Buena Vista, Florida, US, Mar 17 - 18, 2014) The 9th Annual North American ICS Security Summit brings together the program managers, control systems engineers, IT security professionals and critical infrastructure protection specialists from asset owning and operating organizations along with control systems and security vendors who have innovative solutions for improving security.

27th Annual Federal Information Systems Security Educators' Association (FISSEA) Conference (, Jan 1, 1970) The 27th Annual Federal Information Systems Security Educators' Association (FISSEA) Conference will be held at the National Institute of Standards and Technology on March 18-20, 2014, exhibits will be on display March 19 only. This year's theme "Partners in Performance: Shaping the Future of Cybersecurity Awareness, Education, and Training" will focus on developing a better understanding of current information systems/cybersecurity projects, emerging trends, and initiatives. Through numerous high quality sessions, approximately 200 attendees will learn new ways to improve their IT security program and practical solutions to training problems while earning Continuing Professional Education (CPE) credits. The vendor fair gives attendees a tactical look at the products and services available to meet their professional goals.

Suits and Spooks Singapore (, Jan 1, 1970) Our first international Suits and Spooks conference will be held in Singapore with a visit to Malaysia on March 20-21, 2014. The focus will be on how multi-national corporations can profitably operate in a globally hostile environment that consists of foreign intelligence collection, mercenary hacker crews, insider threats, and supply chain/vendor vulnerabilities. Our international list of speakers will discuss who the threat actors are, what they're after, and best practices to mitigate the risks.

MCT-Congress: Going Mobile with Clinical Trials (Edinburgh, Scotland, UK, Mar 20 - 21, 2014) It is almost inevitable that mHealth solutions will be adopted across healthcare systems worldwide over the next decade. What is less clear is the impact that mobile solutions are having and could have on the clinical research process.

Cyber Security for Energy & Utilities (, Jan 1, 1970) Following the rapid evolution of the cyber and digital world, IT Security Directors, Information Security Directors, Chief Security Officers, Chief Information Officers and many more will gather at the 3rd Edition of Cyber Security for Energy & Utilities conference taking place from 23 -26 March 2014 at The Westin Golf Resort in Abu Dhabi, UAE.

Veritas 2014 (, Jan 1, 1970) At Veritas 2014, hear directly from the big data experts in top tier retail finance who are now implementing strategy and starting to yield real commercial value. Experts dedicated to Big Data in the sector will show you how the right approaches can lead to far-reaching results in business model innovation, risk mitigation and identifying new revenue streams. See how Veritas 2014 will help you develop your big data implementation strategy.

Black Hat Asia (, Jan 1, 1970) Black Hat is returning to Asia for the first time since 2008, and we have quite an event in store. Here the brightest professionals and researchers in the industry will come together for a total of four days--two days of deeply technical hands-on Trainings, followed by two days of the latest research and vulnerability disclosures at our Briefings.

SEC Cybersecurity Roundtable (Washington, DC, USA, Mar 26, 2014) The Securities and Exchange Commission today announced that it will host a roundtable next month to discuss cybersecurity and the issues and challenges it raises for market participants and public companies, and how they are addressing those concerns.

Cyber Security Management for Oil and Gas (, Jan 1, 1970) Attend to gain cutting-edge information from oil and gas cyber security experts on: Using the very latest in intelligence techniques to find and neutralize the newest threats in time. Preventing security breaches while ensuring your employees, social media and mobile devices operate effectively. Implementing best practices in order to achieve and maintain SCADA and other key systems security. How a "critical infrastructure" designation would impact different aspects of oil and gas cyber security management.

ISSA Colorado Springs — Cyber Focus Day (Colorado Springs, Colorado, USA, Mar 27, 2014) Join us for the Information Systems Security Association (ISSA) — Colorado Springs Chapter — Cyber Focus Day set to take on Thursday, March 27, 2014 at Colorado Technical University (CTU).

CyberBiz Summit (Linthicum, Maryland, USA, Mar 28, 2014) Learn first-hand how to get your cyber business started, how to raise capital, and what to do to make it happen. Join us for four informative sessions, networking and breakfast at the BWI Westin on Friday, March 28th.

Corporate Counter-Terrorism: the Role of Private Companies in National Security (Washington, DC, USA, Mar 28, 2014) The 2014 American University Business Law Review Symposium will address the growing role of corporate America in governmental counter-terrorism programs, including the bulk metadata and PRISM surveillance initiatives. John Carlin, Assistant Attorney General for National Security, will deliver the keynote. Other speakers will include current and senior officials from the Justice Department, National Security Agency, Office of the Director of National Intelligence, FBI, DHS, Google, and Microsoft.

SyScan 2014 (Singapore, Mar 31 - Apr 4, 2014) SyScan is a deep knowledge technical security conference. It is the aspiration of SyScan to congregate in Asia the best security experts in their various fields, to share their research, discovery and experience with all security enthusiasts in Asia.

Interop Conference (, Jan 1, 1970) Interop Conference sessions help you find actionable solutions to your current IT headaches and plan for future developments.