The CyberWire Daily Briefing for 5.1.2014

Cyber Attacks, Threats, and Vulnerabilities

Milken 2014: Russia could wage cyber war on U.S. (USA Today) Russia, enraged by the Obama administration's sanctions over Ukraine, could strike back at the U.S. via cyber warfare — then deny the attack ever took place, a former top intelligence official said Tuesday

Researchers Find IE VGX Components Likely Exploited in Zero-Day Attacks (Threatpost) Researchers at Websense said today they may have isolated two components within the VGX library that are being exploited by attackers targeting the latest Internet Explorer zero-day vulnerability

Industrial Computers Emerge as Another Heartbleed Worry (Recode) As if there weren't a sufficient number of things to worry about related to the Heartbleed vulnerability disclosed earlier this month, you can now add this to the list: Many of the world's computers used to control and manage heavy industrial equipment may be vulnerable, too

Most Internet Users Ignored Heartbleed, New Poll Shows (NBC News) Heatbleed prompted panic in the media, warnings from Internet companies, and suspicion towards the National Security Agency. But was it bad enough to make regular people change their passwords?

It's Crazy What Can Be Hacked Thanks to Heartbleed (Wired) Western Digital makes a tiny box where you can store all your photos and other digital stuff. It's called My Cloud, and you've probably seen the TV ads hawking the thing. It gives you a way to access your stuff from any machine, across the internet

Post-Heartbleed: When Not To Change Your Password (Dark Reading) One takeaway from Heartbleed is that conventional wisdom about the need to periodically change passwords is wrong

New Android Trojan spreads like a worm (Help Net Security) A new SMS Trojan with worm-like spreading capabilities has been spotted targeting Russian Android users

Voice phishing campaign hits customers at dozens of banks (IT World) Cybercriminals used a combination of SMS and voice phishing techniques to obtain debit card details from bank customers

Microsoft Azure is phishing-friendly (ZDNet) Free hosting, free SSL certificate, free subdomains and free anonymizing proxy make Azure a powerful platform for phishing

Sefnit Botnet Swaps Tor for SSH (Dark Reading) Facebook security researchers spot a Sefnit/Mevade click-fraud and Bitcoin-mining botnet returning to its previous SSH command-and-control communications infrastructure

Bad bots on the rise: A look at mobile, social, porn, and spam bots (CSO) Bad bots create untold security nightmares for the enterprise. Today, we're taking a look at the trouble they lead to, and what companies can do to about it

Pirate Sites are Rife with Malware and Scams, Report Claims (Torrent Freak) New research carried out by analysts from Intelligent Content Protection concludes that 90 percent of the top pirate sites link to malware or other unwanted software. In addition, two-thirds of the websites are said to link to credit card scams. Entertainment industry groups hope the findings will motivate people to choose legal options instead

Amazon Fires Back Against Bkav Security Accusations (Talkin' Cloud) Amazon Web Services has issued a response regarding security firm Bkav's accusations its lack of security patches were responsible for a customer's malware infection. AWS is stressing the shared security responsibility of both the public cloud service provider and its customers

UltraDNS Dealing wtih DDOS Attack (Threatpost) UltraDNS said it has mitigated a distributed denial of service (DDoS) attack for most of its customers after the service was held down for most of the day

Snelling Staffing Acknowledges Data Breach (eSecurity Planet) 9,757 employees' names, birthdates, home addresses, medical information, driver's license numbers and Social Security numbers were exposed

Data Breach at Tufts Health Plan Exposes 8,830 Members' Info (eSecurity Planet) Names, birthdates and Social Security numbers were accessed

4chan admits it suffered hack attack (Graham Cluley) The 4chan image messageboard, beloved by anonymous internet pranksters and trolls, has admitted that it suffered a security breach last week that saw a hacker gain unauthorised access to user information

Samsung Galaxy S5 owners can unlock LastPass with a keypress — but is that wise? (Hot for Security) Popular password manager service LastPass has announced that it has introduced a new feature for Samsung Galaxy S5 users: Fingerprint scanning

Security Patches, Mitigations, and Software Updates

Microsoft Simplifies IE Zero-Day Security Advisory, Removes Unnecessary Workaround (Windows Pro) If you've been paying attention, there's been quite a bit of confusion over which mitigation technique is the best to use when attempting to eliminate computers at risk over the severe flaw reported last weekend. Yesterday, Microsoft updated Security Advisory 2963983, to hopefully cut through the confusion and give a more defined direction and a distinct set of workarounds

Cyber Trends

Infosec 2014: Threat knowledge is key to cyber security, say experts (ComputerWeekly) Business should improve awareness of current cyber risks and threats to stay ahead of cyber criminals, security and law enforcement professionals have told delegates at Infosecurity Europe 2014 in London

AT&T CSO: Your perimeter security architecture won't hold — get thee to the cloud (TechTarget) Ed Amoroso, chief security officer at AT&T, knows how to work up a crowd. Speaking at the recent Landmark CIO Summit in New York, Amoroso told an audience packed with financial sector CIOs to run, not walk, to get their data to the cloud. "If you're not doing it now, run back to your security team and ask, 'What're our plans to move to the cloud?'" This was not some sales pitch from a cloud vendor, Amoroso said, raising his voice in emphasis. "I am here as a CSO and that is what I am doing. I am rushing to move things out to a much better model and a much more flexible model — and one that users love"

Are Companies Doing Enough for Cloud Security? (eSecurity Planet) Bitglass found that few companies use single sign-on, which the security vendor calls "the most basic security measure for SaaS adoption"

As International Business Activity Heats Up, So Do Supply Chain Fears, Chubb Survey Finds (Chubb) As U.S. and Canadian businesses plan to expand their business overseas this year, supply chain failures, data breaches and political instability are weighing heavily on the minds of their executives, according to a survey by the Chubb Group of Insurance Companies

The Rise Of Medical Identity Theft In Healthcare (Student Doctor Network) If modern technology has ushered in a plague of identity theft, one particular strain of the disease has emerged as most virulent: medical identity theft

Trust Is Good. Control Is Better — Securing The Internet Of Things (InformationSecurityBuzz) Once a buzzword thrown around by computer geeks, the Internet of Things (IoT) is now a household name, sparking excitement and visions of futuristic living among even the most conservative of technology users. While the foundations for our new, connected world are being laid, experts see the current developments only as the beginning. A new Gartner report predicts a 30-fold increase in internet-connected devices, set to reach 26 billion by 2020, up from 0.9 billion in 2009

Israel a Mecca for spammers, cyber stats show (The Times of Israel) Per capita, Israeli computers are the third-biggest spam source in the world, according to security firm Sophos

A Woman's Journey to Cyber Security (Tripwire: The State of Security) Being a woman in infosec isn't easy, but if you play it right and earn the respect of this dude gang, it is absolutely the most fun. Here, in the last bastion of a nearly HR-free zone, where many cubicles still have stashes of silly string, where sarcasm is the norm, where outwit and outlast is the name of the game, I am home

Marketplace

A healthcare IT security spending wish list (FierceHealthIT) Beth Israel's John Halamka on preventing cyber attacks, keeping networks secure

George Pedersen: ManTech to Buy 7Delta in Healthcare IT Push (GovConWire) ManTech International (NASDAQ: MANT) has agreed to purchase Columbia, Md.-based technology management contractor 7Delta for an undisclosed sum that includes cash on hand and funding from ManTech's existing line of credit

Infosec 2014: US tech dominance Europe's fault, says Mikko Hypponen (ComputerWeekly) Europeans only have themselves to blame for the dominance of internet data by big US technology firms, says Mikko Hypponen, chief research officer at Finnish security firm F-Secure

Retailers plodding toward accepting higher-security payment cards (CSO) A price tag estimated at $30 billion for the industry has many retailers choosing to wait beyond credit-card companies' 2015 deadline for accepting chip-and-PIN cards

Target's move to chip and pin seeks to assure consumers (CSO) Target is upgrading the security of its store-branded payment cards and making other network improvements as it seeks to restore confidence after one of the largest-ever data breaches last year

Protecting Against CyberAttacks Through Social Networks, ZeroFOX Raises $11 Million (TechCrunch) Anyone can be anyone on social networks. It's part of the allure of sites like Facebook and Twitter. They enable self-expression, but increasingly the ability to assume any identity online is being used by hackers to get sensitive data from consumers and businesses

How Enterprises Can Harvest The Knowledge Of Security-Focused Venture Capitalists (Dark Reading) Tomorrow's game-changing security startups are meeting with investors today. Here are some tips on how you take advantage of smart guidance from venture funding firms

What's The NSA Doing Now? Training More Cyberwarriors (NPR via Alaska Public Media) The U.S. needs more cyberwarriors, and it needs them fast, according to Defense Secretary Chuck Hagel. He plans to more than triple the size of the Pentagon's Cyber Command over the next two years. But where will they come from? These are not the kind of skills you can teach in basic training

Bug Bounties Expanding to Individual Developers (Threatpost) Bug bounties once were restricted mainly to large software companies such as Mozilla and Google. But the success of these programs has led many other infrastructure and product companies, including Yahoo, Facebook, Barracuda, PayPal and even Microsoft, to launch their own reward systems. Now, the phenomenon has spread to individual developers

Akamai: Overvalued With Competitive Challenges Looming (Seeking Alpha) The increase in web traffic should drive strong first-quarter results. The intrinsic value estimate is $24 per share. Shares are in an intermediate bear market as part of primary bull market

Ed Casey Appointed Serco Group COO (GovConWire) Ed Casey, acting CEO of Serco Group since October, has been appointed chief operating officer for the U.K.-based government services contractor as Rupert Soames takes chief executive post on a permanent basis Wednesday

Products, Services, and Solutions

M2Mi Brings Industry Leading M2M and Internet of Things Enterprise Cloud Platform to the IBM Cloud Marketplace (PRWeb) M2M Intelligence® provides cyber security and intelligence from the platform to enable enterprises to rapidly build valuable M2M and IoT solutions. This industry leading platform is now available for trial and purchase from the IBM Cloud Marketplace

Proofpoint Voted Best Email Security Solution by SC Europe Magazine (MarketWatch) Proofpoint, Inc., PFPT +15.41%, a leading security-as-a-service provider, is pleased to announce it was named winner in the Best Email Security Solution category for the 2014 SC Europe Awards. A prestigious judging panel comprised of industry leaders evaluated countless service providers, choosing the Proofpoint enterprise suite from a pool of eight finalists. The announcement was made on April 29, 2014 at the SC Europe Awards ceremony

Dome9 Security Named a Cool Vendor by Gartner (MarketWatch) Cloud Security Innovator Dome9 Is Recognized for Its Policy Enforcement Service Empowering Service Providers and Enterprises to Securely Adopt Cloud Infrastructure

Fortinet unveils FortiOS 5.2 to fight APTs (Help Net Security) Fortinet unveiled a major update to the FortiOS network security operating system that powers the FortiGate platform at Infosecurity Europe 2014. This release incorporates numerous innovations that strengthen Fortinet's Advanced Threat Protection Framework, providing enterprises with a cohesive and coordinated way to combat APTs, zero-day attacks and other malware

eScan Total Security Suite 14 review: a quick and good value internet security suite for PC, Mac and Android (PC Advisor) The eScan Total Security Suite 14 is a quick and good value internet security suite for PC, Mac and Android. Here's our eScan Total

Cyber Squared Inc. Announces Expansion of Data Services with Powerful Domain and Passive DNS Intelligence (BusinessWire) Cyber Squared Inc. announced today that ThreatConnect™, the leading threat intelligence platform, has entered into a partnership with DomainTools and Farsight Security, Inc. to provide ThreatConnect users with the industry's most powerful domain and passive DNS intelligence

Technologies, Techniques, and Standards

Certificate revocation controversy heats up (ZDNet) There's a lot of criticism of Google CRLSets, and some of it is valid, but there's no defense for CRLs and OCSP as they currently work

Four Tips for Thwarting Microsoft Zero-day Threat (Bank Innovation) Microsoft has acknowledged a new zero-day vulnerability affecting multiple versions of Internet Explorer, and stated there have been active attempts to exploit the problem. A zero-day vulnerability is one that operates within a computer system or application, and for which no patch is available

Busybox Honeypot Fingerprinting and a new DVR scanner (Internet Storm Center) My little "lab of vulnerable devices" is still getting regular visits from script kiddies world wide. By now, I replaced some of the simulated honeypots with actual devices, giving me a bit a more accurate view of what is happening and how attackers are distinguishing honeypots from real devices. For example, the DVR I set up with default telnet credentials is getting regularly visited and the following command tends to get executed first

SecDevOps: Security Automation By Example — The Firewall Change (DevOps Blog) Just when you thought DevOps was the new black, along comes SecDevOps. Yes folks, like most things in life, the new cool is already here. Before I move on to trying to explain SecDevOps, please accept my mea culpa because for many people DevOps is yet to be clearly defined. I can imagine your frustration that I'm going to try and explain a new term based on a loosely defined term

Applying the right incident management process can avert trouble (TechTarget) To avoid finding out about an emergency after it's too late, implement monitoring, change, problem and incident management processes for your IT team

Passwords: Not Going Away Anytime Soon (Trend Micro Security Intelligencde Blog) For users who are not system administrators, the biggest impact of the Heartbleed vulnerability has been all the passwords that they have had to change. This, together with improvements in alternative authentication methods (like the fingerprint scanners now embedded in flagship smartphones), have caused some rather bold statements about passwords to be made

How To Avoid Sloppy Authentication (Dark Reading) Viewing authentication as a process, not simply as an encryption or algorithm, is the key to defending corporate resources from attacks

Avoiding burnout: Ten tips for hackers working incident response (CSO) Recent security graduates entering the world of incident response, or those with a strong security background making a career move, face a challenging environment that often leads to frustration and burnout

Research and Development

Airbus Group debuts SCADA research project to mitigate ICS vulnerabilities (Help Net Security) Airbus Group will highlight this week at Infosecurity Europe 2014 its range of technologies, services and a cutting edge research project to help governments and industry deal with the increasingly complex and unpredictable nature of cyber attacks

Academia

University brings infosec courses to London (Help Net Security) The University of South Wales is to open a Centre in the heart of London's Docklands financial district where it will deliver a range of professional level courses in information and cyber security

Cyber attack training centre to launch (Insider Media) The National Cyber Skills Centre (NCSC), based at the Malvern Hills Science Park in Malvern, is being launched at InfoSec, an information security event taking place in London

Whatcom County colleges educating much-needed cybersecurity specialists (Bellingham Herald) The urgent and massive need for computer security professionals has caught the government, industry and education sectors quite unprepared. Corporations such as Target are suddenly finding that large-scale compromise of their information systems is not just an embarrassment, but a significant threat to their commercial viability

Legislation, Policy, and Regulation

The Kremlin's Internet Annexation (Advocacy: Global Voices) Over the past two years, the Russian government has armed itself to the teeth with regulatory powers that enable nearly every conceivable form of Internet censorship. In the summer of 2012, the state created a federal registry, where it can blacklist any website or entire web domain for hosting content deemed to be harmful to minors

FBI Keeps Internet Flaws Secret to Defend Against Hackers (Bloomberg) The Obama administration is letting law enforcement keep computer-security flaws secret in order to further U.S. investigations of cyberspies and hackers

NSA on Heartbleed: 'We're not legally allowed to lie to you' (ZDNet) In an exclusive interview with ZDNet's David Gewirtz, a senior NSA official explains why the agency regards security and civil liberties as more than a simple balancing act: "You have to have them both"

How the NSA Undermined One of Obama's Top Priorities (National Journal) As part of its push for mass surveillance, the spy agency has taken steps to sabotage cybersecurity

Will Congress require companies to share data on cyber-security breaches? (Christian Science Monitor) Senators Dianne Feinstein, a California Democrat, and Saxby Chambliss, a Georgia Republican, are circulating a draft of the new cyber-security bill among key stakeholders

Congress eyes Pentagon cyber oversight (Federal Times) Congress would get greater oversight authority over Defense Department operations in cyberspace if language that a House Armed Services Committee subcommittee issued makes it into the 2015 National Defense Authorization Act

DIA director, deputy to step down (C4ISRNet) Defense Intelligence Agency Director Lt. Gen. Michael Flynn and his deputy, David Shedd, both will retire by early this fall, DIA officials confirmed

Cyber-attack — a military operations task (Australian Defense Magazine) US Cyber Command, which has focused on developing forces to blunt attacks against national critical infrastructure, should delegate operational control of distinct combat forces designed to support military operations, a new report urges

US State Department adopting social media to counter Al-Qaeda propaganda (Ars Technica) US says violent extremists increasingly taking to social media

'A greater role for NGOs in cyber crime awareness' (The Hindu) Every minute, on an average, nearly 80 people in India fall prey to some form of cyber crime and the awareness initiatives in place to prevent them are not enough, Governor K. Rosaiah said here on Tuesday

Litigation, Investigation, and Law Enforcement

European Police Seek Cybercrime Triage (Dark Reading) Many organized cybercrime gangs operate beyond European and US borders — or jurisdiction — thus making online crime eradication impossible

Infosecurity Europe 2014 › Whistleblowing Keeps Security Under Scrutiny Says Hypponen (InfoSecurity Magazine) Whistleblowers have exposed issues around data custody and data privacy, says Mikko Hypponen

Infosecurity Europe 2014 › Crime Groups Increase Hold on Cyberspace (InfoSecurity Magazine) Organised crime is the greatest source of cyber attacks, according to expert at Infosecurity Europe

Surveillance orders declined in 2013 (Politico) Amidst a major public and press furor over National Security Agency surveillance, federal surveillance orders and demands for national-security related information declined slightly last year, according to statistics made public Wednesday by the Justice Department

Boston Marathon Bombing Lessons Learned (SIGNAL) Investigators made mistakes but may not have prevented the tragedy, a Senate hearing concludes

FBI may put Anonymous hacker behind bars for 440 years on 44 charges (Hack Read) A Texas man and an alleged member of the famous Anonymous hacktivist group, may face prison up to 440 years in the latest second superseding indictment of cyber assaults charges against him that includes hacking attempts against county, school, and newspaper organizations, says the latest release from the Federal Bureau of Investigation

For a complete running list of events, please visit the Event Tracker.

Upcoming Events

Mobile Network Security in Europe (London, England, UK, May 21, 2014) Following on from two successful events in the United States, this first Light Reading conference on Mobile Network Security in Europe will again focus on the key role of the network in safeguarding the mobile carrier's network assets while protecting its customers from security attacks. The conference will also consider the case for distributing and coordinating security strategies across the end-user device, the mobile network, and the cloud as carriers look to prevent attackers from triggering outages and degradations or from stealing sensitive customer information.

Rock Stars of Cybersecurity (Austin, Texas, USA, Sep 24, 2014) The unprecedented Target breach and NSA spying scandal have put cybersecurity in the global spotlight. With cyberattacks on the rise, it is now even more important to learn how to identify weaknesses and protect company infrastructure from incursions. At the Rock Stars of Cybersecurity conference, well-respected cybersecurity authorities from leading companies will deliver case studies and actionable advice that you can immediately put to use.

United States Cyber Crime Conference 2014 (, Jan 1, 1970) This is the only event of its kind that provides both hands-on digital forensics training and an interactive forum for cyber professionals to network. The conference covers the full spectrum of topics facing defenders as well as law enforcement responders. All aspects of computer crime will be covered, including intrusion investigations, cyber crime law, digital forensics, information assurance, along with research and development, and testing of digital forensic tools.

Infosecurity Europe 2014 (, Jan 1, 1970) Infosecurity Europe is Europe's number one Information Security event. Featuring over 350 exhibitors, the most diverse range of new products and services, an unrivalled education programme and over 12,000 visitors from every segment of the industry, it's the most important date in the calendar for Information Security professionals across Europe.

Cyber COMSEC and IT Day at Fort Huachuca (, Jan 1, 1970) This one-day vendor expo is a unique opportunity to demonstrate your products and services to military and civilian personnel at Fort Huachuca. Exhibitors will have a casual atmosphere to share ideas, concerns and build relationships with the men and women of Fort Huachuca.

STEM Café (Geneva, Illinois, USA, May 6, 2014) At the next STEM Café, Raimund Ege, associate professor in NIU's Department of Computer Science, will lead a lively discussion on how computer crime affects our everyday lives and what we can do to protect ourselves and our data. The event will take place from 6:30 to 8:30 p.m. Tuesday, May 6, at Claddagh Irish Pub, 1702 Commons Drive in Geneva.

cybergamut Technical Tuesday: Malware Reverse Engineering (Columbia, Maryland, USA, May 6, 2014) An introduction to the tools, workflows, and tricks of the trade to attack sophisticated malware by Dale Robson of CyberPoint. Industry standard cyber security products do a good job in blocking and defending against recognized or suspicious malware. Yet increasingly, advanced malware is customized to evade detection and remediation; and even those that are caught can have deeper and more dangerous capabilities. In order to truly understand the malware's capabilities and to assess its success in gaining access to an enterprise, cyber security professionals should reverse engineer the binary to expose its secrets. But organizations may forgo reverse engineering and rely on industry solutions to characterize and defend against the threat. Reverse engineering is done by exception and within the constraints of budget, time, and available professional talent, if it is done at all. However, reverse engineering malware can be an integral part of every security team's calculus. This session provides a technical review of the tools, workflows, and advanced analytic insight a senior reverse engineer brings to the fight.

Kirtland AFB — Cyber Security Seminar & Information Technology Expo (Albuquerque, New Mexico, USA, May 7, 2014) Join FBC and the Armed Forces Communications & Electronics Association (AFCEA)-Albuquerque Chapter for the Cyber Security Seminar & Information Technology Expo set to take place at Kirtland Air Force Base. This is the only yearly event officially sponsored by AFCEA at Kirtland AFB. The goal of this expo is to stimulate exchanges of information between industry partners and Kirtland AFB Information Management Officers', Information Technology personnel, Contracting Officers' as well as end-users, developers, scientists, researchers and project managers in the areas of cyber security and information technology.

US Secret Service Cybersecurity Awareness Day (Washington, DC, May 8, 2014) This Cybersecurity event will be the first of its kind at the USSS. There will be 2-3 opportunities for participating companies to present a 1/2 hour presentation on a Cybersecurity topic of concern to the agency. In addition, this event will be widely attended by the majority of personnel at the USSS HQ building. Attendance is expected to be over 300 for the event.

SANS Security West (, Jan 1, 1970) SANS Security West will arm information security professionals with the necessary insight to prepare their organization for today and the future. Attendees will have the opportunity to advance their information security skill set by learning innovative ideas and techniques to fend off today's most challenging cyber threats as well as emerging threats.

HackMiami 2014 (Miami Beach, Florida, USA, May 9 - 11, 2014) The HackMiami 2014 Hackers Conference seeks to bring together the brightest minds within the information security industry and the digital underground. This conference will showcase cutting edge tools, techniques, and methodologies that are at the forefront of the global threat landscape.

Eurocrypt 2014 (, Jan 1, 1970) Eurocrypt 2014 is the 33rd Annual International Conference on the Theory and Applications of Cryptographic Techniques. It is devoted to all aspects of cryptology.

ISPEC 2014 (Fujian, China, May 12 - 14, 2014) The ISPEC conference series is an established forum that brings together researchers and practitioners to provide a confluence of new information security technologies, including their applications and their integration with IT systems in various vertical sectors.

CyberWest (Phoenix, Arizona, USA, May 13 - 14, 2014) Cyber threats affect all industry sectors and impact individuals, businesses and governments. From hacktivists to advanced persistent threats, conducting business on-line exposes individuals, corporations and Governments to a complex threat environment including hacktivists to trans-national crime organizations and advanced persistent threats. Join experts from government, industry and academia in discussing how we are making our future more secure.

GovSec 2014 (Washington, DC, USA, May 13 - 14, 2014) GovSec is the nation's premier event for Government, Homeland Security, and Law Enforcement professionals looking for proven strategies and cost effective technology so they can achieve their mission of protecting our critical infrastructures, key assets, communities and the nation.

Cyber Security for National Defense Symposium (, Jan 1, 1970) DSI's Cyber Security for National Defense Symposium is designed as an educational and training "Town Hall" forum, where thought leaders and key policy-makers across military and civilian organizations can come together for actionable discussions and debate. The symposium will focus on increasing the security and resiliency of the Nation's critical networks, operating freely in the Cyber Domain, and the protection of infrastructure in support of national defense and homeland Security.

FOSE Conference (Washington, DC, USA, May 13 - 15, 2014) Spend 1 day or 3 days at the FOSE conference and leave with actionable information, covering a broad spectrum of trending topics including: Cybersecurity, Cloud and Virtualization, Mobile Government, Big Data and Business Intelligence, Project Management, Procurement and Acquisition and more. (free-of-charge for government personnel).

INFILTRATE (, Jan 1, 1970) INFILTRATE is a deep technical conference that focuses entirely on offensive security issues. Groundbreaking researchers focused on the latest technical issues will demonstrate techniques that you cannot find elsewhere. INFILTRATE is the single-most important event for those who are focused on the technical aspects of offensive security issues, for example, computer and network exploitation, vulnerability discovery, and rootkit and trojan covert protocols. INFILTRATE eschews policy and high-level presentations in favor of just hard-core thought-provoking technical meat.

Security BSides Denver 2014 (Denver, Colorado, USA, May 16, 2014) Each BSides is a community-driven framework for building events for and by information security community members. The goal is to expand the spectrum of conversation beyond the traditional confines of space and time. It creates opportunities for individuals to both present and participate in an intimate atmosphere that encourages collaboration. It is an intense event with discussions, demos, and interaction from participants. It is where conversations for the next-big-thing are happening.

Security Start-up Speed Lunch NYC (New York, New York, USA, May 19, 2014) Our goal for this inaugural event is to connect the most promising security startups in the world with decision-makers at aerospace, asset-management, banking, communications, defense, energy, healthcare, government, technology and transportation sector companies in a novel way: the speed lunch.

CEIC 2014 (Las Vegas, Nevada, USA, May 19 - 22, 2014) It's no exaggeration to say that CEIC is the biggest digital-investigations conference of its kind and the only one to offer hands-on lab sessions and training for practical skills development. From sessions on acquiring evidence from mobile devices to international e-discovery to cyber security intelligence, there's simply no other training or seminar series available that packs so much relevant and practical information from so many expert speakers into a single four-day period.

The Device Developers' Conference: Bristol (Bristol, England, UK, May 20, 2014) The Device Developers' Conference is an annual UK event for the developers of intelligent systems and devices. The objective is to provide an event that provides engineers with an opportunity to learn about the latest tools, technologies and techniques for the successful development of leading edge electronic products and systems.

Positive Hack Days (, Jan 1, 1970) Positive Hack Days is the international venue for the unification of progressive forces of the IT industry. It is about innovators interested in information security problems; it is fresh blood and bright eyes, the atmosphere of a huge research ground, communication between people sharing the same views and their opponents, minimum formalities and maximum practice.

Georgetown Law: Cybersecurity Law Institute (, Jan 1, 1970) A day does not go by where cybersecurity is not in the news. In fact, according to a recent national survey conducted by FTI Consulting, cybersecurity is the number one issue on the minds of general counsels of American companies. Last year's inaugural Cybersecurity Law Institute received positive reviews for its unique simulation approach that prepared attendees on actions to take if their company faced a cyber-attack.

NSA Mobile Technology Forum (MTF) 2014 (, Jan 1, 1970) The Mobile Technologies Forum is an annual event that attracts SIGINT, Information Assurance, HUMINT, Federal Law Enforcement, Counterintelligence and Government personnel from the United States, Australia, Canada, New Zealand, and United Kingdom focused in mobile technologies. Those companies who specialize in both current and future mobile features and equipment or have efforts that benefit NSA's efforts should participate as a commercial vendor; conference attendance is limited to government employees.

CyberMontgomery Forum: Center of Gravity (Rockville, Maryland, USA, May 22, 2014) Cybersecurity will be a major growth engine in the region for many years to come. With solid federal government, industry and academic assets already in place in the region, there is still a need to bring them together so that they can coalesce and elevate the cyber ecosystem to a level of national prominence. CyberMontgomery Forum events will provide clear direction on finding business opportunities, contracting, forecasted demand areas, workforce development, recruiting & staffing, legal responsibilities for businesses, updates on technologies being developed in MoCo and summary updates regarding our NCCoE neighbors, federal civilian agencies and commercial sector leaders.

Cyber Risk Summit (Washington, DC, USA, May 22, 2014) This one-day leadership conference will provide a discussion forum for business executives, insurance companies and policymakers on more effective private and public responses to cyber risk management. Topics to be discussed by expert speakers will include state and federal regulatory and legislative initiatives, efforts to develop a common cyber security framework, the threats from cyber espionage and terrorism, and the development of public and private mechanisms to finance and transfer losses from cyber events.

The Device Developers' Conference: Cambridge (Cambridge, England, UK, May 22, 2014) The Device Developers' Conference is an annual UK event for the developers of intelligent systems and devices. The objective is to provide an event that provides engineers with an opportunity to learn about the latest tools, technologies and techniques for the successful development of leading edge electronic products and systems.

Fort Meade Technology Expo (, Jan 1, 1970) The Ft. Meade Technology Expo is a one-day event held at the Officers' Club (Club Meade) on base. Industry vendors will have the unique opportunity to showcase their products and services to personnel that may otherwise be unattainable.

CANSEC (, Jan 1, 1970) CANSEC is Canada's foremost defence tradeshow. A two-day event, CANSEC will feature 120,000 square feet of indoor exhibits by Canada's leading edge defence companies, as well as an outdoor static display. This tradeshow targets a wide audience of customers that includes Government agencies and departments with an interest in the defence sector.

Hack in The Box Security Conference (HITBSecConf) Amsterdam (, Jan 1, 1970) HITBSecConf Amsterdam is a gathering of network security professionals and enthusiasts who come from all corners of the globe to discuss the next generation of attacks and defense techniques. This is not an event you come to for 'security 101' talks or marketing hype. We cover stuff that hasn't made it into the news — yet. Potential security issues coming our way in the next 12 months.