The CyberWire Daily Briefing 07.06.15

Cyber Attacks, Threats, and Vulnerabilities

Hacking Team hacked, 400GB+ of company documents and emails leaked (Help Net Security) Hacking Team, the (in)famous Italian company that provides offensive intrusion and surveillance software to governments, intelligence and law enforcement agencies around the world, has been hacked

Notorious Security Firm 'Hacking Team' Compromised (Inquisitr) It is just now being reported on Twitter and by CSO Online that Italian security firm Hacking Team has been compromised by parties unknown

Hacking Team responds to data breach, issues public threats and denials (CSO) Hacking Team is awake, and the first order of business is to promote fear, uncertainty, and doubt

Reactions to the Hacking Team breach (Help Net Security) Here are some of the comments Help Net Security received

Hacking Team hacked — bad news for firm that helps governments spy on their citizens (Graham Cluley) Hacking Team, an Italian company which specialises in helping governments and intelligence agencies spy on their citizens, has found itself hacked — and its internal emails and documents published on the net

Hacking Team Breach Shows A Global Spying Firm Run Amok (Wired) Few news events can unleash more schadenfreude within the security community than watching a notorious firm of hackers-for-hire become a hack target themselves. In the case of the freshly disemboweled Italian surveillance firm Hacking Team, the company may also serve as a dark example of a global surveillance industry that often sells to any government willing to pay, with little regard for that regime's human rights record

Digital India Week: Pakistan hacker defaces NIT website (Times of India) A day after Prime Minister Narendra Modi launched Digital India week to reform government through technology, the official website of National Institute of Technology

BSNL site hacked (Hindu Business Line) BSNL's Telecommunications Journal website has been hacked by AnonOpsIndia

Obama administration spied on German media as well as its government (CNN) An investigation by the German parliament is raising questions on whether the Obama administration not only spied on journalists in that country, but also interfered in the exercise of the free press under the guise of U.S. national security

WikiLeaks: NSA spied on Brazil's president (The Hill) WikiLeaks disclosed documents Saturday detailing the National Security Agency's wiretapping of Brazilian President Dilma Rousseff

Poor security at JPS preceded cyber-attack / Most leaked files not protected by passwords (Yomiuri Shimbun) An investigation into the recent unauthorized access of personal information from the Japan Pension Service found that 99 percent of the files accessed were not protected by passwords, sources said

Hackers Installed Sophisticated Malware on U.S. Computers. Why Doesn't Anyone Care? (Reason) The worm was designed to gather intelligence on the ongoing Iranian nuclear talks

After a hack attack: Who was at fault? (Philly.com) Did a flaw from the tech firm SAP bare government secrets for hackers to steal? Or was it a security company's neglect?

Hacker hijacks Plex's forum and blog, makes Bitcoin ransom demand (Graham Cluley) Plex, an application used to organise and stream video collections between devices, has found itself on the sharp end of an attack from a ransom-demanding hacker

Security Alert: Ransomware delivered through Google Drive in New CryptoWall Campaign (Heimdal Security) Our team at Heimdal Security has recently collected and analyzed a new drive-by campaign abusing vulnerabilities in various popular third-party products

Evasion Techniques Keep Angler EK's CryptoWall Business Thriving (Threatpost) The Angler Exploit Kit is turning into a model for malware rapidly integrating new evasion techniques

Leak of ZeusVM malware building tool might cause botnet surge (IDG via CSO) The Internet could see a new wave of botnets based on the ZeusVM banking Trojan after the tools needed to build and customize the malware program were published online for free

Command Injection Vulnerabilities Plague IP Enabled Airlive Cameras (Threatpost) A handful of IP-enabled cameras are susceptible to command injection vulnerabilities that could let attackers decode user credentials and gain complete access to the devices

Rise in DDoS reflection attacks using abandoned routing protocol (Help Net Security) There's been an increase in the use of outdated Routing Information Protocol version one (RIPv1) for reflection and amplification attacks, according to Akamai

Bitcoin Exchange Hacked With Word Macro (Databreach Today) $5 million Bitstamp breach detailed in unconfirmed report

BizCN gate actor changes from Fiesta to Nuclear exploit kit (Internet Storm Center) An actor using gates registered through BizCN recently switched from Fiesta to Nuclear exploit kit (EK). This happened around last month, and we first noticed the change on 2015-06-15

Win32/Lethic Botnet Analysis (Infosec Institute) Lethic is a spam botnet consisting of an estimated 210 000 - 310 000 individual machines which are mainly involved in pharmaceutical and replica spam. At the peak of its existence, the botnet was responsible for 8-10% of all the spam sent worldwide

The top three banking malware families (Help Net Security) The primary motivator behind banking malware attacks is to capture credentials, financial data, and personal information from employees, and partner company employees, across industries. Then apply this stolen information in fraudulent wire transfers or fake automated clearing house (ACH) transactions to steal funds

Why Web browser security is a goldmine for attackers (Tech Target) Web browsers from all vendors are under constant attack and a large part of that has to do with the use of third-party software. Browsers using Java and Silverlight specifically are often targeted, but Robert "RSnake" Hansen, vice president of WhiteHat Labs at WhiteHat Security, says it's not always the fault of the browser, but the third-party software

A closer look into the piracy ecosystem (Help Net Security) Illegal reproduction and distribution of copyrighted material on the Web is booming as a result of security breaches in both mobile and desktop software applications

433,000 Ford cars to be recalled because of software bug — would you have preferred an internet update? (We Live Security) Apparently, Ford has identified a software bug on a number of its car models that means drivers may not be able to turn off the engine, even if they remove the ignition key

Architelos Latest State of Abuse Report Shows .Science Leads New G's When It Comes to Spam (paperblog) Architelos puts out a State of Abuse report that looks at which domain extensions are being used the most for things like spam and phishing. Their latest report shows data from May, Ten New gTLDs comprised 77% of the 143 new phishing reports in May 2015. This equates to 24 phishing reports per million new gTLD domains under management. The .xyz TLD had the highest number of phishing reports with 42 followed by .science with 22 and .club with 9

Bulletin (SB15-187) Vulnerability Summary for the Week of June 29, 2015 (US-CERT) The US-CERT Cyber Security Bulletin provides a summary of new vulnerabilities that have been recorded by the National Institute of Standards and Technology (NIST) National Vulnerability Database (NVD) in the past week

Security Patches, Mitigations, and Software Updates

Twitter's Periscope patches against malicious chatters pretending to be other users (Graham Cluley) Periscope, the live-streaming video app that Twitter launched with some fanfare in March, has suffered a security issue

Cyber Trends

Do Privacy Concerns Really Change With The Internet Of Things? (Forbes) "I see purposeful obfuscation and lack of transparency on the part of companies. Understanding is easier when a company is interested in telling me what they are doing with my data first, then interested in making a profit second." This is one of the reactions in the report by the Altimeter Group, Consumer Perceptions of Privacy in the Internet of Things written by Jessica Groopman with Susan Etlinger. The sentiment rings a sharp note out through our cloud of concerns about privacy

In The Cyber Realm, Let's Be Knights Not Blacksmiths (DarkReading) Why the Internet of Things is our chance to finally get information security right

Ignoring Mobile Security Doesn't Make It Go Away (Security Week) Recently I attended Gartner's Security and Risk Management Summit outside Washington, D.C. Early in the week, I had a discussion with a security professional who asked me, skeptically, if mobile threats were actually something he had to worry about

Cyber Security Monitoring and Logging needs to be taken more seriously warns CREST (IT Security Guru) New research published by CREST, the not-for-profit accreditation body that represents the technical information security industry, warns that organisations need to focus more effort and resources on monitoring and logging to help detect potential cyber security attacks, respond to incidents and meet compliance requirements

Unisys Survey: Consumers Cite Cyber Concerns in Gov't, Telecom, Retail Sectors (ExecutiveBiz) A new Unisys survey has found cyber attacks in the government, telecommunications and retail sectors to be a high concern among many consumers

Security threats, hackers and shadow IT still plague health IT (CIO via CSO) New analyses of security posture in the fast-growing health-tech market highlight the challenges posed by both external threats and unauthorized cloud applications

Healthcare Moves To The Cloud But Is The Cloud Ready For Healthcare? (Forbes) In less than one year — we've seen a staggering number of data breaches in healthcare. Almost 96 million records were stolen in just 3 high‒profile cases alone — Community Health Systems (4.5 million), Anthem (80 million), and Premera (11 million)

Doctors See Big Cybersecurity Risks, Compliance as Key for Hospitals (Xconomy) Cybersecurity and healthcare IT are both burgeoning areas of business. Put them together and you have a volatile mix of emerging technologies, security and privacy risks, and regulatory requirements — but also a lot of opportunity for growth and improvements

One-Third of Industrial Control Systems Breached in Last Twelve Months (Dark Matters) According to a report from SANS on the state of Industrial Control System (ICS) security, one-third of respondents (34%) said their systems had been infiltrated or infected in an attack at least twice in the last twelve months

Industrial control system (ICS) cyber incidents are not being identified or reported — despite survey results to the contrary (Control) Tripwire performed a critical infrastructure survey asking how long it would take to detect a breach. According to the Tripwire survey, 86% of energy security professionals believe they can detect a breach in less than a week and 61% believe they can detect a critical system breach in less than 24 hours. Thankfully, Tripwire questioned the results: "The problem with this high level of confidence is that other reports have indicated something quite different"

The Internet of Things Will Give Rise To The Algorithm Economy (Gartner Blog Network) It's hard to avoid. Almost every CEO's conversation about how IT is driving innovation inevitably comes back to the potential of big data. But data is inherently dumb. It doesn't actually do anything unless you know how to use it. And big data is even harder to monetize due to the sheer complexity of it

Cyberthreats Rank among Top 10 Business Risks for Mining and Metal Businesses (Hot for Security) Cyber-attacks rank ninth in the top 10 business risks for mining and metal businesses, 11 places above last year's results, according to the "Business risks in mining and metals 2015-2016" report by accountancy firm EY

Security experts warn airlines face threat of cyber attacks (Sydney Morning Herald) Airlines are increasingly at risk of cyber attacks that could pose significant safety issues and force carriers to ground their fleets to protect passenger welfare, causing major financial damage , security experts say

'A Playground for Hackers' (Inside Higher Education) The recently detected cyberattacks at Pennsylvania State University may spell bad news for other colleges and universities, according to IT security experts. Hackers such as those that targeted Penn State don't set their sights on individual institutions, but on entire industries

Concerns about potential cyber attack on the UK's financial system at 'highest recorded level', says Bank of England (Out-Law) Industry concerns about a potential cyber attack on the UK's financial system are at their "highest recorded level", the Bank of England (the Bank) has said in a new report

Securing the 'Net — at what price? (CSO) There is unanimous agreement that 100% security is not possible. But at least one expert says it could come close to that, for $4 billion. Others say it could cost less, but would require a lot more than money

Marketplace

Huawei tells resellers — 'we have no secrets' (CRN) UK CSO admits partners may encounter scepticism from customers worried about the colour of the flag outside its HQ

AVG Technologies Acquires Privax, a Global Leader in HMA VPN Solutions (Free Press Release Center) HideMyAss is a VPN (Virtual Private Network) service that was created in 2005 by Privax Limited; a company that is based in the U.K, with its main office situated in London. AVG Technologies, the online security company for more than 200 million monthly active users, announced the acquisition of Privax, a leading global provider of desktop and mobile privacy services for consumers. With the acquisition, AVG will add Privax's HMA! Pro VPN to its existing portfolio of security software and services that will be immediately made available to AVG's global customer base

HP makes it official, files papers to split company (FierceCIO) Several months after the company first revealed plans to split in two, officials at Hewlett-Packard filed formal paperwork to break HP Enterprise off as a separate company

Symantec to split into two publicly traded companies (IT Wire) Symantec will this year launch two separate organisations each focusing on what they do best. Symantec/Norton products will be security focused and Veritas as an information management company. Revenue for Symantec in 2015 is estimated to be about US$4.2 billion and Veritas about $2.5 billion

Moor To The Story: Quicktake on Cisco's Acquisition of OpenDNS (Forbes) This week, Cisco Systems CSCO -0.07% announced its acquisition of OpenDNS for $635M. OpenDNS is a Software as a Service (SaaS) provider for deploying security solutions that enables companies to quickly deploy applications and end-point security solutions to protect themselves and their devices from malware and viruses. This acquisition will help Cisco Systems significantly grow its security profile, especially around the cloud and Internet of Things (IoT)

Products, Services, and Solutions

Intel Security launches new Microsoft Office 365 Channel Kit (ARN) Says it's designed to be a "grab and go kit" for the channel

Here's how much security software can slow down your PC (IT Pro Portal) One of the main complaints that people express about security software is that it harms the performance of their PC. But how much of an effect does it really have?

Strong protection for corporate networks with Windows 7 (AV Test) Windows 7 is the most widely used operating system in companies. It is run on at least one out of two PCs. The newer Windows 8.1 was unable to have any effect on these numbers. AV-TEST examined 11 solutions for companies under Windows 7 in terms of their protection function, and can recommend most of them

Logfiller Inc. Announces Rollout of Its New "User Experience" Technology, Layer8 (PRNewswire) A young Falls Church company, Logfiller Inc., is rolling out its new software, Layer8, a user experience measurement tool that reveals actionable new data. This innovation has "immediate and significant implications for efficiency, cyber security and compliance across the Windows environment," explained company president, Michael Colopy, "providing far more insight than standard technology"

ProxyHam: A 2.5-Mile Leap for Web Anonymity (Tripwire: the State of Security) At DEF CON 23 this summer, an information security consultant plans to unveil ProxyHam, a hardware device that bears much promise for the future of web anonymity

The OPM breach screams for action (Security Info Watch) InZero Systems, a tech company out of Herndon, Virginia has come up with a unique solution it calls WorkPlay Technology. It helps solve this dilemma by creating multiple, hardware-separated operating systems whereby each OS has its own resources — kernel, flash memory, RAMS and drivers. Only one OS is active at a time

Technologies, Techniques, and Standards

Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations (NIST) The protection of Controlled Unclassified Information (CUI) while residing in nonfederal information systems and organizations is of paramount importance to federal agencies and can directly impact the ability of the federal government to successfully carry out its designated missions and business operations. This publication provides federal agencies with recommended requirements for protecting the confidentiality of CUI

New NCCoE Building Blocks for Email Security and PIV Credentials (NIST) NIST's National Cybersecurity Center of Excellence (NCCoE) has proposed two new building blocks, one to help organizations improve the security of email, the other to enable mobile devices to provide security services based on personal identity verification (PIV) credentials. PIV cards (as they are known in the federal government) and other so-called smart card identity credentials contain computer chips that can receive, store, and transmit information securely. They are currently used in conjunction with a card reader to ensure authorized access to computer systems, certify emails, or provide an additional layer of security for physical access to facilities

FTC Releases "Start with Security" Guide to "Practical Lessons" From Data Security Enforcement Actions (National Law Review) As part of its ongoing outreach efforts to educate businesses about the importance of data security practices, the FTC has released a list of "10 practical lessons" drawn from its previous data security enforcement actions

What is the True Cost of a Data Breach? (Infosecurity Magazine) Laurance Dine explains Verizon's assessment model for gauging the financial impact of a security breach

AWS Best Practices for DDoS Resiliency (Amazon Web Services) This paper is intended for customers who want to improve resiliency of their applications running on Amazon Web Services (AWS) against Distributed Denial of Service attacks. The paper provides an overview of Distributed Denial of Service attacks, techniques that can help maintain availability, and reference architectures to provide architectural guidance with the goal of improving your resiliency

DFBotKiller: Domain-flux botnet detection based on the history of group activities and failures in DNS traffic (ScienceDirect) Each botnet needs an addressing mechanism to locate its command and control (C&C) server(s). This mechanism allows a botmaster to send commands to and receive stolen data from compromised hosts. To maximize the availability of the C&C server(s), botmasters have recently started to use domain-flux techniques. However, domain-flux botnets have some important characteristics that we can use to detect them

How to Prevent Data Breaches by Service Providers (CFO) Here are some practical ways to improve providers' data-security efforts

Creating a Cybersecurity Governance Framework: The Necessity of Time (IBM Security Intelligence) Today's organizations are going through a big change in the way they operate, the way they think and the way they function. This change is being pushed by major technological (cloud and mobile), intellectual (big data and analytics) and behavioral (social) transformations that are affecting the entire IT industry. Security also has been hit by this revolution. In fact, more than the change itself, the impact to security is due to the speed of the developments

How to run a security awareness programme (IT Security Guru) If anything is guaranteed to strike doom and gloom into the hearts of security people, it's the prospect of starting a new security awareness programme

U.S. Agencies Conduct Cyberwar Games (Wall Street Journal) Pentagon, Homeland Security, NSA and others join British officials and private companies for three-weeks of exercises

The Phases of a Data Breach: Finding the Attack Before the Damage is Done (Legaltech News) A new report from security firm Vectra looks at the strategic phases of a cyberattack and what companies can do to shore up their defenses

Design and Innovation

MasterCard to trial pay-by-face for online purchasing (Naked Security) "Passwords are a pain," said MasterCard Chief Product Security Officer Ajay Bhalla

Can emoji passwords confuse hackers? (Pittsburgh Post-Gazette) Developers seeking to make security work 'imagistically'

Why Medium doesn't want your account to be password-protected (Graham Cluley) I wrote earlier this week about Medium's plan to allow users to log into their accounts, just by using your email address, but without requiring a password

Research and Development

Encryption's holy grail is getting closer, one way or another (ZDNet) Working with encrypted data without decrypting it first sounds too good to be true, but it's becoming possible

Vencore Labs Wins $4.8 million DARPA Award for Wireless Network Defense (PRNewswire) Work will significantly enhance security of military wireless networks

CrowdStrike Granted Patent for Next-Generation Endpoint Security Platform (BusinessWire) Today, CrowdStrike protects some of the largest blue chip companies in the financial services, energy, oil & gas, and technology sectors, along with some of the most targeted government agencies worldwide

US dominates net-security patents, China, Canada and Oz on the advance (Register) Cisco led the pack, even before the big buys of 2015

Academia

US students might soon be able to use federal aid to attend coding bootcamps (Quartz) As college gets more expensive and wages for computer programmers skyrocket, more people are turning to intense coding bootcamps and online course providers to improve their job prospects without getting buried under debt. And they might get some unexpected funding help soon: The Department of Education is planning to experiment with letting students use Pell Grants to pay for these alternative programs

Sen. Mikulski, HCC celebrate national recognition of college's cyber security programs (Baltimore Sun) American citizens, businesses and government agencies must deal with the daily threat of a cyber attack, but to Sen. Barbara Mikulski and the leaders of Harford Community College, that threat also creates opportunities for education and jobs

Legislation, Policy, and Regulation

The summer of cyber attacks (Ottawa Sun) Two things can be said about Ottawa's summer, so far. One is that it has been wet; the other is that it's been raining cyber attacks on federal government websites

China's new national security law worries US, tech industry (Boston Globe) When a draft of China's new national security law was made public in May, critics argued that it was too broad and left much open to interpretation

Hillary Clinton accuses China of 'stealing US secrets' (BBC) US Democratic presidential hopeful Hillary Clinton has accused China of stealing commercial secrets and government information

Germany says new reports of U.S. spying harm security ties (Reuters via Aol) Germany is taking seriously the latest reports about U.S. spying on senior government ministers and they are putting strains on vital security cooperation between the two countries, Chancellor Angela Merkel's spokesman said on Thursday

Germany wants quick clarification of new NSA spy allegations (AP via Military Times) Germany's foreign minister said Friday that new allegations of U.S. eavesdropping on senior German government officials' telephones need to be clarified "as quickly as possible" and that he hoped Washington would be forthcoming with information

OPM Director Sneaks Out An Update At 8pm on 4th of July (Threat Brief) At 8pm on the 4th of July OPM Director Archuleta posted an update on the breach into the lightly defended databases holding sensitive information on US Government employees. The update sticks with the theme OPM would like to push, which is that the Director is really doing a wonderful and visionary and proactive job at cybersecurity. She also makes her pitch on why she should not resign

Fix the federal hacking breach (Post and Courier) The fallout from the appalling security breach of federal employee records from the Office of Personnel Management continues to spread. And with agency director Katherine Archuleta expected this week to release the presumably final tally of people whose information was compromised, the full extent of this scandal should come into clearer — and even more alarming — focus

OPM Breach Reveals Shortcoming In US Efforts To Curb Advanced Cyber Intrusions (HSToday) On the heels of the recently reported data breach at the Office of Personnel Management (OPM) which affected millions of current and former federal employees, the House Committee on Homeland Security's Subcommittee on Cybersecurity, Infrastructure Protection and Security Technologies held a hearing to examine the Department of Homeland Security's (DHS) efforts to secure government networks in light of the recent data breach on the OPM

OPM, CISA, and the Cybersecurity Oxymoron (Just Security) In Congress, bad policy ideas are like vampires: They are very hard to kill because they're always somehow coming back from the dead. Such is the case with this year's iteration of the Senate's "cybersecurity information sharing" legislation, the Cybersecurity Information Sharing Act (CISA), offered by the chairman of the Senate Intelligence Committee, Sen. Richard Burr (R-NC)

VA gets serious about PIV, two-factor authentication during cybersecurity sprint (FierceGovernmentIT) The Veterans Affairs Department is using the recent information system breaches at the Office of Personnel Management as an opportunity to review current security practices and push existing protocols that may not have been fully implemented

Army Embeds Cyber Forces in Combat Training Drills (National Defense) As part of their routine combat training, Army brigades will be more rigorously challenged to fight enemies in cyberspace

Joint Statement by the DOJ and the ODNI on the Declassification of the Resumption of Collection Under Section 215 of the USA Patriot Act (IC on the Record) Yesterday, the Foreign Intelligence Surveillance Court (FISC) issued an opinion and primary order approving the government's application to renew the Section 215 bulk telephony program. The USA FREEDOM Act of 2015 banned bulk collection under Section 215 of the USA PATRIOT Act, but provided a new mechanism to allow the government to obtain data held by the providers

The battle between Washington and Silicon Valley over encryption (Christian Science Monitor Passcode) When Homeland Security Secretary Jeh Johnson arrived in San Francisco for one of the world's largest technology conferences, it was almost like a foreign emissary entering enemy territory

Smartphone anti-theft "kill switch" law goes into effect in California (Naked Security) California's "kill switch" law went into effect on Wednesday, 1 July, requiring all mobile phones sold in the state to be enabled with theft-deterrent technology

Litigation, Investigation, and Law Enforcement

WikiLeaks founder Julian Assange seeks asylum in France; French president says no (US News and World Report) WikiLeaks founder Julian Assange has failed in a bid to win asylum in France

Mystery vandals are cutting fiber-optic cables in California — how worried should we be? (Naked Security) Somebody is cutting underground fiber-optic cables in Northern California

You can earn millions by helping the FBI capture cybercriminals (TECHi) Few things in the modern world scream "cyberpunk" as much as multi-million dollar rewards for assisting in the capture of notorious cybercriminals. The FBI has had a cybercrime most wanted list for a while now, but just recently updated it with more then four million dollars in rewards

Experts: Cardinals hacking probe will stretch longer if feds implicate team executives (Minneapolis Star Tribune) The federal hacking investigation of the St. Louis Cardinals could take longer if high-level executives are implicated in the breach of the Houston Astros' database, according to legal experts

For a complete running list of events, please visit the Event Tracker.

Upcoming Events

National Insider Threat Special Interest Group Meeting (Laurel, Maryland, USA, Jul 16, 2015) Topics to be discussed at the meeting; Insider Threat Program Development & Implementation, Behavioral Indicators Of Concern, Legal Considerations When Developing & Managing An Insider Threat Program. There is no cost to attend this meeting

National Cybersecurity Center of Excellence (NCCoE) Speaker Series: Janet Levesque, Chief Information Security Officer at RSA (Rockville, Maryland, USA, Jul 16, 2015) Traditional security models are failing. While the idea of a shift from prevention to detection has gained traction, most current approaches to detection rely heavily on the same techniques that have rendered preventative tools ineffective. The ultimate goal — disrupting and stopping attacks — has continued to elude security experts. The next stage in the industry's evolution is to move to a stance of "dynamic defense," which combines the ability to detect an attack and fully understand its scope and potential impact on the business, and then use the information to disrupt the attack before adversaries can accomplish their goals

TakeDownCon Rocket City (Huntsville, Alabama, USA, Jul 20 - 21, 2015) TakeDownCon is a highly technical forum that focuses on the latest vulnerabilities, the most potent exploits, and the current security threats. The best and the brightest in the field come to share their knowledge, giving delegates the opportunity to learn about the industry's most important issues. With two days and two dynamic tracks, delegates will spend Day 1 on the Attack, learning how even the most protected systems can be breached. Day 2 is dedicated to Defense, and delegates will learn if their defense mechanisms are on par to thwart nefarious and persistent attacks

CyberMontgomery 2015 (Rockville, Maryland, USA, Jul 30, 2015) Montgomery County, Maryland, is home to the National Institute of Standards and Technology (NIST), the National Cybersecurity Center of Excellence (NCCoE), the FDA, NIH, NOAA, NRC and more than a dozen other Federal agencies, plus regional State and local agencies, educational institutions (such as Montgomery College, the Universities at Shady Grove, a satellite campus of Johns Hopkins, and the Bethesda-based SANS Institute), plus scores of cyber companies, ranging from start-ups to multinational corporations such as Lockheed Martin, employing upwards of 37,000 people in cyber-related jobs. With cybersecurity constituting a major growth engine in the region for many years to come, and with leading Federal government, industry and academic assets already in place in the region, the annual CyberMontgomery conference serves to bring them together so that they can coalesce and elevate the cyber ecosystem to a level of national prominence. In that light, CyberMontgomery provides clear direction on finding business opportunities, contracting, forecasted demand areas, workforce development, recruiting & staffing, legal responsibilities for businesses, updates on technologies being developed in the County, and summary updates regarding our NCCoE neighbors, federal civilian agencies and commercial sector leaders

Career Discovery in Cyber Security: A Women's Symposium (New York, New York, USA, Jul 30, 2015) Our annual conference brings together some of the best minds in the industry, with the goal of guiding women with a talent and interest in cyber security into top-flight careers