The CyberWire Daily Briefing 07.17.15

Cyber Attacks, Threats, and Vulnerabilities

'Cyber Army' hacker arrested, says Bulgaria (Deutsche Welle) Bulgaria says it has arrested a hacker suspected of belonging to an Islamist network that targeted more than 3,500 websites worldwide. Bulgarian public radio says the suspect is a resident student originally from Syria

Why the Islamic State leaves tech companies torn between free speech and security (Washington Post) When a lone terrorist slaughtered 38 tourists at a Tunisian resort on June 26, the Islamic State turned to one of America's leading social-media companies to claim responsibility and warn of more attacks on the world's nonbelievers

Researchers prove HTML5 can be used to hide malware (Help Net Security) A group of Italian researchers have come up with new obfuscation techniques that can be used to dupe malware detection systems and allow malicious actors to execute successful drive-by download attacks

iOS Crash Report? Don't Be Fooled by iPhone/iPad Scammers (Intego Mac Security Blog) Have you had an unusual error message popping up on your iPhone or iPad?

Tracking MiniDionis: CozyCar's New Ride Is Related to Seaduke (Palo Alto) Unit 42 has uncovered a new campaign from the CozyDuke threat actors, aka CozyCar, leveraging malware that appears to be related to the Seaduke malware described earlier this week by Symantec

Wicked WikiLeaks leaks considered harmful: Alert over malware lurking in dumped docs (Register) Tip-toe through the old-days, hope you don't hit a zero-day

Fake News App in Hacking Team Dump Designed to Bypass Google Play (TrendLabs Security Intelligence Blog) We analyzed the recent Hacking Team dump and found a sample of a fake news app that appears to be designed to circumvent filtering in Google Play. This is following news that iOS devices are at risk of spyware related to the Hacking Team. The fake news app was downloaded up to 50 times before it was removed from Google Play on July 7

Microsoft Office Zero-Day CVE-2015-2424 Leveraged By Tsar Team (iSIGHT Partners) Yesterday, Microsoft patched CVE-2015-2424, a vulnerability in Microsoft Office discovered by iSIGHT Partners while monitoring the Russian cyber espionage team we call Tsar Team. When we found the exploit it appeared to be under development and evidence suggests it was deployed in Georgia. Following discovery, we alerted our customers and began working with Microsoft through the responsible disclosure process

New GamaPoS malware targets US companies (Help Net Security) After dedicating their efforts to swelling the number of computers roped into their malicious net, the masters of the Andromeda botnet are putting it to use by delivering a new family of PoS malware to as many PoS systems as they can

New GamaPoS Malware Piggybacks on Andromeda Botnet; Spreads in 13 US States (TrendLabs Security Intelligence Blog) We discovered GamaPoS, a new breed of point-of-sale (PoS) threat currently spreading across the United States and Canada through the Andromeda botnet. GamaPoS is the latest in a long list of threats that scrape off credit card data from PoS systems. Compared to its predecessors, GamaPoS uses malware coded using the .NET framework — a first in PoS threats

Authentication Bypass Bug Hits Siemens Energy Automation Device (Threatpost) An authentication bypass vulnerability in a Siemens device that's used in energy automation systems could allow an attacker to gain control of the device

Totolink Routers Plagued by XSS, CSRF, RCE Bugs (Threatpost) A slew of routers manufactured in China are fraught with vulnerabilities, some which have existed in products for as long as six years

Gemini CSO Finds Vulnerabilities in Bitcoin Security Hardware (Bitcoin News Service) Gemini CSO Cem Paya recently highlighted certain vulnerabilities in the SafeNet's Hardware Security Modules (HSMs) that can risk users' Bitcoin private keys

Researchers Intercepted a New Backdoor Called 'Matsnu' (Spamfighter) Blog[dot]checkpoint[dot]com reported on 2nd July, 2015 stating that researcher at security firm Check Point, Stanislav Skuratovich recently discovered a new malware known as "Matsnu" which is an infector which acts like a backdoor after it infiltrates a computer system

Outpost24 has found critical vulnerabilities in Joomla Helpdesk Pro! (Bot24) The Outpost24 team has identified several vulnerabilities that affect HelpDesk Pro, an extension to the popular content management system Joomla

Security Patches, Mitigations, and Software Updates

Google to Expand Use of Safe Browsing to Stop Unwanted Software (Threatpost) Google is expanding the use of its Safe Browsing mechanism to warn users about a broader variety of unwanted software, in addition to the warnings they see regarding phishing pages, malware, and other threats

Windows XP security just got worse again (ZDNet) Microsoft will no longer be providing anti-malware signatures via its Security Essentials package for the antique operating system

Flash Furor Grows Despite Adobe's Latest Fix (TechNewsWorld) A plague of security issues have accelerated the end of Flash's life, according to Ken Westin, a senior security analyst at Tripwire. "The days of Flash are numbered. With the advancement of HTML5 and more powerful and standardized JavaScript frameworks and more flexible video support, Web developers no longer need to rely on Flash to create highly interactive Web experiences"

Why Adobe Flash won't die, even though we all want it to (Business Insider) There are few pieces of software that are as hated as Adobe Flash

Java Back In The Bullseye (Dark Reading) Adobe Flash may be all the attack rage lately, but Oracle's new pile of patches — including one for an 0day spotted in the wild — highlight how Java remains an attractive target

Just get rid of Java finally (CSO) Headlines about Adobe Flash zero-day exploits and calls for the execution of Adobe Flash dominated headlines over the past week or so in the wake of the Hacking Team hack. Meanwhile, Oracle pushed out a security update. The Oracle update fixed 193 security vulnerabilities — yes one, nine, three…just seven short of 200 — including 25 just for Java. While we're tossing Adobe Flash overboard let's send Java with it

Cyber Trends

Third-Party Insiders: Compliance as the First Step to Trust (IBM Security Intelligence) Many reports on security breaches treat malicious insiders and third-party threats like two separate risks. Nowadays, however, it can be difficult to determine who is actually an inside member of your organization and who is an outsider. The distinction between inside and outside is disappearing under the influence of new business models and connecting technologies

What the Hacking Team Breach Shows About Bank Vendor Risk (American Banker) The Hacking Team breach offers a cautionary tale for U.S. banks about vendor risk, even though only foreign financial institutions were revealed to be clients of the firm

What's keeping security experts awake at night? (Naked Security) What's keeping you awake at night? Gartner polls top-level security expertsEnterprises will pour more than $71 billion into infosec this year but are still get clobbered by crippling data breaches such as Sony's or Anthem's. Why?

The CIO's real security headache (Tech Republic) Too many security technologies overlap or much worse leave gaps in between that could let hackers through. We need a more coordinated approach, and fast

Majority of Healthcare Security Incidents Involve External Actors, Phishing Attacks (Duo Security) A new survey from HIMSS (Healthcare Information and Management Systems Society) found that 87 percent of healthcare officials rate information security as an increasing business priority. Another two-thirds reported that their organization had experienced a significant security incident

Infosec Influencers: An Interview with Bruce Schneier (Tripwire: the State of Security) This week, as part of our new "Infosec Influencer" series, I had the pleasure of sitting down with Bruce Schneier, an internationally renowned security technologist and one of The State of Security's Top Influencers in Security You Should Be Following in 2015

The Cybersecurity Canon: Cybercrime and Espionage: An Analysis of Subversive Multi-Vector Threats (Palo Alto Networks) Cybercrime and Espionage, published in 2011, is a book that was ahead of its time. The authors were pushing the envelope in terms of how the security community should think about advanced threats. However, almost five years later, there is not enough in here to make the book Cybersecurity Canon material. Gragido and Pirc present some stimulating ideas, but in the end, the security community has not adopted many of them

Marketplace

Government to give £5,000 cyber security boost to SMEs (ComputerWeekly) The UK government has announced initiatives aimed at boosting SME cyber security, promoting the cyber security profession and supporting cyber security innovation projects

Security opportunity in clients still running Microsoft Windows Server 2003 (Channelnomics) Channel players say customers continuing with Windows Server 2003 will need partners to make them secure

Internet of Things — Why security service providers can cautiously rejoice (Reseler) For security service providers, the Internet of Things a terrifying yet exhilarating prospect

After Cyber Attack, "Hacking Team" Founder Speaks Out (Worldcrunch) After a devastating leak and allegations of working with oppressive regimes, the Milan technology firm's founder responds to the critics

How spy agencies around the world used this company's software (Fortune) Cybercriminals who hacked into security firm Hacking Team released a trove of emails showing the inner workings of government spy agencies

CrowdStrike is to expand globally after raising $100 Million (BizTechMojo) A security provider, that is believed to offer brand new approach in the field of cybersecurity, was able to raise a significant amount after making a deal with Google Capital and the partners

OkCupid founders raise $10.8M to make cryptography accessible to mere mortals (New York Business Journal) Two founders of the dating site OKCupid have raised $10.8 million for their new venture, Keybase, a cryptography "hobby project" that took on a life of its own

Symantec split necessary for focus, changing market dynamics (ZDNet) Security vendor will not be nimble enough to address the current landscape if it stays as one entity, says exec, adding that separate sales and product teams already have been established

Symantec, Frost Data Capital to Incubate Cybersecurity Startups (Wall Street Journal) Partnership is intended to create cybersecurity startups to solve looming security challenges

ManTech divests cyber business … sort of (Washington Technology) ManTech International is divesting its commercial cyber business but it's investing there at the same time

Job security: Opportunities in combating cyber crime (Engineer) The growing threat of cyber crime is creating a wide range of career opportunities for engineers

10 Trends In Infosec Careers And Staffing (Dark Reading) Employment stable for job-seekers, but staffing gaps persist for employers who need better security teams to counter threats

American Cyber wins L-3 small business honor (C4ISR & Networks) L-3 National Security Solutions named American Cyber, based in Clifton, Virginia, one of its Small Businesses of the Year for 2014

Products, Services, and Solutions

Lawrence Livermore licenses tool to improve government computer network security (Lawrence Livermore National Laboratory) Government agencies, along with state and local governments, could receive a helping hand from a computer network security tool developed by Lawrence Livermore National Laboratory (LLNL) computer scientists and engineers

AdaptiveMobile Launches Threat Intelligence Unit (TIU) to Enable Operators to Stop Mobile Security Attacks Threatening Their Networks (BusinessWire) Unique intelligence on latest mobile threats, including how SS7 network breaches are compromising personal and national security

Benseron To Implement Comodo Containment Technology To Protect 20,000 Retail And POS Systems (PRNewswire) The Comodo organization, a global innovator and developer of cybersecurity solutions, today announced that Benseron, a premier point of sale (POS) solutions innovator, will integrate Comodo SecureBox containment technology to help secure more than 20,000 Benseron point of sale units across the globe

Varonis launches Datanywhere 2.5 with echancements to workflow and security (Vanilla+) Varonis Systems, Inc. (NASDAQ: VRNS), a provider of software solutions for unstructured, human-generated enterprise data, announced the general availability of version 2.5 of DatAnywhere, its popular secure file-sharing solution

Fortinet Brings Advanced Protection of High-Performance Internal Segmentation Firewalls to Mid-Market and Enterprise Organizations (MarketWatch) Fortinet Ccontinues to expand its FortiASIC-NP6-based FortiGate Platform; delivering best-in-class cybersecurity to mid-market organizations and large branch offices

Which Antivirus Offers Best Real-World Protection? (PC Magazine) Rather than test just one component of antivirus products, AV-Comparatives gives every component of each product a chance to do its malware-blasting job

How to become cyber resilient quickly and remain in full control (Fox IT) Successful and effective cyber security is not only about tools, but (increasingly) about the processes and people to operate those tools effectively. While organizations used to buy security tools and believed this would be sufficient, they increasingly realize that running the actual Cyber Security Operations (CSO) with the right people is necessary to benefit from those tools

Portland security firm lands world-renowned information partner (Portland Business Journal) Portland cybersecurity firm iovation is working with consumer information stalwart Equifax to power a new product available in the United Kingdom

Farsight Security Takes DNS Insights to Improve Security (eSecurity Planet) Paul Vixie, CEO of Farsight Security, discusses how his firm uses DNS and other network traffic information to help organizations with security forensics

EdgeWave Receives Two Gold Medals at 10th Annual 2015 IT World Awards (Virtual Strategy Magazine) EdgeWave®, a San Diego-based leading cyber security firm, announced today that Network Products Guide, one of the industry's leading technology research and advisory guides, has named EdgeWave a double Gold winner in the 2015 IT World Awards for Hot Companies and Best Products. EdgeWave ePrism® Email Security™ was named Best Email Security Product and EdgeWave iPrism® Web Gateway™ was named Best Web Security Product

Technologies, Techniques, and Standards

Process Explorer and VirusTotal (Internet Storm Center) About a year ago, Rob had a diary entry about checking a file from Process Explorer with VirusTotal. Did you know you can have all EXEs of running processes scanned with VirusTotal?

Understanding PCI compliance fines: Who is in charge of enforcing PCI? (Help Net Security) If your business stores, processes, or transmits data from payment cards, then you are subject to the requirements of the PCI DSS. This set of security controls is designed to help merchants combat data theft, protecting both consumers and merchants' own reputations. When a business fails to satisfy those rules, they can be subject to significant financial penalties. But who exactly is in charge of enforcing PCI?

Top 5 Success Factors for Cybersecurity Management Programs (Cisco Security Blog) Several years ago, an employee at an organization I worked for was terminated from his job, effective immediately. While being escorted from the facility this user picked up "his" backup media and started to leave the building

Cyber Security for SMEs (SME) Cyber risk is the risk of an incident resulting from the use of computers and the internet: the loss or theft of personal data, the theft of trade secrets and commercially sensitive information, business interruption, intellectual property infringement, physical damage, personal injury, defamation and extortion. Nick Gibbons, partner at BLM writes for SME

Stepping Up Security Risk Management Practices (SecurityWeek) Targeted and highly sophisticated cyber-attacks are compelling security practitioners to change the way they deal with evolving threats. The damages associated with breaches are motivating companies to transition from a check-box mentality to a pro-active, risk-based approach to security. This means that security risk management needs to advance beyond traditional yearly assessments

The Insiders: A Rogues Gallery (Dark Reading) You can defend against an insider threat if you know where to look

Design and Innovation

Breached PII: Why KBA Has to Go (Data Breach Today) New forms of authentication essential in new environment

IoT is the password killer we've been waiting for (IT World) IoT, with its tiny screens & headless devices, will drive an authentication revolution. It's a short leap from the kind of two-factor authentication used on the Apple Watch to proximity-based authentication that does away with any user interaction. Passwords are just the canary in the coalmine

Sandboxes are "Typed": It's Time to Innovate to Defeat Advanced Malware (SecurityWeek) Alfred Hitchcock once said, "I am a typed director. If I made Cinderella, the audience would immediately be looking for a body in the coach"

Academia

Can Cybercompetitions Help Grow Local Security Talent? (Government Technology) Hiring cybersecurity staff is difficult, but federal, state and local governments are working with nonprofits to encourage the development of cybersecurity skills through individual and team competitions

Inspired Careers launches to help grow the Cyber Security talent pool (Realwire) Developed with the UK Government as part of its National Cyber Security Programme, new careers hub aims to encourage people into the Cyber Security industry and keep them there

Legislation, Policy, and Regulation

Cryptology research potentially a criminal activity (ITWire) Australia's obsession with national security continues to have unintended consequences, with the academic exchange of information about cryptography now in danger

UK minister: Cyber-security a 'priority' for government, but no ban on encryption (SC Magazine) UK minister Ed Vaizey has dismissed media reports that the Conservative government plans to ban encryption, whilst also promising that cyber-security remains a 'priority' in Whitehall

U.S. Vuln Research, Pen Test Firms Protest Impending Export Controls (Dark Reading) American security companies have the most to lose from new rules that would restrict the export of tools and information about network surveillance and 'intrusion software'

There's a Plan to Immediately Purge Some Governmentwide Network Surveillance Data (Nextgov) After a series of stinging government hacks, the Department of Homeland Security said scans of incoming Internet traffic from the public would be amped up. It has been unclear how this monitoring might affect the privacy of citizens and employees

After Dodging the Bullet that Hit OPM, Interior 'Owns' Up to Cyber Problem (Nextgov) Sometimes, fear is the best motivator. At the Interior Department, this was the case when hackers stole millions of federal employee records from an Office of Personnel Management database stored inside one of Interior's data centers. The assailants left Interior's data unscathed

Security of the U.S. Department of the Interior's Publicly Accessible Information Technology Systems (Office of the Inspector General, US Department of the Interior) Defense in Depth is a widely recognized best practice for protecting critical information technology (IT) assets from loss or disruption by implementing overlapping security controls. The concept of Defense in Depth is that if one control fails then another is in place to either prevent or limit the adverse effect of an inevitable cyber attack. We found that three U.S. Department of the Interior (Department) Bureaus had not implemented effective Defense in Depth measures to protect key IT assets from Internet-based cyber attacks

DoD CIO Discusses Pentagon Wireless, Mobility Programs (DoD News) Part of Defense Department Chief Information Officer Terry Halvorsen's work these days involves launching the Pentagon's first wireless network and managing the rollout of "secure enough" mobile devices, he told an audience here recently

Cybersecurity task force looks to next administration (Federal Times) A group of former feds and industry experts are getting together to ensure major cybersecurity initiatives don't fall through the cracks as more candidates pile into the 2016 race and Washington prepares for a transition in leadership

Litigation, Investigation, and Law Enforcement

U.K. 'Emergency' Surveillance Law Ruled Unlawful By High Court (TechCrunch) In a high profile win for civil liberties in the U.K., surveillance legislation rushed through the national parliament in a matter of days last year has today been declared unlawful under European Human Rights law

Government IT official ran law enforcement data systems for years with faked degrees (Ars Technica) Interior official resigned when caught, then took a job at Census Bureau

Are CIOs the Latest Targets in Litigation After a Cyberbreach? (Legaltech News) The increasing risk for being named in a lawsuit illustrates the challenges of being a CIO today

Data errors implicated innocent people — watchdog (BBC) People were wrongly implicated in paedophile investigations because of botched attempts to access data, a communications watchdog has said

Can big data combat a Pentagon insider threat? (C4ISR & Networks) Keeping tabs on workers in contact with the federal government is high priority in an era that is not only post-Edward Snowden, but post-Fort Hood, post-Navy Yard and generally post-general-sense-of-security. The government's struggles to maintain thorough backgrounds of its workers are well-documented, but now officials hope the use of big data will fix many of the problems

Two Charts Show How the Drug War Drives US Domestic Spying (Wired) There's a reason the television show The Wire wasn't just called "The Cops vs. Drug Dealers Show." Law enforcement's surveillance in America — and particularly its ever-increasing use of wiretaps — have been primarily driven for the last 25 years by drug cases. And as the chart above shows, that's now truer than ever before

For a complete running list of events, please visit the Event Tracker.

Newly Noted Events

PragueCrunch IV: The Enpraguening (Prague, Czech Republic, Jul 31, 2015) Here it comes, Central Europe: PragueCrunch IV! This annual celebration of all things startup is coming to your town on Friday, July 31, 2015 from 7:00 PM to 11:00 PM (CEST). We'll be holding the event on the terrace at Střelecký Ostrov. If you've been to any of the previous events you'll know it's a good time

BSides Raleigh (Raleigh, North Carolina, USA, Oct 9, 2015) Security B-sides (BSides) is a community-driven framework for building events for and by information security community members. The goal is to expand the spectrum of conversation beyond the traditional confines of space and time. It creates opportunities for individuals to both present and participate in an intimate atmosphere that encourages collaboration. It is an intense event with discussions, demos, and interaction from participants. It is where conversations for the next-big-thing are happening. Security is top of mind across the entire sphere of IT and the world beyond. Therefore, more people and organizations are interested in the next new thing in security. BSides is the place where these people come to collaborate, learn and share. With many tech-companies, colleges and universities in Raleigh, Durham, Chapel Hill and surrounding areas, it is also an international center of innovation in the security industry

Passwords 2015 (University of Cambridge, England, UK, Dec 7 - 9, 2015) More than half a billion user passwords have been compromised over the last five years, including breaches at internet companies such as Target, Adobe, Heartland, Forbes, LinkedIn, Yahoo, and LivingSocial. Yet passwords, PIN codes, and similar remain the most prevalent method of personal authentication. Clearly, we have a systemic problem. This conference gathers researchers, password crackers, and enthusiastic experts from around the globe, aiming to better understand the challenges surrounding the methods personal authentication and passwords, and how to adequately solve these problems. The Passwords conference series seek to provide a friendly environment for participants with plenty opportunity to communicate with the speakers before, during, and after their presentations

Upcoming Events

SINET 16 Application Deadline (San Francisco, California, USA, Jul 17, 2015) Innovative solutions frequently come from new and small companies. Our goal is to provide entrepreneurs from all over the world an opportunity to increase their product awareness to a select audience of sophisticated investors, builders and buyers. In order to participate, companies must have annual revenues of approximately fifteen (15) Million dollars or less. The application deadline is this Friday

TakeDownCon Rocket City (Huntsville, Alabama, USA, Jul 20 - 21, 2015) TakeDownCon is a highly technical forum that focuses on the latest vulnerabilities, the most potent exploits, and the current security threats. The best and the brightest in the field come to share their knowledge, giving delegates the opportunity to learn about the industry's most important issues. With two days and two dynamic tracks, delegates will spend Day 1 on the Attack, learning how even the most protected systems can be breached. Day 2 is dedicated to Defense, and delegates will learn if their defense mechanisms are on par to thwart nefarious and persistent attacks

The APTs are coming (New York, New York, USA, Jul 21, 2015) With cyberespionage and Advanced Persistent Threats (APTs) on the rise, it's important to understand today's threat landscape-and the ways you can keep your company safe. Join LIFARS, Kaspersky Lab, Cyphort, and vArmour for an informative breakfast discussion on the most effective solutions available for stopping advanced threats

California Cybersecurity Task Force Quarterly Meeting (Walnut Creek, California, USA, Jan 20, 2015) The California Cyber Security Task Force serves as an advisory body to California's senior government administration in matters pertaining to Cyber Security. Quarterly Cybersecurity Task Force meetings address State and Federal cyber legislation; provide updates on Task Force efforts to improve California's cyber workforce and education; promulgate critical information to enhance California's cyber awareness and preparedness; discuss state advances in cybersecurity and digital forensics; and grant residents an opportunity to share cyber information and innovation

CyberMontgomery 2015 (Rockville, Maryland, USA, Jul 30, 2015) Montgomery County, Maryland, is home to the National Institute of Standards and Technology (NIST), the National Cybersecurity Center of Excellence (NCCoE), the FDA, NIH, NOAA, NRC and more than a dozen other Federal agencies, plus regional State and local agencies, educational institutions (such as Montgomery College, the Universities at Shady Grove, a satellite campus of Johns Hopkins, and the Bethesda-based SANS Institute), plus scores of cyber companies, ranging from start-ups to multinational corporations such as Lockheed Martin, employing upwards of 37,000 people in cyber-related jobs. With cybersecurity constituting a major growth engine in the region for many years to come, and with leading Federal government, industry and academic assets already in place in the region, the annual CyberMontgomery conference serves to bring them together so that they can coalesce and elevate the cyber ecosystem to a level of national prominence. In that light, CyberMontgomery provides clear direction on finding business opportunities, contracting, forecasted demand areas, workforce development, recruiting & staffing, legal responsibilities for businesses, updates on technologies being developed in the County, and summary updates regarding our NCCoE neighbors, federal civilian agencies and commercial sector leaders

Career Discovery in Cyber Security: A Women's Symposium (New York, New York, USA, Jul 30, 2015) Our annual conference brings together some of the best minds in the industry, with the goal of guiding women with a talent and interest in cyber security into top-flight careers

Black Hat USA (Las Vegas, Nevada, USA, Aug 1 - 6, 2015) Black Hat — built by and for the global InfoSec community — returns to Las Vegas for its 18th year. This six day event begins with four days of intense Trainings for security practitioners of all levels (August 1-4) followed by the two-day main event including over 100 independently selected Briefings, Business Hall, Arsenal, Pwnie Awards, and more (August 5-6)

ISSA CISO Forum: Third Party Oversight (Las Vegas, Nevada, USA, Aug 2 - 3, 2015) The CISO Executive Forum is a peer-to-peer event. The unique strength of this event is that members can feel free to share concerns, successes, and feedback in a peer only environment. Membership is by invitation only and subject to approval. Membership criteria will act as a guideline for approval. Invitations can be made by a CISO Members or ISSA Management. Guest, renewing, and new members are all subject to approval

BSides Las Vegas (Las Vegas, Nevada, USA, Aug 4 - 5, 2015) BSides Las Vegas is an Information/Security conference that's different. We're a 100% volunteer organized event, put on by and for the community, and we truly strive to keep information free. There is no charge to the public to attend BSidesLV. Our costs are covered by our generous donors and sponsors, who share our vision of free dissemination of information. The conversations are getting more potent and the "TALK AT YOU" conferences are starting to realize they have to change. BSidesLV is making this happen by shaking-up the format

Defcon 23 (Las Vegas, Nevada, USA, Aug 4 - 7, 2015) DEF CON has been a part of the hacker community for over two decades. See the organization's website for more information

USENIX Security (Washington, D.C., USA, Aug 12 - 14, 2015) The USENIX Security Symposium reunites researchers, practitioners, system administrators, system programmers, and others specialists interested in the latest advances in the security and privacy of computer systems and networks

5th Annual Cyber Security Training & Technology Forum (CSTTF) (Colorado Springs, Colorado, USA, Aug 19 - 20, 2015) The Information Systems Security Association (ISSA) Colorado Springs Chapter and FBC, Inc. will once again co-host the 5th Annual Cyber Security Training & Technology Forum (CSTTF). CSTTF 2015 will bring together cyber experts from the DoD, federal government, business, research, and academia to address a variety of current cyber topics

Decepticon 2015 (Cambridge, England, UK, Aug 24 - 26, 2015) Decepticon brings together researchers and practitioners in the detection and prevention of deception. Previously, deception research has been fragmented across conferences in many different disciplines, sub-disciplines and countries. To cover the great diversity of approaches to deception research, our scientific committee has members covering several domains

AFCEA OKC Technology & Cyber Security Day (Oklahoma City, Oklahoma, USA, Aug 27, 2015) FBC and the Armed Forces Communications & Electronics Association (AFCEA) Oklahoma City Chapter will be partnering once again to host the annual Technology Day & "Scholarship" Golf Tournament at Tinker AFB. This is the only Technology Day held at Tinker AFB each year. The annual Technology Day allows exhibitors the opportunity to have access to information technology, communications, cyber, engineering, and contracting personnel at Tinker AFB. Over 300 attendees participated in the 2014 Technology Day and we expect the same level of attendance in 2015

Power Grid Cyber Security Exchange 2015 (San Diego, California, USA, Aug 30 - Sep 1, 2015) The Power Grid Cyber Security Exchange will take a deep dive into the cyber security strategies, innovative approaches and strategic planning necessary to balance the competing priorities of today's technology and information security executives. This program is tailored to utility executives and industry stakeholders that are responsible for addressing threat intelligence, analysis and monitoring; network architecture; and cyber incident response

2015 HTCIA International Conference & Training Expo (Orlando, Florida, USA, Aug 30 - Sep 2, 2015) Bringing together experts from all over the world to share their latest research and techniques related to cybersecurity, incident response and computer forensics

ICFP 2015 (Vancouver, British Columbia, Canada, Aug 31 - Sep 2, 2015) ICFP 2015 provides a forum for researchers and developers to hear about the latest work on the design, implementations, principles, and uses of functional programming. The conference covers the entire spectrum of work, from practice to theory, including its peripheries