The CyberWire Daily Briefing 11.20.15

Cyber Attacks, Threats, and Vulnerabilities

New ISIS video threatens France, Italy, U.S. (CNN) A video released by ISIS on Thursday threatens new attacks in France, Italy, the United States and beyond

New Islamic State video threatens attack on White House (Reuters) Islamic State militants released a video on Thursday threatening the White House with suicide bombings and car blasts and vowing to conduct more attacks on France

Terror warning: Islamic State militants 'planning deadly cyber attack in UK' (Observer Leader) Under the proposals, measures will be put in place to disrupt criminal online marketplaces and Internet Service Providers (ISPs) will be asked to block sites that are know sources of malware

NYC Officials: New Islamic State Video Is Marketing Fear (ABC News) A newly released Islamic State group video that briefly depicts images of Times Square is an advertisement for the terrorist organization meant to market fear, city officials said Thursday

Islamic State Tactics Shift, Borrowing From al Qaeda (Wall Street Journal) Extremists are engineering larger, more coordinated plots against the West

How tech led to the death of France's public enemy number 1 (IDG via CSO) When one of the terrorists involved in the Paris shootings dropped his smartphone in a trashcan outside the Bataclan concert venue on Friday night, he wasn't worried about encrypting his text messages or stored documents. Why would he be? With a bomb strapped to his waist, he knew he was about to die

How French intelligence agencies failed before the Paris attacks (Guardian) Authorities knew of at least three of the Paris attackers but did not act — and ignored a warning about a potential attack

How terrorists exploit Europe's divided intelligence efforts (PBS News Hour) French authorities say the ringleader of the Paris attacks was killed in a raid outside Paris on Wednesday. So how did he return to Europe undetected after joining the Islamic State in Syria?

Terror Ringleader's Paris Death Raises Fear of Intelligence Failures (NBC News) The death in Paris of the suspected terror attack ringleader — a high-profile jihadi — prompted fears Thursday that a major intelligence breakdown may have allowed him to pursue his murderous plot

Anonymous's Cyber War with ISIS Could Compromise Terrorism Intelligence (Scientific American) Efforts to take down the terrorist organization's Web sites and expose its supporters could interfere with carefully planned law enforcement operations

Cyber ghost group foiling plots by feeding feds intel (Boston Herald) A small band of cyber jihadi hunters — including former members of the hacktivist group Anonymous — has been quietly feeding the feds online intel that's foiled more than 10 terror plots and identified scores of ISIS recruiters and websites, on a mission that's acquired new urgency in the wake of the Paris attacks

Linda is taking on Isis and you should be very afraid (Metro) Since the attacks on Paris many people have taken to Twitter and Facebook to share their hatred of Isis

Telegram messaging app will block Islamic State broadcasts (Reuters via the Guardian) Mobile message service used by Isis as recruitment and propaganda platform has so far deleted 78 channels in wake of Paris attacks

Founder of app used by ISIS once said 'We shouldn't feel guilty.' On Wednesday he banned their accounts. (Washington Post) Pavel Durov knew that terrorists might be using his app to communicate. And he decided it was something he could live with

Cryptography expert casts doubt on encryption in ISIS' favorite messaging app (Daily Dot) Telegram, the encrypted messaging app of choice for terrorist groups like ISIS, may not be as secure as the company wants people to think

Hacking group Strontium dogs NATO and government targets (Register) Microsoft reports phishers getting busy on high-value systems

Microsoft Security Intelligence Report: Strontium (Microsoft Malware Protection Center) The latest report (SIRv19) was released this week and includes a detailed analysis of the actor group STRONTIUM — a group that uses zero-day exploits to collect the sensitive information of high-value targets in government and political organizations

Hacking group that hit S. Korea may be at it again with new target (Computerworld) It appears the same malware was recently used against an organization based in Europe

TDrop2 Attacks Suggest Dark Seoul Attackers Return (Palo Alto Networks) While researching new, unknown threats collected by WildFire, we discovered the apparent re-emergence of a cyber espionage campaign thought to be dormant after its public disclosure in June 2013

Blast from the Past: Blackhole Exploit Kit Resurfaces in Live Attacks (Malwarebytes Unpacked) The year is 2015 and a threat actor is using the defunct Blackhole exploit kit in active drive-by download campaigns via compromised websites

Angler, Magnitude, and other exploit kits nearly twice as active as this time last year (Graham Cluley) Exploit kits' activity has risen 75% compared to the third quarter of 2014, reveals a new study

Dridex and Shifu give spam bots the day off and spread via exploit kits (Proofpoint) November 17 presented an interesting variation in Dridex and Shifu distribution techniques, as Proofpoint researchers observed both spreading via compromised websites that led to exploit kits. In these cases, the same compromised web site could infect a user with one Trojan or the other depending on the user's geographical location

Xindi botnet costs digital advertisers billions of dollars through bogus ad impressions (FierceITSecurity) The Xindi botnet, which exploits the critical Amnesia bug in the Internet advertising protocol implementation, could cost advertisers $3 billion by the end of next year, warned advertising security firm Pixalate

KilerRat spying software takes njrat to the next level (Graham Cluley) A new remote access trojan (RAT) called 'KilerRat' has built upon the capabilities of njrat to become a feature-rich, sophisticated spying tool

Why The Java Deserialization Bug Is A Big Deal (Dark Reading) Millions of app servers are potentially open to compromise due to how they handle serialized Java apps, researchers say

Attackers Embracing Steganography To Hide Communication (Threatpost) Encouraged by patterns carried out on a larger scale recently, researchers believe digital steganography has arrived as a legitimate method for attackers to use when it comes to obscuring communication between command and control servers

Huawei CPE Vulnerability and Kiddie Fun (Recorded Future) Like most Recorded Future users I have a list of keywords (entities created from text fragments) that generate a daily alert summary of relevant results from the Web. Recorded Future's applied NLP (natural language processing) makes the daily foreign language results especially interesting

Comcast Xfinity Wi-Fi discloses customer names and addresses (CSO) The Xfinity Wi-Fi service from Comcast is disclosing the full name and home address of residential customers, which is something the company says isn't supposed to happen

World Bank Site Has Certificate Revoked After Hosting Phishing Page (SecurityWeek) The official website for the World Bank's Climate-Smart Planning Platform has been hacked by at least two malicious actors, which has led to the site's certificate being revoked

This Black Friday — Fake Shops! (Check & Secure) Christmas is coming. If you believe the advertising industry anyway, as snowy scenes leak with crushing inevitability onto our screens

DNS Threat Index (Infoblox) The Infoblox DNS Threat Index, powered by IID, stood at 122 in the third quarter of 2015, with exploit kits up 75 percent from the third quarter of 2014

Security Patches, Mitigations, and Software Updates

LinkedIn Fixes Persistent XSS Vulnerability (Threatpost) Developers at LinkedIn fixed a persistent cross site scripting vulnerability in the social network this week that could have been exploited to spread a worm on the service's help forums

VMware Security Advisories VMSA-2015-0008 (VMWare) VMware product updates address information disclosure issue

Cyber Trends

Rogers: Data Manipulation, Non-State Actor Intrusions are Coming Cyber Threats (US Department of Defense) Two specific emerging challenges are among those that concern Navy Adm. Mike Rogers, commander of U.S. Cyber Command and director of the National Security Agency

And Now, A Cyber Arms Race Towards Critical Infrastructure Attacks (Dark Reading) As traditional explosives give way to 'logic bombs,' the need to protect our industrial networks and systems has never been more important

However Vast a Region, Cyber Dominates (SIGNAL) The map of Asia-Pacific challenges leads to the digital realm

4 trends in DDoS security in 2016 (CIO Australia via CSO) As more and more devices become tied into the Internet each day, the security threat will continue to expand

How fake users are impacting business through acts of fraud and theft (Help Net Security) A new report by The Ponemon Institute highlights the average economic value of a company's user base ($117M) and the financial and brand reputation damage that can be done if fraudsters are allowed to create fake accounts and wreak havoc within a business and across the Internet

Mass adoption of mobile payment services derailed by security, privacy concerns (Help Net Security) Evaluating the mobile payment preferences of 1,217 consumers from the U.S., a new Research Now survey revealed that 17 percent of respondents who did not make holiday purchases with their mobile phone last year, plan to use a payment service such as Apple Pay, Android Pay, Samsung Pay or a proprietary service from their bank or card issuer to make the leap to mobile payments this holiday season

Mobile users continue to put personal and corporate data at risk (Help Net Security) Blancco Technology Group surveyed over 1,400 mobile users in the United States, Canada, UK and Australia, and found that inadequate security precautions taken by mobile users not only put their personal information at risk, but also leave corporate data exposed and susceptible to cyber theft

Most European executives would bypass security to win business (ComputerWeekly) A survey has revealed that 69% of European executives polled would take the risk of a potential security threat to achieve the biggest deal of their life

The future of information security in the government (Help Net Security) A new report from Intel Security and the Digital Government Security Forum (DGSF) looks at the fast changing digital world, which promises to transform how our government and public services operate

Marketplace

Insurers prime targets of cyber attacks says Moody's (Business Insurance) Cyber insurance has significant growth potential, but there are also challenges to its broad expansion in the market, including the complexity and variation of its risks, while insurers themselves are prime targets of cyber attacks, says Moody's Investors Service Inc. in a report issued Thursday

Splunk Delivers Solid October Results; Introduces Robust FY17 Top-Line Outlook--Maintain Outperform (FBRFlash) Last night, Splunk reported solid F3Q16 (October) results, exceeding the Street on both the top and bottom lines

Avanan emerges from stealth with cloud-based product to secure data in enterprise SaaS apps (FierceITSecurity) Security startup Avanan emerged from stealth mode on Wednesday with the launch of a cloud-based platform

Israeli startup Secret Double Octopus 'shreds' data in order to protect it (FierceITSecurity) With a name that is sure to evoke James Bond, Israeli security startup Secret Double Octopus launched on Wednesday with the mission of securing data in transit without the need for encryption keys

PhishMe Reports 105% Year Over Year Growth for Q3 2015; Company Positioned to Close Year With Record Revenues (MarketWired) Human phishing defense provider leads market with record growth of 892 percent over the past three years

Tenable Network Security Ranked Among Fastest Growing North American Tech Companies in Deloitte’s 2015 Fast 500 (BusinessWire) Record revenue, employee growth and superior tech land Tenable a seventh straight spot on the Fast 500 list

FireEye Fastest Growing Cyber Security Company in North America on Deloitte's 2015 Technology Fast 500™ (EIN) Attributes Revenue Growth of Nearly 1,165 Percent From 2011 to 2014 to Leadership in Security Technology, Incident Response and Threat Intelligence

Cybersecurity company CyberArk Software expects continuing strong sales growth (South China Morning Post) The Israeli cyber-security company says the sharp decline of its New York-listed shares is out of synch with its sales and market outlook

Five AIM shares to fight cyber war (Interactive Investor) Stories of hacking and distributed denial of service (DDoS) attacks on websites are becoming increasingly common

Cisco building army of niche security channels: Diwakar Dayal (Channel World) The most profitable partners sell security and other portfolio (networking) from Cisco, says Diwakar Dayal, APJC Security Channel Leader, Cisco

Air Force Adds 10 Firms to Potential $5B Cyber, Info Systems Support IDIQ (GovConWire) The U.S. Air Force has selected an additional 10 companies to vie for task orders to research, develop and test cybersecurity and information system management tools under a potential five-year, $5 billion contract

How Are US Armed Forces Closing the Cyber Skills Gap? (IBM Security Intelligence) Faced with a cyber skills gap, the U.S. Navy is seeking to identify and recruit more cyber talent in its force. While the Armed Services Vocational Aptitude Battery (ASVAB) has been a staple of entry into the armed forces, the Navy is looking for ways to better assess the cyber proficiency of potential new recruits

Nominations Open for Women in Security Awards 2016 (MarketWired) Recognizing the contributors transforming the security industry

Products, Services, and Solutions

Secure version of network time protocol now in beta (FierceITSecurity) The network time protocol is one of the oldest protocols on the Internet and was designed for the purpose of synchronizing time between computer systems over unreliable networks

VirusTotal Adds Sandbox Execution for OS X Apps (Threatpost) Mac malware is a thing. It's real. Granted it hasn't reached the critical mass of malicious code for Windows, but recent encounters with WireLurker, XcodeGhost and YiSpecter among others have elevated the conversation to levels where it's been legitimized

Elcomsoft iOS Forensic Toolkit: Physical Acquisition for 64-bit Devices and iOS 9 Support (PRNewswire) ElcomSoft Co. Ltd. updates iOS Forensic Toolkit, adding physical acquisition for 64-bit Apple devices and enabling support for iOS 9 (jailbreak required)

Prevoty Provides Security at the Pace of Business — Innovation in a Fragmented Security Ecosystem to Protect Businesses’ Treasured Applications (BusinessWire) New Prevoty innovation delivers application security with increased performance in-production and expands vulnerability coverage across programming environments & databases

ThreatStream Adds Blueliv to ThreatStream Alliance Preferred Partner (APP) Store (MarketWired) ThreatStream®, the pioneer of an enterprise-class threat intelligence platform, today announced another addition to its Alliance of Preferred Partners (APP) Store

Fortinet 'secret' aces NSS Labs endpoint security test (Channel Life) Fortinet has received a recommendation — and an increased rating — in the latest NSS Lab's enterprise endpoint protection comparative report

CyberArk Launches New Industry Initiative to Promote CISO Cyber Security Expertise (CyberArk) Panel of Global 1000 cisos share advice for implementing strategic security programs, gaining stakeholder support and measuring results

Technologies, Techniques, and Standards

UK joins US financial institutions for industry resilience tests (Register) Op Resilient Shield wasn't a live test, though

Industry should steal FedRAMP cloud security baselines (C4ISR & Networks) The federal government is doing a good job establishing cybersecurity requirements for cloud providers and industry looking to do the same should look no further, according to John Pescatore, director of emerging security trends at the SANS Institute

Blackstone CISO's remediation plan: Fix everything (SC Magazine) In an environment in which cyber professionals are overwhelmed by rapidly changing security threats, industry pros generally agree that a remediation plan must involve difficult decisions about the security issues that companies are willing to accept the risk rather than take action

How CISOs and CEOs must work together (CSO) For as long as there has been security, there have been difficulties, and differences of opinion, between the CISO and CEO

SIEM is not a product, it's a process… (Internet Storm Center) This famous Bruce's quote is so true that we can re-use it to focus on specific topics like SIEM ("Security Information and Event Management")

Design and Innovation

Home IoT security could come from a glowing rock next year (IDG via CSO) Startup Dojo-Labs will show home security status through a stylish imitation stone

Tamper-proof Computing (Pipeline) Ask the vast majority of information technology professionals today if it is possible to completely secure a computing system against cybercrime and the answer you will get is a resounding "no"

Academia

How students can experience future careers in STEM (Splash ABC) The inaugural Day of STEM was launched yesterday, a national program that connects Australian students with STEM leaders in business, science and innovation

Legislation, Policy, and Regulation

Cybersecurity Lessons Learned from the 9/11 Commission Report (Network World) Organizations must move beyond misaligned goals, poor collaboration, and organizational intransigence that hamper cybersecurity efforts at enterprise organizations

Response Against Islamic State Hinges on Whether to Treat It as a State (Wall Street Journal) Western leaders divided on the question

NATO Tests Cyber-Defense Firepower to Combat Internet Terror (Bloomberg) Holed up in the Estonian city of Tartu, where the Soviet Union once housed a fleet of bombers, NATO officials are testing the alliance's ability to defend against cyber-threats by rogue states and terrorists

French Minister Warns Europe to 'Wake Up' to Militant Threat After Paris Attacks (Newsweek) French Interior Minister Bernard Cazeneuve warned on Thursday that other European countries must "wake up" to the threat of militants on the continent after the deadly Paris attacks

Russia Open to Cooperation in Fight Against ISIS: French Foreign Minister (Newsweek) Russia is open to the idea of cooperating with the U.S.-led coalition forces fighting the Islamic State militant group (ISIS), French Foreign Minister Laurent Fabius said on Thursday

White House: 'Sense of urgency' after Paris attacks (Washington Examiner) Obama administration officials said Thursday that the terrorist attacks on Paris have renewed the sense of urgency among the 65-member coalition combating the self-proclaimed Islamic State, but couldn't give any new specifics on what they are doing to stop the Sunni terrorist group

As France and Belgium Strengthen Security, a Classic Debate Arises (New York Times) Shocked by the carnage of the Paris attacks, France and Belgium moved aggressively on Thursday to strengthen the hand of their security forces, pushing Europe more deeply into a debate that has raged in the United States since Sept. 11, 2001: how to balance counterterrorism efforts and civil liberties

Policy Fight over Encryption Only Getting Started inside the Beltway; Paris Tragedy Reignites "Back Door" Debate (FBRFlash) In light of the tragic events in Paris and the terrorist investigation/manhunt, there is starting to be renewed debate around encryption and "back door" government access to consumer/enterprise data. With many signs pointing to advanced encryption messaging technology having been used in the planning of this horrific attack, there is much discussion within many circles of the technology world and government about whether law enforcement agencies should be given unencrypted access to encrypted technology and messaging

After Paris Attacks, Here's What the CIA Director Gets Wrong About Encryption (Wired) It's not surprising that in the wake of the Paris terrorist attacks last Friday, US government officials would renew their assault on encryption and revive their efforts to force companies to install backdoors in secure products and encryption software

Tech firms fight anti-encryption demands after Paris murders (Register) If the US govt wants iMessages, well, tough

US-China Security Review Commission Discusses 'Hack-Back' Laws (Dark Reading) Commission's annual report to Congress recommends a closer look at whether companies should be allowed to launch counterattacks on hackers

DISA chief: We're in 'an economic cyber cold war' (FCW) The U.S. government is fighting at least a two-front cyberwar right now, according to a top Pentagon official. The challenges involve the daily fending off of millions of attacks on defense networks and the slow burn of economic espionage carried out by adversaries

How cyber turns networks into weapons systems (Defense Systems) Information has always been power but the growing importance of the cyber domain has led U.S. military leaders to look at their information networks essentially as weapons systems. Or as Vice Adm. Jan Tighe , commander of the Navy's Cyber Command, put it recently, the branch must "operate the network as a warfighting platform"

DHS bulking up civilian agency cybersecurity (Federal News Radio) The Department of Homeland Security is embarking on an "aggressive" timetable to secure civilian networks in response to the cyber attack on the Office of Personnel Management

Federal Legislation Targets "Swatting" Hoaxes (KrebsOnSecurity) A bill introduced in the U.S. House of Representatives on Wednesday targets "swatting," an increasingly common and costly hoax in which perpetrators spoof a communication to authorities about a hostage situation or other violent crime in progress in the hopes of tricking police into responding at a particular address with deadly force

Government should ensure security, privacy but not overregulate IoT, says report (FierceGovernmentIT) A new report recommends the federal government take several actions as it navigates the Internet of Things, such as ensuring privacy and security protections are in place without imposing regulations that would hinder innovation

State insurance commissioners link with feds to battle cyber threats (Business Insurance) State insurance commissioners are engaging with U.S. federal legislators to counter the evolving cyber threat, but do not want adoption of national legislation or regulations that would pre-empt their authority, according to the head of the National Association of Insurance Commissioners

FTC amends telemarketing rule to ban payment methods used by scammers (Help Net Security) The Federal Trade Commission has approved final amendments to its Telemarketing Sales Rule (TSR), including a change that will help protect consumers from fraud by prohibiting four discrete types of payment methods favored by scammer

Alan Lynn: DISA Eyes 'Identity Assurance' Cyber Partnership With Industry (ExecutiveGov) Army Lt. Gen. Alan Lynn, director of the Defense Information Systems Agency, has said DISA works to achieve "100 percent identity assurance" with its contractors in an effort to safeguard data infrastructures from cyber threats, C4ISR & Networks reported Wednesday

Litigation, Investigation, and Law Enforcement

EU clamps down on bitcoin, anonymous payments to curb terrorism funding (Reuters) European Union countries plan a crackdown on virtual currencies and anonymous payments made online and via pre-paid cards in a bid to tackle terrorism financing after the Paris attacks, a draft document seen by Reuters said

Three Ways ISIS Gets Its Money (Defense One) "It seems to me … that terrorist groups will do anything for money"

Europol Director: Europe Faces Its 'Most Serious' Threat (Defense News) The director of Europol, the EU-wide police agency, has admitted that Europe faces its "most serious" terrorist threat in many years

Islamic State presence in the U.S. is 'the new normal,' FBI director says (Los Angeles Times) When a Brooklyn man pleaded guilty to plotting to join Islamic State and to bomb Coney Island, it drew little attention outside of New York City despite the spectacular image his confession conjured of a fiery blast ripping through a seaside amusement park

The strange case of 77 blue-collar Chinese migrants that Kenya is calling “cyber-hackers” (Quartz) Most of what Luo Songxu knew of Africa when he moved there last year came from a 1991 rock ballad by a Hong Kong pop star, Wong Ka Kui. It was called "Amani," or "peace" in Kiswahili

Second law firm considers group action against TalkTalk for cyber-attack (Guardian) Cardiff-based Hugh James says it is in touch with customers affected by data breach and is investigating potential for group claim

Cybersecurity Class Actions Remain a Concern (Legaltech News) 'Cybersecurity issues are the last place we should want to see class actions proliferate,' attorney Amar Sarwal says

DDoS And The Internet's Liability Problem (Dark Reading) It's past time for an improved liability model to disrupt DDoS

University implies they helped FBI break Tor protection because of a subpoena (Help Net Security) Carnegie Mellon University has finally issued a statement commenting on the recent accusations that their researchers have aided the FBI to unmask a subset of Tor users believed to be involved in criminal activities on the dark web

eBay scammer steals identity of agent investigating him (Naked Security) He had the eBay/PayPal/parcel insurance scam chugging away, with dozens of accounts set up to file claims on packages

Cybercrime: Teen Explains The Lure Of Hacking (Sky News) A teenager tells Sky News how he became a hacker and says easy-to-use hacking tools are readily available online

U.S. To Release Israeli Spy Jonathan Pollard From Prison (Newsweek) Jonathan Pollard, the American citizen convicted of spying on behalf of Israel, is to be released from a U.S. prison on Friday after 30 years of incarceration

For a complete running list of events, please visit the Event Tracker.

Newly Noted Events

Cyber Security Breakdown: Chicago (Chicago, Illinois, USA, Jan 12, 2016) This half day session will provide you with the critical information you need to start formulating an effective response in the eventuality of a cyber security event. Rather than try and handle the breach during the chaos of the event, you'll understand how to build in advance, the best practices to respond effectively. Attend the Cyber Security Breakdown event that is focused on the unique issues and threats facing legal professionals

Cyber Security Breakdown: Dallas (Dallas, Texas, USA, Feb 10, 2016) This half day session will provide you with the critical information you need to start formulating an effective response in the eventuality of a cyber security event. Rather than try and handle the breach during the chaos of the event, you'll understand how to build in advance, the best practices to respond effectively. Attend the Cyber Security Breakdown event that is focused on the unique issues and threats facing legal professionals

Upcoming Events

Internet-of-Things World Forum 2015 (London, England, UK, Nov 18 - 19, 2015) This conference features speakers from leading IoT companies and their customers. Learn how the Internet-of-Things is creating new markets for products, services, and solutions

2015 U.S. Cyber Crime Conference (National Harbor, Maryland, USA, Nov 14, 2015) The 2015 U.S. Cyber Crime Conference (Formerly the DoD Cyber Crime Conference) has brought world-class forensics and incident response training combined with outstanding community networking for over 15 years. The conference covers the full spectrum of topics facing defenders as well as law enforcement responders

CyberPoint 2nd Annual Women in Cyber Security Reception (Baltimore, Maryland, USA, Nov 19, 2015) CyberPoint International announces its 2nd Annual Women in Cyber Security Reception to be held on November 19, 2015. Bringing together women from across the region and all different points on the career spectrum, this event is a great opportunity to get together and share what we are all passionate about — empowering women to succeed in the cyber security field

Pen Test Hackfest Summit & Training (Alexandria, Virgina, USA, Nov 16 - 23, 2015) SANS Pen Test Hackfest Training Event and Summit is coming back to Washington DC, bigger and better than ever! The Hackfest is an ideal way to learn offensive techniques so you can better defend your environment. Whether you are a penetration tester, a forensics specialist, or defender, the techniques covered at the Hackfest represent the latest and most powerful attacks every organization needs to thwart

Energy Tech 2015 (Cleveland, Ohio, USA, Nov 30 - Dec 2, 2015) Now in its 5th year, EnergyTech 2015 seeks the convergence of the best minds in policy, systems engineering and applied technology to address some of the critical issues of our time. In addition to its strong systems and technology focus, this year's theme, "Securing Our Energy Future" will address broad policy issues and big picture topics related to Energy and Critical Infrastructure. Experts from Industry, Academia, and Government present a wide range of perspectives on these challenges

cybergamut Technical Tuesday: It's a Target Rich Environment: Understanding the IIoT Attack Surface (Elkridge, Maryland, USA, Dec 1, 2015) The Internet of Things (IoT) has received an incredible amount of press as of late. But, most of that has been associated with consumer electronics in the form of wearables and home monitoring devices like the Nest Thermostat. While those are worthwhile markets, the majority of the money will be involved with machine-to-machine communications in the Industrial Internet of Things (IIoT). What is the nature of the IIoT? How is it different from the consumer IoT? And, what makes it such a big target? In this session, Mike Anderson of The PTR Group will discuss the flow of data from the edge devices to the cloud and why the big industry players like Intel, IBM and others are so interested in this market

IoT Security Foundation Conference (London, England, UK, Dec 1, 2015) The is the first official conference of IoTSF. It follows on from the IoT Security Summit earlier in the year, maintaining the momentum of the theme. Delegates can expect a similar level of quality of talks as we move from illustrating problems to exploring solutions

Public Sector Cybersecurity Summit 2015 (Reston, Virginia, USA, Dec 1 - 2, 2015) The Raytheon|Websense 6th Annual Public Sector Cybersecurity Summit is a unique opportunity to learn about the state of cybersecurity and how to prepare for future threats from many thought provoking government and industry leaders across Defense, Intelligence, Federal, Civilian, State and Local Government, Industry and the broader Cybersecurity Community

Enterprise Security and Risk Management (London, England, UK, Dec 2, 2015) Whitehall Media's 4th ESRM conference will bring together hundreds of leading InfoSec, cyber security and risk management professionals to discuss the latest industry developments and identify the most pressing security risks of tomorrow. The event offers unrivalled networking opportunities and insights on how to design, implement and embed

Cargo Logistics America (San Diego, California, USA, Dec 2 - 3, 2015) Cargo Logistics America (CLA) connects freight owners with freight movers, fostering multimodal synergy between diverse stakeholders in import, export and domestic supply chains. This year's conference will have a heavy cyber security component

NG Security Summit US (Austin, Texas, USA, Dec 2 - 4, 2015) The NG Security Summit US will bring together 65 senior decision makers and business leaders from across the region. The event aims to solve key business challenges. In particular, the ability to network and learn from industry peers through essential business conversation. Working in partnership with our network of senior executives we identify the key industry themes. These form the foundation of our summit and permeate every layer of the content-rich program. These three core themes represent the business critical challenges driving your conversations at the summit: (1) Governance, Risk and Compliance, (2) Processes and Technology, and (3) Identity and Access Management

Cyber Security Opportunities for U.S. Firms in Japan, S. Korea, and Taiwan (Online, Dec 2, 2015) Listen to experts from Japan, S. Korea and Taiwan and learn how to position your company for success in these countries. Sponsored by the US Department of Commerce

Program on Cyber Security Studies (PCSS) (Garmisch-Partenkirchen, Germany, Dec 2 - 17, 2015) The Marshall Center has developed a comprehensive program to explore the increasing domestic, international and transnational challenges in cyber security. Our goal is to provide a comprehensive, policy-focused, non-technical cyber security program that emphasizes and teaches senior key leaders how to best make informed decisions on cyber policy, strategy and planning within the framework of whole-of-government cooperation and approaches

Cyber Security Breakdown: Washington DC (Washington, DC, USA, Dec 3, 2015) This half day session will provide you with the critical information you need to start formulating an effective response in the eventuality of a cyber security event. Rather than try and handle the breach during the chaos of the event, you'll understand how to build in advance, the best practices to respond effectively. Attend the Cyber Security Breakdown event that is focused on the unique issues and threats facing legal professionals

Cloud Security Alliance Summit Los Angeles 2015 (Los Angeles, California, USA, Dec 3, 2015) The full day Cloud Security Alliance LA Summit is a standalone event in the greater Los Angeles area. Hosted by the CSA LA/SoCal chapter, some 200 well-qualified attendees are expected. The theme is "Enterprise Lessons Learned in Cloud Security," with experts from entertainment and other key industries. Wendy Frank, Chief Security Officer and Leader Content Security Program at Motion Picture Association of America, will deliver the keynote address

2015 Cyber Security Exchange (Orlando, Florida, USA, Dec 6 - 8, 2015) This dynamic, three-day event will provide Cyber Security executives with valuable insights to reach their full potential by exploring security leadership strategies, heightened data privacy concerns, the ever-changing advanced threat landscape, efficient identity access management and more

Disrupt London 2015 (London, England, UK, Dec 7 - 8, 2015) TechCrunch Disrupt is one of the most anticipated technology conferences of the year. Join us at this iconic startup and thought leadership event in London on December 7 and 8. What happens at Disrupt? We start each day with panels and one-on-one discussions featuring TechCrunch writers and editors, special guest speakers, leading venture capitalists and fascinating entrepreneurs addressing the most important topics facing today's tech landscape. Each afternoon, we host the Startup Battlefield competition which culminates in six finalists taking the stage at the end of the event for a shot at winning the Disrupt Cup

Passwords 2015 (University of Cambridge, England, UK, Dec 7 - 9, 2015) More than half a billion user passwords have been compromised over the last five years, including breaches at internet companies such as Target, Adobe, Heartland, Forbes, LinkedIn, Yahoo, and LivingSocial. Yet passwords, PIN codes, and similar remain the most prevalent method of personal authentication. Clearly, we have a systemic problem. This conference gathers researchers, password crackers, and enthusiastic experts from around the globe, aiming to better understand the challenges surrounding the methods personal authentication and passwords, and how to adequately solve these problems. The Passwords conference series seek to provide a friendly environment for participants with plenty opportunity to communicate with the speakers before, during, and after their presentations

ACSAC (Annual Computer Security Applications Conference) (Los Angeles, California, USA, Dec 7 - 11, 2015) ACSAC is one of the most important cyber security conferences in the world, and the oldest information security conference held annually. Researchers, government representatives, academia and security professionals of all types gather at ACSAC to discuss the latest developments in the infosec industry. The core mission of this conference is investigating practical solutions for computer security technology. This year's edition will especially focus on security and privacy in the Internet of Things era

NSA RCTCON (Fort Meade, Maryland, USA, Dec 9, 2015) The NSA RCTCON industry exposition will be attended by 250-300 IC (Intelligence Community) cyber personnel working on solutions to the current cyber threats that face the U.S

SANS Institute: Information Security Training (Las Vegas, Nevada, USA, Sep 12 - 21, 2015) Information security training in Las Vegas from SANS Institute, the global leader in information security training. At SANS Network Security 2015, SANS offers more than 40 hands-on, immersion-style security training courses taught by real-world practitioners. The site of SANS Network Security 2015, September 12 - 21, is Caesars Palace, the majestic Las Vegas hotel

cyberSecure (New York, New York, USA, Dec 15 - 16, 2015) Today's business leaders recognize that a multi-disciplinary approach is critical to protecting the bottom line. What's too often missed is a vision that incorporates best practices that allow you add value to your company and shareholders DURING and POST breach. Enter ALM cyberSecure. A unique professional event providing an all-encompassing view and the relationships necessary to protect enterprises during all phases, across all departments while keeping revenue on track