The CyberWire Daily Briefing 02.20.15
news from the Center for National Policy
The Christian Science Monitor continued its Passcode cyber section launch yesterday with a conference organized by the Center for National Policy: "Cyber Framework and Critical Infrastructure: A Look Back at Year One."
Transforming Overwhelming Data to Actionable Inteligence. Andrew Borene of IBM i2 opened the morning's session. Advocating proactive disruption of cyber attacks, he listed familiar reasons for cyber's pervasive importance. He quoted a Center for Strategic and International Studies estimate of $500B lost to cybercrime annually, and reviewed (again, familiar) accounts of the difficulty of staying ahead of rapidly evolving threats. He concluded that the United States has reached an inflection point with respect to cyber security, and that collaborative public-private action to defend data and networks will become the new norm. He praised last week's formation of the Cyber Threat Intelligence Integration Center (CTIIC) as the focal point for cyber information sharing. He concluded by outlining IBM's view that the coming era of proactive cyber defense will need analytical tools that can deliver insight from big, disparate data sets, connecting seemingly unrelated entities.
Cybersecurity, Critical Infrastructure, and Information Sharing: a View from the Department of Homeland Security. Dr. Phyllis Schneck, Deputy Under Secretary for Cybersecurity and Communications, Department of Homeland Security, put last week's Executive Order into context. It is, she said, the culmination of a lot of Government work over the past two years. The NIST Framework and the progress made toward voluntary adoption of security best practices are successes. Asked about incentives for adopting the Framework, she offered "fear" as one of them — fear, that is, of what a breach could do to an enterprise, not fear of law enforcement. Other incentives moving businesses toward adopting the Framework comes from the still new but rapidly maturing insurance market. She expected legislation fostering targeted cyber liability protection to be very important.
There are, she noted, eighteen different critical infrastructure sectors, each with its distinctive business models, cultures, and needs. The financial sector evolved information sharing early, and has clearly benefited from it. The Department of Homeland Security's National Cybersecurity and Communications Integration Center (NCCIC) is uniquely well-placed to spread cyber information sharing to other sectors, collecting and distributing indicators of threat. The NCCIC delivers in effect a cyber weather map. It is also fostering a common language in which threat information can be shared.
The new CTIIC is an intelligence activity. It will work on the government side, and touch the private sector by providing shareable context to NCCIC. She concluded on a glass-half-full note. As the threats we see grow more sophisticated, we can take this as a sign that the community is doing a good job: "That means we've wiped out some of the bottom feeders."
Information Sharing: Who, What, and Why. The morning's discussions finished with a conversation between the SANS Institute's John Pescatore and Harley Geiger of the Center for Democracy and Technology. Pescatore commented that information sharing legislation is a perennial topic, but too much is made of it. We've shared informaiton for years. The real issue isn't just sharing threat intelligence — the first thing most people think of — but rather sharing effective defense and response tactics. Such lessons learned would be valuable, and considerably more valuable than sharing signatures or threat intelligence. The Government should avail itself of marketing mechanisms to help drive security in the private sector: FedRAMP has done so for the cloud.
Geiger continued with the observation that cyber information sharing is valuable, but not a complete solution. Digital hygiene is at least as important practice, as are other emerging best practices and standards of care. Insofar as the Government does share cyber information, the Center for Democracy and Technology thinks that a military agency like NSA is not the appropriate lead organization. Sharing belongs in the Department of Homeland Security.
There are, Geiger argued, many legislative provisions now in force that permit information sharing. Where new legislation might help would be in removing obstacles in the way of business-to-business information sharing. The Administration's proposals don't incentivize this. We also want to avoid information sharing "becoming a giant backdoor wiretap for law enforcement." In any form of information sharing, promised privacy protections — yet to be developed — will be vital.
Geiger and Pescatore agreed that information sharing shouldn't be government-centric, but believed they saw signs that legislation was shaping up to make it so.
Pesacator concluded with remarks on the future of cyber security in the private sector. "We're evolving toward an effective understanding of what's an acceptable cyber loss." A major retailer like Target loses some $2B annually to "shrinkage" — shoplifting and employee pilferage — and it plans and budgets for such shrinkage as a foreseeable cost of doing business. Yet Target's much-discussed cyber losses last year were an order of magnitude smaller than the shrinkage it experienced. Many kinds of cyber risks might be assessed and managed in terms of foreseeable loss. Pescatore finished with a call to shift attention away from over-emphasized threat intelligence and toward effective, timely sharing of lessons learned.
Reports suggest that, as foreign diplomatic missions in Yemen decamp, some may have abandoned sensitive information, which lends additional interest to stories on "visual hacking" — that is, seeing stuff left lying around.
Cyber rioting appears in another corner of the former Soviet empire, this time in Azerbaijan, where allegations of Armenian hacktivism surface.
Lenovo attracts general odium for pre-installing Superfish adware in its machines, thereby allegedly exposing users to man-in-the-middle attacks and other threats. Lenovo says it thinks Superfish represents no real security issue, but out of sensitivity to its customers' legitimate security concerns, the company will at once stop shipping products with the feature installed. Several experts offer advice on how to detect and remove the adware.
Newly discovered Android malware is said to be able to spy on users even after their phones are (apparently but not really) shut down.
An Australian security researcher demonstrates a proof-of-concept Android credit-card-cloning app.
New Snowden documents appear to show a 2010 GCHQ/NSA operation that compromised SIM cards.
Canadian Bitcoin exchange Cavirtex is compromised by hackers and suspends operations.
A variety of Microsoft patch news is out, including an increase in Windows XP afterlife support costs.
Intel Security urges all not to declare digital bankruptcy — that is, to decide their personal data is valueless. (AT&T, for one, thinks its customers' personal data are worth $29 per month.)
JPMorgan beefs up its in-house cyber security team. Cyber security startups continue to surge, and the cyber labor shortage surges with them.
Notes.
Today's issue includes events affecting Armenia, Australia, Azerbaijan, Canada, China, Iraq, Netherlands, Russia, Syria, United Kingdom, United States, and and Yemen.
Washington, DC: the latest from the Center for National Policy and Passcode
DHS official: Hackers will 'stop dancing in the streets' once companies share more threat info (Christian Science Monitor via Yahoo! News) Security and privacy experts, however, have concerns about the private sector sharing information with the government. Clips from the Passcode and Center for National Policy event on Thursday
Happy Birthday to NIST's Cybersecurity Framework (SIGNAL) The U.S. government-backed cybersecurity framework for the nation's federal agencies and critical infrastructure sector — released one year ago today — has received a general thumbs up of approval from industry experts
Intel panel poised to release new cyber bill (The Hill) The Senate Intelligence Committee is expected to introduce legislation next week that would help the public and private sectors share information about cyber threats, sources tell The Hill
Cyber Attacks, Threats, and Vulnerabilities
Emails reveal sensitive info left exposed after US pullout from Yemen (Fox News) Internal State Department emails reviewed by Fox News reveal that as security unraveled in Yemen, U.S. personnel were scrambling to finalize their exit plan and were so uncertain about what would happen that procedures for safeguarding sensitive information were bypassed — with permission from Washington
Low tech 'visual hacking' successful nine times out of ten (CSO) Researchers were able to get sensitive corporate information just by looking around
Barbarians at — damn, make that INSIDE — the Gate (Electronic Engineering Journal) Beyond computer viruses and worms, prepare for Advanced Persistent Threats
ASALA commits cyber attack on AIDA (Azernews) Armenian terror organization ASALA conducted a cyber-attack on a website of Azerbaijan's international agency
Lenovo chooses ad revenue over customer security by preloading adware (updated with response from Lenovo) (WinBeta) Adware called Superfish comes preinstalled on new Lenovo machines
Superfish: A History Of Malware Complaints And International Surveillance (Forbes) Superfish, a little-known "visual search" and ad tech provider from Palo Alto whose CEO was once part of the surveillance industrial complex, is about to learn what it feels like to face the unwavering wrath of the privacy and security industries. Lenovo will take much of the blame for potentially placing users at risk by contracting Superfish to effectively carry out man-in-the-middle attacks on users to intercept their traffic just to get the firm's "visual" ads up during customers' web searches
How Lenovo's Superfish 'Malware' Works And What You Can Do To Kill It (Forbes) Lenovo might have made one of the biggest mistakes in its history. By pre-installing software called 'Superfish' to get ads on screens it's peeved the entire privacy community, which has been aghast this morning on Twitter. There are serious security concerns about Lenovo's move too as attackers could take Superfish and use it to ensnare some unwitting web users
FAQ: How to find and remove Superfish from your Lenovo laptop (CSO) Lenovo pre-installed dangerous software, here's how to remove it
Android malware spies on you even after phone is shut down (Mashable) A particularly devious new Android malware can make calls or take photos even if you shut the device down, according to security research firm AVG
Evil CSS injection bug warning: Don't let hackers cross paths with your website (Register) Say hello to a fascinating vulnerability in web scripts
Researchers Reveal More Details of iOS Masque Attacks (SecurityWeek) Researchers at FireEye revealed more information about how attackers can compromise iOS devices
See How This Android App Clones Contactless Credit Cards In Seconds (Forbes) Australian security researcher Peter Fillmore has a history of card cloning. In October last year, Fillmore showed how he could clone Visa and MasterCard payment cards with an Android app running on a Google Nexus 4. He successfully shopped with it, buying some beers in a Sydney pub and a Snickers bar from a supermarket
SIM card makers hacked by NSA and GCHQ leaving cell networks wide open (Ars Technica) New Snowden docs show that in 2010, SIM makers lost control of their encryption keys
Hackin' At The Car Wash, Yeah (Dark Reading) Drive-through car washes can be hacked via the Internet, to wreak physical damage or to get a free wash for your ride
Canadian bitcoin exchange Cavirtex closes following data breach (FierceITSecurity) In the world of Bitcoin exchanges, the constant threat of cyberattacks and data leaks can weigh heavy on the mind, more so if an exchange has been successfully hacked
Hey, does anyone know if Dilbert has upset Kim Jong Un recently? (Graham Cluley) No, I'm not serious. I don't really think that North Korea has a grudge against Dilbert. But it's clear that someone isn't a fan of the long-running Scott Adams cartoon strip, whose website has recently suffered a DDoS (distributed denial-of-service) attack
Jamie Oliver website "safe to use" after serving malware (ComputerWeekly) Celebrity chef Jamie Oliver's website has been declared "safe to use" after hackers compromised it and used it to serve up malware that could take control of visitors' computers
Officials: Cyber heist didn't hit US (The Hill) No American banks were affected by a worldwide cyber ring that reportedly stole up to $1 billion from banks in 30 countries, U.S. officials and banking executives say
UMaine professor whose laptop was stolen violated university’s data policy (Office of Inadequate Security) Noel K. Gallagher provides additional details on a U. of Maine breach reported earlier this week
Intel Security warns of six social engineering techniques targeting businesses (ComputerWeekly) Cyber security training and policy management is imperative for businesses, according to the Hacking the Human OS report by Intel Security
Security Patches, Mitigations, and Software Updates
Microsoft surreptitiously reissues KB 3013455 for Vista, Windows Server 2003 (InfoWorld) The lack of documentation leaves users to guess what the Windows patch does and how to install it
Microsoft Adds 4 Security Measures to Office 365 (CMS Wire) Microsoft has added four security measures to Office 365 to help businesses keep their data secure. Two of the measures are focused on compliance and the other two offer better identity protection
Microsoft Boosts Outlook Security For iOS And Android (TechWeek Europe) First update for Outlook mobile app adds passcode, encryption and remote app wipe features
Microsoft to double price of XP's post-retirement support (Computerworld) Renewals of custom support agreements will boost price to $400 for each Windows XP PC
Why Apple and Microsoft are Upset About Google's 'Project Zero' (TechVibes) It's called Project Zero. Sounds like a new sci-fi pic or a top secret government project, doesn't it? Nope, this Project Zero is a new initiative from Google, and rival companies Apple and Microsoft are wishing it would be kept as secretive as Area 51
Cyber Trends
Good tech, bad tech (Economist) Why people need to wise up about what smart criminals are working on
Cyber Attacks: Not Just a Problem for Governments and Giant Companies Anymore (Inc.) The latest report from National Small Business Association shows increasing small business optimism, but an alarming trend emerges related to cyber attacks
End Users Causing Bulk Of Infosec Headaches (Dark Reading) Report shows 80 percent of IT pros blame users for their security woes
Organizations Looking to Invest in Endpoint Security to Improve Incident Response, Detection (SecurityWeek) A new survey by Enterprise Strategy Group found that improving incident response and detection are driving plans to invest in endpoint security technologies in 2015
Many IT Pros Ignore Security Policy in Order to Do Their Jobs: Survey (SecurityWeek) Just like clouds can hide sunshine, they can also hide user activity from the security controls deployed by the business in the world of IT
The BYOD ethos is a corporate cyber attack waiting to happen (Electroblog) BYOD workers may save companies a lot of money by reducing IT hardware expenditure, but it could cost corporations dear in cyber attacks. Most of us today are BYOD (Bring Your Own Device) workers. That is people who use their own computers and smart phones in the workplace. The problem is it raises a multitude of Internet security questions and potentially creates some serious risks
After high-profile hacks, many companies still nonchalant about cybersecurity (Christian Science Monitor Passcode) Multiple surveys, including one recently released by defense contractor Raytheon found that the attention paid to large breaches at corporations such as Sony and Anthem hasn't significantly changed attitudes about information security
Declaring personal data bankruptcy and the cost of privacy (Help Net Security) In the digital economy, your data profile has value, but judging from what I watched happen recently in a London shopping mall, a lot of us give it away for free
Marketplace
JPMorgan Goes to War (Bloomberg) The bank is building a new facility near the NSA's headquarters to attract new talent
Lockheed's HR chief on the battle for cyber talent: 'We're fighting every day to keep them' (Washington Business Journal) You know cybersecurity skills are scarce when even the biggest defense contractor on the globe needs to fight for them
Are We Experiencing a Cybersecurity Bubble? Mach37 Head Weighs In (DCInno) In recent months — maybe more so than ever before in history — the prevalence and threat of cybercriminals has become apparent. Detrimental example after example has illustrated the growing need for top level cybersecurity professionals. As a result, cultivating this talent has become a major business avenue of interest. In Washington, D.C., the area's highly competitive cybersecurity ecosystem is causing a predatory skirmish between budding franchise giants and their startup counterparts
Options traders bet on growing U.S. demand for cyber security (Reuters) A barrage of damaging cyber attacks has shaken up the security industry, and traders in the options market are betting on cyber security companies benefiting from increased spending as governments and businesses boost security
The Kaspersky equation (Economist) A Russian antivirus firm impresses the sceptics, again
Fighting Fire With FireEye (Seeking Alpha) FEYE suffered a dramatic share price decline in 2014 due to irrational valuations and mismanaged expectations for revenue growth following the acquisition of Mandiant in 2014. The poor performance of shares in 2014 does not reflect solid full year 2014 results and execution by management. FEYE's leadership over competitors in advanced threat detection/prevention and incident response forensics is underestimated. The introduction of Fireeye as a Service, new product appliances/subscriptions, and infrastructure investments to expand internationally are potential catalysts for upside to conservative 2015 revenue/billings guidance. FEYE deserves a premium valuation for its leadership position in the fastest growing segments of the security industry
Cyberark Software Ltd (CYBR) Bulls Think There's More Fuel in the Tank (Schaeffer's Options Center) Cyberark Software Ltd (CYBR) hit its highest perch on record earlier
How small cyber-security company has reaped the benefit of the Sony effect (Business Technology) Even the most bullish analysts were blown away by CyberArk Software's earnings last week
Pindrop Security raises $35M, plans to add 100 jobs (Atlanta Business Chronicle) Pindrop Security recently raised $35 million in venture capital as it gears up for global expansion, Atlanta Business Chronicle has learned
SolarWinds Eyes Federal Business Expansion with New Herndon Office (ExecutiveBiz) SolarWinds has opened a new Herndon, Virginia-based office with the intent to expand the software company's federal business operations in the Washington metropolitan area
Kathy Warden, Northrop Info Systems President, Chosen to Wash100 for Cyber and Homeland Security Leadership (GovConExec) Executive Mosaic is honored to introduce Kathy Warden, a corporate vice president at Northrop Grumman and president of its information systems business segment, as the newest inductee into the Wash100 — a group of influential leaders in the government contracting arena
Amit Yoran, RSA President, Inducted Into Wash100 for Tech Development Leadership (GovConExec) Executive Mosaic is honored to introduce Amit Yoran, president of EMC's security division RSA, as the newest inductee into the Wash100 — a group of influential leaders in the government contracting arena
Angie Messer, Booz Allen Named to Wash100 for Digital Services Leadership (GovConWire) Angie Messer, executive vice president for the predictive intelligence business at Booz Allen Hamilton's strategic innovation group, has made it to the Wash100 list of the most influential leaders in GovCon for her leadership role in digital services
HyTrust Brings Aboard Security Industry Veteran Rudy Cifolelli as New Senior Vice President for Sales (Business Wire) HyTrust Inc., the Cloud Security Automation Company, today announced that Rudolfo (Rudy) Cifolelli has joined the company as senior vice president of sales
Products, Services, and Solutions
Intercede service enables developers to load apps on TEE-embedded Android devices (Biometric Update) Intercede announced it launched MyTAM, a full hosted cloud service that enables app developers to load apps, such as biometric solutions, directly onto the trusted execution environment (TEE) in Android devices
AT&T: Pay more if you don't want to share data for personalized ads (Help Net Security) If you are a customer of AT&T's GigaPower fiber-optic Internet access service and you don't want to see personalized ads based on your browsing history, searched terms and clicked links, you'll have to shell out nearly $30 more for the service than those who do
Technologies, Techniques, and Standards
TrueCrypt Audit Stirs Back to Life (Threatpost) The stagnant TrueCrypt audit stirred to life in the last 24 hours with the announcement that the second phase of the audit, tasked with examining the cryptography behind the open source disk encryption software, will begin shortly
6 steps for effective rights management (Help Net Security) Significant data breaches in both government and industry are in the headlines at an unrelenting pace. Some of these breaches are enormous in scale and impact, and all have the potential to damage consumer trust. Why are so many of these breaches disastrous?
Risk Assessments: What You Need to Know (eSecurity Planet) Why are information security risk assessments so important, and how can you make sure you get an effective assessment?
$1 billion bank hack: stopping the next cyber heist (New Scientist) A hacking gang is suspected of stealing vast sums from banks worldwide for two years with apparent ease. How can a repeat be averted?
Five Questions The Financial Industry Should Be Asking About Security (Webroot Threat Blog) As the mobile market continues to skyrocket and gain new users, financial industries are finding it increasingly more difficult to protect their customers against online fraud
Preventing indigestion from ingesting cyber data (Federal Times) Remember the last time that you went to an all-you-can-eat buffet and had a difficult time determining which food group to start with? (I often ask myself, should I start with a salad or head straight to the good stuff?) And do you remember that overstuffed feeling you had once you finished overeating and waddled your way out of the restaurant?
MSPs Can Help Thwart Shadow Cloud Threats (Midsize Insider) The use of unauthorized cloud applications, best known as the "shadow cloud," within in the workplace is a growing trend that most IT departments would like to see evaporate. Shadow cloud threats are an emerging risk to networks and data because they slip under the IT staff's radar; after all, IT can't put in security measures for applications they don't realize are being used
Threat Intelligence in an Active Cyber Defense (Part 1) (Recorded Future) Many organizations have bought into the idea of cyber threat intelligence but two questions tend to dominate the discussion: How do you use threat intelligence and when is an organization ready to use it? There are multiple answers to these questions but this two-part article offers an answer in the context of an active cyber defense
Design and Innovation
Darkleaks: An online black market for selling secrets (Help Net Security) Whistleblowers and those individuals that are simply out to make a buck out of any confidential and valuable information, can now offer it for sale on Darkleaks, a decentralized, anonymous black market on the Internet
Research and Development
Facebook AI Director Yann LeCun on His Quest to Unleash Deep Learning and Make Machines Smarter (Quartz) Artificial intelligence has gone through some dismal periods, which those in the field gloomily refer to as "AI winters"
Legislation, Policy, and Regulation
FSB Chief: Intel Sharing With U.S. On IS Group 'Quite Possible' (Radio Free Europe/Radio Liberty) Intelligence sharing between Russia and the United States regarding the Islamic State (IS) group is "quite possible," the head of the Russian Federal Security Service (FSB), Aleksandr Bortnikov, has said
Vladimir Putin's spy army targets Australia (The Australian) Russian President Vladimir Putin has increased Moscow's spy operations against Australia, boosting his country's espionage to levels not seen since the Cold War
Why The USA Hacks (Dark Reading) The U.S. government views cyberspace as just another theater of war akin to air, land and sea, and it operates in the domain for one basic reason: national defense
America's Eroding Antiterror Intelligence (Wall Street Journal) Thanks to Snowden and other self-imposed harm, we know less about the enemy than at any time since 9/11
Guest Post: The White House Cyber Summit Was Great, But Questions Remain (Council on Foreign Relations) Last Friday, the White House held its "Summit on Cybersecurity and Consumer Protection" on the campus of Stanford University in Palo Alto, California
Five Key Cybercrime and Cybersecurity Issues To Consider (National Law Journal) On Jan. 20, during his State of the Union Address, President Barack Obama highlighted the need to enact cybersecurity legislation in the near term
Our Governments Are Making Us More Vulnerable (Dark Reading) Stuxnet opened Pandora's box and today state-sponsored cyber security policies continue to put us at risk. Here are three reasons why
Draft of Senate Cyber Bill Tackles Retaliation Rules (Wall Street Journal) Measure would make it harder for cyberattack victims to retaliate with attacks of their own
Net neutrality campaigning comes down to the wire (FierceCIO) With a week to go until the Federal Communications Commission votes on the issue of net neutrality, both sides in the debate are making their last minute pushes to influence commission members
Private and public sectors are companions in bold new IoT future (FierceMobileIT) With reports estimating the number of devices connected to the Internet of Things at 25 billion to 50 billion by the year 2020, we're well on our way to an always-connected world
White House names DJ Patil as first US chief data scientist (FierceGovernmentIT) The White House on Feb. 18 named D.J. Patil as chief data scientist and deputy chief technology officer
Federal lead to 'kill the password,' NSTIC's Jeremy Grant resigning with 'mixed feelings' (FierceGovernmentIT) Jeremy Grant, a senior official with the National Institute of Standards and Technology who's been leading the White House's crusade to "kill the password" and improve digital identity management, is stepping down, the agency confirmed Feb. 19
Lt. Gen. Vincent Stewart, DIA Director, Inducted Into Wash100 for Military Intell Leadership (GovConExec) Executive Mosaic is honored to introduce U.S. Marine Corps Lt. Gen. Vincent Stewart, director of the Defense Intelligence Agency, as the newest inductee into the Wash100 — a group of influential leaders in the government contracting arena
Litigation, Investigation, and Law Enforcement
From Russia with love: monopoly tsar investigates Google (Silicon Republic) Google is facing a new anti-trust onslaught, this time from Russia's Anti-Monopoly Service at the behest of Russia's biggest search engine Yandex
Bitcoin funded terror attack foiled by Merseyside Police as man tries to buy ricin via dark web (LeapRate) Terror suspect Mohammed Ammer Ali attempted to purchase ricin, a deadly poison and illegal chemical weapon, from overseas via the dark web, using Bitcoins
For a complete running list of events, please visit the Event Tracker.
Newly Noted Events
Kansas City Secure World (Kansas City, Missouri, USA, Apr 1, 2015) Join your fellow security professional for affordable, high-quality cybersecurity training and education at a regional conference near you. Earn CPE credits while learning from nationally recognized industry experts on many diverse topics such as: Risk Mitigation, Malware Detection, Digital Forensics, Cloud Security, Privacy, Big Data, PCI Compliance, Security Metrics, Encryption, Mobile Device Management, Incident Response, and much more. James Beeson (CISO, GE Capital Americas) will deliver the keynote
Mid-Atlantic ISSA Security Conference 2015 (Gaithersburg, Maryland, USA, Apr 15, 2015) Meeting at the NIST campus, this all-day event, jointly hosted by the ISSA Baltimore, DC, and Northern Virginia chapters, will have 3 concurrent tracks of security professionals discussing the current state of various information security topics. The cost is $150 per person, including breakfast and lunch; pre-registration is required in order to get onto the NIST campus
Upcoming Events
DEFCON | OWASP International Information Security Meet (Lucknow, India, Feb 22, 2015) Defcon | OWASP Lucknow International Information Security Meet is a combined meet of Defcon and OWASP Lucknow. Defcon Lucknow is a DEF CON registered convention for promoting, demonstrating & spreading awareness regarding the field of Information Security and OWASP Lucknow is a chapter of OWASP Community
10th Annual ICS Security Summit (Orlando, Florida, USA, Feb 22 - Mar 2, 2015) Attendees come to the Summit to learn and discuss the newest and most challenging cyber security risks to control systems and the most effective defenses. The Summit is designed so you leave with new tools and techniques you can put to work immediately when returning to your office. The summit will allow you to learn from industry experts on attacker techniques, testing approaches in ICS, and defense capability in ICS environments
Cybersecurity for a New America: Big Ideas and New Voices (Washington, DC, USA, Feb 23, 2015) In addition to featuring keynote remarks by Admiral Mike Rogers, Director of the National Security Agency, this event will convene experts and practitioners from the public and private sector, military, media, academia, non-governmental and intergovernmental organizations for a series of discussion panels and first person "pop-up" style speeches on the wide range of cybersecurity issues that are affecting and infecting everything from personal devices and corporate networks to national defense and international affairs. The focus of the event will be to push past the status quo and instead explore the next generation of challenges, as well as highlight bold, new ideas to face them. CNN is the event's media partner and will provide a live-stream of the event
Workforce Development Forum — CyberWorks Information Session (Baltimore, Maryland, USA, Feb 24, 2015) Are you a technology company that would like to actively participate in growing the right candidates for your open IT and cybersecurity positions? Are you a job seeker interested in pursuing a career in IT/cybersecurity who would benefit from business mentorship and hands-on practical work experience? If you said yes to either question please join us at the upcoming CyberWorks information session to learn how you can benefit from this innovative program. CyberWorks is an industry-led, workforce development program designed to help Maryland companies fill their cybersecurity needs with qualified candidates, while simultaneously helping individuals start careers and improve Maryland's economy
Cybersecurity: You Don't Know What You Don't Know (Birmingham, Alabama, USA, Feb 24 - 25, 2015) What: Connected World Conference in partnership with University of Alabama at Birmingham's Center for Information Assurance and Joint Forensics Research (The Center) have teamed up to bring professionals together to discuss security and connected devices. Purpose: Convene the leading industry, government, and academia leaders. Chief Objective: Influence professionals from the most innovative and influential organizations in the world will meet to unravel the relationship between the connected society and cybersecurity
The Future of Cybersecurity Innovation (Washington, DC, USA, Feb 26, 2015) The US intelligence community has ranked cyberattacks as the No. 1 threat to national security — more than terrorist groups or weapons of mass destruction. But the military's cyberwarriors fight these battles hunkered over computers, working with strings of code — a laborious process that requires advanced engineering skills. That's why the Pentagon's advanced research arm, the Defense Advanced Research Projects Agency (DARPA), is building a system to give the military instantaneous knowledge of network attacks by displaying them in real-time with rich graphics and 3-D visualizations
NEDForum: Cyber Network Exploitation and Defence: "Darknet & the Primordial Soup of Cyber Crime" (Edinburgh, Scotland, UK, Feb 27, 2015) Speakers will cover such topics as: "Fear and loathing on Darknet," (Greg Jones, Managing Consultant, Digital Assurance), "Securing the internet of everything" (Rik Ferguson, Global Vice President Security Research, Trend Micro), and "Is your organisation setup for success in security?" (Patrick Brady, Independent Consultant)
2015 Cyber Risk Insights Conference — San Francisco (San Francisco, California, USA, Mar 3, 2015) Following on the success of the 2014 half-day cyber risk event, Advisen will present a full day of learning and networking for risk managers, CISOs, CROs, insurance brokers, insurance underwriters, reinsurers and other risk professionals. An expert faculty comprised of leading security, regulatory, risk management, and cyber insurance authorities will provide their insights into the critical privacy, network security and insurance coverage now issues facing organizations and their insurers, with an emphasis on the business, technology and regulatory factors that make California and the West Coast unique
Cybergamut Technical Tuesday: Tor and the Deep Dark Web (Columbia, Maryland, Sioux Falls, Mar 3, 2015) This talk will explore the use of Tor and how it relates to garnering useful intelligence. Distinguishing attribution or valuable intelligence from limited event data is difficult. Leveraging external threat data can be helpful in evaluating intelligence but how do you identify relevance? Created as a means of protecting the privacy and anonymity of its users, Tor — the managed network of private computers leveraged by criminal elements to minimize the risk of surveillance and capture — is being exploited by the most technically proficient, aggressive, and organized of criminal syndicates. Presented by Scott FitzPatrick of Norse
Boston SecureWorld (Boston, Massachusetts, USA, Mar 4 - 5, 2015) Join your fellow security professional for affordable, high-quality cybersecurity training and education at a regional conference near you. Earn CPE credits while learning from nationally recognized industry experts on many diverse topics such as: Risk Mitigation, Malware Detection, Digital Forensics, Cloud Security, Privacy, Big Data, PCI Compliance, Security Metrics, Encryption, Mobile Device Management, Incident Response, and much more. Among the speakers are several leading figures in cyber law enforcement
Mercury Proposers' Day Conference (IARPA1, Washington, DC, Mar 5, 2015) The Intelligence Advanced Research Projects Activity (IARPA) will host a Proposers' Day Conference for the Mercury Program on March 5, in anticipation of the release of a new solicitation in support of the program
Financial Services Cyber Security Summit: Middle East and North Africa (Dubai, UAE, Mar 9 - 10, 2015) Building on the success and feedback of our Cyber Security Summit in Europe — 180 attendees, 3 streams, CPE certified — we are pleased to invite you to the Financial Services Cyber Security Summit MENA — a highly interactive experience sharing platform for top experts from banks, insurance companies, monetary organizations and government institutions, accountancy companies, consumer finance, investment funds, stock brokerages and more
The Vulnerability Economy: Zero-Days, Commerce and National Security (Rockville, Maryland, USA, Mar 10, 2015) Dr. Ryan Ellis (Belfer Center, Harvard University) will explore a series of topics around cybersecurity including the challenges and opportunities associated with the growing trade in previously unknown and undisclosed software vulnerabilities ("zero days"). Drawing from a real-world case study, Dr. Ellis investigates the tension between the development of offensive cyber capabilities and cybersecurity. The discussion considers different approaches to disclosing newly discovered vulnerabilities and highlights the key roles that government and industry can play in promoting enhanced cybersecurity
OISC: Ohio Information Security Conference (Dayton, Ohio, USA, Mar 11, 2015) Technology First invites you to participate in the 12th Annual Ohio Information Security Conference Wednesday, March 11, at the Sinclair Community College Ponitz Center in Dayton, Ohio. The conference will focus on three areas/tracks: management, technical and implementation. CEUs (7) are available for this event
RiSK Conference 2015 (Lasko, Slovenia, Mar 11 - 12, 2015) In recent years RISK conference has become one of the leading events on computer security in the Adriatic region and is attended by engineering as well as executive staff of companies from the region. Much has changed in the field of security and data protection in recent times. There are popular new technologies in the form of SaaS (Security as a Service) and services in a cloud (cloud computing), green computing, etc
B-Sides Vancouver (Vaqncouver, British Columbia, Canada, Mar 16 - 17, 2015) The third annual Security B-Sides Vancouver is an information security conference that will be held March 16th and 17th. We love to see brand new speakers, seasoned speakers, and everyone in between
Insider Threat 2015 Summit (Monterey, California, USA, Mar 16 - 17, 2015) The Insider Threat 2015 Summit is about bringing Government and Industry organizations and their cybersecurity leaders together in order to better understand the type of threats that may impact their infrastructure and overall operations. Our two-day summit will provide insights on the most unique and thought provoking active defenses currently available for physical and personnel security, as well as, cyber threats. By supplying intelligent focus through tailored solutions our presenters and sponsors will be contributing to a forum to discuss ways to mitigate the risk of insider threats. This event allows for a truly unique opportunity to hear from experts in the field talk about their current and future solutions, giving way to an optimal setting for networking
2015 North Dakota Cyber Security Conference (Fargo, North Dakota, USA, Mar 17, 2015) The North Dakota Cyber Security Conference brings together community members from academia, government and industry to share strategies, best practices and innovative solutions to address today's challenges in cyber security. The vast scope of modern cyber threats calls for active participation from individuals and organizations across the state
IT Security Entrepreneurs Forum: Bridging the Gap Between Silicon Valley & the Beltway (Mountain View, California, USA, Mar 17 - 18, 2015) IT Security Entrepreneurs Forum (ITSEF) — SINET's flagship event — is designed to bridge the gap between the Federal Government and private industry. ITSEF provides a venue where entrepreneurs can meet and interact directly with leaders of government, business and the investment community in an open, collaborative environment focused on addressing the Cybersecurity challenge
Philadelphia SecureWorld (Philadelphia, Pennsylvania, USA, Mar 18 - 19, 2015) Join your fellow security professional for affordable, high-quality cybersecurity training and education at a regional conference near you. Earn CPE credits while learning from nationally recognized industry experts on many diverse topics such as: Risk Mitigation, Malware Detection, Digital Forensics, Cloud Security, Privacy, Big Data, PCI Compliance, Security Metrics, Encryption, Mobile Device Management, Incident Response, and much more. Keynote speakers will be Larry Ponemon (of the Ponemon Institute) and Christopher Pierson (General Counsel & Chief Security Officer, Viewpost)
BSides Salt Lake City (Salt Lake City, Utah, USA, Mar 20 - 21, 2015) BSides is a community-driven framework for building events for and by information security community members. The goal is to expand the spectrum of conversation
CarolinaCon-11 (Raleigh, North Carolina, USA, Mar 20 - 22, 2015) CarolinaCon-11 (also hereby referred to as "The Last CarolinaCon As We Know It") will occur on March 20th-22nd 2015 in Raleigh NC (USA). We are now officially accepting speaker/paper/demo submissions for the event. If you are somewhat knowledgeable in any interesting field of hacking, technology, robotics, science, global thermonuclear war, etc. (but mostly hacking), and are interested in presenting at CarolinaCon-11, we cordially invite you to submit your proposal
CyberTech Israel 2015 (Tel Aviv, Israel, Mar 24 - 25, 2015) In the face of these enemies and threats, individuals, organizations and states are required to produce innovative, unique solutions that would improve the resistance and resilience of the sensitive systems they rely on every day. For this purpose, it is essential to maintain a direct, on-going contact with the latest developments and changes in the cyber defense market. To this end, we are pleased to invite you to Cybertech 2015, the International Conference & Exhibition for Cyber Solutions, taking place on March 24th-25th, 2015 in Tel Aviv, Israel. Cybertech Conference and Exhibition, an initiative of Israel Defense, is the largest exhibition and conference of cyber technologies outside of the US
2nd Annual ISSA COS Cyber Focus Day (Colorado Springs, Colorado, USA, Mar 25, 2015) Join us for the Information Systems Security Association (ISSA) — Colorado Springs Chapter — Cyber Focus Day set to take on Wednesday, March 25, 2015 at the University of Colorado Colorado Springs (UCCS). The theme for CFD 2015 will "Cybercrime". Industry experts will be on hand to brief attendees on the latest trends, and best practices, in cybersecurity. This one-day forum will offer IT, business, law enforcement, government, military, academic, training, and other professionals a unique, local opportunity to get up-to-date information on rapidly evolving cybersecurity challenges
CYBERWEST: the Southwest Cybersecurity Summit (Phoenix, Arizona, USA, Mar 25 - 26, 2015) The purpose of CYBERWEST is to bring together Government and businesses to: Exchange information and learn in areas of policy and strategy; technology and R&D; workforce training and education; and economic, legal, regulatory and insurance impacts. Discuss cybersecurity issues and to focus on applied cybersecurity (i.e. implementing the NIST framework, R&D, legal and regulatory perspectives, state and local approaches). Present content that attendees can take back and use in their organizations
Women in Cyber Security (Atlanta, Georgia, USA, Mar 27 - 28, 2015) Despite the growing demand and tremendous opportunities in the job market, cybersecurity remains an area where there is significant shortage of skilled professionals regionally, nationally and internationally. Even worse, women's representation in this male-dominated field of security is alarmingly low. Through the WiCyS community and activities we expect to raise awareness about the importance and nature of cybersecurity career. We hope to generate interest among students to consider cybersecurity as a viable and promising career option
Automotive Cyber Security Summit (Detroit, Michigan, USA, Mar 30 - Apr 1, 2015) The debut Automotive Cyber Security Summit will bring together CTOs, CSOs, Engineers and IT professionals from GM, KIA, Nissan, Bosch, Qualcomm and more for three days of case studies, workshops, panel discussions and networking sessions
Insider Threat Symposium & Expo (Laurel, Maryland, USA, Mar 31, 2015) The National Insider Threat Special Interest Group (NITSIG) announced that it will hold FREE 1 day Insider Threat Symposium & Expo (ITS&E) on March 31, 2015 in Laurel, Maryland. The symposium is exclusively focused on insider threat awareness, insider threat program development and implementation and insider threat risk mitigation.The ITS&E will provide attendees with access to a broad network of security professionals to collaborate with on insider threat risks, insider threat detection, insider threat risk mitigation strategies and insider threat program development, implementation and management. The expo will include vendors that have proven technologies and services for insider threat risk mitigation