The CyberWire Daily Briefing 02.23.15

Cyber Attacks, Threats, and Vulnerabilities

The Morning Download: Gemalto Hack Shows 'We Have Their Entire Network' (Wall Street Journal) The revelation that spies in the U.S. and the U.K. stole encryption keys from SIM-card maker Gemalto, a major supplier to wireless carriers, the banking industry and government agencies, is chilling

Gemalto announces investigation of massive SIM heist (Help Net Security) Yesterday's report by The Intercept hit the information security community like a ton of bricks, as a set of documents from Edward Snowden's trove indicate that the US NSA and the UK GHCQ have managed to compromise the networks of Dutch SIM card manufacturer Gemalto and acquire encryption keys that protect the privacy of cellphone communications of millions of users around the globe

How the "Great SIM Heist" could have been avoided (Naked Security) You may very well have read about the latest leak supposedly sourced from the secret data stolen by whistleblower Edward Snowden

Vital Payments Security Method at Heart of Gemalto Hack Investigation (PaymentsSource) The apparent hack of Gemalto by U.S. and U.K. spies casts doubt over several security measures vital to the payments industry as it embraces chip cards and adopts digital payments

Telcos face mass SIM card recall after spy agencies' encryption hack revealed (Sydney Morning Herald) Telstra, Optus and Vodafone may be forced to order the recall of potentially millions of mobile phone SIM cards after it was revealed that US and British spy agencies stole encryption keys that secured personal information, including calls and texts, on the chips

'NSA, GCHQ-ransacked' SIM maker Gemalto takes a $500m stock hit (Register) As security experts denounce mass phone encryption key theft

Gemalto Claims Its Products Are 'Secure' In Response To Reported NSA Hack (TechCrunch) Gemalto, the SIM card maker that reportedly had its encryption keys stolen by the NSA and GCHQ, has claimed that its products are secure, despite apparent leaked NSA documents suggesting otherwise

Report of hacking of SIM card supplier puts spies in spotlight (Australian) European government officials, telecom executives and investors rushed on Friday to respond to a report US and British intelligence agencies breached security systems at Gemalto, a supplier of encryption technology to wireless carriers

Document Reveals Growth of Cyberwarfare Between the U.S. and Iran (New York Times) A newly disclosed National Security Agency document illustrates the striking acceleration of the use of cyberweapons by the United States and Iran against each other, both for spying and sabotage, even as Secretary of State John Kerry and his Iranian counterpart met in Geneva to try to break a stalemate in the talks over Iran's disputed nuclear program

How the NSA's Firmware Hacking Works and Why It's So Unsettling (Wired) One of the most shocking parts of the recently discovered spying network Equation Group is its mysterious module designed to reprogram or reflash a computer hard drive's firmware with malicious code. The Kaspersky researchers who uncovered this said its ability to subvert hard drive firmware — the guts of any computer — "surpasses anything else" they had ever seen

Revelation of Secret Spyware Could Hamper US Espionage Efforts (Voice of America) The revelation of secret technology that buries spyware into computer hard drives could be a blow to espionage efforts by the U.S. National Security Agency, intelligence analysts say

Kaspersky Lab: Israel spared two major cyberattacks (Times of Israel) Software security firm says the Equation Group hacking operation is by far the most sophisticated malware it has uncovered, and the most dangerous; also discovers mega cyber robbery plot

Months Later, Hackers Still Inside State Department's Network (HS Today) Three months after the Department of State acknowledged that hackers breached its unclassified email system, government cybersecurity investigators still haven't been able "to evict them from the department's network, according to three people familiar with the investigation," the Wall Street Journal reported Thursday

SSL-busting code that threatened Lenovo users found in a dozen more apps (Ars Technica) "What all these applications have in common is that they make people less secure"

Lenovo's Superfish security snafu blows up in its face (CNet) The preloaded Superfish adware does more than hijack website ads in a browser. It also exposes Lenovo owners to a simple but dangerous hack that could spell disaster

Spin and FUD: Superfish CEO says software presents no security risk (CSO) Adware firm's top executive says security community has made false and misleading statements

Security software found using Superfish-style code, as attacks get simpler (Ars Technica) Titles from security firms Lavasoft and Comodo leave users open to easier attacks

Spies Can Track You Just by Watching Your Phone's Power Use (Wired) Smartphone users might balk at letting a random app like Candy Crush or Shazam track their every move via GPS. But researchers have found that Android phones reveal information about your location to every app on your device through a different, unlikely data leak: the phone's power consumption

Cyber criminals target trading algorithms (Financial Times) Security experts: targeted attacks try to steal the code that underlies trading strategies

OpSaudi: Hackers Shutdown Saudi Bank Website (HackRead) On Wednesday 17th Feb, 2015, a group of hacktivists calling themselves "The oppressed defenders" conducted a cyber attack on Saudi Arabian based bank AlJazira in shape of a Distributed denial of service attack (DD0S)

Babar the Elephant: Another malware plague with a cute name (Register) Tor-friendly nasty records Skype & Yahoo! chats

Hackers Cut in Line at the Burning Man Ticket Sale — And Get Caught (Wired) Burning Man has practically gone mainstream. The once-fringe desert camping festival is now cultural fodder for The Simpsons and Taco Bell commercials. Celebrities and CEOs routinely attend. So it's no surprise that 40,000 Burning Man tickets sold out in less than an hour last Wednesday when they went on sale

Over 250,000 home routers sport same SSH keys, warns researcher (Help Net Security) With a simple search, John Matherly, the creator of Shodan, has discovered with it more than 250,000 routers that share the same SSH key, meaning they also share the same private key. An attacker could access and hijack them if the devices are configured to allow remote access and authentication

Public Sector Faces Rise in Cyber-Attacks (Computer Business Review) Utilities could be facing more downtime and disruption in future

'Yes, your car wash is on Facebook' (Threatpost) When (or if) people think about the security of the devices they interact with and use on a daily basis, the machines that run their local car wash probably aren't high up on that list. But, like everything else with a computer for a brain these days, those machines are connected to the Internet. And Billy Rios can hack them

Internet of Things security check: How 3 smart devices can be dumb about the risks (PC World) Internet of Things security is no longer a foggy future issue, as more and more such devices enter the market — and our lives

Healthcare Provider Send You An Email? Don’t Open It (Inquisitr) A healthcare provider is probably the last source from which you want to open an email

Kaspersky: Nearly 30 Percent of Phishing Attacks Target Financial Info (The VAR Guy) Nearly 30 percent of phishing attacks in 2014 targeted consumers' financial information, signaling a shift by cybercrooks from banks to payment systems and online shopping websites

Bulletin (SB15-054) Vulnerability Summary for the Week of February 16, 2015 (US-CERT) The US-CERT Cyber Security Bulletin provides a summary of new vulnerabilities that have been recorded by the National Institute of Standards and Technology (NIST) National Vulnerability Database (NVD) in the past week. The NVD is sponsored by the Department of Homeland Security (DHS) National Cybersecurity and Communications Integration Center (NCCIC) / United States Computer Emergency Readiness Team (US-CERT). For modified or updated entries, please visit the NVD, which contains historical vulnerability information

Security Patches, Mitigations, and Software Updates

Microsoft, McAfee update antivirus software to protect against Superfish (Mashable) Lenovo is working with Microsoft and McAfee to help protect its users from the security vulnerabilities created by Superfish's adware

Microsoft helps Lenovo, deletes Superfish 'crapware' and rogue cert (ComputerWorld) New Windows Defender signature seeks out and destroys spying app and the self-signed certificate at the root of security fiasco

Google's new Cloud Security Scanner detects common security bugs (Help Net Security) Here's some good news for Google App Engine developers: Google has released a new application security scanner that's especially fitting to test new app builds for cross-site scripting (XSS) and mixed content vulnerabilities

Pinterest Unveils Its New Spam-Fighting Tool (Wired) Marty Weiner, employee Number Two at Pinterest, needed a better way to fight spam on the popular internet-scrapbooking site. At one point, he asked Mike Krieger, the co-founder of another up-and-coming online social network — Instagram — how he handled the problem

Cyber Trends

Notorious Malware Improvements and Enhancements of 2014 (TrendLabs Security Intelligence Blog) 2014 was a year that was marked with numerous changes in the threat landscape. We saw a lot of improvements in existing malware, either with new evasion techniques or versions. We even saw some old techniques and attacks resurface in the landscape

Hacking hauls grow as security experts rush to catch up (Sarasota Herald-Tribune) This month, the White House held a summit on how to contain such attacks, and one irrefutable conclusion left many in the security industry shaken: Cyber thieves are getting bolder — and smarter

Where's the outrage over data hacks? (Bloomberg News via Arkansas Online) It has been a couple of weeks since health insurer Anthem disclosed that hackers had gotten hold of data on 80 million of its customers. Which just means we're that much closer to the disclosure of the next giant data hack

Using Cyberattacks To Study An Intelligent Adversary (Nasdaq) Organized crime, unfriendly nations and dissidents are using increasingly cheap technology and new platforms such as smartphones and cloud computing to launch cyberattacks on thousands of companies and millions of individuals at a time

Cyber readiness across government and critical infrastructure industries (Help Net Security) While the frequency and severity of cyberattacks against organizations are on the rise, a majority of IT leaders do not feel confident in their leaderships' ability to leverage intelligence that can predict a cyber vulnerability and effectively combat threats, according to Lockheed Martin

Don't wait until you're attacked to take cybersecurity seriously (Help Net Security) CISOs foresee cyber terrorism and cybercrime posing significant risks to their organizations over the next three years, according to Raytheon and the Ponemon Institute

The Future of Cybersecurity Hinges on Boardroom Engagement Today (SecurityWeek) Cyber attacks are increasingly sophisticated and discrete. Nation states and cybercriminal organizations frequently bankroll and mastermind these attacks with the aim of financial or political gain. If attackers have high-powered backing behind them, shouldn't defenders as well? Isn't it time that organizations' top leaders are actively engaged in defense? Granted, the vast majority of enterprises have an executive with direct responsibility for security. But for modern businesses, security leadership needs to ascend even higher in the organization: to the boardroom

Disconnect yawns between CISOs, exec leadership, study says (SC Magazine) A recent survey by Ponemon Institute and Raytheon found senior executives don't fully understand the extent of security threats. Even though CISOs opine that cybercrime and cyberterrorism will be major threats in the next three years, they, by and large, believe that senior executives don't fully understand the extent of those threats, which has proven a real obstacle to meaningful prevention

Who's an insider threat? This one-paragraph definition sums it up for CSOs (IT World Canada) More than half the attendees at a cyber-security event produced by the Conference Board of Canada on Wednesday admitted they are not aware of any common way their organization defines an "insider threat," despite the increased risk they pose to corporate systems and information

Small Businesses Cite Security as Cloud Uptake Barrier (Infosecurity Magazine) Two-fifths (38%) of small UK businesses remain skeptical about the benefits of cloud computing in the face of perceived risks

Lack of resources the biggest hurdle for healthcare organizations in defending cyberattacks (FierceHealthIT) Security professionals in the United States say they feel ill-prepared to defend against cybersecurity attacks, according to new research conducted by The Ponemon Institute and sponsored by Lockheed Martin

Developing a cybersecurity arsenal: the president adds a new weapon (Modern Healthcare) Be prepared for a new acronym, ISAOs, to join the myriad others in the world of healthcare technology, thanks to President Barack Obama's new cybersecurity executive order

Marketplace

Lenovo Superfish saga 'hugely damaging', says analyst (CRN) Adware 'PR disaster' brings issue of Chinese ownership back to the fore, Context co-founder Jermey Davies tells CRN

You Had One Job, Lenovo (Slate) And it didn't involve sneaking malicious adware onto your customers' computers

Is Superfish an Internet pioneer or a PC user's privacy nightmare? (Tech 2) A little-known Silicon Valley startup was caught in a firestorm of criticism this week for making software that exposed Lenovo laptop users to hackers bent on stealing personal information. But Superfish Inc. has also won praise for producing visual search technology that many see as the next big thing in online shopping

A Russian cyber-security company is impressing the skeptics (The Economist via Business Insider) There is more than one reason to harbour doubts about Eugene Kaspersky and the computer-security company that bears his name

Cybersecurity stocks surge again (Seeking Alpha) With the help of strong earnings reports, government initiatives, and ongoing hacking scandals bolstering broader corporate interest in cybersecurity, security tech plays are refusing to take a breather

30 Cybersecurity Stocks In A Dangerous Digital World (Benzinga) Cybersecurity stocks have been on fire lately, but not all of the names in the space are familiar to investors. Here's a list of 30 companies that are working to keep the digital world safe

CyberArk Software: A Bubble Ready To Burst? (Seeking Alpha) Cybersecurity software has become a red hot space. Stock has soared from $16 IPO. Lockup expiration could tremendously increase float. Valuation needs to be justified by substantial future growth

Synack Labs raises $25M to fund new products (Silicon Valley Business Journal) Software bug bounty startup Synack Labs raised $25 million in Series B funding Thursday to accelerate growth of new products

Why the hackers at Synack need $25M to hunt down major security flaws (Venture Beat) The vast number of attacks in 2014 have catapulted information security into the forefront of the media and the minds of many enterprises

Juniper Networks spinoff expands to Massachusetts (Boston Business Journal) Less than one year after Juniper Networks (NYSE:JNPR) sold off its Junos Pulse security business to Siris Capital for $250 million, the investors behind the business have since acquired MobileSpaces and have decided to expand the business to the East Coast

Products, Services, and Solutions

KeyGrabber USB KeyLogger 8MB Black (CyberWar) USB KeyLogger 8MB Black — Small, fast, and smart — One of the world's smallest and smartest USB hardware keylogger

Technologies, Techniques, and Standards

Who Cares Who's Behind A Data Breach? (Dark Reading) Attribution takes a long time, a lot of work, and a healthy dose of luck. But is it worth the effort?

Deploying a Smart Sandbox for Unknown Threats and Zero-Day Attacks (TrendLabs Security Intelligence Blog) Zero-day exploits pose some of the most serious risks to users everywhere. The absence of a patch means that it is up to users (and whatever security products they use) to protect against these attacks

Why All Linux (Security) Bugs Aren't Shallow (eSecurity Planet) With Heartbleed and Shellshock, the open source community realized that Linus' law can be challenged

Prevent your Mac password from being bypassed (CNet) There are two security utilities that can prevent thieves from being able to reset your password to gain access to the contents of your Mac

TrueCrypt Audit to Overturn Fears of Corruption (Computer Busines Review) Months pass after project's abandonment before plans revealed.

ENISA Calls For New ICS/SCADA Cybersecurity Certification Programs (SecurityWeek) The European Union Agency for Network and Information Security (ENISA) has published a new study on the challenges of developing certification schemes for cybersecurity professionals in the field of Industrial Control Systems (ICS) and Supervisory Control and Data Acquisition (SCADA)

5 Ethical Open Source Hacking Tools for Business (Computer Business Review) Hacking is not only the domain of vagabonds and crooks

Privacy & Cybercrime Use The Same Tools (InformationWeek) Users who are hungry for privacy need to choose their solutions carefully

Why you need to learn to love shadow IT (ITProPortal) 'Shadow IT', the concept of employees using all manner of technologies for work regardless of IT's approval, is nothing new

5 Steps to Preventing a Data Breach (RIS News) With more and more consumers using cards instead of cash to pay for their purchases, it's no surprise that retailers are adjusting their payment options to give their customers what they want. Brands are enabling e-payment options, both in store and online, where customers can pay for their merchandise with the swipe of a card and then be on their way

Design and Innovation

Next big thing in online advertising spurs criticism for security flaws (Japan Times) A little-known Silicon Valley startup was caught in a firestorm of criticism last week for making software that exposed Lenovo laptop users to hackers bent on stealing personal information. But Superfish Inc. has also won praise for producing visual search technology that many see as the next big thing in online shopping

One finger doesn't begin to define Windows 10 authentication, FIDO (ZDNet) Microsoft focused on adopting FIDO 2.0 standard for strong authentication, but Windows 10 and everyone else will have to wait for spec's completion

Academia

'White hat hackers' of Johns Hopkins protect data, thwart cybercrime (Johns Hopkins Gazette) Information Security Institute protects data, thwarts cybercrime

Legislation, Policy, and Regulation

How will new internet surveillance measures affect business in France? (ZDNet) A shared digital space requires trust, so why has the French government introduced stricter online surveillance laws and how will it affect enterprises online behaviour?

Interception of communications in SA — you should be worried (My Broadband) Loopholes exist in our laws covering interception of communications, and the state is abusing them

President Obama's cyber pitch misses mark in Silicon Valley (The Hill) The Obama administration is stumbling in its cybersecurity message to Silicon Valley, according to tech executives and a former White House official

Sony, U.S. Agencies Fumbled After Cyberattack (Wall Street Journal) Lack of information and consultation led to flip-flops, added to confusion

Can the Senate's new Republicans usher in NSA surveillance reform? (Christian Science Monitor: Passcode) After the Snowden leaks, many wannabe Republican senators made NSA reform a campaign platform. Now that they're in the Senate, privacy advocates hope they'll stay true to their commitment for curbing surveillance and add momentum to a reform bill

Can Obama, GOP reach consensus on cybersecurity? (CBS News) After cyberhacks across America's most lucrative industries — particularly in health (with insurance giant Anthem), finance (JP Morgan Chase) and Hollywood (Sony Pictures) — the Republican Party said that such cyber-assaults are a "crucial challenge" the nation can't afford to ignore

Retailers Pressed to Protect Consumers From Data Breaches (NerdWallet) Data security continues to be a struggle for major retailers. Surprisingly, there are still few federal regulations for them to follow if they're hacked. Without such rules, damage will most likely increase from high-profile breaches such as those that hit Target and Home Depot in the past year or so

It's time for a National Cybersecurity Safety Board (NCSB) (CSO) In his book The Psychological Edge: Strategies For Everyday Living, clinical psychologist Dr. Samuel Shein writes that while we have a National Transportation Safety Board (NTSB), there is no National Psychological Research Board (NPRB). A group like the NPRB could investigate national disasters caused by those with psychological issues

Justice, DHS Quarantine Smartphones Returning from Abroad (NextGov) Officials at the departments of Justice and Homeland Security typically expect employees' smartphones will be bugged when they travel overseas. So, they are experimenting with various ways to neutralize foreign spy gear

Congress has just days left to avert DHS shutdown (USA TODAY) Congress returns this week with just days left to avert a partial Homeland Security shutdown

Litigation, Investigation, and Law Enforcement

SEC Cyber Security Sweep: Good News, Bad News (InformationWeek: Bank Systems & Technology) In the wake of the SEC's cyber security examinations and a subsequent report, three causes for celebration and three serious action items have emerged from the SEC's recent cyber security examinations. These illustrate where the financial services industry focus its information security efforts

Lenovo faces lawsuit for pre-installing Superfish adware (ComputerWeekly) A class action lawsuit has been filed against Lenovo after it emerged that the company pre-installed adware that made customers vulnerable to HTTPS man-in-the-middle attacks

TurboTax's Anti-Fraud Efforts Under Scrutiny (KrebsOnSecurity) Two former security employees at Intuit — the makers of the popular tax preparation software and service TurboTax — allege that the company has made millions of dollars knowingly processing state and federal tax refunds filed by cybercriminals. Intuit says it leads the industry in voluntarily reporting suspicious returns, and that ultimately it is up to the Internal Revenue Service to develop industry-wide requirements for tax preparation firms to follow in their fight against the multi-billion dollar problem of tax refund fraud

Google opposes plan to let FBI hack any computer in the world (Telegraph) Google claims that the US government's proposal to give the FBI powers to hack computers overseas raises 'monumental' legal concerns

Drones, cybercrime among topics at annual AG meeting (Legal Newsline) When the National Association of Attorneys General meets next week for its annual winter meeting, much of the discussion will focus on several new challenges they face as the chief legal officers of their states

Will your business be financially responsible for cyber attack losses? (Lexology) Businesses are becoming increasingly concerned with cybersecurity as their reliance on technology and data increases. Recent reports of cyber attack incidents underscore the importance of proactive steps to assess a business's vulnerability…A recent federal court decision highlights the importance of careful contract drafting and review to ensure that even time-tested contract language continues to accomplish the parties' business goals and allocates all the risks as intended, including liability for data breach losses

Pakistan arrests FBI’s most-wanted Cyber criminal (HackRead) Officials from Cybercrime Circle of Federal Investigation Agency (FIA) have revealed that two of the Federal Bureau of Investigation (FBI)'s ten most-wanted cyber criminals have been arrested by their department on FBI's request. The suspects Noor Azizuddin and Farhanul Arshad were arrested from their house in Federal B Area in a pre-dawn raid by FIA

For a complete running list of events, please visit the Event Tracker.

Newly Noted Events

Houston Secure World (Houston, Texas, USA, May 13, 2015) Join your fellow security professional for affordable, high-quality cybersecurity training and education at a regional conference near you. Earn CPE credits while learning from nationally recognized industry experts on many diverse topics such as: Risk Mitigation, Malware Detection, Digital Forensics, Cloud Security, Privacy, Big Data, PCI Compliance, Security Metrics, Encryption, Mobile Device Management, Incident Response, and much more. Larry Ponemon will deliver the keynote

Atlanta Secure World (Atlanta, Georgia, USA, May 27 - 28, 2015) Join your fellow security professional for affordable, high-quality cybersecurity training and education at a regional conference near you. Earn CPE credits while learning from nationally recognized industry experts on many diverse topics such as: Risk Mitigation, Malware Detection, Digital Forensics, Cloud Security, Privacy, Big Data, PCI Compliance, Security Metrics, Encryption, Mobile Device Management, Incident Response, and much more. Keynotes by Dr. Marjie T. Britz (Professor of Criminal Justice, Clemson University) and Demetrios Lazarikos (IT Security Researcher & Strategist, Blue Lava Consulting)

Cyber Security Summit 2015 (Minneapolis, Minnesota, USA, Oct 21 - 22, 2015) The Summit's mission is to establish a multi-stakeholder consortium that brings together industry, government and academic interests in an effort to improve the state of cyber security on both a domestic and international level. We believe that cyber security cannot be contained and outsourced to any one sector. Due to the vast scope of cyber threats, it requires active engagement of all stakeholders, including entities and organizations — large and small — across every industry

Upcoming Events

10th Annual ICS Security Summit (Orlando, Florida, USA, Feb 22 - Mar 2, 2015) Attendees come to the Summit to learn and discuss the newest and most challenging cyber security risks to control systems and the most effective defenses. The Summit is designed so you leave with new tools and techniques you can put to work immediately when returning to your office. The summit will allow you to learn from industry experts on attacker techniques, testing approaches in ICS, and defense capability in ICS environments

Cybersecurity for a New America: Big Ideas and New Voices (Washington, DC, USA, Feb 23, 2015) In addition to featuring keynote remarks by Admiral Mike Rogers, Director of the National Security Agency, this event will convene experts and practitioners from the public and private sector, military, media, academia, non-governmental and intergovernmental organizations for a series of discussion panels and first person "pop-up" style speeches on the wide range of cybersecurity issues that are affecting and infecting everything from personal devices and corporate networks to national defense and international affairs. The focus of the event will be to push past the status quo and instead explore the next generation of challenges, as well as highlight bold, new ideas to face them. CNN is the event's media partner and will provide a live-stream of the event

Workforce Development Forum — CyberWorks Information Session (Baltimore, Maryland, USA, Feb 24, 2015) Are you a technology company that would like to actively participate in growing the right candidates for your open IT and cybersecurity positions? Are you a job seeker interested in pursuing a career in IT/cybersecurity who would benefit from business mentorship and hands-on practical work experience? If you said yes to either question please join us at the upcoming CyberWorks information session to learn how you can benefit from this innovative program. CyberWorks is an industry-led, workforce development program designed to help Maryland companies fill their cybersecurity needs with qualified candidates, while simultaneously helping individuals start careers and improve Maryland's economy

Cybersecurity: You Don't Know What You Don't Know (Birmingham, Alabama, USA, Feb 24 - 25, 2015) What: Connected World Conference in partnership with University of Alabama at Birmingham's Center for Information Assurance and Joint Forensics Research (The Center) have teamed up to bring professionals together to discuss security and connected devices. Purpose: Convene the leading industry, government, and academia leaders. Chief Objective: Influence professionals from the most innovative and influential organizations in the world will meet to unravel the relationship between the connected society and cybersecurity

The Future of Cybersecurity Innovation (Washington, DC, USA, Feb 26, 2015) The US intelligence community has ranked cyberattacks as the No. 1 threat to national security — more than terrorist groups or weapons of mass destruction. But the military's cyberwarriors fight these battles hunkered over computers, working with strings of code — a laborious process that requires advanced engineering skills. That's why the Pentagon's advanced research arm, the Defense Advanced Research Projects Agency (DARPA), is building a system to give the military instantaneous knowledge of network attacks by displaying them in real-time with rich graphics and 3-D visualizations

NEDForum: Cyber Network Exploitation and Defence: "Darknet & the Primordial Soup of Cyber Crime" (Edinburgh, Scotland, UK, Feb 27, 2015) Speakers will cover such topics as: "Fear and loathing on Darknet," (Greg Jones, Managing Consultant, Digital Assurance), "Securing the internet of everything" (Rik Ferguson, Global Vice President Security Research, Trend Micro), and "Is your organisation setup for success in security?" (Patrick Brady, Independent Consultant)

2015 Cyber Risk Insights Conference — San Francisco (San Francisco, California, USA, Mar 3, 2015) Following on the success of the 2014 half-day cyber risk event, Advisen will present a full day of learning and networking for risk managers, CISOs, CROs, insurance brokers, insurance underwriters, reinsurers and other risk professionals. An expert faculty comprised of leading security, regulatory, risk management, and cyber insurance authorities will provide their insights into the critical privacy, network security and insurance coverage now issues facing organizations and their insurers, with an emphasis on the business, technology and regulatory factors that make California and the West Coast unique

Cybergamut Technical Tuesday: Tor and the Deep Dark Web (Columbia, Maryland, Sioux Falls, Mar 3, 2015) This talk will explore the use of Tor and how it relates to garnering useful intelligence. Distinguishing attribution or valuable intelligence from limited event data is difficult. Leveraging external threat data can be helpful in evaluating intelligence but how do you identify relevance? Created as a means of protecting the privacy and anonymity of its users, Tor — the managed network of private computers leveraged by criminal elements to minimize the risk of surveillance and capture — is being exploited by the most technically proficient, aggressive, and organized of criminal syndicates. Presented by Scott FitzPatrick of Norse

Boston SecureWorld (Boston, Massachusetts, USA, Mar 4 - 5, 2015) Join your fellow security professional for affordable, high-quality cybersecurity training and education at a regional conference near you. Earn CPE credits while learning from nationally recognized industry experts on many diverse topics such as: Risk Mitigation, Malware Detection, Digital Forensics, Cloud Security, Privacy, Big Data, PCI Compliance, Security Metrics, Encryption, Mobile Device Management, Incident Response, and much more. Among the speakers are several leading figures in cyber law enforcement

Mercury Proposers' Day Conference (IARPA1, Washington, DC, Mar 5, 2015) The Intelligence Advanced Research Projects Activity (IARPA) will host a Proposers' Day Conference for the Mercury Program on March 5, in anticipation of the release of a new solicitation in support of the program

Financial Services Cyber Security Summit: Middle East and North Africa (Dubai, UAE, Mar 9 - 10, 2015) Building on the success and feedback of our Cyber Security Summit in Europe — 180 attendees, 3 streams, CPE certified — we are pleased to invite you to the Financial Services Cyber Security Summit MENA — a highly interactive experience sharing platform for top experts from banks, insurance companies, monetary organizations and government institutions, accountancy companies, consumer finance, investment funds, stock brokerages and more

The Vulnerability Economy: Zero-Days, Commerce and National Security (Rockville, Maryland, USA, Mar 10, 2015) Dr. Ryan Ellis (Belfer Center, Harvard University) will explore a series of topics around cybersecurity including the challenges and opportunities associated with the growing trade in previously unknown and undisclosed software vulnerabilities ("zero days"). Drawing from a real-world case study, Dr. Ellis investigates the tension between the development of offensive cyber capabilities and cybersecurity. The discussion considers different approaches to disclosing newly discovered vulnerabilities and highlights the key roles that government and industry can play in promoting enhanced cybersecurity

OISC: Ohio Information Security Conference (Dayton, Ohio, USA, Mar 11, 2015) Technology First invites you to participate in the 12th Annual Ohio Information Security Conference Wednesday, March 11, at the Sinclair Community College Ponitz Center in Dayton, Ohio. The conference will focus on three areas/tracks: management, technical and implementation. CEUs (7) are available for this event

RiSK Conference 2015 (Lasko, Slovenia, Mar 11 - 12, 2015) In recent years RISK conference has become one of the leading events on computer security in the Adriatic region and is attended by engineering as well as executive staff of companies from the region. Much has changed in the field of security and data protection in recent times. There are popular new technologies in the form of SaaS (Security as a Service) and services in a cloud (cloud computing), green computing, etc

B-Sides Vancouver (Vaqncouver, British Columbia, Canada, Mar 16 - 17, 2015) The third annual Security B-Sides Vancouver is an information security conference that will be held March 16th and 17th. We love to see brand new speakers, seasoned speakers, and everyone in between

Insider Threat 2015 Summit (Monterey, California, USA, Mar 16 - 17, 2015) The Insider Threat 2015 Summit is about bringing Government and Industry organizations and their cybersecurity leaders together in order to better understand the type of threats that may impact their infrastructure and overall operations. Our two-day summit will provide insights on the most unique and thought provoking active defenses currently available for physical and personnel security, as well as, cyber threats. By supplying intelligent focus through tailored solutions our presenters and sponsors will be contributing to a forum to discuss ways to mitigate the risk of insider threats. This event allows for a truly unique opportunity to hear from experts in the field talk about their current and future solutions, giving way to an optimal setting for networking

2015 North Dakota Cyber Security Conference (Fargo, North Dakota, USA, Mar 17, 2015) The North Dakota Cyber Security Conference brings together community members from academia, government and industry to share strategies, best practices and innovative solutions to address today's challenges in cyber security. The vast scope of modern cyber threats calls for active participation from individuals and organizations across the state

IT Security Entrepreneurs Forum: Bridging the Gap Between Silicon Valley & the Beltway (Mountain View, California, USA, Mar 17 - 18, 2015) IT Security Entrepreneurs Forum (ITSEF) — SINET's flagship event — is designed to bridge the gap between the Federal Government and private industry. ITSEF provides a venue where entrepreneurs can meet and interact directly with leaders of government, business and the investment community in an open, collaborative environment focused on addressing the Cybersecurity challenge

Philadelphia SecureWorld (Philadelphia, Pennsylvania, USA, Mar 18 - 19, 2015) Join your fellow security professional for affordable, high-quality cybersecurity training and education at a regional conference near you. Earn CPE credits while learning from nationally recognized industry experts on many diverse topics such as: Risk Mitigation, Malware Detection, Digital Forensics, Cloud Security, Privacy, Big Data, PCI Compliance, Security Metrics, Encryption, Mobile Device Management, Incident Response, and much more. Keynote speakers will be Larry Ponemon (of the Ponemon Institute) and Christopher Pierson (General Counsel & Chief Security Officer, Viewpost)

BSides Salt Lake City (Salt Lake City, Utah, USA, Mar 20 - 21, 2015) BSides is a community-driven framework for building events for and by information security community members. The goal is to expand the spectrum of conversation

CarolinaCon-11 (Raleigh, North Carolina, USA, Mar 20 - 22, 2015) CarolinaCon-11 (also hereby referred to as "The Last CarolinaCon As We Know It") will occur on March 20th-22nd 2015 in Raleigh NC (USA). We are now officially accepting speaker/paper/demo submissions for the event. If you are somewhat knowledgeable in any interesting field of hacking, technology, robotics, science, global thermonuclear war, etc. (but mostly hacking), and are interested in presenting at CarolinaCon-11, we cordially invite you to submit your proposal

CyberTech Israel 2015 (Tel Aviv, Israel, Mar 24 - 25, 2015) In the face of these enemies and threats, individuals, organizations and states are required to produce innovative, unique solutions that would improve the resistance and resilience of the sensitive systems they rely on every day. For this purpose, it is essential to maintain a direct, on-going contact with the latest developments and changes in the cyber defense market. To this end, we are pleased to invite you to Cybertech 2015, the International Conference & Exhibition for Cyber Solutions, taking place on March 24th-25th, 2015 in Tel Aviv, Israel. Cybertech Conference and Exhibition, an initiative of Israel Defense, is the largest exhibition and conference of cyber technologies outside of the US

2nd Annual ISSA COS Cyber Focus Day (Colorado Springs, Colorado, USA, Mar 25, 2015) Join us for the Information Systems Security Association (ISSA) — Colorado Springs Chapter — Cyber Focus Day set to take on Wednesday, March 25, 2015 at the University of Colorado Colorado Springs (UCCS). The theme for CFD 2015 will "Cybercrime". Industry experts will be on hand to brief attendees on the latest trends, and best practices, in cybersecurity. This one-day forum will offer IT, business, law enforcement, government, military, academic, training, and other professionals a unique, local opportunity to get up-to-date information on rapidly evolving cybersecurity challenges

CYBERWEST: the Southwest Cybersecurity Summit (Phoenix, Arizona, USA, Mar 25 - 26, 2015) The purpose of CYBERWEST is to bring together Government and businesses to: Exchange information and learn in areas of policy and strategy; technology and R&D; workforce training and education; and economic, legal, regulatory and insurance impacts. Discuss cybersecurity issues and to focus on applied cybersecurity (i.e. implementing the NIST framework, R&D, legal and regulatory perspectives, state and local approaches). Present content that attendees can take back and use in their organizations

Women in Cyber Security (Atlanta, Georgia, USA, Mar 27 - 28, 2015) Despite the growing demand and tremendous opportunities in the job market, cybersecurity remains an area where there is significant shortage of skilled professionals regionally, nationally and internationally. Even worse, women's representation in this male-dominated field of security is alarmingly low. Through the WiCyS community and activities we expect to raise awareness about the importance and nature of cybersecurity career. We hope to generate interest among students to consider cybersecurity as a viable and promising career option

Automotive Cyber Security Summit (Detroit, Michigan, USA, Mar 30 - Apr 1, 2015) The debut Automotive Cyber Security Summit will bring together CTOs, CSOs, Engineers and IT professionals from GM, KIA, Nissan, Bosch, Qualcomm and more for three days of case studies, workshops, panel discussions and networking sessions

Insider Threat Symposium & Expo (Laurel, Maryland, USA, Mar 31, 2015) The National Insider Threat Special Interest Group (NITSIG) announced that it will hold FREE 1 day Insider Threat Symposium & Expo (ITS&E) on March 31, 2015 in Laurel, Maryland. The symposium is exclusively focused on insider threat awareness, insider threat program development and implementation and insider threat risk mitigation.The ITS&E will provide attendees with access to a broad network of security professionals to collaborate with on insider threat risks, insider threat detection, insider threat risk mitigation strategies and insider threat program development, implementation and management. The expo will include vendors that have proven technologies and services for insider threat risk mitigation