The CyberWire Daily Briefing 04.01.15

Cyber Attacks, Threats, and Vulnerabilities

Reconnaissance malware wave strikes energy sector (ZDNet) Symantec says a new Trojan-based campaign, focused on the Middle East, is targeting the energy industry and its trade secrets

New malware used to attack energy companies (IDG via Computerworld) The Trojan program is used for reconnaissance and distribution of additional malware, researchers from Symantec say

Lebanese cyberespionage campaign hits defense, telecom, media firms worldwide (CIO) For the past two years, a cyberespionage group that likely operates from Lebanon has hacked into hundreds of defense contractors, telecommunications operators, media groups and educational organizations from at least 10 countries

Volatile Cedar: Threat Intelligence and Research (Check Point) Beginning in late 2012, a carefully orchestrated attack campaign we call Volatile Cedar has been targeting individuals, companies and institutions worldwide. This campaign, led by a persistent attacker group, has successfully penetrated a large number of targets using various attack techniques, and specifically, a custom-made malware implant codenamed Explosive

Sinkholing Volatile Cedar DGA Infrastructure (SecureList) Victim spread contained within Lebanon

Two Cyber-Spying Groups Target Middle East Governments, Energy Firms (eWeek) Separate reports reveal details of two espionage networks focused on the Middle East, one aimed at gathering intelligence and the other focused on infecting energy firms

Evidence links China to GitHub cyber-attack (BBC) Internet users outside China are unwittingly participating in a long-running cyber-attack on the coding site GitHub, security experts have said

Security issue in fitness wristband, says Kaspersky researcher (Digital News Asia) Vulnerability discovered in the authentication method used in several smart wristbands. Allows third-party to connect invisibly to device, execute commands, and extract data

Fake "Urgent billing update" email leads to Virgin Media, Paypal phishing page (Help Net Security) Customers of UK-based telecom and ISP Virgin Media are being targeted with a clever spam campaign that is after their account information, but also PayPal account login details and payment card information

KnowBe4 Alert: New Ransomware Spear-Phish Uses Dropbox Attack (Business Solutions) Highly malicious strain found only takes 1 click to infect systems using DropBox

Hack Remote Windows PC using Adobe Flash Player Byte Array Uncompress via ZlibVariant Use after Free (Hacking Articles) This module exploits an use after free vulnerability in Adobe Flash Player. The vulnerability occurs in the Byte Array::Uncompress ViaZlibVariant method, when trying to uncompress () a malformed byte stream. This module has been tested successfully on Windows 7 SP1 (32 bits), IE 8 to IE 11 and Flash 16.0.0.287, 16.0.0.257 and 16.0.0.235

Half of companies under DDoS attack have critical data stolen (Help Net Security) Neustar surveyed IT professionals from across EMEA to understand the impact of DDoS attacks

Florida Department of State Exposes Voter Information (Softpedia) A total of 15 compact discs storing information about voters in Florida have been sent out by the Division of Elections to entities ordering them, leaving intact contact information that could be detrimental to their owners, if made public

Security Patches, Mitigations, and Software Updates

Mozilla Releases Security Updates for Firefox, Firefox ESR, and Thunderbird (US-CERT) The Mozilla Foundation has released security updates to address vulnerabilities in Firefox, Firefox ESR, and Thunderbird. Exploitation of one of these vulnerabilities may allow a remote attacker to take control of an affected system

Verizon Wireless Lets Customers Opt Out of Tracking 'Perma-Cookies' (MacRumors) Last year, Verizon and AT&T made headlines when researchers discovered they had been engaging in some unsavory customer tracking techniques, using unique identifier numbers or "perma-cookies" to track the websites that customers visited on their cellular devices to deliver targeted advertisements, a practice called "Relevant Advertising"

Cyber Trends

Law Firms: Cyber Criminals' Next Top Target? (Digital Guardian) Without breach notification requirements in place, it can be hard to gauge the popularity of law firms as targets for cyber criminals. But if recent findings are any indication, the legal industry may well be the next lowest hanging fruit for attackers

Top 6 Health Data Breaches for 2015 Involve Hacking (HealthITSecurity) We are just three months into 2015, and two large scale health data breaches have already taken place. The Anthem data breach affected approximately 78 million individuals, while Premera Blue Cross' incident could impact nearly 11 million members and applicants

Retailers' heavy handed fraud prevention leads to loss of sales (We Live Security) Online retailers battling with fraud prevention are losing out on genuine sales by treating their customers like criminals, according to a new report by ThreatMetrix

Negotiating with Cybercriminals: 30% of Security Professionals Say They Would Pay for the Return of Their Data (ThreatTrack) In weighing principle vs. negotiating with cybercriminals to recover stolen or encrypted data, 30% of U.S. security professionals have concluded that getting their data back is more important. Respondents at organizations already targeted by cyberextortionists are more than three times as likely to be willing to negotiate with cybercriminals and nearly twice as likely to recommend setting aside funds for that very purpose

Internet Security at risk as Hack Attacks on the rise: No Site Seems to be Safe Anymore (Empire State Tribune) The growing number of people capable of launching the recent spate of hacking on the IT systems of British Airways, Slack, Rutgers University and GitHub are all signs of the fast-changing nature of the Internet. Cyber security professionals fears that such occurrences may likely become more common in the coming years

Surprising Facts and Stats — Online Security (CloudTweaks) It's easy to get lulled into a false sense of security when browsing the web. As more and more devices join the internet of things, the risk of becoming a victim of a criminal cyber gang is increasing — we have more unsecured access points and offer would-be thieves more routes into our home networks

Wie sicher ist das Internet der Dinge? (PresseBox) G DATA Security-Evangelist Eddy Willems empfiehlt Herstellern engere Zusammenarbeit mit IT-Sicherheits-Branche

Securing Smart Cities a Work-in-Progress: Security Vendors (Channel World) It is important to understand and address vulnerabilities associated with IoT in its early stages as companies cannot fully rely on IoT vendors to patch vulnerabilities and protect against all attack vectors

Putting identity at the heart of security in 2015 (Information Security Buzz) Hans Zandbelt, Senior Technical Architect at Ping Identity, discusses the role identity will play in securing and enabling broader internet in 2015

RIP, "APT" (Waters Technology) Perhaps the greatest issue facing cyber security professionals in finance is cutting the wheat from the chaff when it comes to selecting providers and messaging. What happens when cyber — a real menace by all practical accounts — meets the dreaded hype cycle? Tim says it's already not pretty

Users care about privacy when they know what info is collected about them (Help Net Security) A recent study conducted by Carnegie Mellon and Notre Dame University researchers is calling attention to several interesting things

Organizations Changing Strategies and Tactics as Security Environment Gets More Complex, New CompTIA Study Finds (CompTIA) The growing proliferation and sophistication of hackers, combined with greater reliance on interconnected applications, devices and systems, has created a security environment that's challenging for even the best prepared organizations, according to new research released today by CompTIA, the IT industry association

Marketplace

As Internal Threats Rise, Investors Back New Security Tech (TechCrunch) On February 3, 2011, a little over two years before Edward Snowden would board his plane to Hong Kong and change history, a 37-year-old man named Jason Cornish fired what may have been the first shot in one of the new fronts of the battle for enterprise security

After Snowden, The NSA Faces Recruitment Challenge (NPR) Not many students have the cutting-edge cybersecurity skills the NSA needs, recruiters say. And these days industry is paying top dollar for talent. Daniel Swann is exactly the type of person the National Security Agency would love to have working for it. The 22-year-old is a fourth-year concurrent bachelor's-master's student at Johns Hopkins University with a bright future in cybersecurity

The Source: Can San Antonio Do More To Entice Cyber Security Jobs? (Texas Public Radio) A mad scramble to be the nation's hub for cyber security is going on right now between cities across the country. This hundred billion dollar a year industry is only growing, so where does San Antonio stand?

Why security disruptor Tanium aligned exclusively with Andreessen Horowitz (Fortune) The profitable, eight-year-old company just closed another $52 million round with the legendary VC firm — bringing the total to $142 million

Alibaba Invests in Israeli Cyber-Security (Jewish Voice) Chinese e-commerce company Alibaba Group has announced that it is investing in Jerusalem Venture Partners to work with Israeli cyber-security startups and protect itself from hackers. The news comes as Cybertech 2015, Israel's flagship international cyber-tech conference, kicks off in Tel Aviv

SRA to Acquire Qbase Government Services Business Assets (PRNewswire) Strengthens presence in health IT, homeland security, and law enforcement markets

ESI Group to Acquire the Assets of Picviz Labs, Specialist in Big-Data-Based Predictive Analysis Through Advanced Visualization (BusinessWire) Creation of a big data visual analysis platform to detect unknown operational problems

Honeywell opens US cyber security research lab (Hydrocarbon Processing) According to the US Department of Homeland Security's ICS-CERT, reported cyber incidents on industrial targets in 2014 continue to increase and are up more than 25% since 2011

Symantec Signs Multi-Megawatt Lease at Santa Clara Data Center (Data Center Knowledge) Vantage Data Centers has won a multi-megawatt deal with security-software powerhouse Symantec for its Santa Clara data center campus. This is the company's second lab customer in recent months but its first mixed-use infrastructure deal ever. Symantec will deploy both lab space and critical IT infrastructure at the facility

Perspecsys Announces Expansion into Germany (BusinessWire) Perspecsys, the leader in enterprise cloud data protection solutions, today announced it has extended its presence in Europe to Germany. The move will enable it to meet the rapid growth it is experiencing in the region

eMazzanti to Partner with PCI Security Standards Council to Improve Payment Data Security Worldwide (PRWeb) As Council's newest Participating Organization eMazzanti Technologies to contribute to the development of PCI Security Standards

Chertoff Group Principal Jim Pflaging Joins the AdaptiveMobile Board of Directors (BusinessWire) Seasoned executive has deep expertise in the security and enterprise markets

Napatech Welcomes New SVPs to Meet Global Expansion Goals (PRNewswire) To improve its sales and marketing capabilities by creating a strong commercial focus, Napatech (OSE: NAPA) today announced the hire of two new senior vice presidents. Walther Johannessen has been selected for the role of SVP of Global Marketing, and Andrew Patterson will serve as SVP of Global Sales

Molson Coors Chief Information Security Officer (CISO) Joins Security Current's Team of Leading Industry Experts (PRNewswire) Christine Vanderpool to offer insight and guidance on today's top cyber security concerns

SANS Instructor, Ed Skoudis, Awarded the Order of Thor Medal at the Army Cyber Institute (PRNewswire) SANS Institute, the global leader in information security training, today announced SANS Instructor and NetWars CyberCity Director, Ed Skoudis, has been inducted into the Military Cyber Professionals Association's Order of Thor. This prestigious award was presented to Mr. Skoudis by Col. Gregory Conti, Army Cyber Institute director in honor of Mr. Skoudis' contributions in preparing the next generation of military cyber professionals

Products, Services, and Solutions

Resistance to DCGS-A persists (GCN) The Army's main intelligence gathering component, the Distributed Common Ground System, continues to face criticism among lawmakers and members of the military

Verizon, Deloitte Team on CyberSecurity (Light Reading) With data breaches and other cyber incidents becoming more frequent, costly and destructive, Deloitte and Verizon Enterprise Solutions today announced a strategic alliance to deliver a comprehensive set of security and risk-management solutions to help businesses prepare, respond and recover more efficiently, effectively and thoroughly when a cyberattack occurs

Palo Alto expands VMware alliance, launches new service (Seeking Alpha) In the wake of yesterday's analyst day, Palo Alto Networks (NYSE:PANW) has announced it's expanding its partnership with server virtualization kingpin VMware (NYSE:VMW) to cover mobile security

CipherCloud Acquires Cloud Security Analytics Technology (PRNewswire) Incorporates advanced cloud risk rating and real-time detection capabilities to enhance its cloud security platform

Thales launches BYOK Deployment Service for Microsoft Azure Cloud Applications (Realwire) Unique bring your own key capability enables you to have total control over your keys and sensitive data in the Azure Cloud

Security Mentor and Center for Internet Security Partner to Satisfy State and Local Government Security Awareness Training Requirements (Midland Daily News) Security Mentor makes its award-winning security awareness training program affordable for SLTT government entities through Center for Internet Security's purchasing alliance program

Securing Portable Devices and Sensitive Data in Healthcare (Tenable) The high-profile healthcare breaches this year alone, as well as the growth of the lucrative market for healthcare information ("over $500 for a complete dossier"), are a testament that current security processes and solutions require a re-evaluation

Sophos uncovers sophisticated approach to business security (Reseller News) Operating at the heart of the complicated world of security, one overriding philosophy reins supreme — "You don't fix complexity with more complexity"

Amid growing SSL concerns, Qualys expands free public SSL tester (TechTarget) Qualys has added a free, public API to its SSL testing services, which will enable an enterprise to test any website or server for SSL vulnerabilities

Palo Alto Networks Unveils AutoFocus Cyber Threat Intelligence Service (MarketWatch) Delivers actionable intelligence to help customers take quick, definitive and preventive action against targeted cyber threats

Wombat Security Technologies Unveils New Security Awareness and Training Modules to Help Protect Companies Against Advanced Cyber Threats (MarketWired) Wombat's new Security Essentials and Mobile Device Training Modules as well as all training modules are now available in Russian and Dutch

Bitdefender Wins Perfect Score from AV-TEST for Both Consumer and Business Solutions (BusinessWire) Bitdefender Internet Security, Bitdefender Endpoint Security excel in performance, protection and usability

Bitdefender Antivirus mobile security for android phones download (The REM) Mobile phone users always have this fear in their minds that their data might be at risk

SAFE Block Win8 (Forensic Magazine) Today, ForensicSoft releases its latest versions of its write-blocking product SAFE Block, now available for Microsoft's Windows 8 operating system

Pentagon Personnel Now Talking on 'Nsa-Proof' Smartphones (Nextgov) The Defense Department has rolled out supersecret smartphones for work and maybe play, made by anti-government-surveillance firm Silent Circle, according to company officials

Technologies, Techniques, and Standards

Ponemon security survey finds threat intelligence is woefully underused (Silicon Angle) Knowing the enemy has always been important to winning battles, but gaining the right insight at the right time is much easier said than done in the fight against hackers. A new survey of the organizations on the front lines by the Ponemon Institute reveals that there is still a lot of room for improvement

The Importance of Cyber Threat Intelligence to a Strong Security Posture (Ponemon Institute) Does access to timely, accurate and actionable cyber threat intelligence make a difference in blocking or preventing external attacks? Are companies using cyber threat intelligence effectively to make informed decisions about how to respond to a menace or hazard?

Incident Response: Failure to Plan is a Plan to Fail (Dark Matters) I've been thinking a lot about the last several "panic patch" cycles. You know, Heartbleed, Bash bug and others which became nightmares for security organizations due to the pervasiveness of the issues and the fact that security teams simply didn't know the extend of the potential damage

Cyber-Security Teams: No Rest for the Wary (Baseline) Today's IT security teams face a constant and evolving barrage of threats that force them to assess their security policies and procedures on an ongoing basis

The Clinton email brouhaha and information governance (TechTarget) Hillary Clinton's use of a personal email account raises information governance issues that need to be addressed

How hard is it to permanently delete data? (GCN via Forensics Magazine) The controversy surrounding former Secretary of State Hillary Clinton's email has brought data destruction to the forefront of the national conversation. Clinton used a server housed at her New York residence for her personal and official emails and online communications while she was at Foggy Bottom Lawmakers investigating the 2012 death of an ambassador in Libya have been concerned that official government emails from Clinton that might assist in the investigation were deleted despite assurances from Clinton that she turned over all emails pertaining to government work to the State Department

PCI Compliance: What It Means to Your Digital Security (Business.com) Given the internet data breach culture we've been indoctrinated into over the past few years, I need not tell you that PCI compliance is a hot issue in the world of credit card processing

Corporate Security Checklist — a CEO's Guide to Cyber Security (Heimdal Blog) Have you ever wondered if you, as a manager, CEO or investor are prepared to deal with a cyber security failure in your organization? Are there all the necessary systems in place? Do you have enough resources and is there enough careful planning to keep any attack from interrupting your company's activity and causing it financial or reputation damage?

Six ways to backup your data (We Live Security) Today is World Backup Day, and it goes without saying that backing up data is a thoroughly sensible thing to routinely get into the habit of doing

Design and Innovation

Deconstruct websites, get hired: hiding recruitment messages in source code (Troy Hunt) The other day I did a security workshop at a firm here in Sydney and one of the things we did was a proxy a bunch of traffic and inspect what was going on behind the scenes. Among the expected hilarity that always ensues from these sorts of exercises (you can find heaps more of this in my Hack Your API First course), one of the guys at the event found this in the response headers of Airbnb

Research and Development

Quantum-Safe Cryptography. What is it and why should you care? (ID Quantique) Mankind's demand for faster, more powerful computers shows no signs of abating. The rise and rise of big data applications begets faster computers and Moore's Law seems as valid an observation now as it was fifty years ago

Legislation, Policy, and Regulation

S. Korea creates cyber-security post to counter North's threat (Agence France-Presse via the Jakarta Post) Concerned by the growing threat of cyber-attacks from North Korea, South Korea's cabinet on Tuesday approved the creation of a new presidential post handling cyber-security

Taiwan: Reinforcement of Cyber Security New Priority (Unrepresented Nations and Peoples Organization) Taiwan has expressed willingness to strengthen its cyber security ties with the United States. On 30 March 2015 Vice Premier Simon Chang mentioned Taiwan's desire to be included in the biennial US Cyber Storm drill, as Taiwanese systems are constantly being targeted by Chinese hackers accused of committing cyber theft

Obama declares cyberattacks a 'national emergency' (The Hill) President Obama declared Wednesday that the rising number of cyberattacks against the United States is a national emergency, and issued an executive order that would sanction those behind the attacks

U.S. establishes sanctions program to combat cyberattacks, cyberspying (Washington Post) President Obama on Wednesday signed an executive order establishing the first sanctions program to allow the administration to impose penalties on individuals overseas who engage in destructive attacks or commercial espionage in cyberspace

"We can't address cyber threats in isolation", chief lawyers of top companies agree (Forbes) As the frequency and severity of cyber attacks accelerate, both the government and the business community are increasingly willing to acknowledge that they are not in a position to tackle these threats alone. The need for collaboration between government and industry to enhance cyber resilience was emphasized by President Obama at a recent cybersecurity summit and echoed by leaders in the business and non-profit sectors

Air Force stands up Task Force Cyber Secure (AFNS) Chief of Staff of the Air Force General Mark A. Welsh III signed a memorandum on March 20, establishing Task Force Cyber Secure, to address challenges of the cyberspace domain in synchronization, operations and governance within the Air Force and with those organizations it supports

Rapid-Equipping, Asymmetric Groups To Remain (Defense News) Two organizations built for the wars in Iraq and Afghanistan — the Rapid Equipping Force (REF) and the Asymmetric Warfare Group (AWG) — will not fold, but instead endure as part of the Army's Training and Doctrine Command (TRADOC)

Litigation, Investigation, and Law Enforcement

5 Breach Lawsuits Filed Against Premera (HealthcareInfoSecurity) Meanwhile, health insurer provides answers to Congress

Premera lawsuits prolong cybersecurity nightmare (FierceHealthIT) Premera CEO Jeffery Roe: 'Exfiltration of information from systems' has not been found

MasterCard Says Nike Reconfigured Its Network Using 'Confidential Information' (Wall Street Journal) MasterCard International Inc.MA -1.46% filed new charges in its breach of contract lawsuit against Nike Inc.NKE -0.56% and two former information security employees, claiming ongoing IT damage at the credit card company

Feds subpoena Reddit for personal info of dark web forum members (Naked Security) US federal agents want Reddit to rat out five prominent Redditors active in the 'Darknet Markets' subreddit

For a complete running list of events, please visit the Event Tracker.

Newly Noted Events

Michgan InfraGard 2015 Great Lakes Regional Conference: Securing Our Critical Infrastructures (Novi, Michigan, USA, May 14, 2015) Learn all about the risks to critical infrastructures and key resources and the efforts underway to protect them. Private and public sectors will be represented. The conference will include four breakout sessions with numerous experts in the field of securing our critical infrastructures, with topics covering modern day malware and the security architecture to stop it, critical security controls for financial services and plant floor security. Thought-provoking topics will be covered including how overlooking basic security steps can cost you more, the US cybersecurity framework, challenges from new developments in the domain name system, post incident forensic analysis of a social pivoting attack, and more to come

VB2015 (Prague, Czech Republic, Sep 30 - Oct 2, 2015) The VB2015 programme includes 38 papers on a wide range of security topics. As in previous years, the presentations will run in two parallel streams and the programme includes both technical and less technical presentations. Just a small selection of the many highlights includes: "Attack on the drones: security vulnerabilities of unmanned aerial vehicles" (Oleg Petrovsky), "How malware eats cookies" (Zhaoyan Xu, Wei Xu), "The Unbearable Lightness of APTing" (Yaniv Balmas, Ron Davidson, Shahar Tal), "The Kobayashi Maru dilemma" (Morton Swimmer, Nick FitzGerald, Andrew Lee), "DDoS trojan: a malicious concept that conquered the ELF format" (Peter Kalnai, Jaromir Horejsi), "POS fraud: trends and counter-actions to mass fraud" (Ken Dunham), and "The elephant in the room" (Marion Marschalek). This year's conference will include two keynote speakers — one at the opening of the conference and one at the very end. The programme will also include a number of added extras

Upcoming Events

Automotive Cyber Security Summit (Detroit, Michigan, USA, Mar 30 - Apr 1, 2015) The debut Automotive Cyber Security Summit will bring together CTOs, CSOs, Engineers and IT professionals from GM, KIA, Nissan, Bosch, Qualcomm and more for three days of case studies, workshops, panel discussions and networking sessions

Kansas City Secure World (Kansas City, Missouri, USA, Apr 1, 2015) Join your fellow security professional for affordable, high-quality cybersecurity training and education at a regional conference near you. Earn CPE credits while learning from nationally recognized industry experts on many diverse topics such as: Risk Mitigation, Malware Detection, Digital Forensics, Cloud Security, Privacy, Big Data, PCI Compliance, Security Metrics, Encryption, Mobile Device Management, Incident Response, and much more. James Beeson (CISO, GE Capital Americas) will deliver the keynote

Cyber Insurance and Corporate Governance: Facing New Threats (Brooklyn, New York, USA, Apr 2, 2015) Peter D. Hancock, president and CEO of AIG, will lead a discussion of the ways in which the insurance industry is adapting to account for threats to the most valuable — and vulnerable — assets companies around the world possess: intellectual property and, in many cases, the sensitive personal information of millions

Coast Guard Intelligence Industry Day (Chantilly, Virginia, USA, Apr 2, 2015) With a blended focus of defense, homeland security, law enforcement, criminal investigations, intelligence and cyber issues, Coast Guard Intelligence is aggressively looking to collaborate with partners and stakeholders in support of mission of execution. This event will be Coast Guard Intelligence's most significant and inclusive outreach event of the year.

Centers for Medicare and Medicaid Services (CMS) CISO Security & Privacy Forum (Woodlawn, Maryland, USA, Apr 7, 2015) The CISO Security & Privacy Forum is hosted by the Information Security Privacy Group (ISPG) at CMS. The Vision for ISPG is to provide leadership to CMS in managing information security and privacy risks appropriate for evolving cyber threats. The Mission is to enable the safe use of sensitive and privacy data while servicing the healthcare needs of the nation. The format for this event will include briefings from government and industry. Our featured speaker is from the Interagency OPSEC Support Staff and will present on "TRASHINT: Dumpster Diving", a very popular topic which teaches attendees how one person's trash can be another person's treasure

10th Annual Cyber and Information Security Research Conference (Oak Ridge, Tennessee, USA, Apr 7 - 9, 2015) Cyberspace is fundamental to our national prosperity, as it has become critical to commerce, research, education, and government. Realizing the benefits of this shared environment requires that we are able to properly balance the risks and rewards, understand and communicate threats to security and privacy, and rapidly adapt any resulting approach to a changing adversarial environment. The 10th Annual Cyber and Information Security Research Conference at Oak Ridge National Laboratory in Oak Ridge, Tennessee will bring together cyber security researchers, program managers, decision makers, security vendors, and practitioners to discuss many challenging tasks and novel solutions pertaining to cyber security

Cyber Risk Wednesday: The future of Iranian cyber threat (Washington, DC, USA, Apr 8, 2015) Join the Atlantic Council's Cyber Statecraft Initiative on April 8, from 4:00 p.m. to 5:30 p.m. for a panel discussion on the Iranian cyber threat and the potential for a drastic escalation of cyber conflicts between Iran and the West. Few other events have so far dominated 2015 as the P5+1 negotiations to limit Iranian nuclear capabilities. Against the backdrop of the negotiations, it is likely that Iran, Israel, and the United States are gathering their strength for a renewal of cyber conflict of the past several years. The confrontations include attacks both from Iran, such as disruption of the US banking sector and against Gulf energy companies, and against Iran, such as Stuxnet and the Wiper worm. Should the talks fail, what are the chances of an escalating cyber conflict?

Cyber Threats Masterclass (Turin, Italy, Apr 9 - 11, 2015) The United Nations Interregional Crime and Justice Research Institute (UNICRI) is organizing two new courses on emerging threats towards states and citizens with the aim of promoting an in-depth knowledge of specific issues such as cyber crimes and crimes against the environment. The courses are tailored to journalists and chief information officers, as well as those who want to specialize in this area, offering a unique opportunity to network with renowned international experts

InfoSec Southwest 2015 (Austin, Texas, USA, Apr 10 - 12, 2015) InfoSec Southwest is an annual information security and hacking conference held in Austin, Texas, one of the most interesting and beautiful cities in the United States. By addressing a broad scope of subject-matter, InfoSec Southwest is intended to both provide a comprehensive and valuable forum to all participants as well as fill a gap for our local attendees left by the other few conferences held here in Texas which are all focused on a narrower scope of subject matter or a narrower slice of audience demographic

Cybergamut Tech Tuesday: Tor and the Deep Dark Web (Elkridge, Maryland, USA, Apr 14, 2015) This talk will explore the use of Tor and how it relates to garnering useful intelligence. Distinguishing attribution or valuable intelligence from limited event data is difficult. Leveraging external threat data can be helpful in evaluating intelligence but how do you identify relevance? Created as a means of protecting the privacy and anonymity of its users, Tor — the managed network of private computers leveraged by criminal elements to minimize the risk of surveillance and capture — is being exploited by the most technically proficient, aggressive, and organized of criminal syndicates

NIST IT Security Day (Gaithersburg, Maryland, USA, Apr 8, 2014) The Office of the Chief Information Officer, OCIO, is hosting NIST IT Security Day as a means to heighten awareness for all NIST users on the many aspects of operational information technology security and networking at home and in the office. This event's objective is to educate users on IT security and related topics. The event will feature guest speakers on general and technical IT security topics and tutorials on internal services and products.

Cyber Security Summit: Industrial Sector & Governments (Prague, Czech Republic, Apr 14 - 15, 2015) Cyber Security Summit Europe — Industrial Sector & Governments brings together cyber security experts who will share their skills and know-how needed to address highly topical issues such as state-sponsored cyber-attacks and SCADA Security Assessment

Cyber Security Summit: Financial Services (Prague, Czech Republic, Apr 14 - 15, 2015) Cyber Security Summit Europe — Financial Services brings together cyber security experts across the financial sector to discuss topical security vulnerabilities as well as bring forward effective strategies and solutions to effectively mitigate them

INTERPOL World 2015 (Singapore, Apr 14 - 16, 2015) INTERPOL World is a new biennial international security trade event which will bring police and other law enforcement agencies together with security solution providers and security professionals from around the world to identify future challenges and propose and build innovative solutions

Mid-Atlantic ISSA Security Conference 2015 (Gaithersburg, Maryland, USA, Apr 15, 2015) Meeting at the NIST campus, this all-day event, jointly hosted by the ISSA Baltimore, DC, and Northern Virginia chapters, will have 3 concurrent tracks of security professionals discussing the current state of various information security topics. The cost is $150 per person, including breakfast and lunch; pre-registration is required in order to get onto the NIST campus

Symantec Government Symposium: Secure Government: Manage, Mitigate, Mobilize (Washington, DC, USA, Apr 15, 2015) The annual Symantec Government Symposium is a one-day event attracting 1,500 government IT security and management professionals. The event is designed to facilitate peer-to-peer dialogue on the challenges facing today's government leaders. This year, former FBI Director Robert Mueller will deliver the keynote address, and the program will also feature sessions on CDM, risk management, security intelligence, secure app management, cyber legislative priorities, and much more. The theme of the 2015 Symposium is "Secure Government: Manage, Mitigate, Mobilize"

Proposer's Day Conference for the Scientific advances to Continuous Insider Threat Evaluation (SCITE) program (Washington, DC, area, Apr 16, 2015) The Intelligence Advanced Research Projects Activity (IARPA) will host a Proposers' Day conference for the Scientific advances to Continuous Insider Threat Evaluation (SCITE) program, in anticipation of the release of a new solicitation in support of the program. The purpose of the conference will be to provide introductory information on SCITE and the research problems that the program aims to address, to respond to questions from potential proposers, and to provide a forum for potential proposers to present their capabilities and identify potential team partners

IIT Cyber Forensics and Security Conference and Expo (Wheaton, Illinois, USA, Apr 17, 2015) All are invited to participate in this multi-track, technical conference that attracts more than 200 professionals, 50 speakers, 20 sponsors, for an intensive one and a half day schedule that includes discussion and debate over forensics, security, data/information governance, cyber crime and security, ethical hacking, eDiscovery, cloud forensics, steganography, policy and compliance, privacy, wireless security, cloud computing, identity theft, and more

RSA Conference 2015 (San Francisco, California, USA, Apr 20 - 24, 2015) Don't miss this opportunity to join thousands of industry professionals at the premier information security event of 2015

Australian Cyber Security Centre Conference (Canberra, Australia, Apr 22 - 23, 2015) The Australian Cyber Security Centre (ACSC) will be hosting its first cyber security conference in 2015. We are bringing leading cyber security experts from Australia and abroad to share their expertise. This will be your first chance to experience the unique collaboration of the ACSC. Over 700 attendees from the national and international ICT community are expected to attend

Security Forum 2015 (Hagenberg im Mühlkreis, Austria, Apr 22 - 23, 2015) The Security Forum is the annual IT security conference in Hagenberg that addresses current issues in this domain. Visitors are offered technical as well as management-oriented talks by representatives of business, research and public service

CyberTexas / CyberIOT (San Antonio, Texas, USA, Apr 23 - 24, 2015) CyberIOT — Securing the Internet of Things. As more everyday devices become connected to the internet, the need for securing those items becomes critical. CyberTexas will explore the intersection of cyber security and the internet of things'

Defensive Cyberspace Operations & Intelligence Conference & Exhibition (Washington, DC, USA, Apr 27 - 28, 2015) The 5th Annual Defensive Cyberspace Operations & Intelligence (DCOI) conference & exhibition is an Israeli-American partnership promoting the extraordinary developments in the technological, intelligence and policy-making domains of cyberspace. It will be held on April 27-28; the first day will consist of panels and exhibition at the Ronald Reagan Building and International Trade Center, and the second will hold workshops, exhibition and seminars at the George Washington University

INTEROP Las Vegas (Las Vegas, Nevada, USA, Apr 27 - May 1, 2015) Attend Interop Las Vegas, the leading independent technology conference and expo designed to inspire, inform, and connect the world's IT community. In 2015, look for all new programs, networking opportunities, and classes that will help you set your organization's IT action plan

2015 Synergy Forum (Tysons Corner, Virginia, USA, Apr 30, 2015) The 2015 Synergy Forum brings together government and industry practitioners driving our collective technology futures. This event is multi-disciplinary, examining the emerging fusion of physical and digital worlds. The event topics include: Big Data, Cyber Security, Internet of Things, Mobility, Strategy and Technology. Attending this event would be beneficial to: Policy-makers, architects, program managers, influencers in the federal government and the most forward thinking engineers, architects and innovators in the DC ecosystem