The CyberWire Daily Briefing 05.05.15

Cyber Attacks, Threats, and Vulnerabilities

IS says it was behind US Prophet cartoon attack (BBC) Islamic State (IS) has said that it was behind the attack on a Prophet Muhammad cartoon contest in the US state of Texas

'Hacktivists' from around the world take to social media to stir Baltimore unrest (Baltimore Sun) After riots overtook West Baltimore on Monday, a hashtag began to appear on Twitter and other social media — #BALTIMORELOOTCREW — linking together posts that depicted pilfered prescription drugs and demolished store shelves.

Hackers Leak Baltimore Police Data (Softpedia) The recent manifestations in Baltimore against the police department have been noticed by hackers operating under the "Anonymous" banner, who sided with the protesters and disclosed to the public some information belonging to the law enforcement organization

Twitter data show that a few powerful users can control the conversation (Quartz) Twitter advocates like to talk about how Twitter gives everyone a voice. But we should have no illusions that all voices are equal

Police arrest Virginia Tech student over Yik Yak threat (Naked Security) This is the threat that appeared over anonymous messaging app Yik Yak last Tuesday night, 28 April

Macro Malware: When Old Tricks Still Work, Part 1 (TrendLabs Security Intelligence Blog) Now comes a time when we are reminded of why this security warning prompt in Microsoft Word matters

Upatre/Dyre — the daily grind of botnet-based malspam (Internet Storm Center) Malicious spam (malspam) delivering Upatre/Dyre has been an ongoing issue for quite some time. Many organizations have posted articles about this malware. I've read good information on Dyre last year and this year

Super secretive malware wipes hard drive to prevent analysis (Ars Technica) Rombertik will go to great lengths to keep its private parts private

Rombertik Malware Can Overwrite MBR if Audited (Threatpost) A new strain of spyware that logs keystrokes and steals data has a destructive side to it, unleashing wiper capabilities if it detects it's being analyzed and audited

USBKill used to wipe clean criminal's PCs (Security Affairs) Criminals, activists, and whistleblowers have a new weapon dubbed USBKill in their arsenal to shut down laptops before the police start examining them

A peek inside the cybercriminal's toolkit (TechCentral) From advanced persistent threats to spear fishing and zero-day exploits, these are the ways cybercriminals and rogue governments compromise user security and hack into vulnerable computer systems

The Unsettling Rise Of Crypto-Ransomware (BuzzFeedNews) It's a form of hacking that has proliferated so greatly because it requires scant technical expertise

Mind-reading hackers are stealing your data (IT Pro) Mentalist Drew McAdam says that security experts are overlooking the human factor

Mobile ransomware targets Canadian porn viewers (CSO) The latest variety of the Koler Android ransomware shows a warning message from the RCMP

Airworthiness Directives: The Boeing Company Airplanes (Federal Aviation Administration) We are adopting a new airworthiness directive (AD) for all The Boeing Company Model 787 airplanes. This AD requires a repetitive maintenance task for electrical power deactivation on Model 787 airplanes. This AD was prompted by the determination that a Model 787 airplane that has been powered continuously for 248 days can lose all alternating current (AC) electrical power due to the generator control units (GCUs) simultaneously going into failsafe mode. This condition is caused by a software counter internal to the GCUs that will overflow after 248 days of continuous power. We are issuing this AD to prevent loss of all AC electrical power, which could result in loss of control of the airplane

Bugs in the hospital: how to pwn your own pethidine machine (Naked Security) Naked Security reader Ethan alerted us to a disappointing bug that was recently logged in NVD, the US National Vulnerability Database

Free Android Apps Secretly Talk To Ad, Tracking Sites (Dark Reading) Researchers are warning about misleading Google Play app behaviors and are calling for more visibility into Android applications' connection policies

Sally Beauty Card Breach, Part Deux? (KrebsOnSecurity) For the second time in a year, nationwide beauty products chain Sally Beauty Holdings Inc. says it is investigating reports of unusual credit and debit card activity at some of its U.S. stores

EllisLab servers breached by hackers wielding stolen admin password (Help Net Security) EllisLab, the company behind the popular ExpressionEngine CMS, has suffered a breach after hackers managed to gain unauthorized access to its servers

Uber USA Customers Hacked — Change Your Username And Password ASAP (HackRead) In March, Motherboard reported Uber accounts had been stolen by hackers who were selling them on public forums for as low as $1. Now another report by the board claims that Uber has been hacked again, but this time the affected users are American citizens

Las Vegas' Hard Rock casino hit by carders (Help Net Security) Las Vegas' popular Hard Rock Hotel and Casino has been hit by carders, who took off with names, card numbers, expiration dates, and CVV codes (but not PIN numbers or other information) of customers who used their payment cards at several locations within the property

Statement (Hard Rock Hotel and Casino) The trust and loyalty of our customers is our highest priority, which is why, as a precautionary measure, we are writing to let you know of a security incident that may have affected your credit card information

Hackers blamed for Bridezilla post on photographer’s Facebook page (We Live Security) It's supposed to be the greatest day of every woman's life

Security Patches, Mitigations, and Software Updates

Google Patches Clickjacking Bug (Threatpost) Google has patched a clickjacking vulnerability that a researcher says would enable an attacker to retrieve or delete email conversations, manipulate YouTube and Google Plus accounts, and more

Cyber Trends

76 Percent of Organizations Breached in 2014 (eSecurity Planet) QuinStreet Enterprise research outlines the scope of security challenges facing enterprises today

Phishing, hacking remain top tools for cybercriminals (Arizona Republic) A few weeks ago, I wrote that most security breaches involve social engineering and human error. We need to add a growing threat to that list: Unsuspecting employees releasing information or giving access to an organization's data after being fooled by cyber con artists

Global Encryption Trends Report — key management pain bites as encryption usage soars (Information Security Buzz) Our Global Encryption and Key Management Trends report is now in its tenth year, providing an annual 'pulse check' on enterprise approach to and deployment of encryption techniques. The picture across the board is clear — use of encryption is growing across all industries

Hybrid Cloud Adoption is Making Security Operations More Difficult (Information Secuirty Buzz) 3 in 5 respondents feel cloud technology has made their job more difficult than it was two years ago

The Case for Visibility: SANS 2nd Annual Survey on the State of Endpoint Risk and Security (SANS Institute) Read the results of the 2015 Endpoint Security Survey to find out whether organizations assume risk, whether their perimeter defenses protect their endpoints, how much progress we are making on automation, how long it takes to remediate each compromised endpoint, and much more

Are we surrendering the cyberwar? (Computerworld) I ran across a link sent via a Twitter user the other day, quoting NIST fellow Ron Ross as saying, "The interconnectivity of the Internet of Things (IoT) leaves public and private computer systems essentially indefensible, and no amount of security guidance can provide salvation." I confess that this comment set me off a bit, as it sounds like we are prematurely raising the white flag of surrender in the cyber war

Securing the smart grid: European Network of Cyber Security (Help Net Security) Dr. Klaus Kursawe is the Chief Scientist at the European Network of Cyber Security (ENCS), where he is leading the research and development activities for critical infrastructure security. In this interview he talks about the challenges related to smart grid security

Marketplace

How fear and self-preservation are driving a cyber arms race (CNET) Silicon Valley is pouring more money into Internet security companies than ever before

A Cyber Attack Could Cost a Business Its Investor Backing (CFO Innovation) A cyber attack could cost a business its investor backing, according to a survey of Global Institutional Investors by KPMG

Security Product Liability Protections Emerge (Dark Reading) WhiteHat Security, FireEye each offer product liability protections to their customers

FireEye offers new details on customer liability shields under the SAFETY Act (CSO) FireEye's external counsel offers additional insight into what the SAFETY Act means for customers

GSA Unveils STARS II 'Open Season' Schedule for Small Businesses (GovConWire) The General Services Administration is seeking proposals from small businesses for the open season of the 8(a) Streamlined Technology Acquisition Resources for Services II contract during the option period from Aug. 31, 2016 to Aug. 30, 2021

Rapid7 Picks Up NTObjectives (Dark Reading) Adds 25 new employees and further diversifies testing capabilities

Rome tech company acquires DC-area firm (Utica Observer-Dispatch) Assured Information Security Inc. has completed its acquisition of a Washington DC-area technology firm

SAIC Completes Acquisition of Scitor (PRNewswire) Two highly complementary companies join to provide increased opportunities for customers

CyberUnited, LIFARS Form Security Joint Venture (eWeek) The new entity will utilize continuous monitoring through products and services designed to help organizations reduce their chances of being attacked

The 3 Best Stocks to Invest in Cybersecurity (Motley Fool) Unfortunately, cyber crime isn't going away. Hacking scandals have become an almost regular occurrence for public companies, devastating the shares of those unfortunate enough to find themselves the victims of a major data breach

One Reason FireEye Can Still Move Higher (Seeking Alpha) FEYE is considered too expensive for many. After its first quarter report, investors should be more confident than ever that long-term growth is likely. Given PANW's valuation, FEYE's outlook, it is very possible that FEYE trade higher by 80% to 100% over the next year

INTERNET: Qihoo Gets Global Snub For Misleading Ways (Seeking Alpha) Bottom line: The revocation of global certification for Qihoo's security software by 3 European bodies will undermine the company's credibility and hamper its drive to go global, putting pressure on its stock for the next few months

Fidelis Cybersecurity Poised for Next Phase of Growth in Advanced Threat Defense Market, Estimated to Reach Nearly $1 Billion in 2016 (Fidelis) Fidelis Cybersecurity becomes an independent company

Hexis Cyber Solutions Named a "Cool Vendor" by Gartner (Nasdaq) Vendors selected for the "Cool Vendor" report are innovative, impactful and intriguing

Resilient Systems Builds The First Platform For Security Response Management (Forbes) "The premise of Resilient is pretty straightforward. Good security is all about the balance of three things, prevention, detection and response. One tries to stop bad things from happening. Then you want to detect them when they do and having detected them then you need to take care of them," says cyber security software firm Resilient Systems' co-founder and CEO, John Bruce

Engility, Vencore Among 2015 Corporate Growth Awards Winners for Washington M&A Deals (GovConExecutive) Engility, Vencore, Maximus and Raytheon are among the 2015 winners of ACG National Capital?s annual Corporate Growth Awards for mergers and acquisitions and other strategic corporate deals for companies with a presence in the Washington metropolitan area

Microsoft picks security for the enterprise win (IDG via CSO) Microsoft is betting that good security support will be key to keeping its enterprise customers from straying to rivals

Cisco names Chuck Robbins, key player in Sourcefire acquisition, as CEO (Baltimore Business Journal) Cisco Systems named Chuck Robbins as John Chambers' successor as CEO, effective at the end of July

Products, Services, and Solutions

Microsoft bangs the cybersecurity drum with Advanced Threat Analytics (Ars Technica) Redmond also introduces new ways to stop data leaks

Netflix Releases FIDO Incident Response Tool (Threatpost) Engineers at Netflix have released another one of the company's bespoke security tools as an open-source application, this time an incident-response system known as FIDO

Social Media, Context and the New Face of Threat Intelligence (TechZone 360) Conventional network defense tools such as intrusion detection systems and anti-virus focus on the vulnerability component of risk, with incident response falling squarely in the "reactive" camp — protective steps are taken only after an incident has taken place. But new advances in threat intelligence and correlation are looking to support a more rapid response and predictive defense

Safe Systems Unveils Cloud-Based Security Service (Credit Union Times) The Alpharetta, Ga.-based Safe Systems has announced that its NetComply+ solution, a cloud-based toolset for managing and monitoring credit unions' growth, compliance demands and security requirements from a central location, is now available

RiskIQ Helps Facebook Maintain a Safe Environment (Yahoo! Finance) Protects more than one billion users from malicious ads

Technologies, Techniques, and Standards

Quietly Mapping the Network Attack Surface (HackerTarget) When assessing the network security of an organization it is important to understand the breadth of the attack surface. A single forgotten host or web application in the network will often become the initial foothold for an attacker

National Small Business Week: a cybersecurity survival guide (We Live Security) In many ways, small businesses are the powerhouse of the U.S. economy, a reality celebrated this week by a series of events, online and offline, coordinated as part of National Small Business Week

An exit interview with Jeremy Grant, NSTIC director and NIST's lead on digital identity (FierceGovernmentIT) Jeremy Grant left the National Institute of Standards and Technology April 30 after spending the last four years leading an effort to improve digital identity management nationwide

Social threat intelligence (Help Net Security) There's been an explosion of companies that realized threat intelligence was the next frontier

What Small Businesses Need to Know about POS Systems (Business2Community) Point-of-sale (POS) systems are making headlines after four different POS providers suffered data breaches in the past year — exposing customer information at a variety of small businesses

HIPAA Security Rule — Demystified (InsuranceNewsNet) Fines under the Health Insurance Portability and Accountability Act (HIPAA) are formulaic, with little room for discretion, so a small medical office can suffer similar consequences as a large hospital if a breach has occurred

Compliance With Health Insurance Portability and Accountability Act (HIPAA) Security Rules (ThreatBrief) HIPAA was enacted in 1996, and by April 2005 security standards were required to be in place for most covered entities. In 2013 key portions of this law were updated. This post provides an overview of key elements we believe security and technology professionals (and most citizens) should be tracking

3 Challenges to a Consistent Data Incident Response (Health Data Management) Information security vendor ID Experts, which also offers breach remediation services, notes that the 2014 Verizon Data Breach Investigations Report cited 63,437 security incidents from just 50 organizations. That is 1,268 incidents per organization per year

Building a Stronger Security Strategy: 6 Tips (Dark Reading) CIO offers his formula for achieving the right balance between data security and employee productivity and convenience

Defenses Outside the Wall (Dark Reading) Protecting the Internet of Things means protecting the privacy of customers and colleagues

Design and Innovation

Adrian Ludwig Talks About Improving Android Security (Android Headlines) Android has had a rather dark past regarding its reputation with security. Malware was supposedly spreading like wild-fire on phones, and privacy was virtually non-existent. Naturally, a ginormous company like Google wasn't going to let allegations like this just slide

Legislation, Policy, and Regulation

Cyber Crime Attracts New Life Sentence in the UK (WillisWire) Any doubts that the UK Government may not be taking cyber-crime seriously enough should have been dispelled on May 3rd 2015 when an amendment to the Computer Misuse Act 1990 comes into force for the first time. For serious computer-related crime, life imprisonment is now a possibility. A new criminal offence has been created, which includes a number of interesting features

Five dangers of France's new snooping laws (The Local (French Edition)) French MPs are set to overwhelmingly give their backing to a bill that will grant intelligence services sweeping new surveillance powers in the name of fighting terrorism. Here's five reasons why opponents of the bill say we should all be concerned

Under-fire German spy chief says his agency not a 'US tool' (San Diego Union-Tribune) Germany's top spy has rejected opposition charges that the country's foreign intelligence agency acted against national interests in cooperating with U.S. counterparts

Merkel defends BND against criticism (The Local (German Edition)) Chancellor Angela Merkel defended the German intelligence agency (BND) on Monday amid growing criticism of her knowledge of the agency's activities from within her own government

German secret service suspected of deleting search words used by NSA spies (Deutsche Welle) Germany's secret service, the BND, has been accused of deleting search terms used by the NSA to spy on EU countries. The discovery came to light last week when media reported the BND colluding with the US secret service

Could Cyber Attacks Lead to Nuclear War? (Diplomat) It could, according to a former commander of U.S. nuclear forces

CFTC views cybersecurity and data integrity as top priorities; may issue regulations (Data Protection Report) Cybersecurity has recently become a high priority issue at the US Commodity Futures Trading Commission (CFTC) — the agency overseeing designated contract markets, swap execution facilities, derivatives clearing organizations, swap data repositories (SDRs), swap dealers, futures commission merchants, commodity pool operators and other derivatives market participants

Data-Breach Alert Laws May Be Eased (Wall Street Journal) Companies wouldn't have to disclose minor breaches under the proposals

GAO: Civilian Federal Agencies Trail Defense Department, Intel in Cybersecuirty Efforts (SIGNAL) Key challenges continue to plague U.S. federal agencies and contractors in the area of cybersecurity, particularly for civilian agencies that trail the robust cyber defense efforts of the Defense Department and intelligence community, according to a congressional investigative office tasked with summarizing the volatile situation for lawmakers

Litigation, Investigation, and Law Enforcement

No One Jailed In Iran For Their Opinions? Many Take To Social Media To Disagree (Radio Free Europe/Radio Liberty) While Foreign Minister Mohammad Javad Zarif believes Iran does not jail people for their opinions, many disagree with his assessment

NGOs in Russia suffer as Putin targets 'foreign agents' (Al Jazeera America) With steep fines and government inspections, Kremlin escalates enforcement of law regulating civil society groups

No evidence Russian hack of White House breached visitor personal data (Washington Post) A senior lawmaker has asked the White House whether the Russian hack of its unclassified computer networks last fall compromised personal data of ordinary Americans that was submitted by e-mail before a White House meeting, tour or social function

The world's most wanted hackers (We Live Security) Computer hacking is today a widespread, worldwide phenomenon, involving everyone from 'script kiddies' and activists to cyber-crime gangs and nation states. We Live Security looks at some of the world's most wanted hackers who remain on the run, despite the wanted posters and big bounty signs

Shadows And Light In The World Of Romanian Hackers (Hacker Samurai) On the FBI's Most Wanted list is the name Nicolae Popescu

Fulton school district recovers from hacking (KOMU NBC 8) The Fulton School District is still recovering from a denial of service hack carried out by one of their students

For a complete running list of events, please visit the Event Tracker.

Upcoming Events

Cloud Security Alliance Federal Summit (Washington, DC, USA, May 5, 2015) The Cloud Security Alliance Federal Summit, is a one day free-for-government event taking place at the Ronald Reagan Building and International Trade Center and is expected to draw 250 information security professionals from civilian and defense agencies to share experiences and lessons learned about best practices for securing cloud computing and emerging security topics

Amsterdam 2015 FIRST Technical Colloquium (Amsterdam, the Netherlands, May 5 - 6, 2015) FIRST Technical Colloquia & Symposia provide a discussion forum for FIRST member teams and invited guests to share information about vulnerabilities, incidents, tools and all other issues that affect the operation of incident response and security teams

California Cybersecurity Task Force Quarterly Meeting (Walnut Creek, California, USA, Jan 20, 2015) The California Cyber Security Task Force serves as an advisory body to California's senior government administration in matters pertaining to Cyber Security. Quarterly Cybersecurity Task Force meetings address State and Federal cyber legislation; provide updates on Task Force efforts to improve California's cyber workforce and education; promulgate critical information to enhance California's cyber awareness and preparedness; discuss state advances in cybersecurity and digital forensics; and grant residents an opportunity to share cyber information and innovation

DaytonDefense Ohio Cyber Dialogue with Industry Conference (Dayton, Ohio, USA, May 6 - 7, 2015) Our Cyber Security conference presents how Cyber Security affects you as an individual, your company, and your nation, along with business opportunities in this growing area. You will walk away with an understanding of not only what training is needed to counter such a threat, but also where you will find business opportunities in countering that threat

Suits and Spooks London (London, England, UK, Sep 12, 2014) On September 12th, in London's South bank neighborhood of Southwork, approximately 50 former intelligence officials, corporate executives, and security practitioners from the U.S. and the EU will gather at the top floor auditorium of the Blue Fin building, just behind the Tate Modern museum in Central London to discuss present and future threats to global critical infrastructure and how best to mitigate them. It will be closed to the press and held under the Chatham House Rule

Fraud Summit London (London, England, UK, May 7, 2015) ISMG's Fraud Summit is a one-day event focused exclusively on the top fraud trends impacting organizations and the mitigation strategies to overcome those challenges. Highlights of the London event include migration from static identity verification to dynamic identity proofing, the insider cyber threat, threat intelligence, the fraud ecosystem, the future of paycard security, mobile banking fraud, and working effectively with law enforcement

Apple Security Talks & Craft Beer (Laurel, Maryland, USA, May 8, 2015) The world's first security summit held at a production brewery. Join some of the world's best Apple security researchers as they talk about iOS, OS X, Apple hardware and other Apple-related security topics at the first computer security event held at a production brewery. Attendance is limited to 100 to keep the Security Summit small and encourage conversation between speakers, attendees, and sponsors. Tickets include breakfast, lunch, and some drink tickets for happy hour. Oh, and it includes a seat at the Security Summit to partake in the talks and discussion. Come participate in the talks, the conversation, and the beer!

DzHack Event 2015 (Ben Aknoun, Algiers, Algeria, May 9, 2015) DzHackEvent is a security event will contain conferences, workshops, and a challenge (CTF). Aiming to bring together security professionals, students, searcher, ethical hacker enthusiasts or simply technology enthusiasts

12th CISO Summit & Roundtable Geneva 2015 (Geneva, Switzerland, May 11 - 13, 2015) The 12th CISO Summit will give you direct insights from Europe's most experienced CISOs, you will get the latest top hot buttons and focuses from other CISOs for the coming 5 years — shared predictions on the threat horizon, and planned security strategy going forward

NG Security Summit (San Antoino, Texas, USA, May 11 - 13, 2015) The NG Security Summit bringx together more than sixty-five relevant CISOs from the private and public sector for a high level summit where they will workshop to benchmark, identify, and tackle key challenges. They will also hold in-depth forty-minute one-to-one meetings with specially selected providers who can offer a genuine solution to their business needs and assist in meeting their key objectives

Cybergamut Tech Tuesday: An Hour in the Life of a Cyber Analyst (Hanover, Maryland, USA, May 12, 2015) This hands-on workshop will demonstrate how easy it is for a breach to occur by analyzing a virtualized web server environment. Participants will use open source tools such as port scanners and protocol analyzers to identify security issues and then attempt to exploit the discovered vulnerabilities. Following the hands-on activity, the workshop will conclude with a discussion about how to avoid some of the security failures that were identified

MCRCon (Ypsilanti, Michigan, USA, May 12, 2015) Please join the Michigan Cyber Range for the third annual MCRCon cybersecurity conference. MCRCon 2015 will focus on hacking prevention, incident handling, forensics and post-event public relations. MCRCon 2015 is your opportunity to share your cybersecurity expertise with hundreds of professionals. In addition to the nationally-recognized speakers at MCRCon 2015, the Michigan Cyber Range will host a day-long Capture the Flag competition

Houston Secure World (Houston, Texas, USA, May 13, 2015) Join your fellow security professional for affordable, high-quality cybersecurity training and education at a regional conference near you. Earn CPE credits while learning from nationally recognized industry experts on many diverse topics such as: Risk Mitigation, Malware Detection, Digital Forensics, Cloud Security, Privacy, Big Data, PCI Compliance, Security Metrics, Encryption, Mobile Device Management, Incident Response, and much more. Larry Ponemon will deliver the keynote

QuBit 2015 Cybersecurity Conference (Prague, Czech Republic, May 13 - 15, 2015) QuBit brings together top experts and leaders in the field, from the private sector, to academia, to government. The main topics this year are APTs, the Internet of Things, and Digital Forensics, which will be covered by world-class cybersecurity experts from around the world. QuBit will feature two parallel tracks: managerial and technical. The conference also features two optional high-quality, full-day, hands-on training sessions on Linux hardening and forensics. Attendees can earn up to 26 CPE points for attending

Michgan InfraGard 2015 Great Lakes Regional Conference: Securing Our Critical Infrastructures (Novi, Michigan, USA, May 14, 2015) Learn all about the risks to critical infrastructures and key resources and the efforts underway to protect them. Private and public sectors will be represented. The conference will include four breakout sessions with numerous experts in the field of securing our critical infrastructures, with topics covering modern day malware and the security architecture to stop it, critical security controls for financial services and plant floor security. Thought-provoking topics will be covered including how overlooking basic security steps can cost you more, the US cybersecurity framework, challenges from new developments in the domain name system, post incident forensic analysis of a social pivoting attack, and more to come

THOTCON 0x6 (Chicago, Illinois, USA, May 14 - 15, 2015) THOTCON (pronounced \ˈthȯt\ and taken from THree - One - Two) is a hacking conference based in Chicago IL, USA. This is a non profit non-commercial event looking to provide the best conference possible on a very limited budget. Topics we are interested in: Internet of Things, Medical Devices, Industrial Control Systems, Computer/Human Interfaces, Wearable Computing, Offensive/Defensive Techniques, Chaotic Actors, Surveillance, Intelligence Gathering, Data Visualization, Transportation Systems, Legal Issues, Mobile, Locks, Video Games, 0day, Trolling the Trolls and Beer

International Conference on Cyber Security (ICCS) 2015 (Redlands, California, USA, May 16 - 17, 2015) The ICCS 2015 serves as a platform for researchers and practitioners from academia, industry, and government to present, discuss, and exchange ideas that address real-world problems with CYBER SECURITY. The conference program will include special sessions, presentations delivered by researchers from the international community, including presentations from keynote speakers and state-of-the-art lectures and keynote speeches. See the conference website for information on submitting papers and presentations

FS-ISAC & BITS Annual Summit (Miami Beach, Florida, USA, May 17 - 20, 2015) The Financial Services Information Sharing and Analysis Center (FS-ISAC), is a non-profit association comprised of financial institution members, that is dedicated to protecting the global financial services sector from physical and cyber threats that impact the resilience, integrity and stability of member institutions through dissemination of trusted and timely information. The FS-ISAC & BITS Annual Summit will feature sessions of interest to both security professionals and the financial sector

2015 Cyber Risk Insights Conference — Chicago (Chicago, Illinois, USA, May 18, 2015) Advisen again brings its acclaimed Cyber Risk Insights Conference series to Chicago with a full-day event addressing the critical privacy, network security and cyber insurance issues confronting risk professionals and their organizations. An expert faculty comprised of leaders in network security, regulation, law enforcement, risk management and cyber risk insurance will offer their insights on managing risk on a rapidly evolving and increasingly dangerous threat landscape. This day of learning and networking for risk managers, CISOs, CROs, insurance brokers, underwriters, reinsurers and other risk professionals will present a global perspective on cyber threats, but also will examine how the business and regulatory environment of the Midwest influence cyber risk management decisions

IEEE Symposium on Security and Privacy (San Francisco, California, USA, May 19 - 22, 2013) Since 1980, the IEEE Symposium on Security and Privacy has been the premier forum for the presentation of developments in computer security and electronic privacy, and for bringing together researchers and practitioners in the field. Papers offer novel research contributions in any aspect of computer security or electronic privacy. Papers may represent advances in the theory, design, implementation, analysis, or empirical evaluation of secure systems, either for general use or for specific application domains. (Co-located with the IWCC and Web 2.0 Security and Privacy.)

Fraud Summit Chicago (Chicago, Illinois, USA, May 19, 2015) ISMG's Fraud Summit is a one-day event focused exclusively on the top fraud trends impacting organizations and the mitigation strategies to overcome those challenges. Highlights of the Chicago event include the 2015 faces of fraud, science and insider fraud detection, EVM and pay card security, mobile banking risks and their mitigation, and threat information exchange

NCCOE Speaker Series: The Cyber Danger: Problems of Strategic Adaptation (Rockville, Maryland, USA, May 20, 2015) Lucas Kello (Senior Lecturer in International Relations / Director of Cyber Studies Program, Oxford University, and Associate of the Science, Technology & Public Policy Program, Belfer Center for Science & International Affairs, Harvard University, Kennedy School of Government) will deliver the keynote address. The contemporary world confronts an enormous cyber threat. The U.S. intelligence community rates this threat higher than global terrorism. It warns of the severity of the damage a cyber attack could produce. Yet there is no consensus among scholars and decision makers on how to characterize the strategic instability of cyber interactions or on what to do about it. The range of conceivable cyber conflict is poorly understood. It is unclear how conventional security mechanisms such as deterrence and collective defense apply to this phenomenon. Principles of cyber defense and cyber offense remain rudimentary. The growth of cyber arsenals, in short, is outpacing the design of doctrines to limit their risks. This presentation will review problems of strategic adaptation to current cyber realities, applying insights from technological revolutions in previous eras

3rd Annual Georgetown Cybersecurity Law Institute (Washington, DC, USA, May 20 - 21, 2015) In 2015, it is more important than ever that in-house and outside counsel stay abreast of the most current developments and best practices in cybersecurity. Those lawyers who ignore cyber threats are risking millions of dollars for their companies or their clients. Recent reports by Cisco and the World Economic Forum both highlight the paramount importance of cyber risk management. You have an important role to play in cybersecurity leadership, especially in keeping corporate officials and the board of directors informed. Too often, well-meaning officials don't know what they don't know! At our 2015 Institute you will receive insights on the best governance, preparedness, and resilience strategies from experienced government officials, general counsels, and cybersecurity practitioners who face these issues on a daily basis

AFCEA Spring Intelligence Symposium 2015 (Springfield, Virginia, USA, May 20 - 21, 2015) The Symposium will be a one-of-a-kind event designed to set the tone and agenda for billions of dollars in IC investment. Leaders from all major IC agencies, from the ODNI, IARPA, and the National Intelligence Council will explore where that investment is being directed and how industry, Federally Funded R&D Centers, and academia can best contribute to the IC's R&D effort

SOURCE Conference (Boston, Massachusetts, USA, May 25 - 28, 2015) SOURCE is a computer security conference happening in Boston, Seattle, and Dublin that is focused on offering education in both the business and technical aspects of the security industry. The event's vision is to bridge the gap between technical excellence and business acumen and bring the best of both worlds together

7th International Conference on Cyber Conflict (Tallinn, Estonia, May 26 - 29, 2015) CyCon is the annual NATO Cooperative Cyber Defence Centre of Excellence conference where topics vary from technical to legal, strategy and policy. The pre-conference workshop day, 26 May, features a variety of talks and hands-on training. The 7th International Conference on Cyber Conflict (CyCon 2015) held on 27-29 May 2015 in Tallinn, Estonia, will focus on the construction of the Internet and its potential future development. This year's topic — "Architectures in Cyberspace" — asks what cyberspace is and will be in the coming years as well as what are its characteristics relevant for cyber security

HITBSecConf2015 Amsterdam (De Beurs van Berlage, Amsterdam, The Netherlands, May 26 - 29, 2015) This year's event will feature a new training courses. Keynote speakers include Marcia Hofmann and John Matherly. To encourage the spirit of inquisitiveness and innovation, Haxpo will showcase cutting edge technology and security solutions for industry professionals alongside fun, hands-on tinkering and hacking exhibits

1st Annual Billington Corporate Cybersecurity Summit (New York, New York, USA, May 27, 2015) Join Billington CyberSecurity's unparalleled network of cybersecurity professionals as they provide hard-earned insights and education to a high level and exclusive group of attendees from the corporate and financial sector and their portfolio companies. Don't miss this must-attend event

Atlanta Secure World (Atlanta, Georgia, USA, May 27 - 28, 2015) Join your fellow security professional for affordable, high-quality cybersecurity training and education at a regional conference near you. Earn CPE credits while learning from nationally recognized industry experts on many diverse topics such as: Risk Mitigation, Malware Detection, Digital Forensics, Cloud Security, Privacy, Big Data, PCI Compliance, Security Metrics, Encryption, Mobile Device Management, Incident Response, and much more. Keynotes by Dr. Marjie T. Britz (Professor of Criminal Justice, Clemson University) and Demetrios Lazarikos (IT Security Researcher & Strategist, Blue Lava Consulting)

Techno Security & Forensics Investigations Conference (Myrtle Beach, South Carolina, USA, May 31 - Jun 3, 2015) The Seventeenth Annual International Techno Security & Forensics Investigations Conference will be held May 31 ? June 3 in sunny Myrtle Beach at the Myrtle Beach Marriott Resort. This conference promises to be the international meeting place for IT Security professionals from around the world. The conference will feature some of the top speakers in the industry and will raise international awareness towards increased education and ethics in IT security

Mobile Forensics World (Myrtle Beach, South Carolina, USA, May 31 - Jun 3, 2015) The Eighth Annual Mobile Forensics World will also be held May 31 ? June 3 in sunny Myrtle Beach at the Myrtle Beach Marriott Resort. The Mobile Forensics World is specifically dedicated to Federal, State and Local LE Forensic Specialists, Corporate and Private Forensic Examiners, Industry Leaders, and Academic Researchers performing Mobile Device Forensics. With topics such as Mobile Device Forensics (Cell Phone, PDA, Smart Phone, Satellite Phone, GPS), Advanced Techniques of Mobile Forensics, SIM/USIM Card Analysis, TDMA/CDMA/GSM/iDEN Handset Analysis, Cell Site Analysis, Call Data Record Analysis, Mobile Forensics Applications, and Mobile Forensics Research, this event will be a perfect start to an ongoing relationship for many members of this great community