The CyberWire Daily Briefing 01.20.16

Cyber Attacks, Threats, and Vulnerabilities

Everything We Know About Ukraine's Power Plant Hack (Wired) When the US government demonstrated in 2007 how hackers could take down a power plant by physically destroying a generator with just 21 lines of code, many in the power industry dismissed the demo as far-fetched. Some even accused the government of faking the so-called Aurora Generator Test to scare the public

British voice encryption protocol has massive weakness, researcher says (CIO) The UK government is requiring suppliers to implement the protocol

Gaza Cybergang Develops New Malware for Cyber-Espionage Campaigns (Softpedia) The Gaza Cybergang, also known as the Gaza Hackers Team, has developed a new malware strain named DustSky (or NeD Worm), which they've been spreading via phishing campaigns to targets in Israel, Egypt, Saudi Arabia, United Arab Emirates and Iraq, but also in the US and some European states

Dridex banking malware adds a new trick (IDG via CSO) Dridex, the banking malware that won't go away, has been improved upon once again. IBM's X-Force researchers have found that the latest version of Dridex uses a DNS (Domain Name System) trick to direct victims to fake banking websites

Linux bug imperils tens of millions of PCs, servers, and Android phones (Ars Technica) Vulnerability allows restricted users and apps to gain unfettered root access

Linux Kernel Vulnerability (US-CERT) US-CERT is aware of a Linux kernel vulnerability affecting Linux PCs and servers and Android-based devices. Exploitation of this vulnerability may allow an attacker to take control of an affected system

Malicious Chrome extensions ransack Steam users' inventory (Help Net Security) Steam users are being targeted by a scammer that's offering apparently helpful Chrome extensions for free, but is actually using them to steal items from victims' Steam inventory

Duo Security Finds Over 90 Percent of Android Devices Run Outdated Operating Systems (Virtual Strategy Magazine) Research paints worrying picture of state of security of mobile devices in the enterprise

Supermarket patches its web security…how safe are "your" web forms? (Naked Security) The website of UK supermarket chain ASDA is in the news for all the wrong reasons today

LastPass phishing attack could have scooped up passwords (IDG via CSO) The simple attack shows how software needs to be more phishing resistant

Social engineering: 7 signs that something is just not right (CSO) Comprehensive awareness training for your company's employees should prevent these scenarios from taking down your network

Social hacking: the threat it poses to your business (Twin Systems) Social hacking is the criminal act of manipulating people to surrender confidential information

Targeted Mobile Implants in the Age of Cyber-Espionage (SecureList) When mass-produced electronic spying programs became widely known by the public, many email providers, businesses, and individuals started to use data encryption

E-Mail Spam Goes Artisanal (BloombergBusiness) Scammers are turning to small-batch attacks to beat today's more sophisticated e-mail filters

Automated bots drive cyber attack innovation (ComputerWeekly) Persistent cyber attacks will feature highly in 2016 as automation takes over, according to cyber security organisation Radware

WEF delegates warned about cyber-spies (IT-Online) As the World Economic Forum in Davos approaches, Kaspersky Lab experts want to warn attendees about the risk of cyber-espionage attacks using malware designed for mobile devices

Security Patches, Mitigations, and Software Updates

Serious Linux Kernel Vulnerability Patched (Threatpost) A patch for a critical Linux kernel flaw, present in the code since 2012, is expected to be pushed out today

Apple Releases Security Updates for iOS, OS X El Capitan, and Safari (US-CERT) Apple has released security updates for iOS, OS X El Capitan, and Safari to address multiple vulnerabilities. Exploitation of some of these vulnerabilities may allow a remote attacker to take control of an affected system

Oracle issues record number of patches (PCWorld) Admin are advised to patch immediately

Oracle Critical Patch Update Advisory — January 2016 (Oracle) A Critical Patch Update (CPU) is a collection of patches for multiple security vulnerabilities. Critical Patch Update patches are usually cumulative, but each advisory describes only the security fixes added since the previous Critical Patch Update advisory

LastPass takes steps to mitigate 'LostPass' security flaw that could lead to account compromise (FierceITSecurity) Password manager LastPass has outlined steps to mitigate a security flaw, unveiled Saturday by security researcher Sean Cassidy, that could enable an attacker employing a phishing attack to steal a user's email, password and two-factor authentication code

Critical Yahoo Mail Flaw Patched, $10k Bounty Paid (Threatpost) A critical vulnerability in Yahoo Mail that could give attackers complete control of an account was patched two weeks ago

ISC Releases Security Updates for BIND (US-CERT) The Internet Systems Consortium (ISC) has released security updates to address vulnerabilities in BIND. Exploitation of these vulnerabilities may allow a remote attacker to cause a denial-of-service condition

Trend Micro Continues Protection for Older Versions of Internet Explorer (TrendLabs Security Intelligence Blog) Last week, Microsoft ended support for older versions of Internet Explorer (versions 8, 9, and 10). This was done as part of the January 2016 Patch Tuesday cycle; at the same time support for Windows 8 also ended

Cyber Trends

5 biggest cybersecurity concerns facing CIOs, CISOs in 2016 (CIO via CSO) Carl Leonard, a principal security analyst for Raytheon's Websense cybersecurity software unit, offers insight into the most serious threats CIOs and CISOs are likely to grapple with this year

DHS official: Both public and private sectors 'blind' to cyber risk (Fedscoop) DHS' Mike Echols called for cybersecurity 'heroes' to move organizations away from horrible cybersecurity behaviors

Survey shows many businesses aren't encrypting private employee data (Naked Security) Survey shows many businesses aren't encrypting private employee data

Success of the Internet of Things depends on privacy and security (Help Net Security) Although three-quarters of companies report they are now encrypting sensitive customer data such as payment information, many companies aren't extending the same level of protection to their own employees' private data

Unexpected implications arising from the Internet of Things (Help Net Security) More than half of major new business processes and systems will incorporate some element of the Internet of Things (IoT) by 2020, according to Gartner

PWC Reveals Top Bank Threats Facing the Financial Industry (ZeroFOX) Research published by PwC and the Centre for the Study of Financial Innovation (CSFI) found an unusual trend in bank threats related to the financial industry

Small businesses could be hit the hardest by data hacking — with three out of four worried about cyber security (This is Money) Small businesses are particularly vulnerable to cyber hacking, a law firm specialising in data protection has warned

Cybercriminals getting better, enterprise defenders losing confidence, Cisco report finds (FierceITSecurity) Cybercriminals are becoming better organized and funded, while businesses are growing less confident in their ability to prevent attacks, according to Cisco's Annual Security Report released Tuesday

Security exploits overwhelming defences (Enterprise Times) Security exploits hit a new high last year as reported by security vendor Bromium. Their Endpoint Exploitation Trends 2015 report makes sobering reading for IT security teams who must, by now, wonder if they are ever going to stem the tide of attacks

Retail fraud attempts rose 8% over holidays (FierceRetail) According to new data from ACI Worldwide, online transactions worldwide increased 21 percent over the holiday shopping season, with a corresponding 8 percent rise in fraud attempts between Thanksgiving and the end of 2015

Advertisers expected to lose $7.2B in 2016 due to fraud (CSO) No change in fraud levels, but with spending up, losses will climb says ANA

Little Rock, Tampa, and St. Louis hardest-hit by malware among U.S. cities, study finds (Network World via CSO) Little Rock, Tampa, St. Louis, Orlando and Denver were the five American cities most affected by malware on a per-capita basis in 2015, according to a study released today by Enigma Software

Marketplace

Bank Buyers Take a Harder Look at Sellers' Cyber Defenses (American Banker) Acquirers are starting to look more closely at a seller's commitment to cybersecurity to avoid reputational and operational risk

The 4 kinds of cybersecurity customers (Network World) Four different customer profiles to consider when selling cybersecurity products and services

GPRO, FEYE, VMW, other tech stocks fall sharply to new 52-week lows (Seeking Alpha) Though the Nasdaq fell just 0.3%, a healthy number of beaten-up tech names tumbled to new 52-week lows today, often on strong volume. Margin calls, panic selling, and fund liquidations are on the list of potential culprits

FireEye Inc Shot Down to New All Time Low; Can it Bounce Back? (Bidness, Etc.) FireEye shares tanked in today's trading session, to hit a new all time low of $15.38

Symantec accepts $1B cut in Veritas proceeds, updates FQ3 guidance; shares -5.2% (Seeking Alpha) Citing "uncertainties developed regarding the transaction," Symantec (NASDAQ:SYMC) and Carlyle (NASDAQ:CG) have amended the terms of Carlyle's purchase of Symantec's Veritas storage software unit to cut the purchase price from $8B to $7.4B, and double Veritas' offshore cash balance to $400M

IronScales Collects $1.5 Million in Seed Funding to Protect Enterprises from Phishing Cyber Crimes (NewsOn6) Israeli security start-up IronScales, developers of the cyber security industry's first ever employee-based intrusion prevention system with an automated phishing-mitigation response, today announced it has closed a seed round of funding. The $1.5 million round is led by RDSeed, an investment arm of Rafael Development Corporation (RDC)

ThreatQuotient Poised for Continued Growth, Rapidly Expanding Workforce (Threat Quotient) Recent Series A funding of $10.2M paving the way for considerable hiring initiative

Guidance Software Restructures, Hires New Channel Chief (Channel Partners) Big changes at Guidance Software, which says it is restructuring sales, training, channel and product development to improve its business

Rick Holland Joins Digital Shadows as Vice President of Strategy (Digital Shadows) A veteran in information security and threat intelligence, former Forrester research analyst will help company expand vision and innovation

Fred Funk Named President, Cyber and SIGINT Systems at Vistronix (Washington Exec) Vistronix Intelligence & Technology Solutions (Vistronix), a software developer and solutions innovator based in Reston, VA announced on January 12 that Fred Funk has been hired as the new President, Cyber & SIGINT Systems. Funk will be based out of the Columbia, MD office

Office Envy: ThreatConnect's Star Wars Themed Command Center (DCInno) The force flows strong through this office

Products, Services, and Solutions

The New Netsparker Web Security Scanners: Automated Configuration of URL Rewrite Rules, Scan Policy Optimizer and Proof of Exploitation (Netsparker) We are excited to announce the release of a new version of Netsparker Desktop, and an update for Netsparker Cloud web application security scanning service. There are quite a few new features to talk about, so let's get started

Versasec Launches vSEC:CMS S4.3 Smart Card Lifecycle Management (Verasec) Versasec increases security and efficiency with three key additional features — elliptic curve cryptography, batch issuance and HSM support

Triumfant and ReversingLabs form Strategic Integration for Advanced Malware Detection and Analysis (Business Wire) Collaboration provides industry-leading detection, analysis and remediation to prevent malicious attacks on the endpoint

Invincea Recognized as Leader in Advanced Persistent Threat Protection in SC Magazine Awards (Street Insider) Organization is only endpoint security company finalist in APT protection category

Fortinet firewall deployment handling loads 'rivalling any deployment anywhere' (DataCenterNews) Fortinet is heralding the deployment of its FortiGate-3700D data center firewall in Yahoo! Japan subsidiary, GYAO!, as validation of the firewall's ability to handle the world's most demanding applications, with GYAO's data centres required to handle one million requests per second, and 800Gbps traffic

Unisys offers enterprises micro-segmentation security for AWS Cloud (FierceITSecurity) Unisys announced Tuesday that it is providing enterprises with its Unisys Stealth micro-segmentation security product on the Amazon Web Services (AWS) Cloud

Microsoft Exchange Online Protection Combats 'Peer Phishing' (eWeek) New updates make it tougher for phishers to pull off scams that rely on impersonating bosses, co-workers and other personnel

ZTE's latest phone has an eye for security (DNA) The Nubia Prague S is packed full of premium specifications and can be unlocked with a glance

VPN providers mad about Netflix crackdown but say they can evade it (Ars Technica) Even Netflix admits blocking all VPNs won't be possible

The History of Twitter's Rules (Motherboard) The first Twitter Rules were fairly slim: 568 words, divided up under the headings of Impersonation, Privacy, Violence and Threats, Copyright, Unlawful Use, Serial Accounts, Name Squatting, Malware/Phishing, Spam, and Pornography

How Twitter quietly banned hate speech last year (Ars Technica) Company now emphasizes safety and free expression rather than lack of censorship

KnowBe4's Free Phish Alert Outlook Add-in Improves Network Safety (Legaltech News) The tool teaches users 'to be alert for phishing attacks' and lets them 'easily report a suspicious email with a simple click'

Quell the Inside Threat: PKWARE's Smartcrypt Aims to Change How Encryption Protects Data (Legaltech News) The new PKWARE software attempts to nullify threats for companies by encrypting data itself

CounterTack Announces New Training Package for Higher Education Institutions Featuring Malware Analysis Training and Free Tool Licenses (BusinessWire) Program provides real-world, advanced malware forensics training for students around security incident response, investigation and triage to prepare for protecting organizations against cyber attacks

Compliance Discovery Solutions Enhances Privacy and Security Program with 'Hot Failover' (Legaltech News) The "hot failover" system addresses rigorous demands for business continuity by assuring access to data for processing, review, and analytics

FinalCode 5 Takes Aim at File Encryption Challenge (eSecurity Planet) Scott Gordon, chief operating officer of Final Code, discusses the challenges of file encryption and what his company's new technology is all about

Here's What Tor's Data Looks Like as It Flows Around the World (Wired) For a tool that's meant to serve as a cloak of online anonymity, Tor is surprisingly transparent

The CyberWire Debuts New Podcasts (MarketWatch) New podcast features daily and weekly roundups of cyber security news, interviews and commentary

Technologies, Techniques, and Standards

Lloyd's of London develops common core for cyber risks (Business Insurance) Lloyd's of London has developed a set of common core data requirements for cyber risks, it announced Tuesday

Here come the accountants — the codification of cyber risk (PropertyCasualty360) Headline writers and producers of "Shark Tank" want us to believe that all new products and ideas come from rising stars and Silicon Valley grads

Good practice guide on disclosing vulnerabilities (Help Net Security) ENISA published a good practice guide on vulnerability disclosure, aiming to provide a picture of the challenges the security researchers, the vendors and other involved stakeholders are confronted with when disclosing software/hardware vulnerabilities

Threat Intelligence and SIEM (Part 1) — Reactive Security (Recorded Future) Security information and event management (SIEM) is a solution that provides a bird's eye view of an IT infrastructure

/tmp, %TEMP%, ~/Desktop, T:\, ... A goldmine for pentesters! (Internet Storm Center) When you are performing a penetration test, you need to learn how your target is working: What kind of technologies and tools are used, how internal usernames are generated, email addresses format

Cybersecurity recommendations for medical device manufacturers (Help Net Security) Cybersecurity threats to medical devices are a growing concern

Using teamwork to fight DDoS attacks (GCN) When a distributed denial of service (DDoS) attack hits an organization, it quickly overwhelms network resources, disrupting services and making resources unavailable for users

Design and Innovation

OpenWPM: An automated, open source framework for measuring web privacy (Help Net Security) Among the speakers at the first ever Privacy Con, organized by the US Federal Trade Commission (FTC) and held last Thursday in Washington, DC, was Steven Englehard, a Ph.D. candidate at Princeton University's department of computer science and a graduate research fellow at the Center for Information Technology Policy

Can We Ever Rescind Our Data? (Tripwire: the State of Security) I received a phone call from a friend the other night. He was very concerned because he received one of those now infamous letters from the Office of Personnel Management, which indicated that his records were among one of the millions that were taken in the OPM hack

Research and Development

Snark attack: Cornell students teach software to detect sarcasm! (Ars Technica) Open source sarcasm detection helps save the world by eliminating snarky app reviews

Legislation, Policy, and Regulation

'Trident is old technology': the brave new world of cyber warfare (Guardian) Forget debates about Britain's nuclear deterrent. New technology means a country can be brought to its knees with the click of a mouse

UK govt: No, really, we're not banning cryptography (Register) The draft Investigatory Powers Bill debate goes on

CRS: Congress may want to increase its oversight of the federal cybersecurity workforce (FierceGovernmentIT) There are several executive branch initiatives underway to attract and retain cybersecurity talent in the federal workforce. Few of those programs, however, are mandated to report their progress to Congress

The Federal Cybersecurity Workforce: Background and Congressional Oversight Issues for the Departments of Defense and Homeland Security (Congressional Research Service via FAS) The federal cybersecurity workforce is responsible for protecting U.S. government systems and networks against cyber threats and attacks. Federal agencies, however, have reported difficulty in assessing the size and capabilities of their cybersecurity workforces

Rivals Avoid Taking Stand on Backdoor (BankInfoSecurity) Judging presidential contenders on their encryption policy

Feds Prod Automakers to Play Nice With Hackers (Wired) The Department of Transportation and its automotive safety branch, the National Highway Traffic and Safety Administration, are waking up to the threat of hackable vulnerabilities in Internet-connected cars and trucks

Litigation, Investigation, and Law Enforcement

Intelligence community watchdog reconfirms that dozens of Clinton emails were classified (Washington Post) The intelligence community believes that at least several dozen of the emails sent and received by Hillary Clinton while she was secretary of state contained classified material, including intelligence material classified at the highest levels, according to a new letter by the inspector general

Report: Chinese Soldiers Linked to US Military Hacking Case (Agence France-Presse via Defense News) Two Chinese soldiers were "co-conspirators" in a plot to steal US military secrets, including designs for the F-35 stealth fighter and other warplanes, a Canadian newspaper reported Tuesday

Civilians to help police investigate cybercrimes, says Theresa May (BBC) Civilian recruits will help police solve cybercrime under an expansion of the role of volunteers in England and Wales, the home secretary has said

Report: FBI investigates possible Super Bowl link to fiber optic cable mischief in the Bay Area (FierceGovernmentIT) An internal FBI memo obtained by an NBC affiliate in Washington, D.C. reportedly showed federal officials' concern that recently compromised fiber optic cables in California may have been part of an attempt to disrupt the Super Bowl early next month

USPS cyber response plan focuses on only internal threats, says IG (FierceGovernmentIT) The U.S. Postal Service's response plan for cyber incidents lacks several necessary features, making it an incomplete protective measure against cyber threats, according to the USPS Inspector General

IoT Raises New Legal Challenges For Business (InformationWeek) Privacy, security, and data ownership issues surrounding Internet of Things devices are creating a host of new legal questions and problems. Here's what's happening now, and what you need to know

MLB Computer Hacking Scandal — The Intersection of Compliance and Cyber Security (JDSupra) Sometimes I get going on a topic and cannot seem to stop writing blog posts. Then there are times when I feel a roll coming on and just go with it. Today starts one of those rolls and it is around bribery and corruption in sports

Putin's top Internet adviser seems to own a piracy torrent site (Ars Technica) Site owner is also head of Russia's Internet Development Institute

For a complete running list of events, please visit the Event Tracker.

Upcoming Events

National Insider Threat Special Interest Group Meeting (Laurel, Maryland, USA, Jul 16, 2015) Topics to be discussed at the meeting; Insider Threat Program Development & Implementation, Behavioral Indicators Of Concern, Legal Considerations When Developing & Managing An Insider Threat Program. There is no cost to attend this meeting

POPL 2016 (St. Petersburg, Florida, USA, Jan 20 - 22, 2016) The annual Symposium on Principles of Programming Languages is a forum for the discussion of all aspects of programming languages and programming systems. Both theoretical and experimental papers are welcome, on topics ranging from formal frameworks to experience reports

Automotive Cyber Security Summit — Shanghai (Shanghai, China, Jan 21 - 22, 2016) The conference, which brings together automakers, suppliers, various connected-services providers and security specialists, will focus on government regulations, emerging automotive cyber security standards and new products and solutions designed to deal with the growing threats

SANS Institute: Information Security Training (Las Vegas, Nevada, USA, Sep 12 - 21, 2015) Information security training in Las Vegas from SANS Institute, the global leader in information security training. At SANS Network Security 2015, SANS offers more than 40 hands-on, immersion-style security training courses taught by real-world practitioners. The site of SANS Network Security 2015, September 12 - 21, is Caesars Palace, the majestic Las Vegas hotel

CyberTech 2016 (Tel Aviv, Israel, Jan 26 - 27, 2016) Cybertech is the most significant conference and exhibition of cyber technologies outside of the United States. Cybertech provided attendees with a unique and special opportunity to get acquainted with the latest innovations and solutions featured by the international cyber community. The conference's main focuses are on networking, strengthening alliances and forming new connections. Cybertech also provided an incredible platform for Business to Business interaction

Global Cybersecurity Innovation Summit (London, England, UK, Jan 26 - 27, 2016) SINET presents the Global Cybersecurity Innovation Summit, which focuses on providing thought leadership and building international public-private partnerships that will improve the protection of our respective homeland's critical infrastructures, national security and economic interests. Our objective is to advance innovation and the growth of the cybersecurity sector by providing a platform for cybersecurity businesses, particularly small and medium enterprises (SMEs), to connect with key UK, US, and international decision makers, system integrators, investors, government policy makers, academia and other influential business executives

Fort Meade IT & Cyber Day (Fort Meade, Maryland, USA, Jan 27, 2016) The Ft. Meade IT and Cyber Day is a one-day event held at the Officers' Club (Club Meade) on base. The event is held on-site, where industry vendors will have the opportunity to display their products and services to IT, Communications, Cyber and Intelligence personnel

ESA 2016 Leadership Summit (Chandler, Arizona, USA, Jan 31 - Feb 3, 2016) The electronic security industry is rapidly changing and continuously evolving. It's not enough to just survive. Businesses looking to thrive need to adapt to ensure their people, products, services and practices stay ahead of the curve. The Summit is a three-day conference filled with networking and educational opportunities dedicated to delivering business intelligence to electronic security companies and professionals that are ready to embrace innovation and grow

SANS Cyber Threat Intelligence Summit & Training 2016 (Alexandria, Virginia, USA, Feb 3 - 10, 2016) This Summit will focus on specific analysis techniques and capabilities that can be used to properly create and maintain Cyber Threat Intelligence in your organization. Attend this summit to learn and discuss directly with the experts who are doing the CTI analysis in their organizations. What you learn will help you detect and respond to some of the most sophisticated threats targeting your networks

BSides Tampa 2016 (MV Royal Caribbean Brilliance of the Seas, Tampa to Mexico, Feb 4 - 8, 2016) BSides Tampa is an annual IT security/hacking conference featuring hands on training classes and lectures from some of the greatest minds in the industry and academia

The Law and Policy of Cybersecurity Symposium (Rockville, Maryland, USA, Feb 5, 2016) This one-day symposium will cover the critical legal and policy issues, challenges, and developments in cybersecurity. Legal professionals, professionals who develop cybersecurity strategies and policies, and anyone who assists organizations in preparing for and responding to cyber incidents should attend. Attendees will gain a comprehensive understanding of the legal and policy issues that they need to know when they represent clients, develop their organization's cyber strategy and policies, or respond to cyber incidents

National Cybersecurity Center of Excellence to Celebrate Opening of Newly Remodeled Facility (Rockville, Maryland, USA, Feb 8, 2016) The National Cybersecurity Center of Excellence is celebrating its dedication on February 8, 2016 at the center's newly remodeled facility at 9700 Great Seneca Highway

Insider Threat Program Development Training — California (Carlsbad, California, USA, Feb 8 - 10, 2016) The National Insider Threat Special Interest Group website has some very "eye opening" examples of how "damaging and costly" an "insider threat incident" can be. The FBI Insider Threat Alert states companies victimized by current or former employees incur costs from $5,000 to $3 million. bring? Is your company required to establish an Insider Threat Program per the requirements of NISPOM Conforming Change 2? Insider Threat Defense has trained a substantial number of U.S. Government Agencies (DoD, IC), Defense Contractors, Critical Infrastructure Providers, Aviation Security Professionals, large and small businesses on Insider Threat Program Development and Insider Threat Risk Mitigation

Secure Rail (Orlando, Florida, USA, Feb 9 - 10, 2016) The first conference to address physical and cyber rail security in North America

Cyber Security Breakdown: Dallas (Dallas, Texas, USA, Feb 10, 2016) This half day session will provide you with the critical information you need to start formulating an effective response in the eventuality of a cyber security event. Rather than try and handle the breach during the chaos of the event, you'll understand how to build in advance, the best practices to respond effectively. Attend the Cyber Security Breakdown event that is focused on the unique issues and threats facing legal professionals

Department of the Navy (DON) IT Conference, West Coast 2016 (San Deigo, California, USA, Feb 17 - 19, 2016) The purpose of the DON IT conference is to: (1) Explain the new and invigorated DUSN (M), DON/AA, and DON CIO organization and its business and IT transformation priorities. (2) Share information that supports the SECNAV's vision laid out in the DON Transformation Plan to achieve business transformation priorities, leverage strategic opportunities, and implement DON institutional reform initiatives by changing the culture, increasing the use of data-driven decision-making, and effective governance

ICISSP 2016 (Rome, Italy, Feb 19 - 21, 2016) The International Conference on Information Systems Security and Privacy aims at creating a meeting point for researchers and practitioners that address security and privacy challenges that concern information systems, especially in organizations, including not only technological issues but also social issues. The conference welcomes papers of either practical or theoretical nature, presenting research or applications addressing all aspects of security and privacy, that concerns to organizations and individuals, thus creating new research opportunities

Interconnect2016 (Las Vegas, Nevada, USA, Feb 21 - 25, 2016) IBM InterConnect 2016 is for those who are building new business models, transforming industries, and creating better outcomes. Whether you're a C-suite executive, IT leader, developer, designer, architect, or cloud expert, we all have one thing in common — we strive to build better businesses. The relationship between IT and business is changing. As a leader, builder or innovator of technology, the decisions you make today will have an increasingly greater impact on your company's bottom line tomorrow. To remain successful, it's critical that you transform along with this ever-changing environment

CISO Canada Summit (Montréal, Québec, Canada, Feb 21 - 23, 2016) Tactics and best practices for taking on enterprise IT security threats. The CISO Summit will bring together C-level IT security executives, industry analysts and solution providers to discuss challenges and best practices in a relaxed, yet focused business setting

cybergamut Tech Tuesday: Neuro Cyber Analytics: Understanding the Patterns of Human Cognition in the Cyber Domain (Elkridge, Maryland, Middletown, Feb 23, 2016) This presentation will discuss Neuro Cyber Analytics. Humans use context-specific neurocognitive patterns for receiving and processing internal and external sensory information. Stated differently, people interact with the world around them primarily by seeing, hearing, and feeling, and make decisions about what to do next depending upon the context of what is happening in their environment. People often do not realize that their decision making process triggers certain unconscious behaviors that can be read as indicators of how their thoughts were formulated and sequenced

Insider Threat Program Development Training Course — Maryland (Annapolis, Maryland, USA, Feb 23 - 25, 2016) The National Insider Threat Special Interest Group website has some very "eye opening" examples of how "damaging and costly" an "insider threat incident" can be. The FBI Insider Threat Alert states companies victimized by current or former employees incur costs from $5,000 to $3 million. bring? Is your company required to establish an Insider Threat Program per the requirements of NISPOM Conforming Change 2? Insider Threat Defense has trained a substantial number of U.S. Government Agencies (DoD, IC), Defense Contractors, Critical Infrastructure Providers, Aviation Security Professionals, large and small businesses on Insider Threat Program Development and Insider Threat Risk Mitigation

CISO New York Summit (New York, New York, USA, Feb 25, 2016) A data breach is not only a PR nightmare, but cause for customers to turn to competitors, exposing sensitive company information and racking up fines from industry regulators. In order for organizations to operate smoothly, CISOs and IT security executives need to be ahead of the hackers, and kept abreast of the latest IT security topics and trends. Agenda sessions include panel discussions, think tanks, analyst Q&A sessions and much more

BSides San Francisco (San Francisco, California, USA, Feb 28 - 29, 2016) BSides San Francisco is an Information / Security conference that's different. We're a 100% volunteer organized event, put on by and for the community, and we truly strive to keep information free. There is no charge to the public to attend BSides SF. Our costs are covered by our generous donors and sponsors, who share our vision of free dissemination of information. The conversations are getting more potent and the "TALK AT YOU" conferences are starting to realize they have to change. BSides SF is making this happen by shaking-up the format

CISO Summit Europe (London, England, UK, Feb 28 - Mar 1, 2016) With the media covering the latest data breaches, cloud computing security questions going unanswered and hackers developing more sophisticated attacks, the IT department has a growing responsibility to protect customer and company data. The CISO Summit will bring together C-level IT security executives, industry analysts and solution providers to discuss challenges and best practices in a relaxed, yet focused business setting. Agenda sessions include engaging Keynote Presentations, Thought Leadership sessions, CISO Think Tanks, Analyst Q&As and much more

RSA Conference 2016 (San Francisco, California, USA, Feb 29 - Mar 4, 2016) Celebrating its 25th anniversary, RSA Conference continues to drive the information security agenda forward. Connect with industry leaders at RSA Conference 2016