The CyberWire Daily Briefing 07.14.16

Cyber Attacks, Threats, and Vulnerabilities

IS Recruits in SE Asia a Rising Threat Despite Weak Attacks (ABC News) Ineffectual attacks by the Islamic State group's followers in Southeast Asia have shown them to be fragmented and lacking in the expertise that has produced devastating death tolls elsewhere in the world

Irongate Heralds New Cyber Threat to Industry (EE Times) The FireEye Labs Advanced Reverse Engineering (FLARE) team has identified a type of malware that can attack industrial control systems (ICS), but hide itself from conventional antivirus software

HSBC suffers major security breach as hackers launch cyber attack on bank's servers (Daily Star) Hacking group OurMine claim they took down US and UK HSBC servers following a spate of cyber attacks on major tech firm bosses

The Biggest Hacker Whodunnit of the Summer (Motherboard) June 17 marked the beginning of perhaps the biggest digital bank robbery this summer: Unknown attackers disappeared $53 million in the cryptocurrency Ether from one of the startup finance world’s most promising and futuristic projects

PhishMe Unveils Newly Discovered Intelligent Encryption Ransomware Delivered by RockLoader (Digital Forensics Magazine) PhishMe Inc. announced that it has uncovered additional data concerning a recently discovered new ransomware tool in the encryption ransomware market. As of June 24th, the number of infections for Bart’s first run is already significant with targeting all around the globe. In just the first few hours of the campaign, 5,622 victims have been compromised. If only 10 percent of the users pay the ransom, this could net the attackers 1,686 Bitcoins, or just over $1 million USD. These waves also are heavily targeting the United States, Germany, France and the UK

A New High For Locky (F-Secure Labs Blog) After seeing a drop during first weeks of June, the spam campaigns distributing Locky crypto-ransomware has returned as aggressive as ever. Normally we have seen around 4000-10,000 spam hits a day during spam campaigns

Beware; Adwind RAT infecting Windows, OS X, Linux and Android Devices (Hack Read) The Java-based cross-platform adwind rat not only steals data but also turns the infected device into a botnet

Exploit kit miscreants rush to plug gap in cyber-crime marketplace (Register) Sundown's getting updates, possibly from Yugoslavian crooks

A surge of Pokemon Go-related apps is out to steal your data (CSO) A throng of unofficial apps has tried to piggyback on the title’s success

Pokemon Go concerns? Security firms give conflicting opinions (First Post Tech 2) Pokémon Go has taken over the world by storm and while it has become a major concern for security, fans are going crazy trying to catch these pocket monsters via the AR-based game. A US Senator has also called for a probe into Pokémon Go with regards to privacy concerns. But security firms have conflicting opinions on the same – while Trend Micro says that Pokémon Go raises security issues, F-Secure says that these concerns have been blown out of proportion

Pokémon Go malware caught by Skycure (Skycure Blog) Malicious hackers love big targets, and the community of Pokémon Go enthusiasts created a very large target over the last few days. Within 48 hours of the release of the new game, Skycure had already identified multiple repackaged app versions around the world. This is an amazing testament to the power of Skycure’s Crowd-sourced Threat Intelligence technology and deep app analysis

Pokémon Go continues its worldwide march, now live in the UK (TechCrunch) One of the more interesting side effects from the explosion of new mobile AR game Pokémon Go is physical movement: a lot of people are finding themselves walking miles and miles (and miles) more than they normally would as they search for PokéStops, load up on PokéBalls, and (of course) track down more Pokémon. Now the game itself — which originally launched in Australia, New Zealand, and the U.S. — is doing a bit of travelling of its own: as of this morning, Pokémon Go is now live in the UK both on iOS and Android

Pokémon Go installed on more devices than Candy Crush, LinkedIn, Lyft, Tinder & more (TechCrunch) Still fascinated by the viral spread of Pokémon Go? So are we. The app on Monday topped Twitter’s daily users, and has people spending more minutes per day playing the game than browsing Facebook, reports have indicated. Now comes word that game has also topped Pandora, Netflix, Google Hangouts, and Spotify, in terms of daily active users, and is installed on more devices than many popular apps, like Candy Crush, Viber, LinkedIn, Clash of Clans, Tinder and others

Palo Alto Networks Researchers Discover Two Critical Internet Explorer Vulnerabilities (Palo Alto Networks Research Center) Palo Alto Networks researchers discovered two new critical Internet Explorer (IE) vulnerabilities affecting IE versions 9, 10, and 11. Both are included in Microsoft’s July 2016 Security Bulletin, and documented in Microsoft Security Bulletin MS16-084

Cyber-attack on tax-on-web (Expatica) Today is the last day on which you can file your tax returns online using the tax-on-web application without risking a fine

Cryptocat dev reckons WhatsApp is blocking calls to Saudi numbers (Register) Decompiled code suggests blocks are embedded in the app

Fake Olympic tickets and Zika news apps scam users (CSO) Scammers are creating fake websites targeting Olympic fans

We Tried to Operate a Surgical Robot While It Was Being Hacked (Motherboard) Robots have already started working alongside surgeons, but in the future they won’t even have to be in the same room, or perhaps not even on the same planet

Security Robot Knocks Toddler To The Ground Then Runs Him Over At Stanford Shopping Center (SFist) A Palo Alto toddler was injured last Thursday after his parents claim a security robot at the Stanford Shopping Center knocked him over and then proceeded to run him over. And what's more, ABC 7 reports that this may not be the first time that the 5-foot-tall, 300-pound autonomous robot has injured a child

Security Patches, Mitigations, and Software Updates

Juniper patches high-risk flaws in Junos OS (CSO) Attackers could exploit the flaws to gain admin access or cause denial-of-service conditions

Cyber Trends

“I agree to these terms and conditions” is the biggest lie on the Internet (Help Net Security) Two communications professors have proven what we all anecdotally knew to be true: the overwhelming majority of Internet users doesn’t read services’ terms of service (ToS) and privacy policies (PP), and those few they do, they do it far from thoroughly

Nearly 1 in 3 consumers victimized by card fraud (Help Net Security) Thirty percent of consumers globally have experienced card fraud in the past five years, according to ACI Worldwide and Aite Group

Threat intelligence sharing on the rise among cybersecurity vendors (CIO Dive) Dive Brief: A growing number of cybersecurity companies are creating ways to share data about cyberthreats both with each other and customers, to help better respond to threats, according to an IDG News Service report. Carbon Black and Palo Alto Networks both recently initiated programs to share cyberthreat data with other companies. Carbon Black launched a new platform called the Detection eXchange, which enables thousands of companies to share "patterns of attack," according to the report. Elsewhere, Palo Alto Networks works with Fortinet, Intel Security and Symantec on the Cyber Threat Alliance, wherein the companies share thousands of malware samples daily

Evolution of Cloud Security Hindered by IT Skills Shortage: Survey (Nearshore Americas) More than 38% of those surveyed suggested providing training for existing IT security workers, while others favored the idea of increasing the hiring of junior IT professionals

Rise in Shadow IT Linked to More Cyberattacks in Germany than in the UK, According to New Research from Tenable Network Security (BusinessWire) Engineering, R&D and finance are top three departments responsible for introducing shadow IT into the workplace

Marketplace

Romanian company boards to focus on risk management, governance in next two years, says Deloitte (Business Review) Company boards adopt a more optimistic outlook for growth and competitiveness in the short to medium term compared to the recent past according to the first edition of the Deloitte Survey “EMEA 360° Boardroom Survey: Agenda priorities across the region”

Appthority raises $7 mln Series B CORRECTION (PE Hub) San Francisco-based Appthority, a provider of enterprise mobile threat protection solutions, has raised an additional $7 million in Series B funding. Trident Capital Cybersecurity led the round with participation from U.S. Venture Partners, Venrock, Blue Coat Systems and Knollwood Investment Advisory

Samsung SDS invests in UK cybersecurity firm Darktrace (ZDNet) Samsung SDS has invested in UK cybersecurity startup Darktrace, along with Korean blockchain platform maker Blocko, for new growth

FireEye Is a Tremendous Buy (Investor Guide) The cyber security market is booming and although many companies in the sector are still loss-making, they should be highly profitable in the far-off future. As of now, FireEye (FEYE) is my favourite pick from the sector as the company reportedly rejected few acquisition offers. With acquisition still in the cards, FireEye makes for a great speculative play for investors

Why Analysts Are Cheering for the Possible Sale of Intel's Security Business (Fortune) But the company is unlikely to get paid more than the $7.7 billion it spent on the unit

Booz Allen Hamilton (BAH) Awarded $460M IDIQ Contract from USCYBERCOM (Street Insider) It is easier and less expensive than ever for a bad cyber actor to acquire the technology and tools to carry out a cyber attack. As a result, the challenge of ensuring the nation’s cybersecurity has become more complex. Today’s threat environment requires that the nation’s cyber defenders be equipped with actionable intelligence and a keen sense of the tactics, techniques, and procedures to protect our organizations, infrastructure and citizens’ personal information. In recognition of this changing domain, General Services Administration (GSA)/Federal System Integration and Management Center (FEDSIM) has awarded Booz Allen Hamilton a seat on the $460 Million USCYBERCOM MA Indefinite Delivery, Indefinite Quantity (IDIQ) contract. Booz Allen will provide mission support services that include providing capabilities and expertise in the full range of technologies, Cyberspace Operations, joint operation planning, training and exercises

Cabrillo Technologies Captures $37M SPAWAR Win (IT News Online) McKean Defense Group, LLC announced today that its Cabrillo Technologies business unit was awarded a $37M Space and Naval Warfare Systems Command (SPAWAR) contract to provide afloat, ashore, and airborne networks and information systems technical support services. The indefinite delivery indefinite quantity contract has a five-year period of performance

Procera Networks wins multi-million dollar policy enforcement and analytics order from tier 1 APAC telco (Yahoo! Finance) Procera Networks today announced a multi-million dollar policy enforcement and analytics deployment with a tier one APAC fixed operator. The operator is integrating Procera's policy enforcement solutions alongside a Policy and Charging Rules Function (PCRF) solution from another vendor to deliver advanced Quality of Service (QoS) for streaming video services on their network

Raytheon Piles On Cyber, Electronic Warfare Protections (Breaking Defense) Raytheon keeps pushing cyber at its air show appearances, clearly convinced that the Pentad’s commitment to building cyber protection in every weapon system from airplanes, to missiles to, well, everything

Shlomo Kramer: a security investor looking for smart entrepreneurs to disrupt markets (Network World) Tips on how to invest wisely in tech startups

GSA pitches Silicon Valley on federal cyber acquisition (FedScoop) Administrator Denise Turner Roth is visiting San Francisco to host an industry day on GSA's efforts to support the Cybersecurity National Action Plan

Unpacking DoD’s Cyber Strategy and $6.7B Spending Plan (Govtech Works) Congress will likely approve Defense Secretary Ash Carter’s $6.7 billion cyber budget request for 2017 – a 15.5 percent increase over 2016 – but lawmakers want more detail on future spending requests

Intel Security partners with ‘heavy hitters' in security space (CRN) Security vendor adds 24 new vendors to its security alliance, a move it says recognises that it can't do it all alone

Avast purchase of AVG set to secure Prague as global computer antivirus hub (Radio Praha) In what looks like one of the biggest deals of the year, two originally Czech computer antivirus security companies have announced they are getting together with the likelihood of putting Prague and the Czech Republic permanently on the map as the home of one of the world’s leaders in the sector

Galway company Titan HQ enter US market (Galway Independent) TitanHQ, a Galway based company specialising in email and web security solutions for business, has announced a major distribution deal in the US with The Douglas Stewart Company

Sophos to focus on gaining new partners' trust (CRN) Security vendor says its emphasis will be on making sure new partners are 'part of the existing partner family'

Illumio Named One of the Top 50 Startups in Tech (Yahoo! Finance) Illumio, the Adaptive Security Company, today announced it has earned a spot in the Big 50-2016 report, Startup50's annual roundup of the top tech startups to watch in the coming year

Chiron Cyber Security Training Expands into Quantico Corporate Center (Benzinga) Chiron and Yyotta partner on next generation cyber security learning management system delivered from Yyotta Cloud

In wake of Appelbaum fiasco, Tor Project shakes up board of directors (Ars Technica) New team includes Cindy Cohn, Biella Coleman, Matt Blaze, and Bruce Schneier

Products, Services, and Solutions

Symantec introduces security solution for connected cars (Times of India) Cybersecurity firm Symantec today announced a new solution to protect connected cars against zero-day attacks. Called Symantec Anomaly Detection for Automotive, the solution provides the ability to identify issues so they can be remedied early

Contractor adds cyber 'secret sauce' service to GSA schedule (FedScoop) ECS is a DHS program that allows internet and telecom providers to offer security services incorporating the NSA's "secret sauce" — threat signatures and other indicators that show hackers at work

Israeli startup Votiro takes on ransomware in hospitals (Geektime) Tel Aviv-based Votiro security firm announced on Tuesday that the ALYN Woldenberg Family Hospital in Jerusalem would be integrating their email protection solutions to guard against ransomware attacks

CloudLock Expands Malware Detection Orchestration Capabilities and Ecosystem With Leading Malware Threat Detection Solution Providers (PRNewswire) CloudLock®, the leading Cloud Access Security Broker (CASB) and Cloud Cybersecurity Platform, today announced its expanded cybersecurity orchestration ecosystem, delivering advanced malware detection capabilities through integrations with OPSWAT and VMRay to complement the company's existing integration with the threat emulation capabilities of Check Point. The first-of-its-kind integration unifies protection against malware and the growing volume of ransomware across hybrid cloud environments

Creepy Russian tech lets employers spy on all mobile phone calls made on their premises (International Business Times) Natalya Kaspersky touting solution designed to help companies prevent the leak of confidential information

Wombat Security Recommends 'Top Down' Approach to Cybersecurity Education (EIN News) When it comes to security awareness and training, the primary focus is on managing end-user risk. And rightfully so, says Wombat Security, a leading provider of cybersecurity education products and programs, who indicates that uneducated, unprepared end users are more likely to exhibit risky behaviors than those who have been trained to recognize and respond to threats like phishing emails, business email compromise (BEC), and ransomware attacks

Black Duck announces integration of Hub solution with HPE Security Fortify Software Security Center (Software Development Times) Black Duck, a global leader in automated solutions for securing and managing open source software, today announced the integration of its flagship Hub solution into HPE Security Fortify Software Security Center (SSC), which helps organizations measure and control their application security posture and provides visibility into software risk across the enterprise

Pure Storage Earns NIAP Common Criteria Certification (Yahoo! Finance) Pure Storage (PSTG), the market's leading independent solid-state array vendor, today announced that its FlashArray//m and 400 series products have earned the National Information Assurance Partnership (NIAP) Common Criteria Certification (Network Device Protection Profile, v1.1). This certification validates that products in the Pure Storage FlashArray portfolio meet the stringent testing and technical requirements for security mandated by the U.S. National Security Agency (NSA) along with 25 other governments worldwide

CMS Airship: Free secure content management (Help Net Security) CMS Airship is a free content management system designed and maintained by a team of PHP security experts at Paragon Initiative Enterprises

Technologies, Techniques, and Standards

Omni Hotels' new CIO shores up cybersecurity amid data breach (CSO) Following the infiltration of the hotel chain’s network with payment card-stealing malware, Omni is looking to use analytics software to detect and quarantine attacks

The Value of a Hacked Company (KrebsOnSecurity) Most organizations only grow in security maturity the hard way — that is, from the intense learning that takes place in the wake of a costly data breach. That may be because so few company leaders really grasp the centrality of computer and network security to the organization’s overall goals and productivity, and fewer still have taken an honest inventory of what may be at stake in the event that these assets are compromised

3 Best Practices for Protecting Data Better than Hillary Did (eSecurity Planet) Hillary Clinton's email scandal offers a reminder of the importance of data protection best practices, like the three we cover here

Cyber Security for Travelers: How Not to Get Burned This Summer (Heimdal Security) It’s as summer as it can possibly be

Blog: U.S. Army's Cyber Quest Underway in Georgia (SIGNAL) The U.S. Army is testing how cyberwarriors adjust to morphing cyber threats and electromagnetic warfare (EW) attacks during its Cyber Quest 2016, an exercise now underway at the Cyber Center of Excellence at Fort Gordon, Georgia. The event examines concepts and products that could influence future technologies and requirements as well as other Army and Defense Department exercises and experiments

Coast Guard says it’s the first to achieve FOC on insider threat program (Federal Times) The Coast Guard says it’s the first agency in the Executive Branch to achieve full operating capability on its insider threat program

How to Remove Trojan Win32-Adload (Spywaretechs) Trojan Win32-Adload is a malicious software that will inject in your system. It may display fake warnings that your computer has been infected. The Trojan Win32-Adload injects into the Operating System to change permission policies and to modify the registry. Most likely, Trojan Win32-Adload was installed by the user not knowing that this program is malicious. The distribution of Trojan Win32-Adload is most certainly related to downloading fake Windows updates, installing third-party programs “supposedly” required to properly view a webpage or watch videos, clicking on ads or banners, downloading attachments or receiving files through a social media

Design and Innovation

Killing the password: FIDO says long journey will be worth it (CSO) Eliminating passwords will take years, acknowledges the FIDO Alliance. But it says it is well on its way to a faster, easier and much more secure online authentication standard

Hash Histories - Toy Blockchains for Great Danger (InfoQ) Chris Anderson discusses Document Coin and using blockchain in new and innovative ways. He presents the JavaScript Cryptography code line by line and runs test cases using Prova in the browser

Research and Development

Riffle: A new anonymity system to rival Tor (Help Net Security) A group of researchers from MIT and the Swiss Federal Institute of Technology in Lausanne have come up with a new anonymity system that is both bandwidth and computation efficient, as well as less susceptible to traffic analysis attacks than Tor, the currently most widely used anonymity network

MIT Anonymity Network Riffle Promises Efficiency, Security (Threatpost) Researchers from MIT believe a new anonymity scheme they’ve devised dubbed Riffle could contend with Tor, claiming it’s every bit as secure as Tor, and bandwidth-efficient, to boot

Sandia Labs Researchers Build DNA-Based Encrypted Storage (Dark Reading) Researchers at Sandia National Laboratories in New Mexico are experimenting with encrypted DNA storage for archival applications

Legislation, Policy, and Regulation

When and how to respond to cyber acts of war (Federal Times) As cyberattacks become more sophisticated and in some cases more destructive, at what point should the U.S. flex its muscles and say enough is enough?

Britain Has a New Snooper-in-Chief (Foreign Policy) And her name is Theresa May

Russia Foreign Intelligence Service Expands (FAS) The headquarters complex of the Foreign Intelligence Service (SVR) of the Russian Federation has expanded dramatically over the past decade, a review of open source imagery reveals

GDPR could create $320 billion in fines (Help Net Security) Unsurprisingly, many consumer products organisations are taking risks with the security and privacy of their customer data. They are failing to put in place proper processes and safeguards in the rush to harvest as much information as possible and realise the rewards promised by deep, real-time consumer insights

What's Next For Canada’s Surveillance Landscape? (Dark Reading) Edward Snowden headlines SecTor security conference as Canadian privacy advocates await the Trudeau government's next move in the country's complex privacy and security debate

Feinstein encryption bill, opposed by Silicon Valley, likely dead (Charlotte Observer) Even former CIA director Michael Hayden thinks it’s a bad idea. Despite San Bernardino killings, no appetite for forcing companies to decipher encoded messages. Other countries are cracking down on encryption

Senator grills DOE official over lack of cyber training programs (FedScoop) "Doesn’t anyone else see a problem of manpower here," questioned Sen. Bill Cassidy

California lawmakers want to bring down the hammer on ransomware (Naked Security) Ransomware: There ought to be a law against that

Litigation, Investigation, and Law Enforcement

China hacked the FDIC - and US officials covered it up, report says (CNN Money) China's spies hacked into computers at the Federal Deposit Insurance Corporation from 2010 until 2013 -- and American government officials tried to cover it up, according to a Congressional report

Interim Staff Report: The Science, Space, and Technology Committee's Investigation of FDIC's Cybersecurity (Science, Space, and Technology Committee, House of Representatives) This interim report provides hearing background for the House Science, Space, and Technology Committee

The FDIC's Process for Identifying and Reporting Major Information Security Incidents (Office of Inspector General, Federal Deposit Insurance Corporation) The Federal Information Security Modernization Act of 2014 (FISMA) requires federal agencies to develop, document, and implement an agency-wide information security program that includes (among other things) procedures for detecting, reporting, and responding to information security incidents

9th Circuit: It’s a federal crime to visit a website after being told not to visit it (Washington Post) The U.S. Court of Appeals for the 9th Circuit has handed down a very important decision on the Computer Fraud and Abuse Act, Facebook v. Vachani, which I flagged just last week. For those of us worried about broad readings of the Computer Fraud and Abuse Act, the decision is quite troubling. Its reasoning appears to be very broad. If I’m reading it correctly, it says that if you tell people not to visit your website, and they do it anyway knowing you disapprove, they’re committing a federal crime of accessing your computer without authorization

Immunity Law Doesn't Shield Forum Site From Moderator Posts (Bloomberg BNA) An internet forum operator couldn't assert federal online publisher immunity against claims that one of its volunteer moderators allegedly defamed an anti-malware product on the site, the U.S. District Court for the Southern District of New York ruled July 8 ( Enigma Software Group USA LLC v. Bleeping Computer LLC , S.D.N.Y., No. 1:16-cv-00057, 7/8/16 )

The FBI may release two memos with the State Department about the Clinton email probe (VICE News) The FBI said on Wednesday that it will consider whether the bureau can release two letters it sent to the State Department about its investigation into Hillary Clinton's email server. Additionally, the bureau said it will turn over several thousand deleted emails it recovered to the State Department, which the FBI wants to make the final decision whether those communications can be publicly released

FBI agents signed NDA for matters involving Hillary’s emails (New York Post) In an unusual move, FBI agents working the Hillary Clinton email case had to sign a special form reminding them not to blab about the probe to anyone unless called to testify

Ryan: 'Dangerous call' to give Clinton classified briefings (The Hill) House Speaker Paul Ryan claimed Wednesday it will be “a dangerous call” to give Hillary Clinton classified intelligence briefings after she receives the Democratic presidential nomination

Sloppiness in Handling Highly Classified Information is Widespread (Cipher Brief) FBI Director James Comey’s 5 July statement on the investigation into Hillary Clinton’s private e-mail server was exactly what we would expect from a professional investigative service. He explained the issues in plain language, focused on facts, and made clear that the multitude of political opinions swirling around the case are uninformed and had no impact on the investigation. However, I am certain that the Director’s recommendation to not indict Clinton will surprise many people who heard him reveal Clinton had mishandled classified information

Conservatives move to impeach IRS chief (Washingon Examiner) Conservative House Republicans on Wednesday introduced a resolution to impeach Internal Revenue Service Commissioner John Koskinen, something they hope can get a vote this week before Congress leaves for an extended summer break

Google’s ad business “breaches” EU rules, says antitrust chief (Ars Technica) Price comparison charges "reinforced," fresh charges against ad practices coming

For a complete running list of events, please visit the Event Tracker.

Newly Noted Events

RSA Conference Asia Pacific & Japan (Singapore, Jul 20 - 22, 2016) RSA Conference Asia Pacific & Japan is the leading information security event in the region. Join us 20 to 22 July at the Marina Bay Sands in Singapore for three days of engaging sessions and intense networking. Get exposure to innovative technologies and leadership that will help secure your organization and your future.

3rd Annual Senior Executive Cyber Security Conference: Navigating Today’s Cyber Security Terrain (Baltimore, Maryland, USA, Sep 21, 2016) The Johns Hopkins University Information Security Institute and COMPASS Cyber Security are hosting the 3rd Annual Senior Executive Cyber Security Conference on Wednesday, September 21, from 8:30 a.m. – 4:00 p.m., on the Homewood campus of Johns Hopkins University. Hear from industry leaders on cyber security best practices and trends that will help you better secure your organization’s data. This year’s agenda examines the current cyber security landscape, threats, and challenges ahead for organizations and how senior leaders can work towards “shifting their data to being safe and secure.”

Upcoming Events

SINET Innovation Summit 2016 (New York, New York, USA, Jul 14, 2016) “Connecting Wall Street, Silicon Valley and the Beltway.“ SINET Innovation Summit connects America’s three most powerful epicenters and evangelizes the importance of industry, government and academic collaboration on joint research initiatives. The opportunity to bring practitioners and theory together to discuss fundamental Cybersecurity challenges is critical to the advancement of innovation in the Cybersecurity domain. This summit is designed to reinvigorate public-private partnership efforts and increase relationships that foster the sharing of information and joint collaboration on Cybersecurity research projects

Insider Threat Program Development Training (Washington, DC, USA, Mar 29 - 30, 2016) Insider Threat Defense announced it will hold a training class on Insider Threat Program Development (National Insider Threat Policy-NISPOM Conforming Change 2) on March 29-30, 2016, in Washington, DC. For a limited time the training is being offered at a discounted rate of $795. The training is comprehensive and provides students with the knowledge and resources to develop and implement a robust Insider Threat Program. Insider Threat Defense has trained a substantial number of organizations and has become the "Go To Company" for Insider Threat Program Development Training

cybergamut Technical Tuesday: The Importance of Managing Attribution Online by Dani Charles of Ntrepid Corporation (Elkridge and Calverton, Maryland, USA, Jul 19, 2016) cybergamut Technical Tuesday is for cyber professionals to exchange innovative ideas and discuss technical issues of mutual interest. We’ll have a Technical Tuesday event on 19 July 2016 (1600 – 1730 East Coast Time). The importance of open-source intelligence (OSINT) has increased exponentially as more and more information has come available online. At the same time, the increased sophistication of websites and platforms means the content one sees can be easily blocked or manipulated based on one’s attribution to an organization, region, or country. This presentation focuses on the importance of Managed Attribution, detailing the technical methods employed by websites and platforms to determine attribution, and presenting solutions that allow users to manage their attribution in order to get access to the most authentic and accurate information.

CyberSec 2016 (New York, New York, USA, Jul 19, 2016) Ask any bank CEO in the U.S. what keeps them up at night and cybersecurity is bound to be in the top five. Maybe even no. 1. And while the threat matrix is evolving rapidly, along with the regulatory demands, so are the technology tools available to help meet them. This one-day conference will take a big-picture look at the threats facing banks today and tomorrow, and offer insights on how to combat them.

Nominations are now open: National Cyber Security Hall of Fame (Baltimore, Maryland, USA (nominations submitted online), Jul 20, 2016) The Cyber Security Hall of Fame "Respect the Past - Protect the Future" accepts nominations from companies and organizations that are engaged in, and committed to, the growth of the cyber security industry. Each of the nominators can submit nominations in the following categories or combination of categories: Technology, Policy, Public Awareness, Education, and Business.

Billington Global Automotive Cybersecurity Summit (Detroit, Michigan, USA, Jul 22, 2016) Billington Cybersecurity, an independent conference company focused exclusively on cybersecurity seminars, announces the first global summit that brings together the most senior government and industry experts to examine cyber security in the automotive industry. The Chairman and CEO of General Motors, Mary Barra, U.S. Transportation Secretary Anthony Foxx, U.S. Senator Gary C. Peters and Lyft CEO and Co-Founder Logan Green will discuss industry and government insights on automotive cybersecurity.

Community College Cyber Summit (3CS) (Pittsburgh, Pennsylvania, USA, Jul 22 - 24, 2016) The third annual Community College Cyber Summit (3CS) is organized and produced by six Advanced Technological Education (ATE) centers funded by the National Science Foundation (NSF) and involved in cybersecurity. 3CS meets the perceived need for a national academic conference that focuses exclusively on cybersecurity education at the community college level. Faculty, administrators, and other stakeholders in community college cybersecurity education are invited and encouraged to attend

SANS ICS Security Summit & Training — Houston 2016 (Houston, Texas, USA, Jul 25 - 30, 2016) SANS has joined forces with industry leaders and experts to strengthen the cybersecurity of Industrial Control Systems (ICS). The initiative is turning ICS cybersecurity around by equipping both security professionals and control system engineers with the security awareness, work-specific knowledge, and hands-on technical skills they need to secure automation and control system technology. Register now for these ICS skills based courses.

SANS San Jose 2016 (San Jose, California, USA , Jul 25 - 30, 2016) Information security training is coming to Silicon Valley from SANS Institute, the global leader in information security training. At SANS San Jose 2016, July 25-30, 2016, choose from 7 hands-on, immersion-style cybersecurity training courses taught by real-world practitioners. We will see you at The Westin San Jose, located in the heart of downtown San Jose. Now is the time to improve your information security skills. SANS San Jose 2016 features comprehensive hands-on technical training from some of the best instructors in the industry and includes several courses that will prepare you or your technical staff for DoD 8570 and GIAC approved certification exams. Start making your plans to attend now!

AfricaHackOn (Nairobi, Kenya, Jul 28 - 29, 2016) What began as a casual meet up for information security professionals has become one of the formidable forces in the profession. That group is the AfricaHackOn. Housed under its parent umbrella, Euclid Consultancy Ltd, AH as fondly known, has traversed all odds to becoming a leading venture in raising awareness on matters affecting cyber security and also grooming upcoming talent into the job market. We have been poised to becoming a one stop shop for talent and resources in a field greatly short staffed.

Ransomware, exploit kits, and cross-platform adware. Pokémon Go's long march through the Internet. China hacked US FDIC. US courts suggest expansive understanding of cyber liability.

Notes.