The CyberWire Daily Briefing 01.28.16

Cyber Attacks, Threats, and Vulnerabilities

'Critical' Israel power grid attack was just boring ransomware (Register) Minister puts nation on alert, SANS Institute says move along, nothing to see here

Context for the Claim of a Cyber Attack on the Israeli Electric Grid (SANS ICS Blog) *Update* A cyber analyst in Israel (Eyal Sela) messaged me to add that the media reporting so far is misleading with regards to the context around the incident. The "Israel Electric Authority" the Minister mentioned is in no way related to the networks of the Israeli electric companies, transmission, or distribution sites

Exclusive: Hackers may have wider access to Ukrainian industrial facilities (Reuters) Hackers were able to attack four sections of Ukraine's power grid with malware late last year because of basic security lapses and they could take down other industrial facilities at any time, a consultant to government investigators said

BlackEnergy APT Group Spreading Malware via Tainted Word Docs (Threatpost) Attackers have begun using rigged Microsoft Word documents propagated via spearphishing emails to spread the BlackEnergy Trojan

Macros, Network Sniffers, But Still No 'Smoking Gun' In Ukraine Blackout (Dark Reading) Further analysis of the Black Energy 3 malware studies payloads used for reconnaissance in the attacks

Ukraine Power Outage Exposes Industrial Networking Risk (Belden: the Right Signals Blog) While there have been numerous high profile cyberattacks on industry over the past few years, their consequences have primarily been to steal information (Dragonfly, Flame, Duqu) or interrupt business operations (Shamoon). Stuxnet and the attack on the German steel mill were rare cases where a control system was disrupted as a result of a malware infection

Techie on the ground disputes BlackEnergy Ukraine power outage story (Register) And Russia? That's too convenient

NSA Hacking Chief: Internet of Things Security Keeps Me Up at Night (Technology Review) The leader of the National Security Agency's hackers says that putting industrial control systems online has made America less secure

ISIS affiliate Cyber Caliphate announces plans to hack Google (TechWorm) Remember Cyber Caliphate? Yes, the hacking group affiliated to IS or ISIS/Daesh is planning to hack Google

ISIS Communications App: Much Ado About Not Much (Defense One) The group's "secure messaging app" doesn't work. Ghost Security Group backtracks on previous claim

North Korea 'Carries Out Cyber Attack On South' (Sky News) The South's unification ministry confirms its suspects the North of trying to hack into government and industry computer systems

Hot-patching method melts security hole in Apple's App Store (Register) JSPatch is a time bomb waiting to explode, warns FireEye

Security Alert: New CryptoWall 4.0 Campaign — Preparation for CryptoWall 5.0? (Heimdal Security) Ransomware attacks have grown exponentially in 2015, and all evidence points to the fact that the trend is likely to continue

7ev3n Ransomware trashes your PC and then demands 13 Bitcoins (Bleeping Computer) A new ransomware has been spotted called 7ev3n that encrypts your data and demands 13 bitcoins to decrypt your files

New Android ransomware uses clickjacking to gain admin privileges (PCWorld) The app overlays system dialogs on top of the device administrator confirmation window and hijacks users' clicks

Rogue Google browser extension found spying on users (V3) A rogue Google extension is granting invasive permissions that let the app spy on user activity, according to security firm Malwarebytes

Fake Facebook 'Security System Page' scams want your payment card details (Graham Cluley) Fake "Security System Page" scams are making the rounds on Facebook and are trying to lure users into handing over their payment card details

Panic at the Cisco(!): Facebook Malware on the Rise (ZeroFOX Blog) If there's one truism every security professional knows, it's that there will always be a new threat to address. Newest to the table: Facebook malware. As long as your data can be sold, the attack landscape will never stop shifting

MiniUPnP Vulnerability Clears Way for Stack Smashing Attack (Threatpost) The Internet of Things security challenge is twofold: finding bugs, and more urgent — fixing them

Dridex malspam example from January 2016 (Internet Storm Center) I occasionally find malicious spam (malspam) that's blocked by our email filters for various reasons. Most of these blocked messages have .zip archives as file attachments. The .zip archives contain malware designed to infect Windows computers, like Win32 .exe files or Javascript-based malware downloaders (.js files)

Software bug exposes Uber driver's tax info (Naked Security) A bug in Uber's code has led to one of its drivers' personal information being sent to an unknown number of other drivers

Despite repeated warnings, pervasive EHR fraud vulnerabilities remain (FierceHealthPayer) Hidden audit logs and EHR software tools pave the way for brash schemes that rely on fabricated records

Safari is crashing for some iPhone and Mac users (FierceCIO) Some Mac and iPhone users are reporting a problem that causes Safari to crash when attempting to type in the address bar

How much could a cyber attack cost the HMRC? (Help Net Security) HMRC could face compensation claims of over £13 billion if it were to lose people's personal and financial data as a result of a cyber attack, according to a new study by MIRACL

2016 Iowa Caucus Website Hacked by 'Anonymous Conservative' (Hack Read) Anonymous Conservative is the name of a group that has managed to hack the 2016 Iowa Caucus website on Monday

Cyber attack affects Collier County hospital employees (WINK News) Employee information at North Collier Hospital was breached in a major cyber attack Wednesday, a hospital spokesperson confirmed

Three-Year-Olds Could Hack Sites, Firms Warned (Sky News) The Information Commissioner tells MPs that even a three-year-old child could be shown how to hack into a company's website

Security Patches, Mitigations, and Software Updates

Online advertising company fixes severe XSS flaw (IDG via CSO) The flaw could have been used to steal data from people's computers through a malicious online ad

Oracle deprecates the Java browser plugin, prepares for its demise (Ars Technica) It will be removed some time after the release of Java 9

Mozilla Patches Critical Vulnerabilities in Firefox 44 (Threatpost) Mozilla has patched a number of critical vulnerabilities in Firefox 44 and Firefox Extended Release 38.6, which were released this week

Cyber Trends

Larger, more complex, financially motivated DDoS attacks on the rise (Help Net Security) DDoS attacks are becoming increasingly larger, more complex, and perpetrated by cyber extortionist instead of hacktivists and vandals, the results of Arbor Networks' 11th Annual Worldwide Infrastructure Security Report have revealed

One in six Russian companies faced DDoS attack in 2015 — Kaspersky Lab (TASS) In Russia, cyber criminals most often attacked medium and large businesses

Less porn-surfing corporate bosses, more execs taking phishing bait to infect networks (Network World) Malware analysts in the U.S. say there are less infections caused by porn-surfing bosses than two years ago, but more executives clicking on phishing links and infecting networks

Good guys, bad guys square off in cyber security race (Business Insurance) While the top cyber threats faced by businesses remain essentially unchanged, businesses dealing with these threats and their cyber criminal adversaries are both making progress — for better and for worse — the European Union Agency for Network and Information Security says in a report

1 in 3 home routers will be used as public Wi-Fi hotspots by 2017 (Help Net Security) Juniper Research predicts that at least 1 in 3 home routers will be used as public Wi-Fi hotspots by 2017, and that the total installed base of such dual-use routers will reach 366 million globally by the end of 2020

New Report on the State of Phishing Attacks From Wombat Security Shows Significant Increases Year Over Year (Yahoo! Finance) 85% report being the victim of a phishing attack, up 13% from 2014; 67% report a spear phishing attack, up 22% from 2014

Cyberwarfare in 2016: The Virtual Battle for Your Information (Tripwire: the State of Security) In the 21st century, we can expect information technology to play a major role in international espionage and conflict

Why 2016 Will Be an Even Scarier Year for Internet Security (Huffington Post) The holiday decorations had barely been returned to the attic when 2016 already saw its first high-profile cyber attack

Marketplace

At RSA Conference 'Cyber' Is Hot, 'Crypto' Is Not (Fortune) This one chart reveals a telling cybersecurity industry trend

U.S. and Israeli Startups Lead the Way in New Cyber Security Tricks (Haaretz) With corporate giants facing high-profile hacks in recent years, companies are desperate for ideas to make sure financial, personal and corporate data stay safe

The Middle East's Quietly Rising Cyber Super Power (Defense One) Israel now has more than 300 cybersecurity companies, exports totaling $6 billion, and 20 percent of the world's private cyber investment dollars

Cybersecurity Investing In Israel By The Numbers (TechCrunch) With the cybersecurity market growing to a gigantic size, it is well established that Israel is a hotbed of innovation and startups in the space

Israel's CyberArk focused on growing independently: CEO (Reuters via Street Insider) CyberArk Software is focused on building its business independently, the chief executive of Israel's second-largest cyber security company said, two weeks after it was reported to be in talks to be acquired

Deep Instinct: A New Way to Prevent Malware, With Deep Learning (Tom's Hardware) Malware has proven increasingly difficult to detect via signature or heuristic-based methods, which means most Antivirus (AV) programs are woefully ineffective against mutating malware, and especially ineffective against APT attacks (Advanced Persistent Threats)

Battelle awarded slot on $5B cybersecurity contract (C4ISR & Networks) Battelle has been selected for a major Department of Defense cybersecurity contract

Raytheon&#124Websense Awarded Contract To Enhance FBI Data Network Security (Homeland Security Today) Secure network access is vital for government entities striving to keep their data secure while maintaining its accessibility

GCHQ targets EM vulnerability of military systems (Electronics Weekly) GCHQ's information security arm and the UK's National Technical Authority for Information Assurance has appointed an accredited laboratory in the UK to perform Tempest first-of-type platform testing

Look Who's Worried About the NSA's 96 Percent Retention Rate (Defense One) It might seem counterintuitive that someone maintaining a workforce of 30,000 coders and analysts is concerned about too much loyal talent

Careers in InfoSec: Don't Be Fooled By The Credential Alphabet (Dark Reading) Analytical skills, work ethic, an ability to overcome obstacles, and a natural drive to solve problems are the critical hiring factors in today's tight job market

The Rise of the Tech-Savvy Lawyer (Legaltech News) The benefits can be roughly divided into two primary categories: those related to client outcomes and those related to the business of law

VMware cuts 800 jobs, loses CFO amid uncertainties around Dell acquisition (FierceCIO) VMware reported late Tuesday some bad news, even as it released solid full-year financial earnings, adding to concerns that have been piling up against the company recently

VMware Fusion, Workstation team culled in company restructure (Ars Technica) Company says it's just "transitioning" as part of reorganization, products will be supported

Tanium Names Ex-Googler Scott Rubin as First Communications Chief (Re/code) Tanium, the heavily funded computer security startup, has named its first chief communications officer

LightCyber Appoints Claudio Perugini as Senior Vice President of Sales to Expand Global Field and Channel Organization (BusinessWire) Significant 2015 growth and milestones drive next phase of expansion

Products, Services, and Solutions

Refugee or Terrorist? IBM Thinks Its Software Has the Answer (Defence One) A new tool to turn unstructured data into actionable intelligence could change the way law enforcement fights terrorism, and challenge the data-collection debate

Marsh launches excess cyber product underwritten by Lloyd's (Business Insurance) Marsh L.L.C. on Wednesday said it has launched a global excess cyber risk facility underwritten by Lloyd's of London syndicates

Symbiont taps Gemalto to offer high-assurance security for blockchain-based services (Nasdaq) Gemalto's SafeNet HSMs secure transactions and cryptographic identities on Symbiont platform

Lockr Managed Key Service for Drupal, WordPress Launches (eWeek) Lockr, a hosted API and managed key service for Drupal is out of beta and now also available for WordPress

Thycotic Announces Availability of Free Password Vulnerability Benchmarking Tool (IT Business Net) Thycotic, a provider of privileged account management (PAM) solutions for more than 3,500 organizations worldwide, is offering organizations a free online comparative assessment tool that demonstrates how companies compare to other, similarly-sized organizations, in meeting privileged password management best practices and security guidelines

Damballa Announces Failsafe Integration with Palo Alto Networks (BusinessWire) Integrated solution helps customers discover active infections and proactively establish policy-driven enforcement response to threats

Atos and Orange Cyberdefense team up (IT Pro Portal) Atos' technology brand Bull and Orange Cyberdefense have announced a partnership that will see the duo take on the secure mobile terminal communications market

Technologies, Techniques, and Standards

NSA's top hacking boss explains how to protect your network from his attack squads (Register) Rare public appearance from Tailored Access Operations leader

Data protection and breach readiness guide (Help Net Security) The Online Trust Alliance (OTA) released its 2016 Data Protection and Breach Readiness Guide, which provides prescriptive advice to help businesses optimize online privacy and security practices, and detect, contain and remediate the risk and impact of data loss incidents

Using the NIST Cybersecurity Framework to Combat Ransomware Attempts (Tripwire: the State of Security) We left 2015 talking about exponential increases in ransomware attempts on a quarter over quarter basis

John Halamka's 7 Steps to Prevent Healthcare Breaches (Digital Guardian) Here are 7 steps to securing healthcare data, as recommended by a healthcare CIO responsible for supporting 3,000 doctors, 18,000 faculty, and 3 million patients

1 tip to make your home safer on Data Privacy Day (Naked Security) Every so often some small and well-organised bit of the world decides that one day in particular would be a good day to have a Day day

Design and Innovation

How to Make Your Own NSA Bulk Surveillance System (Wired) Of all the NSA surveillance documents Edward Snowden leaked, some of the most important exposed the spy agency's so-called XKEYSCORE program, a massive system for vacuuming up and sifting through emails, chats, images, online search activity, usernames and passwords, and other private digital data from core fiber optics cables around the world

Academia

Cornell Tech adds four of the world's leading cybersecurity experts to faculty (Biopmetric Update) Cornell's Department of Computer Science has added four faculty members at Cornell Tech who are among the world's elite for cybersecurity, privacy and cryptography research

KU to train next-generation cybersecurity experts for government service (EurekAlert!) A new $4.7 million, five-year grant from the National Science Foundation will enable the University of Kansas School of Engineering to educate cyberdefense experts dedicated to public service, making America stronger in an era of rising cyberattacks

Legislation, Policy, and Regulation

Will your Swiss email account stay private (or can the govt take a look)? (We Live Security) Governments have struggled for years to find a balance between security and privacy, especially with electronic communications

How a Small Company in Switzerland Is Fighting a Surveillance Law — And Winning (Intercept) A small email provider and its customers have mobilized to force the Swiss government to put its new invasive surveillance law up for a public vote in a national referendum in June

Opinion: Forget about Safe Harbor. Modernize global privacy law instead (Christian Science Monitor Passcode) When the European Court of Justice invalidated Safe Harbor, it became clear that a single data agreement couldn't account for all the ways countries balance privacy, freedom of expression, and national security

Advocacy groups press for open dialogue on foreign surveillance reform (Christian Science Monitor Passcode) In a letter sent Wednesday, 25 human rights and privacy advocacy groups urged Congress to open a hearing on Section 702, one of the key legal mechanisms the National Security Agency relies on to carry out foreign surveillance

Rep. Mike Pompeo wants to revive mass surveillance program (McClatchy Washington Bureau) A Kansas lawmaker wants the nation's spies to get back their access to mass surveillance data that allowed the federal government to track communications of potential terrorists

Carter Encourages Cyber Command to Intensify Fight Against ISIL (US Department of Defense) Defense Secretary Ash Carter today encouraged U.S. Cyber Command to "intensify the fight" against the Islamic State of Iraq the Levant, Pentagon Press Secretary Peter Cook said

Winning the War We've Got, Not the One We Want (Army Magazine) We need some hard thinking. We are not winning the war against al-Qaida and the Islamic State group in Iraq or Syria, or elsewhere across North and East Africa, the greater Middle East, South Asia and beyond

Influencers: Tech firms should do more to block extremist content (Christian Science Monitor Passcode) A slim majority of Passcode Influencers said that US tech companies should ramp up efforts to remove extremist content from their platforms

Where the candidates stand on cybersecurity (Christian Science Monitor Passcode) From encryption to Chinese hackers, a handy guide to Internet politics in the 2016 presidential election

Strickling: Challenges remain but the future of Internet governance is bright (FierceGovernmentIT) As the debate on who "runs" the Internet continues, the head of the National Telecommunications and Information Administration said he believes multi-stakeholder decision-making will prevail

The admiral in charge of Navy intelligence has not been allowed to see military secrets for years (Washington Post) For more than two years, the Navy's intelligence chief has been stuck with a major handicap: He's not allowed to know any secrets

Litigation, Investigation, and Law Enforcement

Lawmakers to investigate use of Juniper Networks in federal IT (FierceGovernmentIT) The House Oversight and Government Reform subcommittee on information technology plans to take a closer look at federal agencies' use of compromised firewall technology, according to subcommittee chairman Rep. William Hurd (R-Texas)

The Data Breach You Haven't Heard About (Wall Street Journal) Foreign hackers may be reading encrypted U.S. government communications, yet basic information about what happened still isn't available

U.S. Congress to federal agencies: You have two weeks to tally your backdoored Juniper kit (IDG via CSO) The House of Representatives wants to gauge the impact of the recent Juniper ScreenOS backdoors on government departments and agencies

Police destroy evidence with 10 failed passcode attempts on iPhone (Naked Security) In January 2014, a Massachusetts cop was swearing into his mobile phone while working a traffic detail at a construction site

Hacker accused stealing military members' data and giving it to ISIS makes first U.S. court appearance (Washington Post) A man from Kosovo accused of hacking into a U.S. company's server and passing the personal information of American service members to the Islamic State appeared for the first time in a U.S. court Wednesday

NYC Launches Investigation Into Hackable Baby Monitors (Wired) Few scenarios conjure up digital nightmares darker than a hacked, Internet-connected camera pointing at a baby's crib

California Police Used Stingrays in Planes to Spy on Phones (Wired) The government's use of a controversial invasive technology for tracking phones just got a little more controversial

New Evidence Shows Milwaukee Police Hide Stingray Usage From Courts and Defense (ACLU) Late on Friday, the ACLU and ACLU of Wisconsin joined the Electronic Frontier Foundation in filing an amicus brief in a Seventh Circuit case involving real-time cell phone location tracking by police

For a complete running list of events, please visit the Event Tracker.

Newly Noted Events

Amsterdam 2016 FIRST Technical Colloquium (Amsterdam, the Netherlands, Apr 19 - 20, 2016) FIRST Technical Colloquia & Symposia provide a discussion forum for FIRST member teams and invited guests to share information about vulnerabilities, incidents, tools and all other issues that affect the operation of incident response and security teams

SecureWorld Kansas City (Overland Park, Kansas, USA , May 4, 2016) Join your fellow security professionals for affordable, high-quality cybersecurity training and education. Earn 6-12 CPE credits through 30+ educational elements learning from nationally recognized industry leaders. Attend featured keynotes, panel discussions & breakout sessions all while networking with local peers

SecureWorld Houston (Houston, Texas, USA, May 11, 2016) Join your fellow security professionals for affordable, high-quality cybersecurity training and education. Earn 6-12 CPE credits through 30+ educational elements learning from nationally recognized industry leaders. Attend featured keynotes, panel discussions & breakout sessions all while networking with local peers

SecureWorld Atlanta (Atlanta, Georgia, USA , Jun 1 - 2, 2016) Join your fellow security professionals for affordable, high-quality cybersecurity training and education. Earn 12-16 CPE credits through 60+ educational elements learning from nationally recognized industry leaders. Attend featured keynotes, panel discussions & breakout sessions all while networking with local peers

SecureWorld Portland (Portland, Oregon, USA, Jun 9, 2016) Join your fellow security professionals for affordable, high-quality cybersecurity training and education. Earn 6-12 CPE credits through 30+ educational elements learning from nationally recognized industry leaders. Attend featured keynotes, panel discussions & breakout sessions all while networking with local peers

Upcoming Events

SANS Institute: Information Security Training (Las Vegas, Nevada, USA, Sep 12 - 21, 2015) Information security training in Las Vegas from SANS Institute, the global leader in information security training. At SANS Network Security 2015, SANS offers more than 40 hands-on, immersion-style security training courses taught by real-world practitioners. The site of SANS Network Security 2015, September 12 - 21, is Caesars Palace, the majestic Las Vegas hotel

ESA 2016 Leadership Summit (Chandler, Arizona, USA, Jan 31 - Feb 3, 2016) The electronic security industry is rapidly changing and continuously evolving. It's not enough to just survive. Businesses looking to thrive need to adapt to ensure their people, products, services and practices stay ahead of the curve. The Summit is a three-day conference filled with networking and educational opportunities dedicated to delivering business intelligence to electronic security companies and professionals that are ready to embrace innovation and grow

SANS Cyber Threat Intelligence Summit & Training 2016 (Alexandria, Virginia, USA, Feb 3 - 10, 2016) This Summit will focus on specific analysis techniques and capabilities that can be used to properly create and maintain Cyber Threat Intelligence in your organization. Attend this summit to learn and discuss directly with the experts who are doing the CTI analysis in their organizations. What you learn will help you detect and respond to some of the most sophisticated threats targeting your networks

BSides Tampa 2016 (MV Royal Caribbean Brilliance of the Seas, Tampa to Mexico, Feb 4 - 8, 2016) BSides Tampa is an annual IT security/hacking conference featuring hands on training classes and lectures from some of the greatest minds in the industry and academia

The Law and Policy of Cybersecurity Symposium (Rockville, Maryland, USA, Feb 5, 2016) This one-day symposium will cover the critical legal and policy issues, challenges, and developments in cybersecurity. Legal professionals, professionals who develop cybersecurity strategies and policies, and anyone who assists organizations in preparing for and responding to cyber incidents should attend. Attendees will gain a comprehensive understanding of the legal and policy issues that they need to know when they represent clients, develop their organization's cyber strategy and policies, or respond to cyber incidents

National Cybersecurity Center of Excellence to Celebrate Opening of Newly Remodeled Facility (Rockville, Maryland, USA, Feb 8, 2016) The National Cybersecurity Center of Excellence is celebrating its dedication on February 8, 2016 at the center's newly remodeled facility at 9700 Great Seneca Highway

Insider Threat Program Development Training — California (Carlsbad, California, USA, Feb 8 - 10, 2016) The National Insider Threat Special Interest Group website has some very "eye opening" examples of how "damaging and costly" an "insider threat incident" can be. The FBI Insider Threat Alert states companies victimized by current or former employees incur costs from $5,000 to $3 million. bring? Is your company required to establish an Insider Threat Program per the requirements of NISPOM Conforming Change 2? Insider Threat Defense has trained a substantial number of U.S. Government Agencies (DoD, IC), Defense Contractors, Critical Infrastructure Providers, Aviation Security Professionals, large and small businesses on Insider Threat Program Development and Insider Threat Risk Mitigation

OPSWAT Cyber Security Seminar (Washington, DC, Feb 9, 2016) OPSWAT, along with our Washington DC partners, InQuest and Punch Cyber, will be hosting a half-day seminar to cover several threat detection and research technologies

Secure Rail (Orlando, Florida, USA, Feb 9 - 10, 2016) The first conference to address physical and cyber rail security in North America

Cyber Security Breakdown: Dallas (Dallas, Texas, USA, Feb 10, 2016) This half day session will provide you with the critical information you need to start formulating an effective response in the eventuality of a cyber security event. Rather than try and handle the breach during the chaos of the event, you'll understand how to build in advance, the best practices to respond effectively. Attend the Cyber Security Breakdown event that is focused on the unique issues and threats facing legal professionals

SecureWorld Charlotte (Charlotte, North Carolina, USA, Feb 11, 2016) Join your fellow security professionals for affordable, high-quality cybersecurity training and education. Earn 6-12 CPE credits through 30+ educational elements learning from nationally recognized industry leaders. Attend featured keynotes, panel discussions & breakout sessions all while networking with local peers

Suits and Spooks (Washington, DC, USA, Feb 4 - 5, 2015) Suits and Spooks DC (Feb 4-5, 2015) is moving to the Ritz Carlton hotel in Pentagon City! We're expanding our attendee capacity to 200 and for the first time will be including space for exhibitors. We have an international panel of speakers from the public and private sectors and we'll be adding live-streaming via Webex for those who cannot attend in person

2016 Cyber Security Division R&D Showcase and Technical Workshop (Washington, DC, USA, Feb 17 - 19, 2016) The cybersecurity threat continues to evolve and in order to keep ahead of the threat; new cutting-edge cybersecurity technologies are needed. The Cyber Security Division (CSD) within the Department of Homeland Security (DHS), Science and Technology Directorate (S&T) is funding many R&D efforts through academia, small businesses, industry and government and national labs. This year, we are excited to include an R&D Showcase featuring nine innovative transition-ready solutions and two collaboration projects with the private sector selected from our portfolio that address a variety of complex challenges and have the potential for transition into the marketplace

Department of the Navy (DON) IT Conference, West Coast 2016 (San Deigo, California, USA, Feb 17 - 19, 2016) The purpose of the DON IT conference is to: (1) Explain the new and invigorated DUSN (M), DON/AA, and DON CIO organization and its business and IT transformation priorities. (2) Share information that supports the SECNAV's vision laid out in the DON Transformation Plan to achieve business transformation priorities, leverage strategic opportunities, and implement DON institutional reform initiatives by changing the culture, increasing the use of data-driven decision-making, and effective governance

ICISSP 2016 (Rome, Italy, Feb 19 - 21, 2016) The International Conference on Information Systems Security and Privacy aims at creating a meeting point for researchers and practitioners that address security and privacy challenges that concern information systems, especially in organizations, including not only technological issues but also social issues. The conference welcomes papers of either practical or theoretical nature, presenting research or applications addressing all aspects of security and privacy, that concerns to organizations and individuals, thus creating new research opportunities

Interconnect2016 (Las Vegas, Nevada, USA, Feb 21 - 25, 2016) IBM InterConnect 2016 is for those who are building new business models, transforming industries, and creating better outcomes. Whether you're a C-suite executive, IT leader, developer, designer, architect, or cloud expert, we all have one thing in common — we strive to build better businesses. The relationship between IT and business is changing. As a leader, builder or innovator of technology, the decisions you make today will have an increasingly greater impact on your company's bottom line tomorrow. To remain successful, it's critical that you transform along with this ever-changing environment

CISO Canada Summit (Montréal, Québec, Canada, Feb 21 - 23, 2016) Tactics and best practices for taking on enterprise IT security threats. The CISO Summit will bring together C-level IT security executives, industry analysts and solution providers to discuss challenges and best practices in a relaxed, yet focused business setting

cybergamut Tech Tuesday: Neuro Cyber Analytics: Understanding the Patterns of Human Cognition in the Cyber Domain (Elkridge, Maryland, Middletown, Feb 23, 2016) This presentation will discuss Neuro Cyber Analytics. Humans use context-specific neurocognitive patterns for receiving and processing internal and external sensory information. Stated differently, people interact with the world around them primarily by seeing, hearing, and feeling, and make decisions about what to do next depending upon the context of what is happening in their environment. People often do not realize that their decision making process triggers certain unconscious behaviors that can be read as indicators of how their thoughts were formulated and sequenced

Insider Threat Program Development Training Course — Maryland (Annapolis, Maryland, USA, Feb 23 - 25, 2016) The National Insider Threat Special Interest Group website has some very "eye opening" examples of how "damaging and costly" an "insider threat incident" can be. The FBI Insider Threat Alert states companies victimized by current or former employees incur costs from $5,000 to $3 million. bring? Is your company required to establish an Insider Threat Program per the requirements of NISPOM Conforming Change 2? Insider Threat Defense has trained a substantial number of U.S. Government Agencies (DoD, IC), Defense Contractors, Critical Infrastructure Providers, Aviation Security Professionals, large and small businesses on Insider Threat Program Development and Insider Threat Risk Mitigation

CISO New York Summit (New York, New York, USA, Feb 25, 2016) A data breach is not only a PR nightmare, but cause for customers to turn to competitors, exposing sensitive company information and racking up fines from industry regulators. In order for organizations to operate smoothly, CISOs and IT security executives need to be ahead of the hackers, and kept abreast of the latest IT security topics and trends. Agenda sessions include panel discussions, think tanks, analyst Q&A sessions and much more

BSides San Francisco (San Francisco, California, USA, Feb 28 - 29, 2016) BSides San Francisco is an Information / Security conference that's different. We're a 100% volunteer organized event, put on by and for the community, and we truly strive to keep information free. There is no charge to the public to attend BSides SF. Our costs are covered by our generous donors and sponsors, who share our vision of free dissemination of information. The conversations are getting more potent and the "TALK AT YOU" conferences are starting to realize they have to change. BSides SF is making this happen by shaking-up the format

CISO Summit Europe (London, England, UK, Feb 28 - Mar 1, 2016) With the media covering the latest data breaches, cloud computing security questions going unanswered and hackers developing more sophisticated attacks, the IT department has a growing responsibility to protect customer and company data. The CISO Summit will bring together C-level IT security executives, industry analysts and solution providers to discuss challenges and best practices in a relaxed, yet focused business setting. Agenda sessions include engaging Keynote Presentations, Thought Leadership sessions, CISO Think Tanks, Analyst Q&As and much more

RSA Conference 2016 (San Francisco, California, USA, Feb 29 - Mar 4, 2016) Celebrating its 25th anniversary, RSA Conference continues to drive the information security agenda forward. Connect with industry leaders at RSA Conference 2016