The CyberWire Daily Briefing 8.16.18

Summary

By The CyberWire Staff

The FBI is warning of cyber threats to a sometimes overlooked sector of transportation infrastructure: inland waterways. Those include the rivers, canals, dams, locks, and intermodal facilities that serve water traffic in the US.

NSA alumnus Rob Joyce gave an account of nation-state hacking at DefCon last week. The rogue's gallery was populated by a familiar four: Russia, China, North Korea, and Iran.

President Trump is reported to have loosened, in various unspecified ways, the constraints on US retaliatory cyber operations that have been in place since President Obama's promulgation of Presidential Policy Directive 20. PPD 20 is secret but in outline generally familiar, thanks to illicit leaks and licit hinting. Relaxation of certain restrictions seems consistent with public comments from US Cyber Command.

Foreign Policy is reporting on the immediate human consequences of inadequate communications security. According to the journal, a CIA communications system that had worked well enough in the (relatively) benign Middle Eastern environments where the Agency had used it earlier failed when it was deployed for running agents in China. Chinese security services were able to penetrate it between 2010 and 2012, roll up the CIA's agents, and execute about thirty of them. Some estimates give a higher toll. China's alleged recruitment of former CIA officer Jerry Chun Shing Lee appears to have contributed to the intelligence failure. Lee was indicted earlier this year for his alleged role in the matter.

Australia's new cybersecurity laws seem to function more by penalizing non-cooperation than by mandating backdoors.

Learn how Cylance silences cyber attacks with Artificial Intelligence.

Notes.

Today's issue includes events affecting Australia, China, India, Iran, Democratic Peoples Republic of Korea, Pakistan, Russia, United Kingdom, and United States.

Don’t let threats SOC you where it counts.

Protecting your organization from an attack involves much more than the traditional “block & tackle” tactics of the past. A good boxer doesn’t just block the punch they see coming, they move against the next anticipated punch. The modern Security Operations Center (SOC) requires a combination of automation and human tradecraft to successfully repel the adversary. Learn more about the modern SOC in LookingGlass’ webinar featuring guest IDC, August 29 @ 2pm ET.

Podcast Summary

In today's podcast we speak with our partners at the SANS Institute, as Johannes Ullrich (who's also the proprietor of the SANS ICS Stormcast Podcast) discusses lingering legacy passwords in Office documents. Our guest is CyberX's Phil Neray, who shares thoughts on the National Risk Management Center recently established by the US Department of Homeland Security.

The Hacking Humans podcast is up as well, with accounts of a retiree who was cleverly and regrettably scammed, a tech-support caper with a Russian twist, and a Catch of the Day that features an adorable puppy (of particular interest around here since we at the CyberWire are a BYOD—bring your own dog—shop). And our guest, Michael Murray from Lookout, explains mobile device vulnerabilities.

Cyber Attacks, Threats, and Vulnerabilities

Former NSA top hacker names the filthy four of nation-state hacking (Register) Carefully omits to mention the Land of the Free

Botched CIA Communications System Helped Blow Cover of Chinese Agents (Foreign Policy) The number of informants executed in the debacle is higher than initially thought.

NSA Cracked Open Encrypted Networks of Russian Airlines, Al Jazeera, and Other “High Potential” Targets (The Intercept) The agency broke into virtual private networks for several key targets, including two government entities in Iraq.

AP Interview: FBI eyes plethora of river-related threats (AP News) Giant cranes loading and unloading gargantuan barges. Oil tankers, supply vessels and pipelines serving a vital energy industry. Flood control structures. Chemical...

Intel confirms new chip security flaw affecting Core and Xeon CPUs (Computing) Foreshadow attack devised by KU Leuven can compromise Intel's Software Guard Extensions (SGX) technology

Discovery casts dark shadow on computer security (EurekAlert!) Two international teams of security researchers have uncovered Foreshadow, a new variant of the hardware vulnerability Meltdown announced earlier in the year, that can be exploited to bypass Intel Processors' secure regions to access memory and data.

Foreshadow/L1TF: What You Need to Know (SecurityWeek) What you need to know about the Foreshadow / L1TF vulnerabilities affecting Intel CPUs, including impact and affected vendor responses

A Bug in Chrome Gives Bad Actors License to Play ‘20 Questions’ with Your Private Data (Blog | Imperva) In a 2013 interview with The Telegraph, Eric Schmidt, then CEO of Google was quoted as saying: “You have to fight for your privacy or lose it.”

The Real Takeaways From the Reddit Hack (SecurityWeek) The Reddit data breach illustrates the importance of rolling out an approach designed to verify the user, validate their device, limit access and privilege, and learn and adapt to new risks.

Chatbots Say Plenty About New Threats to Data (Flashpoint) Chatbots are becoming a useful customer interaction and support tool for businesses, but cybercriminals have found a use for them too.

Is that email a phishing campaign? Flip a coin. (Fifth Domain) Phishing attacks show no signs of slowing down, according to a new report.

From simple mistakes to cyber sabotage, insiders pose risks to networks (Fifth Domain) To combat insider threat, experts say the best defense is to understand the people who use the network rather than trying to thwart every new hacking technique that comes along.

DDoS attackers increasingly strike outside of normal business hours (Help Net Security) Threat actors targeted organisations most frequently outside normal business hours, between 4pm CET and midnight Saturday through to Monday.

ATM hackers steal $13.5m in 28 countries from India's Cosmos Bank - just days after FBI warning (Computing) India's Cosmos Bank targeted in sophisticated attack by North Korea's Lazarus Group, according to reports

Task force points out flaws in e-voting proposal for overseas Pakistanis (Pakistan Today) The Election Commission of Pakistan’s (ECP) task force, made on the directives of the Supreme Court (SC), has pointed out a number of flaws while checking the feasibility of the proposed e-voting<a href="https://www.pakistantoday.com.pk/2018/08/14/task-force-points-out-flaws-in-e-voting-proposal-for-overseas-pakistanis/" title="Read more" >...</a>

Hacking the Amazon Echo | Avast (Security Boulevard) At DEFCON last week, white hat hackers explained during a presentation that it is indeed possible to hack an Amazon Echo. Security researchers from Chinese conglomerate Tencent described the steps they took to turn a regular, working Echo into a spying device, completely through remote activation. And while this may sound like alarming news, it’s important to note that a key factor of the hack is that the interceptor must be on the same LAN.

Security Patches, Mitigations, and Software Updates

SAP Releases August 2018 Security Updates (SecurityWeek) SAP’s security updates for August 2018 include over two dozen patches, but none of them are for critical vulnerabilities

Hacks of Macs, Microsoft Cortana are two more reasons why you should install updates (USA TODAY) At the annual Black Hat security conference, white-shoe hackers showed how they exploited a Macintosh operating system to install a hostile app and Microsoft's Cortana assistant to push malware. Apple and Microsoft both fixed the bugs with updates, a reminder for users to install patches.

Cyber Trends

Over 2,300 Data Breaches Disclosed So Far In 2018, Exposing Over 2.6 Billion Records (Risk Based Security) Risk Based Security today announced the release of its Mid-Year 2018 Data Breach QuickView report, showing there have been 2,308 publicly disclosed data compromise events through June 30th. After a surprising drop in the number of reported data breaches in first quarter, breach activity appears to be returning to a more “normal” pace. At the mid-year point, 2018 closely mirrors 2016’s breach experience but still trails the high water mark set in 2017.

ThreatList: Financial-Themed Phishing Hooks Targets in Q2 (Threatpost) In addition to traditional phishing, fraudulent cryptocurrency offers pose a rising trend.

Britain's biggest banks report 64 payment outages in last 3 mths (Reuters) Britain's five biggest banks had a total of 64 security or operational incidents that cut customers off from telephone, mobile or online banking in the second quarter of 2018, according to disclosures on the banks' websites.

Marketplace

Here’s what an intel chief thinks industry needs to know (C4ISRNET) The director of the Defense Intelligence Agency shared thoughts on how technologies can be developed to support future operating environments.

Sauna With Russia Spies Shouldn’t Bar U.S. Deals, Kaspersky Says (Bloomberg Governmet) Moscow software company disputes ban on federal contracts

Cybersecurity startup Exabeam raises $50 million to be ‘the next Splunk’ (VentureBeat) Exabeam, a cybersecurity startup that leverages big data, machine learning, and analytics to detect and respond to cyber threats, has raised $50 million in a series D round of funding led by Lights…

Container Security Firm Twistlock Raises $33 Million (SecurityWeek) Twistlock, a provider of solutions to protect cloud containers, has raised $33 million in Series C funding, bringing the total raised to-date by the company to $63 million.

Uber hires former NSA counsel Matt Olsen as top security executive (Cyberscoop) After a tumultuous few months, Uber has a new chief trust and security officer: Matt Olsen, former co-founder off IronNet Cybersecurity and former general counsel of the National Security Agency. Uber CEO Dara Khosrowshahi tweeted about the new hire after it was initially reported by the New York Times...

Products, Services, and Solutions

Cylance Defends Democracy (BusinessWire) Cylance Inc., the leading provider of AI-driven, prevention-first security solutions, today announced a non-partisan initiative to support all 2018 U.

McAfee offers state election officials a year of free cloud security tools (Cyberscoop) McAfee is offering free security services to election offices in all 50 states in order to protect voter data stored in the cloud.

Introducing CompTIA CertMaster Learn for Security+ (Markets Insider) CompTIA, the world's leading technology association, today announced the availability of a new self-paced...

Dynamic Yield Deploys Meta NaaS Software Defined Perimeter for Secure… (Virtual-Strategy Magazine) Dynamic Yield Deploys Meta NaaS Software Defined Perimeter for Secure Network Access with Customers Developer of AI-Powered Omnichannel Personalization Engine Selects Meta Networks to Enable Experience Delivery for Brands

Trend Micro launches product to protect telecom networks serving business and home users (Help Net Security) Trend Micro Virtual Network Function Suite applies URL filtering, application control, intrusion prevention and IoT reputation.

CyberSight’s RansomStopper 3.0 maximizes protection against ransomware attacks (Help Net Security) CyberSight’s RansomStopper 3.0 business version combines five layers of defense-in-depth, new features and enhanced management console.

SSIC advances cyber risk analytics with new release (Help Net Security) SSIC's X-Analytics 2.0 harmonizes cyber risk financial exposure analysis with cybersecurity effectiveness to support executive decision making.

BAE Systems and Splunk secure U.S. government clouds through machine learning (Help Net Security) BAE Systems is leveraging the machine learning expertise of Splunk to enhance the security of its federated secure cloud solution for the U.S. government.

Alkemist: Harden vulnerable embedded systems and devices (Help Net Security) RunSafe's Alkemist is a proprietary self-service technology built to reduce vulnerabilities and deny malware the uniformity needed to execute.

Grand Rapids Community College Deploys vArmour to Protect Student Data and Applications (BusinessWire) vArmour, the leading data center and cloud security company, today announced that Grand Rapids Community College (GRCC) has selected vArmour to protec

UAE logistics giant takes Darktrace cyber solution (BusinessWeekly) Tristar, a major logistics provider in the United Arab Emirates, has deployed Cambridge company Darktrace’s AI-driven cyber defence technology to protect sensitive customer data and operational systems from attacks. Operating in 18 countries, Tristar is a fully integrated liquid logistics solutions provider delivering services to the petroleum and chemical industries, Its core

Technologies, Techniques, and Standards

DHS Hosts National Exercise on Election Security (US Department of Homeland Security) The Department of Homeland Security (DHS) hosted the “Tabletop the Vote 2018: DHS’ National Election Cyber Exercise,” a three-day, first-of-its-kind exercise to assist DHS and our federal partners, state and local election officials, and private vendors in identifying best practices and areas for improvement in cyber incident planning, preparedness, identification, response, and recovery.

Intelligence Community CIO Seeks to Boost IT Integration (Wall Street Journal) John Sherman says he wants to strike a balance between setting standards and avoiding a ‘wild west’ of intelligence agencies deploying their own applications.

The Department of Defense is going to MARS (Just not that one) (C4ISRNET) The Department of Defense is working to replace it's global intelligence repository database with a new system it calls MARS.

A critical top secret intel network needs to evolve (C4ISRNET) Military officials rely on the Joint Worldwide Intelligence Communications System, but voiced it is being stretched beyond its initial capacity.

North Dakota Guard Unit Alerted of Potential Deployment (SecurityWeek) If mobilized, Detachment 1, 174th Cyber Protection Team would provide network security and cyber defense operations in support of the Department of Defense early 2019 at Fort Meade, Maryland.

Is it Time to Replace Pen Testing with Crowdsourced security? (Infosecurity Magazine) As crowdsourced security emerges, are we ready to throw away pen testing as a methodology?

Collaboration & Motivation: Cyber Security Exec Shares Helpful Tips (Cyber Security Hub) On the Aug. 13 episode of “Task Force 7 Radio,” host George Rettas was joined by Alain Espinosa, Director of Security Operations, Online Business Systems and Member of the Board of Directors for InfraGard National. Topics included: cross-sector partnerships, cyber skills and more.

Are Targeted Ads Stalking You? Here’s How to Make Them Stop (New York Times) Ever been haunted by an online ad for an item you researched or bought? Targeted ads were designed to follow you around everywhere. Here’s how to banish them.

Design and Innovation

Credit card skimmers now need to fear the Reaper (Ars Technica) SkimReaper, subject of a USENIX Security paper, detects most common card skimmers.

Hold the Phone! My Unsettling Discoveries About How Our Gestures Online Are Tracked (New York Times) As I learned about companies that track “behavioral biometric” data, I developed a jarring mental image of computers silently recording my clicks, pauses, mouse swoops and typos.

Research and Development

America’s new intelligence research chief wants to predict cyberattacks. Can it work? (Fifth Domain) In her first comments as IARPA chief, the new director of the intelligence community’s research arm emphasized machine learning to forecast cyberattacks.

Facebook turns to artificial intelligence to fight hate and misinformation in Myanmar (Washington Post) Facebook shared some details of the progress it's made in Myanmar.

Inside the Research Lab Teaching Facebook About Its Trolls (WIRED) What can the 14-person Digital Forensics Research Lab discover about fake news on Facebook that the billion-dollar company doesn't already know?

Academia

Bogus journals being used to publish fake science (Naked Security) What’s worse than fake news? Fake science – published in legitimate looking journals.

A-level results: Maths and Computing on the rise (Computing) Investment in STEM education sees rise in number of students taking the subjects, though proportion of A* grades falls

Legislation, Policy, and Regulation

Trump, Seeking to Relax Rules on U.S. Cyberattacks, Reverses Obama Directive (Wall Street Journal) President Trump has reversed an Obama-era memorandum governing how and when the U.S. government can deploy cyberweapons against its adversaries, in an effort to loosen restrictions on such operations, according to people familiar with the action.

Name change eludes DHS cyber wing, spurring frustration (TheHill) Trump administration officials are growing increasingly frustrated over stalled legislation concerning a key office responsible for combating cyber threats.

The New Risk Management Center – Evolutionary Thinking or Another Bureaucratic Obstacle? (CyberDB) In late July 2018, the Department of Homeland Security (DHS) announced the creation of the National Risk Management Center...

Potential Policy Proposals for Regulation of Social Media and Technology Firms (Senator Mark Warner) Social media and wider digital communications technologies have changed our world in innumerable ways.

Tech Giants Face Hefty Fines Under Australia Cyber Laws (SecurityWeek) Tech companies could face fines of up to AUD$10 million (US $7.3 million) if they fail to hand over customer information or data to Australian police under tough cyber laws unveiled August 14th.

Australians who won’t unlock their phones could face 10 years in jail (Naked Security) The Australian government wants to force companies to help it get at suspected criminals’ data. If they can’t, it would jail people for up to a decade if they refuse to unlock their phones.

Candidates: Stall work to replace Louisiana voting machines (AP News) Candidates vying to be Louisiana secretary of state want to pause the work being done to replace the state's 10,000 voting machines until after the election...

Litigation, Investigation, and Law Enforcement

Trump strips former CIA chief John Brennan of security clearance (Times) President Trump revoked the security clearance of the former CIA director John Brennan yesterday over claims that he used access to classified information to “sow division and chaos”. The move came...

Trump revokes security clearance of former CIA director John Brennan — a leading critic of the president (Washington Post) White House press secretary Sarah Huckabee Sanders announced the action, quoting the president’s citing risks from Brennan’s “erratic conduct and behavior.”

How Bruce Ohr Could Implicate High-Ranking Obama Officials In Spygate (The Federalist) Reporting on Bruce Ohr suggests DOJ and FBI employees operated outside the chain-of-command and concealed evidence from congressional oversight committees.

Georgia woman facing ‘longest sentence’ for leaking to media (Washington Post) A Georgia woman who mailed a secret U.S. report to a news organization faces the “longest sentence” ever behind bars for a federal crime involving leaks to the news media, prosecutors said in a court filing.

Analysis | The Cybersecurity 202: Here's what Democrats want to know about the FCC's bogus cyberattack claims (Washington Post) FCC chief Ajit Pai testifies this morning.

When government websites fail (FCW) The FCC’s site went down last year not because of a DDoS attack, but because it couldn’t handle the traffic spike. So who’s responsible for making sure that doesn’t happen?

To Catch A Robber, The FBI Attempted An Unprecedented Grab For Google Location Data (Forbes) The FBI is getting creative with how it obtains data from Google. And it has privacy ramifications for all users of Google services.

Brazil may probe Google over its cell phone system: report (U.S.) Brazil's antitrust watchdog Cade is considering opening an investigation into Google over alleged abuses in its cell phone operating system, the president of the agency said in an interview published on Wednesday in newspaper Valor Economico.

Documents Reveal Successful Cyberattack in California Congressional Race (Rolling Stone) The FBI investigated hacking attempts targeting a Democrat who ran against “Putin’s favorite congressman”

The Hackers Hunting Down Missing People (Motherboard) Nonprofit TraceLabs ran DEF CON’s first crowdsourced event for tracking missing people through public information.

Cryptocurrency investor robbed via his cellphone account sues AT&T for $224 million over loss (CNBC) A U.S. investor files a $224 million lawsuit against AT&T accusing the telecommunications giant of negligence that allegedly caused the California resident to lose roughly $24 million in cryptocurrency.

Hacking firm sues ex-employee over work on antidote to its spyware (The Straits Times) An Italy-based company called HT, or Hacking Team - which sells spyware to law enforcement agencies in more than 45 countries - has accused a former employee of helping an "outsider" develop an antidote to its key software.. Read more at straitstimes.com.

Silk Road founder Ross Ulbricht is dictating tweets from prison (Naked Security) The family of “Dread Pirate Roberts” got him an account and is typing in, word for word, his tweets, including his hope for Trump’s clemency.

Industry Events

For a complete running list of events, please visit the Event Tracker.

Newly Noted Events

SecureWorld Bay Area (Santa Clara, California, USA, Aug 21, 2018) Connecting, informing, and developing leaders in cybersecurity. SecureWorld conferences provide more content and facilitate more professional connections than any other event in the Information Security industry. Join your fellow InfoSec professionals for high-quality, affordable cybersecurity training and education. Earn 6-12 CPE credits through 30+ educational elements, learning from nationally recognized industry leaders. Attend featured keynotes, panel discussions, breakout sessions, and solution vendor displays-all while networking with local peers.

5th Annual Women in Cyber Security Reception (Washington, DC, United States, Oct 18, 2018) This annual networking event highlights and celebrates the value and successes of women in the cyber security industry. Leaders from the private sector, academia, and government from across the region and at varying points on the career spectrum can connect with each other to strengthen relationships and build new ones.

Upcoming Events

The Air Force Information Technology & Cyberpower Conference (Montgomery, Alabama, USA, Aug 27 - 29, 2018) As the premiere Air Force cyber security annual event, the Air Force Information Technology & Cyberpower Conference (AFITC) returns to Montgomery, Alabama in August of 2018. As a critical intersection of Air Force IT experts, prominent IT academics, and some of America’s top cyber security companies, the AFITC offers a full of slate events and activities, with 3 days of speakers, expanded education/training opportunities, and an exhibitor-driven trade show that all revolves around the ways we can better defend America from cyber-attacks, advanced persistent threats, and proactively lead in this in this increasingly digital world.

The Cyber Security Summit: Chicago (Chicago, Illinois, USA, Aug 29, 2018) This event is an exclusive conference connecting Senior Level Executives responsible for protecting their company’s critical data with innovative solution providers & renowned information security experts. Learn from cyber security thought leaders and Engage in panel discussions focusing on trending cyber topics such as Sr. Leadership’s Best Approach to Cyber Defense, What’s Your Strategic Incident Response Plan?, Protecting your Enterprise from the Human Element and more. Your registration includes a catered breakfast, lunch, and cocktail reception. Receive half off your admission with promo code cyberwire50 at CyberSummitUSA.com and view details including the full agenda, participating solution providers & confirmed speakers. Tickets are normally $350, but only $175 with promo code.

Intelligence & National Security Summit (National Harbor, Maryland, USA, Sep 4 - 5, 2018) The Intelligence & National Security Summit is the premier forum for unclassified, public dialogue between the U.S. Government and its partners in the private and academic sectors. The 2018 Summit will include five plenary sessions, where senior leaders from the intelligence and national security communities will discuss top priorities, challenges, and assessments of key threats, as well as nine breakout sessions that will examine issues of vital importance to our national wellbeing and the readiness of the intelligence and national security workforce.

Cyber Resilience & Infosec Conference (Abu Dhabi, UAE, Sep 5 - 6, 2018) Interact with the top-notch cyber security specialists, learn new strategies and protect your company's future efficiently

9th Annual Billington CyberSecurity Summit (Washington, DC, USA, Sep 6, 2018) The mission of Billington CyberSecurity is to bring together thought leaders from all sectors to examine the state of cybersecurity and highlight ways to enhance best practices and strengthen cyber defenses within government and the private sector. This year's summit, like the previous eight, will bring together leaders from government and industry for a comprehenive look at the challenges of cybersecurity.

SecureWorld Twin Cities (Minneapolis, Minnesota, USA, Sep 6, 2018) Connecting, informing, and developing leaders in cybersecurity. SecureWorld conferences provide more content and facilitate more professional connections than any other event in the Information Security industry. Join your fellow InfoSec professionals for high-quality, affordable cybersecurity training and education. Earn 6-12 CPE credits through 30+ educational elements, learning from nationally recognized industry leaders. Attend featured keynotes, panel discussions, breakout sessions, and solution vendor displays-all while networking with local peers.

CornCon IV: Quad Cities Cybersecurity Conference & Kids' Hacker Camp (Davenport, Iowa, USA, Sep 7 - 8, 2018) CornCon is a 2-day conference held in Davenport, Iowa including a professional development workshop on Friday and a full-day cybersecurity conference on Saturday. The workshop covers enterprise risk, privacy and security. The conference has a keynote track with top international speakers, and a technical track with cutting edge exploits, demos and presentations. There will be a hacker village, vendor expo, contests, t-shirts, food drinks and a great after party. There is also a Saturday kids' hacker camp running alongside the conference. "A little DEFCON in a corn field!"

2018 International Information Sharing Conference (Tysons Corner, Virginia, USA, Sep 11 - 12, 2018) Join representatives from fellow information sharing groups with all levels of expertise, security practitioners, major technology innovators, and well-established cybersecurity organizations, as they come together to discuss the impact ISAOs have had on the nation’s security, share lessons learned, and discover the latest in cybersecurity policy. Attendees will gain the knowledge needed to learn how to improve information sharing with keynote addresses by industry experts, senior government, and international thought leaders, presentations on key topics and panel discussions of interest to the Information Sharing community, technology demonstrations from service providers and vendors addressing information sharing challenges. There will be many networking opportunities and exhibits.

SecureWorld Detroit (Detroit, MIchigan, USA, Sep 12 - 13, 2018) Connecting, informing, and developing leaders in cybersecurity. SecureWorld conferences provide more content and facilitate more professional connections than any other event in the Information Security industry. Join your fellow InfoSec professionals for high-quality, affordable cybersecurity training and education. Earn 12-16 CPE credits through 60+ educational elements learning from nationally recognized industry leaders. Attend featured keynotes, panel discussions, breakout sessions, and solution vendor displays-all while networking with local peers.

FutureTech Expo (Dallas, Texas, USA, Sep 14 - 16, 2018) With over 2,000 expected attendees, 70 top-notch speakers and 100+ exhibitors from the Blockchain & Bitcoin, Artificial Intelligence, Cyber Security / Hacking, Quantum Computing, 3D Printing, and Virtual / Augmented Reality worlds, and talks from ICOs and blockchain startups and more, this Expo is going to be a diverse, wonderful, and potentially profitable experience for all who attend.

Insider Threat Program Development-Management Training Course (San Antonio, Texas, USA, Sep 17 - 18, 2018) Insider Threat Defense will hold its highly sought-after Insider Threat Program Development-Management Training Course, in San Antonio, Texas, on September 17-18, 2018. This two-day training course will provide the Insider Threat Program (ITP) Manager, Facility Security Officer, and others (CIO, CSO, CISO, Human Resources, IT, Network Security, Etc.) supporting an ITP, with the knowledge and resources (Templates, Checklits, Etc.) to develop, manage, or enhance an ITP. This training covers, and goes beyond compliance regulations for an ITP (National Insider Threat Policy, NISPOM Conforming Change 2). Insider Threat Defense is one of the few ITP training vendors to offer a guarantee with their training. Insider Threat Defense has provided training and services (In Over 14 U.S. States) to an impressive list of 540+business-organizations / 680+ security professionals.

International Consortium of Minority Cybersecurity Professionals (ICMCP) 3rd Annual National Conference (Atlanta, Georgia, USA, Sep 17 - 19, 2018) The International Consortium of Minority Cybersecurity Professionals (ICMCP) 3rd Annual National Conference continues to elevate the national dialogue on the very necessary strategic, tactical and operational imperatives needed to attract and develop minority cybersecurity practitioners. By providing a combination of thought leadership, awareness and engagement, the 3rd Annual National Conference will seek to break from the norm of day-long sessions of talking-heads through interactive “decode sessions” intended to include conference attendees in helping to devise innovative strategies to tackling cybersecurity’s diversity challenges.

Air Space & Cyber Conference (National Harbor, Maryland, USA, Sep 17 - 19, 2018) Gain new insights and skills to advance your career. Be among the first to see the latest innovations in airpower, space, and cyber capabilities all the while bonding with your fellow Airmen. Inspiring addresses from recognized leaders in your Air Force will give you drive for taking your career to the next level. You can do all of this and more at AFA’s annual Air, Space & Cyber Conference (ASC).

Global Cybersecurity Innovation Summit (London, England, UK, Sep 18 - 19, 2018) Advancing global collaboration and innovation. SINET – London creates a forum to build and maintain international relationships required to foster vital information sharing, broad awareness and the adoption of innovative Cybersecurity technologies.

SecureWorld St. Louis (St. Louis, Missouri, USA, Sep 18 - 19, 2018) Connecting, informing, and developing leaders in cybersecurity. SecureWorld conferences provide more content and facilitate more professional connections than any other event in the Information Security industry. Join your fellow InfoSec professionals for high-quality, affordable cybersecurity training and education. Earn 12-16 CPE credits through 60+ educational elements learning from nationally recognized industry leaders. Attend featured keynotes, panel discussions, breakout sessions, and solution vendor displays-all while networking with local peers.

5th Annual Industrial Control Cyber Security USA (Sacramento, California, USA, Sep 18 - 19, 2018) Now in its 5th year, this two day executive forum will include presentations, roundtable working groups and panel sessions. Together we will address the escalating cyber risk and resilience challenges associated with the adoption and convergence of operational technologies in enterprise facing architecture. Practitioners will gain further insight into how to best respond to evolving cyber threats, the importance of effective risk management throughout the industrial control supply chain, innovations in detection and mitigation, configuration management and how can we incorporate resilience into critical control system components and business process.

Security in our Connected World (Beijing, China, Sep 19, 2018) This year’s seminar will not only examine critical security technologies, such as the Trusted Execution Environment (TEE) and Secure Element (SE), but will also delve into their associated business and technical use cases, to explore more deeply the need for security in our connected world. Timely and relevant seminar topics to include a focus on the Internet-of-Things (consumer, industrial and enterprise), identification and authentication, payment and value-added services, premium content protection, device trust, and certification. And, as always, delegates will be able to witness ‘real world’ solutions from our sponsoring/exhibiting member organizations.

Detect 18 (National Harbor, Maryland, USA, Sep 19 - 21, 2018) Detect '18 is the single largest conference dedicated to threat intelligence. This year we're calling on fellow "Threatbusters" to wage a high-tech battle against apparitions (aka bad actors) and learn how to better save the world from cyber destruction! At Detect '18 you will be able to: immerse yourself in 30+ hours of education and training; chooose from 30+ breakout sessions designed for every experience level; listen to peer presentations highlighting real-world issues and solutions; network, network, network with your peers in a social setting; and earn CPE Credits to keep your credential current.

Cyber Beacon (Washington, DC, USA, Sep 20, 2018) Cyber Beacon is the flagship event of the National Defense University's College of Information and Cyberspace (NDU CIC). The conference brings together cyber experts from across the national security community, private sector, and academia to discuss the most pressing problem sets concerning cyberspace and national security. This year's theme is "decision making in cyberspace". Cyber Beacon V will be held on Wednesday 19 and Thursday 20 September 2018 at the NDU campus on Fort McNair in Washington, DC.

IT Security Leadership Exchange (Phoenix, Arizona, USA, Sep 23 - 25, 2018) IT Security Leadership Exchange is an invitation-only, strategic business summit that gathers Chief Information Security Officers (CISOs), senior decision-makers, and industry experts to address the unique needs and current challenges faced by enterprise cyber security leaders. A CISO’s role requires hands-on technical knowledge and understanding of security tools, techniques, and procedures combined with the need to manage up, down, and across the organization. This summit is the perfect platform for leaders to share information, gain insight and develop next-level strategy. Information security executives from across the country will come together for 2 days of peer breakouts and networking to answer the toughest questions facing them today.

Global Security Exchange (Las Vegas, Nevada, USA, Sep 23 - 27, 2018) Global Security Exchange—formerly the ASIS Annual Seminar and Exhibits—delivers new opportunities to exchange key ideas and best practices, expand global connections, and experience innovations. The GSX education program led by ASIS, InfraGard, and ISSA subject matter experts consists of 300+ sessions, each designed to deliver valuable, actionable takeaways to help shape your security strategy—today and in the future.

Merging of Cyber Criminal and Nation State Techniques: A Look at the Lazarus Group (Loudon, Virginia, USA, Sep 24, 2018) This presentation on North Korea's Lazarus Group as a case study of the convergence of organized cyber crime and nation-state intelligence services will be led by Allan Liska, a solutions architect at Recorded Future. Allan has more than 15 years experience in information security and has worked as both a blue teamer and a red teamer for the intelligence community and the private sector. Allan has helped countless organizations improve their security posture using more effective and integrated intelligence. He is the author of The Practice of Network Security, Building an Intelligence-Led Security Program, and Securing NTP: A Quickstart Guide and the co-author of DNS Security: Defending the Domain Name System and Ransomware: Defending Against Digital Extortion.

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry’s largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust the CyberWire to get the message out. Learn more.

Cyber threats to river traffic. Nation-state hacking and PPD 20. Communications security fail cost lives. Australia's cyber laws.