The CyberWire Daily Briefing 5.16.18

Special Section

the third annual Cyber Investing Summit

In his keynote address at yesterday's Cyber Investing Summit, Dave DeWalt (Momentum Cyber co-founder and AllegisCyber managing director) set the terms of discussion by drawing out the history of what he called the "perfect cyber storm." He traced that history since 2000, noting that twenty-nine countries now have declared offensive cyber capabilities. Sixty-four, he said, have declared defensive capabilities, and these sixty-four at least probably also have unavowed offensive capabilities.

As the storm has grown, so too has the cybersecurity market. Worth $3.2 billion in 2000, this year it's reached some $96.3 billion. DeWalt sees the biggest opportunities in that market where there are the biggest gaps: "drones and domes" (the drone economy and the security infrastructure it will necessarily require), "industrial and IoT" (increasingly pervasive), "social and satellite" (with just a handful of company's specializing in social media security, and satellites assuming an increasingly bigger share of communications infrastructure), and "cloud and crypto" (especially with respect to identity management and advanced cryptography).

Companies in this space must, DeWalt emphasized, know their go-to-market window (always narrower and more fleeting than they assume). He advised investors to "look for management teams who can figure out go-to-market."

Other speakers took these themes up throughout the day. We'll have more extensive coverage tomorrow and Friday. For now we'll mention that the Cybersecurity 500 list was released at the Summit. And a quick take on what some VCs thought were the investing hotspots. Data science is hot. Endpoint protection and threat intelligence have cooled off: those particular windows may be starting to close.

Summary

By The CyberWire Staff

Researchers at Lookout describe two extensive Pakistani cyber espionage campaigns: Stealth Mango (which targets Android devices) and Tangelo (which works against iOS). The targets were diplomatic, military, and governmental personnel in India, the UAE, and Afghanistan, with strong interest shown in collecting against Pakistani dissidents as well. Some Australian, US, and German officials were apparently swept up in the campaigns as well. The campaigns, thought to be run by Pakistan's military, used convincing spoof sites in conjunction with phishing to net the victims.

A Vietnamese state-directed group has compromised Cambodia's Phnom Penh Post website to infect Vietnamese dissidents with spyware.

Attackers are using UPnP protocol in harder-to-track DDoS attacks.

The US Department of Homeland Security has released its long-anticipated strategy. The plan has these major goals: better risk identification, improved reduction of both threats and vulnerabilities, better attack mitigation, reduce threats and vulnerabilities, mitigate the consequences of cyberattacks, develop infrastructure resilience, and improve management of the Department's cyber portfolio.

Cambridge Analytica and Facebook data scandal whistleblower Christopher Wylie is testifying before the US Senate Judiciary Committee today. He tweeted yesterday that Cambridge Analytica was "the canary in the coal mine," and that he hopes Facebook and others will be held accountable to users.

Joshua Schulte, a former CIA employee whom US Federal prosecutors suspect in the Vault 7 disclosure of CIA hacking tools to WikiLeaks, is being held in Manhattan on unrelated charges. There's apparently insufficient evidence to charge him in the Vault 7 case, but he remains under investigation.

Learn how Cylance silences cyber attacks with Artificial Intelligence.

Notes.

Today's issue includes events affecting Afghanistan, Australia, Cambodia, China, European Union, Germany, India, Iraq, Lebanon, Mexico, Netherlands, Pakistan, Russia, Syria, United Arab Emirates, United Kingdom, United States, and Vietnam.

Dragos unveils dashboard of ICS-focused threat groups.

The Dragos Intelligence Team tracks a number of industrial-focused activity groups aimed to exploit, disrupt, and potentially destroy industrial systems globally. Each week in May, Dragos will release new content discussing these adversary details that can be read here.

Podcast Summary

In today's podcast we hear from our partners at the SANS Institute, as Johannes Ullrich of the ISC Stormcast discusses the eFail email encryption issue. Our guest is Michelle Maitland from SecureStrux on risk management framework compliance.

New York: the latest from the Cyber Investing Summit

Cybersecurity 500 2018: The Official List (PR Newswire) Cybercrime is the greatest threat to every company in the world, and one of...

Cyber Attacks, Threats, and Vulnerabilities

Stealth Mango and Tangelo: Nation state mobile surveillanceware stealing data from military & government officials (Lookout) Lookout Security Intelligence has discovered Android and iOS surveillanceware tools targeting government officials, diplomats, military personnel, and activists, specifically in Pakistan, Afghanistan, India, Iraq, and the UAE. We're calling these surveillanceware families Stealth Mango (Android) and Tangelo (iOS).

Stealth Mango & Tangelo: Selling your fruits to nation state actors (Lookout) Lookout Security Intelligence has discovered a set of custom Android and iOS surveillanceware tools we’re respectively calling Stealth Mango and Tangelo.

Pakistan: Investigation uncovers 'sinister' hacking campaign targeting activists (Amnesty International) Exclusive investigation used digital forensic techniques and malware analysis to uncover hacking methods

An Analysis of Islamic State Propaganda Distribution (Flashpoint) The success of the Islamic State’s (ISIS) information-warfare strategy relies on the group’s ability to distribute propaganda to targeted audiences online. Moreover, to ensure the longevity of its material, ISIS has taken considerable measures to prevent its content from being removed from the internet.

Vietnamese hackers trigger software trap on Cambodian news website (ABC News) A Vietnamese state-linked hacking group has used Cambodia's Phnom Penh Post website to target a local human rights organisation with malicious code.

Rising Nation State Cyber Attacks from…Lebanon and the Netherlands? (BusinessWire) Optiv Security has published its 2018 Cyber Threat Intelligence Estimate (CTIE), which details the current state of the cyber-threat landscape.

New DDoS Attack Method Obfuscates Source Port Data (SecurityWeek) Recent distributed denial of service (DDoS) attacks showed evidence of a new method being used to bypass existing defenses by obfuscating source port data.

UPnP protocol exploit makes it harder for IT to shut down DDoS attacks (TechRepublic) Attackers can use the Universal Plug and Play protocol to hide packet sources during a DDoS attack.

Java Deserialization Vulnerability Found to be Widespread Across SaaS Vendor SDKs (ShiftLeft Blog) Recently, we’ve identified a number of our customers who are susceptible to a deserialization-based remote control execution (RCE)…

Severe DoS Flaw Discovered in Siemens SIMATIC PLCs (SecurityWeek) High severity vulnerability discovered in Siemens SIMATIC S7-400 PLCs can be exploited remotely to cause devices to enter a DoS condition

Serious XSS vulnerability discovered in Signal (Naked Security) Researchers have discovered a serious cross-site scripting (XSS) vulnerability affecting all desktop versions of Edward Snowden’s favourite security application, Signal.

Shadowy Hackers Accidentally Reveal Two Zero-Days to Security Researchers (BleepingComputer) An unidentified hacker group appears to have accidentally exposed two fully-working zero-days when they've uploaded a weaponized PDF file to a public malware scanning engine.

New Bip Dharma Ransomware Variant Released (BleepingComputer) A new variant of the Dharma Ransomware was discovered that appends the .bip extension to encrypted files. It is not known exactly how this variant is being distributed, but in the past Dharma is typically spread by hacking into Remote Desktop Services and manually installing the ransomware.

Indian Cricket Board Exposes Personal Data of Thousands of Players (HackRead) A trove of personal and sensitive data belonging to around 15,000 to 20,000 Indian applicants participating in cricket seasons 2015-2018 have been found online.

Airports are ill-equipped to handle cyber attacks, says report (Computing) Airports could face millions in damages

WannaCry One Year Later: Looking Back at a Milestone (McAfee Blogs) Has it been a year? It seems longer. When the WannaCry ransomware attack hit tens of thousands of individuals and business around the world on May 12, 2017, it wasn’t the first time we had seen ransomware, but its impact was unique and lasting. We’ve all known for decades about hackers, information thefts, computer

An Oral History of WannaCry (Safe and Savvy Blog by F-Secure) WannaCry will go down in history, but what will history remember most? The outbreak that began on May 12, 2017 still the biggest ransomware attack in history and the trojan ended up being responsible for 9 out of 10 ransomware detections by the end of 2017.

Cyber attack delays Atlanta mayor's first budget pitch (Reuters) Atlanta's 2019 budget process has been delayed by a March cyber attack that scrambled a swath of government data, temporarily closing courts, halting bill payments and slowing other key services in the most devastating "ransomware" assault on a major U.S. city, a city spokesperson said on Tuesday.

Goodyear's Online Payment System Repaired After Cyber Attack (US News & World Report) Officials in Goodyear say the city's online payment system is functioning again after a cybersecurity attack affected the software.

Mexico's Banorte does not see cyber attack impact on financial results (Reuters) Mexico's No. 2 bank Banorte on Tuesday said it did not expect "any economic impact" on its financial results following what the central bank has called a cyber attack on connections to the domestic payment system.

From Yahoo to Uber, major hacks of data (The Economic Times) Seventy million might have lost personal data including names, addresses, phone numbers and e-mail accounts, while 40 million bank accounts and credit cards were also put at risk.

Security Patches, Mitigations, and Software Updates

Vulnerability in Signal's desktop app took only five hours to fix - CyberScoop (Cyberscoop) A critical vulnerability found in the desktop version of secure messaging app Signal was patched less than five hours after disclosure to the developers, a rapid response that's earned some plaudits from observers.

The next Android version’s killer feature? Security patches (Naked Security) Not before time, Google is addressing the mess it’s made of Android updates

Cyber Trends

Companies ditch data as GDPR deadline approaches (Help Net Security) To reduce their exposure, the majority of companies are being more selective in the data they collect and manage, with 70 percent disposing of data ahead of the deadline for compliance.

EfficientIP DNS Threat Report reveals the cost per attack has increased by 57% to $715,000 for organizations globally (Financial IT) EfficientIP, a leading specialist in DNS security to ensure service continuity, user protection and data confidentiality, today announced the results of its 2018 Global DNS Threat Report. It explored the technical causes and behavioral responses towards DNS-based threats and their potential effects on businesses across the world. Over the past year, organizations on average faced seven DNS attacks, which cost some businesses more than $5 million in damages.

25% of companies affected by cloud cryptojacking (Help Net Security) Cryptojacking has unquestionably gone mainstream. Despite heavy media and industry attention, organizations are struggling to meet compliance requirements in public cloud environments, according to RedLock. On the flip side, there’s evidence that companies are becoming more aware of cloud account compromises and

Threat Evolution and the Economics of Cybersecurity (Bricata) Threats change and evolve, and security has to adapt to meet new concerns. John Pirc, Security Expert and currently working for Secureworks sat down with Bricata to explain his view of the challenges in cybersecurity, including the economics and impact on security tools.

Enterprise cyber threat remediation ineffective, study shows (ComputerWeekly) Enterprise cyber threat remediation needs to improve in several key areas according to an analysis of common remediation strategies

Research finds disconnect between belief and reality in Office 365 security (Computing) Microsoft customers believe that they are always protected; the truth is much more varied

APWG Report: Cloud Storage and SaaS Increasingly Targeted by Phishers (BusinessWire) The Anti-Phishing Working Group (APWG) has been tracking notable increases in phishing campaigns that target SaaS/webmail providers

Employees Use Personal Devices to Access Company Email and Shared Documents, Often Without Oversight (PR Newswire) Nearly two-thirds (64%) of employees use a company-approved device for work....

Marketplace

Kaspersky set to leave homeland to alleviate security fears (CRN) Vendor to move a 'good part' of its infrastructure to Switzerland, praising the country's data protection laws and 'two centuries of neutrality'

Kaspersky Lab to Move Core Infrastructure to Switzerland (SecurityWeek) As part of its Global Transparency Initiative, Russia-based Kaspersky Lab today announced that it will adjust its infrastructure to move a number of "core processes" from Russia to Switzerland.

TPG raises Tanium investment, company now valued at $5 bln -sources (Reuters) TPG Capital's growth investment arm has raised its stake in Tanium Inc with a $175 million investment, valuing the U.S. cyber security startup at around $5 billion, people familiar with the matter said on Tuesday.

Darktrace Said to Hit $1.25 Billion Valuation in Stock Sale (Bloomberg.com) Two early investors in Darktrace Ltd. sold some of their shares in a secondary sale, valuing the British cybersecurity company at $1.25 billion, according to a person familiar with the plans.

Raytheon: Think Like An Attacker (Seeking Alpha) Cyber attackers represent an imminent threat to business and government operations. Cybersecurity will become a strategic priority for all organizations.

Symantec moves to allay concerns about accounting investigation, future outlook (ZDNet) Symantec kicked off its week with an analyst conference call outlining its view for the fiscal years ahead and how its enterprise business is shifting.

Barracuda CEO tells partners: 'You should expect us to acquire' (CRN) Vendor announces plan to become a billion-dollar company after recent transition from public to private ownership

Fortinet collects Sunnyvale sites for big expansion of its headquarters (The Mercury News) In 2012, Fortinet paid about $25 million for its current headquarters at 899 Kifer Road in Sunnyvale, but that was just the beginning of the property purchases by the network security software and …

Neustar Appoints Shailesh Shukla to Lead Security Solutions (Odessa American) Neustar®, Inc., a trusted, neutral provider of real-time information services, today announced the appointment of Shailesh Shukla as General Manager (GM) of Security Solutions. Shukla will oversee the company’s industry leading DDoS, DNS and IP Intelligence solutions including its cybersecurity operations. He will report to Neustar Senior Vice President, Chief Data and Analytics Officer Venkat Achanta.

Products, Services, and Solutions

Alphabet's Jigsaw Pledges Free Cyber Shield For All Political Groups As Midterms Loom (Forbes) As the midterm elections near, America is bracing itself for another barrage of cyberattacks, following the alleged Russian onslaught across Democratic and Republican organizations in the lead up to the 2016 presidential race.

Extending Free DDoS Protection for U.S. Political Organizations (Medium) Defending Democratic Institutions from DDoS Attacks

Ampex Partners with OPAL-RT Technologies to Ensure the Security of Critical Infrastructure (Ampex) Ampex Data Systems has partnered with OPAL-RT TECHNOLOGIES, a Canadian company that is the world leader in the development of PC/FPGA-based real-time simulators, Hardware-in-the-Loop (HIL) testing equipment, and Rapid Control Prototyping (RCP) systems that are used to design, test, and optimize control and protection systems for power grids, power electronics, motor drives, automotive, rail, aviation and various critical infrastructure industries.

Leading Canadian Power Company Entegrus Fortifies Security Posture with Pulse Secure (GlobeNewswire News Room) Pulse Secure NAC mitigates endpoint visibility, compliance and IoT security risks

Asigra integrates cyber security to defend against ransomware attack-loops (InsightaaS) Asigra Inc., a leading cloud backup, recovery and restore software provider since 1986 today announced its latest release v14 “Cloud Backup Evolved” to address the growing challenges of modern data…

ThreatConnect Expands Presence in Australia and New Zealand through Exclusive Partnership with emt Distribution (ThreatConnect) ThreatConnect, Inc.®, provider of the industry's only extensible, intelligence-driven security platform, is proud to announce it has entered into an exclusive partnership with emt Distribution to meet the growing demand for security solutions in Australia and New Zealand.

Netwrix stimulates partner success with new channel enablement strategy (Netwrix) Netwrix expands its sales enablement services and makes sales operations processes more transparent and convenient

RunSafe Security Announces Availability of Software Guardian to Cyberharden Vulnerable Embedded Systems and Devices (PRWeb) RunSafe Security, the pioneer of a patented cyberhardening process for vulnerable embedded systems and devices across critical infrastructure, today announced the

Digital Defense, Inc. Named #3 in Cybersecurity Training and #10 in Compliance & Risk Management by Healthcare Specialists, Black Book Market Research (WLNE TV) Digital Defense helps healthcare providers predetermine risk and train employees

Barracuda Introduces New Cloud-Delivered Web Application Firewall (Barracuda Networks) Barracuda Now Offers its Powerful Web Application Firewall Technology as a Cloud-Delivered Service that Simplifies Application Security for Organizations of All Sizes

Proact’s health care team support Revalidatie Friesland to create a high-performance, secure infrastructure (Cision) Revalidatie Friesland has selected data centre and cloud specialist Proact to provide an enterprise-

Winquest Cybersecurity Services Makes Splash at Interop ITX Conference (PR Newswire) Winquest Cybersecurity Services officially unveiled its new...

Minerva Labs and BlueVoyant Team Up To Contain Evasive Cyberattack (PR Newswire) Minerva Labs, a leading provider of anti-evasion technology for...

Exostar Extends Secure Supply Chain Management Collaboration Suite to Support Digitalization Initiatives (BusinessWire) Exostar's Digital Platform supports digital business imperatives and next-gen technologies across global, multi-tier supply chain business networks.

Verizon & Mocana Partner On ThingSpace IoT Security (AndroidHeadlines) Mocana and Verizon have now partnered to bring simplified IoT security to Verizon's ThingSpace platform via the incorporation of Mocana TrustPoint. For those who may not recall, ThingSpace is Verizon's web-based IoT platform first launched in 2015. TrustPoint, on the other hand, is Mocana's premier mission-critical

Napatech in cyber security deal with European government (Reuters) Oslo-listed network computing firm Napatech (NAPAT.OL) said on Tuesday it was selected by a European government agency to boost its cyber security

Gemalto Announces Security Solution for the Smart Grid (Mobile ID World) Gemalto has announced a new solution for what may be an overlooked part of the Internet of Things, smart meters. Comprising 'smart grids', smart meters are designed to process a wealth of data concerning energy usage compared to conventional energy meters.

Design and Innovation

Unpacking the mystery of Satoshi Nakamoto (TechCentral) In 2007, the world entered what has since become known as the Great Recession. Falling housing-related assets contributed to a global financial crisis, which either crippled or toppled many of the world’s largest

Lie-detecting computers equipped with artificial intelligence look like the future of border security (CNBC) A virtual border agent kiosk was developed to interview travelers at airports and border crossings, and researchers claim it does a better job finding deception than human agents.

Research and Development

Uila Announces Issuance of US Patent for Correlating Application and Infrastructure Performance Data (PRWeb) Uila, the Application-centric Infrastructure Monitoring & Analytics company, today announced that the United States Patent and Trademark Office has issued

Academia

University of North Georgia to offer cybersecurity degree (Atlanta Journal Constitution) University says enrollment has more than tripled since 2015

Legislation, Policy, and Regulation

Lawmakers Say U.S. Tech Is Being Used in Abusive Chinese Crackdowns (Wall Street Journal) Two members of Congress are urging the Commerce Department to consider toughening export controls on U.S. companies whose technologies they say are being used for state surveillance of citizens in China that enables human rights abuses.

Top intel official says Chinese ZTE cellphones are security risk (NBC News) President Trump wants to help the Chinese firm, but a top intel official told the Senate that ZTE cellphones may be used by the Chinese government to spy.

Why Trump Suddenly Wants to Save Jobs in China (WIRED) In a surprising reversal, the president says he wants to avert planned sanctions on telecommunications company ZTE.

Trump defends pledge to help save ZTE (Computing) Trump says his government will explore other ways to punish ZTE without pushing it out of business

EU Data Protection May Trigger Global Ripple Effect (SecurityWeek) GDPR, which comes into force in May 2018 is having an impact around the world as firms, including in the United States and China, move to comply.

IBM's top brass lobbies US lawmakers to ignore GDPR in favour of 'public-private approach' (Computing) IBM urges US Congressmen to develop a less onerous 'third way' for data privacy

DHS unveils long-stalled cybersecurity strategy (Cyberscoop) The Department of Homeland Security released a long-awaited cybersecurity strategy that looks to protect critical infrastructure from cyberattacks.

White House sheds cyber coordinator role (TechCrunch) The White House has opted to eliminate the cyber coordinator role on the National Security Council, in what some see as a step back in strong cybersecurity policy. The duties formerly performed by the coordinator will be taken up by the other two senior directors of the NSC's cyber team.

Marines Corps strengthens psychological operations with new job field (Marine Corps Times) The Corps plans to create another primary track field for its information warriors.

Litigation, Investigation, and Law Enforcement

Joshua Schulte named as suspect in 'Vault 7' leak of CIA tools to Wikileaks, but charged instead over child porn (Boing Boing) Joshua Schulte named as suspect in 'Vault 7' leak of CIA tools to Wikileaks, but charged instead over child porn

U.S. identifies suspect in major leak of CIA hacking tools (Washington Post) Despite months of investigation, prosecutors have been unable to bring charges against Joshua Adam Schulte, a former CIA employee being held in a Manhattan jail on unrelated charges.

Julian Assange said to have racked up $5m security bill for Ecuador (Register) WikiLeaks vows to take action over libelous claims

Bitten by the Bitcoin Bug: What is the State of Cryptocurrenices in 2018? (Computer Business Review) The world of cryptocurrencies has sent investors & businesses on a rollercoaster journey over the last few years; through the rise & fall of currencies.

Facebook can’t wiggle out of facial recognition lawsuit, judge says (Naked Security) There are too many factual disagreements for a quick judgment, the judge said, including over what a faceprint actually is.

Prison phone service can expose the location of anyone with a phone (Naked Security) In late April, somebody sent a letter containing meth to an inmate at an Arizona jail.

Police dog sniffs out USB drive to snare school hacker (Naked Security) Police traced an “electronic trail” to the suspect’s house where the USB drive was hidden.

Industry Events

For a complete running list of events, please visit the Event Tracker.

Upcoming Events

Digital Utilitites Europe (Amserdam, the Netherlands, May 16 - 17, 2018) The conference will bring together key industry stakeholders to address the current challenges of the digitisation in the utilities sector. Join us in Amsterdam to hear latest business case studies and gain insight into technological advancements within the industry, as well as unique strategies utilised by to meet demands of rapidly changing energy consumer/prosumer market.

SecureWorld Houston (Houston, Texas, USA, May 17, 2018) Connecting, informing, and developing leaders in cybersecurity. SecureWorld conferences provide more content and facilitate more professional connections than any other event in the Information Security industry. Join your fellow InfoSec professionals for high-quality, affordable cybersecurity training and education. Earn 6-12 CPE credits through 30+ educational elements, learning from nationally recognized industry leaders. Attend featured keynotes, panel discussions, breakout sessions, and solution vendor displays-all while networking with local peers.

Ignite18 (Anaheim, California, USA, May 21 - 24, 2018) Palo Alto Networks' sixth annual conference features highly technical insights based on firsthand experiences with next-generation security technologies, groundbreaking new threat research, or innovative technical best practices. Don’t miss this outstanding opportunity to share your expertise with our Ignite community of distinguished security professionals and researchers.

AFCEA/GMU Critical Issues in C4I Symposium (Fairfax, Virginia, USA, May 22 - 23, 2018) The AFCEA/GMU Critical Issues in C4I Symposium brings academia, industry and government together annually to address important issues in technology and systems research and development. The agenda for 2018 focuses on: innovations in software engineering, advances in data security, blockchain impact on C4I, exploiting machine learning, collaborative community resilience, IoT impact on national security, understanding information warfare, innovations in IT acquisition, and disruptive mobility technology.

3rd Annual Nuclear Industrial Control Cybersecurity and Resilience Overview (Warrington, England, UK, May 22 - 23, 2018) Now in its 3rd year, the Cyber Senate Nuclear Industrial Control Cyber Security and Resilience Conference will take place on May 22/23rd in Warrington United Kingdom. This two day executive forum will include presentations, roundtable working groups and panel sessions. Together we will address the escalating cyber risk and resilience challenges associated with the adoption and convergence of operational technologies in enterprise facing architecture. Practitioners will gain further insight into how to best respond to evolving cyber threats, the importance of effective risk management throughout the nuclear supply chain, innovations in detection and mitigation, configuration management and how can we incorporate resilience into critical control system components and business process.

PCI Security Standards Council’s Asia-Pacific Community Meeting (Tokyo, Japan, May 23 - 24, 2018) Join us for: networking opportunities, updates on industry trends, insights and strategies on best practices, engaging keynotes and industry expert speakers. The PCI Security Standards Council’s 2018 Asia-Pacific Community Meeting is the place to be. We provide you the information and tools to help secure payment data. We lead a global, cross industry effort to increase payment security by providing industry-driven, flexible and effective data security standards and programs that help businesses detect, mitigate and prevent criminal attacks and breaches.

North American Financial Information Summit (New York, New York, USA, May 23, 2018) Data is the most vital asset of any financial services firm. With volumes increasing exponentially, and the complexity and structure continuously changing, it is more vital than ever to keep on top of EDM strategy and analytical capabilities, while of course remaining compliant. Join us for the only conference around to challenge your current data strategy and evaluate your technology investments. Have your voice heard at interactive workshop tables, learn from peers facing the same challenges at their respective firms, listen to the experts, hear their success stories, and meet 350+ senior decision makers over 5 networking breaks - all this for only one day out of the office!

SecureWorld Atlanta (Atlanta, Georgia, USA, May 30 - 31, 2018) Connecting, informing, and developing leaders in cybersecurity. SecureWorld conferences provide more content and facilitate more professional connections than any other event in the Information Security industry. Join your fellow InfoSec professionals for high-quality, affordable cybersecurity training and education. Earn 12-16 CPE credits through 60+ educational elements learning from nationally recognized industry leaders. Attend featured keynotes, panel discussions, breakout sessions, and solution vendor displays-all while networking with local peers.

RISKSEC (New York, New York, USA, May 31, 2018) Welcome to the 2018 New York City RiskSec Conference. As SC Media approaches our 30th anniversary, we fully understand the avalanche of cybersecurity-related problems, responsibilities and aspirations you face. Like no other time before, data security is crucial to you and your corporate executives. With an avalanche of massive data breaches that compromised millions of users’ data and cost senior-level executives their jobs and the endless other types of attacks that leveraged both new and traditional techniques, 2017 seemed yet another banner year for the infosec industry. We expect this year will be just as active as our attendees will face the challenge of both the criminal element and nation states stepping up their aggressive activities. On top of these, insider threats, supply chain vulnerabilities, regulatory demands and increasing dependence on IoT, AI, cloud apps, mobile devices and still other technologies will continue to convolute your tactical and strategic cybersecurity aims.

Cyber:Secured Forum (Denver, Colorado, USA, Jun 4 - 6, 2018) Cyber:Secured Forum will feature in-depth content on cybersecurity trends and best practices as related to the delivery of physical security systems and other integrated systems. Content is being collaboratively developed by SIA and PSA Security Network’s education teams and will feature top cybersecurity leaders. Additionally, sponsor exhibits will help showcase solutions related to cybersecurity, integrated systems and physical security solutions.

Campaign Cyber Defense Workshop (Boston, Massachussetts, USA, Jun 4, 2018) The Campaign Cyber Defense Workshop brings together experts from the region’s industry, university, and government organizations to address campaign security and effective practices for maintaining campaign integrity -- covering everything from data security to countering reputation attacks.

Gartner Security and Risk Management Summit 2018 (National Harbor, Maryland, USA, Jun 4 - 7, 2018) Prepare to meet the pace and scale of today’s digital business at Gartner Security & Risk Management Summit 2018. Transform your cybersecurity, risk management and compliance strategies and build resilience across the enterprise through leading-edge research and thinking on key topics such as agile architectures, BCM, cloud security, privacy and securing Internet of Things (IoT).

New York State Cybersecurity Conference (Albany, New York, USA, Jun 5 - 7, 2018) June 2018 marks the 21st annual New York State Cyber Security Conference and 13th Annual Symposium on Information Assurance (ASIA). Hosted by the New York State Office of Information Technology Services, in partnership with the University at Albany's School of Business, and The New York State Forum, Inc., the conference is part of a statewide effort to boost cyber security awareness and empower state and local governments, academia, organizations and citizens to take better control of their digital security.

The Cyber Security Summit: Boston (Boston, Massachusetts, USA, Jun 5, 2018) This event is an exclusive conference connecting Senior Level Executives responsible for protecting their company’s critical data with innovative solution providers & renowned information security experts. Learn from cyber security thought leaders and Engage in panel discussions focusing on trending cyber topics such as Sr. Leadership’s Best Approach to Cyber Defense, What’s Your Strategic Incident Response Plan?, Protecting your Enterprise from the Human Element and more. Your registration includes a catered breakfast, lunch, and cocktail reception. Receive half off your admission with promo code cyberwire50 at CyberSummitUSA.com and view details including the full agenda, participating solution providers & confirmed speakers. Tickets are normally $350, but only $175 with promo code.

SecureWorld Chicago (Chicago, Illinois, USA, Jun 5, 2018) Connecting, informing, and developing leaders in cybersecurity. SecureWorld conferences provide more content and facilitate more professional connections than any other event in the Information Security industry. Join your fellow InfoSec professionals for high-quality, affordable cybersecurity training and education. Earn 6-12 CPE credits through 30+ educational elements, learning from nationally recognized industry leaders. Attend featured keynotes, panel discussions, breakout sessions, and solution vendor displays-all while networking with local peers.

NSA 2018 Enterprise Discovery Conference (Ft. Meade, Maryland, USA, Jun 5 - 6, 2018) Hosted by the National Security Agency and the Federal Business Council (FBC). The EDC is the largest event held at NSA with over 1500 attendees from around the world. EDC provides a collaborative learning experience for professionals in the SIGINT Development field across the U.S. Intelligence Community and the other 5-Eyes partner nations: Australian Signals Directorate (ASD), Communications Security Establishment, Canada (CSE), Government Communications Headquarters, Great Britain (GCHQ), and Government Communications Security Bureau, New Zealand (GCSB).

Cyber//2018 (Columbia, Maryland, USA, Jun 6, 2018) Cyber touches all aspects of our life from the myriad of devices we have brought into our homes to those we employ on the job to increase and improve our productivity. Please join us for our 9th annual cyber conference, where we tackle some of the most relevant topics surrounding operating within the cyber landscape.

TU-Automotive Cybersecurity (Novi, MIchigan, USA, Jun 6 - 7, 2018) Co-located with the world's largest automotive technology conference & exhibition. The conference unites players from research labs, automakers, tier 1’s, security researchers, and the complete supply chain to plan for the imminent future.

SINET Innovation Summit 2018 (New York, New York, USA, Jun 7, 2018) Connecting Wall Street, Silicon Valley and the Beltway. SINET New York connects the United States’ three most powerful institutions and evangelizes the importance of industry, government and academic collaboration on security initiatives.

Transport Security and Safety Expo (Washington, DC, USA, Jun 11 - 12, 2018) Security incidents are expected to cost the world $6 trillion annually by 2021, making now the time to find out more at the 2018 Transport Security and Safety Expo. The transportation industry is rapidly digitizing, leading to greater risks and potential impacts from cyber and physical events. Understanding how to better safeguard operations and protect critical networks and infrastructure from damage is paramount, and opportunities like TSSX18 that bring the industry together for training and solutions are welcomed by SANS.

Transport Security & Safety Expo (Washington, DC, USA, Jun 11 - 12, 2018) The conference is devoted to the challenges and opportunities surrounding ensuring the safety and security of passengers and cargo in the digital age.

Dynamic Connections 2018 (Palm Springs, California, USA, Jun 12 - 14, 2018) Together with you, our customers and partners, we’ll come together for 2 ½ days to learn, explore and create the possible at Dynamic Connections 2018 (DC18). To get ahead of the most critical, most pervasive threat we face in the digital domain today, we must reach into the future and pull tomorrow’s innovation forward.

Norwich University Cyber Security Summit (Northfield, Vermont, USA, Jun 18 - 20, 2018) Norwich University’s College of Graduate and Continuing Studies (CGCS) is pleased to announce the second annual Cyber Security Summit in June 2018. The summit, presented in a continuing education format, welcomes Norwich alumni and others interested in exploring and discussing the latest in cyber security policy from both the federal level and the practical application of that policy on a local or business level.

Insider Threat Program Management With Legal Guidance Training Course (Tyson's Corner, Virginia, USA, Jun 19 - 20, 2018) This training will provide the ITP Manager, Facility Security Officer, and others (CIO, CISO, Human Resources, IT, Etc.) supporting an ITP, with the knowledge and resources to develop, manage, or enhance an ITP. A licensed attorney with extensive experience in Insider Threats and Employment Law, will provide legal guidance related to ITP's, the collection, use and sharing of employee information, and employee computer user activity monitoring. Insider Threat Defense has trained over 500+ organizations and has become the "Leader-Go To Company" for ITP Management Training.

GovSummit (Washington, DC, USA, Jun 27 - 28, 2018) GovSummit -- the government security conference hosted annually by the Security Industry Association -- brings together government security leaders with private industry technologists for top-quality information sharing and education on security topics affecting federal, state and even local agencies.

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry’s largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust the CyberWire to get the message out. Learn more.

Cyber Investing Summit. Pakistan's mobile spyware campaigns. Phishing via Phnom Pen. DHS cyber strategy. Investigation updates.