The CyberWire Daily Briefing, 4.9.20

Special Section

News for the cybersecurity community during the COVID-19 emergency

Telework standards, some relaxation of GDPR enforcement, more COVID-19-themed phishing, and Zoom agonistes.

CISA updates US Federal telework guidance.

The Cybersecurity and Infrastructure Security Agency (CISA) has issued Trusted Internet Connections (TIC) 3.0 Telework Guidance documents. The TIC guidance is intended to support Federal agencies as they seek to comply with Office of Management and Budget direction to maximize both the opportunity for, and the security of, remote work across the Government during the pandemic emergency.

One of the agencies likely to stand in need of the guidance is NASA. BleepingComputer reports that the space agency is receiving particular social engineering attention as much of its workforce is now telecommuting.

Phishing schemes spoof White House emails on COVID-19.

Researchers at INKY describe some implausible emails on the coronavirus pandemic that pretend to originate from either the White House or US Vice President Pence. INKY outlines two distinct series of emails.

The first said that current measures against the pandemic (which the authors characterize with both orthographic and factual inaccuracy as a “Carnatine”) would continue through August, and that the IRS had pushed “Tax Day” back from April 15th to August 15th. It also urged recipients to download the President’s guidance that would “protect you and your family from pandemic” (sic). The second series reiterated the claims of the first, and encouraged recipients to follow a link for more information.

The spelling and usage are of course appalling (and not as funny as the ShadowBrokers' malapropisms used to be, and where are those guys these days?), but the attackers did use some of the White House’s actual html code. The emails originate from Russia, but they seem pretty clearly to be a criminal as opposed to a state-sponsored campaign. For one thing, the troll farmers of St. Petersburg handle American English much better, without all the Boris-Badenovisms on display in these communications. Nevertheless, someone somewhere is likely to fall for them.

Postponing GDPR fines.

SC Magazine says that the UK’s Information Commissioner’s Office (ICO) is deferring the large fines for data breaches it imposed last year on British Airways and Marriott International, respectively £183 million for British Airways and £99 million for Marriott International. The extension recognizes the economic stress the COVID-19 pandemic has imposed, especially on the travel industry. It is a deferral and not forgiveness; the companies are expected eventually to pay up.

Zoom fixes some security issues, but finds itself unwelcome in more enterprises.

Zoom continues to suffer from the pyrrhic commercial triumph the company enjoyed when demand for its teleconferencing services exploded in February and March. It’s fixed some security issues—Yahoo says Zoom has added a new security menu in its latest versions, and ZDNet reports that the company has removed meeting IDs from its toolbar—but on balance it’s still been a bad week, what CIO Dive calls a “no good, very rotten week.”

According to BuzzFeed, Google has banned its employees from using the teleconferencing app on grounds of its questionable security. And as the US Congress continues to figure out how it will conduct as much business as possible online (and the Washington Post has a summary of some of the measures under consideration), the Senate at least is fighting shy of Zoom. Reuters reports that Senators are being told not to use Zoom’s services.

Summary

By the CyberWire staff

Recorded Future has identified an ongoing disinformation campaign, "Operation Pinball," probably of Russian origin, that seems to overlap the "Secondary Infektion" campaign the Atlantic Council described earlier this year. Operation Pinball for the most part targets Russophone populations in Eastern Europe and the Near Abroad of former Soviet Republics. Two of its principal objectives appear to be undermining the government of Estonia (with content that exploits fears connected with European migrant crises) and disrupting Georgia's "growing relationship" with NATO. Operation Pinball uses inauthentic websites and social media accounts in what appears to be a "hack-and-leak" campaign. In fact the purportedly leaked documents, while often convincing, are bogus.

Sophos yesterday reported finding what it calls "fleeceware" in apps sold through iTunes. By their count there are thirty of them. What counts as fleeceware is something of a judgment call. The applications Sophos singled out charge subscriptions: "$30 per month or $9 per week after a 3- or 7-day trial period. If someone kept paying that subscription for a year, it would cost $360 or $468, respectively. For an app." This is high, especially since the apps in question seem in Sophos's opinion to offer no real value that can't be found in truly free apps, and therefore lack that “ongoing value to the customer” Apple requires subscription products sold in its store to offer.

CISA, by the way, is looking for student interns, and some of the positions are even open to high school students. The application deadline is April 15th.

Podcast Summary

In today's CyberWire Daily Podcast, out later this afternoon, we speak with our partners at CynergisTek, as Caleb Barlow takes a page (specifically, page 302) from 40-second Boyd's Discourse on Winning and Losing and tells us about OODA loops. Our guest is Or Katz from Akamai, discussing how the hoods are bypassing current industry (and employee) phishing defenses.

And Hacking Humans is up. In this episode, "Even famous people get scammed," Dave has the story of a Walking Dead actress raising money for a scammer, Joe has an article warning of Government websites giving bad security advice, the Catch of the Day tries to put the fear of God in its victim, and later in the show Carole Theriault returns with an interview of researchers from Lookout who analyzed a phishing scam with over four thousand victims.

— The cybersecurity community during the COVID-19 emergency

Authoritarianism Goes Viral (Avast) The coronavirus crisis, where many rely on their governments for accurate and prompt information, allows insight into authoritarian regimes and the trust that citizens lack in their government.

GDPR penalties deferred as Covid-19 takes hold (SC Magazine) Penalty extensions, understandable in the current unprecedented times, is likely to have a long-term impact on GDPR enforcement

Post-Covid-19 tech reconstruction - will there be a new tech political contract? (Computing) Will Wallace, Partner at Interel, a European public affairs consultancy, asks how the relationship between big tech and government will change in the post-pandemic world

TIC 3.0 Interim Telework Guidance (CISA) The Trusted Internet Connections (TIC) Program Management Office has produced the TIC 3.0 Interim Telework Guidance document to support OMB Memorandum 20-19 and the surge in teleworking. This document provides security capabilities for remote federal employees securely connecting to private agency networks and cloud environments. The guidance is short-term for Calendar Year 2020 and is expected to be incorporated into a Remote User Use Case later.

NASA under 'significantly increasing' hacking, phishing attacks (BleepingComputer) NASA has seen "significantly increasing" malicious activity from both nation-state hackers and cybercriminals targeting the US space agency's systems and personnel working from home during the COVID-19 pandemic.

()

Peter Cochrane: 5G is bad for our health - not! (Computing) Computing is the leading information resource for UK technology decision makers, providing the latest market news and hard-hitting opinion.

Phishing emails impersonate the White House and VP Mike Pence (BleepingComputer) Phishing scammers have started to impersonate President Trump and Vice President Mike Pence in emails that distribute malware or perform extortion scams.

Coronavirus-themed phishing emails and websites spoof the White House (TechRepublic) The phishing emails led to malicious websites that used the same HTML and CSS found in actual White House sites, says email security provider INKY.

When the Going Gets Tough, Cybercrime Gets Going (RBS) The ongoing “Coronavirus” (COVID-19) pandemic has had a profound impact on the world economy in a short time, especially within the United States where unemployment has risen sharply. While much is still unknown, many analysts are predicting that the market decline will continue before we see any ki

Another COVID-19 Research Firm Targeted by Ransomware Attack (HealthITSecurity) This week's breach roundup is led by a ransomware attack on 10x Genomics, a biotechnology firm currently working on potential COVID-19 treatments; hackers were able to steal some sensitive data.

Phishing Domains Pushing COVID-19 Drugs, Preying on Innocent Consumers (NormShield) As the global death toll rises, unemployment filings reach record highs, and uncertainty skyrockets, everyone is searching for the same thing - relief.

No COVID-19 Respite: Ransomware Keeps Pummeling Healthcare (GovInfo Security) As the COVID-19 outbreak has intensified, so too has cybercrime, including ransomware, Interpol, the international crime-fighting agency, warns. Despite some gangs

Clever Crypto Could Protect Privacy in Covid-19 Contact-Tracing Apps (Wired) Researchers are racing to achieve the benefits of location-tracking without the surveillance.

UW study on app aimed at predicting virus outbreaks seeks volunteers (KING) Researchers at UW Medicine hope to turn smartphones into personal screeners.

Coronavirus turns up the heat on cybersecurity projects (SC Media) Cybersecurity projects – even important ones – often languish, due to budget constraints, scarce resources or simply because they’re just lower priority

Zoom adds new security menu in latest update (Yahoo) The video conferencing platform has promised to improve its security and privacy credentials following concerns over its services.

Zoom removes meeting IDs from app title bar to improve privacy (ZDNet) Zoom app won't show meeting ID in the title bar going forward to avoid accidental leaks and Zoom-bombing disruptions.

Zoom's no good, very rotten week: What's next in its security plans (CIO Dive) It might be tempting to believe Zoom's flaws were intentionally hidden, it's more likely popularity brought scrutiny — something all prominent technologies eventually bear.

Google Has Banned Zoom Software From Employees' Computers, Citing Security Vulnerabilities (BuzzFeed News) Zoom has exploded in popularity during the coronavirus pandemic while also coming under fire over security issues.

U.S. Senate tells members to avoid Zoom over data security concerns: FT (Reuters) The U.S. Senate has told its members to not use Zoom's video conferencing app due to data security concerns, the Financial Times reported on Thursday, even as the company attempts to stem a global backlash against its fast-growing app.

Point of order: Congress weighs how to govern from afar (Washington Post) Congress is considering ways to govern from afar during the coronavirus pandemic

Analysis | The Cybersecurity 202: Mail-in voting surge is already facing time crunch in run-up to November election. (Washington Post) Wisconsin chaos shows the perils of not preparing.

CBS forced to 'clarify' unvetted video of crying nurse; hospital where she quit responds (Conservative News Today) CBS News issued clarifications after questions arose on a viral video of an ICU nurse crying about a lack of face masks in a coronavirus hospital unit.

Corero Network Security keeps operating as essential service during coronavirus crisis (Proactiveinvestors UK) The firm develops software designed to protect against distributed denial of service (DDoS) attacks

COVID-19: Key updates for compliance teams (Lexology) Lexology Pro Compliance takes a look at some of the most informative articles published on Lexology this week for compliance teams to stay up-to-date with some of the biggest challenges brought about by the COVID-19 outbreak, including key guidance from regulators around the world and practical tips to manage business responses to the pandemic.

Free Online Course Helps Remote Workforce Reduce Cybersecurity Risk (Global Learning Systems) With cyberattacks and phishing on the rise amid COVID-19, Global Learning Systems offers free content and online training to help companies educate employees working from home.

ESET gives free antivirus for individual users (Back End News) The new work-from-home setup may not have prepared some companies in terms of internet security. Or some may not be aware of the security risks of conducting corporate tasks online. In the Philippi…

()

WISeKey reveals WIShelter App for security during the 'stay at home' period (Paypers) WISeKey International Holding has announced the launch of WIShelter, its new app in the WISeID App ecosystem, desined to remediate risks during the COVID-19 lockdown period.

Register your interest for RSAC 2020 APJ, a virtual learning experience. (RSAConference2020 APJ) We’re transforming RSA Conference 2020 Asia Pacific & Japan into a free virtual learning experience, taking place 15 – 17 July. We have many exciting and relevant sessions and keynotes planned, featuring some of the world’s leading cybersecurity experts.

Enhancing Your Teleworkers' Cybersecurity During the COVID-19 Pandemic (Billington Cyber Virtual) What are the best practices and lessons learned in cybersecurity for the tens of millions of teleworkers today?

Cyber Attacks, Threats, and Vulnerabilities

Fake U.S. government documents circulated on the internet came from a Russia-connected disinformation group, researchers say (NBC News) The report comes as election security experts remain on alert for efforts to manipulate the 2020 election from Russia and many other countries and nonstate actors.

Intent to Infekt: ‘Operation Pinball’ Tactics Reminiscent of ‘Operation Secondary Infektion’ (Recorded Future) Insikt Group identified an ongoing information operation that they assess shares significant overlap with “Operation Secondary Infektion."

52k Iranian ID cards with selfies sold on dark web & hacking forum (HackRead) Another day, another data breach – The latest one has the potential to affect Iranians online and offline.

Cisco ‘Critical Update’ Phishing Attack Steals Webex Credentials (Threatpost) Emails purporting to be a Cisco "critical security advisory" are actually part of a phishing campaign trying to steal victims' Webex credentials.

Serious cyber-security flaws uncovered in Ford and Volkswagen cars (Engineering and Technology) Connected vehicles produced by both Ford and Volkswagen have serious security flaws which could allow them to be hacked, according to a Which? investigation.

Fleeceware apps discovered on the iOS App Store (ZDNet) More than 3.5 million iOS users installed 'fleeceware' apps from the Apple App Store.

Data Breach Report: RigUp Exposes More Than 70,000 Private Files (Security) Led by Noam Rotem and Ran Locar, vpnMentor’s research team recently discovered a breached database belonging to American software company RigUp, containing more than 70,000 private files belonging to its US energy sector clients. Read more to learn about this data breach and the cybersecurity implications.

Cybercriminals increasingly using SSL certificates to spread malware (TechRepublic) Enterprises that don't perform adequate SSL inspections are now at a much higher risk to be breached or attacked, according to a Menlo Security report.

Cybercriminals Hide Malware & Phishing Sites Under SSL Certificates (Dark Reading) More than half of the top 1 million websites use HTTPS, researchers report, but not all encrypted traffic is safe.

Phishers and iPhone Thieves Rolling Out Multimillion-Dollar Operations (Security Intelligence) Going down the rabbit hole of a physical iPhone theft followed by a SMiShing campaign, IBM X-Force IRIS researchers found a large-scale operation of phishers with over 600 phishing domains.

Hackers leak personal info of Vianet users (My Republica) In yet another breach of customer data, Vianet Communications – one of the largest internet service providers in Nepal – suffered a 'serious hack' on Wednesday. Data belonging to more than 160,000 consumers was leaked by a hacker through Twitter.

Bisq Bitcoin exchange slams on the brakes after exploit of critical security flaw, crypto theft (ZDNet) Over $250,000 in cryptocurrency has been stolen from users.

Google removes Android VPN with ‘critical vulnerability’ from Play Store (Naked Security) Google has removed the SuperVPN program from the Google Play store after researchers notified it of a critical vulnerability.

Fingerprint cloning: Myth or reality? (Cisco Talos) A blog from the world class Intelligence Group, Talos, Cisco's Intelligence Group

Telehealth: What's at stake from a security standpoint? (ZDNet) Many remote devices lack even basic network security.

Security Patches, Mitigations, and Software Updates

Update Firefox again – more RCEs and an Android “takeover” bug too (Naked Security) Hot on the heels of Firefox’s emergency update over the weekend are the four-weekly fixes that Mozilla had in train already. Get ’em now!

Slack in the security spotlight – lessons for collaboration servers (Naked Security) Interested in WFH collaboration tools right now? Lots of people are – so here’s a history lesson to learn from…

Something something DANE cook: Microsoft pledges to wrap its email systems in secure anti-snooping protocol (Register) Office 365 will finally get DNSSEC-based protection later this year

Cloudflare dumps Google's reCAPTCHA, moves to hCaptcha as free ride ends (and something about privacy) (Register) You want this service at Cloudflare's scale? Then maybe you might want to pay for it

Cloudflare dumps reCAPTCHA as Google intends to charge for its use (ZDNet) Cloudflare says its moving to hCaptcha, an alternative CAPTCHA service, more private than reCAPTCHA.

Cyber Trends

Customer Personal Information Is the Number One Data Protection Priority – nCipher 2020 Global Encryption Trends Study (AFP.com) As organizations accelerate digital initiatives such as cloud and the internet of things (IoT), and data volumes and types continue to rise, IT professionals cite protection of customer personal information as their number one priority, according to the 2020 Global Encryption Trends Study from the Ponemon Institute.

New DivvyCloud Report Finds 85% of Enterprises Believe Cloud Adoption is Necessary for Innovation, but Less than Half are Equipped to Operate in the Cloud Securely (DivvyCloud) Only 58% of Enterprises Have Clear Guidelines and Policies for Developers Building Applications in the Cloud, and 25% Say These Policies are not Enforced

New year, old threats: Malware peddlers went into overdrive in Q1, says Trend Micro (Register) Jan and Feb contained bumper load of fake invoice emails

The Citizen’s Guide to Spotting Fake News (Avast) Finding the truth when you read the news is tricky. Here are a few tips to become more discerning readers.

Know thy enemy: The evolving behaviors of today's cybercriminals (Help Net Security) In order to understand cybercriminals' motives and gameplay, we need to understand their evolving behaviors. according to VMware Carbon Black.

What do CISOs want from cybersecurity vendors right now? (Help Net Security) As Covid-19 spreads across the globe, what challenges are CISOs dealing with and what things they don't want to be dealing with?

Third-party risk is broken, businesses unprepared for supply chain disruptions (Help Net Security) Significant percentage of organizations are drastically unprepared to address supply chain disruptions, according to Prevalent.

Marketplace

Bugcrowd Announces Record Growth, Secures $30 Million in Series D Funding (PR Newswire) Bugcrowd, the #1 crowdsourced security company, today announced record year-over-year growth, including 100% bookings growth in the North...

Accenture acquires cybersecurity startup Revolutionary Security (ZDNet) Revolutionary Security's portfolio includes services for risk assessment, breach and attack simulation testing, and designing and building security programs

Santa Barbara cybersecurity startup MixMode gets $4M in funding (Pacific Coast Business Times) Santa Barbara cybersecurity startup MixMode secured $4 million in Series A funding April 7, coinciding with the launch of its artificial intelligence-based platform for large enterprise data networ…

Estonia signs contract for development of NATO Cyber Range command platform (ERR) The Estonian Center for Defense Investment (ECDI) has concluded a framework agreement with Guardtime OÜ and GT Cyber Technologies OÜ, the object of which is to develop an automated command and development platform for the NATO Cyber Range over a period of four years.

UK's Spamhaus signs Rivium as first Aussie partner (CRN Australia) Tesserent subsidiary becomes exclusive Australian reseller.

Claroty Deepens Leadership Bench with Appointment of Chief Financial and Chief Product Officers (PR Newswire) Claroty, the global leader in industrial cybersecurity, today announced the appointment of Udi Bar Sela as Chief Financial Officer (CFO) and...

SecureSky Accelerates as it Expands its Board of Directors (The Norfolk Daily News ) SecureSky, a leader in cloud security and compliance solutions, announced that veteran executive William E. Fisher has joined the company's Board of Directors,

Secureworks appoints Baghdadi as Regional Sales Director (Trade Arabia) Secureworks, a leading global cybersecurity company that protects organisations in a digitally connected world, has appointed Nader Baghdadi as its new Middle East Regional Sales Director, focusing on the Gulf Cooperation Council (GCC) markets.

Turturro Brings Space, Cyber Expertise to Parsons Talent Acquisition (PR Newswire) Parsons Corporation (NYSE: PSN) announced today the addition of Dana Turturro as the company's senior vice president of talent acquisition....

Products, Services, and Solutions

()

Illusive Networks Integrates with Infoblox to Speed Deployment (PR Newswire) Illusive Networks, the leader in distributed deception-based cyber defense solutions, today announced an out-of-the-box integration with...

()

AttackIQ Added to the Department of Homeland Security’s Continuous Diagnostics and Mitigation Approved Products List (BusinessWire) AttackIQⓇ, the leading independent vendor in the breach and attack simulation market, in conjunction with their GSA Schedule partner, RockITek, today

Box to Reduce Risk of Security Breaches and Cyber-Attacks With New Automated Malware Detection and Controls in Box Shield (MarTech Series) Box Sets New Standard for Mitigating Malware Attacks by Neutralizing Malicious Files

Facebook’s new Tuned chat app lets couples keep their mush private (Naked Security) If you’re OK with Facebook getting your phone number and storing your love notes, photos, shared daily diary and more, then Tune away, baes.

Technologies, Techniques, and Standards

Is your ransomware recovery plan good enough? (Computing) Find out how to improve your recovery from a potential ransomware attack

How To Use Portspoof (Cyber Deception) (Black Hills Information Security) Hello and welcome, and in this video, we’re going to be talking a little bit about Portspoof, a fantastic utility that takes your unused TCP/IP ports and turns them into something different whenever an attacker actually goes about trying to scan them. This video is part of the Active Defense and Cyber Deception class that …

Threat Simulation - Unexpected Protocol on Non-Standard Port (Active Countermeasures) Intro This article is 1 of 7 in a series on testing Threat Hunting software to make sure that it’s configured correctly and …

Threat Simulation - Long Connections (Active Countermeasures) Intro This article is number 2 of 7 in a series on testing Threat Hunting software to make sure that it’s configured correctly …

Threat Simulation - Client Signatures (User Agent) (Active Countermeasures) Intro This article is number 3 of 7 in a series on testing Threat Hunting software to make sure that it’s configured correctly …

Threat Simulation - DNS (Active Countermeasures) Intro This article is number 4 of 7 in a series on testing Threat Hunting software to make sure that it’s configured correctly …

InQL will help developers discover GraphQL vulnerabilities (The Daily Swig) Offensive security tool speeds up the process of exposing hard-to-find security flaws

Design and Innovation

Linux Foundation backs security-oriented seL4 microkernel operating system (ZDNet) Want a truly secure operating system kernel? The Linux Foundation is partnering with Australia's national science agency, CSIRO, to roll out the seL4 microkernel.

Legislation, Policy, and Regulation

U.S. Allows Google Internet Project to Advance Only if Hong Kong Is Cut Out (Wall Street Journal) U.S. officials granted Google permission to turn on a high-speed internet link to Taiwan but not to the Chinese territory of Hong Kong, citing national-security concerns in a ruling that underscores fraying ties between Washington and Beijing.

Barr leads revamped 'Team Telecom' to protect networks from foreign adversaries (Washington Examiner) Attorney General William Barr will lead a revamped national security group dubbed "Team Telecom" as part of the Trump administration’s effort to combat foreign influence in the U.S. telecommunications sector amid concerns about China and other foreign parties.

The Illiterate Mugging of Huawei Will Mug the U.S. Economy (Real Clear Markets) It seems like something from another era at this point, but no doubt some readers remember just how sensitive markets were not too long ago to protectionist trade rhetoric from President Trump.

Separation anxieties: US, China and tech interdependence (Observer Research Foundation) In the near future, we will likely see the United States supplement domestic mechanisms to decouple from China with systematic escalation at key global technology norms-making bodies.

The Inspector Who Never Inspected Anything (American Greatness) ere’s a simple question to ask anyone outraged over the recent firing of Michael Atkinson, the former inspector general for the intelligence community: Can you identify a single instance of a report or letter in which Atkinson exposed intelligence community misconduct to the public? After searching the inspector general’s website, I was unable to do …

Litigation, Investigation, and Law Enforcement

Analysis | Foreign hackers have made it harder for the U.S. to prosecute them (Washington Post) The Justice Department has dropped the charges against these two Russian companies.

French regulator: Google must pay French news and publishing firms for using their content (Reuters) France's competition authority issued a ruling on Thursday that Google would have to pay up to French publishing companies and news agencies for re-using their content.

Apple Beats ID Login Authentication Trespass Suit For Good (Law360) A California federal judge threw out a putative class action over Apple Inc.’s two-factor authentication login, ruling that the users hadn’t sufficiently alleged that the process was enabled without their authorization nor had they shown how the authentication problem directly caused them harm.

Rakoff Mulls Bail For Silk Road Crook Jailed In Brooklyn (Law360) U.S. District Judge Jed S. Rakoff pondered Wednesday whether a toy merchant-turned-drug dealer on the online Silk Road bazaar, who is doing time in Brooklyn for lying about where he got $19 million worth of bitcoins, should be released until the coronavirus abates.

Data breach by disgruntled employee: UK Supreme Court clarifies approach to employer’s liability (Lexology) The UK Supreme Court has issued its decision in Various claimants v Morrisons Supermarkets1 regarding when an employer can be vicariously liable for…

Low-orbit internet banking fraud claim alleged to be a load of space junk (Register) This is what comes of mixing the International Space Station, a relationship breakdown, and banking records

'Football Leaks' Hacker Rui Pinto Placed On House Arrest (Outlook India) In February, English champions Manchester City were handed a two-year ban from European competitions and fined 30 million euros for

Industry Events

For a complete running list of events, please visit the Event Tracker.

Upcoming Events

National Cyber League (NCL) Spring Season (Various locations, Mar 19 - May 15, 2020) The National Cyber League (NCL) is a defensive and offensive puzzle-based, capture-the-flag style cybersecurity competition. Its virtual training ground helps high school and college students prepare and test themselves against cybersecurity challenges that they will likely face in the workforce. All participants play the games simultaneously during Preseason, Individual Game and Team Game. NCL allows players of all levels to enter. Between easy, medium and hard challenges, students have multiple opportunities to really shine in areas as they excel. Registration for the Spring Season closes March 20, 2020.

SecureWorld Houston (Houston, Texas, USA, Apr 15, 2020) Join your fellow InfoSec professionals for high-quality, affordable cybersecurity training and collaboration. Earn 6-12 CPE credits through 30+ educational elements, learning from nationally recognized industry leaders. Attend featured keynotes, panel discussions, breakout sessions, and solution vendor displays—all while networking with local peers.

OFFZONE 2020 (Moscow, Russia, Apr 16 - 17, 2020) This year, cybersecurity specialists, researchers and enthusiasts will meet at the Loft Hall #2. As usual, the focus will be not on business, but on practical issues, fresh research results, and the most relevant cyberthreat experience. As in previous years, the conference will have an additional dimension — an enthralling story-line lived out by the participants in the course of 2 days. The first OFFZONE located visitors in a disaster survival bunker. The second conference brought participants together to revive lost computing power, knowledge and technology. And this year, visitors to OFFZONE 2020 will be connected to unique artificial intelligence that accumulates all their skills and experience. Does the program really selflessly help people or pursue its own goals? Find out at OFFZONE 2020!

SecureWorld Cincinnati (Cincinnati, Ohio, USA, Apr 21, 2020) Join your fellow InfoSec professionals for high-quality, affordable cybersecurity training and collaboration. Earn 6-12 CPE credits through 30+ educational elements, learning from nationally recognized industry leaders. Attend featured keynotes, panel discussions, breakout sessions, and solution vendor displays—all while networking with local peers.

SecureWorld Toronto (Toronto, Ontario, Canada, Apr 23, 2020) Join your fellow InfoSec professionals for high-quality, affordable cybersecurity training and collaboration. Earn 6-12 CPE credits through 30+ educational elements, learning from nationally recognized industry leaders. Attend featured keynotes, panel discussions, breakout sessions, and solution vendor displays—all while networking with local peers.

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry’s largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust the CyberWire to get the message out. Learn more.

Telework guidance. Operation Pinball. iTunes fleeceware? Notes on COVID-19 and cybersecurity.