The CyberWire Daily Briefing for 10.17.2013

Cyber Attacks, Threats, and Vulnerabilities

Anonymous Venezuela Defaces Venezuelan Police and Military Websites for #Op15O (HackRead) The online hacktivists from Anonymous Venezuela have hacked and defaced the Venezuelan police, military websites and domains of non-profit organizations under the operation of #Op15O. Targeted sites belong to Vargas Municipal Police and two domains of Bolivarian Military Technical Academy, left with a deface page showing official Anonymous logo and Twitter handles of the hackers who participated in the cyber

Official Google Video Costa Rica Domain Hacked by h4x0r HuSsY from TeaM MADLEETS (HackRead) Pakistani hacker h4x0r HuSsY from TeaM MADLEETS has hacked and defaced the official Google Video Costa Rica domain just few hours ago. The hacker left his deface page along with a message on the hacked Google Video Costa Rica domain which shows that hack was more likely done as a result of a personal dispute between TeaM MADLEETS and another Pakistani hacker going with the handle of Dr. Freak!

Anonymous Peru Attacks Peruvian Association of Authors and Composers (Softpedia) Anonymous Peru has set its sights on the Peruvian Association of Authors and Composers (APDAYC), an organization that represents authors from Peru and other countries, and grants licenses for the use of musical works

Indian State Owned Telco BSNL gets Hacked by Ch3rn0by1 Hacker (HackersPost) The official domain of Indian state–owned telecommunications company Bharat Sanchar Nigam Limited — BSNL gets hacked by the Pakistani hacker with the handle Ch3rn0by1. The Ch3rn0by1 hacker is a crew member of P4K M4D HUNT3RS hacking group. The hacked domains belong to BSNL's Regional Telecom Training Centre (RTTC), Ahmedabad. There is no specific reason mentioned

Government minister embraces the Dark Side. (Trend Micro CounterMeasures) It appears that Francis Maude, the Minister for the Cabinet Office in the United Kingdom government is getting a little frustrated with technological solutions available to him in the Houses of Parliament. So much so that he has "installed his own wi-fi". In the House of Commons. In his office. In government. Nothing to worry about there then

Comment: Parliamentary Porn Habits (Help Net Security) Security analyst Bill Walker says the only scandal regarding recent revelations about the frequency of the UK Parliament's porn surfing is the lack of web security training

Hackers hit PR Newswire, data shows up alongside recently stolen Adobe code (Ars Technica) Krebs on Security hints these aren't the only companies with hacked data on the servers

Bug Hunters Find 25 ICS, SCADA Vulnerabilities (Threatpost) A trio of researchers have uncovered 25 security vulnerabilities in various supervisory control and data acquisition (SCADA) and industrial control system (ICS) protocols. The researchers, Adam Crain, Chris Sistrunk, and Adam Todorski–though Todorski has not yet been credited with finding any of the disclosed bugs — are conducting this research with a sponsorship from Automatak, a firm — started by Crain — that provides security support for the makers and maintainers of the sorts of ICS and SCADA equipment that control much of the world's critical infrastructure and industrial machinery

'Project SHINE' Illuminates Sad State Of SCADA/ICS Security On The Net (Dark Reading) One million ICS/SCADA devices — and counting — found exposed on the public Internet, researchers say. A global Internet-scanning project focused on finding SCADA/ICS equipment and systems accessible via the public Internet is discovering some 2,000 to 8,000 new exposed devices each day

Project SHINE — Are Control Systems REALLY Connected to the Internet? (Belden) Eric Byres: One of the statements I continue to hear as I talk to executives, managers and engineers is "None of our SCADA or ICS equipment is accessible from the Internet." This week's blog contributor, Bob Radvanovsky of www.infracritical.com, explains Project SHINE — his effort to determine if this statement is fact or fiction

Researchers uncover holes that open power stations to hacking (Ars Technica) Hacks could cause power outages and don't need physical access to substations

Smart Grid and the Threat of Malicious Cyber Actors (Global Security Sitrep) As the energy industry rushes to become "smart," it has paid scant attention to the security implications of this move, particularly in the cyber realm. Touted as the next big thing by policymakers and industry executives alike, smart grid technology is projected to improve the efficiency and sustainability of the electric grid--for less money. Yet smart grids will also drastically increase the security risks of an already vulnerable energy infrastructure

Cyber attack: The truth wouldn't be stranger than fiction (Baltimore Business Journal) "American Blackout" tells what might happen if a cyber attack cripples the nation's power system. A consultant for the film says that the scenario isn't that far-fetched. Could a cyber attack destroy the electrical grid and leave the nation powerless and in the dark for days, weeks or even months? How would people react and deal with an attack on the electrical grid? Would we be prepared, or would chaos ensue? On Oct. 27, National Geographic will premiere "American Blackout," a movie that tells the story of a national power failure in the U.S. caused by a cyber attack

Mass iFrame injection campaign leads to Adobe Flash exploits (Webroot) We've intercepted an ongoing malicious campaign, relying on injected/embedded iFrames at Web sites acting as intermediaries for a successful client-side exploits to take place. Let's dissect the campaign, expose the malicious domains portfolio/infrastructure it relies on, as well as directly connect it with historical malicious activity, in this particular case, a social engineering campaign pushing fake browser updates

Advanced attackers seen moving to sophisticated hacking technique (CSO) Address Space Layout Randomization (ASLR) scrambling memory positions of program elements

Fake Flash Update Serves Multitude of Firefox Extensions (ThreatTrack Security Labs) Specifically, "Version 11.9.900.117″ because "if you're not using the latest version of Flash Player your version may contain vulnerabilities which can be used to attack your computer"

Malware Alert: "Your Facebook Friend Andrew Hernandez Joined Pinterest" (Softpedia) Bogus Pinterest emails designed to spread a piece of malware inform recipients that one of their Facebook friends has joined Pinterest

Gang hires hackers to smooth smuggling operation in Antwerp (Vancouver Sun) Drug gangs are hacking into computers at European ports to allow them to smuggle in entire container shipments of contraband, Europe's crime-fighting agency has disclosed

Cyber–attack breaches port security; containers hijacked (Transport Intelligence) Organised criminals have employed hackers to launch a cyber-raid on port systems, pinpointing the locations of containers concealing smuggled drugs and releasing them to bogus drivers

Organised drug gangs increasingly hooking up with hackers, warns Europol (Naked Security) Organised crime is becoming increasingly entwined with hacking, creating a "service-orientated industry" and making the internet "the single most important" factor facilitating major organised crime and drug trafficking, according to the head of Europol

How mystery DDoSers tried to take down Bitcoin exchange with 100Gbps crapflood (Register) Web security firm Incapsula helped a Chinese Bitcoin trader to weather a ferocious denial-of-service attack last month when the volume of inbound traffic to the site peaked at 100Gbps

DDoS attack size accelerating rapidly (Help Net Security) Arbor Networks released data on global DDoS attack trends for the first three quarters of 2013. The data shows that DDoS continues to be a global threat, with alarming increases in attack size this year

Easyjet systems crash "not an attack" (Business Traveller) Easyjet has denied speculation that its website fell victim to a cyber attack following a Europe-wide system failure yesterday. The airline faces a big compensation bill after its system shut down from 1100 to around 2000, affecting hundreds of flights

Wisconsin hospital bills erroneously mailed to unauthorized persons (SC Magazine) A system settings error caused financial statements to be mailed to roughly 8,000 people who received care from Wisconsin-based Memorial Hospital of Lafayette County, but an undisclosed number were sent to unauthorized persons

Legal Aid Society of San Mateo County Admits Security Breach (eSecurity Planet) An undisclosed number of clients' names, birthdates, Social Security numbers and medical health information may have been accessed

Twitter introducing new direct message options — to combat spam or invite more? (Naked Security) News has been spreading that Twitter is slowly introducing changes to how it handles direct messages (DMs) and controlling the types of links that can be sent through DMs from non-verified accounts

Google Chrome to help unsafe, insecure XP users surf the net…putting the rest of us at risk (Graham Cluley) Gee thanks for nothing Google. Your latest decision regarding Chrome could put many of us at risk on the internet. After April 8, 2014, Microsoft will no longer support Windows XP. That means your XP computers will no longer receive security updates to protect your from the latest security vulnerabilities exploited by malicious hackers

Is your webcam watching you? (KSDK) The plundering of the Internet of Things has commenced. From a command center in a non-descript high-rise here in the heart of Silicon Valley, security start-up Norse has been gathering shocking evidence of hackers usurping control of Internet-connected appliances, everything from web cams to climate-control systems

Inside the mind of an online predator (Graham Cluley) Fortunately, most of us don't think like a predator. Understanding how predators act and think is one of the most difficult things a victim has to do. But identifying predators is a useful skill, not only for victims but anyone online

Security Patches, Mitigations, and Software Updates

About the security content of Java for OS X 2013-005 and Mac OS X v10.6 Update 17 (Apple Support) This document describes the security content of Java for OS X 2013-005 and Mac OS X v10.6 Update 17

Cyber Trends

Security Spending Continues to Run a Step Behind the Threats (CIO) Security professionals are being hammered by a powerful combination of forces: As IT systems get more difficult to defend—more open, mobile and shared—cyber-threats are also evolving to more swiftly penetrate enterprise defenses

The Internet of Things: Vulns, botnets and detection (Help Net Security) Does the Internet of Things scare you? It probably should. This DerbyCon video discusses why embedded device security is laughably bad, handling vendor notification, and setting up a dev environment to build embedded software

Young Aussies sending private information via Facebook at risk of falling victim to cyber fraud (News.com.au) Experts have warned there's "no such thing as privacy on the internet" and Australians need to think twice before sending details over the web

Study: Millennials indifferent to online risks (USA Today) Growing up in the age of the Internet, many Millennials don't give much credence to cybersecurity or consider it as a career

Study Reveals Cyber Security Teams are Bogged Down with Tactics Not Strategy (Herald Online) Half of IT and business leaders surveyed believe shortage of qualified security talent is exposing their organizations to serious risk

All quiet on the Wi–Fi security front (ComputerWeekly) Since the assault on the Wi-Fi network of the US-based TJX retail group in 2007, there has been no further high-profile data breach involving this communications channel. Does this mean that the TJX breach was enough to shock corporations into ensuring that Wi-Fi networks were secure, proving that it usually takes a big breach to spur across the board action

Personal mobile devices cause nearly one–third of corporate breaches in Europe (FierceMobileIT) By Molly Bernhart Walker Comment | Forward | Twitter | Facebook | LinkedIn Within the last two years, nearly one-third of European companies lost confidential or customer data because employees used personal mobile devices on the network, finds a new survey from Samsung

Marketplace

Thanks to NSA, German e–mail providers see flood of new customers (Ars Technica) But remember, they may not be as safe as you think. The revelations about the National Security Agency's surveillance programs may have hurt US cloud providers' business, but they've created a boom in German e-mail hosting

BlackBerry to world: Trust us (CRN) Canadian vendor claims to be solid but the losses have long told another story. Ailing BlackBerry has a message for its passionate, if dwindling, user base: We'll be here for you

Seven Local Tech Companies Prove Vermont Can Lead the Nation (Seven Days) When most people think of Vermont products, they think of Burton Snowboards, Ben & Jerry's ice cream and maple syrup. But the Green Mountain State is also home to a number of tech and bioscience companies with national or international reputations within their niche markets

Healthcare.gov problems spark federal IT recriminations (FierceGovIT) Problems with healthcare.gov, the federal website for residents of 36 states whose governments declined to build their own healthcare exchanges, have set off a round of recriminations against federal information technology management and acquisition

Products, Services, and Solutions

Mocana Purges NSA–Compromised Key–Generation Scheme From Its NanoCrypto Embedded Security Engine (Dark Reading) NIST previously promoted the algorithm as a cryptographically secure key generation method

Yahoo Should Consider SSL a Minimal Security, Privacy Standard for Email (Threatpost) Yahoo's decision to turn SSL on by default for its email users is being met with halfhearted applause by the security industry

Video: Hacking back and active defense (Information Security Buzz) In this DerbyCon video, John Strand will demonstrate the Active Defense Harbinger Distribution, a DARPA funded, free Active Defense virtual machine. He will debunk many of the myths, outright lies and subtle confusions surrounding taking active actions against attackers

Windows 8.1 includes seamless, automatic disk encryption—if your PC supports it (Ars Technica) A handy feature, but stringent hardware requirements limit it to newer systems

Webroot brings app reputation service to its mobile security suite (ComputerWorld) Webroot announced a new release of the Webroot SecureAnywhere Business--Mobile Protection suite. The new version adds some key features and capabilities and blurs the line between mobile security and mobile device management. One element that stands out from the rest, though, is Webroot's new service to help IT admins understand the risk posed by installed apps

Malwarebytes launches anti–virus Android app (ZDNet) As worries surface that mobile devices will soon become a prime target for cybercriminals, Malwarebytes is the latest firm to launch their own anti-virus application

Signifyd Fights Fraud With Online Sleuthing (All Things D) Signifyd today launches tools for online merchants to fight fraud. It helps sellers make better choices about whether to accept or deny sales by piecing together online identities that match up with offline people

Technologies, Techniques, and Standards

NSA's Data Center Electrical Problems Aren't That Shocking (IEEE Spectrum) Last week, the Wall Street Journal reported that arc-fault failures—electrical problems that exceed the protective capabilities of circuit breakers and cause metal to melt and go flying—are delaying completion of the NSA's controversial new Utah data-storage center. The article reported that 10 such meltdowns over the past 13 months had led to disputes about the adequacy of the electric control systems, and suggested that designers and builders of the new data center may have cut corners

Access denied and blacklists / blocklists (Internet Storm Center) If you are surfing the Internet, minding your own business, and receive an access denied message, you might understandably wonder why. As one Internet surfer discovered, he was trying to go to a legitimate web site to book a service in a country he was planning on visiting. Imagine his surprise when he see the image below in his web browser

Is Cybersecurity an Inside Job? (Digital Communities) While security clearance and authentication processes are essential to physical and other security, the physical DC Navy Yard breach by Aaron Alexis and the state secret breaches by Edward Snowden illustrate some disturbing weaknesses in personal validation and authentication. These clearance breaches were very different in nature but show a range of how a person's calculated action can subvert basic security measures

Improving Tor's anonymity by changing guard parameters (Tor Project) There are tensions in the Tor protocol design between the anonymity provided by entry guards and the performance improvements from better load balancing. This blog post walks through the research questions I raised in 2011, then summarizes answers from three recent papers written by researchers in the Tor community, and finishes by explaining what Tor design changes we need to make to provide better anonymity, and what we'll be trading off

Customizing defense models to reduce the window of exposure (Help Net Security) Most organizations already have a defense model in place that is meant to protect them from attacks, but the problem is that many use an outdated one. But the threat landscape has changed and is constantly changing. Currently, that involves many client side attacks, and the possibility of being targeted by persistent attackers, either those affiliated with criminal organizations or state-sponsored ones

Dissecting Malware — Static Analysis of Malware (Infosec Institute Resources) This article will show you how to do static malware analysis. What are the processes involved in a static analysis? Static malware analysis is the first essential step taken by malware analysts or reverse engineers working in the forensics department

User–Selected Passwords Still Getting Cracked (Dark Reading) Educating people about good password selection has largely failed as graphics-processor-enabled cracking crunches through billions of possibilities every second

Raising awareness quickly: A look at basic password hygiene (ComputerWorld) Continuing a running series for National Cyber Security Awareness Month, Rapid7 has released another easily emailed awareness note. This time the topic is passwords, something that can either make or break a person's overall level of security

Cybernomics 101 (The Hill) Over the last few months there's been tremendous speculation in the media surrounding leaks from the National Security Agency (NSA) and the ongoing commentary this continues to receive around the globe. Much of what we are reading is the stuff of spy novels, and in some cases media reports pursue headlines without understanding the substance of the content contained within the classified documents that they are reviewing

NIST cybersecurity framework draft delayed by shutdown (FierceGovIT) The Oct. 10 deadline for the National Institute of Standards and Technology to issue a preliminary cybersecurity framework for private sector operators of critical infrastructure came and went without action, due to the ongoing government shutdown

Security Think Tank: Make security and compliance part of workflow to achieve balance (ComputerWeekly) The march towards greater regulation and adherence to compliance has created a set of challenges for organisations and their IT departments, while also delivering a cultural shift with regards to how they treat data and quantify the need to secure it

Security Think Tank: Understanding risk key to security balance (ComputerWeekly) The holistic view must be taken that security must be part of the wetware (humans) and the hardware (ICT). This recognises that humans are involved with writing code (software, applications) and configuring any hardware and software

How to Design — And Defend Against — The Perfect Security Backdoor (Wired) We already know the NSA wants to eavesdrop on the internet. It has secret agreements with telcos to get direct access to bulk internet traffic. It has massive systems like TUMULT, TURMOIL, and TURBULENCE to sift through it all. And it can identify ciphertext — encrypted information — and figure out which programs could have created it

Design and Innovation

Disruptive Technology: Follow Fight Club Rules (InformationWeek) Smart IT pros will apply the rules from the movie "Fight Club" to discussions with business colleagues. First rule: You do not talk about disruptive technologies

Academia

The Reality Of Freshly Minted Software Engineers (Dark Reading) Why do recent computer science graduates need to be retrained when they hit the commercial world? Universities and colleges are pumping out more and more software engineers each year. Yet it would seem to many in the industry that the quality of these freshly minted graduates is decreasing. Perhaps "quality" is too harsh a word — "immediate usefulness" would likely be more appropriate. What's the problem

Legislation, Policy, and Regulation

Building a new international consensus on the future of cyberspace (Gov.uk) Foreign Secretary William Hague calls for countries to address collectively one of the greatest challenges facing our generation

U.S. eavesdropping agency chief, top deputy expected to depart soon (Reuters) The director of the U.S. National Security Agency and his deputy are expected to depart in the coming months, U.S. officials said on Wednesday, in a development that could give President Barack Obama a chance to reshape the eavesdropping agency

Meet the man who could be next in line to control the NSA's spying apparatus (Washington Post) Reuters reports that both Gen. Keith B. Alexander, NSA and U.S. Cyber Command chief, and his civilian deputy John "Chris" Inglis will be departing the National Security Agency (NSA) soon. And they identify Vice Admiral Michael Rogers, current commander of the U.S. Navy's 10th Fleet and U.S. Fleet Cyber Command, as one leading candidate to replace Alexander in the top spot

Should the NSA and U.S. Cyber Command be split up after Keith Alexander steps down? (Washington Post) The head of U.S. Cyber Command and the NSA, Gen. Keith Alexander, intends to retire, Reuters is reporting. It doesn't appear that he's being forced out over this year's domestic surveillance controversy. Alexander's voluntary plans were first reported by Wired back in June. But news that the intelligence official has finalized his departure means that President Obama faces a choice: Will Alexander's successor have control over both the NSA and Cyber Command, or should he appoint two separate officials to manage each agency

NSA revelations: A timeline of what's come out since Snowden leaks began (Christian Science Monitor) Since Edward Snowden's first published leak about National Security Agency surveillance techniques appeared in The Guardian on June 5, new revelations have been steadily trickling out. Here's a look at what we've learned since June, broken down by eight key dates

How the NSA and FBI foil weak oversight (Guardian) Over 20 congressional bills aim to address the crisis of confidence in NSA surveillance. With Patriot Act author and Republican Congressman Jim Sensenbrenner working with Vermont Democratic Senator Patrick Leahy on a bipartisan proposal to put the NSA's metadata program "out of business", we face two fundamentally different paths on the future of government surveillance

How to fight cyber war? Estonia shows the way (Times of India) Estonia is the Hiroshima of cyber war. In April 2007, the new government decided to move a Soviet-era war memorial to a location outside the capital, Talinn. Pro-Soviet elements came out on the streets to protest. Then, the cyber attacks started. Within hours, the attackers brought down the tiny country's banks, newspapers, news agencies and all government sites. The rioters raged outside

Defending Against Cyber Attacks in South Korea (The Peninsula) Named as the most wired place on earth, it is no surprise that South Korea has faced many cybersecurity challenges with 2013 being one of its worst years. Unfortunately, at this time all that South Korea can do when dealing with cyberwarfare is play defense

Cryptographer Adi Shamir Prevented from Attending NSA History Conference (Federation of American Scientists) In this email message to colleagues, Israeli cryptographer Adi Shamir recounts the difficulties he faced in getting a visa to attend the 2013 Cryptologic History Symposium sponsored by the National Security Agency. Adi Shamir is the "S" in the RSA public-key algorithm and is "one of the finest cryptologists in the world today," according to historian David Kahn. The NSA Symposium begins tomorrow. For the reasons described below, Dr. Shamir will not be there

Post–Snowden, U.K. Parliamentary Committee To Probe Individual Privacy Vs. National Security (TechCrunch) A U.K. parliamentary committee has widened the scope of a planned inquiry into the legislative framework governing national intelligence agencies' access to private information, triggered by the PRISM revelations in the U.S. It will now consider more broadly the impact of mass surveillance on individuals' right to privacy. The Intelligence and Security Committee (ISC) said today it will broaden the scope of its forthcoming inquiry — in order "to examine the appropriate balance between privacy and security in an internet age"

National Strategies & Policies (CCDCOE) The selection below provides links to national cyber security policy and legal documents, including national security and defence strategies identifying cyber, national cyber/information security strategies, and relevant legal acts. The collection primarily focuses on NATO Nations, but a number of other national examples are represented as well

Litigation, Investigation, and Law Enforcement

To pay off webcam spies, Detroit kid pawns $100k in family jewels for $1,500 (Ars Technica) Video was so embarrassing, theft seemed the better option. Yesterday, I gave a one-hour talk at the University of Michigan on remote administration tools (RATs) and the surprising ways they allow hackers, corporations, schools, and police to spy on computer users by activating microphones and webcams. The talk contains some pretty wild stories—but a woman approached me afterward to let me know that the craziest single RATing story she had ever heard just took place up the road in Detroit. And she was right

Snowden leaks: David Cameron urges committee to investigate Guardian (Guardian) PM says leaks have damaged national security and suggests MPs could 'examine issue and make further recommendations'

Controversy grows over cyber warfare command's alleged election meddling (Yonhap) The main opposition Democratic Party (DP) on Thursday sought to stir up controversy over allegations that the defense ministry's cyber warfare command meddled in last year's presidential election, likening the current Park Geun-hye administration to the military regime of her father and late president Park Chung-hee

Door may open for challenge to secret wiretaps (New York Times) Five years after Congress authorized a sweeping warrantless surveillance program, the Justice Department is setting up a potential Supreme Court test of whether it is constitutional by notifying a criminal defendant -- for the first time -- that evidence against him derived from the eavesdropping, according to officials

Obama Administration fights quick Supreme Court review of NSA program (Politico) The Obama Administration is fighting an effort to have the Supreme Court immediately review the legality of the National Security Agency's call-tracking program

IBM continues legal fight against AWS (FierceGovIT) Making good on its promise to contest an unfavorable Court of Federal Claims decision over its effort to have the CIA reconsider a lucrative contract award for intelligence community cloud computing to Amazon Web Services, IBM filed two requests for an injunction on Oct. 10

Two girls arrested after one allegedly brags on Facebook about cyber bullying suicide victim (Naked Security) Two girls — ages 12 and 14 — have been arrested in connection with the bullying of Florida teen, Rebecca Ann Sedwick, after the 14–year-old allegedly bragged on Facebook about her part in Rebecca's death, signing the post with a little red heart

For a complete running list of events, please visit the Event Tracker.

Upcoming Events

MIRcon 2013 (Washington, DC, USA, Nov 5 - 6, 2013) With targeted attacks becoming more prevalent, today's incident responders are faced with the tremendous challenge of accelerating their response times while capturing relevant data from attacks in progress. From analysts and innovators to managers and executives the Mandiant Incident Response Annual Conference® (MIRcon®) is an excellent investment in your business and your professional development where you will learn about new technologies, incident response best practices, and key strategies for managing network security.

Hack-in-the-Box Security Conference 2013 (Kuala Lumpur, Malaysia, Oct 14 - 17, 2013) The 11th annual HITB Security Conference (16th/17th October) will be a triple track offering featuring keynotes by Andy Ellis, Chief Security Officer at Akamai and Joe Sullivan, Chief Security Officer at Facebook. This year's event also features all new 2-day training courses (14th/15th October) on a wide variety of topics including Android exploitation, extreme web hacking, infrastructure security, exploiting injection flaws and a special iOS security course by the world famous Evad3rs team. The full speaker list and conference agenda will be released after the Call for Papers closes on the 25th of July.

SNW Fall 2013 (Long Beach, California, USA, Oct 15 - 17, 2013) SNW is the world's largest independently produced conference series focused on the evolution of architecture for a new world of mobility, Big Data and business agility. Produced by Computerworld -- and co-owned by Computerworld and the Storage Networking Industry Association (SNIA) -- SNW remains unbiased and vendor agnostic. Unlike events focused on a specific vendor agenda and product portfolio, SNW provides a forum of open thought leadership and practical education that defines the spectrum of storage, data and infrastructure solutions available to a highly qualified audience of enterprise technology decision-makers.

Cybersecurity Symposium: "Protect. Defend. Educate." (Linthicum, Maryland, USA, Oct 16 - 17, 2013) The Cybersecurity Symposium being held October 16-17, 2013, will deliver first-class training for government and industry security professionals while simultaneously offering high-level keynote speakers, essential networking opportunities, and an informative technology exposition. The Symposium sessions will have a special emphasis on security challenges facing today's security professionals and cyber awareness training for security professionals responsible for protecting sensitive and classified information from the ever increasing threats of mobile devices, espionage, terrorism, and cyber-attacks to ensure our national security. Register by August 31 to ensure the reduced early bird registration fee. This event is free for government employees and active-duty military personnel. Exhibit space and sponsorship opportunities are also available.

NSU Healthcare Cyber Security Summit (Fort Lauderdale, Florida, USA, Oct 17, 2013) In today's modern healthcare systems, data is everywhere, including sensitive patient data that needs to be secured and monitored. Join top healthcare security professionals from Nova Southeastern University, AccessData, and RSA to hear about current regulations that affect healthcare companies of all sizes, ways to protect sensitive data, and learn techniques to monitor access for suspicious activity. If you are responsible for the privacy or security of your company's healthcare data, you will benefit from presentations from these leading experts in the field. NSU's Chief Information Security and HIPAA Security Officer, John Christly, will examine the threats to the privacy and security of todays' modern healthcare operations. You will also hear from experts from AccessData and RSA on how to detect and prevent data breaches. RSVP at the link.

Nuclear Regulatory Commission Cyber Security Conference & Expo (Rockville, Maryland, USA, Oct 17, 2013) This one-day conference will consist of cyber sessions in the NRC Auditorium given by government and industry speakers. Exhibit tables will be set-up just outside the Auditorium and companies will have the opportunity to demo their latest technologies to NRC's IT personnel.

Securing the Internet of Things Summit (San Francisco, California, USA, Oct 21, 2013) The Internet of Things is still in its infancy and the security community has a chance to build in new approaches to security if we get started now. More secure embedded operating systems and applications, more scalable approaches to continuous monitoring and threat mitigation and new ways of detecting and blocking active threats are evolving and can be tremendously effective. SANS is looking to bring together community talent and ideas to develop new solutions, demonstrate security technology that already works and to provide a force multiplier to making the Internet of Things be more secure than the first phases of Internet evolution.

13th Industrial Control Systems Cyber Security Conference (Atlanta, Georgia, USA, Oct 21 - 22, 2013) Industrial Control Systems (ICS) operate the infrastructures of electric power, water, chemicals, manufacturing, transportation, defense, etc. and link the digital and physical worlds. Their cyber security presents challenges that are distinct from securing traditional IT systems. The conference is attended by control & operations engineers and their IT counterparts from critical infrastructure industries, by ICS and security vendors, and by universities. Run under the Chatham House rules of confidentiality, the conference discusses ICS cyber incident case studies, provides regulatory updates, discusses solutions in the form of policies and procedures, presents demonstrations of hacking ICS and ICS protocols, and provides a status of ICS security solution field demonstrations.

Cloud Connect (Chicago, Illinois, USA, Oct 21 - 23, 2013) Cloud Connect returns to Chicago October 21-23, 2013 with an all new program built around the leading cloud platforms. Cloud Connect provides the independent guidance IT professionals need to successfully build, operate and manage the cloud, and the tools to measure application performance and business metrics.

cybergmut Technical Tuesday: Cyber Security Strategy — Why We're Losing and What's Needed to Win (Columbia, Maryland, USA, Oct 22, 2013) CrowdStrike's Steve Chabinsky of CrowdStrike explains the situation. Everybody seems to be spending more on cybersecurity, but with questionable return on investment. In fact, the problem clearly is getting worse, and current strategies show no indication of reversing that trend. This non-technical presentation explores the typical cyber risk environment, considers the proper balance and likely effectiveness of threat deterrence, vulnerability mitigation, and consequence management to reduce cyber risk, and examines the current and evolving roles of government agencies and the private sector in addressing the problem. Backed by powerful, real-world examples of threat actor tactics, this presentation will help managers develop a better understanding of how their current security approach is most likely to succeed or fail over time, and what strategies are the most likely to shift the advantage to the good guys. cybergamut is co-hosting this event with the Maryland Chapter of InfraGard.

Cyber Security Seminar and IT Expo at Peterson AFB (Colorado Springs, Colorado, USA, Oct 22, 2013) The Cyber Security Seminar and IT Expo is a one-day event held on-site where industry vendors will have the opportunity to display their products to personnel attending briefings concerning the latest updates in Cyber Security Awareness. This is an excellent and unique opportunity to meet IT personnel from USNORTHCOM, NORAD, Army Space Command, USSPACECOM, and the 21st Space Wing all in one day.

Hack.lu 2013 (Luxembourg, Oct 22 - 24, 2013) Hack.lu is an open convention/conference where people can discuss about computer security, privacy, information technology and its cultural/technical implication on society.

Joint Federal Cyber Summit 2013 (Washington, DC, USA, Oct 23 - 24, 2013) This collaborative government wide event is truly one of a kind, with speakers and attendees anticipated to represent more than 10 federal government agencies. Information sharing will be accomplished through keynote speakers on both days, along with numerous targeted breakout sessions (including a session with a federal CISSO panel), hands on live demonstrations, and industry exhibits.

NSU's 12 Simple Cybersecurity Rules For Your Small Business (Fort Lauderdale, Florida, USA, Oct 24, 2013) In this presentation twelve simple and inexpensive techniques for protecting small businesses from cyber threats will be discussed. While complex and expensive solutions exist to improve the security of information technology most of these products are not designed for the specific needs of small businesses. The techniques that will be discussed in the presentation are designed to address the most common threats encountered by small businesses without requiring significant expertise and expense. RSVP at the link.

BREAKPOINT 2013 (Melbourne, Australia, Oct 24 - 25, 2013) Over two days, 14 world-renowned speakers front Breakpoint to share their knowledge on a full range of security issues, from unpublished research to the latest trends in information security.

Ruxcon (Melbourne, Australia, Oct 26 - 27, 2013) Ruxcon is a computer security conference that aims to bring together the best and the brightest security talent within the Aus-Pacific region. The conference is a mixture of live presentations, activities and demonstrations presented by security experts from the Aus-Pacific region and invited guests from around the world. Ruxcon is widely regarded as a leading computer security conference within Australia attracting all facets of the security landscape from industry, academics, to enthusiasts.

2013 ACT–IAC Executive Leadership Conference (Williamsburg, Virginia, USA, Oct 27 - 29, 2013) Advances in technology and massive increases in data available can both challenge and transform Government mission performance. ELC-2013 focuses on how to make this transformation a reality, in and for agencies. We will hear from nationally prominent speakers and work across government and industry to learn new ideas and techniques. Four mission-oriented tracks will focus on initiatives for driving results using data and the "Innovate, Deliver, Protect and Analyze" paradigm that is at the heart of the Government's strategic vision.

FIRST Energy Symposium (Leesburg, Virginia, USA, Oct 28 - 29, 2013) Recent reports have shown that the Energy Sector has seen a large increase in the reported number of cyber attacks. The need to protect against threats and improve upon incident management has never been greater. Many control systems are already networked and are target of sophisticated attacks. Organizations will benefit from having a specialized team to work on detection and handling of cyber attacks, analyzing incidents and sharing information with other security organizations. The FIRST Symposium will focus on lessons learned from attacks and technology and sector specific security aspects. Strong emphasis will be given to organizational issues like creation and operation of incident response teams.

SAP NS2: National Security Solutions Summit (Falls Church, Virginia, USA, Oct 29, 2013) Join us for a day of learning and networking focused on how to advance U.S. national security and homeland security through I.T. innovation. Top-notch speakers will address the new challenges facing U.S. national security and critical infrastructure -- as well as powerful, affordable technologies that are available today to tackle those challenges while saving money and simplifying operations. Learn how your organization can run faster, smarter, leaner in the most secure environments -- with world-class, breakthrough solutions that are bold alternatives to business as usual.

RSA Conference Europe (Amsterdam, the Netherlands, Oct 29 - 31, 2013) Information security today isn't optional. It's business-critical. Over three days, RSA® Conference Europe 2013 imparts the must-know actions to manage growing cyber threats. With over 60 sessions spanning 10 hours, attend the educational and networking event that builds your knowledge and furthers your career.

Regional Cyber Security Forum & IT Day (CSFI) — Hawaii (Honolulu, Hawai'i, USA, Oct 30, 2013) 2013 marks the 10th anniversary of National Cyber Security Awareness Month and FBC will host the 1st Annual Cyber Security Forum & IT Day (CSFI) at Fort Shafter - Club Hale Ikena to coinside with the anniversary, and activities surrounding this month. The goal of CSFI is to raise cyber security awareness, and to promote best practices in cyber while allowing DoD personnel and industry partners the opportunity to share the most up to date remediation strategies. The event will feature four educational cyber sessions to go along with an exhibit hall..

NSA Hawaii — Cyber Security, Intelligence & IT Day (Honolulu, Hawai'i, USA, Oct 30, 2013) Be a part of the 1st Annual Cyber Security, Intelligence and IT Day set to take place at the new National Security Agency (NSA) Hawaii Rochefort facility. The event will be hosted by NS/CCS Hawaii Technology Directorate and will focus on Cyber Security, Big Data and Cloud Computing. There are other areas of interest listed below as well. This is an extremely unique opportunity to network with NSA personnel in Hawaii at their location. Educational sessions will be provided to attendees to coincide with government and industry exhibits.