Thursday, January 18, 2018
Home Tags Information Security Conference

Tag: Information Security Conference

The 25th anniversary edition of the annual RSA Conference was held from Feb. 29 to March 4 in San Francisco's Moscone Center, showcasing the best and the worst that the security world has to offer, ranging from new products (check out eWEEK's slide sho...
IDG.TV | Mar 8, 2016 At the 2016 RSA Conference, CSO talked with John Grimm and Peter Galvin from Thales e-Security about their latest data encryption report.

The big trends: More companies are moving sensitive data to the cloud, but a lot of organizat...
Ecryption, bug bounties and threat intel dominated the mindshare of the cybersecurity hive mind at RSAC last week. SAN FRANCISCO, CALIF. – RSA Conference 2016 -- With one of the biggest crowds ever to hit Moscone for RSA Conference USA, the gathering last week of 40,000 security professionals and vendors was like a convergence of water cooler chatterboxes from across the entire infosec world. Whether at scheduled talks, in bustling hallways or cocktail hours at the bars nearby, a number of definite themes wound their way through discussions all week. Here's what kept the conversations flowing. Encryption Backdoors The topic of government-urged encryption backdoors was already promising to be a big topic at the show, but the FBI-Apple bombshell ensured that this was THE topic of RSAC 2016.

According to Bromium, a survey taken of attendees showed that 86% of respondents sided with Apple in this debate, so much of the chatter was 100 different ways of explaining the inadvisability of the FBI's mandate. One of the most colorful quotes came from Michael Chertoff, former head of U.S.

Department of Homeland Security: "Once you’ve created code that’s potentially compromising, it’s like a bacteriological weapon. You’re always afraid of it getting out of the lab.” Bug Bounties In spite of the dark cast the backdoor issue set over the Federal government's relations with the cybersecurity industry, there was plenty of evidence of positive public-private cooperation.

Exhibit A: the "Hack the Pentagon" bug bounty program announced by the DoD in conjunction with Defense Secretary Ash Carter's appearance at the show. While bug bounty programs are hardly a new thing, the announcement of the program shows how completely these programs have become mainstream best practices. "There are lots of companies who do this,” Carter said in a town hall session with Ted Schlein, general partner at Kleiner Perkins Caufield & Byers. “It’s a way of kind of crowdsourcing the expertise and having access to good people and not bad people. You’d much rather find vulnerabilities in your networks that way than in the other way, with a compromise or shutdown.” Threat Intel There was no lack of vendors hyping new threat intelligence capabilities at this show, but as with many hot security product categories threat intel is suffering a bit as the victim of its own success.

The marketing machine is in full gear now pimping out threat intel capabilities for any feature even remotely looking like it; one vendor lamented to me off the record, "most threat intel these days is not even close to being real intelligence." In short, threat intel demonstrated at the show that it was reaching the peak of the classic hype cycle pattern. RSAC attendees had some great evidence of that hanging around their necks. Just a month after the very public dismantling of Norse Corp., the show's badge holder necklaces still bore the self-proclaimed threat intelligence vendor's logos.

But as Robert Lee, CEO of Dragos Security, capably explained over a month ago in the Norse fallout, this kind of failure (and additional disillusionment from customers led astray by the marketing hype) is not necessarily a knock on the credibility of threat intel as a whole.
It is just a matter of people playing fast and loose with the product category itself. "Simply put, they were interpreting data as intelligence," Lee said. "There is a huge difference between data, information, and intelligence.
So while they may have billed themselves as significant players in the threat intelligence community they were never really accepted by the community, or participating in it, by most leading analysts and companies.

Therefore, they aren’t a bellwether of the threat intelligence industry." Related Content: Find out more about security threats at Interop 2016, May 2-6, at the Mandalay Bay Convention Center, Las Vegas. Register today and receive an early bird discount of $200. Ericka Chickowski specializes in coverage of information technology and business innovation.
She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio More Insights
Always check the headers Storage drive biz Seagate is lousy at keeping its own data safe: it accidentally handed over the crown jewels of its employees' private information to persons unknown. A Seagate employee was fooled by an email that masqueraded as an internal memo from the CEO: the message requested people's W-2 forms, and the worker duly handed over the paperwork to fraudsters thinking the request was legit. The forms include colleagues' social security numbers, income figures, work and home addresses, and other data useful to identity thieves.

Anyone who worked at Seagate at any point in 2015 will have had their details leaked. "On March 1, 2016, Seagate Technology learned that the 2015 W-2 tax form information for current and former US-based employees was sent to an unauthorized third party in response to a phishing email scam," the biz said in a statement to The Reg. "At this point we have no information to suggest that employee data has been misused, but caution and vigilance are in order. We deeply regret this mistake and we offer our sincerest apologies to everyone affected." Seagate has informed the IRS, America's taxmen, about the scam, and the FBI has launched an investigation.
In the meantime, the tax authorities will be scrutinizing returns from Seagate employees more carefully this year, and the firm has given staff two years of credit fraud protection. This is the busiest time of the year for Americans and their tax affairs, both legitimate and illegitimate, and last week something similar happened to Snapchat.

The fear is that with this information scammers can file false tax records impersonating employees and funnel refunds into the crooks' bank accounts. Seagate can, at least, take comfort in the fact that it's better at this stuff than the actual IRS.

Earlier this month, the tax agency was forced to admit it let slip up to 700,000 tax forms thanks to flaws in its electronic filing system. Seagate's woes do, however, show the importance of checking the details on emails to avoid getting phished.

Too many people are still getting caught out by official-looking emails and not double checking when sending out sensitive info. Public-key encryption cofounder Whitfield Diffie put it best last week at the RSA conference when he was asked what his first reaction was when he was emailed to say he'd won the Turing Prize – the tech industry's Nobel Prize. "I spent a long time checking the email headers very, very carefully," he joked. ® Sponsored: Addressing data governance requirements in a dispersed data environment
IDG.TV | Mar 7, 2016 At the 2016 RSA Conference, CSO's Steve Ragan chats with Chris Wyospal, co-founder and CTO of Veracode, about the importance of liability insurance for companies that may be affected by data breaches. Similar Sec...
IDG.TV | Mar 7, 2016 At RSA Conference, we catch up with Markus Jakobsson, Founder and CTO of ZapFraud, about the latest trends in consumer and enterprise scams (phishing schemes), including the very successful "email from the CEO" trick. Similar Secu...
The cyber attacks of the future may be hard to spot, and nations may fight over fiber. In recent weeks, the digital security discussion has been focused on a certain fruit-flavored company's public battle with a three-letter agency.

But Kaspersky Principal Security Analyst Vicente Diaz is considering the far larger, and far more complicated, fights that nations might carry on in the digital world. You Don't Need StuxnetIn his presentation at RSA, Diaz made a distinction between three kinds of attacks.

The first were exotic attacks, developed and deployed at great expense by nation states.

Think Stuxnet, the complex malware allegedly developed by the U.S. and Israel to physically disable Iranian nuclear enrichment machinery. The second were so-called "middle-class" attacks, which are assembled by knowledgeable teams of hackers.

The third category encompassed all other attacks, usually carried out by individuals with little to no technical knowledge, who purchase malicious payloads and delivery mechanisms from the digital black market.The problem with complicated nation-state campaigns like Stuxnet is that they make attribution easier. When it comes to determining who is capable of developing and deploying such an attack, "the list of countries is very short," said Diaz. In the future, Diaz predicted that nation states will move away from exotic attacks and focus on middle-class attacks that are as simple and stealth as possible. "Now you don't need to develop Stuxnet-like malware just to attack," said Diaz. "Ukraine was attacked by BlackEnergy, which is not in the same league as Stuxnet." The key is obtaining the physical and digital infrastructure, like the cable that connects the global Internet. "It's good for cyber espionage but also good for attacking an adversary," said Diaz. "You can use it in an offensive way, or you can use it to get information from the people who are using this infrastructure." As an example, Diaz said that if you control the Internet infrastructure, you can simply snatch passing data rather than having to target specific devices.This approach sounds similar to the one used by the NSA in its massive data collection operations exposed by Edward Snowden, which used the position of the United States Internet infrastructure to intercept data traveling around the world. The Fight for Digital TerritoryDiaz believes that the importance of Internet infrastructure will spark conflict between nations. "Control over physical infrastructure is where the next big battles will happen," he said. He pointed to efforts made by Brazil to construct its own trans-Atlantic Internet connection and efforts within Europe to foster the development of Internet business and infrastructure within national borders. Conflicts over control of the Internet could take many forms, and need not be offensive.
Instead, countries might form alliances to create spheres of influence over the Internet.

For example, Diaz pointed to a diplomatic agreement between the U.S. and China, where the two countries agreed not engage in cyber attacks for financial gain. Diaz said this agreement was an example of one such alliance, and hinted that it would have wide-ranging consequences. "Obviously these alleged attacks will probably move to some other country because they still need to get this data," he said. Digital resources are already playing a role in warfare and politics.

This week saw confirmation from the Department of Defense that the U.S. was bringing cyber capabilities to bear against ISIS.

Also speaking at the RSA conference, Secretary of Defense Ashton Carter declined to go into specifics about these operations, but said they were focused on disrupting ISIS's command and communications capabilities. What Diaz is describing is more like the groundwork for larger operations.
It's also a shift in how diplomacy, as well as warfare, will be carried out since the fiber traveling through a stretch of land (or ocean) may be as a valuable as the land, its people, or its resources to a nation state developing its cyber capabilities. But perhaps the most important point is Diaz's prediction that attacks will simplify, rather than increase, in complexity.
If Diaz is correct, then the kind of cyber attack that worries NSA Director Rogers might be indistinguishable from the everyday work of a hacker and nearly impossible to spot.
IDG.TV | Mar 7, 2016 At the 2016 RSA Conference, CSO chats with Grayson Milbourne of Webroot, about the latest malware trends it saw from its customer base, including the growing importance of polymorphic malware and the flaws in signature-based detect...
IDG.TV | Mar 7, 2016 At the 2016 RSA Conference, CSO's Steve Ragan chats with Joseph Opacki from PhishLabs about how cyber-criminals are becoming increasingly smarter about targeting specific high-end business users to try and steal data or money. Sim...
IDG.TV | Mar 7, 2016 At the 2016 RSA Conference in San Francisco, CSO chats with SecureAuth about their behavioral biometrics technology, which allows or prevents access depending on a person's keystroke and mousing techniques.

Could this method replac...
IDG.TV | Mar 7, 2016 At the 2016 RSA Conference, CSO chats with Uri Rivner from BioCatch about how behavioral biometrics will improve authentication methods, not just at login but during an entire web- or tablet-based session. Similar ...
NEWS ANALYSIS: Multiple speakers at the RSA conference said developers alone are not to blame for the current state of cyber-security in which threats evolve faster than the defenses. SAN FRANCISCO—It's the best of times and the worst of times to be a software developer.

There are lots of jobs and business opportunities for developers, but thousands of new applications reach the market each day with inadequate attention to built-in security flaws.Cloud computing, containers, new programming languages and continuous integration and delivery tools are changing the game and enabling developers to create new types of applications and reach new levels of agility.

Despite all the opportunity, there's one area in which developers can't catch a break—security.Here at the RSA Conference this week there was a lot of talk about Apple vs. the FBI and the coming security market consolidation.

Dig a little deeper and the real issues confronting enterprise CIOs and security managers include the never-ending stream of insecure applications being put into production from vendors as well as corporate developers.For enterprise developers, this is not necessarily their fault.

They are facing, in geek speak, the Kobayashi Maru Star Trek command test scenario: They can't win.

Either they push out apps quickly and insecurely, or slowly but more securely.
Security processes and agile development methodologies require their own schedules and resources. To that point, a new survey from CloudPassage found that 50 per cent of security professionals don't believe security is capable of moving as fast as app release cycles; 65 percent said a lack of resources and organizational siloes are the main barriers to security getting into release cycles earlier. Businesses, seeing great opportunities in increasing developer productivity, are pushing developers to get apps out as fast as possible.
Sometimes, security best practices are being ignored. More often, they are merely being put off until later.
Software producers will wait to work on security until hackers find the product's weak spots.

This symptom is already pervasive in the Internet of things.

Experts who monitor and test application security call this "security debt."Which kinds of applications are the ones causing the most problems?"New ones.

That's the reality," said Amichai Shulman, CTO of Web application firewall vendor Imperva. "There are not bad programmers or bad languages.
It's mostly those apps that have very tight schedules—a very fast time to market—that are the most vulnerable. No one has enough time to weed out vulnerabilities and write secure code."The biggest code culprit for security these days are APIs for mobile apps and server-side controls.

Companies are creating mobile versions of their legacy applications and in the process generating security bugs. "Companies say let's go mobile, they mobilize the apps and they end up with APIs that are vulnerable," he said.Again, business imperatives are not necessarily the developer's fault. Nor do security flaws occur because student developers are not getting enough training on writing secure code and preventing exploits like SQL injection and cross-site scripting.It's also a simple numbers problem.
IT industry research shows that over the next few years millions of cyber-security jobs will go unfilled.