Category Archives: Announcements

SANS ICS Summit & Training in Singapore

Posted on by
3

SANS Asia Pacific ICS Summit and Training 2013 – Singapore

If you have any responsibility for security of control systems – policy, engineering, governance or operations you won’t want to miss the Asia Pacific ICS Security Summit taking place 2-8 December 2013 where you will:

Learn all about the new Global ICS Professional Security Certification

Gain the most current information regarding Industrial Control System threats and learn how to best prepare to defend against them

Hear what works and what does not from peer organizations. 

Network with top individuals in the field of Industrial Control Systems security and return from the Summit with solutions you can immediately put to use in your organization. 

Listen to 15+ speakers from a variety of companies who will cover exceptional content throughout the two-day Summit.

Earn CPE credits for the summit and course you attend

 

ICS410: ICS Cyber Security Essentials, (Brand New course) – 4-8 December taught by SANS Faculty Fellow Dr. Eric Cole will provide a standardized foundational set of skills, knowledge and abilities for Industrial Cyber Security professionals. This course is designed to ensure that the workforce involved in supporting and defending Industrial Control Systems is trained to perform work in a manner that will keep the operational environment safe, secure and resilient against current and emerging cyber threats.

Agenda highlights for the summit include:

A Community Approach to Securing the Cyberspace to Enhance National Resilience

The Good, Bad and the Ugly: Certification of People, Processes and Devices 

SCADA Security Assessment Methodology: The Malaysia Experience  

The State of Critical Control System Security in Japan 

Smart Security : Strengthening Information Protection in Your ICS

 

To learn more about the Summit and Training, or register now and save 5% on your registration with code SANSICS_MSI5, please visit: http://www.sans.org/info/142537


CMHSecLunch is Monday, November 11th

Posted on by
2

Mark your calendars now!!!!

The next CMHSecLunch is Monday, November 11th at the Tuttle Mall food court! Starts at 11:30 and runs to about 1 PM.

Come out and see your old friends, make some new ones and generally have a little InfoSec FUN!!!!!!

This is even a great food court, with COFFEE and ICE CREAM!!!! Fun and dessert!!!! mmmmmmmmmm 🙂

Sign up here, or just drop by and surprise us all! 🙂 

See ya then! 

Come Out and See Us at NE Ohio Security Summit

Posted on by
5

Brent will be speaking at the NEO Security Summit again this year. He will be concluding his set of presentations on the History of Cybercrime and Toffler’s Cell Theory as its basis. TheSummit is October 24-25, 2103 in Westlake, Ohio. 

Brent speaks on Thursday at 1:15 PM in “The Champagne Room A”. (Get the thought out of your mind.. You know what Chris Rock says… NSFW…)

This is the 11th annual Summit for NEO and it has history of being a fabulous, affordable event. Come out and learn some stuff, get a ton of CPEs and re-connect with old friends. You can find out more about the event and register here. 

As always, thanks for reading and we hope to see you at the event!

UPDATE: Looks like I’ll be doing back to back sessions on Thursday at NEO Summit: 1:15 Crime History in Champagne A, 2:30 Defensive Tampering in Bordeax A. Come out and see me. That’s 2 chances in one day to get your heckle on!!!!

Operation Lockdown Update ~ Xojo Web App Security

Posted on by
Reply

Just a quick note today to bring you up to date on Operation Lockdown. As many of you may know, MSI began working with Xojo, Inc. a year or so ago, focusing on increasing the security of the web applications coded in the language and produced by their compiler. As such, we gave a talk last year at XDC in Orlando about the project and progress we had made. 

Today, I wanted to mention that we have again begun working on OpLockdown, and we remain focused on the stand-alone web applications generated by Xojo. 

Last week, Xojo released Xojo 2014R3 which contains a great many fixes from the project and our work.

The stand-alone web apps now use industry standard HTTP headers (this was true for the last couple of releases) and have the ability to do connection logging that will meet the compliance requirements for most regulatory guidelines.

Additionally, several denial-of-service conditions and non-RFC standard behaviors have been fixed since the project began.

My team will begin doing regression testing of the security issues we previously identified and will continue to seek out new vulnerabilities and other misbehaviors in the framework. We would like to extend our thanks to the folks at BKeeney Software who have been helping with the project, and to Xojo for their attention to the security issues, particularly to Greg O’Lone, who has been our attentive liaison and tech support. Together, we are focused on bringing you a better, safer and more powerful web application development platform so that you can keep making the killer apps of your dreams!

Hello from DayCon!

Posted on by
Reply

I have spent some time this week at DayCon in Dayton, Ohio. This is a small hacker conference, with attendance by invitation only. This year the event was focused on attack sources, emerging trends and new insights into the cutting edge of dealing with cyber-crime across many vertical markets and countries.

I speak later today, and I am focusing on the history of cyber-crime, the crime stream, the criminal value chain and how information coalesces before an attack. I look forward to my talk, especially given how engaged the crowd has been thus far with the other speakers. The hallway conversations have been great! 

Lots of variety in the speakers here, with professors, researchers, hackers and even some ICS/SCADA folks in attendance. Lots of good insights floating around and even a few new product ideas!

I’d highly suggest you check out DayCon next year.

PS – Also, looking at the calendar, we are prepping for DerbyCon next week. Come out and see us there. I will be speaking on the Stolen Data Impact Model (SDIM) project and other topics. Plus, as usual, we will be haunting the halls and swinging from the rafters! 🙂 See you in Louisville! 

Infosec, The World & YOU Episode 3 is Out!

Posted on by
3

Our newest episode is out, and this time we are joined by a very special guest, @TSGouge who discuss social engineering for companies and on the nation state scale. Victoria reveals her new plans to take over the world and Brent tries to keep up with these gals, who are straight up geniuses. We also pontificate on Syria and the potential for cyber-fallout from the action going on over there.

Check it out here. 

Have a global real world/cyber issue you want us to tackle? Observed an odd event that ties to a real world cause in the Internets? Drop us a line ~ we’d love to hear about it or get you on the show! 

You can find Brent on Twitter at @lbhuston and Victoria stars as @gisoboz. Get in touch! 

CMHSecLunch is Monday August 9th

Posted on by
Reply

This month’s CMHSecLunch is Monday, August 9th, 2013 at 11:30am. The location for this month is the Easton Mall food court. You can register here, or just show up. ADMISSION IS FREE!!!!!

Imagine hanging out with your infosec bestys, or meeting a new infosec connection that takes your career to the next level. Ever wondered what infosec experts eat, drink or why some of them only wear pastel shirts? This is YOUR chance to find out! 

We hope to see you there! 

Save The Date: August 12 is CMHSecLunch

Posted on by
2

Just a heads up, mainly because it seems late this month, but the next CMHSecLunch is Monday, August 12, 2013. Location is the North Market, beginning at 11:30am. 

You can find out more here, as well as sign up for reminders and such.

Thanks to all who make it out, we always enjoy seeing you and the amazing conversations that happen there! 

See You At EPRI Event in Chicago

Posted on by
3

Next Monday, June 17th, I’ll be presenting at the EPRI conference in Chicago. My topic is a threat update on what attackers are targeting and what kind of value future state designs and other research/planning data has on the attacker market. If you’re going to be at the event, please join me for my presentation. If you’d like to grab a coffee or the like, let me know. I’ll be around all day. 

Thanks for reading and I hope to see you there!