RSA
Peter Andrious – Manager, Systems Engineering
Chad Loeven – Technical Specialist
Jack Estep – Field Operations Manager

Topic:

Implementing Lessons Learned From Being Breached

RSA will present Advanced Incident Response. The presentation will focus on the process, how that ties the many Security Technologies (Controls) together and how that allows us to drastically cut down on the investigative time, critical in an incident. RSA will review their organization pre-breach and post-breach to show how they applied their lessons learned. They will wrap up with a technical demo on host forensics inspection and memory analysis.

Bio:

Chris Astacio is a Manager for Security Research at Websense Security Labs, the team within Websense that ensures that our 65 million customers are protected against all type of web and email based threats. Chris is a specialist in javascript obfuscation and has done extensive research into web exploit kits, the most prevalent threat on the web used to compromise computers around the world.

Topic:

Evolution of the BlackHole Exploit Kit and Platform Agnostic Mobile Threats

Chris Astacio will cover two topics:

• The BlackHole exploit kit is hugely successful — arguably the most successful exploit kit in history. Chris will discuss how BlackHole has evolved since it was first identified, and explore why its developers have been so successful. He will also outline the innovations and enhancements that have contributed to the kit’s success over the years.
• Threats to mobile devices are less widespread than those targeting desktops and laptops. But as platform-agnostic exploits start to appear more frequently, will mobile threats increase? Chris will examine the possibility of mass mobile attacks, using tools like BlackHole, and discuss what vectors could be used to evolve these attacks.

Bio:

Until recently Anup Ghosh was also Research Professor and Chief Scientist in the Center for Secure Information Systems (CSIS) at George Mason University. He was previously Senior Scientist and Program Manager in the Advanced Technology Office of the Defense Advanced Research Projects Agency (DARPA) where he managed an extensive portfolio in information assurance and information operations programs. He previously held a role as Vice President of Research at Cigital, Inc. In his career he has served as principal investigator on contracts from DARPA, NSA, and NIST’s Advanced Technology Program and has written more than 40 peer-reviewed conference and journal articles. He was awarded the NSA’s Frank Rowlett Trophy for Individual Contributions in 2005 and the Secretary of Defense Medal for Exceptional Public Service for his contributions while at DARPA. Anup was named to the Naval Studies Board for a National Academies Study in 2008 on Information Assurance for Network-Centric Naval Forces and currently sits on a number of advisory boards informing the future of American cyber-defenses.

Topic:

Addressing User Targeted Attacks At The Endpoint - Killing Apts And 0Days With Behavioral Based Detection.

Your organization is under a state of constant and sustained attack, and every employee represents a potential point of weakness in your security strategy. Innovation in endpoint security is a critical need. New approaches to insulate the employee against these attacks are required. Today's most successful and common attack vector is to spear-phish your employees with email containing links to malicious sites and weaponized attachments. The adversary is getting onto your networks by tricking your employees into becoming accomplices to network breach every time they click on a link in a spear-phish or open its attachments.

The techniques used by your adversaries include:

• Spear-phishing emails that deliver the employee to malicious websites that run drive-by download exploits or include weaponized document attachments
• Hijacking legitimate trusted sites to push malware to unsuspecting users
• Poisoning search results behind trending news items on popular engines, such as Google, Yahoo!, and Bing
• Pushing malware through popular social networks such as Twitter and Facebook

This presentation will focus on new approaches, without the need of signatures or lists, to fight against Zero Day Attacks.

Bio:

John Dickson is a Principal at Denim Group, Ltd, a 20-year career security professional, an entrepreneur, and a serial volunteer. John is Past President and Founder of the Alamo Chapter of the ISSA, which won the Chapter of the Year award in 2011. John’s background includes hands-on experience with network security, intrusion detection systems and software security. He helps Chief Security Officers of Fortune 500 and federal organizations launch software initiatives. He is currently the honorary commander of the 67th Network Warfare Wing, which organizes, trains and equips cyberspace forces to conduct network defense, attack and exploitation.

John has a strong history of non-profit leadership outside the ISSA and security worlds. In addition to being a full-time security professional and running Denim Group, John is currently President Elect of the Texas Lyceum, a statewide leadership group which includes well-known alumni such as President George W. Bush and Governor Rick Perry. He is also a Past Chairman of the North San Antonio Chamber of Commerce, and past Chairman of the San Antonio Technology Accelerator Initiative, a community-wide advocating technology businesses in the region.

Topic:

Software Security for the 99%: Realistic Approaches

Industry conferences and professional literature give examples of successful software security programs, but those examples are usually of the largest, most security-conscious companies in the marketplace. These Wall Street banks and independent software vendors, such as Microsoft and Adobe, have mature software security programs that have been in place for years and have driven best practices for developing more secure code. Benchmarking tools capture successes of these companies, but leave most organizations wondering, “What about us? How can we build a software security program on a limited budget, with little resources?” Unfortunately, the state of software security outside these top companies is vastly different. In many organizations, software security champions still struggle to justify resources and head count, and find themselves substantially behind their more sophisticated companies. What can a security leader reasonably do to build a successful software security program in the small enterprise or upper mid-market space? What can they do to build more secure code when regulatory scrutiny or the publicity of product breaches is not yet a business consideration? This presentation will represent what these companies are doing, and what one can do to define success.