@vbisbest / h30499.www3.hp.com/t5/user/viewprofilepage/user-id/1456467

HP Fortify on Demand

Ray Kelly got his start in internet security 11 years ago with SPI Dynamics. As the lead developer of WebInspect, he helped build the product into an industry leading application scanner. After the SPI’s acquisition by HP, Ray moved on to other startups such as Purewire and Barracuda Networks where he focused on content security and mobile technologies. Currently Ray is back at HP Fortify on Demand group managing the Mobile Penetration team where mobile applications are tested for security vulnerabilities.

Man In The Front – Modifying the Android OS for Mobile Application Testing

Most penetration testers know the headaches of testing mobile applications. Challenges like certificate pinning and wondering what files are being written to the device while the app is in use. Since Android is open source, you create your own custom OS that takes the guess work out of your test. By doing this, you can monitor HTTP/HTTPS traffic, SQLLite queries, file access and more. Because this is part of the OS, you can intercept before the data is encrypted (i.e. MiTF). And this works for all apps. No need to hook, inject or rebuild each app you test.
In this talk, I will give a high level overview of the Android OS, point out key files for modifications, and demonstrate a proof on concept with a custom OS along with a monitor showing the intercepted information.

@desmondholden & @elizmmartin / www.arbornetworks.com/asert/

Arbor Networks & RedLegg
Dan Holden is the Director of ASERT, Arbor’s Security Engineering and Response Team, where he leads one of the most well respected security research organizations in the industry. His teams oversee the ATLAS global security intelligence database, and are responsible for threat landscape monitoring and Internet security research including the reverse engineering of malicious code. Dan also oversees the development and delivery of security content and countermeasures for Arbor’s industry leading DDoS technologies via the ATLAS Threat Feed (ATF) and the ATLAS Intelligence Feed (AIF) threat detection services.

Prior to Arbor, Dan was director of HP TippingPoint’s DVLabs and a founding member of IBM/ISS X-Force. While at HP TippingPoint, Dan grew the DVLab’s organization into a mature security research and development team delivering security content, intelligence portals, and reputation technology as well as overseeing both the Zero Day Initiative (ZDI) program and Pwn2Own vulnerability contest. Dan also helped build and define X-Force over the course of 12 years in various capacities ranging from development to product management. Dan has been in the security industry spanning two decades specializing in vulnerability analysis, security research, and technology incubation. Dan is a frequent speaker at major industry conferences and has been quoted and featured in many top publications, radio and television.

Elizabeth Martin is the Director of Security Services with RedLegg and is responsible for the development and delivery of the Risk Management practice. Elizabeth’s tenure includes Arthur Andersen, IBM Internet Security Systems, and Trustwave. She has 15 years’ experience in the Information Security, Compliance, and Risk Management industry and her expertise lies with assessing organizations and assisting with the development of a strategic approach to Information Security. Ms. Martin has extensive experience delivering Compliance Gap Assessments and Audits, Risk Assessments, Vulnerability Assessments, Policy Framework Development, and Solution Design and Deployments in the automotive, retail, financial, healthcare, government, and managed security services verticals. Elizabeth is active in the industry and serves as Board Member for the Cloud Security Alliance, Chicago Chapter; Coordinator for BSidesChicago; and is a founder of SecureChicago, Inc., an Illinois not for profit organization dedicated to promoting education and professional development in the security industry.

Pissing Down The Leg Of Much Of Our Careers; Why Are You People Still Buying Firewalls & IPS?

Do you recall the good ole days when you would often issue the command ‘more /etc/services’ to correlate an application to a port number? Next thing you know everyone spends a fortune on firewalls and it now seems that the majority of applications now run over just a few ports. Funny thing is now we are told we all need to buy next generation firewalls because you now need visibility into the applications that your standard firewall can’t see. Is this a solution to a problem that the firewall created in the first place? Are firewalls really providing security, or is it simply network segmentation for a network that isn’t that difficult to get onto in the first place?
The story for other traditional security technologies such as A/V and IDS/IPS can be just as perturbing. For years signatures have been lambasted as not being able to keep up with the maturing and quickly advancing threat landscape. If this is the case then why are these solutions allowed to mature into old grey veterans pushed upon us by compliance requirements and experts espousing ‘defense in depth’?
This talk will not only poke fun at these crippled and elderly network membranes but will highlight real world examples used by attackers to bypass them. The point of the talk will be to provoke thinking about a false sense of security that can come from legacy technologies or ideals, and whether these can actually be a burden rather than a solution.

@analoggirl11 / www.riskbasedsecurity.com
Risk Based Security

Inga has been involved with specialty insurance coverages since 1993 and brings a wealth of experience with all facets of risk transfer. Her focus includes the strategic management of data privacy and security exposures, with an emphasis on leveraging data-driven risk assessment to build sustainable insurance programs and product profitability. As the leader of the insurance practice group at Risk Based Security, Inga is responsible for a variety of client advisory services including identification of data security and privacy exposures, policyholder risk management support and the development and implementation of cost effective breach response solutions. As a strong advocate for sharing knowledge, Inga has presented at a variety of industry forums and has led many continuing educations sessions throughout the U.S. She currently holds a CIPP/US designation.

Cyber Insurance – Worth the Effort or Total Ripoff?

Have you ever found yourself paying premiums for years, just to be shortchanged by the insurance company when you submit a claim? It’s a common story and one that can leave the impression that an insurance policy isn’t worth much more than the paper it’s written on. But when it comes to transferring risk for a data breach event, cyber insurance can be a powerful and budget-saving tool. This session includes a discussion of how cyber insurance policies can be a benefit to both the security practitioners responsible for keeping data safe and the leaders tasked with minimizing the impact of a data breach. The session will also include an insider’s view of the real value behind this insurance and share strategies for leveraging these policies to your advantage.

@SethHanford / blogs.cisco.com/tag/trac/

Cisco

Seth Hanford manages Cisco’s TRAC team, whose members use Cisco’s expansive security intelligence resources to detect and respond to threats and generate original research on a wide array of security topics. Prior to this role, he worked for more than a decade in vulnerability and threat intelligence. Between his roles as a Security Analyst for Cisco’s vulnerability database service (IntelliShield) and as an Incident Manager on it’s Product Security Incident Response Team (PSIRT), he has reviewed and scored thousands of security vulnerabilities in a wide range of software products. In 2005 he began contributing to the Common Vulnerability Scoring System v2 working group, and in 2011 accepted a nomination to chair the special interest group tasked with developing CVSS version 3.

CVSS v3 – This One Goes to 11

Software vulnerabilities — love em or hate em, they’re crucial to your job. Likewise, you may have a love/hate relationship with vulnerability classification and severity scoring (like CVSS v2 or any number of proprietary methods). In this talk we will look at statistics and characteristics for thousands of vulnerabilities to see if we can determine what CVSS v2 did wrong, what it did right, and what we (the CVSS v3 Special Interest Group) intend to do to fix it. We will also come away with a better understanding for why systems like CVSS are important to security practitioners, even those who’d rather be popping shells than pushing off patches whose scores are “too low to care about”.

www.prevalent.net

Prevalent Networks

Prevalent Networks Managing Director Jonathan Dambrot, CISSP, works with the leading organizations in the world to help better manage third party and IT related risks. Prevalent develops Prevalent Vendor Risk Manager and provides compliance automation solutions from the cloud with its Prevalent Compliance as a Service. Jonathan received his MBA from The Pennsylvania State University and is currently Vice-Chair of the Shared Assessments Steering Committee, Chair of the SIG Committee, and sits on the Penn State Outreach Advisory Board.

Third Party Risk Management and Cybersecurity

Several recent research reports have identified that close to 80% of data breaches are caused by Third-Party Error. Additionally, The Ponemon Institute recently identified that third party error represented the largest factor in the cost of a data breach. Lastly, recent regulatory and mandate guidance has required most regulated industries to perform Vendor Risk Management as part of their security strategy. If you do not have third party risk management as part of your security strategy you potentially have a major gap in your program. This talk will discuss several use cases as well as strategies to consider in helping manage your third and fourth party risk.

@dystonica / dystoni.ca
Genesys Telecommunications

Sarah Clarke is a Senior Security Engineer at Genesys Telecommunications. She has 12 years of experience in IT, seven of which have specialized in Security. She has worked with nonprofit, government contracting, ISP, financial sector, and telecommunications organizations; currently, she is enjoying serving as application security testing and vulnerability management SME for Genesys Cloud, a global SaaS IVR and virtual call center PCI (and etc) compliant service provider.
Sarah’s passion for application security began with the Toyota break failure bug and continued with the work by Barnaby Jack and Jay Radcliffe on poor software design causing fatal error conditions in pacemakers and insulin pumps. She chooses to focus on helping teams make better software, to protect the innocent, save lives and identities.
Sarah is a member of Infraguard, holds four industry certifications, recently presented at Shmoocon Firetalks 2014, and volunteers to support the security community whenever possible.

Lessons Learned Implementing a SDLC
Developers and Quality Engineers are wonderful people who understand how to create, test, and validate features. They frequently aren’t, however, educated in school on architecting applications to prevent security failures, coding to not introduce security bugs, and testing to validate secure functionality.
The language of development – features, releases, agile – is not the same as security – XSS, CSRF, managing session state.
We have to communicate better with our developers and QEs, to inspire them to care, in their language; we have to work with senior management to identify how security fits into their needs to get buy-in and support.
This is a discussion on how that communication works best; overcoming cultural sticking points, and iterating through creating a process that creates better code without slowing down business.

@evanbooth / terminalcornucopia.com

Growing up, it was a safe bet that if an object around the house was held together with screws or contained any number of wires, Evan “treefort” Booth took it apart at some point to see what made it tick. In 4th grade, with the help of strategically placed pens, erasers, and a Pop-Tarts wrapper, Evan’s pencil box could quickly be converted into a model rocket launchpad. His Liquid Drano purchases to toilets cleaned ratio is absolutely abysmal. This never-ending supply of curiosity eventually translated into a passion for understanding computers and programming.
Having earned a degree in Digital Media — a nerdy union of design fundamentals and computer programming — from East Tennessee State University in Johnson City, Evan founded his company, Recursive Squirrel, where he has served a wide variety of clients in need of application development and consulting for nearly a decade. When he isn’t organizing 1′s and 0′s, Evan is likely off picking locks with the FALE Association of Locksport Enthusiasts, a lock picking group he co-founded in 2010.
In his most recent project, Terminal Cornucopia, Evan set out to demonstrate how difficult it would be for an attacker to construct lethal weapons in a typical airport terminal after the security screening. After successfully building an arsenal consisting of everything from simple melee weapons to reloadable firearms to a remotely-triggered incendiary suitcase, Terminal Cornucopia garnered international media attention and attracted viewers from nearly every country on the planet.
Make no mistake: the best part about buying a bulky item is, in fact, the huge cardboard box.

Evan will be presenting Terminal Cornucopia: Demystifying the Mullet

When solving difficult problems that require unorthodox thinking, it’s crucial that you remember APATHY: Acronyms Probably Aren’t That Helpful, Yo. Instead, we’ll dig into the practical side of creative problem solving by reflecting on Terminal Cornucopia — my year of building improvised weapons out of materials and items available in what is touted as one of the most “sanitized” environments designed for everyday citizens: the airport.

This talk will serve as a primer on building lethal improvised melee, projectile, explosive, and incendiary weapons. More importantly, I will share lessons learned about creativity, passion, and human potential during my year with Angus MacGyver.

Dust off your leather jacket and roll up those tube socks; we’re going to hit the ground running!

@DavidJBianco / detect-respond.blogspot.com
Mandiant (a FireEye Company)

Before coming to work as a DFIR subject matter expert at Mandiant, David spent five years helping to build an intel-driven detection & response program for a Fortune 5 company. He set detection strategies for a network of nearly 500 NSM sensors in over 160 countries and led response efforts for some of the company’s the most critical incidents, mainly involving targeted attacks. He stays active in the community, speaking and writing on the subjects of Incident Detection & Response and Threat Intelligence.

David will be presenting The Pyramid of Pain: Intel-Driven Detection & Response to Increase Your Adversary’s Cost of Operations

There’s more to good threat intelligence than lists of domains or IPs, and it’s useful for more than just finding bad actors in your environment. What if I told you that you could use threat intelligence not only to get better at detecting and responding to incidents, but also to make your attackers’ lives significantly more difficult, to drive up the costs of their operations and to potentially make it so expensive to operate against you that they give up? Sound too good to be true?
In this talk, I’ll cover a practical, proven framework for applying threat intel to incident detection and response. The framework’s centerpiece is the Pyramid of Pain. The result of nearly 5 years experience directing the global detection program for a Fortune 5 company, the Pyramid is a blueprint for turning your incident response capability into an offensive weapon to cause pain for your attackers.