Krypt3ia – Attribution Shmatribution! FIX YOUR SHIT!
APT, Cyberwar, ANONYMOUS, ACTIVE DEFENSE! All things you will hear along with the word “Attribution” but what is the point of attribution anyway? Are you going to hack back? Will you really be able to tell who really hacked you anyway? This talk is a cry for sanity in a world where the new hotness is attributing who attacked you even though the damage has already been done. In this presentation I will go beyond attribution of who did what to whom and show you methods to use the WHO to perform a 360 degree assessment of WHY you were attacked and HOW it was successfully carried out.
This talk will discuss common techniques of OSINT, Psychology, Sociology, Forensics, Asset Classification, and other INFOSEC standard practices within a framework for securing your environment in a more holistic manner while using salty language and imagery.
BIO: Krypt3ia is a Whiskey loving INFOSEC refugee and infamous crabby old bastard.
Ed Bellis and Michael Roytman - Vulnerability & Exploit Trends: A Deep Look Inside The Data
While the past isn’t a direct indication of future performance, knowing the past is essential to predicting the future. In security, this requires reviewing large quantities of vulnerability, defect and exploit data to fully understand how attackers are likely to approach their task.
While there have been many annual reports on the vulnerabilities produced by individual tools, this view can be myopic based on the focus of that particular product: Network, Database, Operating System, Dynamic Application, Source code, etc. It is impossible to get a full picture and how the different components relate.
This talk is a comprehensive look into a data set that spans all of these. Instead of examining a single tool, this talk represents the aggregation of data from 20 of the leading security tools on the market and a thorough review of the data they generate. First, we examine the overlapping data generated from the aforementioned tools. Next, we will compare and contrast it with the output of multiple breach reports and databases, and extract trends that may be important in helping us reduce the number of breaches in the future. The corpus of this research is from over 30,000,000 vulnerabilities analyzed from the past 12 months, generated from across some of the largest corporations in the world.
BIOS:
Michael is responsible for building out Risk I/O’s predictive analytics functionality. He formerly worked in fraud detection in the finance industry, and holds an MS in Operations Research from Georgia Tech. In his spare time he tinkers on everything from bikes to speakers to cars, and works on his pet project: outfitting food trucks with GPS.
Ed is the CoFounder of Risk I/O a vulnerability intelligence Software as a Service that centralizes, correlates and automates the entire stack of security vulnerabilities and remediation workflow. Ed has over 20 years of experience in information security and technology. He is a frequent speaker at information security events across North America and Europe. Additionally, Ed is a contributing author to the book Beautiful Security by O’Reilly and a blogger on CSO Online.
Mark Kita – Popping the Penguin: An Introduction to the Principles of Linux Persistence
Breaking in is half the battle. I’ve talked to so many people whose only objective is to try and break into systems. I get that. It’s awesome, the rush you get when you bring up that shell. But what then? Ops hardening does not end at the outer shell. Once you’re in, you still have to navigate the maze of files, directories, and permissions that is the Linux file system. This talk will cover discovering services, utilizing simple and moderate netcat commands, combining netcat with crontab to create access windows, utilizing /dev/tcp to create a reverse shell, obfuscation to avoid IDS/IPS, and providing examples of tools at each step of the way. Some Linux experience needed. If breaking in is half the battle, staying in wins the war.
BIO: Mark Kikta is a Security Consultant with VioPoint which is located in Auburn Hills, Michigan. Mark supports a variety of operational security programs that includes vulnerability management security monitoring and incident response. As a former Linux engineer with Secure-24, Mark tries to provide information he wishes he had known when he was starting to work with Linux in the realms of security.
Andrew Hay - Techniques for Escaping the AppSec Labyrinth
BIO: Andrew Hay is the Director of Applied Security Research at CloudPassage, Inc. where he leads the security research efforts for the company. Prior to joining CloudPassage, Andrew served as a Senior Security Analyst for 451 Research’s Enterprise Security Practice (ESP) providing technology vendors, private equity firms, venture capitalists and end users with strategic advisory services. He is a veteran strategist with more than a decade of experience related to endpoint, network and security management across various product sectors.
Christopher Elisan – Malware Automation
Automation is key when it comes to production. The same is true for malware. Malware production has moved on from the traditional manual method to a more efficient automated assembly line. In this talk, I will take the audience on an over-the-shoulder look at how attackers automate malware production. Discussion will focus on the tools and methodologies the attackers use to produce thousands of malware on a daily basis. The talk will then conclude with a live demonstration of how malware is produced in an automated fashion.
BIO: Christopher Elisan is the author of “Malware, Rootkits and Botnets: A Beginner’s Guide.” Elisan is a seasoned reverse engineer and malware researcher. He is currently the Prinicipal Malware Scientist at RSA. Elisan is one of the pioneers of Trend Micro’s TrendLabs where he held multiple technical and managerial positions. After Trend, he led and established F-Secure’s Asia R&D where he spearheaded multiple security research projects. He then joined Damballa where he specialized in malware research, analysis and reversing. He frequently speaks at various security conferences across the US and provides expert opinion about malware, botnets and advance persistent threats for leading industry and mainstream publications.
Eve Adams - Hack the Hustle! Career Strategies for Information Security Professionals
While information security is widely considered a negative-unemployment industry (it’s actually closer to 3%), most of us will look for a job at some point. Seasoned technical recruiter Eve Adams (@HackerHuntress) provides infosec-specific insight on writing resumes that attract the kind of attention you want, getting short-listed for cool positions before they’re even posted, strategically riding infosec employment trends, and how to most effectively work with those delightful recruiters. This talk will have something for those just entering the workforce, mid-career security professionals, and former VAX hackers alike!
BIO: Eve Adams (@HackerHuntress) is Senior Talent Acquisition Expert at Halock Security Labs, an information security advisory in Schaumburg, IL. Eve leverages three years of security staffing experience to recruit for both internal Halock roles and clients. She also spearheads Halock’s social media presence and counts Twitter as one of her most powerful recruiting tools. She’s passionate about information security, thinks most recruiters do it wrong, and naively believes technology can change the world for the better. In past lives, she has been a writer, translator and reptile specialist, among other things. While officially OS-agnostic, she runs Ubuntu 12.04 at home.
James Costello - Network Survival WCS
Imagine you have just started a new job and been handed a new (to you) desktop. It’s running Windows 7 and you have no local admin rights. Your new boss has challenged you to find out as much information about the network in the next 45 minutes without downloading any tools. What do you do? What do you do?
BIO: James Costello is the Director of Engineering for Armada Data Solutions, a services consultancy specializing in network enhacement. He has more than 13 years experience with various aspects of security. He holds a BA from the University of Saint Mary and in his free time enjoys reading scifi, watching British television and repurposing electronic devices.
Javvad Malik - How embracing social media helped me stop the hackers, save the world and get the girl!
I used to be a security professional, but even my boss didn’t remember my name. My brilliant ideas weren’t listened to, I was never invited to speak at conferences and not even my mother visited my blog. In this talk I will take you down a journey of self-discovery that took me 3 years and went from another faceless security dude, to being slightly less faceless. What worked, what didn’t work and all the behind-the-curtain magic exposed. If you’re interested in carving out your own space, making your voice heard amongst the 100′s of security ‘rockstars’ and dinosaurs who get all the attention – this is the talk for you to attend.
BIO:
Javvad Malik is a Senior Analyst in the 451 Enterprise Security Practice, providing in-depth, timely perspective on the state of enterprise security and emerging trends. Prior to joining 451 Research, he was an independent security consultant, with a career spanning 12+ years working for companies including NatWest Group, Royal Bank of Scotland Group, Halifax Treasury Services, Tesco Bank, Lloyds Banking Group and BP. Javvad is an active blogger and video blogger who was named, “The most entertaining blogger” at RSA Social awards 2013 and winning “The most entertaining blogger” and “Best video blogger” awards at the European blogger awards 2013.
Chris Mills - Information Sharing, or “I’ve got 99 problems and they’re probably pretty similar to yours”
BIO: Chris Mills manages the incident response team for a large financial services company. He also co-hosts the SecuraBit Podcast. He is active in his sector’s information sharing programs and encourages others to participate.
Katie Rodzon – Diamonds, Fitness and Cults: Manipulation for Fun and Profit
Why is the diamond a sign of love and devotion? Why do baseball players always step over the first base line? The history behind these questions are examples of how small manipulations can make changes in the behavior of millions. Kati Rodzon uses her background in behavioral science to demonstrate how easy it is to social engineer your own behavior as well as those around you. Want your dog to fetch you a beer? How about get your friend to think that he has to stand up and point his remote at the wall before the TV will turn on? Done. Changing behavior is easier that you might think. Get ready to learn some history and social engineer your way into anything.
BIO: Katrina Rodzon has spent the last 9 years studying ways to modify human behavior and is the lead behavioral scientist at MAD Security in her role of Manager of Security Behavior Design. From learning about the power of social pressure on groups to analyzing the ability of contingencies – reinforcement and punishment – to change behavior, Kati has spent the better part of a decade learning how humans work and now applies that to security awareness. When she is not measuring an organizations culture and making a customized behavior modification plan, she helps with everything from curriculum development to creating effective social engineering tools and testing scenarios for MAD’s penetration testing team.
Grecs - EC2 or Bust – How to Build Your Own Pen Testing Lab in Amazon EC2
Interested in building your own pen test training lab but lack the hardware or software to roll your own? One option is to go the way that most companies are doing these days and build your own “infrastructure” in the cloud. Not only do you get the cloud benefits of only paying what you use and the ability to expand when needed but you also get a range of licensed victim servers to choose from. This talk covers the basics of Amazon’s EC2 cloud infrastructure (e.g., EC2, VPC, basic network and routing, Elastic IPs, Security Groups, VPNs, and Snapshots) and step-by-step instructions on configuring this infrastrucutre to build your own isolated test network complete with licensed victim servers or customized AMIs.
BIO: Grecs has over 17 years experience, undergraduate and graduate engineering degrees, and a really well known security certification. Despite his formal training, grecs has always been more of a CS person at heart going back to his VIC-20, Commodore 64, and high school computer club days. After doing the IT grind for five years, he discovered his love of infosec and has been pursuing this career since. Currently, he spends his days doing cybersecurity paperwork drills in building multi-billion dollar government systems. At night he runs a local infosec website and tries to get some hands-on skillz.
Beau Woods and Taylor Banks – GTFO FTW: Hacking Your Lifestyle for Fun and Profit
“See the world. Meet interesting people. Hack the planet.”
You don’t have to join the military or the Peace Corps. Just be ready, able and enthusiastic to DROP TABLE status_quo;– There’s nothing stopping you from living your dream except a little bit of information and that first step. Hack Java from Java, Indonesia. Drop O’Day from a Dublin pub. Run Kali from Cali, Colombia. Beau and Taylor want to engage the BSidesLV attendees with stories of our WINS and FAILS. We want to hear your stories and inspire you to live your dreams as we are doing. We’ll tell you what’s worked for us and give ideas for what might work for you. We’ll pay cab fare for anybody who heads straight to the airport to GTFO FTW!
BIO: Traveled the globe? Achievement unlocked. The two have visited over 50 countries between them in the last decade. They’ve turned their hobbies into lifestyles, traveling the world and playing in Infosec.
The founder of ACEHackware.com, Taylor is busy establishing a shadow empire in Costa Rica, from which he occasionally advises clients out of a luxurious single-room hut overlooking the Pacific.
Officially itinerant, Beau has spent the last 18 months traveling, settling in Armenia, London and S. Korea at times. Traditional consulting and advisory work, as well as writing books and some Internet ventures have kept the travel binge going.
Jack Daniel - The Erudite Inebriate’s Guide to Life, Liberty, and the Purfuit of Happinefs
It is possible to eat healthy foods, moderate (or even eliminate) alcohol consumption, and exercise- both at home and while traveling. But life is too short for that nonsense, so let’s enjoy ourselves; if you’re worried about shortening your life with food and drink you clearly have too much to live for.
This talk is about exploration and discovery, but in generally low-risk situations- no pith helmet required (but if you can rock one, I say go for it).
The presentation begins with an introduction to classic (and no-so-classic) drinks, starting with an exploration of bitters- those magical elixirs which have evolved from impotent herbal remedies to potent flavoring agents. I’ll explore the history, evolution, and popularity boom of bitters, and delve into making your own bitters. The discussion of bitters leads into their use in drinks both tame and wild, and their role in the revival of the cocktail scene- including a few suggestions for drinks both alcoholic and not.
The ensuing quest for proper cocktails leads us out of our hotel bar, and into more interesting venues where good drink leads to good conversation, which leads to learning more about drinks- and also leads to local knowledge. Local knowledge leads to more entries in the ever-evolving Erudite Inebriate’s own Traveler’s Survival Guide. This phase of our journey includes discussions of how to find the good stuff, how to have a socially-acceptable amount of fun, and how to stay somewhat safe while doing it. I will close by delivering a short “Business Traveler’s Survival Guide to Las Vegas” as an example of these ideas.
BIO: Jack Daniel, Technical Product Manager at Tenable, has over 20 years experience in network and system administration and security, and has worked in a variety of practitioner and management positions. Jack is a sporadic blogger at his Uncommon Sense Security and Travels with Jack blogs, a Security BSides co-founder, InfoSec Curmudgeon, Very Reluctant CISSP, Amateur Blacksmith, and BS Artiste Extraordinaire. Often found on barstools during his frequent travels, Jack’s views on drink and travel have developed, evolved, and merged with the help of many a bartender- his ideas coming into focus as the rest of the world blurred around him.
Tod Beardsley and Thomas d’Otreppe – The Slings and Arrows of Open Source Security
Creating and distributing useful software requires significant intellectual, emotional, temporal, and financial resources. Security software tends to require some level of operational security around vulnerability disclosures, and often carries some unique ethical and legal implications. On top of all this, “open source” often means there is no paycheck at the end of the week for programming effort. Why go to all the trouble? Why do some open source security projects succeed while many others fail? What does success even mean for open source?
This talk by Thomas d’Otreppe (Aircrack-NG project lead) and Tod Beardsley (Metasploit engineering manager) will explore the unique challenges (and rewards!) faced by open source security projects. They will discuss strategies to keep projects and contributors on track, provide resources that make the life of an open source developer more productive and rewarding, and offer their unique insight into open source security development. Participants in this talk will come away with the tools and knowledge needed to launch a new open source security project or more effectively contribute to an existing one.
BIOS: Tod Beardsley is the Engineering Manager for the Metasploit Project, the world-renowned open source penetration testing platform. He has over twenty years of hands-on security knowledge, reaching back to the halcyon days of 2400 baud textfile BBSes and in-band telephony switching. Since then, he has held IT Ops and IT Security positions in large footprint organizations such as 3Com, Dell,and Westinghouse. Today, he is passionate (some might say militant) about open source software development, open source security research, and data liberation, and can often be found on Freenode IRC as “todb.”
Thomas d’Otreppe “Mister X” is a wifi hacker and the author of Aircrack-ng, a Wi-Fi auditing suite and OpenWIPS-ng, an open source modular wireless IPS. He has designed Offensive-Security WiFu, a proactive wireless security course, with Mati Aharoni and also contributed to BackTrack Linux. He works as a software developer for Main Nerve.
Josh Sokol - Convincing Your Management
As security professionals, almost every action we take comes down to making a risk-based decision. Web application vulnerabilities, malware infections, physical vulnerabilities, and much more all boils down to some combination of the likelihood of an event happening and the impact of that event. Risk management is a relatively simple concept to grasp, but the place where many practitioners fall down is in the tool set. The lucky security professionals work for companies who can afford expensive GRC tools to aide in managing risk. The unlucky majority out there usually end up spending countless hours managing risk via spreadsheets. It’s cumbersome, time consuming, and just plain sucks. After starting a Risk Management program from scratch at a $1B/yr company, I ran into these same barriers and where budget wouldn’t let me go down the GRC route, I finally decided to do something about it. At BSides Las Vegas 2013, I would like to formally debut SimpleRisk, a simple and free tool to perform risk management activities. Based entirely on open source technologies and sporting a Mozilla Public License 2.0, a SimpleRisk instance can be stood up in minutes and instantly provides the security professional with the ability to submit risks, plan mitigations, facilitate management reviews, prioritize for project planning, and track regular reviews. It is highly configurable and includes dynamic reporting and the ability to tweak risk formulas on the fly. It is under active development with new features being added all the time and can be downloaded for free or demoed at http://www.simplerisk.org. With a simple, powerful, and cost-effective tool and some basic risk management knowledge at your disposal, you too can become the security rock star that your business seeks out for risk-based decision making. Let me show you how to convince your management, your peers, and yourself that Risk Management doesn’t suck.
BIO: Josh Sokol, CISSP, graduated from the University of Texas at Austin with a BS in Computer Science in 2002. Since that time, he has worked for several large companies including AMD and BearingPoint, spent some time as a military contractor, and is currently employed as the Information Security Program Owner at National Instruments. In his current role, Josh manages all compliance, security architecture, risk management, and vulnerability management activities for NI. Josh holds a CISSP certification and has spoken on dozens of security topics including the much hyped “HTTPSCan Byte Me” talk at BlackHat 2010.
Fak3r - What if Petraeus was a hacker? Email privacy for the rest of us.
Almost every day there are new revelations about violations of user’s online privacy. Usually these infractions are for the monetary gain of an online entity, but at other times it can be part of censorship, a surveillance state or even a government breaking the law when accessing such data. With email being so personal, webmail (which is generally hosted free of charge by for-profit providers) is a particularly vulnerable space where people are not doing enough to protect online privacy. When a highly decorated four-star general is brought down because he couldn’t secure his online webmail, what hope do we have in terms of guaranteeing our own online privacy? The Electronic Communications Privacy Act of 1986 states that after 6 months, email messages lose their status as protected communication and no longer requires a warrant, only a subpoena, for a government agency to force email providers to produce copies of user’s data. Online privacy is a right we have taken too lightly. Attendees of this talk will learn real world techniques that will enable them to make educated decisions about how to properly protect their webmail.
Generally, you have little email privacy with US-based email services, so we will focus on offshore hosting where laws better regulate your data protection and online privacy. A survey of current options, with details from the speaker’s own trials of multiple solutions, will provide a framework for you to replicate, allowing you the online email privacy everyone deserves.
BIO: Fak3r is a hacker, open source technologist, writer and speaker at conferences like DEF CON, SecureWorld and SEMAFOR. As an active member of the EFF, he leads and moderates discussions about electronic privacy rights and civil liberties while educating users how their data is being used by companies. Fak3r enjoys researching companies weaknesses and failures in safeguarding user’s personal data. He is constantly learning new techniques to solve technical challenges, sharing what he learns online via posts or code. Fak3r listens to music constantly, holds a bachelor’s degree in fine arts, is a practicing troublemaker and likes to keep it real.
Michael “DrBearSec” Smith - Calling All Researchers: A Discussion on Building a Security Research Framework
Independent researchers are lifeblood of the hacking community. Discovering new vulnerabilities, formulating new strategies and ideas, publishing white papers and blogs, and creating new tools, these visionaries help move our community and industry forward.
Unfortunately, many outside of the community look down upon independent security researchers and dismiss their ideas and work. This can be for numerous reasons, such as the research not working for a specific organization or company, the lack of scientific and academic standards, or just a prejudice against the concept of independent research. Even worse, for our community, we have recently witnessed the prosecution of some of these researchers for crossing real or imaginary legal lines during the pursuit of their study.
One way to help legitimize the researchers to others in the corporate and academic communities, as well as help them avoid legal trouble, is the creation and adoption of research guidelines. The first half of the talk discusses some of the potential pitfalls and prejudices independent security researchers face, especially in regards to security disclosures. After that, there will be a frank discussion with audience members about their concerns and fears in terms of research, as well as what they would like to see in a research framework. Finally, volunteers will be invited to help create the framework.
BIO: Michael Smith is a senior security engineer and consultant for ePlus Security. A long time veteran of the industry, he has a diverse IT background, although his true passion remains security. Michael is currently a Doctoral candidate at Capital College, researching the usage of qualitative and quantitative intelligence in security analytics. He holds several certifications including his CISSP, OSCP, and GPEN. When not testing or securing the enterprise, Michael enjoys spending time with his family, pursuing his many geeky interests, wearing strange hats, and traveling… especially to see the Mouse.
Shannon Sistrunk – Say It To My Face
As we are becoming more immersed in technology the “talent” of face to face communication is becoming a commodity. This talk will look at Communication Degradation and its effect on social engineering effectiveness and fundamental communication skills. While Communication Degradation is not new, research into it and its effects are. This talk will explore some of the new research being done in the area as well as look at some future research that is going to be taking place soon.
BIO: Shannon Sistrunk has a B.A. in Speech Communication from Louisiana Tech University and a M.S. in Applied Communication from Mississippi College. Shannon won the graduate research symposium at MC for her work on recognizing the expression of pain among the other universally accepted facial expressions. She is the owner of Bayou Communications LLC, specializing in training for corporate communication, nonverbal communication, social-engineering, and more. She is also married and has two children.
Christopher ‘EggDropX’ Payne & Doug ‘Tha Cheezman’ Nibbelink - Evil Empire: SIEM FTW
Come witness the prognosticators of the SIEM as we travel through the mysterious 5 Ages of Logging and Security. We will reveal the (likely bleak) future of every InfoSec pro’s fave topic, Log Review. Our holy mission is to make you think about log review in a new light, discuss how to make it suck less, and to make you laugh about things that would normally lead to sadness and cutting yourself.
The 5 Ages of Logging:
Anarchistic - There were no logs, the IT world was a dark & chaotic place, which was pretty cool, albeit kinda scary.
Monolithic - There were logs, but no one cared/bothered to look at them. Life was good.
Realistic - There was log review, and it sucked, like really – a lot.
Craptastic - Miraculously SIEM was created, and it sucked too, but slightly less so.
Supercalifuturistic - There will be something ‘better’ and it will also suck. And you will pay too much for it from your favorite greedy vendor(s) because your CISO told you to get some of that stuff that is on the cover of <Insert Garbage Industry Rag Here> or he heard about at the IT Managers happy hour at the local sleaze joint… Why? Come to the talk…
Live onstage [redacted] demo included. You will laugh at least once – or your money back! Satisfaction Guaranteed except where noted, especially Nevada.
BIO: Together, Eggz and Cheez have too many years of experience in InfoSec. Which as you the reader surely know leads to cynicism, bitterness, overuse of sarcastic humor and alcoholism. How they continue to be employed is a mystery.
Alex Hutton – Alex Dreams of Risk: How the Concept of Being a Craftsman Can Help You Find Meaning and Avoid Burnout.
Much talk has been given to the concept of burnout and recurring feelings of futility by InfoSec professionals.This talk will discuss the Japanese concept of the craftman’s spirit — “shokunin kishitsu”, and how that mindset can help you find some fulfillment in your job in what can be a really frustrating industry.
BIO: Often referred to as “The biggest Bitch since Elton John”, Alex Hutton likes risk and security. He works for a bank. He commits a lot of his free time and even some money to the industry.
Twyla and Ivan Campbell - You Can’t Make People Act More Securely, You Can Help Them Want To.
Trying to make non-security people to follow security systems is incredibly difficult when it works, and incredibly difficult and frustrating when it fails. This presentation not only describes what to do and what not to do, but also why the different approaches work or not. There are simple guidelines, based on psychological principles, that can help you develop more successful security systems. Explaining and developing security systems in a way that anyone can understand means you can get them to decide to do what you wanted them to do in the first place.
BIOS: Twyla Campbell, PhD is a research psychologist at Unger Campbell. Her work uses an understanding of psychological principles and focused research to optimize the interaction between users and systems. Unger Campbell is an internationally recognized human factors and usability consulting firm. Dr. Campbell has experience developing systems for a wide variety of Defense and Corporate clients.
Ivan Campbell, M.S. is a security enthusiast. He currently works as a security engineer/operations manager where he does penetration testing, vulnerability analysis, and manages a SOC team of security engineers and analysts. He has several security certifications (e.g. CISSP, GCIH, CEPT, CPT, ECSA, CEH, ACE) He is in the process of getting an MBA. He is interested in most aspects of security and human-machine interaction. He has also taught in a number of subjects on 3 continents.
Bharat Jogi - You Are Being Watched!
Network Video Recorders (NVR) are network devices that record and store video from local and remote IP cameras on HDD storage. These NVRs are increasingly used in surveillance systems of homes and businesses. In this presentation, we will analyze the (in)security of NVRs from one of the reputed manufacturers of these devices. The presentation will cover how NVRs work, analysis of NVR firmware and a step-by-step demo of how an attacker could take complete control of these devices. Once an attacker has control of the device, he can monitor videos from all the cameras connected to the device in real time from anywhere via his smartphone.
I will also release a tool to remotely detect and own a vulnerable device in the wild.
BIO: Bharat Jogi is a Security Professional with over 5 years of experience which includes research on vulnerabilities, malware, protocol analysis, evolving attack vectors and signature development. He countinues to work for Qualys Inc. where he researches latest vulnerabilities in various products, reverse engineers binaries and malware and develops signatures to identify these threats. He holds a Masters degree in Computer Science from the University of Southern California and has been quoted in NetworkWord, SecurityCurve and other main stream media.
Davi Ottenheimer, Raymond Umerley, Jack Daniel, Steve Werby, David Mortman & George V. Hulme - Breach Panel
“A burglar steals an unencrypted powered-down laptop containing PII and is immediately hit and killed by a bus. Data breach?” as more laws are passed there remain many difficult questions to answer. this panel will try. come see opposed minds in the industry debate the ethics and economics of incident response and related regulations. we will debate things like: have the past 10 years of breach legislation helped or hurt our efforts in information security? when is a breach really a breach? is it wrong to say “any loss of control is a breach and must be reported?” do you agree there “no safe harbor for encryption?” is it “unduly costly on society” if our breach definition is too broad?
BIOS: Davi Ottenheimer, President of flyingpenguin and EMC Senior Director of Trust, has more than eighteen years’ experience managing global security operations and assessments, including a decade of leading incident response and digital forensics. He is co-author of the book “Securing the Virtual Environment: How to Defend the Enterprise Against Attack,” published in May 2012 by Wiley. He is a frequent top-rated public speaker and has been quoted or written articles on security, risk management and compliance for publications including Compliance Week, Search Security, Bank Info Security, Network World, Red Herring, Chain Store Age, Inc, Reuters and SC Magazine. Davi received his postgraduate academic Master of Science degree in International History from the London School of Economics.
Ray Umerley (@RayUmerley) is the Chief Data Protection Officer for a Fortune 500 company, where he is responsible for all data security and privacy initiatives. He has over a decade of security and privacy experience, all of the industry “required” certifications, and a MS in computer information systems focusing on information security. He sporadically blogs at SecJitsu.com and is a firm believer of the mantra, “We cannot solve our problems with the same thinking we used when we created them.”
Jack Daniel, Technical Product Manager at Tenable, has over 20 years experience in network and system administration and security, and has worked in a variety of practitioner and management positions. Jack is a sporadic blogger at his Uncommon Sense Security and Travels with Jack blogs, a Security BSides co-founder, InfoSec Curmudgeon, Very Reluctant CISSP, Amateur Blacksmith, and BS Artiste Extraordinaire. Often found on barstools during his frequent travels, Jack’s views on drink and travel have developed, evolved, and merged with the help of many a bartender- his ideas coming into focus as the rest of the world blurred around him.
Steve Werby is an independent information security consultant and security architect for a Fortune 200 company. He previously led enterprise information security programs for 3 large organizations and has presented at conferences such as DerbyCon, SOURCE Seattle, Hack3rCon, SecTor, ShmooCon, and OWASP LASCON. He is proud of the fact that he hasn’t signed his name the same way twice since 2009.
David Mortman has been doing Information Security for well over 15 years and is currently the Chief Security Architect for Enstratius and a Contributing Analyst at Securosis. Most recently, he was the Director of Security and Operations at C3. Previously, David was the CISO at Siebel Systems and the Manager of Global Security at Network Associates. David speaks regularly at Blackhat, Defcon, RSA and other conferences. Additionally, he blogs at emergentchaos.com, newschoolsecurity.com and securosis.com. David sits on a variety of advisory boards, including Qualys, Risk I/O and Virtuosi. David holds a B.S. in Chemistry from the University of Chicago.
George V. Hulme is an internationally recognized information security and business technology writer. For more than 20 years Hulme has written about business, technology, and IT security topics. From March 2000 through March 2005, as senior editor at InformationWeek magazine, he covered the IT security and homeland security beats. His work has appeared in CNN.com, Government Computer News, Nation’s Business, Network World, San Francisco Examiner, The Industry Standard, VARBusiness, and dozens of other technology publications.
