Emerging Threats Track
Many organizations take a "reactive" approach to threats and vulnerabilities--an outdated approach that leaves high-value data and intellectual property exposed. This track explores how to build and maintain a more agile, proactive defense model that reduces the risk of malware, application attacks and emerging Web 2.0 threats.
The Four Horsemen of the Virtualization Security Apocalypse
Christofer Hoff, Chief Security Strategist, Unisys
Despite shiny new stickers on the boxes of our favorite security vendors' products that advertise "virtualization ready!" or the hordes of new startups emerging from stealth decrying the second coming of security, there exists the gritty failed reality of attempting to replicate complex network and security topologies in virtualized environments. This talk clearly demonstrates that unless we radically rethink our approach, the virtualization security apocalypse is nigh!
Christofer Hoff focuses on the realities of operationalizing virtualized security; from virtualization-enabled chipsets to the hypervisor to the VM's. Attend and explore the real issues that exist today as well as those that we can expect to see in the future.
A Tale of 2.0 Webs, It Was The Best Of Times, It Was The Worst Of Times
David Mortman, CISO-In-Residence, Echelon One
Web 2.0 has brought us an unprecedented ability to not only access data but to remix it in previous unthought-of applications and in the process enable users and vendors in here-to impossible ways. This has also led to security and privacy issues that have so far only been the purview of distopian fiction. Is it really that bad? Or is it far worse? Get straight answers from David Mortman and find out what you need to know about Web 2.0.
What Organizations Need to Know about Insider Cyber Crimes
Andrew P. Moore, CERT, Software Engineering Institute, Carnegie Mellon University
CERT’s insider threat team, which was formed in 2001, has gathered over 250 prosecuted cases of insider crime that exploited the insider’s access to an organization’s information systems. The team, composed of CERT's technical experts, psychologists and subject matter experts from the Department of Defense, used system dynamics to model and analyze the dynamic nature of the insider threat problem.
In this presentation, Andrew Moore describes the findings based on three primary insider cyber crimes: IT sabotage, theft/modification for financial gain, and theft for business advantage. Moore examines who committed the crimes, their motivation, organizational issues surrounding the incidents, methods of carrying out the attacks, impacts, and precursors that could have served as indicators to the organization in preventing the incident or detecting it earlier. Actual cases are presented throughout the presentation to provide concrete examples and offer lessons learned.