Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Perimeter

2/23/2011
02:34 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Another Side Of B-Sides

The "unconference" across the street from the RSA show in San Francisco last week was shaped, in part, by recent security events

Last week's B-Sides San Francisco had a much different vibe than the previous B-Sides I attended. Granted, that one was held at a private resort in Las Vegas, and San Fran ain't Vegas -- although that may be debatable after Sourcefire's glittery Vegas-themed casino party and Barracuda Networks' Gold Club bash held in conjunction with the RSA Conference there last week.

The backdrop of the recent targeted attack on HBGary by Anonymous, Stuxnet, and a year of advanced persistent threat (APT) revelations and discussions in some ways made for a slightly more serious B-Sides. It also created a lot more buzz at the typically marketing-oriented RSA Conference across the street. The location for the "unconference" at a kids' museum (complete with kids running in and out of the venue amid hackers and attendees) kept B-Sides still a far cry from the more formal RSA Conference, though, and the informal nature of the presentation sessions were still apparent, even with the little theater lecture hall rooms in the Zeum.

Noticeably missing from the B-Sides agenda, of course, was the now-infamous talk that never happened: Aaron Barr's presentation on using social networks to gather intelligence. Among the three case studies Barr had planned to discuss during the talk, "Who Needs the NSA When We Have Social Media," were the Anonymous group, a critical infrastructure facility, and a military installation. The fallout came when Barr told The Financial Times in an article prior to the show that he was able to identify real names of most of the higher-ups in Anonymous. Anonymous hit back hard, dumping the contents of the HBGary Federal and HBGary's email messages and other sensitive information online, as well as commandeering Barr's Twitter account and posting his Social Security number and address.

Barr subsequently canceled his B-Sides talk, and HBGary later pulled out of the RSA Conference as well, leaving behind a sign on its booth on the show floor noting threats against its employees: "In addition to the data theft, HBGary individuals have received numerous threats of violence including threats at our tradeshow booth."

So the big week for the security industry began on a slightly more somber note; the HBGary/Anonymous incident infiltrated many presentations and talks, and was carefully discussed among gun-shy attendees and speakers. But that wasn't the only reality check for the security industry that had hit the fan. Stuxnet's presence also was felt, serving as a chilling reminder of the vulnerability of the power grid, and generating more debates over cyberwar and espionage.

One of the talks at B-Sides looked at security "marketecture," with Richard Bejtlich, director of incident response for General Electric and leader of the GE computer incident response team, and Travis Reese, president and COO at Mandiant. Andrew Hay, senior security analyst with The 451 Group's enterprise security practice, chaired the panel, which debated how security vendors use and abuse terms like "advanced persistent threat" and "cyberwar" to sell their wares.

Cyberwar has become one of the most popular topics of debate in the industry given the events of the past year: What the heck is cyberwar? Are we in one now? How will we know when we are at cyberwar? The panels sorted out just what constitutes cyberwar and an APT or targeted attack.

Bejtlich pointed out that according to Chinese information war doctrines, China believes the U.S. already started an information war against it. "They believe our culture is an affront to their sovereignty," he said. And Chinese attackers tend to use the "persistence" strategy of gaining a foothold in a targeted network for espionage purposes and finding ways to remain there as long as possible and employing a strategy of "plausible deniability."

Attackers from other regions take more pains to remain anonymous. "They don't use persistence. If you shut a box down [where they had infiltrated], they are gone," Bejtlich said.

And Mandiant's Reese noted that cyberespionage isn't the same as cyberwar, even though nearly 20 percent of the targeted attacks Mandiant has seen of late were against energy companies. He said cyberwar would have a military element as well.

No one drew definitive conclusions, but that's half the fun of the B-Sides banter. There's no stock "takeaway" slide at the end of a preso -- just open and continued dialogue and debate on security's hottest topics. Even with the large turnout last week in San Francisco, with some 500 attendees, B-Sides still was able to maintain the intimate atmosphere it was built on while at the same time growing into a more prominent venue for security professionals.

-- Kelly Jackson Higgins, Senior Editor, Dark Reading Follow Kelly (@kjhiggins) here on Twitter.

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
AI Is Everywhere, but Don't Ignore the Basics
Howie Xu, Vice President of AI and Machine Learning at Zscaler,  9/10/2019
Fed Kaspersky Ban Made Permanent by New Rules
Dark Reading Staff 9/11/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-14540
PUBLISHED: 2019-09-15
A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariConfig.
CVE-2019-16332
PUBLISHED: 2019-09-15
In the api-bearer-auth plugin before 20190907 for WordPress, the server parameter is not correctly filtered in the swagger-config.yaml.php file, and it is possible to inject JavaScript code, aka XSS.
CVE-2019-16333
PUBLISHED: 2019-09-15
GetSimple CMS v3.3.15 has Persistent Cross-Site Scripting (XSS) in admin/theme-edit.php.
CVE-2019-16334
PUBLISHED: 2019-09-15
In Bludit v3.9.2, there is a persistent XSS vulnerability in the Categories -> Add New Category -> Name field. NOTE: this may overlap CVE-2017-16636.
CVE-2019-16335
PUBLISHED: 2019-09-15
A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariDataSource. This is a different vulnerability than CVE-2019-14540.