Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Perimeter

2/23/2011
02:34 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Another Side Of B-Sides

The "unconference" across the street from the RSA show in San Francisco last week was shaped, in part, by recent security events

Last week's B-Sides San Francisco had a much different vibe than the previous B-Sides I attended. Granted, that one was held at a private resort in Las Vegas, and San Fran ain't Vegas -- although that may be debatable after Sourcefire's glittery Vegas-themed casino party and Barracuda Networks' Gold Club bash held in conjunction with the RSA Conference there last week.

The backdrop of the recent targeted attack on HBGary by Anonymous, Stuxnet, and a year of advanced persistent threat (APT) revelations and discussions in some ways made for a slightly more serious B-Sides. It also created a lot more buzz at the typically marketing-oriented RSA Conference across the street. The location for the "unconference" at a kids' museum (complete with kids running in and out of the venue amid hackers and attendees) kept B-Sides still a far cry from the more formal RSA Conference, though, and the informal nature of the presentation sessions were still apparent, even with the little theater lecture hall rooms in the Zeum.

Noticeably missing from the B-Sides agenda, of course, was the now-infamous talk that never happened: Aaron Barr's presentation on using social networks to gather intelligence. Among the three case studies Barr had planned to discuss during the talk, "Who Needs the NSA When We Have Social Media," were the Anonymous group, a critical infrastructure facility, and a military installation. The fallout came when Barr told The Financial Times in an article prior to the show that he was able to identify real names of most of the higher-ups in Anonymous. Anonymous hit back hard, dumping the contents of the HBGary Federal and HBGary's email messages and other sensitive information online, as well as commandeering Barr's Twitter account and posting his Social Security number and address.

Barr subsequently canceled his B-Sides talk, and HBGary later pulled out of the RSA Conference as well, leaving behind a sign on its booth on the show floor noting threats against its employees: "In addition to the data theft, HBGary individuals have received numerous threats of violence including threats at our tradeshow booth."

So the big week for the security industry began on a slightly more somber note; the HBGary/Anonymous incident infiltrated many presentations and talks, and was carefully discussed among gun-shy attendees and speakers. But that wasn't the only reality check for the security industry that had hit the fan. Stuxnet's presence also was felt, serving as a chilling reminder of the vulnerability of the power grid, and generating more debates over cyberwar and espionage.

One of the talks at B-Sides looked at security "marketecture," with Richard Bejtlich, director of incident response for General Electric and leader of the GE computer incident response team, and Travis Reese, president and COO at Mandiant. Andrew Hay, senior security analyst with The 451 Group's enterprise security practice, chaired the panel, which debated how security vendors use and abuse terms like "advanced persistent threat" and "cyberwar" to sell their wares.

Cyberwar has become one of the most popular topics of debate in the industry given the events of the past year: What the heck is cyberwar? Are we in one now? How will we know when we are at cyberwar? The panels sorted out just what constitutes cyberwar and an APT or targeted attack.

Bejtlich pointed out that according to Chinese information war doctrines, China believes the U.S. already started an information war against it. "They believe our culture is an affront to their sovereignty," he said. And Chinese attackers tend to use the "persistence" strategy of gaining a foothold in a targeted network for espionage purposes and finding ways to remain there as long as possible and employing a strategy of "plausible deniability."

Attackers from other regions take more pains to remain anonymous. "They don't use persistence. If you shut a box down [where they had infiltrated], they are gone," Bejtlich said.

And Mandiant's Reese noted that cyberespionage isn't the same as cyberwar, even though nearly 20 percent of the targeted attacks Mandiant has seen of late were against energy companies. He said cyberwar would have a military element as well.

No one drew definitive conclusions, but that's half the fun of the B-Sides banter. There's no stock "takeaway" slide at the end of a preso -- just open and continued dialogue and debate on security's hottest topics. Even with the large turnout last week in San Francisco, with some 500 attendees, B-Sides still was able to maintain the intimate atmosphere it was built on while at the same time growing into a more prominent venue for security professionals.

-- Kelly Jackson Higgins, Senior Editor, Dark Reading Follow Kelly (@kjhiggins) here on Twitter.

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Mobile Banking Malware Up 50% in First Half of 2019
Kelly Sheridan, Staff Editor, Dark Reading,  1/17/2020
Active Directory Needs an Update: Here's Why
Raz Rafaeli, CEO and Co-Founder at Secret Double Octopus,  1/16/2020
New Attack Campaigns Suggest Emotet Threat Is Far From Over
Jai Vijayan, Contributing Writer,  1/16/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
The Year in Security: 2019
This Tech Digest provides a wrap up and overview of the year's top cybersecurity news stories. It was a year of new twists on old threats, with fears of another WannaCry-type worm and of a possible botnet army of Wi-Fi routers. But 2019 also underscored the risk of firmware and trusted security tools harboring dangerous holes that cybercriminals and nation-state hackers could readily abuse. Read more.
Flash Poll
How Enterprises are Attacking the Cybersecurity Problem
How Enterprises are Attacking the Cybersecurity Problem
Organizations have invested in a sweeping array of security technologies to address challenges associated with the growing number of cybersecurity attacks. However, the complexity involved in managing these technologies is emerging as a major problem. Read this report to find out what your peers biggest security challenges are and the technologies they are using to address them.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-5216
PUBLISHED: 2020-01-23
In Secure Headers (RubyGem secure_headers), a directive injection vulnerability is present in versions before 3.9.0, 5.2.0, and 6.3.0. If user-supplied input was passed into append/override_content_security_policy_directives, a newline could be injected leading to limited header injection. Upon seei...
CVE-2020-5217
PUBLISHED: 2020-01-23
In Secure Headers (RubyGem secure_headers), a directive injection vulnerability is present in versions before 3.8.0, 5.1.0, and 6.2.0. If user-supplied input was passed into append/override_content_security_policy_directives, a semicolon could be injected leading to directive injection. This could b...
CVE-2020-5223
PUBLISHED: 2020-01-23
In PrivateBin versions 1.2.0 before 1.2.2, and 1.3.0 before 1.3.2, a persistent XSS attack is possible. Under certain conditions, a user provided attachment file name can inject HTML leading to a persistent Cross-site scripting (XSS) vulnerability. The vulnerability has been fixed in PrivateBin v1.3...
CVE-2019-20399
PUBLISHED: 2020-01-23
A timing vulnerability in the Scalar::check_overflow function in Parity libsecp256k1-rs before 0.3.1 potentially allows an attacker to leak information via a side-channel attack.
CVE-2020-7915
PUBLISHED: 2020-01-22
An issue was discovered on Eaton 5P 850 devices. The Ubicacion SAI field allows XSS attacks by an administrator.