Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Perimeter

2/23/2011
02:34 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Another Side Of B-Sides

The "unconference" across the street from the RSA show in San Francisco last week was shaped, in part, by recent security events

Last week's B-Sides San Francisco had a much different vibe than the previous B-Sides I attended. Granted, that one was held at a private resort in Las Vegas, and San Fran ain't Vegas -- although that may be debatable after Sourcefire's glittery Vegas-themed casino party and Barracuda Networks' Gold Club bash held in conjunction with the RSA Conference there last week.

The backdrop of the recent targeted attack on HBGary by Anonymous, Stuxnet, and a year of advanced persistent threat (APT) revelations and discussions in some ways made for a slightly more serious B-Sides. It also created a lot more buzz at the typically marketing-oriented RSA Conference across the street. The location for the "unconference" at a kids' museum (complete with kids running in and out of the venue amid hackers and attendees) kept B-Sides still a far cry from the more formal RSA Conference, though, and the informal nature of the presentation sessions were still apparent, even with the little theater lecture hall rooms in the Zeum.

Noticeably missing from the B-Sides agenda, of course, was the now-infamous talk that never happened: Aaron Barr's presentation on using social networks to gather intelligence. Among the three case studies Barr had planned to discuss during the talk, "Who Needs the NSA When We Have Social Media," were the Anonymous group, a critical infrastructure facility, and a military installation. The fallout came when Barr told The Financial Times in an article prior to the show that he was able to identify real names of most of the higher-ups in Anonymous. Anonymous hit back hard, dumping the contents of the HBGary Federal and HBGary's email messages and other sensitive information online, as well as commandeering Barr's Twitter account and posting his Social Security number and address.

Barr subsequently canceled his B-Sides talk, and HBGary later pulled out of the RSA Conference as well, leaving behind a sign on its booth on the show floor noting threats against its employees: "In addition to the data theft, HBGary individuals have received numerous threats of violence including threats at our tradeshow booth."

So the big week for the security industry began on a slightly more somber note; the HBGary/Anonymous incident infiltrated many presentations and talks, and was carefully discussed among gun-shy attendees and speakers. But that wasn't the only reality check for the security industry that had hit the fan. Stuxnet's presence also was felt, serving as a chilling reminder of the vulnerability of the power grid, and generating more debates over cyberwar and espionage.

One of the talks at B-Sides looked at security "marketecture," with Richard Bejtlich, director of incident response for General Electric and leader of the GE computer incident response team, and Travis Reese, president and COO at Mandiant. Andrew Hay, senior security analyst with The 451 Group's enterprise security practice, chaired the panel, which debated how security vendors use and abuse terms like "advanced persistent threat" and "cyberwar" to sell their wares.

Cyberwar has become one of the most popular topics of debate in the industry given the events of the past year: What the heck is cyberwar? Are we in one now? How will we know when we are at cyberwar? The panels sorted out just what constitutes cyberwar and an APT or targeted attack.

Bejtlich pointed out that according to Chinese information war doctrines, China believes the U.S. already started an information war against it. "They believe our culture is an affront to their sovereignty," he said. And Chinese attackers tend to use the "persistence" strategy of gaining a foothold in a targeted network for espionage purposes and finding ways to remain there as long as possible and employing a strategy of "plausible deniability."

Attackers from other regions take more pains to remain anonymous. "They don't use persistence. If you shut a box down [where they had infiltrated], they are gone," Bejtlich said.

And Mandiant's Reese noted that cyberespionage isn't the same as cyberwar, even though nearly 20 percent of the targeted attacks Mandiant has seen of late were against energy companies. He said cyberwar would have a military element as well.

No one drew definitive conclusions, but that's half the fun of the B-Sides banter. There's no stock "takeaway" slide at the end of a preso -- just open and continued dialogue and debate on security's hottest topics. Even with the large turnout last week in San Francisco, with some 500 attendees, B-Sides still was able to maintain the intimate atmosphere it was built on while at the same time growing into a more prominent venue for security professionals.

-- Kelly Jackson Higgins, Senior Editor, Dark Reading Follow Kelly (@kjhiggins) here on Twitter.

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
Cloud Security Startup Lightspin Emerges From Stealth
Kelly Sheridan, Staff Editor, Dark Reading,  11/24/2020
Look Beyond the 'Big 5' in Cyberattacks
Robert Lemos, Contributing Writer,  11/25/2020
Why Vulnerable Code Is Shipped Knowingly
Chris Eng, Chief Research Officer, Veracode,  11/30/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: I think the boss is bing watching '70s TV shows again!
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-28971
PUBLISHED: 2020-12-01
An issue was discovered on Western Digital My Cloud OS 5 devices before 5.06.115. A NAS Admin authentication bypass vulnerability could allow an unauthenticated user to execute privileged commands on the device via a cookie, because of insufficient validation of URI paths.
CVE-2020-28993
PUBLISHED: 2020-12-01
A Directory Traversal vulnerability exists in ATX miniCMTS200a Broadband Gateway through 2.0 and Pico CMTS through 2.0. Successful exploitation of this vulnerability would allow an unauthenticated attacker to retrieve administrator credentials by sending a malicious POST request.
CVE-2020-6880
PUBLISHED: 2020-12-01
A ZXELINK wireless controller has a SQL injection vulnerability. A remote attacker does not need to log in. By sending malicious SQL statements, because the device does not properly filter parameters, successful use can obtain management rights. This affects: ZXV10 W908 all versions before MIPS_A_10...
CVE-2020-28940
PUBLISHED: 2020-12-01
On Western Digital My Cloud OS 5 devices before 5.06.115, the NAS Admin dashboard has an authentication bypass vulnerability that could allow an unauthenticated user to execute privileged commands on the device.
CVE-2020-28970
PUBLISHED: 2020-12-01
An issue was discovered on Western Digital My Cloud OS 5 devices before 5.06.115. A NAS Admin authentication bypass vulnerability could allow an unauthenticated user to execute privileged commands on the device via a cookie. (In addition, an upload endpoint could then be used by an authenticated adm...