No we aren’t going to talk about jailbreaks or other penal system trials and tribulations. This one is about how the conference circuit is evolving in a really positive way. Most folks attend the big security shows – you know, RSA and BlackHat and maybe some others. Most folks also hate these shows. I hear a lot of complaints about weak content and vendor whoring putting a damper on the experience. Of course, since myself and my ilk tend to speak at most of these shows, we can only point the finger at ourselves. Personally, unless I’m speaking I tend to skip all but the biggest shows, which I attend for networking purposes. But that’s just me.

But nature hates a vacuum, and the vacuum of user-oriented conferences is being filled by the BSides movement and a number of regional hacker cons. If the conference you are attending doesn’t do it for you, get some smart folks together (who are there anyway) and put on an unconference of your own. That’s the general concept for BSides. I attended BSides ATL last week, and it was a really great experience. First shout outs need to be sent to the driving forces bringing BSides to ATL, and they were Eric Smith (@infosecmafia), Nick Owen (@wikidsystems), Marisa Fagan (@dewzi) and MC Petermann (@petermannmc). I know there were tons of other folks who put a lot of blood, sweat, and tears into making BSides ATL happen, and no offense to anyone I didn’t mention. I can’t thank them all enough.

Why is this working? Because it’s about community. I’ve been in Atlanta for over 6 years now, and there isn’t really a cohesive security community. The ISSA meetings are a joke, unless you like vendors to hump your leg for 2 hours every month. We tried to get a CitySec group meeting going (and all three of us who attended enjoyed the beer that I bought), but that fizzled. A new Cloud Security Alliance chapter is forming in the ATL and we are seeing a lot of activity for the NAISG in town as well. Yes, there are other organizations, but it’s generally a small group of folks getting together in an ad hoc fashion.

But what’s been missing has been a more technically oriented conference, where smart folks from the Southeast can get together and share what we are seeing. That happened in spades at BSides ATL. Whether talking Google and Bing hacking with Rob Ragan, exfiltration with Dave Shackleford and Rick Hayes, pen testing with Eric Smith and Dave Kennedy, or having Chris Nickerson show how to bring entire companies down (think attacking robots!) – it was just a flood of information. Good information. And those were just the sessions I attended. There were a bunch of others I had to miss.

The conference organizers even let me play and talk about what I think will happen in 2011. The short answer is I have no idea. But you already knew that. Yet I did get to use a picture of a guinea pig BBQ, which has to set some low bar for depravity.

I’m probably going to get in trouble by talking up BSides because we Securosis folks do a lot of work with the RSA Conference. Next year, we’ll be leading the E10 (CISO-focused) event on Monday at RSA, and Rich is in London and will be in China this month speaking at RSA’s global events. But the writing is on the wall. Content is king, and right now there is a lot of great content being driven through the regional BSides conferences and the other hacker cons.

While I’m talking conferences, I also should mention what seemed to be a rousing success for Hoff and friends at the inaugural HacKid conference in Boston last weekend. It’s such a great concept, to teach kids about security, self-defense and other important topics. I can’t wait to get this going in ATL. And with that, just remember – if you don’t take care of your customers someone else will. Mr. Market told me.

– Mike.

Photo credits: “Pug Shot” originally uploaded by Jerry Reynolds

Recent Securosis Posts

1. IT Debt: Real or FUD?
2. FireStarter: Consumer Internet Penalty Box
3. Friday Summary: October 8, 2010
4. Monitoring up the Stack:
   • User Activity Monitoring
   • Identity Monitoring

I should also highlight an article on Application Monitoring in Dark Reading that highlights the Monitoring up the Stack research Adrian and Gunnar are working on right now. I know lots of folks have a hard enough time monitoring their network and security devices, but the application is where the action is, so ignore it at your own peril.

Incite 4 U

1. Time for the heavy artillery. What heavy artillery? – Greg Shipley makes the point we’ve all come to grips with. We are outgunned. The bad guys have better tools and more motivation, and all we can do is watch it happen and clean up the mess afterwards. This statement kind of says it all: “Recent events suggest that we are at a tipping point, and the need to reassess and adapt has never been greater. That starts with facing some hard truths and a willingness to change the status quo.” Right. So all is not lost, but we need to start thinking differently. But what does that mean? According to Shipley, it’s focusing on the database and maybe things like application white listing. Best of all is the idea to “stop rewarding ineffectiveness and start rewarding innovation.” Bravo. But how do you do that when the checkbox says you need AV? So basically we are in a quandary, but you already knew that. What to do? Basically what we’ve been saying for years. React Faster (and Better), focus on the fundamentals, and if you are targeted, just understand you can’t stop them. And manage expectations accordingly. He closes the article with “If we remain bound to our relentless commitment to mediocrity, we will be worse off moving ahead. We can and must do better. It’s time to change our way of thinking.” Right. – MR
2. Instructive memory – Ever had something running on your machine and you wanted to know “what the hell this that”? Not for your day to day IT practitioner, but for those of you who wanted to know more about forensic analysis, Lenny Zeltser’s 3 phases of Malware Analysis is a good place to start. Watching application behavior is a good way to get a handle on an applications ‘intentions’ and what the code is trying to do. From there, disassembling the code can help you understand the threat and – hopefully – how to stop it. But some malware can’t be understood through behavioral monitoring, and reverse engineering does not fully disclose code segments. Examining the runtime execution of a program provides a different view – helpful in some cases, and necessary when it comes to memory-resident-only malware. This analysis is a little more difficult – it requires some understanding of operating system functions and memory layout. But for detection of memory-only malware and rootkits, it’s your only option. Lenny’s post mentions some tools and resources so you can try it out for yourself. – AL
3. Will you end up under the security bus? – Great post here from Adam Ely about who should be making the decisions in your organization. Unfortunately fat, dumb, and/or lazy security folks all too often let vendors dictate what they do and don’t do. Or some analyst quadrant or product review. Adam’s point is that he gets paid to prioritize between all the things he could do and focus on the things he needs to do. I could talk more about what is says, but just go read the post. Now. – MR
4. Stop. Think. Get Pwned. – Given that it’s cyber-security awareness month, it’s not surprising to see the Department of Homeland Security get into the fray with its awareness campaign called Stop. Think. Connect. Their focus is on getting Americans to take responsibility for what they do online and also tell their friends. How? By putting money into some fora I’ve never heard of which will hold town-hall meetings. That will be pretty effective. Bah, cynicism is getting the better of me. Personally I think DHS should just give a bunch of money to Facebook to educate their users. I know that wouldn’t work, for lots of reasons, but I can tell you the folks who are getting pwned are on Facebook a lot, and probably not going to attend a town hall meeting. Even if they provide coffee and donuts. – MR
5. Mobile strategy, meet rotary oscillator – I get a chuckle out of articles like Christina Torode’s post on CIOs feverishly working on mobile strategy. Mainly because it implies that there is planning and preparation. Usually “working on a mobile strategy” is not a proactive effort, but is prompted by a dozen executives and half the sales teams getting iPhones and implying the CIO’s job security is suspect if he/she can’t support them. It’s not “How do we harness mobile devices for our business?” but “How can my infrastructure support mobile apps and not break the other applications and my entire security model?” It’s not “How can IT help or hinder the use of mobile devices and applications?” but “Where do I start my investigation?” It’s almost like you need to break other services, applications, or protocols in order to leverage the mobile apps, and it’s these trade-offs that cause CIOs to lose sleep at night. – AL
6. The return of Free Public WiFi – A story I keep seeing across mass media is the re-emergence of Free Public WiFi. You know, the ad hoc network that shows up on XP machines that haven’t been patched in, I don’t know, maybe 3 years. Right, Microsoft fixed that years ago and I’m not sure what makes this newsworthy now. The point, first of all, is patch your damn machines. If you do a NetStumbler scan and find “Free Public WiFi,” take that person’s machine away. They are clearly not competent to use a computer. Next, teach your damn users not to connect to any old WiFi network. It just goes to show old attacks never die, so old controls can’t die either. Guess that’s why Jaquith called it the Hamster Wheel of Pain. BTW, 5 years later, Andy’s post is still unbelievably on point. – MR
7. Why SEO is the end of civilization… – Aside from Rob Ragan’s demonstration of how negative SEO can torpedo competition, check out the title of this press release from McAfee. “McAfee, Inc. Security Management Platform Provides Businesses with Proactive Risk Management” What? Clearly this is keyword optimization run amok. Of course, I scoff at the idea of anything proactive in security. Give me a break. And are they talking about security or risk? And don’t bother looking at the release – it’s about as clear as mud. Are they talking about ePO? Or is the Security Management Platform something else? Come to think of it, I don’t care. I just wanted to point out security marketing at pretty close to its absolute worst. – MR
8. Two more marshmallow deals… – We’ve talked all year about more and more consolidation in the security market. Two more examples hit this week. First off Nitro raised some money and also acquired LogMatrix. Who? They used to be called OpenService and they’ve been the walking dead for the last few years. Guess Nitro got a handful of customers in the deal. And HID Global acquired ActivIdentity. Right – the proximity card, I mean physical security folks. Actually this deal makes sense, since ActivIdentity always did well issuing credentials for universal ID cards. The deal was for $162 million, a 48% premium over the 20-day average, but keep in mind that ActivIdentity had over $90 million in cash. So the deal is for maybe 1.2x sales. Anyone have some marshmallows? I think we are going to see a few more fire sales before we close the books on 2010.