Conference Program

Doug Wilson (Ex-Mandiant, FireEye, Uptycs) has almost 20 years in security, but if you look way back, his college degree is actually in design! When not doing security, he has spent a fair bit of the past 15 years attending events that focus on design, and believes that design elements are critical to success in security pursuits. He has presented at numerous security conferences over his career, as well as talks and a workshop at FIRST.

Nguyet Vuong has 16 years of experience as digital designer, and is currently a Co-Founder and Design Lead for Civil (www.civil.co). She has won design industry awards, given numerous presentations, and facilitated workshops on design. She believes in honest and transparent design patterns that respect people’s time and intelligence. She regularly tries to spread the word of how design thinking and processes can make other fields better, including security.

Security practitioners often struggle with collaboration, especially on projects where there are competing or contentious points of view. Design Thinking is a set of tools coming from the world of user experience design that allow for facilitation of discussion so that groups have a more equitable exchange of ideas, and come up with outcomes that more accurately represent a wide variety of views compared to traditional discussion forums.

By participating in a demonstration of a facilitated workshop, participants will realize the benefits of design thinking. This will include how to properly frame problems, ask the right questions, uncover unrealized components of both problems and solutions, and maintain empathy throughout the process so that diverse views are included in all parts of the process. We will attempt to keep the workshop pertinent by tackling a current concern in the security industry today.

Keir is a National Cyber Incident Coordinator at the UK's National Cyber Security Centre (NCSC). The Incident Coordination team are responsible for aligning the UK government's response to cyber incidents of a highly significant or critical nature.

Having been an Incident Responder and Coordinantor in the NCSC's precursor organisation, CERT-UK, Keir has had wide experience at both a technical and strategic level in dealing with a variety of prominent incidents with significant impact in both the UK, and across the globe.

Your CTI (Castle Tower Installation) vendor has just sold you a quick-raise drawbridge, fast-load catapults, and tar covered fence (literally, a firewall). That stuff was super expensive and next gen - there is no way a dragon/marauding army is getting in there!

So why is half the town on fire, and other half full of nasty people with swords?

Did you let guards take the keys to the bar again?

Did you ever check that the broken wooden fence at the back of the castle had been replaced with that stone wall, like you asked?

We are seeing APTs neglect the 0day and hardened front door, instead using simple, easily accessible methods, with devastating efficiency. With a change in commodity malware use, this means we underestimate the threat, just as the danger grows.

Pull up a stool by the fire for some cautionary tales and how best to prevent them.

Chris King is the Chief Security Architect and former Cyber Defense Manager for Rockwell Automation, a leading industrial automation company. In his role at Rockwell, Chris is responsible for security architecture for the company, and formerly ran global cyber defense operations, vulnerability management, application security, and digital forensics. Before coming to Rockwell, Chris was a vulnerability analyst at the CERT Coordination Center (CERT/CC), where he conducted research into vulnerabilities in connected and automated vehicles for the Departments of Transportation and Homeland Security, developed strategies in coordinated disclosure, as well as development of secure architectures for the Department of Defense.

Adversaries are finding new opportunities to inflict damage to organizations by impacting their operational technology (OT) operations and supply chain. At the same time tooling, monitoring, and response at the OT level has remained ad hoc and siloed. Now more than ever we must have a disciplined approach to not only detect threats impacting our OT environments but more importantly be able to respond in an efficient way that leads to a timely recovery. A single team providing integrated incident response for both IT/OT environments can help achieve these objectives. Come learn about operational models, techniques and workflows that Rockwell Automation has been implementing to improve mean times to respond and recover from cyber events and foster knowledge sharing between IT and OT experts.

Coming soon.

In a large company with hundreds of software products, following up and fixing vulnerabilities in open source and commercial components is a big and complex task. Co-ordination of accurate vulnerability information between the vulnerability information sources, product development units, product management, customer support organizations, customers and sometimes even executives and public relations would be impossible without automated tools.

This talk presents the Ericsson Vulnerability Management Service (EVMS), a full-fledged vulnerability management system developed in-house. Various Ericsson employees globally use the service in different roles: Ericsson PSIRT provides the vulnerability management service through EVMS, product development submits their mitigation plans into EVMS, customer support searches for information about specific products and managers search for recently created security alerts to keep up with the security landscape. EVMS is the place where all the above information can be found.

Open to academic teams and organizations.

1. Academic CSIRTs update session.
2. Presentation session: sharing initiatives, experiences, work in progress.
3. Discussion session.

Some themes to consider presenting:

• Security Tools and systems
• Security best practices
• Legal and regulatory issues
• Security governance
• Data exchange and privacy
• Other topic you consider relevant

Chandan Nandakumaraiah is a senior manager of incident response at Juniper Networks, co-founder and director of OpenGrok Foundation for the advancement of human understanding of complex software and systems and a member of the CVE Automation Working Group. He has served in various software engineering and security incident response roles for large corporations since the start of this millennium. Chandan is a member of Vulnerability Coordination SIG, Vendor SIG and Ethics SIG, and has been attending FIRST annual conferences since 2005. Chandan holds a Master's degree in Computer Science and Engineering from the Indian Institute of Science.

Communicating information related to vulnerabilities, including CVE IDs, is often one of the core services offered by product security teams. Describing vulnerabilities in a factual and precise language is critical for efficiency in response and remediation activities throughout the response ecosystem. Encoding the vulnerability related information in a machine readable format is essential for automation and for handling issues at scale.

We will discuss the latest developments in automation and encoding formats related to vulnerabilities and CVE IDs. This includes demonstrating tools and techniques related to creation, dissemination and consumption of the new CVE-JSON format. This presentation also shares our experience in streamlining vulnerability response processes at Juniper Networks by taking advantage of the new standards and techniques.

Otis Alexander joined the Mitre Corporation as a Cyber Security Engineer in 2014. He currently leads the development of the ICS ATT&CK model and focuses on the categorization and emulation of adversary behavior in cyber physical systems. Otis holds a BS and MS in Computer Science from the University of Washington.

Operators of Industrial Control Systems (ICS) like those used in the electric power substations lack the capability for active defense of their systems from cyber adversaries. Critical to building defenses is understanding potential and past cyber adversary behavior. Building a threat model for ICS systems, e.g. ATT&CK for ICS will enable the industry to prioritize and enhance defenses, sharing threat information relative to adversary Tactics and Techniques, and enable more effective incident response. MITRE will present their ATT&CK for ICS model with associated use cases of past and recent incidents.

Moderator:

• Cristine Hoepers, CERT.br/NIC.br, BR

Cristine Hoepers is the General Manager of CERT.br, the Brazilian National CERT. In the past she served as a member of the FIRST Board of Directors, as a Lead Expert of the UN IGF Best Practice Forum on CERTs, and as a member of the ITU HLEG (High Level Experts Group). She holds a degree in Computer Science and a PhD in Applied Computing.

Panellists:

• Art Manion, CERT/CC, US

Art Manion is a senior member of the Vulnerability Analysis team in the CERT Program at the Software Engineering Institute (SEI), Carnegie Mellon University. Since joining CERT in 2001, Manion has studied vulnerabilities, coordinated disclosure efforts, and published advisories, alerts, and vulnerability notes for CERT/CC and US-CERT. Manion currently focuses on vulnerability discovery and other areas of applied research, including ways to automate and improve operational vulnerability response. Prior to joining the SEI, Manion was the Director of Network Infrastructure at Juniata College.

• Marissa Quebbeman, Microsoft, US

Marissa Quebbeman is a Senior Security PM Manager in the Microsoft Security Response Center’s (MSRC) PSIRT where she leads a team to collaborate with researchers and developers to remediate security issues identified in Microsoft’s products and services. Prior to Microsoft, Marissa worked in cyber threat intelligence, digital forensics, and in the intelligence community. She earned both a M.S. and B.S. in Computer Science, and currently holds SEPP, GCIH, and GPEN certifications.

• Maarten Van Horenbeeck, Zendesk, US

Maarten Van Horenbeeck is Chief Information Security Officer of Zendesk, a customer service and engagement software company headquartered in San Francisco. He is also a Board member of the Forum of Incident Response and Security Teams (FIRST). Van Horenbeeck holds a master’s degree in information security from Edith Cowan University in Western Australia and a master’s degree in international relations from the Freie Universitat Berlin, and is a fellow in New America’s Cybersecurity Initiative.

On March 25th 2019, journalist Kim Zetter reported the discovery by Kaspersky Lab that thousands of laptop computers had had malware installed through abuse of their vendor's signed auto-update process [1]. This was not the first time this happened and it might not be the last. Professor Steve Bellovin described this as "A Dangerous, Norm-Destroying Attack", pointing out that "trust in the update channel is utterly vital" [2]. If end-users, organisations or third party vendors conclude - almost certainly wrongly - that it is less risky to disable updates of their connected devices and systems, then much of this century's progress in Internet security will be lost.

In this panel we will invite a number of experts to share their ideas on how the FIRST community can help ensure that auto-update processes are both trustworthy and trusted, and that Professor Bellovin's "sure-fire recipe for disaster" doesn't happen.

[1] https://motherboard.vice.com/en_us/article/pan9wn/hackers-hijacked-asus-software-updates-to-install-backdoors-on-thousands-of-computers

[2] http://www.circleid.com/posts/20190326_a_dangerous_norm_destroying_attack/

The AGM is FIRST's Annual General Meeting, where the FIRST members meet and discuss and decide about FIRST and its road ahead. This includes the elections for the 5 Board of Directors slots that go vacant each year at the AGM.

Attendance and participation at the FIRST Annual General Meeting is limited to FIRST team members, FIRST liaison members and their invited guests, subject to approval by the Board of Directors.

• 2019 Annual General Meeting (AGM)](https://members.first.org/events/agm/2019/#secure) requires FIRST X.509 certificate

Jan Kohlrausch received a Diploma in computer science from the University of Hamburg in June 2000. Since July 2000 he works as a Senior member of the development and research team at the DFN-CERT Services GmbH. His research interests include Honeypots, malware analysis, and network forensics.

Security metrics allow to quantify information in order to support threat intelligence processes. In this contribution we propose to apply metrics to security data of a clearing house in order to provide quality feedback and situational awareness to the user group as well as to the general CSIRT community. The clearing house collects events submitted by the user group (ISPs and CSIRTs) whereas the data is gathered by a combination of honeypots, IDS, and other sensors such as AV software. Our aim is to advise and to motivate other teams in application of security metrics and to promote information sharing.

Chip Greene

A leader in the GE CIRT, Threat Management Team responsible for the Operational Readiness of all analysts, technology and processes within Incident Response. The GE CIRT provides monitoring, detection and response services for all environments including enterprise, cloud and operational technology, across multiple businesses. Chip holds a Bachelor of Science Degree from Virginia Commonwealth University in Information Systems, and a Master’s Degree from the University of Richmond in Disaster Science, along with IT and Security industry certifications.

Conrad Layne

Conrad Layne is a senior cyber intelligence analyst with General Electric since 2013. In this role, Conrad tracks more than 50 Nation-state actors, their attacks, and TTPs with efforts focused on cyber-attacks affecting industrial control systems. Conrad holds a Bachelor of Science Degree in Digital Forensic Science from Defiance College and a Masters Degree in Cyber Security Intelligence from Utica College.

As industrial systems become increasingly cloud connected, threat actors are developing more sophisticated attacks against the IT/OT space. Unlike enterprise level attacks that have often targeted intellectual property or sought financial gain, the IT/OT space is particularly at risk for critical and destructive attacks by these threat actors. New defenses are needed. In this talk, GE CIRT will propose new strategies to track and respond to threat actors using frameworks like the Lockheed Martin Kill Chain and the MITRE ICS/SCADA ATT&CK framework. The presentation will also demo how these frameworks have been used to track, simulate, and stop malicious activity. 

Join us for an afternoon of fun challenges with an IR twist. We will provide the beat and the incident response scenarios where you can learn new skills and practice current ones against a set of simulated security incidents. Can you identify what caused the blues? What would you do differently? How can you architect multiple AWS services to prevent it from happening again? How do you automate the incident response? Take part in our jam to find out!

As the challenges develop, you will take the initial infrastructure, and challenge by challenge, improve it into a resilient and secure deployment. Use your knowledge of AWS services and information security to perform incident response in the cloud and forensic analysis to find out whodunit! We will have a number of experienced AWS experts in the room that will be available to discuss ideas, provide guidance and in general help your team get through any roadblocks that pop up. New to AWS? New to security? Come and join us! Our activities are structured to accommodate AWS users of all levels. We have AWS experts, plus guided exercises, that will ramp up your security knowledge. We will form team on the spot and provide challenges for you to tackle. Just bring your laptop to score the points by solving and get some cool prizes!

If you plan to join in on the fun Sunday, please submit your registration here so we can plan ahead for numbers: https://capsllc.wufoo.com/forms/first-2019-aws-security-jam-sunday-session/

Harry is the Technical Director for Incident Management in the UK's National Cyber Security Centre with over 15 years’ experience in cyber security.

One of the key tasks for a national CSIRT is to be a clearing house for cyber-incident notifications. The UK's NCSC receives information potentially related to incidents in the UK from a wide range of sources. Turning these raw notifications into actionable information packs and delivering them to the right person at the right organisation in the shortest time possible is a key responsibility for us. Drawing on case studies, this talk will discuss the challenges that we have had in this area, the steps we've taken to improve already and the steps we are still taking. These steps will be useful to other national CSIRTs and large enterprise CERTs as they are likely to have similar challenges and also to smaller CERT teams to understand the issues and to be a more informed consumer of these notifications.

Open meeting.

Agenda:

1. Introductions.
2. Brief history of the SIG.
3. Review draft document.
4. Open discussion on future of the SIG.

Yoshihiro Masuda (CISSP, CISM, CRISC) Yoshihiro Masuda, CISSP, CISM, CRISC is a manager for Fuji Xerox Co., Ltd. He has led launch of Fuji Xerox CERT, and is currently engaged in cyber security management of software products and cloud services Fuji Xerox offers. Also, he is devoted to development and dissemination of tabletop exercise method as a chief of Incident Simulation Exercise working group of Nippon CSIRT Association, Japan.

Chiyuki Matsuda is currently studying Finance at UC Berkeley after engaging in cyber security at an IT company in Japan for 5 years, where one of her main missions was incident handling. She has also contributed to CSIRT community in Japan (called NCA; Nippon CSIRT Association) by joining several working groups. This is second time speaking at FIRST Annual Conference as showing an accomplishment of a working group in NCA on incident handling exercises.

Yusuke Kon (CEH,CHFI,ECSA,CISSP) Yusuke Kon is a security analyst for Trend Micro Inc., and his current work is threat information sharing and product support. He has an experience on developing incident response exercising kits for eight years. Also, he is a member of TM-SIRT, a CSIRT of Trend Micro Japan.

Keisuke Ito Keisuke Ito is a member of IL-CSIRT, a CSIRT of NTT DATA INTELLILINK Corporation. Since 2014, he has been engaged in security incident handling in his company and customers. Also his another mission is support of CSIRT construction and application at customers.

Fumie Watanabe has been engaged in cyber security at IT company in Japan for 6 years. As a member of DeNA CERT, one of her main missions is cyber security training for employees. For her recent activity, she runs table-top workshops for employees. She is also actively running several CSIRT workshops of Nippon CSIRT Association, and contributing to activation of communication among CSIRTs in Japan.

Hajime Ishizuka is a senior consultant for NTT Security Japan KK, and his main work involves security planning, security assessment, support of setting up CSIRT, and CSIRT maturity assessment. He is also an expert advisor of Nippon CSIRT Association.

Toshiaki Ohta is an engineer for Yahoo Japan Corporation. He has experience in developing telephone exchanges for five years. After joined Yahoo! Japan in 2000, he has been responsible for the production of web content for entertainment (comics, music, and fashion). He is working as a project manager for cyber-range project "Yahoo! JAPAN Hardening" from 2016.

Tabletop exercise is an effective way to improve the capability of resiliency on incident response. Last year, we conducted a hands-on demonstration of our tabletop exercise method which provides two features: red team vs. blue team interaction, and random scenario creation using condition cards at the workshop in FIRST conference 2018. From the experience of the tabletop exercise done so far, we recognized the need to include the process of investigating cause of attack in the training so that a more realistic incident response training to be implemented.

We will conduct a hands-on demonstration of our tabletop exercise method which introduced investigation steps such as checking logs on a network architecture diagram. Basically, no prior knowledge/skills that attendees will be assumed, and hopefully it is desirable to have basic knowledge about network and system architecture.

Reference Security Incident Taxonomy Working Group – RSIT WG was created by ENISA and TF-CSIRT. The aim of this working group is to enable the CSIRT community in reaching a consensus on a reference taxonomy and improve incident classification https://github.com/enisaeu/Reference-Security-Incident-Taxonomy-Task-Force

Rossella Mattioli joined ENISA, the EU Cybersecurity Agency, in 2013. Over the years she has worked on threat modelling and security measures for Internet infrastructure, ICS/SCADA, smart grids, Internet of Things, smart cars and aviation. She is currently focusing on supporting European CSIRTs communities to build and advance their incident response capabilities, the “CSIRTs Network” and the Reference Security Incident Taxonomy Working Group.

As the need for information exchange and incident reporting increases, together with the use of automation, it is becoming evident that there is need for a common language to support incident response. Following a discussion among the CSIRT community @ 51st TF-CSIRT meeting, it was concluded that there is an urgent need for a taxonomy that serves as a fixed reference for everyone. This is why ENISA and TF-CSIRT created ‘‘Reference Security Incident Taxonomy – RSIT WG". This talk will present the latest version of the taxonomy, how the WG works and how this makes incident classification easier and more effective. All info at https://github.com/enisaeu/Reference-Security-Incident-Taxonomy-Task-Force

Open meeting.

Meeting Agenda:

1. Presentation of CTF SIG and results since 2017.
2. Some statistics and work done for 2019.
3. Discussion on goals and objectives for 2020.
4. Open discussions.

Banquet Cocktail Reception Sponsored by VMRay Conference Banquet Sponsored by IBM Resilient

Natsuko Inui works with FS-ISAC colleagues in the AP region to foster the community in sharing, collaboration and engagement in the Asia Pacific region. Previous to FS-ISAC, she was an Analyst at Cyber Defense Institute involved in government research projects regarding incident response and cyber-exercises. She is also Vice Chair of the Nippon CSIRT Association, the CSIRT community of Japan.

Cryptocurrency exchanges in Japan have been breached in the year of 2018, resulting in millions of losses. This presentation will cover a timeline of the major Coincheck breach that occurred in January 2018, what actually happened based on a report by the company, and how the Financial Regulators have been responding to cryptocurrencies and their breaches. This will give insight into how regulations and breaches in a new industry unfolds, the issues both sides are struggling with, and how both sides are addressing and trying to resolve the current issues. Many of the issues stem from cultural differences, including the gap between well prepared companies and emerging industries who have yet to address cybersecurity as part of their risk assessment. The information will be based on open source information that can only be found in Japanese.

More than 20 years of experience in ICT security. Founder and president of the Cybersecurity Foundation, leader of the ComCERT.PL team and former leader of CERT Polska team. In 2017-2018 he was the adviser to the Minister of National Defence of Poland on planning cyberdefence capabilities and building organizational structures as well as establishing international cooperation on the field of cyberdefence. Initiator of Polish Civic Cyberdefence organization. Co-founder of Open CSIRT Foundation - the stewardship organisation for SIM3 model.

European Network Information Security Agency expert and co-author of many ENISA publications including CERT exercises and papers on improvement CSIRT maturity. He organised 9 editions of cyber exercises in few countries for most essential sectors (e.g energy, banking). Speaker on many international conferences including the FIRST conferences. He is also the originator organiser Security Case Study conference.

The disinformation campaigns in the internet became the real problem. Most of these campaigns, especially those which are well organised, involve technical mechanisms, including malicious activities (like botnets). Thus CSIRT teams are asked for help and direct involvement. Should your team be involved? Should you agree on that and if so, what could be a real value brought by your team to resolve the problem? Are these value related to the monitoring services or rather surly reactive ones?

In Cybersecurity Foundation we run the project dedicated to this topic. We try to do practical things. We co-organised the dedicated exercises (tighter with ITU) for CSIRT representatives to check out how they could help INFOOPS specialists to better react to INFOOPS incidents. This topic is not only about general best practices but also about concrete technical activities, which CSIRT specialists could do during INFOOPS incident management.

Open meeting.

Agenda:

1. A brief intro to the SIG and the mission.
2. Overview of the content that the SIG has published.
3. Discuss and select the topics and activities for the next year.

Hakan Nohre is a Technical Solutions Architect with Cisco Systems specialising in Cyber Security and Secure Access. Hakan has over 20 years experience in IT security working with Enterprise customers. Prior to joining Cisco Hakan was working in Software Development and and as a Manager at Ericsson.

Hakan holds the CISSP and GIAC Pen tester certifications.

The Cyber Threat Response (CTR) Clinic has been built as a training platform based on the Cisco Security Integrated Threat Defense (ITD) architecture and solutions. Students will get to experience life-like cyber security attack situations in a virtualized enterprise lab environment, where they will get to play both the role of attacker and defender. Utilizing an environment that models after many enterprise networks, students will learn and understand how their own environments get compromised, how security breaches get detected, and how to respond with maximum effectiveness.

MEGAT MUAZZAM BIN ABDUL MUTALIB is the Head of Malaysia Computer Emergency Response Team or in short, MyCERT - a department within CyberSecurity Malaysia. He is responsible in Cyber999 Incident Handling and Emergency Response daily operation, which primarily focuses on incident alert or threat issue, related to Malaysia constituency and the Malware Research Centre. Has experience in IT Security for more than 10 years such as network security, penetration testing, web security, malware research and honeypot technology

DR. ASWAMI ARIFFIN is a digital forensic scientist with vast experience in security assurance, threat intelligence, incident response and digital forensic investigation. Aswami is active in research and one of his papers was accepted for publication in the Advances in Digital Forensics IX. Currently, Aswami is a Senior Vice President of CyberSecurity Responsive Services Division at CyberSecurity Malaysia.

The nation needs to develop a cyber-protective strategy that is able to provide adequate protection and response mechanisms at the national level and across CNII sectors. Computer Emergency Response Team (CERT) / Computer Security Incident Response Team (CSIRT) manage the organization's information security risk management to an acceptable level. The capability to have a functional CERT/CSIRT is seen as closely connected to the concept of CNII protection.

In addressing cyber threats at national level, several services that provide proactive response to malware threats are proposed. This presentation discusses reported cyber security incidents focusing on APTs and malware threats in Malaysia. The presentation further highlights several case studies on services being implemented in Malaysia, namely CyberDEF (Detection, Eradication, Forensic) and CMERP (Coordinated Malware Eradication & Remediation Project). The objective of these services is to reduce the number of malware infection in Malaysia. The presentation highlights the importance of having these services to ensure a secure, resilient and sustainable CNII.

Jasper currently works for Z-CERT as a Security Specialist. Jasper has been involved in security for some years now and likes to think that he brings the other view to the table. In his own time he likes to tinker with all sorts of technologies from analogue to digital ones and also plays the trumpet.

The healthcare sector is complex, consisting of a lot of different parties, standards and products. All of these parties have different threats. Attendees will be presented with an overview of the threat landscape for the Dutch healthcare sector including examples of responsible disclosures or incidents. One of the new threats is medical devices moving into patients’ homes. This change brings new risks, often overlooked by manufacturers. With this presentation Z-CERT hopes start new international collaborations within the FIRST community.

Open meeting.

Matt Linton is a Senior Security Engineer in Google's "Incident Management" team responsible for detection, response and remediation of serious security and privacy related issues. He is formally trained in Emergency Management, is an active Urban Search & Rescue Specialist, and has 20 years of experience in the information security industry. Prior to working at Google, he was Deputy CISO at NASA's Ames Research Center and a senior Security engineer for the Constellation space program.

In any crisis, communication issues are the most frequent cause of an incident going awry. Security and Privacy incidents are a stressful time when the ability to communicate clearly and quickly is both at its most necessary and most difficult to accomplish. Using proven methods for formal incident management which helped Google smoothly and clearly communicate during the Spectre and Meltdown disclosures (among others), this talk outlines how comms can go awry and provides concrete suggestions for how incident responders can prepare for and improve communications before, during, and after an incident.

Andy Applebaum is a Lead Cyber Security Engineer at The MITRE Corporation, where he works on applied and theoretical security research problems. Most of Andy’s work is in MITRE’s internal research and development portfolio on projects at the intersection of security, automation, and reasoning, including as one of the lead researchers on the CALDERA automated adversary emulation project. Outside of research, Andy is a member of MITRE’s ATT&CK team, where his current focus is on using ATT&CK for SOC assessments. Prior to working at MITRE, Andy received his PhD in computer science from the University of California Davis, where his dissertation topic was using argumentation logic for reasoning in security. Andy’s work has been published in multiple conferences and workshops and he has spoken at various industry and academic conferences. In addition to his PhD, Andy holds a BA in computer science from Grinnell College and the OSCP certification.

Adversaries rarely do things in a vacuum: many adversary techniques are stepping-stones that open doors to further execution opportunities, and not ends-in-themselves. Indeed, most techniques have functional requirements that must be met before execution; e.g., to use remote desktop protocol, an adversary must first have access to valid credentials. Understanding these relationships is important for defenders, as it can enable them to hunt more effectively and write better detections.

In this talk, we’ll present three studies we’ve conducted to find dependencies between adversary techniques. Our approaches include a data-driven approach that leverages the MITRE ATT&CK framework and a logical approach that shows how some techniques explicitly enable others. We’ll also present experimental results where we leveraged an automated adversary (CALDERA) to observe how techniques are interleaved in practice. Our results have wide applicability for defenders, and attendees should leave with a better understanding of the importance of technique dependencies.

Desiree is a Security Architect for a Security Operation Center in the financial industry. But through her career she worked in engineering positions for different security vendors and products, until in 2014 she finally became a Security Analyst. She now draws all of her experience from these jobs and her connection into the Infosec scene into creating efficient SOCs. Desiree is also a certified GCIA Forensic Analyst, Network Forensic and Cyber Threat Intelligence Analyst.

Have you ever wondered how to get a good sense about your security monitoring rules, but you didn't want to invest in yet another tool? Sometimes, we have all the solutions laying right in front of us and all we need is a different perspective. This talk is about giving this new perspective of the data you are already commulating, by making a small change to your security monitoring process. With a potential huge change in your workflow, and improved results.

Victor Sant’Anna (Nixu.com FI)

Victor Sant’Anna is a Senior Security Consultant working currently with PSIRT coaching and Digital Identity. Victor has worked in the Information Security industry for the past 18 years in various roles usually revolving PSIRT activities, Vulnerability management and Identity and Access Management. Human interactions and especially social engineering have always been a subject of interest, currently he is studying Social Psychology to complement his social engineering practical knowledge.

How to prevent you and your staff from being manipulated? A Social Engineering role-playing game to create awareness and introduce the methods for social engineering attacks and prevention. Security experts can use it to train their own organizations.

SE basic concepts, methods and techniques will be explained during the game. Play the roles of attackers and victims, identify the valuable social clues that can be exploited and engage in social attack scenarios. A lessons learned, wrap-up and discussions will follow to ensure assimilation by the participants.

No previous experience needed, no computers required during this session. Pen, paper & some imagination required.

So you think you are doing pretty good with your vulnerability management practices and then wham a severity 2.2 turned your world upside down. Yup I said a CVSS score of 2.2. This talk will tell an interesting story of a severity 2.2 issue that not only cost our company tons of hours of work, but caused our CEO to come asking about it. Stories of real situations are always great to learn from. We at NVIDIA learned a pretty good lesson about a third party reported issue and how better to handle it next time. Come walk through this story to learn about the mistakes we made and how we now have a better approach to all third party reported issues regardless of the score. Let our story be your story to better improve your PSIRT practice.

Dr. Lisa Bradley is the Senior Manager for NVIDIA’s PSIRT. Her responsibilities include the management and resolution of product security vulnerabilities involving all NVIDIA products. Lisa has 20 years of Enterprise-class engineering and leadership experience including 6+ years of experience leading PSIRT programs as she previously ran IBM’s. Lisa is part of FIRST’s PSIRT committee and contributed to the FIRST PSIRT Services Framework and training and PSIRT Maturity document. Lisa has spoke at many tech-related events including FIRST, BSIMM, DerbyCon, ISACA and Security Journey White Belt modules.

Dr. Lisa Bradley is the Senior Manager for NVIDIA’s PSIRT. Her responsibilities include the management and resolution of product security vulnerabilities involving all NVIDIA products. Lisa has 20 years of Enterprise-class engineering and leadership experience including 6+ years of experience leading PSIRT programs as she previously ran IBM’s. Lisa is part of FIRST’s PSIRT committee and contributed to the FIRST PSIRT Services Framework and training and PSIRT Maturity document. Lisa has spoke at many tech-related events including FIRST, BSIMM, DerbyCon, ISACA and Security Journey White Belt modules. *****

Jessica Butler is a Senior Application Developer for NVIDIA’s Security Tools team and is the lead developer for NVIDIA’s Portfolio Manager Tool. Jessica has over 12 years experience and earned her MS in Computer Engineering from Washington University in St Louis. She has certifications in Java, Ruby and a CCNA. In her free time Jessica enjoys gardening, kiteboarding and traveling with her family, BJ, Sebastian (4) and Eliza (2).

Did you know a software product is only as strong as what it consumes? The internal components, Open Source Software (OSS), and vendor products that your product relies on can leave you at risk if they do not have a strong security posture and vulnerability management process. We will cover NVIDIA’s path to better dependency management by integrating security into the design of internal components, putting together vendor/OSS questionnaires, creating a product profile tool to map dependencies, utilizing an OSS scanning system, and automatically creating bugs when a dependency has a vulnerability or update. A demo of NVIDIA’s product profile tool will be included.

John Holowczak began his cyber security career in Carbon Black's Security Operations Center (SOC), focusing on defense. With his domain knowledge, John moved onto Carbon Black's Threat Analysis Unit to focus on automation of threat detection and building out infrastructure for large scale malware analysis. Within the field of threat detection and analysis, John focuses on binary classification, dynamic analysis and Threat Hunting. He maintains an interest in tool development, both for CarbonBlack's SOC and for threat research.

Brian Baskin is a Threat Researcher with Carbon Black’s Threat Analysis Unit with a specialty in digital forensics, incident response and malware analysis. Baskin was previously an intrusions analyst for the US Defense Cyber Crime Center. For over 15 years he has researched responses to cyber threats. He has authored multiple security books and develops software for more efficient malware analysis.

Visibility is the core component in any SOC, from continual monitoring to incident response. While having a simple interface helps to display data, sometimes advanced hunting requires moving beyond the interface and delving into data that’s likely never been documented. This presentation focuses on building a better understanding of your environment and hunting for unknown threats that lie within.

Join us for the opening reception of the 31st Annual FIRST Conference! Beverages and light refreshments will be served. Newbies (first-time attendees and first-time members) are encouraged to arrive early to meet and greet with the FIRST membership committee and board.

Mr. Jermaine Roebuck serves as the Chief of Hunt and Incident Response Team for the Cybersecurity and Infrastructure Security Agency (CISA). Mr. Roebuck oversees a team of technical subject matter experts who perform operational and strategic-level analysis to support network defense and resilience across the DHS stakeholder community. His team leads the federal effort to respond to cyber incidents and proactively hunt for malicious cyber activity in public and private sector organizations and critical infrastructure. Mr. Roebuck and his team works closely with law enforcement, the intelligence community, and international partners to provide a coordinated and comprehensive response.

Mr. Roebuck brings a wealth of experience to his role with over 15 years in various cybersecurity and IT leadership positions. Most recently, he served as Chief of the Network Analysis Group and as an Engagement Lead within the Hunt and Incident Response Team. As an Engagement Lead, he led the federal government’s efforts to provide technical assistance to significant cyber incidents, including many large-scale data breaches in both the private sector and federal government. During large-scale breaches he leads teams focused on discovering and analyzing new forensic artifacts, finding new security controls to prevent and detect APT intrusions, and creating or enhancing opportunities for early detection and containment.

Mr. Roebuck holds a Bachelor of Science degree in Cyber Security from the University of Maryland University College and he possesses CISSP, GSEC, GCED, GCIH, and GCFA certifications to name a few.

Come learn to defend ICS! In this capture the flag competition, participants will be able to analyze live industrial control systems processes and data to identify the root cause of an intrusion. There are many levels to the CTF so even if you are not an ICS expert there will still be challenges for you to learn! Please bring your own laptop and any tools you desire to use.

Dr. Chih-Hung Lin has been in the ICT industry for over 20 years and focused on cyber security in the latest 15 years. His research covers Threat Hunting, Malware Analysis, Penetration Testing, and Digital Forensics. He is currently the director of TWCERT/CC at TWNIC in Taiwan. He previously led ICS security teams at Institute for Information Industry and was the head of Research and Development Team at National Center for Cyber Security Technology in Taiwan. He has been in close collaboration over years with universities, national and private research institutes and industries. He received Ph.D. in Computer Science from National Taiwan University of Science and Technology (NTUST) in Taiwan. He is the certificate holder of GCFA, GPEN and CHFI.

As the number of malware continues to increase rapidly, waiting two or three minutes for a sandbox to analyze a piece of malware has become intolerable. To improve detection efficiency, several sandboxes with multiple virtual machines (VMs) simultaneously to perform parallel computation have been developed. However, a few moments is still needed to perform dynamic malware analysis using the sandbox. This talk aims to reduce the latency of dynamic analysis by using temporal syscall measure for early stopping technology. This makes the proposed Sandbox consume less time performing dynamic analysis than the usual wait time needed for timeout. This solution does not serve as a substitution technology, but an augmentation.

Anthony Talamantes

Anthony Talamantes has over 18 years’ experience in Cyber Security Operations and Threat Intelligence, with the last 11 years working for Defense contractors. He managed the Information Security and Incident Response efforts at RAND Corporation, where he focused on cyber defense and incident response from Advanced Persistent Threats. Anthony joined Johns Hopkins University Applied Physics Laboratory in 2013 and is Manager of Defensive Cyber Operations, where he created intelligence and threat based cyber teams that specifically target advanced adversaries by blending Research, Threat Emulation, DevOps and Analytics to gain visibility in identifying Advanced Persistent Threats.

In performing Incident Response at multiple organizations, we have found that there is normally too much focus on the Cyber Teams as Incident Responders and following their prescribed playbooks. During an impactful Incident, representatives from an entire organization may be part of the Incident Response effort.

We will discuss how we have extended the love, Cyber Incident Response, to our family, other areas within Information Technology & Services. The goal is to build their skill levels to a level where they can participate and contribute to an Incident Response effort. Having a dynamic and extended team has definitely augmented our Incident Response capabilities.

Next steps is extending the love to other areas within the organization, including Legal, Human Resources, Public Relations and others to better prepare them for a significant Incident.

Chandan Nandakumaraiah is a senior manager of incident response at Juniper Networks, co-founder and director of OpenGrok Foundation for the advancement of human understanding of complex software and systems and a member of the CVE Automation Working Group. He has served in various software engineering and security incident response roles for large corporations since the start of this millennium. Chandan is a member of Vulnerability Coordination SIG, Vendor SIG and Ethics SIG, and has been attending FIRST annual conferences since 2005. Chandan holds a Master's degree in Computer Science and Engineering from the Indian Institute of Science.

PSIRTs have to keep track of diverse set of information from multiple sources for effective incident response. This includes communication with vulnerability researchers, coordinators, vulnerability related new feeds, social media, internal defect tracking systems, remediation management, product inventories and third party dependencies, people, release timelines, third party product vulnerability tracking, standard dictionaries, advisories, CVE ID assignments to name a few.

This presentation shares my experience at Juniper Networks in streamlining and automating PSIRT processes by pulling information from diverse sources and making use of new technologies to solve multiple challenges.

Tyler Halfpop is a senior malware researcher at Palo Alto Networks. In the past he has worked at General Dynamics Fidelis Cybersecurity and Salesforce. He has presented research at a variety of conferences and meetings including SANS, DerbyCon, Shakacon, and Hushcon.

Encrypted Office documents pose a difficult challenge to organizations and security vendors and attackers know it and are starting to utilize this tactic more and more. This talk will highlight analysis of multiple major campaigns utilizing encrypted documents as well as encrypted document file formats and different encryption methods utilized by Office. Attendees will also learn how to create automated systems to crack and analyze encrypted documents.

Chin-Wei Tien is a deputy director in CyberSecurity Technology Institute at Institute for Information Industry(III). Besides, he is also a PhD. candidate in the department of electrical engineering at National Taiwan University. His research area includes cloud virtual machine introspection, malware behavior analysis, IoT security, and blockchain security. Recent years, cyber security threats have become increasingly dangerous. Hackers have fabricated fake emails to spoof specific users into clicking on malicious attachments or URL links in them. This types of threat is called an APT attack. Because APT attacks use unknown exploits to trigger malicious activities, it is difficult to effectively defend against them. Thus, Chin-Wei focuses on this type of challenges security industry faced, and developed a Cloud-threat Inspection Appliance (CIA) system to defend against APT threats. Chin-Wei received 6 awards and 14 patents in his career life at III. These results demonstrated his past achievements and also his great potential in security profession.

The threats of malware in IoT devices are increasing in recent years, the amount of malware in IoT of 2018 has already over 120 thousand which is three times than 2017 and 10 times than 2016. However, we still have too less understanding about how to analyze IoT malware effectively unlike what we did in windows malware analysis. Thus, in this talk, we are going to introduce a framework for IoT malware analysis including detection and family classification. Differentiating to the best of our search for related works, this study chooses ELF opcode as main feature and conducting machine learning mechanisms to detect and classify IoT malware. We collect over 30 thousand of IoT malwares (Caught by IoT honeypot since 2016) for this study and design 19 features from ELF format and 8 categories of opcode instruction sets. The experiment result obtains 99% and 98% accuracy of detection and classification which can be used to demonstrate the effectiveness of our method.

Paul Jung

Paul Jung is since a long time a security enthusiast. He works in the security field in Luxembourg since more than a decade. During this time, Paul has covered operations as well as consulting within various industries. He possesses a wide range of skills and experiences that enable him to perform multiple roles from offensive security audit to security incident handling. From 2008 to 2014, prior to join Excellium Services, Paul was Senior Security Architect in the Managed Network Security department of the European Commission. In this previous position, Paul was responsible for leading technical aspects of security projects. He also wrote a few articles in MISC magazine (French) about DDos, Botnets and incident response. Since 2014, Paul works at Excellium Services as senior security consultant. He leads Excellium Services CSIRT (CERT-XLM). Within this position, Paul lead the response team involved in incident handling and intrusion responses. He provides security awareness and recommendations to Excellium Services customers. Paul is often speaker at local event and was multiple times speaker at Hack.lu and Botconf security conferences. His mother tongue is French, and he speaks English.

Rémi Chipaux

Rémi Chipaux aka Futex – @futex90. He is Working at Qintel as a Security researcher, thread intelligence and malware reverser. He works previously in Unix/Linux administration and since a decade in computing security in various industry (Bank, European institutions, etc..). He is a member of the organizer team of BSides Luxembourg and speaker. He also plays CTF challenges. Passionate by all hacking stuff since his young age, electronics, D.I.Y and beers (drinking and making).

We will propose a 3h Workshop and we are open to repeat it multiple time during the conference event. In the workshop, we aim to learn to the public how malware packers usually works to hide the original payload. We will learn to the audience tricks used by reverse engineers to unpack samples and dumps protected executables. Between each formal "lessons" slides, we will have hand on practice to unpack real malwares. We will show where breaking the application flow and what looking for in order to dump the real non obfuscated payload.

Open meeting.

Meeting Agenda:

1. Introductions.
2. Administrative Items.
3. Plans for Next Year.
4. New or Ongoing Metrics Initiatives and Resources Discussions.
5. Any Other Discussion Topics.
6. Wrap-up.

Piotr is a member of The Shadowserver Foundation, a non-profit with a mission of making the Internet a more secure environment. He has a strong CSIRT background, previously working in incident response at a national level for 14 years in the CERT Polska (CERT.PL) team. He managed the team for nearly 7 years up till 2016, building up its various security data gathering and analysis projects as well as managing its anti-malware operations, including numerous botnet disruptions. Piotr currently also serves on the Board of Directors of the Honeynet Project, a well-known and respected non-profit that is committed to the development of honeypot technologies and threat analysis.

David Watson, a member of the Shadowserver Foundation since 2008, a Director who leads the Special Projects Team in support of international Law Enforcement. David regularly presents and teaches classes at information security events and is passionate about helping network owners and cybercrime victims to defend themselves using tools and information sources that freely available. David was previously the Chief Research Officer and a Director of the Honeynet Project (2006-2016), helping develop and deploy security tools worldwide.

Nearly every day brings us news about how big IoT related attacks are and how much damage they cause. But how large are they really? The talk will provide an overview of how The Shadowserver Foundation collects information about IoT related attacks, malware and potentially vulnerable devices. These data collection processes are in many ways unique due to their sheer size and scope, hence able to give insight (even if of course incomplete) into the scale of the IoT problem. From daily large scale open services/vulnerable services scanning of the entire IPv4 address space, to sinkholing operations, honeypots and darknets, all these techniques give their unique views of current IoT attack and threat landscape. They do however come with their own set of problems and areas for improvement. We will provide some concrete solutions that can make things better. We will also demonstrate how Shadowserver conducts deeper dives into particular IoT threats and builds customized platforms for their monitoring to obtain more detailed insight. As a result of this wide set of activities, Shadowserver is able to present global and per country views of IoT-related problems, of which the most interesting cases will be highlighted in the presentation. By using a data driven approach to identify relevant threats, it is hoped that CSIRTs responsible for particular countries or networks can gain an understanding of where to focus their remediation actions to be most cost effective and offer the best return of investment in making their constituency and environment secure.

Anthony Talamantes has over 18 years’ experience in Cyber Security Operations and Threat Intelligence, with the last 11 years working for Defense contractors. He managed the Information Security and Incident Response efforts at RAND Corporation, where he focused on cyber defense and incident response from Advanced Persistent Threats. Anthony joined Johns Hopkins University Applied Physics Laboratory in 2013 and is Manager of Defensive Cyber Operations, where he created intelligence and threat based cyber teams that specifically target advanced adversaries by blending Research, Threat Emulation, DevOps and Analytics to gain visibility in identifying Advanced Persistent Threats.

The adversaries are evolving and we needed the agility to evolve with them. Our new philosophy of targeting the adversaries evolving TTPs with cyber hunting, needed the people, processes and technology to support it. We will discuss how we operationalized cyber hunting. We started with simple behavioral use cases and then expanded to more advanced use cases, looking for PowerShell, WMI and Kerberos manipulation activity. We will outline open source reporting, reference the MITRE ATT&CK model and discuss how we used threat emulation to operationalize hunt procedures. We are going to illustrate how we created analytics to identify advanced methodologies, used by some of the most advanced Nation States.

Chris Merida is an InfoSec Engineer for Cisco's CSIRT team. Before making a transition to Cisco, Chris was the founder of the InfoSec program at a health organization in Maryland where he participated in several local, state, and Federal events to shape the future of information security for healthcare in the region. After joining Cisco, Chris was assigned to the team that deploys, maintains, and optimizes CSIRT's SIEM on which the playbook is executed. He enjoys making "good" processes "better" and finding ways to utilize an organization's existing technology to improve security. In his free time, Chris enjoys music, organic coffee, and fine liquor (occasionally at the same time).

Jason Kmack is a an InfoSec engineer that works for Cisco's CSIRT team. His main focus is on developing software tools for security analysts to more efficiently do their jobs. Additionally, he works on improving backend processes and creating and improving data models for security reporting. In his spare time, Jason tries as often as possible to get lost in video games, television, and pints of micro brews.

Optimize Prime demonstrates how a CSIRT team can improve the efficiency of their SIEM to run plays faster and near real-time.. The tool receives a query from a user or playbook management tool, optimizes it, and provides feedback on how the user can restructure the query to be more effective. In this case, we use Splunk's built in optimizer, best practices for query structure from query experts, data source analytics (size of data being searched, measure of entropy for frequently used fields), and deployment benchmarking to provide the user with a faster query execution time. Operation of this tool reduced time-to-detect across all plays by 20 days over a year.

Francois did his PhD in the Crypto Group at UCLouvain in Belgium. His research topic was on the evaluation of side-channel attacks. Now, Francois is working as a security engineer at Thales Belgium. He continues research activities both during work and on his free time. Francois is interested in all security aspects, and is never bored to learn new things. Beers and video games are great too!

What if an attacker can get closer to your sensitive devices? This talk demonstrates how to exploit the electro-magnetic radiations emitted by electronic devices in order to recover cryptographic keys within seconds. We will first show how an affordable side-channel attack setup can be built. We will then show how the implementation of an AES-256 running on a 8-bit microcontroller can be attacked.

Lion Gu is security analyst of 360 Enterprise Security Group. He has been a security professional over 15 years. He graduated with a B.A. in Electrical Engineering, and holds several security certificates, including CISSP, CEH, CCNP. His interests covers all aspect of cyber security, especially malware analysis, cybercrime in general, and web security. He is an active member of local security community, where he helps businesses, academic institutions, and governments to improve security. He also has presented at conferences, including BlackHat, RSA, AVAR, CNCERT Annual, and so on. He was formerly with Forward-looking Threat Research Team of Trend Micro.

Driven by the increased value of cryptocurrency, cybercriminals are hijacking millions devices to mine cryptocurrencies by using cryptojacking malware. Unlike common malware which target small consumer devices, modern cryptojacking malware is designed to go after enterprise networks. Critical business can be impacted as a consequence of crashing application and even damaging hardware. This new kind of malware is one of major concerns of incident response teams.

Our talk attempts to bridge knowledge gap about cryptojacking malware and shed light on threat actors behind the malware. We will illustrate tactics, techniques and procedures of 8220 Miner Group which has been conducting cryptojacking attack for one year, and still active. We also give protection measures which derive from our comprehensive survey on 9 cryptomining malware families, including WannaMiner, MsraMiner, ZombieboyMiner, etc.

Gijs Peeters works as an senior advisor on public-private cooperation and international relations at the National Cyber Security Centre the Netherlands (NCSC-NL). Gijs has been working for some years now on stimulating different forms of public-private cooperation in the Netherlands and is one of the authors of different NCSC guides on how to set up your own cooperation in your sector (ISAC), region or supply chain (https://www.ncsc.nl/english/cooperation).

The Netherlands has a history of active public-private cooperation in different forms. This talk will present our long-term vision. We want share our journey of getting to where we are now, how we initially set up these different forms of cooperation and where we will go in the future. We’ll share our lessons-learned so that others can benefit from our positive and negative experiences and also create a network of clans in their country.

NCSC-NL has been working closely together with private companies for many years now — bottom-up and by ‘poldering’. We have learned a lot in setting-up sixteen sectoral Information Sharing and Analysis Centres (ISACs). This has worked well, but we want to keep improving. As cybersecurity is gaining importance and permeating our society, we believe central coordination is no longer possible. Thus we are striving towards creating a nationwide network of cybersecurity partnerships, including ISACs but also collective CSIRTs and regional forms of cooperation.

Open meeting.

Eireann is not a PhD student, though he is a lifelong student. He also believes in repeatable research. He lives in Edinburgh, and might even be wearing a kilt as he types his bio in the third person (though he copied and pasted Ankit's to preserve his dignity).

We do the economics to see what it would take to build a socialised ransomware response programme, stripping payment information from binaries, websites, onions. Then we use frequency analysis and the proportion of people who pay to work backwards into the sizes of infections. From there, we look at the wide variety of factors that determine how much it costs to clean up (DEFOCUS HOW MUCH IS PAID IN RANSOM), and come to some funding numbers about how we might approach this collectively, instead of individually as CERTs.

David Watson, a member of the Shadowserver Foundation since 2008, a Director who leads the Special Projects Team in support of international Law Enforcement. David regularly presents and teaches classes at information security events and is passionate about helping network owners and cybercrime victims to defend themselves using tools and information sources that freely available. David was previously the Chief Research Officer and a Director of the Honeynet Project (2006-2016), helping develop and deploy security tools worldwide.

Piotr is a member of The Shadowserver Foundation, a non-profit with a mission of making the Internet a more secure environment. He has a strong CSIRT background, previously working in incident response at a national level for 14 years in the CERT Polska (CERT.PL) team. He managed the team for nearly 7 years up till 2016, building up its various security data gathering and analysis projects as well as managing its anti-malware operations, including numerous botnet disruptions. Piotr currently also serves on the Board of Directors of the Honeynet Project, a well-known and respected non-profit that is committed to the development of honeypot technologies and threat analysis.

Domain Generation Algorithms (DGAs) are now used across almost all popular malware families to increase their resilience against botnet takedown attempts. However, DGAs have their weakness: they can be reverse engineered and current and future domains predicted. This can be done on an industrial scale, using malware datasets such as those of The Shadowserver Foundation (nearly 1 billion unique samples). Still, the problem of how to make DGA lists actionable for effective mitigation/remediation remains. Blocking or sinkholing DNS DGAs at the Registrar/Registry level is possible, but requires a significant amount of resources. However, what if we could blackhole/sinkhole DGAs at a recursive DNS resolver level instead? Enter the DNS Response Policy Zone (RPZ) mechanism. This talk will describe how any organization that runs its own recursive DNS server can gain access to Shadowserver’s new DGA DNS RPZ services to obtain real-time lists of DGA domains, that they can subsequently utilize in their own DNS servers to filter out queries from malware, locate victims in their network and collaboratively help save the world from DGA-enabled cybercrime!

Emilien Le Jamtel is security analyst for CERT-EU since more than 4 years.

In the world of cryptocurrency-related malware, mining botnets are a growing threat for organizations. We can observe that interest of malicious actors in CryptoNote-based currencies (likeMonero or Bytecoin) has increased dramatically because of the specificities of those cryptocurrencies.

In this presentation we explain why such cryptocurrencies are appealing to malicious actors, and how to leverage publicly available sources for hunting of CryptoNote-related malicious activities. We present tools to hunt and process CryptoNote-related malware samples, as well as how to use the generated data for threat analysis and indicator-driven monitoring activities.

Bisyron Wahyudi is the Vice Chairman of ID-SIRTII/CC (Indonesia Security Incident Response Team on Internet Infrastructure/Coordination Center) for Data Center Application and Database. He pursued his postgraduate study in Software Engineering from Institute of Technology Bandung and Université Thomson, France. Now he is a doctoral student at Universitas Indonesia in the field of network security. He is a computer scientist with over twenty years of professional experience in Software Application development. Broad range Solution Architect with various exposures on enterprise solution development, solution architecture design and solution delivery. He's also been working for more than ten years in the field of network and information security. He is actively involved in several information and network security working groups, workshops, and trainings in the area of cyber security collaboration, capacity building, critical information infrastructure protection, information security standard and compliance, incident handling and CERT/CSIRT establishment & management.

Asian Games is the type of high-profile event where every operational mistake can get blown up into a global incident and national crisis. The Asian Games is the biggest multi-sport games after the Olympic Games, the most prestigious event organized by the Olympic Council of Asia (OCA).

Every four years, the Asian Games capture the world’s attention as thousands of top athletes of Asia compete for medals, glory and national pride. As this mega event become further digitized, turning physical event into the most computer connected games, event organizers and sport officials are ever more concerned about cyber threats looming over the games.

Indonesia Asian Games 2018 Organizing Committee (INASGOC) is an official committee formed by the Indonesian government after Indonesia's appointment as the host of the 18th Asian Games. Id-SIRTII/CC as the national CSIRT of Indonesia together with IDCERT as the national CERT community were assigned by the government to assist INASGOC to guarantee IT (cyber) security during the holding of ASIAN GAMES 2018. The goal of IT security is to ensure that Asian Games Information System (AGIS) and the related working staff are protected from any uncontrolled issues, problems or risks that could compromise the performance and/or the usability of the AGIS services.

The implementation of the Asian Games requires very complex IT system support. All sport games cannot be run without IT. Organizing the IT Asian Games is equivalent to an IT service for companies with more than 50,000 employees and serves millions of customers and operates 24/7, with a variety of systems involving many multinational vendors. Given the criticality of IT to both event organizers and attendees, one area of critical concern was cyber security. Disruption to the digital side of the game can interrupt the overall implementation of sports games.

Turning the strategy and policies into an operational security program required us to develop measurements and associated infrastructure to provide a continuous view of its security posture, a data collection and analysis platform that could evaluate the millions of security alerts and telemetry to assess risk, design and build the network infrastructure to provide the appropriate security domains and control points and create an operations center to run the whole thing and respond to incidents. Integrated monitoring system was created to help collect, collate, sift, analyze and share vast amounts of information being collected by various sensors.

In this presentation, we intend to share our experience and describe the integrated monitoring system was provided to get end to end visibility and centrally manages all the sensor data collected and log elements of the network, server, application and endpoint device. This system’s ability to quickly analyze, adapt, and respond to threats at tactical speeds can mean the difference between success and failure. Additionally, this offers analysts and security officials the ability to detect and act early. Furthermore, we will also share the process of risk identification and assessment. This element is essential to developing the appropriate controls and the subsequent process of identifying potential threats and risks, developing mitigation plans, building audit processes, putting it into operation and optimizing operational efficiency.

Tamas is a Senior Threat Analyst at VMRay. He is responsible for finding and analyzing relevant malware samples and improving VMRay's detection capabilities. He is mostly interested in evasive in-the-wild samples, and exploitation. He is a regular contributor of deep technical blog posts in VMRay's technical blog.

In 2018 the ransomware-as-a-service black market has been taken over by a single malware family, Gandcrab. Besides its prevalence and rapid development, the family is also notable for burning a zero-day exploit of an antivirus software – something we expect from APTs, but is unique in commercial non-targeted malware of recent years. We tracked and analyzed each version of the malware from the start.

In this talk we present the various delivery methods used to spread the ransomware, and show how agile development allowed it to rapidly evolve and react to countermeasures. Based on our analysis of the malware variants and the zero-day, we also present upper and lower bounds of the capabilities of the adversary.

Paul Vixie was responsible for BIND from 1989 to 1999, and is the author of a dozen or so IETF RFC documents about DNS. He also started the first anti-spam company (MAPS) where he co-invented the DNS RBL (Realtime Blackhole List) that now protects all e-mail planet-wide, and was the founder and later president of the first U.S.-based commercial Internet Exchange (PAIX). Today he serves as CEO of Farsight Security, home of the Security Information Exchange (SIE) and the world's leading Passive DNS database (DNSDB). He managed the F-root DNS server from 1996 to 2012, and wrote the Cron software used on all UNIX-type computers today. He is also co-inventor of the DNS Response Rate Limiting (RRL) and Response Policy Zone (RPZ) feature-sets now in wide use to protect the operational Internet Domain Name System against online attacks. He received his Ph.D. from Keio University in 2011, and was inducted into the Internet Hall of Fame in 2014.

The Domain Name System has been a critical enabler of Internet growth since its inception in 1987. In the decades since then, the DNS resolution process has evolved from the LAN to the WAN, and to Anycast; it now includes DNSSEC validation, Extended DNS (EDNS) Client Subnet, larger message sizes, and I18N. The resolution processs has also been abused for surveillance, advertising insertion, and exfiltration. Today the DNS resolution process is poorly understood, and yet under forced revision. The trend is for DNS to be carried inside HTTPS where it cannot be monitored or controlled except by servers and clients themselves, and the dangers this will yield must be studied and discussed while the future remains flexible. Dr. Vixie will describe the past and present of DNS, and discuss its likely near term future.

Jan Pospisil: Jan is Senior Data Scientist at the Siemens Cyber Defense Center. He has a background in Artificial Intelligence and Machine Learning. Currently his focus is on building a Siemens-wide cyber defense platform based on AI. Before joining the Cyber Defense Center, Jan was Head of Data Science at Siemens MindSphere IoT platform. There, his focus was on manufacturing optimization, predictive maintenance, and digital twin.

Karl Peter Fuchs: Karl is Functional Lead for Security Monitoring at Siemens’ Cyber Defense Center. His focus is on improving the threat detection capabilities of Siemens and on automating related processes to prevent Security Analysts from repetitive work. Karl has a strong passion for trying out and applying new technologies and approaches. Before joining Siemens, he worked for several R&D facilities on Security, Privacy, Usability, Machine Learning, and Big Data.

Deep Learning has become practical in many domains, including Self-Driving Cars, Language Translation, Healthcare, and IT Security. Yet, the actual use cases in those domains where Deep Learning and AI can add real value are still eminently limited. Especially in Threat Detection it is a big challenge to design approaches that introduce an acceptable number of false positives when applied to large networks. In this talk, we show how we solved this challenge for a concrete use case: the detection of domain names generated by Domain Generation Algorithms utilized by malware to obfuscate communication. We give insights on the design and capabilities of the threat detection model and the underlying Big Data platform that enables continuous threat detection across more than 500.000 hosts on the Siemens corporate network.

Mr. Perttu Halonen works as information security specialist at the National Cyber Security Centre Finland where he is one of the responsibles for cooperation with social welfare and health care sector. In addition, he contributes to the national CERT function as a situation awareness coordinator. Prior to joining the NCSC-FI, he worked as research specialist at Nokia Corporation.

Health care sector cyber security is a hot topic. Improving the sector's cyber security is challenging: educating the large health care personnel that traditionally is not very inclined to security; protecting various connected medical devices from misuse; managing the cyber security in collaboration networks. Finland has taken an approach to develop the sector's cyber security with multiple concurrent actions with stakeholders on regional and national levels and influence on all levels. This presentation describes the goals and results of health ISAC, Cyber-Health development project and national cyber preparedness guidelines on health care sector.

Olivier is a Ph.D. student from the Design and Analysis of Communication Systems (DACS) group at the University of Twente. As a Ph.D. student he is working on malicious domain detection through active DNS measurements, for the last two years. Next to his Ph.D., Olivier is a voluntary system administrator at two study associations since the last five years. Because of his Ph.D. work he is closely involved with the OpenINTEL measurement project. This project is well established within the academic community, OpenINTEL data has been used in more than 20 academic published papers and helped in establishing academic collaboration worldwide.

In this talk (long presentation) we introduce the idea of pro-active threat detection using active DNS data. We give examples on how pro-active detection approaches can be applied to different types of attacks. We will detail the case of snowshoe spam, for which we have developed an pro-active detection approach, currently in use in the mail filter of a large Dutch operator.

Snowshoe spam is a hard to detect type of spam based on a large number of low-volume spammers, which typically evade traditional spam detection methods. We uncovered that domains set-up for snowshoe spam differ significantly from regular, benign, domains. We are not only able to detect those domains, but we show that we can do that considerably earlier than regular spam detection methods.

Our intuition is that predicting if a domain will be used for malicious intent might reduce the damage done by attackers. CERT teams may configure their systems to be extra vigilant towards domains predicted to be malicious. Our ultimate goal is to make the Internet a safer place by making an early prediction to the nature of a domain via pro-active blacklists.

Closed meeting - members only.

If you would like to join the TLP SIG, please e-mail your request to Don Stikvoort at tlp-chairs@first.org or talk to him at the conference.

Open meeting.

Open meeting.

Art Manion is a senior member of the Vulnerability Analysis team in the CERT Program at the Software Engineering Institute (SEI), Carnegie Mellon University. Since joining CERT in 2001, Manion has studied vulnerabilities, coordinated disclosure efforts, and published advisories, alerts, and vulnerability notes for CERT/CC and US-CERT. Manion currently focuses on vulnerability discovery and other areas of applied research, including ways to automate and improve operational vulnerability response. Prior to joining the SEI, Manion was the Director of Network Infrastructure at Juniata College.

Leigh Metcalf has a PhD from Auburn University in Mathematics. She has been at CERT for 9 years as a Cybersecurity researcher and is the co-Editor-in-chief of ACM Digital Threats: Research and Practice. She is also the primary author of the book Cybersecurity and Applied Mathematics and a co-author on the book The Science of Cybersecurity (in preparation with World Scientific). Leigh specializes in analyzing assumptions found in Cybersecurity research and has written and released open source software.

Madison Oliver is a vulnerability analyst in the CERT Coordination Center (CERT/CC) at the Carnegie Mellon University Software Engineering Institute. She has been performing coordinated vulnerability disclosure at the CERT/CC for just over a year and supports Common Vulnerabilities and Exposures (CVE) efforts both at the CERT/CC and in multiple CVE working groups. Before joining the CERT/CC, Oliver studied cybersecurity for six years at both the Pennsylvania State University and Carnegie Mellon University. She has presented at ShmooCon and other local conferences. When she is not busy trying to make the Internet a safer place, she serves on the alumni board at the Pennsylvania State University mentoring young women studying cybersecurity.

This one-day course is designed for those responding to vulnerabilities. It will provide an overview of key issues, processes, and decisions that must be made to either create or better support the response efforts of a PSIRT team. Attendees will develop an action-plan for vulnerability response as they work through their current processes, or during design a PSIRT capability if one does not exist.

The course is composed of lectures and class exercises. Participants will learn the requirements for establishing an effective PSIRT team, the various organizational models, the variety and level of services that can be provided, and the types of resources and infrastructure needed to support a team.

This course supports the FIRST PSIRT Services Framework, and explores a subset of the elements covered by the Framework.

Jeroen van der Ham is researcher at NCSC-NL and assistant professor in the Design and Analysis of Communication Systems (DACS) group at the University of Twente. At NCSC-NL he focuses on coordination of academic cyber security research, the many developments in coordinated vulnerability disclosure and ethics of the security profession. At the University of Twente he focuses his research on ethics of internet security research, denial of service attacks, and anonimization in network measurements.

Shawn Richardson is the technical lead for Palo Alto Networks Product Security Incident Response Team (PSIRT), driving product security incidents from initial disclosure to full resolution with security researchers, engineering, quality assurance, and customers for the company. Prior to joining Palo Alto Networks, she spent over 15 years at Microsoft in various security and privacy roles including in the Microsoft Security Response Center. Ms Richardson was also a contributor to the ISO 29147 and ISO 31111 standards.

In this talk we will walk through the current work in progress in the Ethics SIG, describe our goals and explain what it will mean for you to have a code of ethics for FIRST.

Doug Wilson (Ex-Mandiant, FireEye, Uptycs) has almost 20 years in security, but if you look way back, his college degree is actually in design! When not doing security, he has spent a fair bit of the past 15 years attending events that focus on design, and believes that design elements are critical to success in security pursuits. He has presented at numerous security conferences over his career, as well as talks and a workshop at FIRST.

Nguyet Vuong has 16 years of experience as digital designer, and is currently a Co-Founder and Design Lead for Civil (www.civil.co). She has won design industry awards, given numerous presentations, and facilitated workshops on design. She believes in honest and transparent design patterns that respect people’s time and intelligence. She regularly tries to spread the word of how design thinking and processes can make other fields better, including security.

The fields of security and design are eerily similar. Both are interested in challenging the status quo for processes, products and applications. Both spend a lot of time examining unusual and unplanned behaviors from both users and applications. And both are fields where success or failure tends to come down to the humans involved, despite amazing technical innovation

Security practitioners, however, are sometimes overly focused on the negative. This may cause them to lose track of some ideals that are core to design, and can lead to problems in communication, inclusiveness, and the creation of equitable solutions.

By adopting practices that come from the positive side of the equation in the design field, security practitioners can improve their communication and solve problems at different levels. This talk will introduce several tools that designers use in their work on a daily basis, and propose how they can help security practitioners.

David Watson (The Shadowserver Foundation, GB)

David Watson, a member of the Shadowserver Foundation since 2008, a Director who leads the Special Projects Team in support of international Law Enforcement. David regularly presents and teaches classes at information security events and is passionate about helping network owners and cybercrime victims to defend themselves using tools and information sources that freely available. David was previously the Chief Research Officer and a Director of the Honeynet Project (2006-2016), helping develop and deploy security tools worldwide.

Stewart Garrick (The Shadowserver Foundation, GB)

Stewart Garrick is a former Senior Investigating Officer with Scotland Yard and latterly the UK’s National Crime Agency. He led many of the NCA’s high priority cybercrime operations. Upon ‘retiring’ he joined The Shadowserver Foundation’s Special Projects Team, where he uses his 30 years of experience to help Law Enforcement around the world lead complex, successful cybercrime disruption operations.

Botnet takedowns are challenging and complex activities, requiring long-term technical analysis and highly coordinated, cross-jurisdictional cooperation between public/private entities. They also involve fighting back with the skill, agility and imagination matching the criminals. Success culminates in a shutdown of cybercriminal operations, sinkholing of botnet C&C infrastructures, ideally actor arrests, and media attention. Botnets can be massive, global and abuse DNS at scale. Shadowserver’s privileged position as a go-to partner to many international LEAs allows us to provides a candid insight and lessons learned to better understand how to combat these significant threats.

We describe Shadowserver’s first-hand experiences in this niche arena, drawing on recent cases (e.g. Kovter/Boaxxe, VPNFilter, Magecart, Kelihos, Mirai, Avalanche/Andromeda) as well as newer operations by the time of the conference. We also consider opportunities for engaging CSIRTs in communities of interest as active providers of information, as well as traditional victim remediators.