Already some years ago malware has evolved with the aim of obtaining economic benefits from their infections, which among other things are the theft of credentials, access to electronic banking accounts or the rental and sale of zombie networks for carrying out DDoS attacks or sending spam. Nowadays, this professionalization is known as 'Malware as a Service'.
The talk is intended to give an idea of the state of the art of today's malware - major players, behavior and institutions involved. The focus will be on one of the main malware families we face today: Zeus / Zbot / Wsnpoem.
Wsnpoem is a banking Trojan active since years which has evolved over the time also by making it increasingly more difficult for researchers and security experts to analyze it. This is done by using different types of encryption methods and hiding techniques, new features (screenshots, execution of binaries...) and changes in the C&C structure.
The presentation aims to give technical information about its evolution including recent changes such as the new process of extracting the encryption key for the configuration files (live demo).
Presented by members of the e-crime S21SEC
The e-crime group is a unit of the dedicated security company S21SEC - on behalf of investigating cases of fraud for organizations, the study of new Internet threats and vulnerabilities, malware collection and analysis, search for stolen data and research of all threats about current cybercrime.
The Conficker (also known as Downadup) worm is the most prolific computer worm the world has ever seen. Since surfacing in November 2008, Conficker and its variants have according to numerous estimates infected more than 11 million Windows systems worldwide (far more than MSBlaster ever infected), and the number is growing daily. The phenomenal success of Conficker comes in the face of a pronounced trend in which fewer and less prolific worms have emerged in recent years, causing experts to pronounce the demise of worms and other types of self-reproducing malware. Conficker has clearly proven these experts wrong. Strangely, this worm's main attack vectors, exploitation of a Windows vulnerability and password guessing, are nothing out of the ordinary. However, Conficker's use of "drones" that scout out domain names for targeting purposes is has proven to be a novel and highly successful mechanism. Additionally, a number of this worm's authors are constantly changing Conficker's functions and mechanisms in ways that the white hat community has not been able to anticipate. The end of Conficker's life is thus nowhere in sight.
Conficker is more than just an interesting piece of malware to analyze, however, Conficker has become so prolific that it is forcing the information security community to re-think the self-reproducing code threat and to re-evaluate currently accepted approaches to countering this type of malware. Given the failure of a considerable proportion of anti-virus software and endpoint security products to stop this worm, vendors, too, have been forced to consider substantial changes in their products. And given the high percentage of systems that were not patched (and still are not patched) for the vulnerability that this worm exploits, the controversy concerning whether Microsoft should be given license to force critical updates into unpatched Windows systems has re-emerged with greater intensity than ever before. This presentation delves into these and additional extremely important issues that the Conficker outbreak has raised, with the goal of facilitating discussions that will help attendees re-evaluate today's self-reproducing code threat and come up with satisfactory solutions for their own information security practices.
Key principles of agile software development were written in the agile manifesto in 2001. Human interaction and collaboration are valued more than strictly defined procedures. The results which meet stakeholders' requirements are more important than comprehensive documentation. Changes are welcome at any stage of the development process - which is often a nightmare in the traditional waterfall development model.
In security management we are still facing the same challenge as software developers did before the "age of agility". Most security management standards and practices are like the waterfall model in software development - well defined but often too rigid to react to the turbulences of modern business environment which requires quick reaction to continuously emerging new challenges. We as security practitioners also have a lot to learn from manufacturing management where the concept of lean manufacturing is widely applied. The concept of agile manufacturing has also been introduced.
Including security in software projects managed with agile methods has also been widely discussed. However, agile security management methods seem to missing in the field. Agility is often seen as gradual erosion of good security - agility and security just cannot coexist. But it is not necessarily so. This paper introduces the concept of agile security management - how to respond to changing business needs at the same time ensuring that security meets the requirements defined in legislation, standards and contracts.
One way or another, cloud computing seems determined to be on your radar. Whether it's your CXO, your customers or even your staff, someone is either going to be asking you about it, doing it, or trying to keep you from knowing they're doing it. You can't afford not to be prepared and understand not only the fundamentals and current definitions of cloud computing, but you also need to be able to get beyond the buzzwords, the hype and the fear, uncertainty and doubt (FUD) presented everwhere from the Wall Street Journal to trade magazines to vendor brochures.
This session will provide a brief overview of the current cloud computing landscape, including:
- The different definitions and approaches
- The claimed business benefits and opportunities
- The most touted security issues and risks
Following this introduction, we will examine the potential business value, opportunities and risks in more detail to identify the ones that are likely to have a real impact on your organisation. After this session, you should be able to understand:
- The relationship between cloud computing, virtualisation, Software as a Service (SaaS), SOA and other types of outsourced services
- Whether cloud computing is a real option for your organisation
- The unique information assurance and security challenges posed by cloud computing
- What you can do to prepare yourself and your organisation for evaluating, deploying and leveraging cloud computing services
- How you can begin to assess the level of enterprise information already being managed externally by such services as Amazon's S3, Google Data, and end-user productivity suites like Google Docs and MS Office Live
As organizations have increasingly become dependant on information technology to facilitate business operations, information has grown to become an asset critical to an organization's survivability. In order to ensure the protection of information as an asset information security managers have become a common position within organizations. However, information security managers face a myriad of challenges including changing risk profiles, lack of funding, cultural issues and internal and external threats.
The human resources of the organization and the organizational culture which they operate within are critical components to security program success. Culture may dictate patterns by which people behave. The human resources within an organization can choose to follow security policies or choose not to. If strong governance is not in place and senior management does not make it known that information security is a priority for the organization, employees may not bother with security. Insiders are often the top threat to an information security program and account for many unknowns. Organizations must understand the importance organizational culture has on the information security program.
This 75 minute symposium session will focus on understanding the impact that culture has on the success of an enterprise's information security program. There are many different aspects of culture which will be discussed. The session will also present thoughts on how to create an intentional culture which is favorable to the information security program. While making cultural change is often a daunting task it is possible and can have tremendous benefits for the security program and ultimately, the organization.
On Nov. 5, 2008, two Los Angeles traffic engineers, after first pleading not guilty, pled guilty to illegally accessing a city computer. The pair, at work on Aug 21, 2006, used stolen manager ID's to hack one of their traffic computers and sent commands to maliciously modify four signal control boxes at critical intersections. No one was killed, no accidents were even reported, but it took 4 days for LA traffic to get back to its usual semi-controlled, semi-chaotic state.
The plea bargain doled out minimal penalties for this crime, but the mind boggles thinking about possible consequences of similar exploits in the future (see San Francisco, 2008). We'll analyze this incident, ask some questions, and pose some "what if" scenarios. We'll also discuss whether this constituted a failure of security awareness, why the punishment was so miniscule, what other factors (union, LA City culture, etc.) played supporting roles, and how an incident like this and its fallout can be used effectively in an Awareness program. Then we'll tell you the scariest part.
This will be very COSAC, a highly interactive session with much potential for disagreement, varied analysis and lessons learned from real-world experience.
| C5 |
The Elephant Cookbook: Countering Social Engineering |
Jon Colombo |
When I talk to colleagues about this topic, I cannot but help think that this is an 'eating-the-elephant-in-the-room' problem:
Few are willing to admit that there is one there, let alone how large it is
… of those that do, most think it is far too big to tackle, and even if it wasn't they'd not be able to cut the skin
… of those remaining, hardly any know how to slice the elephant, let alone the right way to cook the bits
Just to confuse matters, many of the so-called recipes that do exist, rely on the beneficial properties of snake-oil for their efficacy
At last year's Cosac I introduced compelling evidence that turned the spotlight on the elephant and pointed out some of its vulnerabilities.
This year, I've been looking at slicing strategies, and recipes for the bigger bits. Whilst the Deliah Smith 'Complete Elephant Cookbook' is still some way off, she would probably want to come along to this session to get some hints.
Based on ongoing research into the field, this session aims to push forward understanding of the topic. It will:
Recap the ground covered last year
Look at the reality behind some of the myths that are out there
Propose an overall approach and some techniques that seem to work
| D3 |
Fundamental Components of "Usable" Operational IT Risk Management Systems |
Michael Legary |
Can you make sense of security control monitoring in your organization? Can you determine, visualize or communicate any true point-in-time posture of enterprise security? Can you answer these questions with a straight face?
Our organizations are becoming saturated by function specific information security tools such as SIEM, DLP, IDM, TRA Tools, Automated Vulnerability Assessment and IT Risk Registers.
Our organizations' security policies are often driven by compliance with little ability to detect actual harmful events or scenarios impacting the business. Management and executives have no first hand visibility to security issues impacting their areas of responsibility.
We have the technology to overcome these challenges and harness the true power of our control infrastructure, but where do we start?
An Operational IT Risk Management system is the first step towards aligning traditional risk management requirements of the organization with the IT controls and decision sub-systems we have littered throughout the organization.
Michael will discuss several key technologies and technical challenges in the building of a usable Operational IT Risk Management System (OITRMS) and provide examples of real world implementation failures. Highlights will be provided regarding key technical developments in this field of research and the major challenges to be resolved. The presentation will be followed by a discussion of the achievable goals of an OITRMS and how it is enabled by technologies already available in our organizations.
We live in a world of surveillance and the UK has the most CCTV cams deployed in the world. I know there has been a lot of publicity on CCTV, but I would like to explore the other world in this session. We are going to cover the world of the CCTV online, WiFi cams, IP cams that are used as remote surveillance, internal security, office and home monitoring and the crazy world of robot cams that you can travel around your property remotely with.
Who is affected you ask?
Anyone who installs a CCTV camera or any sort that is connected live to the internet.
As usual I hope this will be a fun presentation with a lot of "What if's?" and "Could I" statements from myself and the participants.
In the next 2 years the present IP address space - (IPv4) - will reach its capacity. The new Internet currently under development will have enough IP addresses for every human being on the planet to have a personal network the size of today's internet. Why? Because the next internet will connect "things" to other "things". The Internet of Things" will be possible through the use of "smart objects"
Smart objects will enable a wide range of applications that will improve our lives in many areas such as energy management, healthcare, and safety. The recent progress in low-cost embedded devices is about to make the Internet of Things a reality. For this to come true, we must learn from the lessons of the past and adopt a flexible, scalable, efficient and open based networking technology. But most of all we must master IP security.
This presentation looks at the "Internet of Things" and the associated security challenges. In a thought provoking style the presenter will discuss the obvious (and not so obvious) security issues of having your car, cat and oven on the same network. The impact of hacking takes on a whole new significance. Are we as security professionals ready for this challenge? The material will also cover the technology of "smart objects", the use of RFID and GPS technology to network "things". The approach is both philosophical and common sense subject matter invaluable for today's information security professional.
Imagine, a court jurisdiction that is 2,645,615 Sq Km in size.
Imagine a place where public servants drive large 4WD not for status but to get to work.
Western Australia is the second largest administrative division in the world with one of the lowest population densities, the people are known as sandgropers and the insects are everywhere.
Establishing a business driven security architecture for an organisation that has developed and grown security at an operational level is challenging enough. When the customer is also an internal IT service provider to multiple other State Government agencies and has multi-sourced its technical responsibilities the project becomes interesting. This case study will outline how these challenges are met and in most cases overcome.
We will delve into the pragmatic approaches to modify the SABSA framework to suit multiple stakeholders that were not beholden to each other. These stakeholders at different times have corresponding, competing and conflicting requirements and drivers.
"This is all very good but what does this mean for me?" is the question stakeholders ask when they are happy to share requirements but would prefer someone else, in this case the internal IT service provider, to pay to achieve the result. The SABSA framework allowed the project team to provide clarity for all stakeholders about requirements from the board to the wiring closet. It helped identify where requirements are achieved and where they are missing. The case study will explain how the cats were herded, and most importantly how to pull all the information together and create a cohesive framework.
Despite advice to the contrary, the journey was made to "modernise" the Enterprise Security Architecture at one of Australia's big four banks. This journey was undertaken to facilitate a merger, position the bank architecturally to meet the challenges of "de-perimitisation" and both contemporary and future threats. All this as well as address the common issues that typically haunt an enterprise trying to fit the brave new world of multi- channelling, application integration, cloud computing and other exotic 3rd party associations into the traditional web based 3 tier reference architecture. Oh and also reduce costs and time to market………..
This session will provide fast and furious run through on how, why, where, what when and to whom the SABSA method (aka the "Matrix") was applied.
Layer by layer it will move through the challenges (any references to onions is not required to shed a few tears) such as:
- Project Scope issues - did we really try to eat an elephant?
- What are we delivering - the artefact format question. Does it already exist?
- Who should be doing what - political boundaries and dependencies
- Closure criteria - how do we know when we get there - what is good enough to move on to the next step
- So how do you relate this to COBIT? Making it meaningful to everyone else
Along the way some amazing compromises, decisions that while they may either make you laugh or cry, will definitely make you think again!
(Note no IBM reference architectures / product placements used - but be prepared to bring your blue SABSA book)
| S3 |
Developing a Solution Security Architecture using the SABSA Development Lifecycle |
Pascal de Koning |
SABSA is a framework for Enterprise Security Architecture. When developing a security solution the scope is not enterprise-wide, however the SABSA Development Lifecycle still can be very useful in this case.
This presentation gives a practical approach to fill in the Contextual and Conceptual layer of the Solution Security Architecture. This approach:
- deals with constraints derived from the existing environment, law and regulations, risk management, etc
- makes use of the well-developed requirements management approaches in software development and references to a very useful method for requirements managent
- Defines a set of Solution Quality Attributes at the solution level (comparable with the Business Attributes at Enterprise level)
This is still work under construction, so comments and thoughts are more than welcome. Some parts of this approach have been tried in a real world case and have proven their value. These will be shown to illustrate the method.
This session delves into a long standing pain point: errors of omission, exemplified by late problem detection causing delays, irritation and non-compliance. It does not take a theoretical view point: things are as they are. Rather the idea is to find out what the problems really are and what to do about them.
In this case, the nice top-to-bottom, all business driven and linked two-way is the theoretical heaven. But all of security, audit and infrastructure have a parallel circuit to do their job well.
Ignoring these realities will not improve the situation. Rather, integrating their views in the enterprise architecture processes seems not only possible but even highly preferable. Is heaven on earth possible, or not? The proposal suggests we can at least get out of the big heat.
The proposal touches on a difficulty that is inherent: it is suggested that security and audit are not merely controlling bodies, but take on a role as advisory and partner. This trend is clearly present, but we run into a potential governance issue: combining the roles of advisor and controller is dangerous for conflict of interest.
As far as I am aware, there are not yet presentations that attempt to integrate these isolated approaches in their own worlds into larger frameworks like SABSA ®.
Security must be more effective and far better integrated in normal (enterprise) architectural practices.
But that means that the value proposition must be there: if at the end of the ride tests for security and compliance still fail frequently and unpredictably, this proposition is not good enough.
Enterprise security architecture is the right vehicle: there is a need to build an organization and processes that make this happen, and that is far more important that new checklists, blueprints or controls.
The author expects to be challenged on many aspects of this proposal. The main positive feedback would be a confirmation that practitioners agree that this may be the root cause for some persistent problems, and that the solution direction is promising. He is also very keen on discussing the possible approaches to come to a better integration of the existing practices and to use the experience that is likely to exist in the COSAC audience.
| S5 |
Business Enablement - A Systems Integrator's Perspective |
David Baker |
Do you encounter problems when trying to get support for security projects?
Is your security framework not quite meeting its risk management objectives and losing understanding or popularity within the business?
Looking for innovative ways to use security architecture principles before the framework exists?
In this session, David intends to cover some well trodden ground with what he hopes will bring some fresh ideas for people who are in these situations. By recapping on the key principles of a security architecture framework, new ways of both positioning the value of the framework itself, and value of identifying and tracing business enablement objectives may become obvious.
Working for the Australian security line of business of Dimension Data, a global systems integrator, David specialises in the medium to large enterprise space across multiple commercial and government sectors. Dealing with a multitude of customers places David in a unique position to witness the success and failure of security projects under many scenarios, where different business drivers, risk appetite and budget capacity are constantly evaluated. This has both enabled and driven David and his colleagues to create innovative ways to engage with clients with these differing requirements, in a flexible but repeatable manner.
Session Topics
Promoting security architecture as a business enablement tool
- Traceability & Flexibility - two essential focal points of SABSA
- Sizing security architecture development
- Successfully introducing architecture early in the IT maturity cycle
Using business enablement objectives
- Representing positive gain/business enablement
- Should we create enablement objectives for existing controls?
- When to use enablement objectives
How do we use SABSA as a system integrator - Case Studies
- Examples of when we use SABSA principles in a typical SI engagement
- Driving increased revenue
Imagine your organisation has been the victim of a crime, a large scale fraud perpetrated over years. You make a complaint to the police and then what?
This talk will consider how corporate complainants are dealt with by the English criminal law and some practical steps you can take in the hope of making the process as painless as possible.
- How will the police react to your complaint?
- What can you expect of them and what will they expect in return?
- Taking control - identifying the right person to make the statement.
- Gone fishing - disclosure to the defence and what it will mean for your company in reality.
- The trial process - what is it like giving evidence and how can you prepare?
- The sentencing process - do you have a say, will you get compensation?
Whilst most COSAC papers are interactive, few deliberately set out to make the audience do the work. This is an exception. Come along to get a real feel for what it is like to be at the centre of a corporate crisis.
Inspired by the court-case scenario during last-year's COSAC, we'll be going one stage further - this time the delegates will be the actors. Structured like a 'murder mystery evening' the session will work through a crisis management scenario. Groups of delegates, acting as 'crisis teams' will respond to a situation as it develops.
We don't want to give too much of the plot away, but we can say that:
- this will not be the usual bomb/fire/flood scenario
- it should make you think, demonstrating some common pitfalls
- it should spark debate and hopefully decisions (albeit in a simulated situation)
- it should be fun!
By the end of this experience participants (there will be no passengers!) will appreciated that:
- The Crisis Management Part of BCP ain't simple - there are some common traps.
- Rehearsals can and should be both fun and useful
- BCP isn't just about physical disasters
