Cyber Crime Conference
The 4th Annual IRISSCERT Cyber Crime Conference was
held on Thursday the 22nd of November 2012 in the D4Berkley Court Hotel,
in Ballsbridge Dublin. It was an all day conference which focused on
providing attendees with an overview of the cyber threats facing
businesses in Ireland and throughout the world and what they can do to help deal
with those threats.
Experts on various aspects of cyber crime and
cyber security shared their thoughts and experiences with attendees,.
The IRISSCERT Annual Conference is an
opportunity to not only increase your knowledge but also to meet and network
with your peers in a relaxed environment. The Cyber Crime Conference for 2013 is
scheduled to be held on November 21st 2013.
In parallel to the conference, IRISS also
hosted Ireland's premier Cyber Security Challenge to identify
Ireland's top cyber security experts. These experts competed against each other in a
controlled environment to see who would be the first to exploit weaknesses in a
number of systems and declare victory. The purpose of the competition is to
demonstrate how attackers could gain access to your systems and allow you to
learn from the event on how to prevent such attacks from impacting your network.
Keynote Speaker -
Marcus J. Ranum, Chief Security Officer of Tenable Security, Inc.
Marcus is a world-renowned expert on
security system design and implementation. Since the late 1980's, he has
designed a number of groundbreaking security products including the DEC
SEAL, the TIS firewall toolkit, the Gauntlet firewall, and NFR's Network
Flight Recorder intrusion detection system. He has been involved in every
level of operations of a security product business, from developer, to
founder and CEO of NFR. Marcus has served as a consultant to many FORTUNE
500 firms and national governments, as well as serving as a guest lecturer
and instructor at numerous high-tech conferences. In 2001, he was awarded
the TISC "Clue" award for service to the security community, and also holds
the ISSA lifetime achievement award. In 2005 he was awarded Security
Professional of the Year by Techno Security Conference.
Cyberwar in the era of Stuxnet
We all know Stuxnet was a significant
historical event in the time-line of computer security, but most of us are
unsure what it means, practically and professionally. Are the "big
scenarios" of cyberwar - countries knocked back to the pre-industrial age -
just around the corner? How much do we really need to worry about
state-sponsored cyberwar? Marcus will offer some perspectives on how this is
likely to play itself out.
Michael Moran, coordinator for
Crimes against Children, Interpol
Michael Moran is the coordinator for
Crimes against Children at INTERPOL, the International Criminal Police
Organisation. This team, based within the Serious Crime directorate at
INTERPOL specialises all aspects of international criminality against
children and especially in online child sexual exploitation. His duties
include management of international networks of officers working in the
field including the INTERPOL Specialists working group on Crimes against
Children, the International Child Sexual exploitation database and victim
identification network along with International Operations. He is also the
INTERPOL representative with the VGT and ICANN (GAC observer). From November
2011 to July 2012 he was temporarily deployed as acting Assistant Director
Cyber Security and Crime for the INTERPOL Global complex for Innovation in
He has an MSc. in Forensic Computing and Cybercrime Investigation from UCD
(MSc FCCCI) and a BA (Hons) IT, from IPA as well as a diploma in Project
Management from UCC. He has a higher Diploma in Information Systems and is a
certified Internet Webmaster Professional.
He is an advisor to the University College Dublin Centre for Cybercrime
Investigation at the School of computer science and informatics. He is the
designer of a module on online child exploitation there and continues to
lecture there. He is a developer and instructor of the “Europol Combating
Child Exploitation online” course held annually in Germany. He talks at many
conferences, trainings and seminars around the world.
Topic: Tackling Online Crimes Against
Crimes against Children is a statement
that has many connotations, most of which are unsavoury, difficult and
complex. People find it difficult to talk about, to discuss or to debate.
Discussion about it often takes the polar opposites of the hysterical
rhetoric of the populist as against the turbid language of academic papers.
Yet, in order to deal with it we must talk about it as this remains the best
way to deal with it.
One of the most difficult crimes against
children to discuss is sexual abuse. Traditionally this was a very local
crime that took place within the home or in isolated cases. After all, in
order to abuse a child the criminal needs unfettered access, time and
security, none of which is easily obtained. Exposure to this crime only
occurred if you were directly affected. All this has changed with the
advent of the internet.
The Internet and ICT in general has revolutionised the world and most things
in it through its facilitation of communication, data exchange and the
indexing of both. This is also true for child sexual abuse.
The ease with which offenders or potential offenders can get access to free
speech protected advocacy websites; the ease with which child abuse material
(also erroneously called child pornography) is produced, stored and
transferred and the ease with which people with a sexual interest in
children can contact them have thrown up many challenges for law
enforcement, parents and society in general.
In this talk Mick Moran will explain in a sober, simple and open way the
subject of sexual abuse of children, the effects of ICT on its perpetration
and the role of the systems administrator, IS security personnel and others
in combating it.
Rik Ferguson - Director Security
Research & Communication EMEA - Trend Micro
Rik Ferguson brings more than seventeen
years of security technology experience to his role as Director of Security
Research & Communications at Trend Micro. In this position, Rik is actively
engaged in research into online threats and the underground economy. He also
researches the wider implications of new developments in the Information
Technology arena and their impact on security both for consumers and in the
enterprise, contributing to product development and marketing plans. Rik
writes the Countermeasures blog and is the lead spokesperson for Trend
Micro. He is often interviewed by the BBC, CNN, CNBC, Channel 4, Sky News
and Al-Jazeera and quoted by national newspapers and trade publications
throughout the world. Rik also makes a regular appearance as a presenter at
global industry events. Remaining actively engaged in customer projects, Rik
tries to ensure his views and areas of research reflect the security
concerns as experienced by enterprises and individuals as they come to grips
with new technologies. In April 2011 Rik was formally inducted into the
InfoSecurity Hall of Fame.
Prior to assuming his current role, Rik
served as Solutions Architect at Trend Micro. Previously, he served as
Security Infrastructure Specialist at EDS where he led the security design
work for government projects related to justice and law enforcement and as
Senior Product Engineer at McAfee focused on network security, intrusion
prevention, encryption and content filtering.
Neira Jones - Head of Payment
Security - Barclaycard
As Head of Payment Security at
Barclaycard, Neira Jones is responsible for ensuring that the transactions
processed by Barclaycard’s 100,000 business customers worldwide are safe,
secure and compliant with industry standards and that the importance of
information security is understood in the industry. Neira’s success in
steering Barclaycard and its customers through the changes in payments
security, and in particular with the PCI DSS (Payment Card Industry data
Security Standard) has resulted in Barclaycard winning two prestigious
awards at the February 2012 Merchant Payments Ecosystem conference (MPE,
formerly ECAF) for "Data Security" & "Merchants".
In 2011 Neira was inducted to the Infosecurity Europe Hall of Fame and in
April 2012 at SC Magazine Awards 2012 Europe she was awarded Information
Security Person of the Year. The Barclaycard Payment Security team which she
heads has twice been awarded the Information Security Team of the Year award
from SC Magazine the first time in 2011 and again in 2012. Past awards
include the 2010 European Card Acquiring Forum (ECAF) award for Data
Security (PCI DSS) and in October 2010, Neira was voted one of the top 10
most influential people in infosec in the UK by SC Magazine and ISC2.
In addition, Neira has been on the PCI Security Standards Council Board of
Advisors since 2009 and has over twenty years experience in financial
services working for among the best known and respected names in the
financial services sector. Before joining Barclaycard, Neira managed
business process re-engineering as well as technology strategy functions.
Her knowledge of the finance industry and her skills in change and
transformational management have been instrumental in demonstrating that
payment security issues could not be solved by IT alone. It was this
holistic approach to tackling the problems of information security, as well
as her commitment to working with partners, that brought her to Barclaycard.
Social Media: The New Dimension For Incident Response
Nicolas Villatte is a Principal
Consultant with Verizon Business EMEA RISK Team
Nicolas Villatte is a Principal Consultant
with Verizon Business EMEA RISK Team. In this role, Nicolas has been
responsible for managing the EMEA incident response laboratory as well as
overseeing and performing incident response and investigation, helping
customers mitigate against and investigate incidents such as stolen
information, hacked servers and applications, anonymous email threats,
malware infections and fraud.
Topic : Security and Risk Management
Lessons from The Verizon Databreach Investigations Report
Every year Verizon Business releases a
Data Breach Investigations Report (DBIR). In 2010, Verizon Business also
made the underlying framework VERIS open source. Several partners have
adopted the framework to report on data breaches and have shared their
anonymized data with Verizon Business. The result is a study that gives the
reader not only a unique insight into the world of Cybercrime, and how
hackers work but also a useful source of information to aid risk management
Gavin O'Gorman, Senior Threat
Intelligence Analyst, Symantec
As a senior analyst in Symantec Security
Response’s Attack Investigation Team (AIT), Gavin handles the investigation
of high priority attacks and long term research of threats. He presents AIT
work regularly at industry conferences. Gavin has worked previously as a
reverse engineer and incident handler in Symantec Security Response. He has
a master’s degree in Computer Security & Forensics from DCU, has spent
several years researching anonymous networks, and also lectured network
security in DCU.
Topic - Investigating Law Enforcement
Over the past six months there has been a
spate of ransomlock trojans which make use of the logos and icons of various
police forces. Citing some fictional transgression, the trojans lock a
user's computer screen, effectively disabling the computer. They then demand
payment of a ‘fine’ to unlock the computer. In an attempt to lend the ‘fine’
an air of authenticity, the trojans use geo-location to display a logo from
local law enforcement. If you are in Germany for example, then a German
police force logo is displayed on the computer. If you are in Ireland, then
you may see a Garda Síochána image! The Security Response Attack
Investigations Team has analyzed and investigated multiple versions of these
trojans. This presentation will describe that work, charting the evolution
of the trojans and describing the attackers behind the fraud.
Eoin Keary CISSP, CISA,
Chief Technology Officer, BCC Risk Advisory
Eoin Keary is the CTO and founder of BCC Risk Advisory Ltd. (www.bccriskadvisory.com)
an Irish company who specialise in secure application development, advisory,
penetration testing, Mobile & Cloud security and training.
Eoin is also an international board member, and vice chair of OWASP, The
Open Web Application Security Project (owasp.org). During his time in OWASP
he has lead the OWASP Testing and Security Code Review Guides and also
contributed to OWASP SAMM, ASVS and the OWASP Cheat Sheet Series.
Eoin has led global security engagements for some of the world’s largest
financial services and consumer products companies. He is a well-known
technical leader in industry in the area of software security and
Topic: Everything we know and do to secure
web applications is wrong
The premise behind this talk is to challenge both the technical controls we
recommend to developers and also out actual approach to testing. This talk
is sure to challenge the status quo of web security today.
"Insanity is doing the same thing over and over and expecting different
results." - Albert Einstein
We continue to rely on a “pentest” to secure our applications. Why do we
think it is acceptable to perform a time-limited test of an application to
help ensure security when a determined attacker may spend 10-100 times
longer attempting to find a suitable vulnerability?
Our testing methodologies are non-consistent and rely on the individual and
the tools they use. Some carpenters use glue and some use nails when
building a wooden house. Which is best and why do we accept poor
Fire and forget scanners won’t solve security issues. Attackers take time
and skill but our industry accepts the output of a software programme to
help ensure security?
How can we expect developers to listen to security consultants when the
consultant has never written a line of code? Why don’t we ask ‘How much code
development have you done, seen as you are assessing my code for security
Currently we treat vulnerabilities like XSS and SQLI as different issues but
the root causes it the same. – it’s all code injection theory!! Why do we do
this and make security bugs over complex?
Why are we still happy with “Testing security out” rather than the more
superior “building security in”?
Venman Security Engineer Manager, Sourcefire EMEA
Dave Venman has been
working out why and how networks break on their own for more than 15 years,
and for the last four years, working out why and how networks are being
broken by people for fun or profit. He has wanted to be working in IT
security since reading Cliff Stoll's book "The Cuckoo's Egg" in the early
90s, but it took him 10 years to persuade someone he was actually capable of
doing the job.
Topic - Roll your own
Next Generation Security Solution
All sorts of vendors
will tell you that their NGFW / NGIPS is better than everyone else's.
That's great if you have the budget, but if you don't this talk will break
down some of the steps the best protected companies are taking to defend
themselves, and some of the open source software there is to help you copy
Jo De Muynck & Romain Bourgue, Security Experts,
Jo De Muynck is a National Expert seconded
from Belgium to ENISA. Prior to joining the Agency he worked as a security
specialist for BELNET as part of the team responsible for the national
CERT.be and BELNET CERT. Before that, he worked for the Internet Monitoring
Unit of the FPS Economy, SMEs, self-employed and Energy.
Romain Bourgue is an Expert in NIS for
Computer Security and Incident Response at ENISA. Before joining the Agency
he was working as IT Security Expert for the French Ministry of Agriculture,
Food and Fishing and, as a freelance, for private sector.
Topic: Improving cooperation for CERTs
Successful cooperation with other
stakeholders, such as LEA, and effective awareness raising are two key
factors for CERTs in their fight against cybercrime.
ENISA is actively supporting the CERT
community by identifying and addressing operational and legal barriers in
their collaboration within the community and with other stakeholders. ENISA
will be presenting the results of its activities in this area by focusing on
CERT cooperation with LEA and the EISAS Pilot project for improved
Pan-European awareness raising activities.
Candid Wueest, Principal Threat Researcher, Symantec
Candid Wüest holds a master of computer
science from the Swiss Federal Institute of Technology (ETH) and various
certifications. During the day he works for Symantec's global security
response team, where he has been going far beyond anti virus signatures
during the last 9 years. He researches new threat vectors, analyses trends
and formulates new mitigation strategies. He has published various articles
and appeared in magazines and TV shows. He is a frequent speaker at
conferences like VB, RSA or hashdays.
He learned coding and the English language
on a Commodore 64.
Topic: Current Advances in Banking
For ten years we have been fighting
against malware that targets online banking. Trojans like Zeus, SpyEye,
Torpig, Carberp and others still manage to loot millions of dollars from
infected user accounts every year.
This presentation will analyze the current
situation of online banking malware. How sophisticated are the current
versions of these Trojans and how did they evolve? Which techniques are
currently used to bypass the security measurements of online banking
applications? Are man in the browser attacks still the most sophisticated
ones? Or are other attacks like proxies or DNS redirections taking over? How
much do the attackers focus on mobile banking or tokens on mobile phones
like mTAN? These mobile features have been introduced to create a second
authentication channel, independent from the infected PC, in order to
protect against Trojan attacks and are therefore of interest to the
attackers. We will dissect new features like the P2P option of Zeus but also
lesser know methods like the Firefox XUL injection used by Trojan.Neloweg.
Mark Hillick, Senior Engineer,
Mark is a founder of the HackEire CTF
contest and was a founding member of IRISS-CERT. He
is currently a Senior Engineer at 10gen, the creators of MongoDB, where he
is helping users
and spreading the MongoDB word.
Prior to 10gen, Mark led the EMEA TRM Networking Team for Citrix Systems,
where he was
responsible for many of Citrixʼs biggest worldwide customers and ensuring
Netscaler in the best and most secure fashion across their infrastructures.
Mark is one of few people worldwide and the only one in Ireland to have
industry-leading GIAC GSE certification. As a result, he also currently
writes questions for
GIAC exams. As you can see from the title of the talk, Mark is one of the
members to the Security Onion project.
Topic Peeling off your network layers with
In this talk, I'm going to demonstrate how
easy the Security Onion distro makes Network Security Monitoring (NSM).
As many folk in the security industry know, traditional Intrusion Detection
Systems (IDS) can be costly, difficult to install, may not provide all the
capabilities that you need to defend your network and frequently end up as a
doorstop in your datacentre. In the early noughties, the craze was to
install IDS hardware because the auditor had said so. Then in the late
noughties, research analysts were saying there was no need for dedicated IDS
solutions because devices were collapsing and everything was going to be on
your firewall, oh yeah that silver bullet :)
NSM is different because it provides with visibility like never before, it
combines traditional IDS alerts with additional data to give you a more
complete picture of what's really happening on your network.
This presentation will demonstrate a NSM solution, called Security Onion,
running on commodity hardware, can be used to detect real attacks and help
give you a view like never before!!
They say the best things in life are free and for once, it just might be
Arron Finnon, Research Consultant, Activity
Information Management Ltd.
Arron has been involved in security
research for over 6 years, and has discussed a wide range of security
related topics at a number of Security/Hacking conferences in both the UK
and Europe. In addition to this, Arron has produced over 60 security related
podcasts, interviewing countless security professionals as part of the
popular Finux Tech Weekly show.
During Arron’s time at university he was also awarded the SICSA Student Open
Source Award for his Advocacy of Free and Open Source software. Now a
Research Consultant with Activity Information Management Ltd.
Topic: Time for a Better Gun?
Depending on how you look at it, I have
been fortunate or unfortunate enough to be involved with IDS/IPS for
sometime - although my involvement hasn't been within the world of vendors
and products, but detection and mitigation. IDS/IPS devices have, and
rightly so, faced a lot of criticism over the years. Few could argue that
these systems making massive claims that have no real world basis is bound
to attract a cynical eye, however in the end its achieved nothing.
IDS/IPS have apparently been dead for a number of years, which I always find
amazing as they have been deployed in large numbers since their obituaries
were written, although in some cases they are there for no other reason than
to satisfy compliance. Still the facts are as follows:
- They do have a place and a purpose
- They don't always do what they claim
- The security community will continue to moan about them not being a
The above is all true, I am not going to lie and its not my intention to
alter that belief. However, my main thoughts are that the language used in
assessing the effectiveness of detection systems is in the complete control
of vendors. They have control over the information made available to
organisations wishing to purchase these systems and, without independence,
we are all at the mercy of a few companies with vested interests. Something
must change, otherwise the same mistakes will carry on being created as they
have been in the past.
The IPS is dead, long live the IPS!
This talk looks at the current situation that surrounds the murky world of
vendor spin and Intrusion Detection/Prevention Systems. Discussing the
potential avenues that, as a security community, we can take control of the
situation and attempt to change things for the better. This is in no way a
vendor pitch, in fact this is probably the most anti-vendor talk I have ever
given. It is my aim to plant a seed, allowing people to walk away with the
idea that more questions need to be asked, and that we must find a better
way of asking them. Hopefully, attendees will leave with at least one major
question niggling at their subconsciousness: "What questions would an IPS
Christopher Boyd, Senior Threat
Researcher, GFI Software
Christopher Boyd is a Senior Threat
Researcher for GFI Software, a former Microsoft MVP in Consumer Security and
former Director of Malware Research for FaceTime Security Labs.
He's been thanked by Google for contributions to security and responsible
disclosure, and has been credited with numerous finds in security including
the first rootkit in an Instant Messaging hijack, the first example of a
rogue web browser installing without permission and the first DIY Twitter
Botnet creation kit.
In addition to presenting in Singapore, Spain and India he has also given
talks at RSA, the Antispyware Coalition, InfoSec Europe, SecTor and Rootcon.
His areas of research include Adware, videogame / console exploits, IM and
You Fumbld your Tumbl
Tumblr now has a bigger
userbase than WordPress, with 20 billion posts spread across 50 million
blogs. More and more companies are taking the plunge and signing up, often
with little idea of the dangers, scams and threats that plague the userbase
on a daily basis. Phishing, surveys, Malware, redirects, scripting attacks
and affiliate deals are all part and parcel of the experience for budding
Tumblr users - falling prey to these scams could be costly to a corporate
entity trying to keep up with the latest social media strategies deployed by
This presentation will
take a look at some of the most popular attacks on both the service and its
users, exploring the techniques and the files used to generate some profit
for the scammers or just give users a bad hair day for no other reason than
the fun of it. From large scale phish attempts and fake Tumblr staff blogs,
to weightloss spam runs and the use of memetics to catch out unwary users,
this talk will show corporate users how to keep their accounts safe from
harm, avoid risky users that could expose them to malicious content and the
steps to take to fix any potential compromise.
With numerous case study
examples from the past year to draw on, attendees will come away from the
talk with a solid base to map out a safe Tumblr strategy that could also be
applied to other social networking portals such as Pinterest.
Mathieu Gorge, ISI
Chairman and CEO VigiTrust
Mathieu Gorge has been in the security
industry for the past 13 years. He is a regular speaker at international
security conferences (RSA, ENISA, ISACA). He is also on the Global
Educational Advisory Committee of the ISSA and a well respected figure in
the security industry in North America and in EMEA. Mathieu specialises in
Cybercrime, Payments Security (PCI DSS), Security of Social Networks.
Infosecurity Ireland (ISI) supports the interaction of technology firms,
research institutes, third level colleges and industry associations to
ensure continuous development of Ireland as a centre of excellence in
Thanks to the generosity of our
sponsors IRISS is able to
host this event. The following organisations kindly lent their support to our
is a global leader in providing security, storage and systems management
solutions to help our customers – from consumers and small businesses to the
largest global organizations – secure and manage their information and
identities independent of device. Symantec does this by bringing together
leading software and cloud solutions that work seamlessly across multiple
platforms, giving customers the freedom to use the devices of their choice and
to access, store and transmit information anytime, anywhere.
distributes Sophos products in Ireland along
with a portfolio of complimentary data security products to suit your needs for
now and into the future. As threats and risks change so does the Renaissance
portfolio to meet these ever evolving requirements. Renaissance partners with
most of the leading solution providers in Ireland and has a range of accredited
trained partners throughout Ireland. Renaissance through our partners provides
you with the products and support which your business needs to ensure a safe
secure environment to carry out your business.
help organisations keep data safe and block the growing number of complex
threats. Smart investments yield positive gain and investing with
Sophos is smart. As a
Sophos customer you benefit from industry
leading, high quality security solutions for business.
Our complete security portfolio means that you can protect every part of your
business; Web, Email, Endpoint, Mobile, Network and Data. Our Unified Protection
brings all these products together as a hardware, software, virtual or cloud
based solution with centralised management enabling you to deliver end to end
Security. Our ability to provide complete security without complexity means
better security for you at reasonable pricing for you. It’s that simple.
We understand your needs and are committed to giving you the information and
tools you need for a successful partnership with us. That’s a promise.
Net Security has been a prime resource for information security news since
1998. The site is updated daily with
fresh content including interesting articles, information on new product
releases, latest industry news and more. Besides reading daily news coverage,
you can download all of the issues of our digital
Magazine is the world's largest dedicated IT security publication having
served the IT security industry for over 15 years. Our readers turn to
SC Magazine each month for
informative and up-to-date features on key players in the industry, exclusive
interviews, case studies and the renowned SC product reviews. With 100% of our
readers intending to make multiple purchases over the next 12 months and over
42% of our readers turning to these product reviews for advice on what product
they should purchase, it is the first port of call for key IT security
Should you or your company be interested in
sponsoring the upcoming event or sponsoring IRISS please send an email for
firstname.lastname@example.org for our sponsorship pack.