2015

Platinum

Gold

Bronze

Educational Sponsor

Name: Zack Mullaly, eQualit.ie
Title: Censorship? No thank you!
Abstract: Censorship is one of the greatest challenges to freedom of information online. It stymies political activism, and keeps people in the dark about threats to their security. CENO (Censorship? No!) is a project being developed by equalit.ie in collaboration with the Freenet community to create a fault-tolerant network for the secure dissemination of digital content. CENO is an abstraction over existing dark net technology such as Freenet and, in the future, others such as Tor and Bittorrent. It uses these technologies to anonymously exfiltrate requests for restricted content and to store that content securely in a distributed fashion. Because CENO is designed to use these technologies as plugins to its own services, it can provide considerable resilience against censors who might try to block some of the services. The big challenge the CENO team is tackling is the problem of creating a utility that is robust and can protect the identity of its users while presenting a pleasant user experience. The experience as lead to exploration into network communications obfuscation, distributed storage technology, anonymous messaging, as well as browser extensions, proxy services, and web content bundling. Equalit.ie is continuing work into improving CENO’s user experience by automatically retrieving updated content from the web and presenting its own interface to the growing wealth of information stored in Freenet.

Name: Robert Masse, Deloitte
Title: Hunting Down Enemy Nation States Within Your Organization
Abstract:For the last 10 years, we have seen major growth of attacks from Advanced Persistent Threats. In our experience, the majority of these groups are well funded government agencies & organized crime syndicates who have been wreaking havoc across important institutions around the world. As FBI director James Comey said in 2014, “there are two big types of companies in the US – those who’ve been hacked by the Chinese and those who don’t know they have been hacked by the Chinese”.

Just two years ago, I wouldn’t have believed this myself.

With the recent uptick of attacks against organizations with massive databases containing personal information, more companies than ever are at risk from being compromised. This presentation will cover real-life experiences of several investigations we have done around the world and provide valuable lessons learned on how to detect and protect yourself from these advanced threat actors.

Name: Dave Lane, City of St. John’s
Title: Municipal E-Voting – Could it be a thing in St. John’s?
Abstract: Councillor Dave Lane has been exploring the possibility of St. John’s adopting e-voting for its municipal elections. There are proponents and opponents to the idea in many areas, and Dave will discuss what he’s learned to date.

Name: Scott Stevenson, NOCLAND
Title: Listen Carefully: Acoustic Keylogging Techniques
Abstract: Keylogging is the action of recording (or logging) the keys struck on a keyboard, typically with the purpose of snooping on sensitive information such as passwords and credit card numbers. Attackers have many keylogging tools at their disposal, from covert malware to hardware that is connected between a keyboard and a computer.

This talk will demonstrate a more rarely-considered vector for keylogging: Deciphering typed text by recording and processing the sound of keys being struck. One group of researchers demonstrated their ability to recover 96% of typed text from a 10 minute audio recording using machine learning and statistical analysis techniques – similar to those which will be demonstrated.

Name:Dale O’Grady, Vectra Networks
Title: Stop Cyber Attacks in Real Time: Modern Defense in Depth
Abstract: Over the past year, cyber attacks have gone from being a worst-case scenario for security teams to a real-world certainty. Yet for all the recent investment and focus on cyber security, attackers continue to succeed at stealing or destroying our most valued assets. In this discussion, we will analyze recent cyber attacks to see what they have in common, and propose new models of defense-in-depth that can apply generically to detecting today’s most sophisticated attacks.

This session will cover:

• An analysis of recent cyber attacks and what they have in common
• Understanding the inherent advantages attackers enjoy today, and how we can turn the tables
• Proposing a generic methodology for automating the detection of breaches and APTs

Name: Kevin Burgess, Fortinet
Title: Security in a Virtually Cloudy World
Abstract: This presentation will discuss:

• The multiple definitions of “cloud”
• Security concerns in a cloud-based infrastructure
• Mitigation techniques for protecting cloud applications

Name: Alexandre Argeris, Cisco
Title: Honeypot for Fun
Abstract: What is a Honeypot ? This presentation will show you the different types of honeypot and deployment scenarios. You will also learn how to create, in a few clicks, one or more honeypots across the web using the cloud infrastructure providers for just a few dollars per year. Also the presentation will show you the different information you can gather from this type of solution.

Name: Jared Perry, Stratum Security
Title: How File Uploads Can Go Horribly Wrong
Abstract: File upload functionality is a common feature in web applications and is one that is often used by attackers to compromise an application or server. This talk will provide application security testers with a variety of techniques and examples to effectively test file uploads in an application. After showing how file uploads can go horribly wrong, recommendations will be provided to help application developers design useful functionality while effectively mitigating the risks associated with file uploads.

Name: Gus Bruneau, Dell SecureWorks
Title: Battling against the Threat Landscape
Abstract: Threat actors know midsize businesses are vulnerable to cyber-attacks. Board members and clients are concerned, and asking organizations to show them how they are securing, and validating the security of critical data. From spearfishing, to ransomware to Trojans, attacks against midsize organizations increase each year. Core information security technologies and practices need to be solidly in place to help detect and deflect attacks. Before you act you should have an understanding of the threat landscape and what’s at stake if threat actors get to your critical data and wreak havoc on your organization. During this session attendees will hear about:

• Information security threat landscape for mid-size organizations
• Most pervasive malware and attack vectors
• Why Firewall and antivirus technologies are failing to stop attackers.
• Role of applied global threat intelligence plays in information security
• What you should consider when building or updating your information security program

• Robert Percy @percyrobert
• Norbert Griffin @norbert_griffin
• Jamie Goodyear @icbts
• Matthew Middleton @mmiddleton