The 8th Annual Information Security Summit will be held on October 14-15 at Corporate College East, Cleveland Ohio with pre-conference training opportunities held October 11-13. Listed below are just some of the activities and sessions you can experience at this year’s event:

Pre-conference training classes include: Social Networks, Malware Analysis, Email Authentication, COBIT(r) Exam Prep, White Collar Forensics & the Investigation Process, Websense Web Security, Linux Security, Ethical Hacking, IT Risk Assessment, Building Effective Security Awareness, Defending Against Social Engineering and Next Generation Firewall Training.

Our Keynotes include two panel discussions and a general session. Our panel discussions will cover forensics and privacy. Our general session will focus on identifying the evil insider and protecting against IP theft.

Our Session topics include an Introduction to GRC, Privacy & Regulations, Social Networks, Hacking Techniques, E-discovery, Computer Forensics, Security Awareness, Securing the Cloud, Risk Assessment, High Security Locks, Securing VMs, Network Security, Web Application Security, Security Assessment Practices, Honeypots, case studies, and much, much more.

By registering for the conference you will be able to attend our Thursday evening networking reception. This reception provides you an opportunity to get reacquainted with some old friends and business associates, as well as make new business contacts.

The Information Security Summit is a registered non-profit organization run by volunteers with a mission to bring quality, cost-effective training to Northeast Ohio. Visit our website at www.informationsecuritysummit.org for event details and registration information.

Overview of The Next HOPE Conference – Jody McCluggage
The HOPE (Hackers on Planet Earth) conference is a biennial conference held in New York City and sponsored by 2600. A high level overview will be given of the events, presentations, and politics at the most recent conference.

Return of the Social Zombies – Tom Eston
Tom Eston, the only survivor of the zombie apocalypse that took place at Shmoocon this year, examines the risks of social networks and discusses techniques and tools that can be used to exploit these issues. This presentation begins by discussing new twists on existing privacy concerns that are caused by the trust mass that is social networks. This privacy confusion is used to exploit members and their companies during penetration tests. The presentation then discusses social network botnets and bot programs. Both the delivery of malware through social networks and the use of these social networks as command and control channels will be examined. Tom then explores the use of browser-based bots and their delivery through custom social network applications and shows new social network applications can be used for malware delivery. Finally, the information available through the social network APIs is explored using third-party applications designed for penetration testing. This allows for complete coverage of the targets and their information.

Speaker Bios:

Jody McCluggage (CISSP, CCNA, CEH, MCTS, CHP, Network+) – Director of Operations and Compliance at a local government agency.

Tom Eston is a Senior Security Consultant for SecureState. Tom has previously served in many security roles for large enterprises including leading a penetration testing team for a Fortune 500 financial institution. Tom is actively involved in the security community and focuses his research on the security of social media. He is the founder of SocialMediaSecurity.com which is an open source community dedicated to exposing the insecurities of social media. Tom is also a security blogger, co-host of the Security Justice and Social Media Security podcasts and is a frequent speaker at security user groups and national security conferences including Defcon, Shmoocon, OWASP AppSec and Notacon.

Cradle to Grave Part 2 – FBI Special Agent Ryan MacFarlane
This is the continuation of last months talk in which Ryan will walk us through a forensic analysis and incident response of compromised systems using SIFT 2.0. Last month Dave Kennedy showed a demonstration of systems being exploited with Metasploit Express.

Overview of the REcon Security Conference – Tyler Hudak
Tyler gives a review of the REcon Security Conference that he recently attended. REcon is a conference focused on reverse engineering and is held in Montreal Canada.

Speaker Bios

FBI Special Agent Ryan MacFarlane, Cleveland Office, has spent the last six years investigating numerous criminal intrusions. With over 8 years of Internet security experience, previous work experience includes positions at IBM, i2 Technologies, Georgia Tech, and as a co-founder of an Internet security start-up in 2004.

Tyler Hudak is an Incident Handler for General Electric, specializing in malware analysis and reverse engineering. Prior to joining GE, Tyler worked for a number of corporations performing intrusion detection, incident response, forensics and, of course, malware analysis. He has presented at a number of local and national conferences, is on the board of the Northeast Ohio Information Security Forum and maintains a blog at http://secshoggoth.blogspot.com.

Whose Afraid of the Big Bad Wolf: Embracing Audit as a Service
Let’s see if you have a picture in your head of auditors. Do see you them, sitting there in the darkness, with a maniacal look on their faces. They pour over your documentation and configuration files just hoping to find the red meat. If there is anything juicy they will find it and feed off it at your expense. Is this the image you have of auditors? Perhaps you were burned during an audit, or just didn’t have a very good experience at the auditor’s hands. With a bit of explanation, your next audit doesn’t have to be so stressful and adversarial. Maybe, just maybe, you can walk away with some value to help improve what you do that you hadn’t thought of before.

Starting from the beginning, we will walk through why IT auditors exist and what role they play in the organizations risk management process. Since we all can relate to risk, maybe we can find the common ground and start to derive value from what auditors provide. Given the right amount of attention and care, organizations can ultimately benefit from IT and Audit working together. Plus you will sleep better at night knowing the bogeyman is just a myth.

Speaker Bio
Jeff Kirsch is an IT auditor by day and ghostnomad, an infosec geek alter ego, every chance he can get. Always trying to learn new things drives him to find better ways to help others learn about technology. His passion for technology also drives him to help those in technology understand auditors and the audit process.

Part 1: Metasploit Express – Dave Kennedy
Metasploit Express was newly released by Rapid7 and is a web-based exploitation suite built on top of the Metasploit Framework. During this presentation we will be discussing how this tool can be incorporated into your daily use within vulnerability management and penetration testing within your organization and how this tool can revolutionize how you currently perform your own testing. Metasploit Express is now one of my favorite toolset’s to utilize and after this talk, it may be yours too.

Part 2: Cradle to Grave - FBI Special Agent Ryan MacFarlane
Following an attack run from Metasploit Express through incident response and forensic analysis using SIFT 2.0.

Speaker Bios
Dave Kennedy is a security expert that has over ten years of experience in the Information Security arena. He has presented at several large conferences including BlackHat, DefCon, ShmooCon, Information Security Summit, InfoSecWorld, and other well known speaking engagements. David is the author of the Social-Engineer Toolkit, a well known and established attack framework for Social-Engineering. David has published a number of exploits, whitepapers, and contributed to the widely popular Back|Track security distribution and the Metasploit Framework. Currently, David is a director of security for an international Fortune 1000 company located in North Canton, Ohio.

FBI Special Agent Ryan MacFarlane, Cleveland Office, has spent the last six years investigating numerous criminal intrusions.  With over 8 years of Internet security experience, previous work experience includes positions at IBM, i2 Technologies, Georgia Tech, and as a co-founder of an Internet security start-up in 2004.

Into the Rabbit Hole: Execution Flow-Based Web Application Testing
Since the caveman first fashioned a spear humans have been using tools to make them more efficient and effective. Unfortunately, today’s analysts often misunderstand the role tools play in testing web applications. While tools can be quite good at mapping a web application’s attack surface there is still much human analysis that must be done to find the elusive defects that lie just below the surface. That human analysis is daunting and irregular … until now. The answer is an execution-flow-based approach to application security testing. By first understanding application logic and execution flow it is possible to completely map a web application’s attack surface, and therefore fully test the application. Along the way, we will cover the principles of data-flow analysis, application process mapping and building execution-flow diagrams (EFDs), which together form a complete picture of the web application and allow an analyst to uncover potentially critical defects.

Speaker Bio
Senior Security Specialist and Web Application Security evangelist with Hewlett-Packard’s Application Security Center (ASC), Rafal Los has more than thirteen years of experience in network and system design, security policy and process design, risk analysis, penetration testing, and consulting. For the past eight years, he has focused on information security and risk management, leading security architecture teams, and managing successful enterprise security programs for General Electric and other Fortune 100 companies, as well as SMB enterprises. Previously, Rafal spent three years in-house with GE Consumer Finance, leading its web application security programs.

A Survey of Security Certifications:  Which Regex Should You Match?
The IT industry has long been a maze of myriad technology certifications, and the security industry is no different.  CISSP, CISA, CEH, GCIH, OSCP…you’ve seen the letters, and probably even have a few on your business card.  In this presentation, Chris will breakdown popular security certifications, categorizing them by both educational and resume-building value.

Speaker Bio
Chris Clymer is a senior security consultant for a Fortune 500 financial services institution, a co-host of the Security Justice podcast, and currently sits on the NEOISF board.  He’s been working hard on his cert regex in recent years, current patterns matched include: CISSP, CISA, GPEN, and GWAPT.

This months meeting is sponsored by HP.  Come early, at 6:00 PM, for pizza, pop, water and social networking with your peers.  We hope to see you there!

The emphasis of this course is on increasing students’ understanding of the workings of TCP/IP, methods of network traffic analysis, and one specific network intrusion detection system (NIDS) – Snort. This is not a comparison or demonstration of multiple NIDSs. Instead, the knowledge provided here allows students to better understand the qualities that go into a sound NIDS and the whys behind them, and thus, to be better equipped to make a wise selection for their site’s particular needs.

For complete event details visit http://www.sans.org/info/58593.

When: June 24 – August 26, 2010 (Class meets once a week from 6:30-8:30PM on Thursdays)
Course: Security 503: Intrusion Detection In-Depth
Mentor: Steve Jaworski
CPEs: 36
GIAC Certification: GIAC Certified Intrusion Analyst (GCIA). This course prepares meets the requirement of the DoD 8570 IAT Level III. http://www.sans.org/8570/
Tuition: Save $400 when you register by May 27 at http://www.sans.org/info/58593
For group discounts please contact mentor@sans.org.

What is the SANS Mentor Program
The SANS Mentor Program offers you local, live training over the course of ten weeks.  This format allows students to understand, apply and digest the material each week and return with any questions at the next class session.  Mentor classes are small classes averaging less than 12 students which gives students the opportunity to directly interact with each other and the Mentor in a hands-on environment.

With local training from SANS Mentor  you save on travel expenses, time away from work, family and save on average 25% on the tuition
cost.  If you have a limited training budget this SANS Mentor class will get you the knowledge you need at savings you can use.  If this sounds like the kind of local, live training you can use please register today at http://www.sans.org/info/58593.

Since the caveman first fashioned a spear humans have been using tools to make them more efficient and effective. Unfortunately, today’s analysts often misunderstand the role tools play in testing web applications. While tools can be quite good at mapping a web application’s attack surface there is still much human analysis that must be done to find the elusive defects that lie just below the surface. That human analysis is daunting and irregular … until now. The answer is an execution-flow-based approach to application security testing. By first understanding application logic and execution flow it is possible to completely map a web application’s attack surface, and therefore fully test the application. Along the way, we will cover the principles of data-flow analysis, application process mapping and building execution-flow diagrams (EFDs), which together form a complete picture of the web application and allow an analyst to uncover potentially critical defects.

Speaker Bio:
Senior Security Specialist and Web Application Security evangelist with Hewlett-Packard’s Application Security Center (ASC), Rafal Los has more than thirteen years of experience in network and system design, security policy and process design, risk analysis, penetration testing, and consulting. For the past eight years, he has focused on information security and risk management, leading security architecture teams, and managing successful enterprise security programs for General Electric and other Fortune 100 companies, as well as SMB enterprises. Previously, Rafal spent three years in-house with GE Consumer Finance, leading its web application security programs.

Stay tuned for the full agenda announcement in the next few days!  We hope to see you May 19th!

Oracle, Interrupted: Stealing Sessions and Credentials
In a world of free, ever-present encryption libraries, many penetration testers still find a lot of great stuff on the wire. Database traffic is a common favorite, and with good reason: when the data includes PAN, Track, and CVV, it makes you stop and wonder why this stuff isn’t encrypted by default. However, despite this weakness, we still need someone to issue queries before we see the data. Or maybe not… after all, it’s just plaintext.

Recapping his recent Black Hat Europe presentation with Wendel G. Henrique, Steve Ocepek will be taking a look at the world’s most popular relational database: Oracle. Through a combination of downgrade attacks and session take-over exploits, this talk introduces a unique approach to database account hijacking. Using a new tool, thicknet, Steve will demonstrate just how deadly injection attacks can be to database security.

Speaker Bio: Steve Ocepek serves as the Director of Security Research for Trustwave’s SpiderLabs division – the advanced security team focused on penetration testing, incident response, and application security. Steve has been working in the Information Security field for over ten years. As a founder of Wholepoint Corporation, he and his team created one of the first Network Access Control (NAC) systems in 2001, and has been granted four patents in this area to date. After being acquired by Mirage Networks in 2004, Steve continued his research, discovering new, effective ways to profile network devices in real-time. During this process, Steve had the opportunity to fill a number of roles, from research and development to security consulting. At Trustwave, Steve continues to innovate and is frequently referred to in cases where network technologies are concerned. Steve is a CISSP, frequently speaks at security venues, both corporate and academic. Recent venues include Black Hat USA 2009, Black Hat Europe 2010, and Northwestern University.

SIEM’s and Auto-blocking Attacks
SIEM’s are often used in the capacity for intelligence and information gathering within organizations. Often times, the large amount of information used is wasted and not utilized in an efficient manner. At my organization, the SIEM can be used in a much larger capacity when performing responses to actual threats and attacks in an automated fashion. Let’s take a plunge into ArcSight where we can actively block predefined attacks and utilize the SIEM in a responsive measure across an international company.

Speaker Bio: Josh Kelley is an Enterprise Security Analyst for a Fortune 1000 company where his primarily responsibilities are web application security, incident response, vulnerability management, and ensuring that the organization is protected against attack. Much of this is understanding the latest attack vectors and establishing a defense against a large international target.  Josh has recently been working on exploit development and vulnerability research. Josh currently holds the SANS’ GSEC and GCIH certifications and is undergoing the Offensive-Security Certified Professional certification.

Come early, at 6:00 PM, for pizza, pop, water and social networking with your peers.  We hope to see you there!

Attacking WPA-Enterprise Wireless Networks, Matt Neely
This presentation covers different attacks that can be leveraged against wireless networks using Enterprise (802.1x) authentication. Attendees will learn about and see demonstrations of these attacks, many of which can be used to reveal the credentials used to join the wireless network. The presentation concludes with recommendations on how to defend against these attacks.

Matt Neely (CISSP, CTGA, GCIH and GCWN) is the Profiling Team Manager at SecureState, a Cleveland Ohio based security consulting company. At SecureState, Matt and his team perform traditional penetration tests, physical penetration tests, web application security reviews and wireless security assessments. His research interests include the convergence of physical and logical security, cryptography and all things wireless. Matt is also a host on the Security Justice podcast.

Analysis of the Energizer Charger Malware, Tyler Hudak
Energizer and the US-CERT recently released an advisory that the software for the Energizer USB battery charger contained a backdoor.  Tyler will perform a technical analysis of the backdoor and discuss why this malware is more than just an accidental infection of software.

Come early, at 6:00 PM, for pizza, pop, water and social networking with your peers.  We hope to see you there