August 28, 2010


      Register Now! 2010 Information Security Summit October 11-15th

Don’t get left out, register today for the 2010 Information Security Summit!

The 8th Annual Information Security Summit will be held on October 14-15 at Corporate College East, Cleveland Ohio with pre-conference training opportunities held October 11-13. Listed below are just some of the activities and sessions you can experience at this year’s event:

Pre-conference training classes include: Social Networks, Malware Analysis, Email Authentication, COBIT(r) Exam Prep, White Collar Forensics & the Investigation Process, Websense Web Security, Linux Security, Ethical Hacking, IT Risk Assessment, Building Effective Security Awareness, Defending Against Social Engineering and Next Generation Firewall Training.

Our Keynotes include two panel discussions and a general session. Our panel discussions will cover forensics and privacy. Our general session will focus on identifying the evil insider and protecting against IP theft.

Our Session topics include an Introduction to GRC, Privacy & Regulations, Social Networks, Hacking Techniques, E-discovery, Computer Forensics, Security Awareness, Securing the Cloud, Risk Assessment, High Security Locks, Securing VMs, Network Security, Web Application Security, Security Assessment Practices, Honeypots, case studies, and much, much more.

By registering for the conference you will be able to attend our Thursday evening networking reception. This reception provides you an opportunity to get reacquainted with some old friends and business associates, as well as make new business contacts.

The Information Security Summit is a registered non-profit organization run by volunteers with a mission to bring quality, cost-effective training to Northeast Ohio. Visit our website at www.informationsecuritysummit.org for event details and registration information.



del.icio.us|Digg|Furl|ma.gnolia|RawSugar|reddit|Spurl|Google|StumbleUpon



August 16, 2010


      August 18th NEOISF Meeting Announcement

Our next meeting is this WEDNESDAY August 18, 2010. Pizza and networking start at 6:00 PM. Talks start at 6:30 PM. Location: Park Center Plaza #1, 6100 Oak Tree Blvd, off Rockside Road, Independence, Ohio. Click here for a Google Map! Open to everyone and free as always! Here are the list of talks and agenda items for this months meeting:

Overview of The Next HOPE Conference – Jody McCluggage
The HOPE (Hackers on Planet Earth) conference is a biennial conference held in New York City and sponsored by 2600. A high level overview will be given of the events, presentations, and politics at the most recent conference.

Return of the Social Zombies – Tom Eston
Tom Eston, the only survivor of the zombie apocalypse that took place at Shmoocon this year, examines the risks of social networks and discusses techniques and tools that can be used to exploit these issues. This presentation begins by discussing new twists on existing privacy concerns that are caused by the trust mass that is social networks. This privacy confusion is used to exploit members and their companies during penetration tests. The presentation then discusses social network botnets and bot programs. Both the delivery of malware through social networks and the use of these social networks as command and control channels will be examined. Tom then explores the use of browser-based bots and their delivery through custom social network applications and shows new social network applications can be used for malware delivery. Finally, the information available through the social network APIs is explored using third-party applications designed for penetration testing. This allows for complete coverage of the targets and their information.

Speaker Bios:

Jody McCluggage (CISSP, CCNA, CEH, MCTS, CHP, Network+) – Director of Operations and Compliance at a local government agency.

Tom Eston is a Senior Security Consultant for SecureState. Tom has previously served in many security roles for large enterprises including leading a penetration testing team for a Fortune 500 financial institution. Tom is actively involved in the security community and focuses his research on the security of social media. He is the founder of SocialMediaSecurity.com which is an open source community dedicated to exposing the insecurities of social media. Tom is also a security blogger, co-host of the Security Justice and Social Media Security podcasts and is a frequent speaker at security user groups and national security conferences including Defcon, Shmoocon, OWASP AppSec and Notacon.



del.icio.us|Digg|Furl|ma.gnolia|RawSugar|reddit|Spurl|Google|StumbleUpon



April 30, 2010


      Rafal Los from HP Speaking at the May 19th Meeting

We are excited to announce that Rafal Los from HP will be speaking at the May 19th meeting.  He will be giving his talk from the Source Boston conference “Into the Rabbit Hole: Execution Flow-Based Web Application Testing”.  Here is the talk abstract and his bio:

Since the caveman first fashioned a spear humans have been using tools to make them more efficient and effective. Unfortunately, today’s analysts often misunderstand the role tools play in testing web applications. While tools can be quite good at mapping a web application’s attack surface there is still much human analysis that must be done to find the elusive defects that lie just below the surface. That human analysis is daunting and irregular … until now. The answer is an execution-flow-based approach to application security testing. By first understanding application logic and execution flow it is possible to completely map a web application’s attack surface, and therefore fully test the application. Along the way, we will cover the principles of data-flow analysis, application process mapping and building execution-flow diagrams (EFDs), which together form a complete picture of the web application and allow an analyst to uncover potentially critical defects.

Speaker Bio:
Senior Security Specialist and Web Application Security evangelist with Hewlett-Packard’s Application Security Center (ASC), Rafal Los has more than thirteen years of experience in network and system design, security policy and process design, risk analysis, penetration testing, and consulting. For the past eight years, he has focused on information security and risk management, leading security architecture teams, and managing successful enterprise security programs for General Electric and other Fortune 100 companies, as well as SMB enterprises. Previously, Rafal spent three years in-house with GE Consumer Finance, leading its web application security programs.

Stay tuned for the full agenda announcement in the next few days!  We hope to see you May 19th!



del.icio.us|Digg|Furl|ma.gnolia|RawSugar|reddit|Spurl|Google|StumbleUpon



March 14, 2010


      March 2010 Meeting Announcement

Our next meeting is WEDNESDAY March 17, 2010.  Pizza and networking start at 6:00 PM.  Talks start at 6:30 PM.  Location: Park Center Plaza #1, 6100 Oak Tree Blvd, off Rockside Road, Independence, Ohio.  Click here for a Google Map! Open to everyone and free as always!  Here are the list of talks and agenda items for this months meeting:

Attacking WPA-Enterprise Wireless Networks, Matt Neely
This presentation covers different attacks that can be leveraged against wireless networks using Enterprise (802.1x) authentication. Attendees will learn about and see demonstrations of these attacks, many of which can be used to reveal the credentials used to join the wireless network. The presentation concludes with recommendations on how to defend against these attacks.

Matt Neely (CISSP, CTGA, GCIH and GCWN) is the Profiling Team Manager at SecureState, a Cleveland Ohio based security consulting company. At SecureState, Matt and his team perform traditional penetration tests, physical penetration tests, web application security reviews and wireless security assessments. His research interests include the convergence of physical and logical security, cryptography and all things wireless. Matt is also a host on the Security Justice podcast.

Analysis of the Energizer Charger Malware, Tyler Hudak

Energizer and the US-CERT recently released an advisory that the software for the Energizer USB battery charger contained a backdoor.  Tyler will perform a technical analysis of the backdoor and discuss why this malware is more than just an accidental infection of software.

Come early, at 6:00 PM, for pizza, pop, water and social networking with your peers.  We hope to see you there



del.icio.us|Digg|Furl|ma.gnolia|RawSugar|reddit|Spurl|Google|StumbleUpon




Local Security Jobs @ our LinkedIn Group!


Support our Sponsors:


Visit our friends: