Offensive talks are easy, I know. But the goal of offensive security at the end of the day is to make us better defenders. And that’s hard. Usually after the pen-testers/auditors (or worst – red team) leaves, there’s a whole lot of mess of vulnerabilities, exposures, threats, risks and wounded egos. Now comes the money time – can you fix this so your security posture will actually be better the next time these guys come around?
This talk focuses mainly on what should be done (note – not what should be bought – you probably have most of what you need already in place and you just don’t know it yet). Methodically, defensively, decisively. Just like the red-team can play ball cross-court, so should you!

The focus is to enable open discussion about what sort of information should be shared in relation to security breaches, how this could be shared and to solicit ideas from the community about how this could work in proactive for the information security industry. Many other industries are capable of sharing incident data, insurance companies can easily see how many car accidents there are every year and all the stats that relate to the root cause. The healthcare industry is capable of giving a n% chance of obtaining cancer, or certain deformities or other illnesses. This is all possible because professionals in those sectors are capable of sharing information that relates to the cause of the issue in the first instance.
The presenter will share personal experiences in relation to RISK in general and aim to show that the information security industry can work together to collate this data and extrapolate sensible values and likelihood data for risk management purposes.

In order to understand why the social media has has become an actual threat to the corporate landscape, we must first understand how an attacker operates when he sets out to attack an organization. In order to have a complete attack scenario, an attacker must gain some actionable intelligence on the organization. The information that he seeks can be split into two main categories:

• Technical Intel (TecInt) – the organizational surface attack. When launching an attack, the attacker needs to have a proper understanding of what sort of implementation he is attacking.
• Attack Group – closed social targets – if we were to analyze what are the main methods of launching a successful and stealthy attack on large scale organization, we see that one of the major ways is via the usage of spear phishing. This method includes sending out targeted personal e-mails crafted and fitted for an exact recipient, with the usage of customized vulnerabilities that were attained from the TecInt phase.

When security devices such as NIDS/NIPS (Network Intrusion Detection/Prevention Systems) are developing their rules/signatures, exploit PoC's tend to be used to develop and test those rules. Sometimes there is lots of PoC code around for a single exploit. Not too much of leap of faith to suggest that those people developing those rules will stick to what they know, and obtain those PoC from the favourite place. What happens if an exploit from one PoC is very subtlety different from other ALL the other PoC's available? What happens if this subtly different PoC is more popular than the rest? What happens if the PoC is not a clear baseline of the threat? What happens if you introduce a "quirk" in to your NIDS analysis?
This talk looks at the situation where the choice of PoC for NIDS/NIPS signature could have massive and wide ranging implications. In lack of a better term, what happens if a security rule writer inadvertently codes a very subtle quirk into the rules. This can lead to a situation where the same exploit using a different PoC might well be sufficiently different from the rule writers sample as to evade detection. The reality of this is in play in the real world, and security devices have been tuned to a slightly different key. I intend to show an example of how security devices have been developed using a unclean sample and how an exploit's original PoC can pass NIDS detection.
The aim of the talk is to raise awareness into carefully verifying an exploit prior to developing rules, a practice that is clearly not happening.

During the past years typologies of crime and offenders have changed enormously as well as rapidly. State-of-the-art techniques increasingly find their way into criminal investigations. New types of criminal phenomena tend to substitute the well-known types of crime. Common crimes range from the classical online fraud to cyber terrorism. Online crime has come to be a million dollar business.
Within the frame of this paper three aspects will be examined by reference to a meta survey based on the whole german spekaing area. As first step the penologic options fighting online crime will be considered. Then the different types of crime will be illustrated as well as the consequences of their exposure. The objective is to depict offender profiles as precisely as possible.

Ms Kosina presents a critical look at the cyberwar debate (the result of her master thesis). “The United States is fighting a cyber-war today, and we are losing”, Mike McConnell, former US Director of National Intelligence, has claimed. Well, sir, I don’t think so. The term “cyberwar” is way over-used in the media. But if you look at the cyber incidents that we have seen from the perspective of the law of armed conflict, none of them qualifies as an act of war. Rather than focusing on military cyber defense (and offense), we need to work on a better civilian response to the (very real) IT security threats we are facing. The militarisation of the debate does nothing to address the actual problems, and creates a whole range of new problems instead.

The game has changed. Less and less it is the opportunistic attackers that present the greatest risk. Determined adversaries target organizations with trained, high-skilled specialists, often with large financial budget and linked, opaque mafia-like structures. Incidents with targeted Advanced Persistent Threats (APTs) are difficult to handle in numerous ways. First, the goal of an APT is to stay as clandestine as possible on its victim’s environment until the adversary’s mission is fulfilled. Second, the combination of different attack methodologies is often highly sophisticated, combining various techniques to cover their tracks and infect multiple important and strategic gateways in the company network infrastructure. Generally the full spectrum of intrusion technologies is utilized and will bypass firewalls, antivirus software and all other traditional security mechanisms that are in place. Next, most of the affected organizations only recognize such breaches after months or years, mostly followed by a huge impact on their business. Once a breach is identified, affected organizations need to quickly identify existing threats and loopholes into the network and adapt according to the attacker’s changing plans. Through our Incident Response dealing with APTs we are always using the following approach as immediate steps:

1. Get the attacker out of your network and close their original entry points
2. Identify and close new entry points
3. Hardening of critical systems
4. Implement strategic changes

Shadowserver has been collecting data in ever growing quantities over the last seven years. We have seen the growth of megabytes to terabytes of security related data and now are faced with having to store and analyze petabytes of data. This talk will lead you through the history of the different storage and growth methods we have suffered through up until today. We will review what is the most current for us and where we see storage going to in the future. We will offer specific technology suggestions and rules of thumb on deployment of that technology. Learn from our mistakes on what it took to plan to handle and plan for Petabytes of data and still get value and reports out of the data.

Cyber-war, cyber-crime and cyber-security are hot topics nowadays and discussed even in mainstream media. As information technology spreads and emerges into new fields - from smart meter and intelligent homes, intelligent cars and supervisory control and data acquisition system - IT security becomes more and more a vitally important part of our society.
Since discussing Carl von Clausewitz and "cyber war" does not resolve security problems itself, I introduced and discussed the concept for a cyber peace at last year's DeepSec conference.
To resolve security problems and getting things done, we founded the Global Cyber Defence Initiative - an interdisciplinary network of security experts (researchers, consultants, trainers, hacker…) and other organisations (corporations, chambers of commerce, scientific institutes…) who are interested in solving security problems.
Besides setting up the GCDI as a cluster of competence, we also work on a doctrine (including strategy and tactics) to resolve some of the IT security problems. Those include:

• getting more interdisciplinary research and work in IT security, esp. psychological and pedagogical
• setting up security awareness campaigns and evaluating their succes
• creating a didactics of security including methods and tools to teach security
• professionalising the field of IT security, e.g. with new job trainings and degree programmes
• eliminate the buffer overflow - buffer overflows are easy to prevent, yet they still exist
• making Operating Systems more resiliant against malware
• raise security awareness among end users and developers of industrial systems
• find methods to counter spear phishing
• make cryptography usable, making computer more usable in general
• stopping governments to undermine security with data retention, computer surveillance and other BS
• finally: make security sexy :-)

Your organization has firewalls, network IDS/IPS, anti-virus on multiple layers, maybe even HIPS, hardening and patching done and feels pretty safe and secure. But lots of companies and organisations who got breached had all that too. So maybe that’s not enough for today’s threats any more? This speech should give you lots of new intelligence resources to know who are the different threat actors, what are their motivations and techniques, what vulnerabilities are exploited by what threat actors, and some (maybe more or less unconventional) methods for prevention or detection of these threats. Most resources used are freely available, some need free registration and some are from personal work experience.

Based upon the recent decision made by the Government of the United States of America to shift their main political and military interests from Europe to the Pacific and the increasing significance of the Peoples Republic of China and their military and economical influence in this region,Europe must reconsider its military and economic vulnerabilities in light of multi – threats , posed by International Terrorism,International Organized Crime and Cyber Operations against Critical Infrastructures , military and other conflicts in the vicinity of Europa and their possible implications. Therefore,the gathering of Intelligence will be an imperative aspect of the future architecture of Intelligence and Security Agencies among the European States in times of shrinking military and civilian budgets.

• Present threats to Europe
• The actual status of Intelligence gathering within the States of the European Union
• Future developments of Intelligence structures and capabilities among selected States

To exchange information, security professionals can choose from many options. They can either work with a commercial organisation, join conferences to meet and learn to know their colleagues or subscribe to one of the many security mailing lists which exist out there.
Many of these options leave a lot to be desired:

• Often commercial entities are involved, although there is no direct need for them. We pay them for data which already is out there. For example, organisations like the Shadowserver foundation give such data away for free.
• Invitation only private mailing lists grow over time and it is unclear how many unwanted recepients are reading along. Although registered members need to vouch for newcomers, the world keeps turning, even angels fall.