To the INFOSEK 2008 - FORUM Conference were envited besides numerous Slovenian speakers also foreign speakers - information security experts from EU.
Pre-conference Day: we present the most famous (former) hecker.
The Art of Deception
With more than fifteen years of experience in exploring computer security, Kevin Mitnick is a largely self-taught expert in exposing the vulnerabilities of complex operating systems and telecommunications devices. His hobby as an adolescent consisted of studying methods, tactics, and strategies used to circumvent computer security, and to learn more about how computer systems and telecommunication systems work.
In building this body of knowledge, Kevin gained unauthorized access to computer systems at some of the largest corporations on the planet and penetrated some of the most resilient computer systems ever developed. He has used both technical and non-technical means to obtain the source code to various operating systems and telecommunications devices to study their vulnerabilities and their inner workings.
As the world's most famous (former) hacker, Kevin has been the subject of countless news and magazine articles published throughout the world. His first best-selling book, The Art of Deception, was published in October 2002 by Wiley and Sons Publishers. His second title, The Art of Intrusion, was released in February 2005.
THE ART OF DECEPTION: ARE YOU IN DANGER OF BEING ‘CONNED'?
Join us to hear the world's most famous former hacker share his perspective on the threat of "social engineering"-a highly effective type of attack that exploits the human element of corporate security.
Mitnick illustrates why a misplaced reliance on security technologies alone, such as firewalls, authentication devices, encryption, and intrusion detection systems are virtually ineffective against a motivated attacker using these techniques.
In the corporate environment, a large number of unsuspecting victims never realize they have been manipulated. Will your employees be the next? Through concrete examples, Mitnick shares what your business can do to develop a creative and engaging security program that heightens awareness, motivates employees to change their attitudes, influences them to think defensively, and encourages the adoption of good security habits.
More information about Kevin Mitnick available on http://www.kevinmitnick.com/
Information Security: moving from awareness to management
This talk introduces the need to involve members in the organisation in dialogue to build an understanding of the need for information security and agree how the organisation should protect its important information. It considers that awareness often misses the mark because it is seen as not relevant or that there is always something more important to consider than information security awareness. It builds on the statement in the ENISA information security awareness guide that recognises that ".. taking a change management approach to awareness initiatives is crucial.."
Jeremy Hilton is a lecturer at Cardiff University specialising in information security, information systems strategy, organisational learning and change. He has been working in information security within industry for most of his career, focusing on information security policy, the implementation and operation of public key infrastructures, and secure systems operation. His main research interests are in effective methods of introducing a culture of information security in organisations, and the communication and enforcement of information security requirements within and between organisations.
Social Aspects of IT Security: Social Engineering
In recent years, people have become more familiar with the term "social engineering", the use of deception or impersonation to gain unauthorised access to sensitive information or facilities. Because computer security is becoming more sophisticated and more difficult to break (although this is still very possible) more people are resorting to social engineering techniques as a means of gaining access to an organisation's resources. Logical security is at a much greater risk of being compromised if physical security is weak and security awareness is low. Performing a social engineering test on an organisation gives a good indication of the effectiveness of current physical security controls and the staff's level of security awareness. But once you have decided to perform a social engineering test, where do you start? How do you actually conduct a social engineering test?
Sharon manages Ernst & Young's UK Attack & Penetration Testing Team in London, where she enjoys performing social engineering assignments as well as penetration testing activities. She lectures regularly on social engineering and has previously presented at conferences including Recon, IT Security Congress, SANS Secure Europe and ISSE/Secure 2007.
dr. Blaž Rodič, Fakulteta za družbene vede
"Blaž Rodič is a researcher at the Faculty of Applied Social Studies and the
University and Research Centre Novo mesto. Security mechanisms in Wi-Fi (802.11b/g) networks have seen a lot of development in the last seven years, and most of that development was in response to discovered and published vulnerabilities.
The speaker will present the available security mechanisms in Wi-Fi networks and
their vulnerabilities and threats and identify solutions for (more) secure wireless
computer networks. A few words will be also dedicated to security in Bluetooth
Location security in wireless and mobile networks
Ernesto Damiani is a full professor at the Information Technology Dept., University of Milan, where he leads the SESAR research lab, and the Head of the University of Milan's Ph.D. program in Computer Science. He holds a held visiting positions at several international research institutions. Prof. Damiani serves in the editorial board of several journals in the secure software development area; among others, he is Area Editor of the Journal of System Architecture and Associate Editor of the IEEE Transactions on Service-oriented Computing. He is the Vice-Chair of the IEEE Technical Committee on Industrial Informatics, the Chair of IFIP WG 2.6 on Database Semantics and the Secretary of the IFIP WG 2.13 on Open Source Development.
Understanding Critical Success Factors' interrelationships to Improve Information Systems Security Management Actions
I could start the speech by introducing the current state of Information Systems Security Management (ISSM) issues in Small and Medium size Enterprises (SMEs). Then, I plan to approach information security from a managerial perspective by presenting an ISSM framework which gathers critical success factors (CSFs) and shows the necessity to better understand and assess the effectiveness of implemented Security Controls. In addition, I will also share the results of my doctoral work by presenting security management behaviours within SMEs based on the analysis of the interrelations between these CSFs utilizing Systems Thinking. The proposed speech aims to direct IT administrators and/or security managers towards more managerial and proactive security practices instead of currently technical and reactive security practices. Thus, they could straightforward identify, manage and communicate security issues.
Web based threats: drive-by attacks
Due to a decreasing number of remotely exploitable vulnerabilities, and advances in client protection mechanisms, the threat landscape for the last couple of years is shifting towards web based threats: almost every computer user uses web browsers, which come preinstalled on almost every operating system.
Legitimate web servers are today commonly compromised and the content they are serving changed. All a victim has to do now is visit such a web page with a vulnerable browser in order to get infected through a drive-by exploit.
This presentation will cover web based threats history. Attack methodologies and tools, such as MPack, IcePack, WebAttacker and Nuclear Malware Kit will be described, as well as protection mechanisms and methodologies.
The presentation will also include a live demonstration of a drive-by attack with the MPack attack package.
Bojan graduated in 1998 at the Faculty of Electrical Engineering and Computing, University of Zagreb. After graduation he started working in the LSS group as an associate on information security projects.
He is a long-standing author for Bug and Mreža computer magazines and has his own security column in the magazine Mreža. He is also the author of the book „What are the viruses and how they work?" published by SysPrint. Since 2003, he worked at the University of Auckland, New Zealand, as an information security specialist, where he actively participates as an architect in numerous enterprise projects.
In 2005 he became one of the handlers of SANS Internet Storm Center (ISC), a voluntary organization with a goal to detect security problems, analyze risks and distribute technical information. ISC is the most often quoted source of security information in the world today. Since 2006 Bojan works in INFIGO IS as a senior information security consultant.
He is a member of leading international organizations in the area of information security: ISC2 and SANS. He is a certified information security specialist (CISSP), RedHat certified engineer (RHCE), GCIA (GIAC Certified Intrusion Analyst) and GCIH (GIAC Certified Incident Handler). Bojan is also a member of the SANS Advisory Board and a GIAC Gold Advisor.
In 2007 Bojan was a co-author for the book "AVIEN Malware Defense Guide for the Enterprise" where he wrote a chapter on malware analysis. He is also one of the authors of the SANS' 610 course: "Reverse-Engineering Malware: Malware Analysis Tools and Techniques".
Cyberattacks on Estonia (also known as the Estonian Cyberwar) refers to a series of cyber attacks that began April 27, 2007 amd swamped websites of Estonian organizations, including Estonian parliament, banks, ministries, newspapers and broadcasters, amid the country's row with Russia about relocation of a Soviet-era memorial to fallen soldiers, as well as war graves in Tallinn. Most of the attacks that had any influence on general public were distributed denial of service type attacks ranging from single individuals using various low-tech methods like ping floods to expensive rentals of botnets usually used for spam distribution. Spamming of bigger news portals commentaries and defacements including that of the Estonian Reform Party website also occurred.
Pete Verreck, Computer Evidence Ltd
Forensic Examination Procedures Following Intellectual Property Theft
The talk will look at how computer forensic techniques are used to investigate intellectual property theft. The basic principles for the forensic collection and analysis of computer evidence will be explained and examples of the type of equipment shown. The talk will be illustrated with examples of how past cases were solved and the perpetrators prosecuted.
Investing in privacy protection with Privacy-enhancing Technology
He will talk about "Investing in privacy protection with Privacy-enhancing Technology", where the focus of his talk will be a bussiness-oriented view on the benefits and constraints of privacy in information systems. Businesses and vendors face challenges when they make investment decisions in information systems. What value will they create investing in PETs? What are the business benefits? Which are the privacy risks relevant to information system operators and their customers?
Future of Software and Services: a perspective of Security Issues in SOA Deployment
Cryptographic Hash Functions - Recent Results and Implications
Cryptographic hash functions play a fundamental role in cryptography. They are used amongst others as a stand-alone primitive for computing cryptographic checksums, in message authentication algorithms, and in applications such as digital signature schemes. In the past years much progress has been made in the cryptanalysis of hash functions with the surprising and unsettling result that most of the hash functions have been broken or show significant weaknesses. In this talk, we will review cryptographic hash functions and emphasize on the implications of recent results on hash-based message authentication algorithms and on applications such as digital signatures. Finally, we will discuss future
directions in the design of new cryptographic hash functions.