1609, 2012

DeepINTEL 2012 Review Articles

René Pfeiffer/ September 16, 2012/ Conference, Security Intelligence

The first DeepINTEL was very successful, and we enjoyed the presentations given and the many discussion that followed. While we will not disclose details or publish the slides of the talks, we would like to point you to reviews others have written. DeepINTEL 2012 by c-APT-ure DeepIntel 2012 – An Intelligent Security Conference DeepINTEL – Day one DeepINTEL – Day two Cybercrime – Who are the offenders? (Slides) Ergebnisse der IT-Sicherheitstagung DEEPINTEL am 3.3.2012 in Fuschl am See (in German) We definitely have some more ideas of how to tackle big data, how to identify and defend (in this order) digital assets, what „Cyberwar“ looks like, how to deal with threats and how to aquire information for analysing who’s after your data. Some of the topics with be described in more detail on our

Read More

1007, 2012

How to register for DeepINTEL

René Pfeiffer/ July 10, 2012/ Administrivia

The link to the online registration for DeepINTEL tickets has been activated. We’ve added a shiny IFRAME and a direct link on the DeepINTEL site. Since DeepINTEL is a bit different from DeepSec, here are the steps to your ticket. Contact us by sending your name and your affiliation. We start the vetting process and might ask for additional information. You get the code for your ticket. You register, get your ticket and send us your itinerary so we can take care of accommodation and your arrival. That’s about all you need. We already explained that the DeepINTEL event contains information and knowledge exchange which will not be reflected in public. This is why we provide a little exercise in data loss prevention (difficulty level easy ☺). Any presentation materials provided by the speakers

Read More

0307, 2012

DeepINTEL 2012 – Preliminary Schedule

René Pfeiffer/ July 3, 2012/ Administrivia, Schedule

This is the preliminary schedule of the first DeepINTEL seminar taking place in September 2012. We have more talks in the pipeline and the final decision won’t be long. Bear in mind that we will receive some additional information for some of the abstracts soon. The registration for DeepINTEL is online, too. If you are interested in attending DeepINTEL, please get in touch with us (you know, the vetting process and such). Please note that all further updates will be published at the main DeepINTEL web site. You will also find the speaker’s biographies there. Preventing and Detecting Mass-Malware and Advanced Threats (Tom “c-APT-ure” Ueltschi) Your organization has firewalls, network IDS/IPS, anti-virus on multiple layers, maybe even HIPS, hardening and patching done and feels pretty safe and secure. But lots of companies and organisations

Read More

2706, 2012

“The early bird gets the worm” or “Can you be faster than FUD?”

Mika/ June 27, 2012/ Conference, Security Intelligence

This is an old saying and like most old sayings it bears some truth: the first one to notice an opportunity does indeed have an advantage. But I don’t want to philosophize about “ancient wisdom” or something the like but I want to address a quite up-to-date topic: 0-day prevention, early warning systems, heuristic detection and how fast you have to be to catch worms and 0-day exploits. A lot of security vendors and open source security projects provide a very fast response to emerging threats. New worms and malware are detected quickly after appearance in the wild and signature patterns are updated a couple of times daily. So you should be safe. Really? How much of your resources would you spend on 0-day prevention and how effective is it? We have learned from

Read More

3105, 2012

What to expect from DeepINTEL

Mika/ May 31, 2012/ Conference, Security Intelligence

Preliminary schedule soon (CFP is still open) DeepINTEL will be a conference about security intelligence on September 3rd and 4th 2012 in the heart of Europe. We have prepared this project for a long time and we were monitoring the security intelligence landscape for quite a while. During the last year we had many chances to discuss different approaches and talk to many people involved in security intelligence, either on the provider, research or customer side. Our vision is now clear and here are some details which might have been covered here and here or which might be new: Our understanding of security intelligence We know quite well that security intelligence isn’t defined very clearly. Methods and tools differ as wildly as expectations and goals do. We find almost as many approaches as we

Read More

1704, 2012

Let’s talk about War

René Pfeiffer/ April 17, 2012/ Discussion, High Entropy, Stories

Extreme situations, entropy eruptions and unforeseen problems caused by complex interactions between a plethora of components are prime story material. You can use it in (science) fiction, you can use for breaking news, you can use it for scaring your children, you can use it for advertising and you can use it when talking about information security. Maybe this is why talking about „cyberwar“ is all the fashion these days. Let’s follow the trend and introduce the issue with style: No boom today. Boom tomorrow. There’s always a boom tomorrow. What? Look, somebody’s got to have some damn perspective around here! Boom. Sooner or later. BOOM! — Lt. Cmdr. Susan Ivanova, Babylon 5 This statement from a fictional character pretty much sums up the issue (plus it contains exactly the required amount of sources

Read More

1902, 2012

Five Million, quick and easy!

Mika/ February 19, 2012/ High Entropy, Odd, Security Intelligence

A good friend and former colleague of mine asked me recently, whether I could give him a tip how to make 5M quick and easy. My answer was “Nothing I could think of which doesn’t involve a lot of nasty things and imply a long stay in jail”. But that’s not what I wanted to discuss here, although it’s somehow related: We had a couple of talks at the DeepSec which shed a little light on the underground economy and I also started to take some dives into the “Deepnet” to get acquainted with jargon, topics, trends and so on. Btw: NO, no details on this: not what I have visited, not when or how I registered there, I don’t wanna get doxed (1), these guys can get nasty and we don’t need another

Read More

1702, 2012

DeepINTEL 2012 – Security Intelligence Call for Papers

René Pfeiffer/ February 17, 2012/ Administrivia, Security Intelligence

We already gave some hints on our security intelligence event we are planning for end of Summer. We now have a date and a venue: DeepINTEL will be held on September 3rd and 4th near Salzburg in Austria. This single track two day event addresses mainly critical infrastructure, state organizations (administrative and law enforcement), accredited CERTs, finance organizations and trusted parties and organizations with a strong relation or partnership to the aforementioned. Due to the sensitive topics and the nature of the participants and speakers we will have a vetting process for participants. We’d like to know our audience, so that we all can talk freely and openly during the event. If you have questions on this, please contact us directly via deepsec@deepsec.net or the contact information given on our web site. Here is

Read More

2001, 2012

DeepINTEL: Security Intelligence Event in Late Summer 2012

Mika/ January 20, 2012/ Conference, Internet, Security Intelligence

We are currently finalizing our new event in Summer 2012, focusing on Security Intelligence. Security Intelligence is one the newest disciplines in the IT security zoo and not yet fully defined (e.g. there is no Wikipedia article or rich bibliography of works dealing with the topic). We have been monitoring the Security Intelligence scene now for more than 3 years and found many different approaches, ranging from standard security advisories and alerts to deep insight into the current threat landscape. While some organizations (mostly network equipment vendors) seem to view Security Intelligence just as a new buzz-word for marketing others do a more thorough job: Especially software and anti-virus vendors like Microsoft, McAfee, IBM, Symantec and some ISPs like Verizon and AT&T provide valuable intelligence to the community. Also voluntary groups, free-of-charge spin-offs from

Read More