Offensive Tactics That You Won't Hear About At HackerCons

Here's a first look at the partial agenda for Suits and Spooks Boston. We're still finalizing content for some of our speakers (i.e., "to be announced"). You'll quickly see the reason why it's closed to journalists and why no presentations will be shared or made public. And you'll also see why Suits and Spooks isn't just another security conference. No one covers what we do.

8:30am Registration and Continental Breakfast

9:00am: David Bray: "The Need for a Science of Cybersecurity and Critical Infrastructure"

9:30am: Rob DuBois "How would a red team plan and launch an assault against a typical power plant"

10:00am: Dale Peterson: "How adversaries could take out thousands of power plants around the world as well as large parts of the electric transmission system"

10:30am: Break

10:45am: John Sullivan: "How a large municipal water system can be disrupted and why there's no defense against it"

11:15am: Dan Kuehl: to be announced

11:45am: Lunch

12:45pm: Christopher Ahlberg "How to create a targeting package against a corporation or individual using social media"

1:15pm: Henry Shiembob "How multi-national corporations watch for outside threats but miss the more dangerous insider threat"

1:45pm: Dan Geer: to be announced

2:15pm: Larry Castro: "A Policy Review of Pending Cyber Security Legislation and What an Executive Order Might Cover"

2:45pm: Break

3:00pm: Christopher Burgess: "Creating havoc through the disruption of medical devices and electronically altering patient data"

3:30pm: Derek Gabbard: to be announced

4:00pm: Zach Tumin: to be announced

4:30pm: Closing Remarks

The final agenda will be announced on October 1st. A full list of speakers and their bios is at the Suits and Spooks Boston web page. Our early bird registration rate of $295 ($100 savings off the standard rate) ends in six days so reserve your space today.

Options

Early bird registration $295.00 USD

Add to Cart View detail

Reflections on Suits and Spooks DC

It's been one week since the Suits and Spooks DC (SNSDC) event took place and I've made four of the presentations given that day available for download. Not all of the speakers, including me, wanted their information available outside of the protected venue that we offer so for those of you who couldn't make it last week, watch for our upcoming announcement of Suits and Spooks LA this summer. Yes - the next event will be in Los Angeles - probably Santa Monica, to be specific. The exact date and venue is still being explored. but I can tell you that it will be held on a Friday so that, if you're traveling in, you can enjoy the weekend on the beach afterwards.

The general consensus of those attending Suits and Spooks DC was overwhelmingly positive. Dr. Mark Drapeau attended and wrote a review of SNSDC: "Suits and Spooks Rendezvous for the Greater Good". It was my hope that by inviting a multi-disciplinary lineup of speakers that some common themes would emerge, and in fact - that's what happened. One of the points that I made in my opening remarks was that we should re-assess which attacks should be investigated and which should be let go. The FBI and US-CERT are overwhelmed with tracking everything from probes against government networks to DDoS attacks to targeted attacks against the Defense Industrial Base. That's far too much to expect any agency to do let alone ones burdened with budgetary and staffing problems. One of John Robb's 27 Rules was that "it’s better to damage and impair a network than to completely destroy it, because it forces the target to use up more resources for repair." That's what Anonymous is succeeding at doing so brilliantly - using up massive amounts of federal, state and local resources in multiple countries without ever actually destroying anything. Someone needs to conduct a hard target evaluation on whether Anonymous attacks deserve the same importance as the theft of critical data or attacks against critical infrastructure.

While Anup Ghosh gave example after example of how inept our past approaches to information security have been, Dan Geer made an elegant argument for the need harness the world's "unemployed geniuses who are, incidentally, desperate for a job" rather than continue to turn over our security to machines. Jonathan Hutson started off his remarkable presentation on the Satellite Sentinel Project by explaining that the worst question one can ask when faced by a seemingly impossible task is "how can I help?" The passivity of that question doesn't fare well against insurmountable odds. A far better question, Jonathan explained, is "what needs to be done?". Then do it, no matter how impossible the problem looks to be. That's great advice, regardless of the challenge.

Add to Cart View detail