POSITIVE HACK DAYS



ORGANIZER

Business

The Bazaar, the Maharaja's Ultimatum, and the Shadow of the Future: Extortion and Cooperation in the Zero-Day Market

Want to visit   +97

Author: Alfonso de Gregorio

The work contains the first results of an ongoing study on extortion and cooperation in zero-day markets. The speaker will present a detailed overview of some inherent obstacles that market players face and describe the strategies, which allow maximizing profits.

  • Language
  • English

Alfonso De Gregorio is a security technologist, founder of BeeWise, and Principal Consultant at secYOUre. He also served as the chief security architect at an HSM vendor, expert at the European Commission, and visiting scholar at the Computer Security and Industrial Cryptography (COSIC) research group. He has been a speaker at Fault Diagnosis and Tolerance in Cryptography (FDTC), ISS World Prague, RSA Conference Europe, Metricon, Security by Design: From Theory to Practice, IFIPTM, and other conferences.

Alfonso de Gregorio Alfonso de Gregorio

Compromises in Large Infrastructures: Investigating and Managing Incidents

Want to visit   +82

Moderator: Vladimir Kropotov

Large companies' information infrastructures often attract hackers. Media highlights tens of hacks, while hundreds of bugs are fixed silently, and thousands of information systems remain compromised for many years.

How do infrastructure owners detect attacks? What do they do once a hack is detected and what should not be done? Who and when should be informed of an incident? What skills and technical equipment are required to detect and control incidents?

  • Language
  • Russian

Vladimir Kropotov, the head of monitoring department at Positive Technologies, a frequent speaker at a number of international conferences, including PHDays, ZeroNights, HITB, and Hack.lu.

Investments in a Global Development of Security Companies

Want to visit   +58

Moderator: Alexander Galitsky

The participants of this section will touch upon the areas of investments in the cyber-security companies, explain how to go global from the local markets and to structure the companies for the international market, as well as discuss further development of the companies as a result of the next investments rounds. These issues will be discussed by the section participants:

  • Yoav Tzruya, Partner, JVP Cyber Labs
  • Sergei Khodakov, Head of Information Security Foresight, Skolkovo Foundation
  • Geoffrey Baehr, General Partner, Almaz Capital Partners (former Chief Network Officer of Sun Microsystems)
  • Mikhail Kader, Distinguished systems engineer, Cisco

  • Language
  • Russian

Alexander Galitsky is a managing partner of Almaz Capital Partners, a venture fund founded in 2008 and backed by Cisco Systems, EBRD and IFC. His investments include Parallels, Yandex, QIK (sold to Skype), Vyatta (sold to Brocade), Acumatica, Alawar, EverNote, GridGain, WikiMart, etc. He pioneered in WiFi and VPN technologies in partnership with Sun Microsystems and was a pioneer of the Russian internet industry back in the 90s. Prior to becoming an entrepreneur, he served as one of the top technical executives for the Soviet space industry. Alexander was honored numerous times as the most influential person in the Russian IT and Internet industry by independent agencies, including Forbes.

Emerging Trends and Ideas About the Business of Security From a Silicon Valley VC Perspective

Want to visit   +47

Author: Geoffrey Baehr

The strategy and business of security companies is rapidly changing. This is due to the accelerating pace of threat evolution, rather than selling to new markets and users, the daily practice of security firms is shifting. However, we find that the comparable evolution in the practice of security techniques is not keeping pace both on the end user and corporate sides. Opportunities abound for startups to address these issues.

  • Language
  • English

Geoffrey Baehr is a general partner at Almaz Capital investing in areas ranging from security and networking to analytics and big data technologies. He is currently working on Software Defined platforms and networks and data analytics applied to the Internet of Things. He is also working on the scaling, management and control of virtualized infrastructure. Geoffrey is on a panel of reviewers for computer science related proposals and is a member of the IEEE (Institute of Electrical and Electronics Engineers) and ACM (Association for Computing Machinery).

Geoffrey Baehr Geoffrey Baehr

Pig in a Poke: M&A Security Issues

Want to visit   +45

Author: Natalya Kukanova

When a company buys another company, nobody ever thinks of a security audit. If, by any chance, it comes to the limelight, the current regulatory requirements alone are analyzed. Yandex mastered security audit implementation into the merging processes (M&A). The report describes the problems faced and the solutions found. No theory, just practice.

  • Language
  • Russian

Natalya Kukanova is an analyst at Yandex. Previously worked as an information security analyst and project manager at Digital Security and Positive Technologies; she was involved in development and implementation of IS systems and processes, as well as information security risk management.

Natalya Kukanova Natalya Kukanova

Building International White Hat Community

Want to visit   +41

The Hacker Manifesto provoked the ongoing dispute on the distinction between hackers and criminals, researchers and public enemies. Government bodies and companies only add to the confusion investing to the "white" and "gray" exploit and vulnerability market shaking an unsteady responsible disclosure process. This section will gather organizers of the world's top hacker conferences to discuss information security development and new trends on different continents.
Participants:

  • Dragos Ruiu (a.k.a. Dojo Mama-San) — CanSecWest, Canada
  • Vangelis — Power of Community, Korea
  • Sergey Gordeychik — SCADA Strangelove
  • Kana Shinoda — CodeBlue, Japan
  • Rodrigo Branco — H2HC, Brazil
  • Alexander Polyakov — ZeroNights, Russia
  • Bogk Andreas – Chaos Communication Congress

  • Language
  • English

Information Security: Careers of the Future

Want to visit   +38

Moderator: Evgeny Minkovsky

What jobs and technologies in information security will be in, say, five years? What about in fifteen years? During the meeting, invited experts will try to predict most likely trends using the Rapid Foresight method. This discussion is also available via online voting.

  • Igor Sokolov, a member of the Russian Academy of Sciences, director at the Institute of Informatics Problems of the Russian Academy of Sciences
  • Aleksey Lukatsky, a business consultant in information security with Cisco Systems
  • Mikhail Savelyev, director at Security Training Center Informzaschita, a specialized center of continuing professional education
  • Alexander Rusinov, director deputy at the Department of Development of Informational Technologies, Ministry of Telecom and Mass Communications of Russia
  • Dmitry Gorelov, commercial director at Active-Soft CJSC, director of RusCrypto
  • Ilya Dimitrov, a member of the Presidium of Opora Russia, an all-Russian non-governmental organization of small and medium-sized business, executive director at the Association of Electronic Trading Platforms

  • Language
  • Russian

Evgeny Minkovsky is a lead consultant for Positive Technologies and graduate of Moscow State University. He held courses dedicated to network security and OS Linux, also developed training courses at the security training center “Informzaschita”.

SAP Security: Real-life Attacks on Business Processes

Want to visit   +37

Author: Ertunga Arsal

SAP applications build the business backbone of the largest organizations in the world. The speaker will show exploits that manipule a business process to extract money, critical payment information, and credit card data out of the business backbone. He will explain the attack vectors, and what effective measures you can take to prevent, detect and respond to them.

  • Language
  • English

Ertunga Arsal is the founder of ESNC, a company specialized in securing large enterprise SAP implementations. He is an active security researcher, and SAP released more than 80 security patches for the vulnerabilities he reported. He has been a speaker at many conferences, including Black Hat, Defcon, Chaos Communication Congress, DeepSec, SecT, and Hack.lu.

Ertunga Arsal Ertunga Arsal

Future Technologies for Internal Threat Elimination

Want to visit   +36

Author: Natalya Kaspersky

Protection from data leaks has evolved to resistance to internal threats and business risks. According to InfoWatch Research Center, more than 80% of information security incidents experienced by companies are organized by their employees. This talk will focus on the main risks of internal threats and countermeasures of the future.

  • Language
  • Russian

Natalya Kaspersky graduated from Moscow State Institute of Electronic Engineering with a master’s degree in Applied Mathematics, and has a bachelor’s degree in Business of The UK Open University. She actively invests in high-tech companies.
Natalya is a co-founder of Kaspersky Lab, one of the world's largest antivirus companies, and CEO of InfoWatch Group of Companies, working in the sphere of information security. During her 10-year tenure at Kaspersky Lab, Natalya turned a small group of enthusiasts into a world-class international IT company with annual revenues of hundreds millions USD.
She holds multiple awards in Russian and International Business and IT including: “Best Technology Business Entrepreneur”, Women in Technology MEA 2014 awards, Dubai and Nominee as “The most influential person from Russia Q1 2015 for input in the IT industry” by BRIC Magazine, UK.

Natalya Kaspersky Natalya Kaspersky

Technologies for Protection of ICS Integrity

Want to visit   +36

Author: Andrey Doukhvalov

Modern security technologies are oriented mostly on data confidentiality and less on data availability or integrity. Unfortunately, this does not work for industrial control systems (ICS). The main protection goal here is to provide control continuity.

  • Language
  • Russian

Starting as a software engineer at Kaspersky Lab in 1998, Andrey Doukhvalov rose to the chief software architect. Now he is the Head of Future Technologies engaged in development of a secured operating system and technologies designed to protect ICS.

Andrey Doukhvalov Andrey Doukhvalov

Today's Russia in Unfriendly Cyberworld

Want to visit   +36

Moderator: Alexey Andreev

A panel discussion on what information security issues are now the most pending in Russia and other world.
Representatives of the State Duma, FSTEC, FSB and Ministry of Foreign Affairs of Russia are among the participants.

  • Language
  • Russian

Alexey Andreev, also known as Lexa and Mersey Shelley, is a Russian IT journalist, former editor-in-chief of the Webplanet web portal and other network projects. Alexey is the author of the cyberpunk novels "The Web" and "2048", full of that contain detailed predictions about our technological future. He received Russian and Ukrainian awards in literature, won three international haiku competitions (Japan). He currently works at Positive Technologies.

Expert Community's Role in Generation of Information Security Threat Databases

Want to visit   +34

Moderator: FSTEC of Russia

This year, FSTEC of Russia has launched a public information security threat database comprised of data on software vulnerabilities and typical threats to information systems. How is this resource made up? What is its purpose and how will it develop? How will its data be implemented? Experts, developers of information security systems and public officers will discuss these and other questions.

  • Language
  • Russian

How to Get the Common Criteria Certificate in Germany and Live to Tell the Tale

Want to visit   +32

Author: Dmitry Kuznetsov

The speaker will focus on his first successful experience in certifying a Russian security product in the international certification system ISO 15408. He will point out similarities and differences between Russian and international certification procedures, obstacles he encountered and ways to overcome them. The report will be a valuable source of information to those developers who plan to enter international markets of enterprise-level information security tools.

  • Language
  • Russian

Dmitry Kuznetsov is the Director of Methodology and Standardization at Positive Technologies. He manages scientific researches in product development and certification. He also represents the company in the technical committees of the Federal Agency on Technical Regulating and Metrology — “Information Security” and “Standards for Financial Operations”.

Dmitry Kuznetsov Dmitry Kuznetsov

Kaspersky Lab’s Solutions for ICS Security

Want to visit   +31

Author: Konstantin Kamanin

Kaspersky Lab’s overview of how to protect an ICS from main threats.

  • Language
  • Russian

Konstantin Kamanin is the Head of Industrial Security and Critical Infrastructure Protection, HQ, Product Management at Kaspersky Lab. Since 2013, he has been responsible for creating products and solutions that effectively protect industrial facilities and critical infrastructures from cyberthreats. He got wide experience in product management being responsible for creation and delivery of B2C, B2B, OEM and platform products and solutions.

Konstantin Kamanin Konstantin Kamanin

Black and White: Underground and Security Trends

Want to visit   +28

Author: Boris Simis

Co-author: Vladimir Kropotov

  • Language
  • Russian
Boris Simis Boris Simis, Vladimir Kropotov

Cyberspace in Outer Space

Want to visit   +28

Moderator: Aleksey Andreev

Development of the Internet and other communication systems brought space much closer. On the one hand, the progress ensured space discoveries by thousands of amateur researchers, but on the other hand, it left spaceships wide open to hacker attacks threatening to disrupt costly missions. This round table discussion will be dedicated to the development of space technology in the digital era.

Reports:

  • Dmitry Pashkov — Amateur Radio for Space Communication
    The radio amateur from Mordovia will describe his experience of intercepting and handling space images and other curious data he managed to retrieve from satellites using homemade devices.
  • Vitaly Egorov — How the Internet Brings Space One Step Closer
    The review report focuses on scientific studies conducted through the Internet. Its author became famous after finding the Soviet station Mars 3 while studying the images from Mars probes.
  • Alexander Ilyin — Foreseeable Future for World’s Space Technology
    The co-owner of Lin Industrial and resident of the Skolkovo space cluster will talk about real and ideal plans for space research in a variety of countries.

  • Language
  • Russian

Alexey Andreev, also known as Lexa and Mersey Shelley, is a Russian IT journalist, former editor-in-chief of the Webplanet web portal and other network projects. Alexey is the author of the cyberpunk novels "The Web" and "2048", full of that contain detailed predictions about our technological future. He received Russian and Ukrainian awards in literature, won three international haiku competitions (Japan). He currently works at Positive Technologies.

How to Spot Invisible Incidents

Want to visit   +26

Author: Dmitry Kuznetsov

Statistics show that attackers require three to five days to obtain full control over large IT infrastructures. While intruders may operate in a hacked network for months, companies usually become acknowledged once hackers' actions lead to significant financial loss.

Standard protection means are of no help. Hiring hackers to prevent hypothetical incidents is unreal. How then to detect intruders in your network?

  • Language
  • Russian

Dmitry Kuznetsov is the Director of Methodology and Standardization at Positive Technologies. He manages scientific researches in product development and certification. He also represents the company in the technical committees of the Federal Agency on Technical Regulating and Metrology — “Information Security” and “Standards for Financial Operations”.

Dmitry Kuznetsov Dmitry Kuznetsov

Destroy — Create — Destroy

Want to visit   +23

Author: Alexey Kachalin

Assessment of information system and application security in the course of development is gradually becoming popular. Security specialists have finally gained credence to be included in development teams and start creating knowledge databases to store research results. What are developers and information system owners expecting from researchers? This talk is about current tasks to be solved and the quality of regular assessments.

  • Language
  • Russian
Alexey Kachalin Alexey Kachalin

Information Security Market: Novelties, Questions & Answers

Want to visit   +22

Moderator: Oleg Glebov

Leading participants of the IS market will introduce their products and solutions:

  • Oleg Glebov — Overview of Advanced Threats and Countermeasures
  • Aleksey Kiselev — Modern DDoS Attacks: Tendencies, Risks and Approaches to Security
  • Igor Lyapunov — From IS Products to Services. Distribution Evolution. Jet Infosystems
  • Yuri Sergeev, Head of Software Security — Sberbank-Technology Software Security Practice @ Sberbank Technology

  • Language
  • Russian

Oleg Glebov rose from a system administrator in a small IT company to a well-known information security expert. More than 100 articles in IT and IS magazines. A certified information security expert with fundamental security and cryptography knowledge has almost 6 years of active work with leading global vendors (HP, SUN, IBM, CheckPoint, Cisco, Wibu-Systems, and McAfee).