Coding standards, including Motor Industry Software Reliability Association (MISRA) C and CERT C, exist to service the safety and security markets performing C language development. The requirements of these markets are described and some background information on these coding standards and the C language are provided. MISRA C and CERT C are compared, and the possibility of a single standard that addresses the combined safety and security market is discussed. Engineering Challenges Doing Intrusion Detection in the Cloud Craig Chamberlain, N/A N/A Conventional, specification-based intrusion detection paradigms, particularly around network intrusion detection, are not easily applied to the software defined network abstractions that power multi-tenant public clouds. While there are challenges, there are also opportunities to do a reboot on traditional network security monitoring and embrace new tactics. This talk contains the lessons learned during extensive research and implementation of various forms of intrusion detection and security monitoring in EC2 and AWS. The talk contains extensive data including comparative test results of IDS tools; examination of what works well and what does not; and a fun interactive portion on real-world cloud threat hunting with syscalls. The History and Future of Public Key Infrastructure Sandy Carielli, N/A N/A Public Key Infrastructure (PKI) has been around for decades and has been through multiple rounds of pre-mature burials and anticipated comebacks. In this session, we look past the hype cycles, delve into the past 20 years of applied PKI, and talk about the role it can play today: • The early promise of PKI • Early successes – where did PKI take off? Where is it ubiquitous today? • PKI and the end user experience – an early and enduring example of the security / usability problem. What effect did that have on the industry and the narrative? • The evolution past the end user and into the machine • PKI’s future in an Internet of Things – how it must continue to evolve Throwing Out the Rulebook On Application Security Mike Milner, N/A N/A When it comes to web application security, many organizations follow a generic set of best practices that include WAFs and static pen testing processes that often occur before the application launches. Post-launch, IT operation teams then flag various vulnerabilities that come up to the development team in the hopes that eventually they'll have time to patch them up. However, you won’t hear about that if you attend this session, you’ll obtain so much more. The current status quo for application security has fallen inadequate, and it comes as no surprise that web applications - both large and small - are constantly being hacked as a result. With new applications being developed every day and hackers racing to be one step ahead, simply checking off the boxes when it comes to security is no longer enough. As founder of IMMUNIO, a first-of-its-kind tool that can protect applications in real-time and from within - an entirely new concept for the industry that many are still wrapping their heads around - I can offer insight into where the gaps are with today's status quo, and how businesses can effectively (and affordably) up their security game. In this session, I'll demonstrate how application protection software built into the application can help guard against some of today's worst attacks. The demonstration will be done by simulating a hack and walking the audience through the steps of blocking an attack as it’s happening, then quickly finding and fixing the vulnerability without ever having to make a call to the development team. In the session, I will also address some of today's most high profile hacks and shed light on the reasons data breaches of 2016 could be the source of major account takeovers in the years to come (if we don't start evolving how we protect web applications). IoT Security: My Worst Nightmares Come True and How To Sleep Better At Night Paul Asadoorian, N/A N/A Do you believe IoT vulnerabilities impact your personal life and the security of the networks you are defending? This presentation will explore how IoT devices are being used for all kinds of evil schemes, and more importantly, educate the security community on the current solutions. Over the past 15 years, I’ve been researching some variant of what we now call “IoT” devices and their lack of security. In today’s world of IoT, all of my nightmare scenarios have come true. All those times I laid awake at night and thought “Man, if an attacker were to just scan the Internet for default passwords on IoT devices, that’d be one heck of a botnet” are coming back to haunt me every day when I read the security headlines. The mainstream media has largely gotten it wrong; they have no idea how to communicate the problem or describe the solutions. Find out how IoT security impacts you, society as a whole, your network security, and how we can solve the problem. For the first time ever, there are actual efforts in the works to make IoT security better, and one thing they need is the support of the security community, so come be a part of the effort to make the IoT security world a better place! I will try not to say “I told you so”, but I really can’t make any promises on that front. A slide or two from presentations delivered 5+ years ago may be referenced (which makes it really hard not to say “I told you so!”, when in reality I really did tell you so, but I digress…) Sneak preview: My worst fear: the industry adopts an awful acronym for embedded systems, devices grow exponentially in quantity, none of the security problems are addressed, and I am forced (once again) to start presenting on “IoT Security”.... Crowdsourced Security: The Good, The Bad, and The Ugly Mike Shema, N/A N/A Cost, quality, and coverage. These are the three major factors that security professionals must consider when designing a strategy for testing their web applications. There is a major talent shortage in the security industry, and tools will only get you so far. How can security professionals leverage the power of the crowd to get fresh, incentivized eyes on their latest and greatest web apps, mobile apps, and APIs? Public and private bug bounties, crowdsourced penetration testing… what are the advantages and risks to engaging in this brave new world of “hire the hacker”?