Another Side Of B-Sides

Last week's B-Sides San Francisco had a much different vibe than the previous B-Sides I attended. Granted, that one was held at a private resort in Las Vegas, and San Fran ain't Vegas -- although that may be debatable after Sourcefire's glittery Vegas-themed casino party and Barracuda Networks' Gold Club bash held in conjunction with the RSA Conference there last week.

The backdrop of the recent targeted attack on HBGary by Anonymous, Stuxnet, and a year of advanced persistent threat (APT) revelations and discussions in some ways made for a slightly more serious B-Sides. It also created a lot more buzz at the typically marketing-oriented RSA Conference across the street. The location for the "unconference" at a kids' museum (complete with kids running in and out of the venue amid hackers and attendees) kept B-Sides still a far cry from the more formal RSA Conference, though, and the informal nature of the presentation sessions were still apparent, even with the little theater lecture hall rooms in the Zeum.

Noticeably missing from the B-Sides agenda, of course, was the now-infamous talk that never happened: Aaron Barr's presentation on using social networks to gather intelligence. Among the three case studies Barr had planned to discuss during the talk, "Who Needs the NSA When We Have Social Media," were the Anonymous group, a critical infrastructure facility, and a military installation. The fallout came when Barr told The Financial Times in an article prior to the show that he was able to identify real names of most of the higher-ups in Anonymous. Anonymous hit back hard, dumping the contents of the HBGary Federal and HBGary's email messages and other sensitive information online, as well as commandeering Barr's Twitter account and posting his Social Security number and address.

Barr subsequently canceled his B-Sides talk, and HBGary later pulled out of the RSA Conference as well, leaving behind a sign on its booth on the show floor noting threats against its employees: "In addition to the data theft, HBGary individuals have received numerous threats of violence including threats at our tradeshow booth."

So the big week for the security industry began on a slightly more somber note; the HBGary/Anonymous incident infiltrated many presentations and talks, and was carefully discussed among gun-shy attendees and speakers. But that wasn't the only reality check for the security industry that had hit the fan. Stuxnet's presence also was felt, serving as a chilling reminder of the vulnerability of the power grid, and generating more debates over cyberwar and espionage.

One of the talks at B-Sides looked at security "marketecture," with Richard Bejtlich, director of incident response for General Electric and leader of the GE computer incident response team, and Travis Reese, president and COO at Mandiant. Andrew Hay, senior security analyst with The 451 Group's enterprise security practice, chaired the panel, which debated how security vendors use and abuse terms like "advanced persistent threat" and "cyberwar" to sell their wares.

Cyberwar has become one of the most popular topics of debate in the industry given the events of the past year: What the heck is cyberwar? Are we in one now? How will we know when we are at cyberwar? The panels sorted out just what constitutes cyberwar and an APT or targeted attack.

Bejtlich pointed out that according to Chinese information war doctrines, China believes the U.S. already started an information war against it. "They believe our culture is an affront to their sovereignty," he said. And Chinese attackers tend to use the "persistence" strategy of gaining a foothold in a targeted network for espionage purposes and finding ways to remain there as long as possible and employing a strategy of "plausible deniability."

Attackers from other regions take more pains to remain anonymous. "They don't use persistence. If you shut a box down [where they had infiltrated], they are gone," Bejtlich said.

And Mandiant's Reese noted that cyberespionage isn't the same as cyberwar, even though nearly 20 percent of the targeted attacks Mandiant has seen of late were against energy companies. He said cyberwar would have a military element as well.

No one drew definitive conclusions, but that's half the fun of the B-Sides banter. There's no stock "takeaway" slide at the end of a preso -- just open and continued dialogue and debate on security's hottest topics. Even with the large turnout last week in San Francisco, with some 500 attendees, B-Sides still was able to maintain the intimate atmosphere it was built on while at the same time growing into a more prominent venue for security professionals.

-- Kelly Jackson Higgins, Senior Editor, Dark Reading Follow Kelly (@kjhiggins) here on Twitter.