Dear members,

CIRCL and BlackRidge Technology are glad to invite you for our session on leveraging Identity-Based Network Security and Honeypot Observations in Luxembourg on 15 March 2017.

Agenda:

• 17:50 - 18:00 Reception
• 18:00 - 18:45 CIRCL’s Early Detection Network - Honeypots observationsand their usefulness (Gerard and/or Alex about CIRCL honeynet network and data)
• 18:45 - 19:30 Introduction to Identity-based Network Security (Robert presenting BlackRidge's approach and honeypot data to date)
• 19:30 - 19:45 Questions, Answers & Closing
• 19:45 - 21:00 Cocktail

During the evening we will present the following:

--CIRCL will introduce and provide an overview of their HoneyBot services in Luxembourg. CIRCL continuously explores new engineering solutions to improve operations and to predict current and future threats. One such tool is the HoneyBot Early Detection Network which consists of the distributed operation and exploitation of CIRCL HoneyBots. These services are part of a cyber threat research project with the aim to improve security on the Internet. CIRCL will discuss observations of their services and the value of such data.

--BlackRidge will introduce the new concept of identity-based network security. By applying identity-based security policies to the first packet of a TCP/IP connection one can gain real-time visibility of and control access to network resources at the earliest possible time. This approach offers a new and practical way to monitor access policies, handle exceptions, and provide proof to auditors and regulators of your controls including who is doing what on your network. Example data will be provided of such network policy actions including blocking traffic (cloaking your network) or redirecting unauthorized traffic to honeypots for threat intelligence collection.

Our Speakers for the evening:

CIRCL's - Gérard Wagener (gerard.wagener@circl.lu):

Gerard currently works as an Operator for the national Computer Incident Response Center Luxembourg (CIRCL) for the Grand-Duchy of Luxembourg. He is specialized in the information security area and has deep operating system development and reverse engineering skills. He reversed engineered malicious software and discovered numerous implementation flaws in information forensics tools. His scientific achievements have been praised and rewarded twice at highly ranked conferences.

Gerard’s past doctoral research at the University of Luxembourg and INPL Nancy, France focused on adaptive decoying systems to improve intelligence gathering on attackers in computer networks. He is the founder and lead developer of the Adaptive Honeypot Framework, which serves as the solid foundation for constructing intelligent honeypots. Gérard comes from the malware research community, where he worked on projects such as sandboxes for monitoring and analyzing malicious software. In addition to these hands-down activities, his scientific work has investigated malware classification using phylogenetic trees and intelligent high-interaction honeypots driven by game theory. In his spare time, Gérard can often be found in his garage fixing cars and doing metalwork.

BlackRidge's - Robert Forster (rforster@blackridge.us)

Robert currently works as Strategic Business Advisor for BlackRidge Technology and is based in Luxembourg overseeing company efforts in Europe and the Middle East. Robert specializes in the application of technology and security research to help enhance the security posture for public and private organizations. Robert has over 17 years of experience and worked for some of the world’s largest multinational organizations. He began his career with the US Army, then transitioned to management roles with ExxonMobil Oil Corporation and Hewlett-Packard.

Robert is also the founder and managing member of Edgemount Solutions S.à r.l., a Luxembourg IT-business consultancy and enjoys global business development, business strategy and IT security research. He resides in Bertrange with his wife and three young daughters.