19th Annual FIRST Conference: Program

Program Schedule

Overview

Saturday, June 16^th

Train the Trainers Workshop

Sunday, June 17^th

Train the Trainers Workshop

Registration

Program Committee Meeting

Welcome Icebreaker Reception

Monday, June 18^th

Tutorials

Geek Zone

SIG Meetings

Beer 'n Gear

Tuesday, June 19^th

Tutorials

SIG Meetings

Pre-AGM

Wednesday, June 20^th

Keynote Speakers

Main Conference

Geek Zone

SIG Meetings

Vendor Booths

Conference Banquet

Thursday, June 21^st

Keynote Speakers

Main Conference

Geek Zone

SIG Meetings

Vendor Booths

Annual General Meeting (AGM)

Sponsor Reception

Birds of a Feather (BOF)

Friday, June 22^nd

Keynote Speakers

Main Conference

Geek Zone

SIG Meetings

Vendor Booths

Conference Closing

FIRST 2007 Security Conference Blog

Facilities

Registration — Triana Foyer

Sunday 14:00—18:00

Monday — Wednesday 08:00—17:00

Thursday — Friday 08:00—14:00

Vendor Booths — Giralda IV & V

Wednesday — Friday 08:00—18:00

Terminal room — Girlada VI & VII

Monday — Thursday 08:00—17:00

Lunch — Restaurant

Monday — Friday 13:10—14:40

Program

Download the conference schedule

schedule-2007.pdf
PDF format, 0.5Mb

Saturday, June 16^th

	Arenal I & II
09:00 – 10:50	Workshop Train the Trainers Workshop (Members only)
10:50 – 11:20	Morning tea break
11:20 – 13:10	Train the Trainers Workshop (continued)
13:10 – 14:40	Lunch break
14:40 – 16:30	Train the Trainers Workshop (continued)
16:30 – 17:00	Afternoon tea break
17:00 – 18:50	Train the Trainers Workshop (continued)

Sunday, June 17^th

	Arenal I & II	Meet at Conference Reception Desk	Santa Cruz
09:00 – 10:50	Workshop Train the Trainers Workshop (Members only)
10:50 – 11:20	Morning tea break
11:20 – 13:10	Train the Trainers Workshop (continued)
13:10 – 14:40	Lunch break
14:40 – 16:30	Train the Trainers Workshop (continued)
16:30 – 17:00	Afternoon tea break
17:00 – 18:50	Train the Trainers Workshop (continued)	Program Committee Meeting
19:00 – 21:00			Added Attraction Welcome Icebreaker Reception

Monday, June 18^th

	Conference Room I - Giralda I & II	Conference Room II - Santa Cruz	Geekzone I - Nervion I & II	SIG Room - Giralda III	Exhibition Room – Giralda IV & V
09:00 – 10:50	Tutorial Creating and Managing CSIRTs Robin Ruefle (CERT/CC, US), Georgia Killcrece (CERT/CC – Carnegie Mellon University, US)	Tutorial Understanding & Analyzing Botnets Jeff Nathan , Jose Nazario (Arbor Networks, US)	Geek Zone Forensic Discovery Dr. Wietse Z. Venema (IBM Research – GSAL, US)	Special Interest Group Law Enforcement / CSIRT Cooperation SIG Chris Painter (Department of Justice, US), Yurie Ito (JPCERT, JP), Matthew Pemble (Vizuri Limited, UK)
10:50 – 11:20	Morning tea break
11:20 – 13:10	Creating and Managing CSIRTs (continued)	Understanding & Analyzing Botnets (continued)	Forensic Discovery (continued)	Law Enforcement / CSIRT Cooperation SIG (continued)
13:10 – 14:40	Lunch break
14:40 – 16:30	Creating and Managing CSIRTs (continued)	Understanding & Analyzing Botnets (continued)	UNIX/C Programming traps and pitfalls Dr. Wietse Z. Venema (IBM Research – GSAL, US)	Internet Infrastructure Vendors (Vendor SIG) Gaus . (Cisco Systems, US)
16:30 – 17:00	Afternoon tea break
17:00 – 18:50	Creating and Managing CSIRTs (continued)	Understanding & Analyzing Botnets (continued)	UNIX/C Programming traps and pitfalls (continued)	Internet Infrastructure Vendors (Vendor SIG) (continued)
19:00 – 22:00					Added Attraction Beer 'n Gear
20:00 – 22:00	Added Attraction FIRST Football Cup To take part please register with Martijn van der Heide via email: mheide@kpn-cert.nl or at the conference with Francisco Monserrat, Jordi Aquila, Don Stikvoort.

Tuesday, June 19^th

	Conference Room I - Giralda I & II	Conference Room II - Santa Cruz	Geekzone I - Nervion I & II	SIG Room - Giralda III	Santa Cruz
09:00 – 10:50	Tutorial Creating, Managing and Using a Malware Lab Grant Deffenbaugh , Lisa Sittlerl , Nick Ianelli (CERT/CC, US)	Tutorial System, Network and Security Log Analysis for Incident Response Anton Chuvakin (LogLogic, Inc., US)	Tutorial Do it yourself: The latest in forensic tools and techniques to examine Microsoft Windows Andreas Schuster (Deutsche Telekom AG, Group Security, DE), Pär Österberg (Swedish IT Incident Centre, Sitic, SE)	Added Attraction Corporate Executive Programme (CEP)
10:50 – 11:20	Morning tea break
11:20 – 13:10	Creating, Managing and Using a Malware Lab (continued)	System, Network and Security Log Analysis for Incident Response (continued)	Do it yourself: The latest in forensic tools and techniques to examine Microsoft Windows (continued)	Special Interest Group Common Vulnerability Scoring System (CVSS-SIG) Gavin Reid (Cisco Systems, US)
13:10 – 14:40	Lunch break
14:40 – 16:30	Creating, Managing and Using a Malware Lab (continued)	System, Network and Security Log Analysis for Incident Response (continued)	Do it yourself: The latest in forensic tools and techniques to examine Microsoft Windows (continued)	IT-ISAC Tech SIG Peter G. Allor (ISS – Internet Security Systems, US)
16:30 – 17:00	Afternoon tea break
17:00 – 18:50	Creating, Managing and Using a Malware Lab (continued)	System, Network and Security Log Analysis for Incident Response (continued)	Do it yourself: The latest in forensic tools and techniques to examine Microsoft Windows (continued)	SIG Meetings
19:00 – 22:00					Pre-AGM

Wednesday, June 20^th

	Conference Room I - Giralda I & II	Conference Room II - Santa Cruz	Conference Room III - Arenal I	Geekzone I - Nervion I & II	SIG Room - Giralda III
09:00 – 09:10	Conference opening
09:10 – 09:20	Opening Speech
09:20 – 10:00	Keynote Speaker Lord Toby Harris of Haringey (House of Lords, UK)
10:00 – 10:50	Identity Management Systems: the forensic dimension Peter Sommer (London School of Economics, UK)	Data on Data Breaches: Past, Present, and Future Chris Walsh (cwalsh.org, US)	Long term instability of high priority incident response – A system dynamics simulation approach Johannes Wiik , Jose J. Gonzalez (Agder University, NO), Klaus-Peter Kossakowski (SEI Europe GmbH, DE)	Geek Zone A day in the life of a hacker... Things we get up to when nobody is looking, and that keep me awake at night. Adam Laurie (The Bunker Secure Hosting Ltd., UK)	Special Interest Group Network Monitoring SIG Carol Overes, Menno Muller (GOVCERT.NL, NL)
10:50 – 11:20	Morning tea break
11:20 – 12:20	How many RAT's do you know out there? Simon Gunning (Digilog UK Limited, UK)	Inside the Perimeter: 6 Steps to Improve Your Security Monitoring Chris Fry , Martin Nystrom (Cisco Systems, US)	What We Learn From Cyber Exercises, or Not James N. Duncan (BB&T Corporation, US)	A day in the life of a hacker... Things we get up to when nobody is looking, and that keep me awake at night. (continued)	Network Monitoring SIG (continued)
12:20 – 13:10	Provider Practicalities and Paranoia: Modern ISP incident response Scott McIntyre (KPN-CERT, NL)	Taming Packets: The Network Expect Framework for Building Network Tools Eloy Paris (Cisco PSIRT, US)	Why Protection against Viruses, Bots, and Worms is so hard – Malware seen as Mobile Agents Till Dörges (PRE-CERT – PRESECURE Consulting GmbH, DE)	A day in the life of a hacker... Things we get up to when nobody is looking, and that keep me awake at night. (continued)	Network Monitoring SIG (continued)
13:10 – 14:40	Lunch break
14:40 – 15:40	Using Intelligence to Forecast Risk and Allocate Resources: It's Not Hocus-Pocus Anymore Peter G. Allor (ISS – Internet Security Systems, US)
15:40 – 16:30	The Art of RFID Exploitation Melanie Rieback (Vrije Universiteit Amsterdam, NL)	Reviewing the VoIP Threat Landscape Peter Cox (Borderware, UK)	Security Risk Management: breaking through technology and market barriers – a real life story Avi Corfas (Skybox Security, Inc, US)	Insider Threat – The Visual Conviction Raffael Marty (ArcSight, Inc., US)	CSIRT Metrics Georgia Killcrece (CERT/CC – Carnegie Mellon University, US)
16:30 – 17:00	Afternoon tea break
17:00 – 18:00	Beyond the CPU: Defeating Hardware Based RAM Acquisition Tools Joanna Rutkowska (Invisible Things Lab, PL)	Cyber Fraud Trends and Mitigation Ralph Thomas (Verisign/iDefense, US)	Assessing Incident Severity in a Network and Automatic Defense Mechanisms Klaus-Peter Kossakowski (SEI Europe GmbH, DE), Luis Francisco Servin Valencia , Till Dörges (PRE-CERT – PRESECURE Consulting GmbH, DE)	Insider Threat – The Visual Conviction (continued)	CSIRT Metrics (continued)
18:00 – 18:50				Insider Threat – The Visual Conviction (continued)
19:30 – 22:00	Added Attraction Conference Banquet – Hacienda El Visir

Thursday, June 21^st

	Conference Room I - Giralda I & II	Conference Room II - Santa Cruz	Conference Room III - Arenal I	Geekzone I - Nervion I & II	Geekzone II - Arenal / Nervion III	SIG Room - Giralda III
09:00 – 09:10	Day Opening
09:10 – 10:00	Keynote Speaker Francisco García Morán (Director General, DG Informatics, European Commission, EU)
10:00 – 10:50	Targeted attacks (spear phishing): A demonstration and analysis of a former Office 0-day vulnerability Robert Hensing (MSCERT – Microsoft, US)	Software Security: Integrating Security Tools Into a Secure Software Development Process	Forensics for Managers – Presenting and understanding forensics from the MBA point of view Mr. Ryan Washington (Crucial Security, US)	Geek Zone I know what you (and your company) did last summer... Roelof Temmingh (Paterva, ZA)	Geek Zone Botnet: Creation, usage, detection and eradication Guilherme Vênere, Jacomo Piccolini (CAIS/RNP – Brazilian Academic and Research Network, BR), Francisco Monserrat (IRIS-CERT – RedIRIS, ES)	Special Interest Group SIG Meetings
10:50 – 11:20	Morning tea break
11:20 – 12:20	The Security needs of the State versus the rights of the individual Bob Ayers (Chatham House, UK)	Flaws and frauds in the evaluation of IDS/IPS technologies Stefano Zanero (Politecnico di Milano T.U. & Secure Network S.r.l., IT)	NUS IT Security Landscape Fong Lian Yong (National University of Singapore, SG) Privacy matters in directories Javier Masa, Jose Alfonso Accino (University of Malaga, ES), Victoriano Giralt (University of Málaga, ES)	I know what you (and your company) did last summer... (continued)	Botnet: Creation, usage, detection and eradication (continued)	Abuse Handling (AH-SIG) Martijn van der Heide (KPN-CERT – Chairman KPN-CERT, NL)
12:20 – 13:10	Our Own Worst Enemies Frank Wintle (PanMedia Ltd, UK)	Vulnerability Remediation Decision Assistance system Yurie Ito (JPCERT, JP), Art Manion , Hal Burch (CERT/CC, US)	Dealing with Unreliable Software: Exile, Jail, and other Sentences Dr. Bernd Grobauer , Dr. Heiko Patzlaff , Martin Wimmer (Siemens-CERT, DE) Using instrumented browser instances for detecting 0-day exploits and filtering web traffic Dr. Heiko Patzlaff (Siemens-CERT, DE)	I know what you (and your company) did last summer... (continued)	Botnet: Creation, usage, detection and eradication (continued)	Abuse Handling (AH-SIG) (continued)
13:10 – 14:40	Lunch break
14:40 – 15:40	Keynote Speaker George Stathakopoulos (General Manager of Product Security, Microsoft, US)
15:40 – 16:30	The Benefits of FIRST: How to sell FIRST to your Upper Management Ray Stanton (BT, UK)
16:30 – 17:00	Afternoon tea break
17:00 – 18:50	Side event Annual General Meeting (AGM) * Limited to FIRST team members, FIRST liaison members and their invited guests, subject to approval by the Steering Committee
19:00 – 21:00	Added Attraction Birds of a Feather (BOF) Sponsor Reception

Friday, June 22^nd

	Conference Room I - Giralda I & II	Conference Room II - Santa Cruz	Conference Room III - Arenal I	Geekzone I - Nervion I & II	Geekzone II - Arenal / Nervion III	SIG Room - Giralda III
09:00 – 09:10	Opening
09:10 – 10:00	Keynote Speaker Andrea Pirotti (Executive Director, ENISA, EU)
10:00 – 10:50	Building a scalable, accurate, actionable Incident Response system Dr. Ken Baylor (CISSP CISM, VP & CISO Symantec, US)	Electronic Forensics: a Casefor First responders Dr. Henry B. Wolfe (University of Otago, NZ)	Technical Evolution of Cybercrime Rolf Schulz (GNS-Cert, DE)	Geek Zone Tools and techniques to automate the discovery of zero day vulnerabilities Joe Moore , Mark Rowe (Pentest, UK)	Geek Zone Espionage – Reality or Myth? A Demonstration of Bugging Equipment Emma Shaw (Esoteric Ltd, UK)	Special Interest Group SIG Meetings
10:50 – 11:20	Morning tea break
11:20 – 12:20	SafeSOA: Managing Privacy & Risk In The Global Service Oriented Environment Hart Rossman (SAIC, US)	Handling Less-Than-Zero-Day Attack – A Case Study Ma Huijuan (National University of Singapore, SG) Setting up a Grid-CERT – Experiences of an academic CSIRT Klaus Möeller (DFN-CERT, DE)	An Internet Threat Evaluation Method based on Access Graph of Malicious Packets Masaki Ishiguro , Hironobu Suzuki (Mitsubishi Research Institute, Inc., JP)	Tools and techniques to automate the discovery of zero day vulnerabilities (continued)	Espionage – Reality or Myth? A Demonstration of Bugging Equipment (continued)	First Team Members Update Panel Francisco. (Paco) Monserrat (IRIS-CERT – RedIRIS, ES)
12:20 – 13:10	New Trends and technologies in Identity Theft Christoph Fisher (BFK Edv-Consulting Gmbh, DE)	Unique Challanges for Incident Response in a Grid Environment Aashish Sharma (NCSA-IRST, US), James J. Barlow (NCSA-IRST – National Center for Supercomputing Applications, US)	The Evolution of Online Fraud David Barroso (S21sec, ES)	Tools and techniques to automate the discovery of zero day vulnerabilities (continued)	Espionage – Reality or Myth? A Demonstration of Bugging Equipment (continued)	First Team Members Update Panel (continued)
13:10 – 14:40	Lunch break
14:40 – 15:40	Keynote Speaker Graham Whitehead (Futurologist, BT, UK)
15:40 – 16:30	WiMAX: Security Analysis and Experience Return Laurent Butti (France Telecom Orange, FR)	Developing a trusted partnership to prepare a framework for the collection of information security data Carsten Casper (ENISA, GR)	Experiences with Building, Deploying and Running remote-controlled easily installable Network Sensors Dr. Bernd Grobauer (Siemens-CERT, DE) Malware distribution trough software piracy: a case study Jacomo Piccolini (CAIS/RNP – Brazilian Academic and Research Network, BR)	Provider practicalities and paranoia: Modern ISP incident response – the tooling of incident response at a ISP Scott McIntyre (KPN-CERT, NL)	Identity theft in the corporate environment – demonstration and hands-on Peter Wood (First Base Technologies, UK)	Artifact Analysis (AA-SIG) Kevin Houle (CERT Coordination Center, US)
16:30 – 17:00	Afternoon tea break
17:00 – 17:45	Managing Privacy in Network Operations: Learning from the Law Andrew Cormack	Setting up a governmental CERT: The CCN-CERT case study Carlos Abad (Spanish National Cryptologic Center (CCN), ES) Tunisia's experience in establishing the first public CSIRT in Africa, as a case example for developing countries, and some guidelines and schemes for International cooperation Nabil Sahli (CERT-TCC, National Agency for Computer Security, TN)		Provider practicalities and paranoia: Modern ISP incident response – the tooling of incident response at a ISP (continued)	Identity theft in the corporate environment – demonstration and hands-on (continued)	Artifact Analysis (AA-SIG) (continued)
17:45 – 18:00	How to Join FIRST Damir (Gaus) Rajnovic (Cisco PSIRT – Cisco Systems Co., UK)	Setting up a governmental CERT: The CCN-CERT case study (continued) Tunisia's experience in establishing the first public CSIRT in Africa, as a case example for developing countries, and some guidelines and schemes for International cooperation (continued)		Provider practicalities and paranoia: Modern ISP incident response – the tooling of incident response at a ISP (continued)	Identity theft in the corporate environment – demonstration and hands-on (continued)	Artifact Analysis (AA-SIG) (continued)
18:00 – 18:15	Conference closing note

Program Schedule

Overview

Facilities

Download the conference schedule

Saturday, June 16th

Sunday, June 17th

Monday, June 18th

Tuesday, June 19th

Wednesday, June 20th

Thursday, June 21st

Friday, June 22nd

Saturday, June 16^th

Sunday, June 17^th

Monday, June 18^th

Tuesday, June 19^th

Wednesday, June 20^th

Thursday, June 21^st

Friday, June 22^nd