Program Overview
The FIRST Technical Colloquium (TC) event is restricted to FIRST members only and will be held in Nov 14-16, 2005.
The Vendor SIG Meeting is open to all vendor teams irrespective if the are members of Vendor SIG or FIRST or not. Relevant guests are also welcomed. However, the Vendor SIG forum moderators can use their discretion and refuse participation.
Monday, November 14th
| Technical Colloquium - Plenary Session |
|---|
| 09:45 – 10:45 | Vulnerability Management : Past, Present and Future Tom Briglia |
| 10:45 – 11:15 | Coffee break |
| 15:00 – 15:30 | Coffee break |
Tuesday, November 15th
| Technical Colloquium - Hands-On Classes |
|---|
| 09:00 – 11:00 | US CVSS Gavin Reid (HUMAN Security, US); Mike Scheck (Cisco PSIRT, US) Design your network to aid forensics investigation Robert Sisk Introduction to Computer Forensics Chok Wee Malware analysis workshop Steve Romig |
| 11:00 – 11:30 | Coffee break |
| 11:30 – 12:30 | Design your network to aid forensics investigation Robert Sisk Introduction to Computer Forensics Chok Wee Malware analysis workshop Steve Romig |
| 12:30 – 13:30 | Lunch |
| 14:00 – 15:00 | US Design your network to aid forensics investigation Robert Sisk (IBM MSS – IBM Corporation, US) US Introduction to Computer Forensics Chok Wee, Dr. Uwe Kohler (ORACERT – Oracle, US) US Malware analysis workshop Steve Romig (OSU-IRT – Ohio State University, US) |
| 15:00 – 15:30 | Coffee break |
| 15:30 – 17:30 | US Design your network to aid forensics investigation Robert Sisk (IBM MSS – IBM Corporation, US) US Introduction to Computer Forensics Chok Wee, Dr. Uwe Kohler (ORACERT – Oracle, US) US Malware analysis workshop Steve Romig (OSU-IRT – Ohio State University, US) |
- US
CVSS
Gavin ReidGavin Reid (HUMAN Security, US), Mike Scheck (US)
This class will first go over CVSS basics. Then have the participants score some test vulnerabilities themselves. We will then go over the results and attempt to identify any discrepancies.
November 15, 2005 09:00-11:00
Design your network to aid forensics investigation
Robert Sisk
This course will review network design and monitoring with the intent of identifying and providing adequate compromise detection, developing appropriate security response to suspicious "events", and increasing readiness for forensics investigation.
November 15, 2005 09:00-11:00, November 15, 2005 11:30-12:30
- GB
Introduction and welcome
Damir (Gaus) Rajnovic (Cisco Systems Co., GB)
November 16, 2005 09:00-09:15
Introduction to Computer Forensics
Chok Wee
This class is an introductory class to computer forensics and requires no prior forensics experience. The presentation will focus on delivering key concepts in computer forensics. Students will have the opportunity to perform hard drive data acquisition on their laptops using some well-known tools. The instructor will perform a live forensic analysis with a commercial tool to conclude the training.
November 15, 2005 09:00-11:00, November 15, 2005 11:30-12:30
- US
Legal issues
Tara Flanagan (Cisco Systems Ltd., US)
Some legal issues related to handling product security vulnerabilites.
November 16, 2005 14:00-14:45
Malware analysis workshop
Steve Romig
We'll demonstrate and practice some techniques for dynamic analysis of malware by running it under vmware and creating a fake environment (DNS, WWW, FTP) for it to see what it does. We'll also
discuss other aspects of incident response. We will be using an incident involving a backdoor program called Nethief as our case study.
Students who wish to may use their own laptops with Linux or a Vmware Linux image. For this hands-on if preferred the use of Redhat 8 or 9 with BIND, Apache and FTP). Students who will join this class can ask the instructor for configurations procedures prior to the class.
November 15, 2005 09:00-11:00, November 15, 2005 11:30-12:30
Responsible Security Coordination with Open Source
Derrick Scholl
Sun Microsystems recently open sourced it's Solaris Operating System. I'd like to present some of the pitfalls and experiences we have encountered thus far as we learn to exist in both the open source and responsible vendor worlds. In addition, I'd like to ask some thought provoking questions and maybe even generate a discussion with other vendors about the future of responsible security coordination with open sourced products.
November 16, 2005 11:15-12:00, November 16, 2005 13:30-14:00
- JP
Vulnerability handling in JPCERT/CC
Yurie Ito (JP)
Yurie will be introducing the JPCERT/CC vulnerability handling/disclosure policy, legal document which JPCERT contract with vendors, vendor registration scheme of JPCERT/CC vulnerability handling, and JVN (JP Vendors status Notes) portal site. Also introducing JPCERT's international handling partnership with partner CSIRT (CERT/CC, NISCC).
November 16, 2005 09:15-10:00
