Day 1 – 18th of November 2016:
Next Generation Security Platform
By AHMED ABDEL SALAM (Regional Sales Manager, Palo Alto Networks).
The increasing success of cyberattacks in the region is threatening the trust that underpins our digital way of life. Palo Alto Networks is committed to protecting our way-of-life, leading a new era in cybersecurity by safely enabling applications and preventing cyber breaches for tens of thousands of organizations worldwide.
Microsoft Secure : Secure your digital transformation with Microsoft
By SHADI NAGGAR (Enterprise Mobility + Security Specialist Microsoft Egypt)
And AHMED EL KANADILY (Cloud and Datacenter Solutions Specialist Microsoft Egypt)
Overview on how enterprises can protect against evolving cybersecurity threats—from the datacenter to the endpoints.
End-user IT Analytics for Security.
By MOHAMED ENAB (Cyber Security Specialist)
By MOHAMED SAMIR WALI (Sr. Manager, Technology Security Operations –Technology Information Security, Orange Egypt)
Industry analysts agree that end-user devices are the weakest link in the IT chain and the biggest IT security threat that organizations face today. One of the solutions to this issue is having a real-time end-user IT Analytics across all endpoint devices and networks, to detect any lingering or potential security threats. Security Analytics comprise a collection of dashboards, templates, investigations, and sample technology integrations that can be utilized to boost strengthen endpoint security. During this session, Nexthink and Mr. Mohamed Wali (Sr. Manager, Technology Security Operations –Technology Information Security, Orange Egypt ) will discuss the common threats to the endpoints and how Security Analytics can be a solution to the growing issue.
Session Sponsored by Nexthink
The Hidden Venom : Dangerous Formats. – Workshop
By FADY OTHMAN (Information Security Consultant at ZINAD IT)
In the past years, we have seen the development of client-side attacks and how hackers became smarter and smarter. We came to a realization that you don’t really need a zero day or advanced exploit to spread a malware or ransomware. all what you need is a good social engineering trick and the knowledge of how to abuse a legitimate file format. In this talk, we will have a look at seemingly non-harmful file formats and how they can be abused to spread malware.
NOT EASY TO EXTEND YOUR STAY AT 127.0.0.1.
By MUHAMMED M.BASSEM (Senior consultant at the Enterprise Risk Services (ERS) department, specializing in Cyber Risk, at Deloitte)
“The art of war teaches us to rely not on the likelihood of the enemy’s not coming, but on our own readiness to receive him; not on the chance of his not attacking, but rather on the fact that we have made our position unassailable.” — Sun Tzu
Do you think that all your organization “foo” security controls are well placed and updated?Is every penetration test you performed on “foo” detectable by Blue team? How do you believe in foo’s perimeter security?
Red teaming is not an ordinary penetration test. There is a big difference in the methodology, risk evaluation and reporting. To understand the advanced persistent threats’ risk, you need to see one.
Exploiting PHP Serialized Objects for Authentication bypass. – Workshop
By EBRAHIM HEGAZY (Senior Security Engineer)
In this session, I will talk about PHP Serialized Objects as below:
– What is PHP Serialized/Unserialize Objects and how it works
– Demo Code on PHP Serialized Objects
– Exploitation scenarios for Serialized Objects
– Practical example of exploiting Serialized Objects for Authentication bypass & Privilege Escalation
The state ” or lack of it” of infosec workforce in the job market.
By AHMED ELEZABI (Consultant)
The Cyber Security job market is currently expanding, demand surpasses available skills and recruiters are struggling to fulfill their customers demands. Information security professionals should be ready to answer to this situation, prepare themselves for the future, and educate their organizations.
Detecting APTs at web application layer. – Workshop
By MOHAMED ALFATEH (Sr. Consultant at ZINAD IT)
Detecting and defending against Multi – Stage Advanced Persistent Threats (APT) Attacks is a challenge for mechanisms that are static in its nature and are based on blacklisting and malware signature techniques. The comprehensive analysis and correlation can discover behavior indicative of APT-related attacks and data exfiltration. In the web application layer, other techniques are used to detect the sophisticated web attacks. In this presentation, we will discuss some techniques that could be used to deal with the APTs in the web application layer.
Stop Being Reactive and start acting: Microsoft Advanced Threat Analytics”.
By AHMED NABIL (IT Manager | Security, Networking, System Engineering)
Recent research showed that 75% of attacks are targeting user accounts on any device and the Average amount of time attackers are living in your network is 8 month before getting detected. ATA is a new solution that leverage Machine Learning to analyze and predict User behavior.
Egypt Security Kaizen Awards.
We are living in a world where threats, risks and cyber attacks affect individuals, businesses and countries which bring a direct impact to our life. Our goal by announcing SK Awards is to honor the achievements of Security professionals, Vendors and local companies and all cyber security ecosystem who contributed in making our environment safer.
Gala Dinner & Entertainment Night.
(ISC)² and Bluekaizen ((ISC)² official Partner in Egypt) are delighted to invite all attendees, speakers and sponsors to CSCAMP2016 | 7th year Gala Dinner which will take place at 18th of November Night. Don’t miss this fantastic evening full of entertainment, amazing food and a friendly atmosphere . The Gala Dinner Will witness also the Security Kaizen awards of the year for the Best CISO, Best Security Product, Best Partner and Others.
Spaces are limited to this awesome annual event, so don’t delay.
Professional and Corporate tickets will be able to access the Gala Dinner For free. Academic tickets will need to add an extra 100 EGP .
Day 2 – 19th of November 2016:
Let us build a SOC
By OSAMA KAMAL | Sr. Security Consultant – IBM Security Intelligence Operations and Consulting Services, Middle East & Africa
Building a SOC is not an easy task, it needs paying attention to several elements and directions. During this presentation we discuss some important aspects of any modern SOC such as operating models, reference architecture, technology stack and will shed the light on the maturity levels of the SOCs specially in the region.
Organizational Resilience Framework & Methodology
By AHMED RIAD | Managing Director- ESTMRARYA Consulting
Most of organizations having separate departments for Information Security, Risk Management, Health & Safety, Business Continuity, Crisis Management , etc. We believe that will end in the coming three to five years. Through the session, we will provide an award winning framework and methodology that will help you and your organization to build a resilient organization. Estmrarya’s Resilience Model is helping shape the future of Organizational Resilience in the world
Download coming soon!
Encrypted traffic in Egypt – an attempt to understand
By AHMED MEKKAWY | CEO | Founder, Spirula Systems
We all noticed the unstability in the internet lines in Egypt lately, especially with encrypted traffic; HTTPS, SSH, and VPN. Nobody declares why is this happening, so let’s try to check it out from a normal internet user’s POV.
Let’s Encrypt, Certbot and ACME – The Core
By AMJAD MASHAAL
Let’s Encrypt is a free certificate provider. Combined with Certbot, the average amount of time needed to configure an SSL certificate has decreased from a few hours to 30 seconds, and the total cost decreased from $10 to $0. Let’s Encrypt has been growing exponentially, and it continues to.
Beside the impressive features advertised publicly, the core of Let’s Encrypt is also impressive. I’ll share with you a part of the story of developing Certbot, which I have been a part of for a while as a volunteer. I’ll discuss parts of the ACME (Automated Certificate Management Environment) specification, security concerns, limitations, and more.
Download coming soon!
Telco’s Fallen Wall: SS7/SigTran Signaling Security
By LOAY ABDELRAZEK | Cyber Security Researcher
The invention and implementation of the telecommunication suite protocol “Signaling system no.7” (SS7) has always been based on mutual trust of peers. SS7 was viewed as a trusted network between peers, a wallen garden.
In this talk we will discuss various threats and attacks of the SS7 suite protocol focusing on the application layer protocol – Mobile Application Part (MAP)- which is responsible for roaming services, location services,SMSs, supplementary services(call forwarding,charging,..etc).
Also we will highlgiht the new SS7 over IP integration and its threats like the SIP-ISUP injection that could lead to various attacks such as: changing user profiles on the HLR, call forwarding, fake billing, call interception.
At last we will discuss the recommendations and security controls operators should implement to be protected against such attacks.
Bulwarking Software Architecture and Design
By AHMED SAAFAN | Director of security, zlabs
Cross-site scripting, SQL injections, Buffer overflows and many other well known vulnerabilities are a result of coding errors. With all the news coming in about vulnerabilities and compromises discovered, it is clear that the way the security industry used to handling the security awareness of software developers is not enough. Also, fixing issues after they are already in production is costly. Hence the need for a more fundamentalist approach to solve the problem by tackling vulnerabilities early on in the development life-cycle. Architecting and designing software with security in-mind can mitigate major threats by shielding the architecture from individual errors and not relying too much on security awareness for protecting the code. The system should be built such that a lot of vulnerabilities are less probable or impossible to occur as the code grows. This session will go through several secure design concepts and pitfalls to ensure a fortified architecture for commonly susceptible components so that they can withstand development errors.
ATM Malware, Malware for Money!
By MOHAMED ENAB | Cyber Security Specialist
The ATM is no longer a safe with money only; it’s an advanced machine that enables the user to bank with multiple provided services and it’s the official face for the bank and its reputation, and counted as a primary source of cash for millions of users.
ATMs have been the target, historically and recently, for multiple types of attacks and as the payment sector implements controls, attackers are shifting their attacks accordingly till we reach a stage of sophisticated attacks which plants malicious codes to spew cash out of the ATM and/or steal card holders’ data.
The talk will discuss the evolution of ATM threat starting from the physical ones till the recent threats and the ways of combating such threats.
Inside the web evil codes
By ESLAM SALEM | Founder & CEO of Shieldfy
Malicious codes is everywhere and web is an easy and rich target for hackers. We will have a good look into the codes of this malwares with real cases of Code Injection , Backdoors , Polymorphic Codes and Web Ransomeware.
Download coming soon!
Android Commercial Spyware Disease and Medication
By MUSTAFA SAAD | Cyber Security Researcher
Android-based smartphones are gaining significant advantages on its counterparts in terms of market share among users. The increasing usage of Android OS make it ideal target for attackers. There is an urgent need to develop solutions that guard the user’s privacy and can monitor, detect and block these Eavesdropping applications. In this paper, two proposed paradigm are presented. The first proposed paradigm is a spy-ware application to highlight the security weaknesses “disease”. The spy-ware application has been used to deeply understand the vulnerabilities in the Android operating system, and to study how the spy-ware can be developed to abuse these vulnerabilities for intercepting victim’s privacy such as received SMS, incoming calls and outgoing calls. The spy-ware abuses the Internet service to transfer the intercepted information from victim’s cell phone illegally to a cloud database. The Android OS permission subsystem and the broadcast receiver subsystem contribute to form a haven for the spy-ware by granting it absolute control to listen, intercept and track the victim’s privacy. The second proposed paradigm is a new detection paradigm “medication” based on fuzz testing technique to mitigate known vulnerabilities. In this proposal, anti-spy-ware solution “DroidSmartFuzzer” has been designed. The implementation of the anti-spy-ware application has been used to mitigate the risks of the mentioned attacks. It should be noted that the proposed paradigm “DroidSmart-Fuzzer” and its fuzzing test cases are designed not only to catch the proposed spy-ware application but also to catch any similar malicious application designed to intercept one or more of the listed privacies
By Bluekaizen, Official C|CISO Partner
About
Cairo Security Camp is an annual event targeting the Information Security Community of the Middle East and North Africa (MENA Region). IT Professionals and security practitioners from throughout the region are invited to attend. The Conference purpose is to gather, in one place, everyone interested in helping to improve and enrich the Information Security field in the MENA region. Our Goal is to raise the level of information security field in the MENA region, hoping that one day we live up to international standards.
About BlueKaizen
Bluekaizen is a fast growing company that focus on cyber security education either for students, professionals or Management level. Either for individual or organization. We provide educations via training, conferences, webinars, magazines, cyber security summer camps, Assessments, cyber exercises & games and much more.
Place: Cairo, EGYPT.
Date: 16th of November for Training – 18th, 19th of November 2016 for the conference.
Organizers: BlueKaizen.org and Security Kaizen Magazine.
Sponsors
Do you need to promote your product or services?
Do you need to reach Security Experts and Security Professionals?
Let it be known through sponsoring Cairo Security Camp or Security Kaizen Magazine.
Cairo Security Camp is the first annual conference organized by an Arab Country. Our conference covers all aspects of Information Security both technical and managerial aspects. In addition to being the first, Cairo Security Camp 2012 will proudly be hosting a variety of experienced speakers from very renown companies and organization To request for a sponsorship prospectus or find out more about sponsorship opportunities.
Please contact:
mahitab.afify (at) bluekaizen (dot) org
