May 15, 2012 at 6:30 PM

ISSA National Capital Chapter May meeting topic:

Establishing Trust with Electronic Identities, When Electrons Aren’t Enough
by Brent Williams

Abstract

Now that information about individuals and companies abounds on the Internet - through social networking, public directories, and corporate data - how do we create and establish real trust with individuals and companies?  How does that trust change over time and through routine interactions?  The tools and techniques used to establish and maintain identity are just the beginning of a trust relationship that includes being able to establish whether the user is operating from a trusted environment, if they still work for the company that I do business with, if their device has been compromised, if they are calling from a landline that has been highjacked, or if somebody is trying to impersonate them. With recent compromises in what was considered the gold-standard of identity solutions, what solutions are good enough.

During this session, you will learn about the change from discrete risk management to broad-based trust measurement, establishing confidence levels in trust, understanding how trust and confidence level impact three different stakeholder groups - employees, supply chain partners, and end users, and how to implement these kinds of solutions.   You will also come away with a deeper understanding of the reliability and availability of data about users across your enterprise - from internal data assets to public data assets and shared data assets.

About the Speaker

Brent Williams is a seasoned information security professional with over 20 years of experience as a government and industry practitioner.  He is currently transitioning, post-acquisition, from a large credit bureau to start a new company, Araxid, that expands the discrete, traditional concepts of risk management into a diverse set of trust vectors that can be synthesized into a more meaningful trust measurement capability.  Brent brings a global experience base across a wide variety of technical domains including IT security, identity, telecommunications, risk analysis, and complex data analytics.  Finally, Brent has significant senior-level strategic experience with government information security solutions.  This includes drafting national-level policy related to authentication into secure systems for the White House, developing security policy guidelines with the National Institutes of Standards and Technology, and participating national and international healthcare standards bodies.

As Brent is driving innovation in the building of the Araxid Trust and Reputation Evaluation Exchange (TREE), the Active Asymmetric Analysis (AAA) tools, and a wide variety of Trust Vectors that measure independent risk domains, he is helping sunset his role at the highly successful change agent, Anakam, which was acquired by Equifax in October of 2010.  Anakam has developed an innovative approach to strong authentication of extremely large-scale user-bases for consumer, patient, and citizen-facing applications in e-health, e-government, and e-commerce.  Brent has extensive experience delivering innovative, market changing solutions for not only government, but also healthcare, financial services, education, and high-tech companies – all seeking to improve trust in the way they do online business and offer more services across employees, trusted business partners, and customers.

Brent has also worked at Bolt, Baranek, and Neuman, GlobalOne, and Greenwich Technology Partners on the deployment of new Internet protocols across the telecommunication industry. This career took root after retiring from service as a US Nuclear Submarine Officer.  His last duty station in the US Navy was on the White House staff leading the development of national-level policy related to national security telecommunications and continuity of operations.  He also served as a Presidential Emergency Operations Officer.  As a Submarine Officer, Brent is dual qualified as a nuclear power plant chief engineer and strategic nuclear weapons officer.  He was also responsible for shipboard security and communications systems.  Brent is a graduate of the US Naval Academy (BSNA) and Johns Hopkins University (MEE).

Please RSVP if you plan to attend.
Non-members are welcome without charge!  Light refreshments will be served.

Tuesday, May 15, 2012 6:30 PM

Government Printing Office
Room A138
732 N. Capitol St.
Washington, DC, 20401

Click here for details

April 17, 2012 at 6:30 PM

Evolving Cyber Security Strategies and
Highlights from NIST Special Publication 800-53 revision 4

by Ron Ross

About the Speaker
Dr. Ron Ross is a senior computer scientist and information security researcher at the National Institute of Standards and Technology (NIST).  Dr. Ross leads the Federal Information Security Management Act (FISMA) Implementation Project for NIST, which includes the development of key security standards and guidelines for the federal government, support contractors, and the United States critical information infrastructure. His recent publications include Federal Information Processing Standards (FIPS) Publication 199, FIPS Publication 200, NIST Special Publication 800-53, NIST Special Publication 800-53A, NIST Special Publication 800-37, and NIST Special Publication 800-39.

Dr. Ross is also the principal architect of the NIST Risk Management Framework that provides a disciplined and structured methodology for integrating the suite of FISMA security standards and guidelines into a comprehensive enterprise-wide information security program.

Dr. Ross is a frequent speaker at public and private sector venues including federal agencies, state and local governments, and Fortune 500 companies.

Dr. Ross is a two-time recipient of the Federal 100 award for his leadership and technical contributions to critical information security projects affecting the federal government and has been inducted into the ISSA Hall of Fame.  Dr. Ross is a graduate of the Program Management School at the Defense Systems Management College and holds both Masters and Ph.D. degrees in Computer Science from the United States Naval Postgraduate School.

Please RSVP if you plan to attend.
Non-members are welcome without charge!  Light refreshments will be served.

Tuesday, April 17, 2012 6:30 PM

Government Printing Office
Room A138
732 N. Capitol St.
Washington, DC, 20401

Click here for details

December 20, 2011 at 6:30 PM

Advanced Threat Modeling
by John Steven

Abstract

How will attackers break your web application? How much security testing is enough? Do I have to worry about insiders? Threat modeling, applied with a risk management approach can answer both of these questions if done correctly. This talk will present advanced threat modeling step-wise through examples and exercises using the Java EE platform and focusing on authentication, authorization, and session management. Participants will learn, through interactive exercise on real software architectures, how to use diagramming techniques to explicitly document threats their applications face, identify how assets worth protecting manifest themselves within the system, and enumerate the attack vectors these threats take advantage of. Participants will then engage in secure design activities, learning how to use the threat model to specify compensating controls for specified attack vectors. Finally, we'll discuss how the model can drive security testing and validate an application resists specified attack.

About the Speaker

John Steven is the Internal Chief Technology Officer at Cigital, with over a decade of hands-on experience in software security. Mr. Steven’s expertise runs the gamut of software security from threat modeling and architectural risk analysis, through static analysis (with an emphasis on automation), to security testing. As a consultant, Mr. Steven has provided strategic direction as a trusted adviser to many multinational corporations. Mr. Steven’s keen interest in automation keeps Cigital technology at the cutting edge. He has served as co-editor of the Building Security In department of IEEE Security & Privacy magazine, speaks with regularity at conferences and trade shows, and is the leader of the Northern Virginia OWASP chapter. Mr. Steven holds a B.S. in Computer Engineering and an M.S. in Computer Science both from Case Western Reserve University.

Please RSVP if you plan to attend.
Non-members are welcome without charge!  Light refreshments will be served.

Tuesday, December 20, 2011 6:30 PM

Government Printing Office
Room A138
732 N. Capitol St.
Washington, DC, 20401

Click here for details

November 15, 2011

Stream-based digital forensics with bulk_extractor
by Simson L. Garfinkel

Abstract
Bulk data analysis eschews file extraction and analysis, common in forensic practice today, and instead processes data in ``bulk,'' recognizing and extracting salient details (``features'') of use in the typical digital forensics investigation. This talk presents the requirements, design and implementation of bulk\_extractor, a new, high-performance carving and feature extraction tool that uses bulk data analysis to allow the triage and rapid exploitation of digital media. bulk\_extractor offers several important advances over today's forensic tools, including opportunistic decompression of compressed data, context-based stop-lists, and the creation of a forensic path that allows concise documentation of both the physical location and forensic transformations necessary to reconstruct exploited evidence. bulk\_extractor is a stream forensic tool, meaning that it scans the entire media from beginning to end without seeking the disk head, and is fully parallelized, allowing it to work at the maximum I/O capabilities of the underlying hardware (provided that the system has sufficient CPU resources). Although bulk\_extractor was developed as a research prototype, it has proved useful in actual police investigations, two of which we recount.

About the Speaker
Simson L. Garfinkel is an Associate Professor at the Naval Postgraduate School in Monterey, California. His research interests include computer forensics, the emerging field of usability and security, personal information management, privacy, information policy and terrorism. He holds six US patents for his computer-related research and has published dozens of journal and conference papers in security and computer forensics.

Garfinkel is the author or co-author of fourteen books on computing. He is perhaps best known for his book Database Nation: The Death of Privacy in the 21st Century. Garfinkel's most successful book, Practical UNIX and Internet Security (co-authored with Gene Spafford), has sold more than 250,000 copies and been translated into more than a dozen languages since the first edition was published in 1991.

Garfinkel is also a journalist and has written more than a thousand articles about science, technology, and technology policy in the popular press since 1983. He started writing about identity theft in 1988. He has won numerous national journalism awards, including the Jesse H. Neal National Business Journalism Award two years in a row for his "Machine shop" series in CSO magazine. Today he mostly writes for Technology Review Magazine and the technologyreview.com website.

As an entrepreneur, Garfinkel founded five companies between 1989 and 2000. Two of the most successful were Vineyard.NET, which provided Internet service on Martha's Vineyard to more than a thousand customers from 1995 through 2005, and Sandstorm Enterprises, an early developer of commercial computer forensic tools.

Garfinkel received three Bachelor of Science degrees from MIT in 1987, a Master's of Science in Journalism from Columbia University in 1988, and a Ph.D. in Computer Science from MIT in 2005.

Please RSVP if you plan to attend.
Non-members are welcome without charge!  Light refreshments will be served.

Tuesday, November 15, 2011 6:30 PM

Government Printing Office
Room A138
732 N. Capitol St.
Washington, DC, 20401

Click here for details

October 18, 2011

Mobile Devices Gathering Information and Protecting Organizations
by Amber Schroader
  

Abstract

Mobile devices are no longer the device of the future, they are the here and now of information sharing, and leaks. Mobiles contain more information on an individual than any other digital device, but do you know how to find this information, protect it, or use it in an investigation. Learn the latest techniques for protecting your device from known spyware and how to find out if you have spyware running on your phone that might potentially cause risk to you or your organization. Learn what data to find, how to recover deleted information on some of the latest common mobile devices. Don’t be the last to know when it comes to your mobile device or the devices of your organization.

About the Speaker

Amber Schroader has been involved in the field of computer forensics for the past twenty years. During this time, she has developed and taught numerous courses for the computer forensic arena, specializing in the field of wireless forensics as well as mobile technologies. Ms Schroader is the CEO of Paraben Corporation and continues to act as the driving force behind some of the most innovative forensic technologies. As an innovator in the field, Ms Schroader has been key in developing new technology to help investigators with the extraction of digital evidence from hard drives, email and, hand held and mobile devices. Ms Schroader has extensive experience in dealing with a wide array of forensic investigators ranging from federal, state, local, and corporate. With an aggressive development schedule, Ms Schroader continues to bring new and exciting technology to the computer forensic community world wide and is dedicated to supporting the investigator through new technologies and training services that are being provided through Paraben Corporation. Ms Schroader coined the concept of the 360-degree approach to digital forensics, pushing for development into new areas in the digital evidence arena. Ms. Schroader has been a contributor to several books in the field of Digital Forensic including Techno Security Guide to Managing Risks for IT Managers, Auditors and Investigators, Techno Security's Guide to E-Discovery and Digital Forensics: A Comprehensive Handbook along with Alternate Data Storage Forensics. Ms Schroader is involved in many different computer investigation organizations including The Institute of Computer Forensic Professionals (ICFP), HTCIA, CFTT, and FLETC.

Please RSVP if you plan to attend.
Non-members are welcome without charge!  Light refreshments will be served.

Tuesday, October 18, 2011 6:30 PM

Government Printing Office
Room A138
732 N. Capitol St.
Washington, DC, 20401

Click here for details

Septemeber 20, 2011

Access Control and the Semantic Web
by Ronald P. Reck

Abstract

The presentation will describe how the use of semantic web technologies can provide a scalable access control architecture.

About the Speaker

For over a decade Ronald P. Reck has operated the consulting company, RRecktek LLC, outside of Washington DC metropolitan area. RRecktek LLC has enjoyed over one hundred contracts ranging from the data warehousing of state, local, and federal law enforcement incident reports outside o fsubmarine bases for The Navy Criminal Investigative Service (NCIS) to vocabulary projects for the management and dissemination of controlled vocabularies for the Directorate of National Intelligence (DNI) as a member of the Intelligence Community Metadata Working Group staff and a "simple" content management system for build out drawings for global telecom company. Among the companies served include Nextel, Winstar, ANS +COre, AOL, Standard & Poors, The Federal Communications Commission, Kiplingers Newletter, The United States Information Agency, The Council of Better Business Bureaus, Department of Defense Health Affairs and others.

He is the co-author of Hardening Linux ISBN 10: 0072254971 / 0-07-225497-1 ISBN 13: 9780072254976

Please RSVP if you plan to attend.
Non-members are welcome without charge!  Light refreshments will be served.

Tuesday, September 20, 2011 6:30 PM

Government Printing Office
Room A138
732 N. Capitol St.
Washington, DC, 20401

Click here for details

August 16, 2011

 DDoS Behind the Scenes
by Michael Smith 

Abstract

Akamai's Michael Smith will share some of the threats, capabilities, traffic patterns, and lessons learned from managing and fighting Distributed Denial of Service attacks over the past 12 months..

About the Speaker:
Michael Smith serves as Akamai’s Security Evangelist and is the customer-facing ambassador from the Information Security Team, helping customers to understand both the internal security program and the unique security features and capabilities of the Akamai product portfolio and cloud-based solutions. Mr Smith fulfils a cross-functional role as a liaison between security, sales, product management, compliance, engineering, professional services, and marketing.

Prior to joining Akamai, Mr Smith served as an embedded security engineer, security officer for a managed service provider, and security assessment team lead. He is an adjunct professor for Carnegie Mellon University and teaches through the non-profit Potomac Forum.

Please RSVP if you plan to attend.
Non-members are welcome without charge!  Light refreshments will be served.

Tuesday, August 16, 2011 6:30 PM

Government Printing Office
Room A138
732 N. Capitol St.
Washington, DC, 20401

Click here for details

July 19, 2011

Abstract

Cybersecurity economics is concerned with the application of economic principles to cybersecurity related issues. The objective of Dr. Gordon's talk is to address the following separate, but related, questions that fall under the domain of cybersecurity economics: (1) What is the economic impact of cybersecurity breaches on corporations? (2) How much should an organization invest in cybersecurity activities? (3) What is the effect of SOX on disclosing cybersecurity activities? (4) What is the effect of voluntarily disclosing cybersecurity activities on firm value? (5) Should cybersecurity insurance be used to transfer cybersecurity risk? In answering these questions, Dr. Gordon will draw upon a stream of research that he, and colleagues from the University of Maryland, have been working on over the past 12 years.

About the Speaker:
Dr. Lawrence A. Gordon is the Ernst & Young Alumni Professor of Managerial Accounting and Information Assurance at UMD’s Robert H. Smith School of Business, and an Affiliate Professor in the UMD Institute for Advanced Computer Studies. He is also an active participant in the Maryland Cybersecurity Center, a new research/education Center at the UMD. His Ph.D. is in Managerial Economics from Rensselaer Polytechnic Institute. He is the author of more than 90 articles, published in such journals as ACM Transactions on Information and System Security, Journal of Computer Security and The Accounting Review. He is the author of several books, including Managing Cybersecurity Resources:A Cost-Benefit Analysis, and is the Editor-in-Chief of the Journal of Accounting and Public Policy. In 2007, Dr. Gordon provided Congressional Testimony on cybersecurity economics before a Subcommittee of the U.S. House Committee on Homeland Security. He is a frequent speaker at universities and professional meetings around the world, has been a consultant to many major private and public sector organizations. Dr. Gordon’s former Ph.D. students are distinguished faculty members at many top universities in the U.S., Europe and Asia. In two authoritative studies, Dr. Gordon was cited as being among the world’s most influential/productive accounting researchers.

Please RSVP if you plan to attend.
Non-members are welcome without charge!  Light refreshments will be served.

Tuesday, July 19, 2011 6:30 PM

Government Printing Office
Room A138
732 N. Capitol St.
Washington, DC, 20401

Click here for details

June 21, 2011

Abstract
Mobile technology is rapidly evolving.  Our reliance on mobile computing increases more and more each day.  With disruptive technologies such as Near Field Communications (NFC) and location-based services changing the way we live and interact with the world around us, many new risks are emerging.

This presentation will highlight many of the new security and privacy challenges developers, organizations, and consumers must be aware of.  The Google Android platform will be our target of interest, which is a Linux-based operating system used for smartphones, tablet computers, and much more.  We will discuss the top mobile security risks and the security controls used to mitigate them using guidance provided by the OWASP organization.

At the end of this presentation, attendees will understand how to identify potential mobile risks, how to develop secure applications for the Android platform, and will be exposed to the many resources made available for free by OWASP.

About the Speaker:
Jack Mannino is the CEO of nVisium Security, an application security services firm located within the Washington DC area.    At nVisium, he provides mobile and web application security services including source code reviews, penetration testing, threat modeling, and training.  He is the co-leader and founder of the OWASP Mobile Security Project, which is a global initiative to improve the state of security in the mobile industry.  Mr. Mannino also serves as a board member for the OWASP Northern Virginia chapter.

Please RSVP if you plan to attend.
Non-members are welcome without charge!  Light refreshments will be served.

Tuesday, June 21, 2011 6:30 PM

Government Printing Office
Room A138
732 N. Capitol St.
Washington, DC, 20401

Click here for details

May 17, 2011

Abstract
This presentation will provide an overview of the Federal Chief Information Officer (FCIOC) Information Security and Identity Management Committee (ISIMC) Network and Infrastructure Security Subcommittee (NISSC) Guidelines for Secure Use of Cloud Computing by Federal Departments and Agencies. The goal of this document is to help federal program managers create a strong business case for embracing the appropriate type of cloud computing capability commensurate with their level of acceptable risk. This document presents a set of security guidelines and recommendations for using cloud computing technologies, capabilities and the selection of deployment and service models. These guidelines compliment the FedRAMP cloud computing requirements and controls and the NIST guidelines to provide outcome-based control objectives based on NIST guidance and requirements.

The Federal Cloud Computing Strategy outlines the Cloud First Initiative, intended to accelerate the adoption of cloud computing by federal departments and agencies, by modifying their IT portfolios to take advantage of the benefits of cloud computing to maximize capacity, improve flexibility, and minimize costs. As stated in the strategy, “Agencies should make risk-based decisions which carefully consider the readiness of commercial or government providers to fulfill their Federal needs.” Cloud computing readiness considerations within the federal government include but are not limited to data security and privacy, governance and continuous monitoring. The primary purpose of the ISIMC Guidelines is to enable federal program managers to make a careful assessment of security risks and cloud providers’ readiness to mitigate security risks to enable the secure use of cloud computing by federal departments and agencies.

The federal government is targeted by advanced threats and adversaries that attempt to compromise government information systems to further their own objectives. These advanced attackers are aggressive, persistent, are difficult to detect and prevent, and will sometimes be successful. Some cloud environments have the same capabilities to defend against and recover from these threats as current federal information systems, such as advanced monitoring capabilities and cleared information security professionals, though others may not. Other risks include an increased level of complexity, which may make cloud environments more prone to mistakes such as uploading sensitive or classified information into a cloud environment not authorized to handle that level of information. Finally, some risks may be due to design and architecture, where the cloud environment is abstracted from federal security controls, reducing the level of visibility available to support continuous monitoring.

These guidelines compliment the FedRAMP cloud computing requirements and the NIST security guidelines to support federal program managers in selecting the appropriate cloud computing model and security controls to mitigate these risks. Cloud computing does not absolve an agency of responsibility for securing its data nor eliminate the need for agencies to conduct assessments and authorizations of their respective major application (MA) and general support system (GSS) boundaries.

This document recommends the following “Top 20” federal cloud computing security considerations and guidelines for federal program managers and is intended to help the federal system owner to conduct their control selection by articulating cloud security issues through a discussion of sixteen (16) federal cloud security domains. Each of these sixteen domains is mapped against current cloud security best practices and FISMA security guidance, and is summarized into one or two top federal cloud security issues.

Cloud computing adoption is still in its early stages, but the commercial and government sectors are beginning to see the advantages of lower IT costs and reduced overhead by adopting this new trend. Though cloud computing comes with some risks, these can be mitigated by making informed risk management decisions when selecting cloud deployment models, service models, and cloud security controls. Federal program managers may consider public cloud computing for some low and moderate systems, freeing up their limited security resources to focus security operations on private cloud computing capabilities.

About the Speaker
Mr. Crane is the Director of the Cybersecurity Strategy Division in the Office of the Chief Information Security Officer (OCISO) for the Department of Homeland Security. Mr. Crane is responsible for developing the DHS Information Security Strategic Plan, enabling the Department to provide a secure, reliable, and trusted computing environment to support DHS’ mission and objectives and effectively share information that protects the Homeland.

Mr. Crane is a contributing author of multiple books, including “SPECIAL OPS: Host and Network Security for Microsoft, UNIX and Oracle”. He is also an adjunct professor in the Carnegie Mellon University H. John Heinz III School of Public Policy & Management where he teaches two courses on incident response and information security management.

Mr. Crane earned a Bachelor of Science in Mechanical Engineering with a minor in Robotics from Carnegie Mellon University. He also earned his Masters of Information System Management at Carnegie Mellon, specializing in Information Security and graduating with honors of “Highest Distinction”. Currently he is pursuing a PhD in information security management from George Washington University.

Please RSVP if you plan to attend.
Non-members are welcome without charge!  Light refreshments will be served.

Tuesday, May 17, 2011 6:30 PM

Government Printing Office
Room A138
732 N. Capitol St.
Washington, DC, 20401

Click here for details

April 19, 2011

Abstract
As smartphones become increasingly ubiquitous and powerful, they become appealing targets for botnet infections. Many of the top selling smartphone platforms are built on common PC operating systems. This makes the transition from developing PC based malware to smartphone based malware nearly trivial. Smartphone malware and specifically botnets have been seen both in security research and in the wild. The GSM modem can be viewed as a public IP address without filtering or firewall capabilities. The presentation shows an example of a smartphone botnet that is controlled over the GSM function SMS. The presented system works at the base operating system below the application layer, resulting in transparency to the user. Details of the system are discussed with particular emphasis on cryptography and security concerns.

About the Speaker

Georgia received a M.S. from James Madison University in computer science emphasizing information security and secure software engineering in 2009 and a B.A. in Mathematics in 2006. While at JMU, she was captain for the cyber defense team, taking home 1st in the 2008 JMU cyber defense competition, 1st at the 2009 Mid-Atlantic CCDC qualifier, 2nd at the 2008 Mid-Atlantic CCDC regional, and 3rd at the 2009 Mid-Atlantic CCDC regional. She now serves as a red team member at competitions and thinks that its just as stressful as playing blue.

Since graduation Georgia has worked in vulnerability management for both the public and private sectors. She especially enjoys pentesting and forensics work when she can get it. Having a degree in software engineering, she enjoys coding small projects, in small groups, without methodology, and not in Java.

Georgia works at Reverse Space, a hackerspace in the DC area, as the Director of Cyberwarface. It was Cyberwarfare, but when she was interviewed on Hak5 they billed her as Director of Cyberwarface and she liked that more. There she manages the cyberwar center for CTF/cyber defense, malware analysis, exploit development, and whatever else members talk her into. She also teaches courses on hacking.

Georgia currently researches smartphone insecurity and mobile botnets. She was last seen speaking at Shmoocon 2011.

Please RSVP if you plan to attend.
Non-members are welcome without charge!  Light refreshments will be served.

Tuesday, April 19, 2011 6:30 PM

Government Printing Office
Room A138
732 N. Capitol St.
Washington, DC, 20401

Click here for details

March 15, 2011

Abstract
Today's malware are very sophisticated and difficult to detect, capture, and analyze. This presentation shares some of the best practices and latest tools for capturing system memory and analyzing the image for malware artifacts. The session will be heavily hands-on in nature. At the end of the presentation, participants will be armed with the right arsenals for quickly extracting malware specimen from RAM and conducting deep analysis on the malicious software strain.

About the Speaker
Inno Eroraha is the founder and chief strategist of NetSecurity Corporation. He delivers cyber security and computer forensics solutions, teaches Hands-On How-To(r) Security/Forensics courses, and oversees the state-of-the-art NetSecurity Forensic Labs. He has delivered keynote speeches at industry conferences such The Computer Forensics Show and Techno Security and Digital Investigations conferences. Mr. Eroraha graduated cum laude with dual bachelor degrees in mathematics and computer science from Morgan State University as well as a masters degree in computer science from The George Washington University. Mr. Eroraha possess professional certifications including: CISSP, ISSAP, ISSMP, CISM, CISA, CHFI, CCSE, and CCSA. He is a licensed Private Investigator (PI) in the Commonwealth of Virginia.

Please RSVP if you plan to attend.

Tuesday, March 15, 2011 6:30 PM

Government Printing Office
Room A138
732 N. Capitol St.
Washington, DC, 20401

Click here for details

February 15, 2011

Abstract
Due to the exhaustion of IPv4 address space, and the Office of Management and Budget (OMB) mandate that U.S. federal agencies begin to use the IPv6 protocol, NIST undertook the development of a guide to help educate federal agencies about the possible security risks during their initial IPv6 deployment.  Special Publication (SP) 800-119, Guidelines for the Secure Deployment of IPv6, describes and analyzes IPv6's new and expanded protocols, services, and capabilities, including addressing, DNS, routing, mobility, quality of service, multihoming, and IPsec. For each component, there is a detailed analysis of the differences between IPv4 and IPv6, the security ramifications and any unknown aspects.  It characterizes new security threats posed by the transition to IPv6 and provides guidelines on IPv6 deployment, including transition, integration, configuration, and testing.  It also addresses more recent significant changes in the approach to IPv6 transition.

Sheila Frankel will discuss the security-related aspects of IPv6 deployment and NIST's recommendations for secure IPv6 deployment.

About the speaker
Sheila Frankel is a computer scientist and computer security researcher in NIST's Computer Security Division. She is an active participant in the Internet Engineering Task Force (IETF) IPsec standardization effort, and was responsible for NIST's IPsec/IKE reference implementation and interactive Web-based interoperability tester. She is the author of a book on IPsec, "Demystifying the IPsec Puzzle" and author of several IPsec-related RFCs. She also contributed to IEEE's 802.11i wireless standardization. Currently, she is involved with the Federal Government’s transition to IPv6, the next generation Internet protocol, and is a co-author of NIST’s U.S. Government IPv6 Profile. She holds a Masters degree from New York University's Courant Institute.

 Please RSVP if you plan to attend.

Tuesday, February 15, 2011 6:30 PM

Government Printing Office
Room A138
732 N. Capitol St.
Washington, DC, 20401

Click here for details