SANS Institute

Dear Colleague,

The attackers have changed the rules again — using old tools in new ways, and new tools for which your defenses have to be re-tuned and updated. Incident handlers and experts from the SANS Internet Storm Center are coming together this summer to present briefings on the most important of the new attack techniques. Please join this team for SANSFIRE 2008 in Washington, DC, July 23-31. You'll also find over forty of SANS top-rated courses: from penetration testing to hacker exploits to security management, wireless, forensics, secure coding, and more.

Dr. Johannes Ullrich, PhD, said on June 12: "Just last week, yet another attack from inside China penetrated US government networks. At SANSFIRE, you will have the unique opportunity to listen to Maarten Van Horenbeck (see the Thursday Keynote below). One of our ISC handlers, he has been analyzing these attacks for years and gained unique insights into the origins of these attacks. This is a 'must see' presentation. Maarten will share deep insight into the techniques used in these attacks, what works to protect from them, and how different attacks can be linked to common origins."

Dr. Johannes Ullrich, PhD, Chief Research Officer for SANS, and Marcus Sachs, Director of the Internet Storm Center, invite you to the following SANSFIRE 2008 Keynotes:

- Wednesday, July 23, "Joint Podcast with PaulDotCom and ISC"
- Paul Asadoorian, Joel Esler, Johannes Ullrich, and ISC Handlers
A live joint podcast from PaulDotCom Security Weekly and the Internet Storm Center with topics relating to the monthly Internet Threats.

- Thursday, July 24, "Is Troy Burning?
- An analysis of targeted cyber attacks" featuring Maarten Van Horenbeeck, SANS ISC

SANS @Night events also promise to provide a value-added experience not to be missed!

- Wednesday, July 23, "Mistakes Made with Snort, and How to Correct Them"
- Presented by Joel Esler
- A quick 10-topic list of the most common mistakes made while using Snort, what they mean, how to correct them, and why you should.

- Thursday, July 24, "State of the Internet"
- A panel discussion with Moderators Marc Sachs and Johannes Ullrich of the ISC.

- Friday, July 25, "Cold Boot Attacks for Pen Testers" with Ed Skoudis & Tom Liston
- Skoudis and Liston will discuss how penetration testers can incorporate cold-boot attacks into their penetration testing methodology, increasing the effectiveness of their physical security assessments.

- Saturday, July 26, "Malware Counterstrike"
- Lorna Hutcheson presents a look at different techniques and tools to detect and mitigate the effects of malware. If you want to join in on the counterstrike against malware, you won't want to miss this!

The Internet Storm Center knows about more than the vulnerabilities. Because the Infosec community shares an unprecedented amount of information with the Internet Storm Center, evening talks at SANSFIRE 2008 will provide extraordinary insights into actual attacks that have taken place. These special presentations are free to everyone who attends one of the courses at SANSFIRE 2008. You'll learn about current threats — and, how the Internet Storm Center can help you in your fight against these threats.

The Internet Storm Center's success is largely because the defensive Infosec community shares information to make our world better. Nothing fosters information sharing and trust building better than face-to-face meetings like SANSFIRE 2008. Again, several of our incident handlers will be present at this event, giving you unprecedented opportunities to get to know these fantastic people.

The course schedule for SANSFIRE 2008 features a full lineup of SANS classics in the disciplines of audit, security, management and legal. We've also rolled out new courses with a focus on penetration testing, malware analysis and removal, and secure coding. All SANS courses directly address the kinds of incidents reported by the Internet Storm Center in their daily diaries. And, it's a SANS promise that what you learn you'll be able to apply immediately back at the office. Last year's SANSFIRE attendees told us:

Just absolutely mind blowing. - Hank Watson, NG

I was excited to come to SANSFIRE, but this blew my expectations out of the water; the best coverage ever. - M. Ortega

AT SANFIRE 2008, you'll have far more than just training opportunities. This is also the place to meet other information security professionals, discuss new products with vendors, participate in online challenges, and listen to world-class guest speakers. Our downtown conference location also has easy access to all of the monuments, museums, and government buildings that offer many days of sightseeing for spouses and kids.

Make your travel and training plans early. Discounted room rates are available at the for SANS students through July 9. Plus, register for SANSFIRE 2008 by June 25, and you can receive a $150 tuition fee discount.

You won't want to miss this important industry event.

Marcus Sachs
Director, SANS Internet Storm Center

Johannes Ullrich,
Chief Research Officer, SANS

P.S. If you are not part of the active defensive community, we appreciate your continued support by submitting your logs and helping us make a difference: http://isc.sans.org/howto.html