Schedule

Dr. Bernhard Tellenbach President, Swiss Cyber Storm

Dr. Bernhard Tellenbach President, Swiss Cyber Storm

Dr. Christian Folini Program Chair, Swiss Cyber Storm

Paul Vixie , CEO Farsight Security

We are very proud to have Paul Vixie as our keynote speaker. We do not need to tell you about Paul’s greatness or about the fact that he is a veteran with over 30 years in the IT industry. But Paul also has a unique stage presence and a very wide horizon that spans the whole of the internet and beyond. As if to underline this, Paul proposed to talk about the viability of our constant expansion of software to govern our lifes, our culture, society and economy: Humanity has been building and programming general purpose computers for about six decades now, with spectacular results, mostly good. As we contemplate the Internet of Things in light of our collective experience, there are some disturbing conclusions to be drawn. Can we as a species safely place our economy and culture into a global distributed network of computers, if those computers are programmed by humans using commodity programming languages and tools?

Aldo Frick Board Member, Head, IT Service and Delivery, FL1 Telecom Liechtenstein AG

Aldo Frick is board member of the FL1 - Telecom Liechtenstein AG since 2011. Telecom Liechtenstein AG serves private and business customers with modern products from fixed networks, mobile internet and TV. Smart ITC services and solutions complete the portfolio. It is a new player, yet it accepts the responsibility to protect the assets of its customers and partners with strong security companies like RadarServices. And RadarServices is able to tailor its offerings to the exact demands of its customers while maintaining a high level of security; a perfect partnership.

• www
• www

Harald Reisinger Managing Director, RadarServices Smart IT-Security GmbH

Harald Reisinger is Managing Director of RadarServices, the European market leader for pro-active IT security monitoring and risk detection. He has over 20 years of experience in corporate management in the IT sector. He was the co-founder of Greentube Ltd. (later successfully sold to Novomatic). In 2001, Harald Reisinger founded the base-camp GmbH and in 2011 he co-founded RadarServices. Harald Reisinger studied international business at the Vienna University of Economics and Business and the University of Nebraska at Omaha.

• www

Clément Guitton Political Risk Analyst, SwissRe

Clément Guitton received his doctorate from the department of War Studies at the University College in London. He works as an advisor on political risks and released a book on attribution this year. In classical warfare, attribution is generally of an obvious nature thanks to the openness of the attacks or physical evidence collected on the ground. In cyber campaigns however, attribution is one of the hardest problems that is far some solved. And it matters a lot as many Western countries are revising the doctrines in case they come under attack and immediate retaliation with cyber counter strike is now on the table. The discussion in Switzerland is turning in this direction as well despite the 2nd edition of the National Cyber Strategy keeping its civil tone. Yet the NCS is limited to non-crisis situations and the army is warming up to the topic of cyber warfare around here. So we are happy to have a renown expert on the subject on stage at our conference.

Bryan Ford Professor, EPFL

Professor Bryan Ford went from MIT to Yale and is now leading the Decentralized/Distributed Systems Lab (DEDIS) at the EPFL. His interest lie with the securing of private and anonymous communication technologies. This work naturally makes him a very good choice for an introductory presentation on E-Voting at Swiss Cyber Storm. We are not the only ones who realized this however. So he presented in front of a group of cantons lately. His talk covered the application of blockchain technology on E-Voting and unsolved challenges faced by the two Swiss competitors on their way to build a solution that is certified for use by 100% of the voters and no longer limited to certain groups of voters. Proven anonymity, individual and general verifiability of the system and the establishment of multiple, independent control systems to supervise the various stages of the vote are the key problems. His talk at our conference will prepare the stage for the presentations of the two Swiss competitors.

• www

Jordi Puiggalí Head of Research and Development, SCYTL

Jordi Puiggalí is the head of research and development of the Spanish company SCYTL, the partner of Swiss Post for its E-Voting offering. Instead of developing it's own core E-Voting system, Swiss Post decided to join with one of the most experienced E-Voting companies in the world. That way Swiss Post could concentrate on the infrastructure and SCYTL adopt its voting protocol to a potential of 26 different Swiss jurisdictions and a heavy standard document issued by the Federal Cancellery. The cantons of Neuchatel and Fribourg have started to use the system actively in 2016 and the solution has been certified for use by 50% of the voters of a given canton. More cantons decided to go with Swiss Post and the development is actively aiming for the 100% certification in 2018. Jordi's talk will present the Swiss Post system and their approach to the problems of voter anonymisation and the verifiability of the votes cast and the results.

Thomas Hofer Technical Expert, State of Geneva

Thomas Hofer is the head of development for CHVote, the E-Voting offering of Geneva. Geneva has been doing many, many E-Voting pilot runs for over ten years. Thomas Hofer has been part of the project for half of its existence and his background in Open Source Software is now coming at his service. Despite initial resistance, Geneva made the complete transparency a prime characteristic of its E-Voting solution. And when it became clear that it's system was unfit to meet the high federal standard to receive the certification for general use by 100% of the voters of a given canton, Geneva decided to start over from scratch, to task the technical University of Berne to develop a new voting protocol and to implement it in a completely open source process. At Swiss Cyber Storm, Thomas Hofer will introduce us toCHVote and how Geneva intends to implement four independent control systems to verify the votes. Meanwhile the former generation of CHVote is in use by multiple other Swiss cantons.

Deviant Ollam , Author of Practical Lock Picking

Cyber Security is most interesting, when it touches on the real world. Our speaker Deviant Ollam embodies this relationship as godfather of locksport and board member of TOOOL US and as a physical penetration tester that not only hacks into systems, but he hacks virtual and physical systems in order to actually get into buildings. He will also touch on social engineering so you get an all-encompassing picture of his work with intrusion as its ultimate goal no matter the means. Deviant Ollam is a fascinating person, a pioneer of Android security, an expert on flying with guns, an excellent cook specialized in hotel room cuisine coping with limited means and he is a long time member of the DefCon and the Shmoocon crew where he co-created the Lockpick Village. Join his talk and follow a astonishing collection of staggering stories all pointing to human fallacies that would never happen to any of you and your companies or organizations? Or could they?

Dhia Mahjoub Head of Security Research, Cisco Umbrella (former OpenDNS)

When we think of bulletproof hosting, we usually think of shady firms in the style of the Russian Business Network. They were known dodge all inquiries and take-down notices from governments. They are thus operating in corrupt legislations where such behaviour is accepted. Nowadays, this traditional centralized bulletproof hosting has morphed into a more modern, flexible and elusive style where hosters diversify their footprints across various spaces and jurisdictions and act as dynamic business partners for criminals that want to host illegal contents online. Copyright infringement? Not all country prosecute it. Illegal Porn? Better know the jurisdiction. Stolen data? We have servers in locations were your government won’t be able to reach them. Dhia Mahjoub is the Head of Security Research at Cisco Umbrella, formerly OpenDNS, where he has all the data at his disposal to discover the operation patterns of these modern bulletproof hosters.

• www

Jos Wetzels , Researcher at the University of Twente

IoT is all the rage and we all have seen many presentations that left us chuckling at the abhorrent security of these devices. Jos Wetzels takes that class of presentations one step further by leaving the smart toothbrushes and iphone enabled dildos behind and examining IoT devices and industrial control systems in environments where you would hope for higher standards: He looked at critical infrastructures for electric, oil, gas and water utilities. He analyzed the operating systems used in cars, nuclear power plants and military fighter jets. A lot of this work was carried out under NDA conditions, but that does not prevent Jos from telling us about his lessons learnt. There is a structural problem that he discovered, the search for a decent source of entropy. Getting truly random numbers is hard and obtaining them in a controlled setting is a contradiction in itself. He will touch on this and tell us how he thinks developers should improve IoT security.

• www

Not yet announced , Not yet revealed

Not yet revealed ...

Mazin Ahmed , Information Security Specialist / Penetration Tester

Mazin Ahmed is an Information Security Specialist and a Penetration Tester. Computers and its security is his passion for years, and every day he gets attached more into this field. Information Security is not just his career focus, but it's his hobby. Mazin has worked for a variety of companies, universities, banks, providing the best security solutions, and ensuring that the maximum security possible. Currently, he is running a few community projects, to help raising better awareness regarding Information Security. He is also a bug bounty programs participant in his spare time. He has reported valid vulnerabilities to numerous top-profile companies, such as Facebook, Twitter, LinkedIn, Bugcrowd, Oracle, Ebay to name a few. He has also been one of the top 3 researchers for PureVPN, one of the top 5 researchers for Tagged, and he was three times in the Bugcrowd top 10 researchers of the month. He is currently among the 15 top researchers (out of 20,000+) on Bugcrowd.

• www

Not yet announced , Not yet revealed

Not yet revealed ...

Not yet announced , Not yet revealed

Not yet revealed ...

Not yet announced , Not yet revealed

Not yet revealed ...

Friedrich Oesch Head of Professional Services Web Application Security, Ergon Informatik AG

Since 15 years, Friedrich Oesch is responsible for Professional Services and Academy and Quality Assurance for Ergons' application security solution Airlock Suite. Previously, he was a project manager in the development of web applications in the banking, administration and industry sectors. He is a certified business informatics specialist and has a certificate as CISSP (Certified Information Systems Security Professional) and ITIL Foundation.

Not yet announced , Not yet revealed

Not yet revealed ...

Mario Bischof IT-Security Engineer & Consultant, terreActive AG

Cyrill Brunschwiler Managing Director, Compass Security Schweiz AG

With more than fifteen years of experience within the security scene and a background in electronics, Cyrill has come across numerous technologies and issues. He has been extensively contributing wargame challenges and educational material to the hacking-lab.com platform in its early days. Cyrill has been providing independent advice in the fields of penetration testing, security reviews and digital forensics to customers within the industries, utilities, pharma, finance and government sectors since 2005. He has been teaching network pentesting, wireless security and application security in cooperation with the Swiss ISACA chapter to several hundred students since and volunteers now and then for security lectures at local universities and business clubs. Cyrill has also contributed and supported (CFP board) to former Swiss Cyber Storm and Hack&Learn conferences. He holds an MSc degree in Information Security from the well renowned Royal Holloway University of London. In 2014 Cyrill Brunschwiler was appointed as the Managing Director of Compass Security Switzerland.

Miro Ljubicic Head of the Swiss cyber defense team, NTT Security

Miro Ljubicic works for NTT Security since 2013, starting as IT security specialist for security monitoring, vulnerability management and security incident management. Today, Miro Ljubicic is head of the Swiss cyber defense team and responsible for building up and developing the new cyber defense center in Switzerland. Together with his team he plans and designs cyber control systems, analyzes and reviews cyber-attacks, optimizes early and real time detection and develops new analysis standards and value adding services. Before joining NTT Security, Miro Ljubicic has 10 years experiences with IT operations and global security operations at the financial service provider USB AG in Zurich. Miro Ljubicic has a Bachelor of Science of the ZHAW Zurich University of Applied Sciences.

Not yet announced , Not yet revealed

Not yet revealed ...

Milan Singh Thakur , OWASP Foundation

Milan is very passionate about Information Security and an International Speaker. He is leading OWASP Mobile Security Project Globally and is also AppSec INDIA Leader. He also works as Information Security Consultant at Aujas Network in India. His primary focus is Mobile Security. He has helped to secure mobile apps for various well known clients in banking, insurance, health, e-commerce and other sectors.
He has expertise in fields like secure code review, NFC Pentesting, Web Appsec, VAPT activities, Wireless Pentesting, Payment Gateway Security Assessments and lot more. His scope of exploration is not limited to these technologies. He is strong supporter of “Open-Source” terminology and has been promoting it since 2010.

• www

Raphael Reischuk Senior Information Security Researcher, Zühlke Group

Raphael Reischuck has a deep interest with cryptographic primitives and the construction of secure protocols based on these building blocks. This passion lead him into the Network Security Group at ETHZ where he joined the development of the SCION project. SCION is meant to replace the basic protocols the internet is built upon. If we are really honest, these protocols have proven to be illfit for our security needs. The much needed performance boosts often came in the form of bolt-on hacks instead of long-term visions. You could say that we have painted ourselves into a corner of a room stacked with RFCs. Raphael Reischuck thinks it is time for something new. But unlike former attempts to supersede TCP/IP and friends (attempts that are now long forgotten), SCION is designed to allow a smooth transition. And after years of testing, piloting and revising the first designs, the researchers of ETHZ are now coming out of cave to present us their new range of protocols.

• www

Antonio Barresi CEO, Xorlab

It is so annoying to teach users (again and again) not to click and to keep clear of dangerous attachments. Yet, would it not be better if systems were immune from such fiendish assaults? How can we protect systems from PDF exploits and drive by downloads? This question has proven to be very, very difficult in practice. Antonio Barresi and Matthias Ganz are founders of the ETH Zurich spinoff Xorlab that strives to strike at the heart of this problem. For Swiss Cyber Storm, they will address it in a wide perspective and give us a general overview over modern means of mitigation against memory corruption attacks. After all, Data Execution Prevention (DEP) and Address Space Layout Randomization (ASLR) are only the - known forms of defense in this regard. But what other techniques do exist to make the moat wider and the walls thicker? Our two speakers share a big interest in security problems that are closely linked to hardware and namely Antonio has travelled far to talk about these issues.

• www

Matthias Ganz CTO, Xorlab

It is so annoying to teach users (again and again) not to click and to keep clear of dangerous attachments. Yet, would it not be better if systems were immune from such fiendish assaults? How can we protect systems from PDF exploits and drive by downloads? This question has proven to be very, very difficult in practice. Antonio Barresi and Matthias Ganz are founders of the ETH Zurich spinoff Xorlab that strives to strike at the heart of this problem. For Swiss Cyber Storm, they will address it in a wide perspective and give us a general overview over modern means of mitigation against memory corruption attacks. After all, Data Execution Prevention (DEP) and Address Space Layout Randomization (ASLR) are only the - known forms of defense in this regard. But what other techniques do exist to make the moat wider and the walls thicker? Our two speakers share a big interest in security problems that are closely linked to hardware and namely Antonio has travelled far to talk about these issues.

Stefan Lüders CISO, CERN

We all know, there is no business case for securing IoT hardware. There is no legislation and no incentive to lock it down. But there is a lot of legal knowledge how a manufacturer can sneak out of the responsibility via extensive EULAs. Our industry has been having great fun dissecting electronic scales, smart toothbrushes and even IoT egg containers (here at SCS!). But the fun stops when products with the same lousy level of security hit your corporate network. Stefan Lüders is the CISO of CERN and he has first-hand experience with securing mission critical infrastructure when separation and containment of insecure devices is no longer an option as strong stakeholders (CERN physicists in Stefan's case) push for a wide introduction of hot sensors and control systems. So what options do you have in such a situation? Stefan's talk will teach you how to live with these devices. A separate talk by Jos Wetzels looks closer at the hardware itself.

Tarah Wheeler , Author and Cybersecurity Czar

Tarah Wheeler is a thought leader on security and internet freedom. She is best known for her Women in Tech book but at Cyber Storm, she will speak about the security and the digital transformation of finance: Fiat currencies around the world are beginning to transition to a purely digital form and the removal of the 500 Euro notes is only one of the more obvious signs. With a purely digital fiat currency, black market monetary stockpiles would be exposed, the number of participants in the banking system is meant to grow, and fiscal efficiency will be improved. Money is now flowing freely, with no capital controls, and the meta data surrounding financial transactions is more valuable than the money itself - yet often poorly secured. Meanwhile the blockchain or even crypto currencies seem to be a disrupting technology and they will destroy many established business models: It is very likely the Bretton Woods system as we know it will transform before our eyes in the next few years.

• www

Tanya Janca , Security Officer at Canadian Government

Tanya Janca's talk titled "Pushing Left Like a Boss" points at the Software Development Lifecycle (SDLC) where the costs of bugs grow exponentially the longer you wait. Fix conceptual bugs and they hurt, but wait until the product has been rolled out and conceptual errors have grown into failures that threaten the existence of the product; to say the least. But how can you push left? What are the best practices for your organisation to detect these failure early on and to remain agile in your development. Can you build a DevOps pipeline without compromising on security? Tanya Janca is a developer with almost 20 years of experience. She advocated safe coding practices for years, she accompanied the 42nd General Election in Canada as the IT security coordinator, she is a Co-Leader of the OWASP Chapter Ottawa and engaged in the OWASP Women in AppSec initiative. And lately she started a career as a speaker at various conferences in the States and in Europe.

Daniela Oliveira Professor, Florida Institute for Cyber Security

Professor Daniela started out with research on performance in distributed video on demand systems. She then shifted into the security domain and worked on malware detection in virtual machines, kernel extensions and other hard technical security topics. But then, slowly, she started to bring heuristics, behaviour models and psychology into the mix and her research turned to applied security and human interactions with computers. A very typical development that we see over wide stretches of the security industry. At our conference, this career scientist will speak about the susceptibility of C-Level Management to spear phishing attacks. What angles do attackers use when writing their bait messages and what are the keywords that will lead to a lethal click by the receiver? What "life domains" need to be mentioned to draw the attention of the board member? Daniela has originally researched this for elderly populations but is now focusing on decision makers for our conference.

• www

Not yet announced , Not yet revealed

Not yet revealed ...

David Rosenthal Counsel, Co-head IT practice, Homburger AG

David Rosenthal is counsel and co-head of the IT practice at Homburger, a leading Swiss law business firm in Zürich, which he joined in April 2001. Before that, he headed his own legal consulting firm in Basel.

• www

David Caissy Security Consultant, Albero Solutions Inc.

David Caissy , OSCP, GWAPT, GPEN, GSEC, CISSP, CEH has 16 years of experience as a security consultant and a web application architect. He has performed security audits, vulnerability assessments, web application penetration tests and has designed several secure systems. He has worked for banks, the Department of National Defense, various government agencies and private companies. He has been teaching information security in colleges and in many departments over the last 10 years.

Walter Belgers President of TOOOL, Owner and COO Madison Gurkha

Walter Belgers is busy in the security and computing science field since age 8. He has experience in setting up security systems, international roll-out, education, auditing you name it. He is owner and COO of Madison Gurkha, a Dutsch security company with a name that sticks. The last 15+ years he was also involved in giving lectures and organising conferences (boardmember of EuroBSDCon 2004, chair or member of the program committee for many others; probably a reason he has sympathy for Swiss Cyber Storm). Walter's specialties include Security (computers and other), UNIX, computer science in general (operating systems, computer languages, hardware), teaching, explaining, social engineering, organising, giving lectures. AND: Lockpicking! Walter is multiple winner of Dutch lockpicking championships and the president of TOOOL (The Open Organisation of Lockpickers).

• www

Anthony Vance Associate Professor, University of Hawaii at Mānoa

The famous quote “Given a choice between dancing pigs and security, users will pick dancing pigs every time” stands at the beginning of Anthony Vance's talk. Yet, why are users behaving like this? And why have 20 years of friends getting hacked, near-daily press coverage of security incidents and tedious awareness programs failed to change this fundamental behaviour pattern? Our speaker used combined functional magnetic resonance imaging and traditional usability testing to examine users while surfing the web and watching video clips. The results reveal a substantial effect of neurobiology on user’s security behavior. It is worth looking at his results in detail. But Anthony will also suggest practical ways to improve the security via a better design of user interfaces. Interfaces written with the awareness of the fact that neurobiological fundamentals are hard to change. His presentation will include various examples and suggestions in this direction.

• www