AI Security and Privacy Governance in the New Digital Era
MARCELO MOTTA

Abstract

With the accumulation of big data, dramatic improvements in computing power, Billions of smart devices connected by ultra high speed networks empowered by 5G and AI technologies are the enablers of a new digital world,. Which are the new threats and how to tackle them? The security of AI systems is becoming vitally important and has gone beyond our traditional understanding of security boundaries and frameworks. In this session, we will highlight the major security challenges, defense systems and governance for AI deployment and, more important, transparency and openness for collaboration between industry and governments to overcome the common cyber security challenges.

Bio
Marcelo Motta Marketing Director & Cyber Security Expert Huawei Global Cyber Security and Privacy Protection Office
In Huawei Global Cyber Security and Privacy Protection Office, Motta is the marketing director focused on end-to-end cyber security governance and assurance.
Experienced in cross-domain solutions including 5G Security, Edge Computing (MEC), SDN/NFV/Cloud, Big Data and AI, Motta is Huawei representative in several industry events and innovation projects including requirements collection, gap analysis, roadmap formulation, business model definition and go-to-market. In Huawei since 2002, he served company in many leading positions at headquarter and overseas. Prior to Huawei, Motta occupied several positions in Nortel Networks, Siemens and HP, and was a professor of telecom engineering for over 10 years at the Maua Institute of Technology, Brazil.

Automated adversary emulation using Caldera
ERIK VAN BUGGENHOUT

Abstract
MITRE ATT&CK is quickly gaining traction and is becoming an important standard to use to assess the overall cyber security posture of an organization. Tools like ATT&CK Navigator and Caldera facilitate corporate adoption and allow for a holistic overview on attack techniques and how organizations are preventing and detecting them. Furthermore, many vendors, technologies and open-source initiatives are aligning with ATT&CK. Some more information on Caldera from the official documentation https://github.com/mitre/caldera

“CALDERA is an automated adversary emulation system that performs post-compromise adversarial behaviour within Windows Enterprise networks. It generates plans during operation using a planning system and a pre-configured adversary model based on the Adversarial Tactics, Techniques & Common Knowledge (ATT&CK™) project. These features allow CALDERA to dynamically operate over a set of systems using variable behaviour, which better represents how human adversaries perform operations than systems that follow prescribed sequences of actions.”

MITRE recently released Caldera 2.0 (end of April 2019), which includes a larger focus on “extendibility”. During this talk, we will leverage these features for maximum effect. We will highlight some interesting improvement opportunities in Caldera and we will focus on how we developed additional plugins & features. To make this a bit more concrete:

-How can we improve Caldera’s reporting engine? (It’s currently not possible to get an easy ATT&CK coverage report / deliverable out of the tool). This is of great use if we want to increase usability of the tool and ATT&CK overall!
-How can we build additional plugins for MITRE Caldera to increase the ATT&CK coverage of the tool?
-How can we adapt Caldera to work around common security controls in place at organizations (e.g. Windows 10 security features such as ExploitGuard and AMSI, which hinder Caldera’s PowerShell scripting).

This talk will arm infosec professionals with the required skills to further extend their adversary emulation options without breaking the bank for a commercial tool! As our main focus is to increase Caldera adoption and help the community, we will also publicly release developed plugins!
We will go into the nitty-gritty details of our development efforts and will also include several technical demo’s that will help transfer knowledge to the audience and encourage their own development efforts!

Bio
Erik Van Buggenhout is the lead author of SEC599 – Defeating Advanced Adversaries and SEC699 – Advanced Purple Team Tactics. and SEC699 – Advanced Purple Team Tactics. In addition to SEC599 and SEC699, Erik teaches SEC560 – Network Penetration Testing & Ethical Hacking and SEC542 – Web Application Penetration Testing & Ethical Hacking. He has been involved with SANS since 2009, first as a Mentor, working his way to Community Instructor in 2012 and finally becoming a Certified Instructor in 2016.
Erik loves explaining deeply technical concepts by using war stories, adding a few funny anecdotes here and there. As a testimony of his technical expertise, he has obtained the GSE, GCIA, GNFA, GPEN, GWAPT, GCIH, and GSEC certifications.
In addition to his work with SANS, Erik is the co-founder of European cyber security firm NVISO, which focuses on high-end cyber security services, specializing in government, defense and the financial sector. Together with his team of 70+ consultants, Erik delivers a wide array of technical security services, including penetration testing, security monitoring & incident response.
Prior to NVISO, Erik spent five years at Big 4 firm, starting as a junior penetration tester and evolving into a subject matter expert for the EMEA region.

Avaya Deskphone: Decade-Old Vulnerability Found in Phone’s Firmware
PHILIPPE LAULHERET

Abstract
Avaya is the second largest VOIP solution provider with an install base covering 90% of the Fortune 100 companies, with products targeting a wide spectrum of customers, from small business and midmarket, to large corporations. As part of the ongoing McAfee Advanced Threat Research effort into researching critical vulnerabilities in widely deployed software and hardware, we decided to have a look at the Avaya 9600 series IP Deskphone. We were able to find the presence of a Remote Code Execution (RCE) vulnerability in a piece of open source software that Avaya likely copied and modified 10 years ago, and then failed to apply subsequent security patches to. The bug affecting the open source software was reported in 2009, yet its presence in the phone’s firmware remained unnoticed until now. Only the H.323 software stack is affected (as opposed to the SIP stack that can also be used with these phones), and the Avaya Security Advisory (ASA) can be found here ASA-2019-128.

Bio
Philippe Laulheret is a Senior Security Researcher on the McAfee Advanced Threat Research team. With a focus on Reverse Engineering and Vulnerability Research, Philippe uses his background in Embedded Security and Software Engineering to poke at complex system and get them behave in interesting ways. In his spare time, Philippe enjoys playing CTFs, immersing himself in the beauty of the Pacific Northwest, and exploring the realm of Creative Coding. Philippe holds a MSc in Computer Science from Georgia Tech and a MSc in Electrical and Computer Engineering from Supélec (France).

Binary Testing and the simplicity of MLAB on your mobile apps
MOHAMMED BELREMAITHA

Abstract
The mobile application portal is a versatile security scan engine focused on securing cross platform applications, through static code reviews. The solution aims to help the developer to locate areas of code that may be vulnerable to security exploits, and can be closely integrated into the entire design process of the applications. The portal is designed to ensure the simplicity of uploading the mobile applications. Through this solution, the TRA aims to dramatically reduce security vulnerabilities in UAE Government applications.

Bio
My name is Mohammed Belremaitha, I work as Information Security Senior Engineer at the Telecommunication Regulatory Authority the aeCERT. my job position is the team leader of the Security Quality Team in aeCERT.

Open Problems in AI and Security
PROF. ERNESTO DAMIANI

Abstract
The presentation will focus on discussing the fundamental role of AI and ML in the definition of next-generation cyber security solutions. This scenario will consider the extreme benefits and, at the same time, the critical challenges introduced by a huge amount of heterogeneous data coming from exponential growth of connected devices (from minuscule sensors to bigger machines), which, according to Intel, are expected to reach 200 billions by 2020. The presentation will then concentrate on open issues and challenges, as well as possible approaches, to AI applications for cyber security. AI/ML analytics can in fact achieve satisfactory performance in attack detection only if distributed training and execution of the models fully match latency and resource constraints. Enforcing this condition requires advanced skills, time and experience, and is still considered more an art than a science.

Bio
Ernesto Damiani is a professor of computer science at the University of Milan, where he leads the SEcure Service-oriented Architectures Research (SESAR) Lab. He is also the co-director of the IRIXYS French-German-Italian research center (www.irixys.org). On leave from Milan, he is the Director of the Center on Cyber-Physical Systems and the Senior Director of the A.I. Institute at Khalifa University, in the UAE. He has held visiting positions at George Mason University (US), University of Technology Sydney (Australia), Tokyo Denki University (Japan) and Université de Bourgogne (France). Damiani received an honorary doctorate from Institut national des sciences appliquées, Lyon, France (2017). His research spans security, Big Data and knowledge processing, where he has published over 400 peer-reviewed articles and books. He is a Senior Member of the IEEE and a Distinguished Scientist of ACM

The Internet of medical things (IoMT)
NASSER HASSAN ALBLOUSHI

Abstract
The digital revolution is sweeping the healthcare industry where a vast amount of data is being captured, processed and stored through systems, applications and a plethora of interconnected bio-medical devices. while this allows to significant gains in efficiency and reduction in clinical workload; it also imposes new risks and threats that have to be embraced by both suppliers and healthcare providers

Bio
Eng. Nasser Al-Bloushi is the Head of Information Security at Dubai Health Authority. Nasser has been in this role since 2014 and ever since; he has been responsible for information security governance, risk & compliance of the public health sector in the emirate of Dubai. Nasser is passionate about implementing security principals that are both secure and business efficient. He has been integral in involving information security as a core function in Dubai’s health strategy. He holds a B.S. in Computer Engineering from the American University of Sharjah and an M.S. of Cybersecurity and forensic from Zayed university.

Exploring Data Mining Techniques for detecting Deep fake Videos
Dr. FATEN F KHARBAT

Abstract
Detecting Deepfake videos is one of the challenges in digital media forensics. Deepfake video is an expression used to describe the production of a video by swapping the face of one person onto another. This talk will cover some points; starting with a brief literature survey since detecting deepfake videos since it is classified into two main categories in terms of the availability of information: (a) passive detection, and (b) active detection. Also, the talk proposes a tool to detect deepfake videos using Support Vector Machine (SVM) regression. The SVM classifier can be trained with feature points extracted using one of the different feature-point detectors such as HOG, ORB, BRISK, KAZE, SURF, and FAST algorithms.

Bio
Faten F Kharbat is an Associate Professor at Al Ain University – Abu Dhabi Campus. She is currently the deputy dean for the College of Engineering. Her Ph.D. was in Computer Science/ Artificial Intelligence from the UK. Her research interest includes Cancer Informatics, Image Processing, Data Mining tools & techniques, and technology in education. A strong believer that technology can enhance our lives if (and only if) we keep the right distance!

Investigating with Encrypted Network Traffic
MATT BROMILEY

Abstract
Let’s talk about a key issue in enterprise defense: encrypted traffic.Many organizations are seeing a majority – if not all – of their traffic being encrypted, and thus causing a blind spot for the incident response and investigations team. There’s also an assumption that more and more attackers are moving towards encrypted channels for their communications, and thus rendering network monitoring useless. As such, many teams are ignoring network data because they assume they simply cannot analyze it. They could not be more wrong.

In this talk, we’re going to discuss techniques that can be used to profile and fingerprint encrypted network traffic. Encrypted traffic leaves behind a wide range of highly-useful and descriptive artifacts and metadata – we’re going to discuss ways to include these into your investigations. Furthermore, we’ll also examine examples of true threat actor traffic, and see how (and if!) they are using encrypted traffic. We’ll prove once and for all that even though we cannot see inside of it, we can still use this traffic to our advantage!

Bio
Matt Bromiley is a principal incident response consultant at a top digital forensics and incident response (DFIR) firm where he assists clients with incident response, digital forensics, and litigation support. He also serves as a SANS GIAC Advisory Board member, a subject-matter expert for the SANS Securing The Human Program, and a technical writer for the SANS Analyst Program. Matt brings his passion for digital forensics to the classroom as a SANS instructor for FOR508: Digital Forensics, Incident Response, and Threat Hunting, and FOR572: Advanced Network Forensics, where he focuses on providing students with implementable tools and concepts.
“SANS is the only organization where I have seen students bursting to get out of class to apply their newly acquired skills to current casework,” he says.
Matt fell into this career somewhat by accident, taking on a junior analyst role because the team was great and the work sounded exciting. “My first day, I was working a keylogger case that required me to examine various hardware, test information, extract USB information, and decode logged keys,” he recalls. “I was hooked!”
Since then, Matt has built a wide-ranging career that gives him a broad perspective on digital forensics. He has helped organizations of all types and sizes, from multinational conglomerates to small, regional companies. His skills run the gamut from disk, database and network forensics to malware analysis and classification, incident response/triage and threat intelligence, memory analysis, log analytics, and network security monitoring.
Along with traditional database forensics, Matt has experience deploying such tools as Elasticsearch, Splunk, and Hadoop to assist in large-scale forensic investigations, network security monitoring, and rapid forensic analysis on over 100 systems and over 10TB of logs. He has a particular interest in database and Linux forensics, as well as in building scalable analysis tools using free and open-source software.
Matt understands the importance of making the information he’s teaching relatable to students. “It’s easy to picture every scenario as an advanced persistent threat attack, but some students don’t perform those investigations,” he explains. So Matt looks for the common ground among all of the specific artifacts and the bigger picture that each artifact helps develop, thus enabling students to enhance their investigations and succeed in their day-to-day careers.
His extensive experience in digital forensics shines through in his teaching. An energetic, enthusiastic instructor, Matt sees digital forensics as a puzzle that is begging to be solved. He loves piecing together artifacts to tell a vivid story about what has happened, and he strives to inspire his students to have the same passion for “completing the puzzle”.
Outside of work, Matt loves spending time with his family, cooking Texas BBQ, and making his house as automated as possible in hopes that it will one day do work for him.

AI mutated malware: the next threat
SHEIKH ABDUR RAHEEM & YOUSEF AWAD

Abstract
We will present a asynchronous genetic algorithm that performs a series of functionality preserving modifications on a Windows PE binary, sends the updated files to VirusTotal, collects reports on how many antiviruses detect the file as malicious, then searches for the best sequence of operations by selecting the strain with the maximum evasion rate as a base for further mutations. We design custom malware using the metasploit framework to test that our final sample can still perform its original functionality. We discuss the imminent threat of low cost, high speed AI assisted obfuscation of payloads, and outline potential ways to strengthen security solutions against similar approaches.

Bio

Abdur Raheem
a machine learning research assistant at the American University of Sharjah. He has won awards from the second largest advertising company in the world (Omnicom), the seventh largest bank in the world (HSBC), and lead the second place team at the HITB+ CyberWeek AI Challenge. He has been invited to conferences in the UK, contributed to the textbook ‘Mathematics for Machine Learning’, and interned at an AI startup. He has worked on a project sponsored by the Ministry of Health, and is a member of IEEE and ACM. He’s graduating with a Bachelor’s in Computer Science shortly after he turns 20 next year.

Yousef Awad
Self taught cybersecurity researcher, CTF creator and participant. Organizes security workshops across universities in the UAE. Creator of multiple security tools including iPwn

The role of AI and its implications on the Future of cyber security
DR. MARYAM ALYAMMAHI

Abstract
Within the current worldwide digital revolution, Artificial Intelligence (AI), also known as Machine Intelligence, is one the most dramatic technological changing aspects in the human nation. AI is one of Computer Science fields that is aim for simulating intelligence in machines so that they can think, feel, and make decision like human. You have probably heard of some today’s AI applications like Siri, Netflix, Alexa, Tesla, and many others. Not forgetting the robot that can play chess better than human can. These applications of AI and more are developed every day bringing us to unexpected future and thus having disruptive impact on most aspects of our life. Cyber security field will have no exception even though the intelligent technologies of this field are in the early stages of that dramatic shift. There are many governmental leaderships including UAE, China, and USA are advancing and embraced “innovation- driven” strategies to become premier in AI by 2030. In this talk, we will address the general role that AI is playing in cyber security and its future. The talk will also discuss some other real-life examples related to social media and other governmental smart applications.

Bio
Dr. Maryam Al Yammahi is Assistant Professor in the College of Information Technology at the UAE University. She is currently the Assistant Dean for Students in the IT College. Dr. Maryam has received her MS and PhD degrees in Computer Science from The George Washington University at USA in 2012 and 2015, respectively. Her current research and technical interests includes information retrieval systems, intelligent systems for Big Data processing, and applications of Artificial Intelligence (AI) and 4th industrial revolution (4IR).Moreover, she has number of journal and conference publications, and hold
a US patent for inventing Pigeonhole search method in Big Data.She was invited speaker in many conferences and events internationally and nationally including UAE governmental Foresight Summit 2019, Ministry of Defense conference 2018.