Once again InfoSecurity Europe was an interesting place to visit. Lots of good sessions and interesting people to talk to. Most of the usual protagonists were there and the organisers have increased the educational part of the exhibition as well, which is good.
I thought I would put down a few things that I thought were noteworthy from the exhibition. I've already blogged about the GrIDsure anti-phishing sender verification and the new 3M mobile phone privacy filters, but there were a few other things I want to mention.
The first one is Panda Security's new Panda Cloud Internet Protection. This is a cloud-based service that provides consistent security and access policies to all machines within an organisation. The key thing is that it will protect mobile machines that are outside the corporate network with the same policies as those within the network. Protecting corporate machines when mobile is a big concern and a good way to reduce malware or hacking problems on the main network.
The usual problem is that mobile devices connect to public, unsecured (or badly secured) networks and either pick up some malware that they bring back with them, or they connect back remotely and open a soft doorway into the corporate network. By securing machines with this cloud service, it should stop them from being a soft target and weak link in your security chain. If you already do something similar by allowing VPN access into the corporate network and allowing them to create connections out, you are using additional bandwidth for this traffic and having to open a VPN connection, which isn't always wise.
Another topic talked about (mainly by Sophos) was the security, or lack thereof, when using social media. Graham Cluley gave a really good talk on the subject on the Sophos stand including the use of SPAM avatars on sites such as Twitter. The attack is centred around the fact that anti-SPAM filtering finds it hard to scan the content of images, e.g. by doing Optical Character Recognition (OCR). So, people have been putting written messages in their ID picture to get past any filtering. You can find out more from his blog.
The final mention has to go to Ian Mann from ECSC. He, once again, talked about several Social Engineering techniques to get past security. He stated that he always likes to see security guards when trying to gain unauthorised access, as it usually makes the system much less secure. He gave a talk in one of the main theatres as well as several talks on the ECSC stand, all of which were interesting. He has written a book called Hacking the Human, which is worth a read if you want to find out more.
Beyond that, most of the usual suspects were there and many things were as before with incremental changes and updates. There didn't seem to be a central theme or message from all the vendors or industry in general. Everyone seemed to be concentrating on their own topics and products. One new addition to the exhibition was the University Pavilion. I think this could be put to good use to show people what's coming over the horizon or how these technologies that the vendors are pushing actually work.