11th September Event

Let’s join us for our next event in Zürich. 

Location

Cyber Defence Campus
Zollstrasse 62
8005 Zurich

Agenda

17:30 Registration / Welcome

17:50 ISC2 Chapter Switzerland introduction

18:00 Presentation from Bernard Tellenbach 

18:30 Presentation from Martin Strohmeier

19:00 Networking / Apero

Speakers: 

Bernhard Tellenbach | ARMASUISSE

Bio:
Bernhard Tellenbach is the head of the cyber security team of armasuisse Science and Technology’s Cyber-Defence Campus. He holds a Master (2005) and Doctor of Science (2012) degree from ETH Zurich in electrical engineering and information technologies. Before his current role, he lead the information security research group at Zurich University of Applied Sciences. Bernhard leads the Swiss Cyber Storm association, represents Switzerland in the steering committee of the European Cybersecurity Challenge coordinated by ENISA, heads the Cyber Security thematic platform of the Swiss Academy of Engineering Sciences (SATW), and is a member of the Cyber Security Advisory Board of SATW.

Abstract:
In this talk, we present a large family of DNS amplification vulnerabilities that we recently discovered and provide insights into its relevance.
Previous amplification vulnerabilities have been discovered mostly by ad-hoc analysis on a particular aspect of DNS dynamics. However, the sheer complexity of the DNS protocols suggest the existence of many more such vulnerabilities. This motivated us to perform a systematic investigation of application-layer amplification vulnerabilities based on a set of amplification primitives. This ultimately leads us to the discovery of compositional amplification (CAMP) vulnerabilities, where each derivative name of a primitive generates another primitive and so on.
Our measurement with popular DNS implementations and open resolvers indicate the ubiquity and severity of CAMP vulnerabilities and the serious threats they pose to the Internet’s crucial naming infrastructure.

Martin Strohmeier | ARMASUISSE

Bio:

Martin Strohmeier is a Senior Scientist at the Swiss Cyber Defence Campus, where he is primarily based at the ETH Zurich office, and also a Visiting Fellow of Kellogg College, University of Oxford. The main focus of his work has been the design, implementation, and analysis of security protocols for cyber-physical systems and networks, specifically those used in critical infrastructures found in the air, in space or on the ground. Using these domains as a driver for the real-world applicability of his research, his work has been published in many diverse venues, spanning wireless communications, cryptology, systems security, sensor networking, machine learning, privacy and aviation.

During his DPhil (2016) at Oxford with Prof. Ivan Martinovic, he has extensively analyzed the security and privacy of wireless aviation technologies of this generation and the next. This line of work has predominantly been focused on developing cyber-physical approaches which can improve the safety and security of air traffic control quickly and efficiently. After completing his DPhil, he has been extending his interests towards areas of open-source intelligence, privacy issues in aviation, security in electric vehicles and satellite environments, and adversarial machine learning.

Martin is also a co-founder and board member of the aviation research network OpenSky and responsible for coordinating research activities there. Before coming to Oxford in 2012, he received his MSc degree from TU Kaiserslautern, Germany and joined Lancaster University’s InfoLab21 and Lufthansa AG as a visiting researcher. His work on aviation security received several awards from the aviation and computer security communities, including the EPSRC Doctoral Prize Fellowship. His dissertation was further highly commended by the British Computer Society.

Abstract:

Aviation and aerospace, historically revered for their safety protocols, have reached unparalleled levels of safety in air travel. However, this remarkable track record does not necessarily equate to robust cybersecurity. In this talk, we explore the unique challenges that cybersecurity faces within the aviation and aerospace sectors, emphasizing the critical distinction between safety and security.

The discussion will delve into the complexities of fostering trust between IT security researchers and operational technology (OT) domains, highlighting how many cybersecurity lessons from the IT world had to be relearned and adapted by aerospace stakeholders. The talk will also examine the pitfalls of quick-fix cryptographic solutions, shedding light on the potential long-term security vulnerabilities they can introduce. A critical part of this discussion will focus on the security disclosure practices of aerospace and defense firms, which resemble those of IT companies in the 1990s. These outdated practices reveal significant gaps in the industry’s approach to transparency and collaboration, essential elements for modern cybersecurity.

Additionally, we will explore how the principles of physics have historically served as a deterrent to certain practical cyber-attacks in these domains. However, as technology advances, this once-reliable barrier is increasingly challenged, necessitating new approaches to ensure the security of aviation and aerospace systems. This talk discusses the evolving cybersecurity landscape in these critical sectors and to emphasize the importance of proactive, informed strategies to safeguard against emerging threats.

Pricing

Free for members

50 CHF for non-members incl. a membership.

Looking forward to meeting you there
Best regards
Your ISC2 Switzerland Board