In late 2003 the rate of phishing fraud suddenly began to escalate leading to widespread media reports. Phishing fraud is impersonating a trusted party such as a bank in order to steal personal information such as credit card numbers of account details. This talk will describe real life phishing incidents experienced by one of the largest on-call response teams in the field and the actions being taken by the industry to prevent or discourage future attacks.

Dr Phillip Hallam-Baker has been active in the development of security protocols for the World Wide Web since 1992. He has since made substantial contributions to many Internet protocols including HTTP, X.509/PKIX, OCSP, XKMS, SAML and WS-Security. He is currently the editor of the XKMS specification, a co-editor of the WS-Security specification and a co-author of various related specifications. He is also the editor-emeritus of the SAML specification. His research interest in countering phishing fraud began as part of his work on stopping spam. In addition to his extensive work in the security area Dr Hallam-Baker has a long-standing research interest in online collaboration systems.

Dr Phillip Hallam-Baker holds a degree in Electronic Engineering from Southampton University and a doctorate from the Nuclear Physics Department at Oxford University. He has held research positions at DESY, CERN and MIT and is currently Principal Scientist at VeriSign Inc.

There is an emerging trend from ad hoc information security practices toward more a strategic, programmatic approach to information security. Generally speaking, this means a trend toward more structured, comprehensive and documented information security management plans. This change to programmatic approaches is primarily driven by new laws, regulations and standards. We'll begin with a description of the evolution of these laws, regulations and standards, and their impact on information security, highlighting their increasingly regimented, programmatic nature. The presentation will then culminate in a prediction of what we can expect in the next few years in terms of new requirements placed on information security, and what security professionals can do to prepare for (as opposed to react to) these requirements.

Brad Bolin is a senior security consultant who brings an uncommon blend of experience and training to Shavlik’s information security consulting practice. As a licensed attorney, he is uniquely positioned to advise corporations on strategic risk management issues, such as the implications of contemporary data security laws and regulations. As a Certified Information Systems Security Professional (CISSP) with over 6 years of experience in network and security administration, including risk assessment and mitigation at a number of Minnesota’s largest companies, Brad possesses a wide variety of technical skills upon which to draw when confronting the issues faced by Shavlik’s clients.

Why are attackers and worms so successful? Because the process we use to defend systems is too slow to protect against an opponent that uses a superior, faster process. Come watch me argue the case for this hypothesis and how the defense process might be changed in response.

A scenario is presented where a new vulnerability is disclosed at the same time a patch is made available and attackers and defenders are waiting to make use of the patch for their opposing purposes. The process both sides go through will be deconstructed using Boyd’s OODA loop model, and from the analysis we will see the attacker can win too often. Great.

Re-thinking the defense process, we will step back to see what we can generalize about vulnerabilities and the systemic conditions that make exploitation easier. We will also enumerate some general conditions that imply an exploit succeeded. From there I will take the stance that the defense process must be something that can be automated and discuss potential attributes of an automated response process. To put some meat on them bones there will be a demonstration of an implementation of an automated response system consistent with the one described. The demonstrated system will be made available, so you can tinker with it. We all love to tinker.

The presentation will try to stay out of the weeds and clouds, but still present some low-level technology and philosophical ideas. Attendees should gain some insight into the current state of attacker tools and methodologies and the possible future of computer defense. If nothing else attendees will be left with some Linux kernel modules and Python code that does some cool, geeky security juju. Come on, what more could you ask for?

Dominique Brezinski dabbles in things, from intrusion detection and response system developer to former AVP of Technology at In-Q-Tel. He has been employed by Amazon.com, Decru, In-Q-Tel, Secure Computing, Internet Security Systems, Cybersafe, and Microsoft in various security engineering, consulting, testing, research, and management roles over the past decade. Dominique currently serves on the technical advisory board of Sana Security. When not in front of the keyboard writing kernel modules or hacking with Python, he spends time climbing rock, since it is the only thing that makes the code go away.

Rootkits are the backbone of software penetrations. They provide stealth and consistent access to a computer system. Rootkits employ technology for covert ex-filtration of data, IDS evasion, and anti-forensics. Rootkit technology is now incorporated into the most deadly of threats, network worms. Serious security professionals must understand rootkit technology in detail. Commercial anti-virus technology is woefully inadequate at dealing with the threat. There is no magic security tool that will protect your system. Rootkits now employ specific methods to evade many security utilities, including host-based intrusion prevention systems (HIPS).

This talk focuses on specific rootkit threats and more importantly, how intrusion-prevention software can be designed to detect these threats. Illustrated threats include direct kernel object manipulation (DKOM), hooking, and runtime code patching. We will release a new version of our freeware tool, called 'VICE', that can detect many of these rootkit threats.

Jamie Butler is the Director of Engineering at HBGary specializing in rootkits and other subversive technologies. He is the co-author and a teacher of "Aspects of Offensive Root-kit Technologies." Prior to accepting the position at HBGary, he was a senior developer on the Windows Host Sensor at Enterasys Networks, Inc. He holds a MS in Computer Science from the University of Maryland, Baltimore County. Over the past few years his focus has been on Windows servers concentrating in host based intrusion detection and prevention; buffer overflows; and reverse engineering. Jamie is also a contributor at rootkit.com.

Greg Hoglund has spent the last few years working on automated reverse engineering problems. He has released several open source tools and presented on the subject matter at many security conferences. He founded HBGary, Inc. last year, his second commercial startup in the software security testing space. Hoglund recently authored the very successful book "Exploiting Software" (Addison Wesley). He offers the training program "Aspects of Offensive Rootkit Technology" several times a year. His side-projects include running the rootkit.com website.

How knows that Google is a powerful attack tool for pen-testers but also for other kind of black hats ? Few people are aware of how much critical information Google can display with some carefully crafted searches: IP addresses, network architectures, machine roles, sometimes passwords.

In this talk, we will consider ourselves as pen-testers. We won’t talk about classical spying and information warfare. The personal pen-tester experience of the speaker will be presented and some real-life cases will be described.

Patrick Chambet is a Senior Consultant within Edelweb SA (ON-X Group), a leader French company in the IT Security domain. With 8 years of experience in this domain, he is an expert in the security of Windows NT/2000/XP/2003 architecture, and in security audits and pen tests.

He managed a lot of missions in highly secured environments, including in classified environments, and leaded numerous audits and pen tests for big companies in several sectors.

He regularly talks in international briefings (INFOSEC, EUROSEC, SPIRAL, SSTIC, BlackHat Europe, JIP, ...). He teaches IT Security in some universities, and very often writes articles in professional newspapers. He collaborated to the creation of a newspaper about IT Security in France, called "MISC", read in Europe and Canada.

He is also an active member of the rstack team.

More information on his personal website.

Everyone is aware of MSIE vulnerabilities (real or potential), but a great number of administrators have to cope with MSIE in their corporate network. Few of them know and use some advanced security configuration options like Internet Zones and Policies.

This talk will explain how to create your own Internet Zones, how to configure them to respect your security policy and how to allow some ActiveX only but not all of them.

Some demonstrations will show that you can rather secure the browsing habits of your users even if they use MSIE on your corporate network.

Patrick Chambet is a Senior Consultant within Edelweb SA (ON-X Group), a leader French company in the IT Security domain. With 8 years of experience in this domain, he is an expert in the security of Windows NT/2000/XP/2003 architecture, and in security audits and pen tests.

He managed a lot of missions in highly secured environments, including in classified environments, and leaded numerous audits and pen tests for big companies in several sectors.

He regularly talks in international briefings (INFOSEC, EUROSEC, SPIRAL, SSTIC, BlackHat Europe, JIP). He teaches IT Security in some universities, and very often writes articles in professional newspapers. He collaborated to the creation of a newspaper about IT Security in France, called "MISC", read in Europe and Canada.

He is also an active member of the rstack team.

More information on his personal website.

One of the most dangerous cybersecurity threats is "control hijacking'' attacks, which hijack the control of a victim application, and execute arbitrary system calls assuming the identity of the victim program's effective user.

These types of attacks are viperous because they do not require any special set-up and because production-mode programs with such vulnerabilities appear to be wide spread. System call monitoring has been touted as an effective defense against control hijacking attacks because it could prevent remote attackers from inflicting damage upon a victim system even if they can successfully compromise certain applications running on the system. However, the Achilles' heel of the system call monitoring approach is the construction of accurate system call behavior model that minimizes false positives and negatives. This presentation describes the design, implementation, and evaluation of a Program semantics-Aware Intrusion Detection system called PAID, which automatically derives an application-specific system call behavior model from the application's source code, and checks the application's run-time system call pattern against this model to thwart any control hijacking attacks.

The per-application behavior model is in the form of the sites and ordering of system calls made in the application, as well as its partial control flow. Experiments on a fully working PAID prototype show that PAID can indeed stop attacks that exploit non-standard security holes, such as format string attacks that modify function pointers, and that the run-time latency and throughput penalty of PAID are under 11.66% and 10.44%, respectively, for a set of production-mode network server applications including Apache, Sendmail, Ftp daemon, etc.

Dr. Tzi-cker Chiueh is currently an Associate Professor in Computer Science Department of Stony Brook University, and the Chief Scientist of Rether Networks Inc. He received his B.S. in Electrical Engineering from National Taiwan University, M.S. in Computer Science from Stanford University, and Ph.D. in Computer Science from University of California at Berkeley in 1984, 1988, and 1992, respectively. He received an NSF CAREER award in 1995. Dr. Chiueh's research interest is on computer security, network/storage QoS, and wireless networking. Dr. Chiueh's group developed the world's fastest array bound checking compiler that incurs less than 10% run-time overhead than programs without checking under Gcc, and built the world's fastest disk-based logging system, which accomplishes a single-sector disk write operation within 450 micro-seconds.

Home-grown applications and services are increasingly being implemented in order to suit corporate and invidual needs. These custom applications and services are also succepitble to vulnerabilities which must be scanned for quickly and effectively. In addition, closed source scanning tool vendors often do not release checks for vulnerabilities until its too late, and these costly scanning tools do not offer vulnerability checks against custom-made applications and services that may be widely deployed by a corporation. In order to cope with this, individuals and companies are forced to develop their own scanning tools in order to quickly scan for and identify vulnerabilities. This talk will offer solutions against developing scanning tools from scratch. There is no need to re-invent the wheel when open source tools such as Nessus, Hydra, and Nmap are flexible enough to allow for their functionality to be extended by offering appropriate API and plugin functionality. This talk will teach the audience how to develop custom plugins for these popular tools in order to accomplish custom vulnerability scanning and enumeration needs.

Nitesh Dhanjani is a senior consultant for Ernst & Young's Advanced Security Center. He has performed network, application, web-application, wireless, source-code, host security reviews and security architecture design services for clients in the Fortune 500.

Nitesh is the author of "HackNotes: Unix and Linux Security" (Osborne McGraw-Hill). He is also a contributing author for the best-selling security book "Hacking Exposed 4" and "HackNotes: Network Security".

Prior to joining Ernst & Young, Nitesh worked as consultant for Foundstone Inc. where he performed attack and penetration reviews for many significant companies in the IT arena. While at Foundstone, Nitesh both contributed to and taught parts of Foundstone s "Utimate Hacking: Expert" and "Ultimate Hacking" security courses.

Nitesh has been involved in various educational and open-source projects and continues to be active in the area of system and Linux kernel development. He has published technical articles for various publications such as the O'Reilly Network.

Nitesh graduated from Purdue University with both a Bachelors and Masters degree in Computer Science. While at Purdue, he was involved in numerous research projects with the CERIAS (Center for Education and Research Information Assurance and Security) team. During his research at Purdue, Nitesh was responsible for creating content for and teaching C and C++ programming courses to be delivered remotely as part of a project sponsored by IBM, AT&T, and Intel.

Justin Clarke is a Manager in Ernst & Young's Rudolph W. Giuliani Advanced Security Center in New York. He has over 6 years of security experience in network, web application, source code and wireless testing work for some of the largest organizations in the United States. Prior to joining E&Y in the US, Justin did corporate and government security work in New Zealand.

Justin is active in developing security tools for penetrating web applications, servers, and wireless networks and as a compulsive tinkerer he can't leave anything alone without at least trying to see how it works.  Justin got his Bachelor's degree in Computer Science from Canterbury University in New Zealand."

Tor (second-generation Onion Routing) is a distributed overlay network that anonymizes TCP-based applications like web browsing, secure shell, and instant messaging. We have a deployed network of 30 nodes in the US and Europe, and the code is released unencumbered as free software. Tor's rendezvous point design enables location-hidden services—users can run a standard webserver or other service without revealing its IP.

I'll give an overview of the Tor architecture, and talk about why you'd want to use it, what security it provides, and how user applications interface to it. I'll show a working Tor network, and invite the audience to connect to it and use it.

Roger Dingledine is a security and privacy researcher. While at MIT he developed Free Haven, one of the early peer-to-peer systems that emphasized resource management while retaining anonymity for its users. Currently he consults for the US Navy to design and develop systems for anonymity and traffic analysis resistance. Recent work includes anonymous publishing and communication systems, traffic analysis resistance, censorship resistance, attack resistance for decentralized networks, and reputation.

The presentation will discuss the security problems with enterprise storage architectures using Network Attached Storage (NAS) devices, such as filers, NAS heads, and NAS gateways. The key objective of the presentation is to show the exposure of sensitive data and confidential information sitting on NAS devices.  The presentation will demonstrate how storage devices, such as EMC and NetApp filers, are not any more secure than the weak protocols that they supports, such as NFS, CIFS, FTP, and even HTTP.   

The session will show common weakness with NAS devices supporting NFS and CIFS. Additionally, a demonstration of the attacks that can be executed on NAS filers supporting NFS or CIFS will be shown. Furthermore, the presentation will discuss how data stored in a default NAS installation is just as insecure as any default operating system, making NAS security equally as important as other entities in local area networks.

Himanshu Dwivedi is a Director of Security Architecture at @stake, Inc. At @stake, Himanshu leads the Storage Center of Excellence (CoE), which focuses research and training around storage technology, including Network Attached Storage (NAS) and Storage Area Networks (SAN). Himanshu is considered an industry expert in the area of SAN security, specifically Fibre Channel Security.  Himanshu has given numerous presentations and workshops regarding the security in SANs, including the SNIA Security Summit, BlackHat Security Conference, Storage Neworking World, TechTarget, the Fibre Channel Conference, SAN-West, SAN-East, etc. 

Himanshu currently has a patent pending on a storage design architecture that he co-developed with other @stake professionals (U.S. Patent Serial No. 10/198,728). Additionally, Himanshu has written two published books and has written a storage security chapter on a third. The book titles include The Complete Storage Reference – Chapter 25 (McGraw-Hill/Osborne), Storage Security Handbook (Neoscale Publishing), and Implementing SSH: Strategies for Optimizing the Secure Shell (Wiley Publishing). Furthermore, Himanshu has also published two white papers. The first white paper Himanshu wrote is titled “Storage Security” (http://www.atstake.com/research/reports/index.html) and “Securing Intellectual Property” (http://www.vsi.org/cgiscripts/ippwp3request.htm).

Virtually every virus and worm that circulates the Internet today is "protected" by some form of obfuscation that hides the code's true intent. In the Window's world where worms prevail, the use of tools such as UPX, ASPack, and teLock has become standard. Protection of malicious code is not the only goal of binary obfuscators however which can be used to protect intellectual property. In the Linux world, tools such as Burneye and Shiva exist which can be used in ways similar to any Window's obfuscation tool.

To fight such methods, analysts have created specific tools or techniques for unraveling these code obfuscators in order to reveal the software within. To date, in the fight against malware, anti-virus vendors have had the luxury of focusing on signature development since obfuscation of malware has presented little challenge. To combat this, malware authors are rapidly morphing their code in order to evade quickly developed and deployed signature-matching routines. What will happen when malware authors begin to morph their obfuscation techniques as rapidly as they morph their worms?

While not designed specifically as a malware protection tool, one program, Shiva, aims to do exactly that. Shiva forces analysis of malicious code to be delayed while analysts fight through each novel mutation of Shiva's obfuscation mechanism. This, in effect, provides the malware a longer period of time to wreak havoc before countermeasures can be developed.

This talk will focus on the use of emulated execution within IDA Pro to provide a generic means for rapidly deobfuscating protected code. Capabilities of the emulation engine will be discussed and the removal of several types of obfuscation will be demonstrated. Finally, the development of standalone deobfuscation tools based on the emulation engine will be discussed.

Chris Eagle is the Associate Chairman of the Computer Science Department at the Naval Postgraduate School (NPS) in Monterey, CA. A computer engineer/scientist for 18 years, his research interests include computer network operations, computer forensics and reverse/anti-reverse engineering.

Information Hiding techniques are much researched in the context of watermarking or fingerprinting images and sound files, mainly as a means of copyright protection and piracy prevention/detection. Those mediums offer a significant amount of redundancy, thus lending themselves to the implementation of robust IH systems. Executables however do not offer such amounts of redundancy, and have thus far proven to be a difficult and rarely used medium for steganographic and other IH purposes. The aim of this talk is to be an introduction to IH, with a thorough coverage of state of the art techniques for embedding into binaries. Hydan, a tool for performing such embeddings in machine code, will be presented. In addition to typical IH uses [steganography, watermarking], the tool and techniques shown can be used in anti-reverse engineering, trusted application execution, frustrate some buffer overflow attacks, and as an engine for metamorphic viruses. An interesting effect of the tool is that the executable remains the same size before and after embedding, while of course remaining functionally equivalent.

Rakan El-Khalil is currently on sabbatical in France. He is a recent MS CS graduate from Columbia University. While he was there he worked on a variety of projects at the CS Research Lab, such as an IDS that uses machine-learned models to detect network threats, and a syscall based permission system on OpenBSD [predating systrace]. He was also responsible for the short-lived official KaZaA Linux client `kza'. Currently he is involved with The Bastard, a powerful linux disassembler, and has been researching steganography and information hiding in machine code.

New vulnerabilities to internal networks are discovered and published on a daily base. With each such announcement, the same questions arise. How significant is this vulnerability? How prevalent is this vulnerability? How easy is this vulnerability to exploit? Are any of my systems affected by this vulnerability? Due to lack of global vulnerability data, answers to these questions are often hard to find and risk rating is even more difficult.

As part of ongoing research, Gerhard Eschelbeck of Qualys, Inc. has been gathering statistical vulnerability information for more than two years. Those vulnerabilities have been identified in the real world across hundreds of thousands of systems and networks. Users of the QualysGuard network security audit and vulnerability management web service and any of its related free evaluation services are automatically generating the raw data. This data is not identifiable to individual users or systems. However, it provides significant statistical data for research and analysis, which enabled Gerhard to define the Laws of Vulnerabilities for Internal Networks.

The Laws of Vulnerabilities for Internal Networks is derived from vulnerability data gathered during the past 30 months from over five million scans of individual systems. During this timeframe a collective amount of more than three million vulnerabilities—reflecting five different levels of severity—has been identified. Furthermore, the responses to external events (i.e. availability of an exploit or worm taking advantage of a vulnerability) have been studied for the declaration of this new law.

The presentation will also update the Laws of Vulnerabilities for Network Perimeters, originally presented at Black Hat in 2003.

Gerhard Eschelbeck is chief technology officer and vice president of engineering for Qualys, Inc. The QualysGuard network security audit and vulnerability management web service he created secures more than 150 Fortune 1000 companies. Among the company’s 1,400 customers are Hershey Foods, Hewlett Packard, and The Thomson Corporation. Gerhard is a respected teacher, speaker, researcher and writer. His published topics include Active Security, Automating Security Management, and Multi-Tier IDS. He holds several patents on inventions for security integration and security management. Gerhard is also founder of IDS GmbH, a secure remote tool company aquired by McAfee. Gerhard teaches on the field of network security at his alma mater, the University of Linz, Austria where he earned Masters and Ph.D. degrees in computer science. Gerhard speaks regularly at events such as RSA, InfoSec, SANS, and CSI. He can be reached at ge@qualys.com. This is Gerhard’s second speech at Black Hat.

There are several well known techniques to find a vulnerability in a closed source product running on the Windows family of operating systems. Researchers tend to prefer one over the other for many different reasons. But a person entering the field and facing the problem of choosing the techniques appropriate for one particular task is often not aware of the pros and cons of each technique.

This talk will compare the most widely used techniques, where their strong and weak points are and how to combine them to perform vulnerability analysis on closed source applications. The techniques covered are:

• Strictly manual testing
  This method requires little to no extra tools and proves to still be one of the most effective when it comes to security vulnerabilities in custom applications, especially with proprietary protocols and interfaces.
• Fuzzing
  In the last years, fuzzing became very popular as a vulnerability finding method. It can be done with home-grown scripting as well as with more or less professional tools. Both approaches and the tools available will be discussed.
• Static Binary Analysis
  Static binary analysis is perhaps the most well-established method for analyzing binaries of all types, not only for security vulnerabilities. The results are often hard to find but high impact vulnerabilities in critical services. Required tools and prerequisite knowledge as well as ways to estimate the time required will be discussed.
• Binary Diff
  This fairly recent method will be covered shortly, showing the effectiveness of static binary analysis combined with advanced techniques with a focus on the real world application of vulnerability analysis.
• Runtime Analysis
  This method with it’s roots in ancient computer ages is lately less often used for vulnerability analysis but can prove very effective. Especially in situations were the other methods show unexpected weaknesses, runtime analysis can reduce the time required drastically.

FX is the leader of the German Phenoelit group. His and the group's primary interests are in security implementations and implications of standards or less-known protocols. FX works as a Security Solution Consultant at n.runs GmbH.

This briefing addresses the world's first global Internet war: the cyber skirmishes associated with the Palestinian intifadah. What started out as a localized conflict spread to battles around the globe as forces sympathetic to either the Israelis or the Palestinians joined the fray. With the Middle East cyber war as a backdrop, this presentation will cover the ways in which people can try to affect the course of world history through coordinated action in cyberspace.

The authors first describe the globalized and asymmetric nature of modern warfare, the asymmetry of computer hacking, and the psychology of subcultures. They outline the legal issues surrounding cyber warfare, from the perspective of a lone hacker to a massive government intelligence service, and discuss the problems inherent in cyber retaliation and in the prosecution of hackers.

On the technical side, this briefing discusses the targeting of Internet sites for attack, and the strategies used by hackers to bring them down or merely leverage them in more subtle ways to support their cause. The primary focus is the means used by cyber commanders to accomplish political and/or social goals, in particular the creation of Web portals through which their foot soldiers are able to unite and rain network packets down upon their enemies.

Finally, this briefing examines the difference between the perception and the reality of cyber attacks. We address the strategies that national governments are employing to combat the threat, the potential impact of cyber attacks on military operations, and the vexing problem of Denial of Service attacks, Web defacements, and free speech. The authors assess the threat and the limits of the more powerful weapons in the cyber arsenal, and consider who might be the biggest target of cyber attacks in the coming years.

Peter D. Feaver (Ph.D., Harvard, 1990) is the Alexander F. Hehmeyer Professor of Political Science and Public Policy at Duke University and Director of the Triangle Institute for Security Studies (TISS). Feaver is co-directing (with Bruce Jentleson) a major research project funded by the Carnegie Corporation, "Wielding American Power: Managing Interventions after September 11." Feaver is author most recently of "Armed Servants: Agency, Oversight, and Civil-Military Relations" (Harvard Press, 2003),and co-author, with Christopher Gelpi, of "Choosing Your Battles: American Civil-Military Relations and the Use of Force" ( Princeton University Press, 2004). He is co-editor, with Richard H. Kohn, of "Soldiers and Civilians: The Civil-Military Gap and American National Security" (MIT Press, 2001); and author of "Guarding the Guardians: Civilian Control of Nuclear Weapons in the United States" (Cornell University Press, 1992). He has published several other monographs and over thirty articles and book chapters on American foreign policy, nuclear proliferation, civil-military relations, information warfare, and U.S. national security. He won the Duke Alumni Distinguished Undergraduate Teaching Award in 2001 and the Trinity College Distinguished Teaching Award in 1994-95. In 1993-94, Feaver served as Director for Defense Policy and Arms Control on the National Security Council at the White House where his responsibilities included counterproliferation policy, regional nuclear arms control, the national security strategy review, and other defense policy issues. He is a Lieutenant Commander in the U.S. Naval Reserve (IRR). He is married to Karen Feaver, and they have three children, two sons and a daughter.

Kenneth Geers (M.A., University of Washington, 1997) is a Computer Investigations & Operations analyst with the Naval Criminal Investigative Service (NCIS). His career at the Department of Defense also includes work at the National Security Agency, the Defense Intelligence Agency, an SAIC nuclear arms control support team, the John F. Kennedy Assassination Review Board, and the U.S. embassy in Brussels, Belgium. He is an expert in French and Russian, who finished first in a class of seventy at the Defense Language Institute at the Presidio of Monterey. Mr. Geers is the author of training and testing software to prepare U.S. Army Major Commands for Russian strategic arms inspections, and he has designed multiple U.S. Army Space and Missile Defense Command websites devoted to arms control. These days, he spends his time analyzing computer and network logs of all types. In his free time, he plays chess and serves as a SANS mentor in the Washington D.C. area. Over the years, he has taken the opportunity to see the world, stopping long enough to wait tables in Luxembourg, harvest grapes in the Middle East, climb Mount Kilimanjaro, and set his alarm clock for 3 AM in a strict Trappist monastery. He loves his wife Jeanne, and daughters Isabelle and Sophie.