Every day hundreds of new vulnerabilities and exploits are announced by vendors and hackers. Fortunately many of these attacks are similar in nature to what we have seen before so defense mechanisms exist to blunt the attack. Unfortunately there is a new generation of attacks based on Mobile Malicious Code that are so new and powerful that technology has not matured to the point where it can defend us against these attacks.

Mobile Malicious Code attacks are just a glimpse into the future of what we can expect from our malicious friends. The history of information security is filled with attack-measure-counterattack and the frustration of spending billions of dollars to protect yourself against incredibly intelligent 6th graders armed only with a computer. How and when are we every going to get ahead of the curve?

This course has some amazing demos of what Mobile Malicious Code attacks look like. Most people that attend the course walk away in amazement and despair because they now understand that by defending against specific attacks with technology alone we are losing the war, battle by battle. The only way to win this war is by building a comprehensive security infrastructure. 

This course then provides a security model that has the capability to defend against MMC attacks as well as addressing most security issues now and into the future.

Topics covered include:

· Status of information security - We spent a lot of money over the years, but are we any better off?

· Attacks/Countermeasures - Comparing information security to real world battles and understanding why we are losing most of those battles.

· Virus chronology and lessons learned - Looking at information security through the evolution of viruses and Mobile Malicious Code

· Demos: The Horrors of ActiveX - Several ActiveX attack demos, including Adobe 4.0 attack, Exploder, and Excel Save-As.

· Combating MMCs - Demonstrate how MMCs can only be fought with people, policy and procedures forming the nucleus of an information security infrastructure. Provide a model example of a security infrastructure that would win the battle against MMCs.