Friends, Not Foes: Rethinking the Vendor- Reseacher Relationship. Presented By: Rick Ramgattie KEYNOTE
|
|
|
- Lee Malone
- 5 years ago
- Views:
Transcription
1 Friends, Not Foes: Rethinking the Vendor- Reseacher Relationship Presented By: Rick Ramgattie KEYNOTE
2 ./whoami Rick Ramgattie Building / Hacking Web Apps Reverse Engineering Mobile Applications IoT Security Reading Security Independent Security Evaluators
3 Independent Security Evaluators Where: Baltimore, MD and San Diego, CA What: Security Assessments Web Mobile Infrastructure Native Applications How: Whitebox, Blackbox, and everything in between
4 Outline The IoT Village. CTF Intro. Disclosure Models. Full vs. Responsible Disclosure. What can we do to make things better? Questions?
5 IoT Village Origin Story
6 Research: IoT Village Origin Story
7 IoT Village Origin Story Research: Small Office Home Office (SOHO) Routers
8 IoT Village Origin Story Research: Small Office Home Office (SOHO) Routers Network Attached Storage (NAS) Devices
9 IoT Village Origin Story
10 IoT Village Origin Story First SOHOpelessly Broken: 2014 DefCon 22 (
11 IoT Village Origin Story First SOHOpelessly Broken: 2014 DefCon CVEs (
12 IoT Village Origin Story
13 IoT Village Origin Story First IoT Village: 2015 DefCon 23 Expanded SOHOpelessly Broken
14 IoT Village Origin Story SoHo DefCon 22 IoT Village DefCon (23 25) 30+ Devices CTF 60+ Devices ZeroDay Track 38 talks 113 vulnerability disclosures
15 IoT Village DefCon DerbyCon 5 6 ( ) RSA 2017 BSides DC BSides Charm CypherCon 2017 ToorCon HackerLabs Puerto Rico 2017
16 IoT Village Today 1. The Stage 2. The Zero Day Track 3. The CTF
17 CTF TIPS! [1] Logo from a PSA Broadcast on the NBC
18 CTF Tips 1. Map the network: Where are the devices? What are the devices? What is NMAP?
19 CTF Tips 2. Search all the surfaces: Web App Services (Ports)
20 CTF Tips 3. Think outside the box: Be creative Search for canned exploits. (The Documentation is out there.) Linux Kung-Fu.
21 CTF Tips 4. Try not to project. Try another device. Research Share
22 Helpful Links: Practical Reverse Engineering Pt. 4 ( Cameras, Thermostats, and Home Automation Controllers ( Hacking the D-Link DSP-W215 Smart Plug ( Multiple Vulnerabilities in ASUS Routers ( Samsung SmartCam (
23 You got this!
24 But why????
25 IoT Devices
26 IoT Devices
27 IoT Devices
28 IoT Devices
29 IoT Adoption Rate Our bottom-up analysis for the applications we size estimates that the IoT has a total potential economic impact of $3.9 trillion to $11.1 trillion a year by [1]
30 IoT Adoption Rate [B]y the end of 2017, over 20 per cent of organizations will have digital security services devoted to protecting business initiatives using devices and services in IoT. [1]
31 Vulnerability Disclosure????
32 A. Disclose Disclose or nah?
33 Disclose or nah? A. Disclose B. Not Disclose
34 Disclose or nah? A. Disclose B. Not Disclose
35 Full Disclosure vs. Responsible Disclosure Responsible Full
36 Full Disclosure vs. Responsible Disclosure Responsible Coordinated Full
37 Full Disclosure vs. Coordinated Disclosure [Full Disclosure] provides all vulnerability details to everyone at the same time, a move designed to make vendors provide updates faster. 1 [1] (Mircrosoft Security Research Center)
38 Full Disclosure vs. Coordinated Disclosure one general definition of [Coordinated Disclosure] as most vendors define it is that the issue is reported privately to the vendor *and no one else* until the vendor issues a patch. 1 [1] coordinated-vulnerability-disclosure-bringing-balance-to-the-force/ (Mircrosoft Security Research Center)
39 Full Disclosure vs. Coordinated Disclosure Full Disclosure Discloses all details of the vulnerability to Everyone. Goal is to improve security by bringing attention to the vulnerability and making everyone aware of the flaw. Disclosed at the researchers discretion. Coordinated Discloses all details of the vulnerability to the Vendor. Goal is to help the vendor improve the products security by informing them of the vulnerability and giving time to fix the issue before it is publicly disclosed. Disclosed after the agreed disclosure date.
40 Full Disclosure vs. Coordinated Disclosure Full Disclosure Discloses all details of the vulnerability to Everyone. Goal is to improve security by bringing attention to the vulnerability and making everyone aware of the flaw. Disclosed at the researchers discretion. Coordinated Discloses all details of the vulnerability to the Vendor. Goal is to help the vendor improve the products security by informing them of the vulnerability and giving time to fix the issue before it is publicly disclosed. Disclosed after the agreed disclosure date.
41 Full Disclosure vs. Coordinated Disclosure Full Disclosure Discloses all details of the vulnerability to Everyone. Goal is to improve security by bringing attention to the vulnerability and making everyone aware of the flaw. Publicly Disclosed at the researchers discretion. Coordinated Discloses all details of the vulnerability to the Vendor. Goal is to help the vendor improve the products security by informing them of the vulnerability and giving time to fix the issue before it is publicly disclosed. Publicly Disclosed after the agreed disclosure date.
42 Well, what can go wrong????
43 Full Disclosure Example: The Witty Worm Attack On Friday March 19, 2004 it began to spread.
44 Full Disclosure Example: The Witty Worm Attack On Friday March 19, 2004 it began to spread. It targeted a buffer overflow vulnerability in Internet Security Systems (ISS) products.
45 Full Disclosure Example: The Witty Worm Attack On Friday March 19, 2004 it began to spread. It targeted a buffer overflow vulnerability in Internet Security Systems (ISS) products. ISS RealSecure Network RealSecure Server Sensor RealSecure Desktop Within a half-hour it infected 12,000 computers
46 Full Disclosure Example: The Witty Worm Attack On Friday March 19, 2004 it began to spread. It targeted a buffer overflow vulnerability in Internet Security Systems (ISS) products. ISS RealSecure Network RealSecure Server Sensor RealSecure Desktop Within a half-hour it infected 12,000 computers The worm took advantage of a flaw that was disclosed by a security company that believed in full disclosure.
47 Coordinated Disclosure Example: Brute Logic vs. Group On BruteLogic reported 32 instances of XSS in GroupOn. Responsible disclosure policy. He tweeted about the vulnerability after reporting it. He said that he found instances of the vulnerability. Did not get the Bug Bounty payout.
48 Coordinated Disclosure Example: Brute Logic vs. Group On BruteLogic reported 32 instances of XSS in GroupOn. Responsible disclosure policy. He tweeted about the vulnerability after reporting it. He said that he found instances of the vulnerability. Did not get the Bug Bounty payout.
49 Coordinated Disclosure Example: Brute Logic vs. Group On BruteLogic reported 32 instances of XSS in GroupOn. Responsible disclosure policy. He tweeted about the vulnerability after reporting it. He said that he found instances of the vulnerability. Did not get the Bug Bounty payout.
50 Coordinated Disclosure Example: Brute Logic vs. Group On BruteLogic reported 32 instances of XSS in GroupOn. Responsible disclosure policy. He tweeted about the vulnerability after reporting it. He said that he found instances of the vulnerability. Did not get the Bug Bounty payout.
51 Need help?
52 What we do to make things better????
53 What we do to make things better? A. What can vendors do to make things better?
54 What we do to make things better? A. What can vendors do to make things better? B. What can researchers do to make things better?
55 What can vendors do to make things better? Problems: Availability. Combativeness. Naivety. (Unfamiliar with security) The Solution: Bug bounty program. Security related issues contact. Finding vulnerabilities is good not bad. Train your team. (Expose them to security mindset.) Become part of the security community.
56 What can vendors do to make things better? Problems: Availability. Combativeness. Naivety. (Unfamiliar with security) The Solution: Bug bounty program. Security related issues contact. Finding vulnerabilities is good not bad. Train your team. (Expose them to security mindset.) Become part of the security community.
57 What can vendors do to make things better? Problems: Availability. Combativeness. Naivety. (Unfamiliar with security) Solutions: Bug bounty program. Contact for security related issues. Finding vulnerabilities is good not bad. Train your team. (Expose them to security mindset.) Become part of the security community.
58 What can researchers do to make things better? The Problem: Arrogance. Not understanding the complexity of a problem. Fear mongering?* (Sometimes issues aren t as impacting as people think they are.) The Solution: Bug Bounty Program, contact for reporting security vulnerabilities. (Adopt a security focused mindset.) Finding vulnerabilities is not a bad thing, it is good thing. Then issues are fixed. (good guys finding issues is always a good thing.) Train your team. (Expose them to security mindset.) Become part of the security community.
59 What can researchers do to make things better? Problems: Arrogance. Not understanding the complexity of a problem. Stop fear mongering?* Solutions: Play by the rules. Work with companies to understand the complexity of an issue. Understand that some issues have different impact.
60 What can researchers do to make things better? Problems: Arrogance. Not understanding the complexity of a problem. Stop fear mongering?* Solutions: Play by the rules. Work with companies to understand the complexity of an issue. Understand that some issues have different impact.
61 Let s wrap up!
62 Fin Questions??
IRL: Live Hacking Demos!
SESSION ID: SBX2-R3 IRL: Live Hacking Demos! Omer Farooq Senior Software Engineer Independent Security Evaluators Rick Ramgattie Security Analyst Independent Security Evaluators What is the Internet of
The Way of the Bounty. by David Sopas
The Way of the Bounty by David Sopas (@dsopas) ./whoami Security Consultant for Checkmarx Security Team Leader for Char49 Disclosed more than 50 security advisories Founder of WebSegura.net Love to hack
Synology Security Whitepaper
Synology Security Whitepaper 1 Table of Contents Introduction 3 Security Policy 4 DiskStation Manager Life Cycle Severity Ratings Standards Security Program 10 Product Security Incident Response Team Bounty
The Internet of Things. Steven M. Bellovin November 24,
The Internet of Things Steven M. Bellovin November 24, 2014 1 What is the Internet of Things? Non-computing devices...... with CPUs... and connectivity (Without connectivity, it s a simple embedded system)
Mobile Malfeasance. Exploring Dangerous Mobile Code. Jason Haddix, Director of Penetration Testing
Mobile Malfeasance Exploring Dangerous Mobile Code Jason Haddix, Director of Penetration Testing Copyright 2012 Hewlett-Packard Development Company, L.P. The information contained herein is subject to
Internet infrastructure
Internet infrastructure Prof. dr. ir. André Mariën (c) A. Mariën 04/03/2014 1 Topic Vulnerability and patch management (c) A. Mariën 04/03/2014 2 Requirements Security principle: Everything can and will
OPEN SOURCE SECURITY ANALYSIS The State of Open Source Security in Commercial Applications
OPEN SOURCE SECURITY ANALYSIS The State of Open Source Security in Commercial Applications By Mike Pittenger, Vice President, Security Strategy Black Duck s On-Demand business conducts audits of customers
Embedded Management Interfaces
Stanford Computer Security Lab Embedded Management Interfaces Emerging Massive Insecurity Stanford Computer Security Lab What this talk is about? What this talk is about? Massively deployed devices What
01/02/2014 SECURITY ASSESSMENT METHODOLOGIES SENSEPOST 2014 ALL RIGHTS RESERVED
01/02/2014 SECURITY ASSESSMENT METHODOLOGIES SENSEPOST 2014 ALL RIGHTS RESERVED Contents 1. Introduction 3 2. Security Testing Methodologies 3 2.1 Internet Footprint Assessment 4 2.2 Infrastructure Assessments
Malware and Vulnerability Check Point. 1. Find Problems 2. Tell Vendors 3. Share with Community
Malware and Vulnerability Research @ Check Point 1. Find Problems 2. Tell Vendors 3. Share with Community TR-069 quick tour / DEF CON recap Motivation The TR-069 Census 2014 Research Highlights Mass Pwnage
Improving Your Network Defense. Joel M Snyder Senior Partner Opus One
Improving Your Network Defense Joel M Snyder Senior Partner Opus One jms@opus1.com Agenda: Improving Your Network Defense What s the Thesis? Intrusion Detection Collecting Information Enabling Features
CSE 127 Computer Security
CSE 127 Computer Security Alex Gantman, Spring 2018, Lecture 19 SDLC: Secure Development Lifecycle Defining Security Security is not a functionality feature Most of computer science is about providing
The tale of one thousand and one ADSL modems
The tale of one thousand and one ADSL modems Fabio Assolini, Malware Researcher, twitter.com/assolini Virus Bulletin 2012 Dallas, USA PAGE 2 If we can t attack a computer or a server, we ll attack a router
SECURITY TESTING. Towards a safer web world
SECURITY TESTING Towards a safer web world AGENDA 1. 3 W S OF SECURITY TESTING 2. SECURITY TESTING CONCEPTS 3. SECURITY TESTING TYPES 4. TOP 10 SECURITY RISKS ate: 2013-14 Few Security Breaches September
Security and Authentication
Security and Authentication Authentication and Security A major problem with computer communication Trust Who is sending you those bits What they allow to do in your system 2 Authentication In distributed
Internet of Things (IoT) Attacks. The Internet of Things (IoT) is based off a larger concept; the Internet of Things came
Victoria Ellsworth Dr. Ping Li ICTN 4040 04/11/17 Internet of Things (IoT) Attacks The Internet of Things (IoT) is based off a larger concept; the Internet of Things came from idea of the Internet of Everything.
EURECOM 6/2/2012 SYSTEM SECURITY Σ
EURECOM 6/2/2012 Name SYSTEM SECURITY 5 5 5 5 5 5 5 5 10 50 1 2 3 4 5 6 7 8 9 Σ Course material is not allowed during the exam. Try to keep your answers precise and short. You will not get extra points
RouterCheck Installation and Usage
RouterCheck Installation and Usage February 16, 2015 No part of this document may be reproduced, copied, or distributed in any fashion without the express written permission of Sericon Technology Inc.
Measuring and Evaluating Cyber Risk in ICS Components, Products and Systems
Measuring and Evaluating Cyber Risk in ICS Components, Products and Systems Copyright 2018 UL LLC. All rights reserved. No portion of this material may be reprinted in any form without the express written
Survey Results: Virtual Insecurity
Best Practices SURVEY Survey Results: Virtual Insecurity May 2013 Executive Summary: Virtual Assets Could Bring Real Risk Virtualization technologies have reshaped how IT offers and delivers their services
Hello? It s Me, Your Not So Smart Device. We Need to Talk.
SESSION ID: SBX1-R2 Hello? It s Me, Your Not So Smart Device. We Need to Talk. Alex Jay Balan Chief Security Researcher Bitdefender @jaymzu IoT is not optional 2 IoT is not optional IoT = hardware + OS
TIBCO Cloud Integration Security Overview
TIBCO Cloud Integration Security Overview TIBCO Cloud Integration is secure, best-in-class Integration Platform as a Service (ipaas) software offered in a multi-tenant SaaS environment with centralized
Chapter 5: Vulnerability Analysis
Chapter 5: Vulnerability Analysis Technology Brief Vulnerability analysis is a part of the scanning phase. In the Hacking cycle, vulnerability analysis is a major and important part. In this chapter, we
Frequently Asked Questions WPA2 Vulnerability (KRACK)
Frequently Asked Questions WPA2 Vulnerability (KRACK) Release Date: October 20, 2017 Document version: 1.0 What is the issue? A research paper disclosed serious vulnerabilities in the WPA and WPA2 key
Rick Redman, Title, KoreLogic Governance, Risk & Compliance G24
Succe What Audits Miss & How Penetration Testers Abuse Those Gaps Rick Redman, Title, KoreLogic Governance, Risk & Compliance G24 CRISC CGEIT CISM CISA Intro Rick Redman / Minga / @CrackMeIfYouCan KoreLogic.com
PT Unified Application Security Enforcement. ptsecurity.com
PT Unified Application Security Enforcement ptsecurity.com Positive Technologies: Ongoing research for the best solutions Penetration Testing ICS/SCADA Security Assessment Over 700 employees globally Over
Vulnerability Disclosure
Vulnerability Disclosure Rita Wells National SCADA Test Bed DoE-OE September 09, 2008 Department of Energy-Office of Electricity Delivery and Energy Reliability: National SCADA Test Bed Program Mission
Insecurity in Security Software
Insecurity in Security Software Maik Morgenstern Andreas Marx AV-Test GmbH http://www.av-test.org Virus Bulletin 2005 Conference presentation about Insecurity in Security Software Copyright 2005 AV-Test
MD-HQ Utilizes Atlantic.Net s Private Cloud Solutions to Realize Tremendous Growth
Success Story: MD-HQ Utilizes Atlantic.Net s Private Cloud Solutions to Realize Tremendous Growth Atlantic.Net specializes in providing security and compliance hosting solutions, most specifically in the
Computer Security: Cyber Essentials KAMI VANIEA 1
Computer Security: Cyber Essentials DR. KAMI VANIEA KAMI VANIEA 1 First, the news http://www.sbrcentre.co.uk/images/site_images/20522_small BusinessTheCyberRiskReportVoRFINALFeb2016.pdf http://www.informationisbeautiful.net/visualizations/worldsbiggest-data-breaches-hacks/
THE NEW LANDSCAPE OF AIRBORNE CYBERATTACKS
SESSION ID: MBS-W04 THE NEW LANDSCAPE OF AIRBORNE CYBERATTACKS Nadir Izrael CTO & Co-Founder Armis, Inc. Ben Seri Head of Research Armis, Inc. Placeholder Slide: Image of spread of infection Placeholder
INTRODUCTION TO EXPLOIT DEVELOPMENT
INTRODUCTION TO EXPLOIT DEVELOPMENT Nathan Ritchey and Michael Tucker Who Am I (Nathan Ritchey) Have Bachelors in Computer Science Member of CSG Working on Masters with focus on Information Assurance Some
Looking at the big picture on. vulnerabilities. Network Resonance, Inc. Eric Rescorla
Looking at the big picture on vulnerabilities Eric Rescorla Network Resonance, Inc. The big picture! All software has bugs! Security relevant software has security bugs! Security is a problem in any multi-user
CYSE 411/AIT 681 Secure Software Engineering. Topic #6. Seven Software Security Touchpoints (III) Instructor: Dr. Kun Sun
CYSE 411/AIT 681 Secure Software Engineering Topic #6. Seven Software Security Touchpoints (III) Instructor: Dr. Kun Sun Reading This lecture [McGraw]: Ch. 7-9 2 Seven Touchpoints 1. Code review 2. Architectural
TOP 10 Vulnerability Trends for By Nevis Labs
TOP Vulnerability Trends for 28 By Nevis Labs Date: December 11, 27 Page 1 It s the last month of 27 and the time is right to look back at the year and predict the vulnerability trends for 28. A quick
4. Risk-Based Security Testing. Reading. CYSE 411/AIT 681 Secure Software Engineering. Seven Touchpoints. Application of Touchpoints
Reading This lecture [McGraw]: Ch. 7-9 CYSE 411/AIT 681 Secure Software Engineering Topic #6. Seven Software Security Touchpoints (III) Instructor: Dr. Kun Sun 2 Seven Touchpoints Application of Touchpoints
The Data Breach: How to Stay Defensible Before, During & After the Incident
The Data Breach: How to Stay Defensible Before, During & After the Incident Alex Ricardo Beazley Insurance Breach Response Services Lynn Sessions Baker Hostetler Partner Michael Bazzell Computer Security
SOLUTION BRIEF. Enabling and Securing Digital Business in API Economy. Protect APIs Serving Business Critical Applications
Enabling and Securing Digital Business in Economy Protect s Serving Business Critical Applications 40 percent of the world s web applications will use an interface Most enterprises today rely on customers
Vulnerability Disclosure Policy. v.1.1
Vulnerability Disclosure Policy v.1.1 This document describes the security vulnerability disclosure policy of VoidSec Team Members. It is the official policy of VoidSec Team Members (referred to as us
Connect Securely in an Unsecure World. Jon Clay Director: Global Threat
Connect Securely in an Unsecure World Jon Clay Director: Global Threat Communications @jonlclay www.cloudsec.com More devices More data More risks Global Risks Landscape 2018 Source: http://www3.weforum.org/docs/wef_grr18_report.pdf
Exploring CVE , a Skeleton key in DNS. Jaime Cochran, Marek Vavrusa
Exploring CVE-2015-7547, a Skeleton key in DNS Jaime Cochran, Marek Vavrusa What is this about? Vulnerability in glibc DNS clients Similar to CVE-2015-0235 GHOST 2015-07-13 reported 2016-02-16 disclosed
Are You Avoiding These Top 10 File Transfer Risks?
Are You Avoiding These Top 10 File Transfer Risks? 1. 2. 3. 4. Today s Agenda Introduction 10 Common File Transfer Risks Brief GoAnywhere MFT Overview Question & Answer HelpSystems Corporate Overview.
Cracking the code on an IT career
Cracking the code on an IT career Jade Khoo Patrick Hosseini & Laura Deans James Hamlyn-Harris CRICOS 00111D, TOID 3069 Snapshot of stories that made news 2 Hacks that leave you exposed The Australian
Penetration Testing Scope
Penetration Testing Scope Discussing the key areas of the Penetration Testing process 4/18/2013 Nz Paper Linux and Web Application Security - nzpaper.blogspot.com Zeeshan Khan 2 Abstract: The aim of this
Secure Programming Techniques
Secure Programming Techniques Meelis ROOS mroos@ut.ee Institute of Computer Science Tartu University spring 2014 Course outline Introduction General principles Code auditing C/C++ Web SQL Injection PHP
Online Intensive Ethical Hacking Training
Online Intensive Ethical Hacking Training Feel the heat of Security and Learn something out of the box 0 About the Course This is a 7 Days Intensive Training Program on Ethical Hacking & Cyber Security.
Department of Management Services REQUEST FOR INFORMATION
RESPONSE TO Department of Management Services REQUEST FOR INFORMATION Cyber-Security Assessment, Remediation, and Identity Protection, Monitoring, and Restoration Services September 3, 2015 250 South President
Understanding Perimeter Security
Understanding Perimeter Security In Amazon Web Services Aaron C. Newman Founder, CloudCheckr Aaron.Newman@CloudCheckr.com Changing Your Perspective How do I securing my business applications in AWS? Moving
IoT in 2016: a serious overview of IoT today and a technical preview of HoneyVNC. By Yonathan Klijnsma
IoT in 2016: a serious overview of IoT today and a technical preview of HoneyVNC By Yonathan Klijnsma Yonathan Klijnsma Senior Threat Intelligence Analyst Perform threat intelligence analysis at keeping
Segmentation for Security
Segmentation for Security Do It Right Or Don t Do It At All Vidder, Inc. Segmentation for Security 1 Executive Summary During the last 30 years, enterprises have deployed large open (flat) networks to
Certified Vulnerability Assessor
Certified Vulnerability Assessor COURSE BENEFITS Course Title:Certified Vulnerability Assessor Duration: 3Day Language: English Class Format Options: Instructor-led classroom Live Online Training Prerequisites:
Facebook API Breach. Jake Williams Rendition Infosec
Facebook API Breach Jake Williams (@MalwareJake) Rendition Infosec www.rsec.us @RenditionSec Facebook View As Facebook allows users/developers to see what a profile page looks like from another user s
Minds.com Platform Full Disclosure
18/06/15 security@voidsec.com Minds.com Platform Full Disclosure Performers: Paolo Stagno ( aka voidsec voidsec@voidsec.com ) Luca Poletti ( aka kalup kalup@voidsec.com ) 1 18/06/15 security@voidsec.com
Omar Alrawi. Security Evaluation of Home-based IoT Deployments
Omar Alrawi Security Evaluation of Home-based IoT Deployments About Us Astrolavos Research Lab at Georgia Tech We specialize in Network Security Measurements Work is presented on behalf of my team Omar
Activity Guide - Public Key Cryptography
Unit 2 Lesson 19 Name(s) Period Date Activity Guide - Public Key Cryptography Introduction This activity is similar to the cups and beans encryption we did in a previous lesson. However, instead of using
How Secure is Your Border? An Attack and Penetration Audit Houston IIA Annual Conference
How Secure is Your Border? An Attack and Penetration Audit 2019 Houston IIA Annual Conference Bill Jenkins Manager, One Cyber Background A proven Cyber Security professional providing insights and recommendations
Advanced Ethical Hacking & Penetration Testing. Ethical Hacking
Summer Training Internship Program 2017 (STIP - 2017) is a practical oriented & industrial level training program for all students who have aspiration to work in the core technical industry domain. This
WEB APPLICATION VULNERABILITIES
WEB APPLICATION VULNERABILITIES CONTENTS Introduction... 3 1. Materials and methods... 3 2. Executive summary... 4 3. Client snapshot... 4 4. Trends... 5 5. Manual web application security assessment...
Mobility, Security Concerns, and Avoidance
By Jorge García, Technology Evaluation Centers Technology Evaluation Centers Mobile Challenges: An Overview Data drives business today, as IT managers and security executives face enormous pressure to
Lance Spitzner.
Lance Spitzner www.securingthehuman.org/blog lspitzner@sans.org @securethehuman Security Awareness Maturity Model Metrics Compliance Focused Promoting Awareness & Change Long Term Sustainment Non-Existent
Eyes Wide Open. John Sawyer Senior Security Analyst InGuardians, Inc.
Eyes Wide Open John Sawyer Senior Security Analyst InGuardians, Inc. Agenda Who am I? What is IT Security? Penetration Testing (aka. Go Hack Yourself) Fun (and scary) Attacks And, How to Protect Yourself
Web Application & Web Server Vulnerabilities Assessment Pankaj Sharma
Web Application & Web Server Vulnerabilities Assessment Pankaj Sharma Indian Computer Emergency Response Team ( CERT - IN ) Department Of Information Technology 1 Agenda Introduction What are Web Applications?
Symantec Client Security. Integrated protection for network and remote clients.
Symantec Client Security Integrated protection for network and remote clients. Complex Internet threats require comprehensive security. Today's complex threats require comprehensive security solutions
Executive Summary. Flex Bounty Program Overview. Bugcrowd Inc Page 2 of 7
CANVAS by Instructure Bugcrowd Flex Program Results December 01 Executive Summary Bugcrowd Inc was engaged by Instructure to perform a Flex Bounty program, commonly known as a crowdsourced penetration
Overview. Handling Security Incidents. Attack Terms and Concepts. Types of Attacks
Overview Handling Security Incidents Chapter 7 Lecturer: Pei-yih Ting Attacks Security Incidents Handling Security Incidents Incident management Methods and Tools Maintaining Incident Preparedness Standard
ACCESS ROUTEROS USING MULTI-FACTOR AUTHENTICATION MIKROTIK USER MEETING 2018
ACCESS ROUTEROS USING MULTI-FACTOR AUTHENTICATION MIKROTIK USER MEETING 2018 Yogyakarta, Indonesia 20 Oktober 2018 About Me 2 Didiet Kusumadihardja 12 tahun pengalaman di IT RT/RW Net, Startup (e-commerce),
Digital Forensic Science: Ideas, Gaps and the Future. Dr. Joshua I. James
Digital Forensic Science: Ideas, Gaps and the Future Dr. Joshua I. James Joshua@cybercrimetech.com 2015-08-09 Overview Digital Forensic Science where are we now? Past Present Where are we going? Future
IT & DATA SECURITY BREACH PREVENTION
IT & DATA SECURITY BREACH PREVENTION A PRACTICAL GUIDE Part 1: Reducing Employee and Application Risks CONTENTS EMPLOYEES: IT security hygiene best practice APPLICATIONS: Make patching a priority AS CORPORATE
IOT Security More than just the network..
IOT Security More than just the network.. Adrian Winckles Cyber Lead - Anglia Ruskin University & OWASP Cambridge Chapter Leader Adrian.Winckles@anglia.ac.uk Bio Adrian Winckles Adrian Winckles is Course
Real-time Cyber Situational Awareness for Satellite Ground Networks. March 2015 Presenter: Ted Vera
Real-time Cyber Situational Awareness for Satellite Ground Networks March 2015 Presenter: Ted Vera Colorado Springs, CO (719) 598 2801 Denver, CO (303) 703 3834 http://www.rtlogic.com Recent Attacks NOAA
INTERNET OF THINGS. Presented By Erin Bosman & Julie Park, Morrison & Foerster LLP ACC 14th ANNUAL GC ROUNDTABLE AND ALL DAY MCLE
Friday, January 27 th, 2017 INTERNET OF THINGS Presented By Erin Bosman & Julie Park, Morrison & Foerster LLP ACC 14th ANNUAL GC ROUNDTABLE AND ALL DAY MCLE This Talk s Objectives What is the Internet
SECURITY AUTOMATION BEST PRACTICES. A Guide on Making Your Security Team Successful with Automation SECURITY AUTOMATION BEST PRACTICES - 1
SECURITY AUTOMATION BEST PRACTICES A Guide on Making Your Security Team Successful with Automation SECURITY AUTOMATION BEST PRACTICES - 1 Introduction The best security postures are those that are built
Bark: Default-Off Networking and Access Control for the IoT. James Hong, Amit Levy, Laurynas Riliskis, Philip Levis Stanford University
Bark: Default-Off Networking and Access Control for the IoT James Hong, Amit Levy, Laurynas Riliskis, Philip Levis Stanford University The IoT is everywhere So are the attacks... 1. Devices easily compromised
Thanks for attending this session on April 6 th, 2016 If you have any question, please contact Jim at
Thanks! Thanks for attending this session on April 6 th, 2016 If you have any question, please contact Jim at jim@stickleyonsecurity.com Don t forget to checkout Stickley on Security and learn about our
Chair for Network Architectures and Services Department of Informatics TU München Prof. Carle. Network Security. Chapter 8
Chair for Network Architectures and Services Department of Informatics TU München Prof. Carle Network Security Chapter 8 System Vulnerabilities and Denial of Service Attacks System Vulnerabilities and
Cyber Security. Our part of the journey
Cyber Security Our part of the journey The Journey Evolved Built on the past Will be continued Not always perfect Small Steps moving forward The Privileged How to make enemies quickly Ask before acting
How NSFOCUS Protected the G20 Summit. Guy Rosefelt on the Strategy, Staff and Tools Needed to Ensure Cybersecurity
How NSFOCUS Protected the G20 Summit Guy Rosefelt on the Strategy, Staff and Tools Needed to Ensure Cybersecurity SPONSORED BY Rosefelt is responsible for developing NSFOCUS threat intelligence and web
Alternative Exploitation Vectors
Alternative Exploitation Vectors A study of CVE-2010-3333 [1] By George Nicolaou Presentation Objectives Share some Experience with Reverse Engineering Driven Exploitation Challenge what you know about
security mindfulness dwayne.
security mindfulness dwayne. foley@eagledream.com security mindfulness defined - the quality or state of being aware that you need to build security into your daily practice -the secure state achieved
Securing the Modern Data Center with Trend Micro Deep Security
Advania Fall Conference Securing the Modern Data Center with Trend Micro Deep Security Okan Kalak, Senior Sales Engineer okan@trendmicro.no Infrastructure change Containers 1011 0100 0010 Serverless Public
SECURITY TRENDS & VULNERABILITIES REVIEW WEB APPLICATIONS
SECURITY TRENDS & VULNERABILITIES REVIEW WEB APPLICATIONS Contents Introduction...3 1. Research Methodology...4 2. Executive Summary...5 3. Participant Portrait...6 4. Vulnerability Statistics...8 4.1.
Introduction to Information Security Prof. V. Kamakoti Department of Computer Science and Engineering Indian Institute of Technology, Madras
Introduction to Information Security Prof. V. Kamakoti Department of Computer Science and Engineering Indian Institute of Technology, Madras Lecture 09 Now, we discuss about the insecurity of passwords.
CISO Success Strategies: On Becoming a Security Business Leader
SESSION ID: CXO W03 CISO Success Strategies: On Becoming a Security Business Leader Frank Kim CISO SANS Institute @fykim Outline Build Your Business Case Rocket Your Relationships Master Your Message 2
IoT and HEART: Security aspects
IoT and HEART: Security aspects Jago Cocco Eurac Research Institute for Renewable Energy Summary IoT: past, present and future IoT security issues Some actual smart home devices Addressing IoT Sec in HEART
Security in a Converging IT/OT World
Security in a Converging IT/OT World Introduction Around the winter solstice, darkness comes early to the citizens of Ukraine. On December 23, 2015, it came a little earlier than normal. In mid-afternoon,
Internet of Things. Internet of Everything. Presented By: Louis McNeil Tom Costin
Internet of Things Internet of Everything Presented By: Louis McNeil Tom Costin Agenda Session Topics What is the IoT (Internet of Things) Key characteristics & components of the IoT Top 10 IoT Risks OWASP
Five Essential Capabilities for Airtight Cloud Security
Five Essential Capabilities for Airtight Cloud Security SECURITY IN THE CLOUD REQUIRES NEW CAPABILITIES It is no secret; security and compliance are at the top of the list of concerns tied to cloud adoption.
Ethical Hacking Guide 2017
Ethical Hacking Guide 2017 Excerpt from Ethical Hacking and Penetration Testing Guide by Rafay Baloch The book covers a wide range of tools, including Backtrack Linux, Google The Unofficial Guide to Ethical
An SDLC for the DevSecOps Era Or SecDevOps, or DevOpsSec,
An SDLC for the DevSecOps Era Or SecDevOps, or DevOpsSec, or zane@signalsciences.com @zanelackey Who you ll be heckling today Started out in offense Pentester / researcher at isec Partners / NCC Group
Top 10 Considerations for Securing Private Clouds
Top 10 Considerations for Securing Private Clouds 1 Who s that knocking at my door? If you know who s accessing your cloud, you can head off many problems before they turn into disasters. You should ensure
Windows Server Containers Maximum speed and density. Containers = Operating system virtualization. Hyper-V Containers Isolation plus performance
Containers = Operating system virtualization CONTAINER CONTAINER CONTAINER Windows Server Containers Maximum speed and density CONTAINER CONTAINER CONTAINER Applications Kernel Traditional virtual machines
tostatichtml() for Everyone!
tostatichtml() for Everyone! About DOMPurify, Security in the DOM, and Why We Really Need Both A talk by Dr.-Ing. Mario Heiderich, Cure53 mario@cure53.de @0x6D6172696F 1 of 45 Here is Alice. She wants
BOARD DIRECTOR CONCERNS ABOUT CYBER AND TECHNOLOGY RISK
BOARD DIRECTOR CONCERNS ABOUT CYBER AND TECHNOLOGY RISK 5 September 2017 Rob Clyde, CISM, NACD Board Leadership Fellow Managing Director, Clyde Consulting LLC Vice-Chair, ISACA Executive Chair White Cloud
The Eight Rules of Security
The Eight Rules of Security The components of every security decision. Understanding and applying these rules builds a foundation for creating strong and formal practices through which we can make intelligent
Securing Dynamic Data Centers. Muhammad Wajahat Rajab, Pre-Sales Consultant Trend Micro, Pakistan &
Securing Dynamic Data Centers Muhammad Wajahat Rajab, Pre-Sales Consultant Trend Micro, Pakistan & Afghanistan @WajahatRajab Modern Challenges By 2020, 60% of Digital Businesses will suffer Major Service
The name of our class will be Yo. Type that in where it says Class Name. Don t hit the OK button yet.
Mr G s Java Jive #2: Yo! Our First Program With this handout you ll write your first program, which we ll call Yo. Programs, Classes, and Objects, Oh My! People regularly refer to Java as a language that
Who are we? Jonas Zaddach. Andrei Costin. Davide Balzarotti EURECOM. Aurélien Francillon EURECOM 2/54
Who are we? Andrei Costin Jonas Zaddach Aurélien Francillon EURECOM Davide Balzarotti EURECOM 2/54 Embedded Devices Are Everywhere by Wilgengebroed on Flickr [CC-BY-2.0] 3/54 Embedded Devices Smarter and
CASE STUDIES TACTICAL ADVICE RESOURCES Infrastructure Optimization Security Storage Networking Mobile & Wireless Hardware & Software Management CURRENT ISSUE Subscribe 1/8 5 Next Level Data Consolidation
Penetration testing a building automation system
Penetration testing a building automation system Is your smart office creating backdoors for hackers? IBM X-Force Research Click here to start There is much focus in the IT industry on securing web servers,
Web Applications Part 1 The Weak Link in Information Security Your Last Line of Defense
Web Applications Part 1 The Weak Link in Information Security Your Last Line of Defense Anthony Lim MBA FCITIL CISSP CSSLP Director, Security Rational Software - Asia Pacific 1 Hong Kong 17 Nov 2009 Welcome