Secure Services and Quality Testing SST. Security Engineering Privacy by Design Trusted Solutions. Mario Hoffmann. for Service Ecosystems
|
|
- Bernard Norris
- 8 years ago
- Views:
Transcription
1 Secure Services and Quality Testing SST Security Engineering Privacy by Design Trusted Solutions for Service Ecosystems Mario Hoffmann Head of Department
2 Fraunhofer AISEC in a nutshell
3 Fraunhofer Profile 60 Institutes 80 research units at approx. 40 locations Europe, Asia, USA employees 1.7 billion research budget 7 Alliances Information and Communication Technology Life Sciences Materials and Components Microelectronics Production Surface Technology and Photonics Defense and Security
4 Fraunhofer Profile Alliance: Information and Communication Technology Germany
5 AISEC Research & Development Groups Embedded Security Dr. F. Stumpf Secure Hardware Platforms Mobile Phones, Smartphones etc. Anti-Piracy, Know-how protection Network Security, P. Schoo Security in IP-based networks Automotive Security, Car2X Automated Malware-detection Secure Services & Quality Testing, M. Hoffmann Secure Cloud Computing Identity Management Testframeworks for SOA, Cloud
6 Finance and IT Across Borders November 2012 in Munich
7 What if A trojan masquerades as a certificate update New versions of the ZeuS trojan apps going after mobile TANs (mtans) How does it work? 1. PC-Trojan: Install new certificates on the smartphone! 2. PC-Trojan asks for mobile phone number 3. PC-Trojan sends SMS with link to Security Update 4. Another Trojan infects the smartphone, analyses incoming SMS for mtans and forwards them In the news, 14. Nov 2012 and 07. Aug Aug 2012
8 Fraunhofer AISEC Department Secure Services & Quality Testing Mobile Security Research and development of mobile architectures and platforms and their integration in context-aware personalised environments Cloud Computing Security Implications in Cloud Computing Ecosystems Risk Analyses, Technology Studies, Prototyping Digital Identities Development of Security Concepts, Protocols & Use Cases in Identity Ecosystems Assessments & Testing Installation & Evaluation of Open Source Solutions for Cloud Computing, Identity Management and Service Architectures
9 Mobile Security Expertise ¾ Platform Security ¾ Trusted Execution ¾ App Development Holistic security evaluation of mobile systems (OWASP Top 10) Blackbox- / Whitebox-Tests: Data & Protocol Security Accurate integration of cryptography Vulnerabilities of Backend Systems Development of dedicated Testing-Tools (NFC-Fuzzer, Exploit-Frameworks for Android and HTML5) Results: Complete Report + Optional Whitepaper Countermeasures, protection concepts Certificate
10 Mobile Security Expertise ¾ Platform Security ¾ Trusted Execution ¾ App Development OWASP Top 10 Mobile Risks 1. Insecure Data Storage 2. Weak Server Side Controls 3. Insufficient Transport Layer Protection 4. Client Side Injection 5. Poor Authorization and Authentication 6. Improper Session Handling 7. Security Decisions Via Untrusted Inputs 8. Side Channel Data Leakage 9. Broken Cryptography 10. Sensitive Information Disclosure by Jack Mannino on Sep 27, 201
11 Innovative Prototypes: tapndrop ¾ Platform Security ¾ Trusted Execution ¾ App Development tapndrop
12 Innovative Prototypes: tapndrop ¾ Platform Security ¾ Trusted Execution ¾ App Development Allows to easily exchange data e.g., between participants of a workshop Enabling secure information sharing Integrating encrypted Cloud storage Exchanging symmetric keys f2f Establishing trustworthy session management Integrating NFC technology tapndrop
13 Cloud Computing Expertise ¾ Platform Security ¾ Trusted Execution ¾ App Development ¾ Cloud Monitoring ¾ Service Integration ¾ Data Security
14 Cloud Security Standards Cloud Security Alliance Fraunhofer AISEC is co-founder of the German chapter ¾ Platform Security ¾ Trusted Execution ¾ App Development Top Threats to Cloud Computing Survey Results Update ¾ Cloud Monitoring ¾ Service Integration ¾ Data Security
15 Network Bandwidth During the last hour Time Amount of Data GB Datacenter DE Datacenter UK Telco Cloud Cloud Leitstand Fraunhofer AISEC Public Cloud Location of Data During the last day Active users During the last 6 hours Google Datacenter DE 50% Datacenter UK 13% Telco Cloud 12% Public Cloud 25% Failed login attempts During the last 6 hours Hour of day Hour of day Cloud Monitoring & Control Users MBit/s ¾ Platform Security ¾ Trusted Execution ¾ App Development ¾ Cloud Monitoring ¾ Service Integration ¾ Data Security Approaches Questions: Is the online banking service online and available? Is my Cloud infrastructure compliant to regional data protection laws? Am I compliant to ISO27001, SOX, etc.? Ø Risk management and continuous monitoring of all Cloud architectural levels Ø Development of applicable representations of Cloudspecific metrics Ø Development of a dashboard for different roles Ø Certifying/Auditing as a Service Ø AISEC Cloud-Leitstand monitoring cockpit Login attempts
16 Sealed Cloud funded by BMWi Trusted Cloud Initiative Duration: October 2011 September 2014 ¾ Platform Security ¾ Trusted Execution ¾ App Development Approaches Questions: Can data of customers be processed/stored in the system without the danger of being compromised even by the operator? ¾ Cloud Monitoring ¾ Service Integration ¾ Data Security Ø Development of a secure cloud computing infrastructure, technical sealing of the hardware Ø Monitoring components for supporting audits and certifications Ø Integration of Trusted Platform Moduls (TPM) and development of Hardware Security Moduls (HSM) with virtualization support Ø Identity and authorization management Ø Use Case: SealedCloud as enabler for efinance Ø
17 Digital Identities Expertise ¾ Platform Security ¾ Trusted Execution ¾ App Development Implementing identity concepts and frameworks Integrating ID management into service infrastructures (Kantara/UMA, U-Prove, Higgins, Shibboleth, OpenID Connect, OAuth) Secure sharing of information based on authorisation and policy management R&D for the future Internet of people, things, and services ¾ Unified management of virtual identities ¾ Security in Identity Ecosystems ¾ Cloud Monitoring ¾ Service Integration ¾ Data Security Integrating security tokens in service infrastructures Integrating national ID cards, e.g. npa Integrating RFID/NFC-based access tokens Securing and integrating mobile devices
18 Kantara UMA Reference Prototypes Authorization Protocol ¾ Platform Security ¾ Trusted Execution ¾ App Development Adapted in: Cloud Logistics egov To be done: efinance ¾ Unified management of virtual identities ¾ Security in Identity Ecosystems ¾ Cloud Monitoring ¾ Service Integration ¾ Data Security UMA-Protocol Reference Implementation
19 Life Management Platform New approach for transparency and user empowerment in service federations ¾ Platform Security ¾ Trusted Execution ¾ App Development ¾ Unified management of virtual identities ¾ Security in Identity Ecosystems ¾ Cloud Monitoring ¾ Service Integration ¾ Data Security
20 Assessments & Testing ¾ Interoperability and Compliance Tests ¾ Penetration Testing ¾ Security & Risk Analysis ¾ Platform Security ¾ Trusted Execution ¾ App Development Requirements Analysis Security Requirements Engineering Threat Analysis Models of assets and attackers Threat and risk analysis Security Analysis Blackbox-/Whitebox-Tests Integration of crypto methods and protocols ¾ Unified management of virtual identities ¾ Security in Identity Ecosystems ¾ Cloud Monitoring ¾ Service Integration ¾ Data Security Whitepaper Countermeasures Marketing whitepaper with test results Technical paper with recommendations and countermeasures Certificate Holistic and detailed analysis of SW, HW, and protocols incl. AISEC certificate
21 Selected References
22 Opportunities for cooperation Evaluation of security, interoperability, feasibility Security Requirements Engineering Specification of Security Architectures Integration of existing concepts & components Implementation of new concepts & components Assessment of security levels, threats, and risks Test & Mitigation of vulnerabilities è Contract research & development è Consortia in publicly funded projects
23 Conclusion Analyse your process and service requirements before Cloud-enabling your business Transparency, monitoring and control are prerequisites for realiable Private/Public Cloud solutions Analyse your policies before thinking about BYOD Security & Privacy by Design lowers follow-up costs and strengthens your reputation Your business is global but compliance to regulations and data protection laws differ from region to region Let s get in touch
24 Contact Fraunhofer AISEC Parkring Garching (near Munich) Germany Secure Services & Quality Testing SST Mario Hoffmann Head of Department Phone: +49-(0) Fax: +49-(0) mario.hoffmann@aisec.fraunhofer.de Web:
Applied and Integrated Security. C. Eckert
Applied and Integrated Security 1 Joseph von Fraunhofer (1787-1826) Researcher discovery of Fraunhofer Lines in the sun spectrum Inventor new methods of lens processing Entrepreneur head of royal glass
More informationAPPLIED AND INTEGRATED SECURITY
APPLIED AND INTEGRATED SECURITY Directors: Claudia Eckert (Managing) Georg Sigl SECURITY RESEARCH IN MUNICH Fraunhofer Institution for Applied and Integrated Security Claudia Eckert Georg Sigl TU München
More informationSecurity Challenges in the Cloud
Security Challenges in the Cloud Claudia Eckert Fraunhofer Research Institution for Applied and Integrated Security (AISEC) Chair for IT Security, TU München 7.2. Darmstadt, Conference of the e-finance
More informationBYOD: End-to-End Security
BYOD: End-to-End Security Alen Lo MBA(CUHK), BSc(HKU), CISA, CCP, CISSP, CISM, CEH IRCA Certified ISMS Lead Auditor, itsmf ISO 20000 Auditor Principal Consultant i-totalsecurity Consulting Limited alenlo@n2nsecurity.com
More informationSecurity in Vehicle Networks
Security in Vehicle Networks Armin Happel, Christof Ebert Stuttgart, 17. March 2015 V1.1 2015-04-28 Introduction Vector Consulting Services supports clients worldwide in improving their product development
More informationAPPLIED AND INTEGRATED SECURITY
APPLIED AND INTEGRATED SECURITY New approach for Compliance, Security and Data privacy assessment in the Cloud Age NGCert Next Generation Certification EuroCloud Forum 2015 Fraunhofer AGENDA Fraunhofer
More informationPCI Security Standards Council
PCI Security Standards Council Ralph Poore, Director, Emerging Standards 2013 About PCI Emerging Technologies OWASP and Mobile Guidelines About PCI About the PCI Council Open, global forum Founded 2006
More informationMobile Application Security. Helping Organizations Develop a Secure and Effective Mobile Application Security Program
Mobile Application Security Helping Organizations Develop a Secure and Effective Mobile Application Security Program by James Fox fox_james@bah.com Shahzad Zafar zafar_shahzad@bah.com Mobile applications
More informationCHANCES AND RISKS FOR SECURITY IN MULTICORE PROCESSORS
CHANCES AND RISKS FOR SECURITY IN MULTICORE PROCESSORS Prof. Dr.-Ing. Georg Sigl Institute for Security in Information Technology Technical University Munich sigl@tum.de Fraunhofer Research Institution
More informationWeak Spots in Enterprise Mobility Management Dennis Schröder
Weak Spots in Enterprise Mobility Management Dennis Schröder Personal details TÜV Informationstechnik GmbH TÜV NORD GROUP Dennis Schröder, M. Sc. IT Security Business Security & Privacy Product Manager
More informationEU Threat Landscape Threat Analysis in Research ENISA Workshop Brussels 24th February 2015
EU Threat Landscape Threat Analysis in Research ENISA Workshop Brussels 24th February 2015 Aristotelis Tzafalias Trust and Security Unit H.4 DG Connect European Commission Trust and Security: One Mission
More informationMS-55096: Securing Data on Microsoft SQL Server 2012
MS-55096: Securing Data on Microsoft SQL Server 2012 Description The goal of this two-day instructor-led course is to provide students with the database and SQL server security knowledge and skills necessary
More informationWWRF Cloud Implications to Security, Privacy, and Trust
ITU-T Workshop on Addressing security challenges on a global scale 06.+07.12.2010, Geneva WWRF Cloud Implications to Security, Privacy, and Trust Mario Hoffmann Chair WWRF Working Group 7 Security & Trust
More informationCan We Reconstruct How Identity is Managed on the Internet?
Can We Reconstruct How Identity is Managed on the Internet? Merritt Maxim February 29, 2012 Session ID: STAR 202 Session Classification: Intermediate Session abstract Session Learning Objectives: Understand
More informationSecure Cloud Computing
Secure Cloud Computing Agenda Current Security Threat Landscape Over View: Cloud Security Overall Objective of Cloud Security Cloud Security Challenges/Concerns Cloud Security Requirements Strategy for
More informationSecuring Data on Microsoft SQL Server 2012
Securing Data on Microsoft SQL Server 2012 Course 55096 The goal of this two-day instructor-led course is to provide students with the database and SQL server security knowledge and skills necessary to
More informationChapter 1: Introduction
Chapter 1 Introduction 1 Chapter 1: Introduction 1.1 Inspiration Cloud Computing Inspired by the cloud computing characteristics like pay per use, rapid elasticity, scalable, on demand self service, secure
More informationSECURING MOBILE APPLICATIONS
SECURING MOBILE APPLICATIONS Ulf Larson Göteborg ulf.larson@owasp.org ulf.larson@adecco.se A REAL WORLD EXAMPLE TO GET US STARTED Google ClientLogin Authentication Protocol https un/pw auth token... Google
More informationMobile & Security? Brice Mees Security Services Operations Manager
Mobile & Security? Brice Mees Security Services Operations Manager Telenet for Business Agenda Mobile Trends Where to start? Risks and Threats Risk mitigation Conclusion Agenda Mobile Trends Where to start?
More informationThe State of Mobile Application Insecurity
The State of Mobile Application Insecurity Sponsored by IBM Independently conducted by Ponemon Institute LLC Publication Date: February 2015 Ponemon Institute Research Report Part 1. Introduction The State
More informationHow To Protect Your Cloud Computing Resources From Attack
Security Considerations for Cloud Computing Steve Ouzman Security Engineer AGENDA Introduction Brief Cloud Overview Security Considerations ServiceNow Security Overview Summary Cloud Computing Overview
More informationSecure Embedded Systems eine Voraussetzung für Cyber Physical Systems und das Internet der Dinge
Secure Embedded Systems eine Voraussetzung für Cyber Physical Systems und das Internet der Dinge Mitgliederversammlung EIKON e.v. 26. Februar 2014 Prof. Dr.-Ing. Georg Sigl Lehrstuhl für Sicherheit in
More informationSecuring Your Web Application against security vulnerabilities. Ong Khai Wei, IT Specialist, Development Tools (Rational) IBM Software Group
Securing Your Web Application against security vulnerabilities Ong Khai Wei, IT Specialist, Development Tools (Rational) IBM Software Group Agenda Security Landscape Vulnerability Analysis Automated Vulnerability
More informationCAST CENTER FOR ADVANCED SECURITY TRAINING. CAST618 Designing and Implementing Cloud Security CAST
CENTER FOR ADVANCED SECURITY TRAINING 618 Designing and Implementing Cloud Security About EC-Council Center of Advanced Security Training () The rapidly evolving information security landscape now requires
More informationBuilding Trust in a Digital World. Brian Phelps, BSc CISSP Director of Advanced Solutions Group EMEA Thales UK, Ltd.
Building Trust in a Digital World Brian Phelps, BSc CISSP Director of Advanced Solutions Group EMEA Thales UK, Ltd. 2 Global incidents Equivalent of 117,339 incoming attacks per day, everyday Total number
More informationExternal Supplier Control Requirements
External Supplier Control s Cyber Security For Suppliers Categorised as Low Cyber Risk 1. Asset Protection and System Configuration Barclays Data and the assets or systems storing or processing it must
More informationConsolidated Edition. 5th Annual State of Application Security Report Perception vs. Reality
Consolidated Edition 5th Annual State of Application Security Report Perception vs. Reality January 2016 2 Table of Contents Executive Summary... 2 State of Application Security Report Healthcare Edition
More informationTable of Contents. FME Cloud Architecture Overview. Secure Operations. Application Security. Shared Responsibility.
FME Cloud Security Table of Contents FME Cloud Architecture Overview Secure Operations I. Backup II. Data Governance and Privacy III. Destruction of Data IV. Incident Reporting V. Development VI. Customer
More informationBrainloop Cloud Security
Whitepaper Brainloop Cloud Security Guide to secure collaboration in the cloud www.brainloop.com Sharing information over the internet The internet is the ideal platform for sharing data globally and communicating
More informationWeb Application Security
Chapter 1 Web Application Security In this chapter: OWASP Top 10..........................................................2 General Principles to Live By.............................................. 4
More informationBuilding a Corporate Application Security Assessment Program
Building a Corporate Application Security Assessment Program Rob Jerdonek and Topher Chung Corporate Information Security Intuit Inc. July 23, 2009 Copyright The Foundation Permission is granted to copy,
More informationCloud security architecture
ericsson White paper Uen 284 23-3244 January 2015 Cloud security architecture from process to deployment The Trust Engine concept and logical cloud security architecture presented in this paper provide
More informationCloud-Security: Show-Stopper or Enabling Technology?
Cloud-Security: Show-Stopper or Enabling Technology? Fraunhofer Institute for Secure Information Technology (SIT) Technische Universität München Open Grid Forum, 16.3,. 2010, Munich Overview 1. Cloud Characteristics
More informationThe Top Web Application Attacks: Are you vulnerable?
QM07 The Top Web Application Attacks: Are you vulnerable? John Burroughs, CISSP Sr Security Architect, Watchfire Solutions jburroughs@uk.ibm.com Agenda Current State of Web Application Security Understanding
More informationExcellence Doesn t Need a Certificate. Be an. Believe in You. 2014 AMIGOSEC Consulting Private Limited
Excellence Doesn t Need a Certificate Be an 2014 AMIGOSEC Consulting Private Limited Believe in You Introduction In this age of emerging technologies where IT plays a crucial role in enabling and running
More informationElevation of Mobile Security Risks in the Enterprise Threat Landscape
March 2014, HAPPIEST MINDS TECHNOLOGIES Elevation of Mobile Security Risks in the Enterprise Threat Landscape Author Khaleel Syed 1 Copyright Information This document is an exclusive property of Happiest
More informationAPIs The Next Hacker Target Or a Business and Security Opportunity?
APIs The Next Hacker Target Or a Business and Security Opportunity? SESSION ID: SEC-T07 Tim Mather VP, CISO Cadence Design Systems @mather_tim Why Should You Care About APIs? Amazon Web Services EC2 alone
More informationAdobe Systems Incorporated
Adobe Connect 9.2 Page 1 of 8 Adobe Systems Incorporated Adobe Connect 9.2 Hosted Solution June 20 th 2014 Adobe Connect 9.2 Page 2 of 8 Table of Contents Engagement Overview... 3 About Connect 9.2...
More informationKenna Platform Security. A technical overview of the comprehensive security measures Kenna uses to protect your data
Kenna Platform Security A technical overview of the comprehensive security measures Kenna uses to protect your data V2.0, JULY 2015 Multiple Layers of Protection Overview Password Salted-Hash Thank you
More informationelearning for Secure Application Development
elearning for Secure Application Development Curriculum Application Security Awareness Series 1-2 Secure Software Development Series 2-8 Secure Architectures and Threat Modeling Series 9 Application Security
More informationHow to Build a Trusted Application. John Dickson, CISSP
How to Build a Trusted Application John Dickson, CISSP Overview What is Application Security? Examples of Potential Vulnerabilities Strategies to Build Secure Apps Questions and Answers Denim Group, Ltd.
More informationCycurHSM An Automotive-qualified Software Stack for Hardware Security Modules
CycurHSM An Automotive-qualified Software Stack for Hardware Security Modules Dr. Frederic Stumpf, ESCRYPT GmbH Embedded Security, Stuttgart, Germany 1 Introduction Electronic Control Units (ECU) are embedded
More informationPRIVACY AWARE ACCESS CONTROL FOR CLOUD-BASED DATA PLATFORMS
www.openi-ict.eu Open-Source, Web-Based, Framework for Integrating Applications with Social Media Services and Personal Cloudlets PRIVACY AWARE ACCESS CONTROL FOR CLOUD-BASED DATA PLATFORMS Open-Source,
More informationCloud Security Framework (CSF): Gap Analysis & Roadmap
Cloud Security Framework (CSF): Gap Analysis & Roadmap Contributors: Suren Karavettil, Bhumip Khasnabish Ning So, Gene Golovinsky, Meng Yu & Wei Yinxing Please send comments & suggestions to Suren Karavettil
More informationWorkday Mobile Security FAQ
Workday Mobile Security FAQ Workday Mobile Security FAQ Contents The Workday Approach 2 Authentication 3 Session 3 Mobile Device Management (MDM) 3 Workday Applications 4 Web 4 Transport Security 5 Privacy
More informationSecure Web Applications. The front line defense
Secure Web Applications The front line defense Agenda Web Application Security Threat Overview Exploiting Web Applications Common Attacks & Preventative techniques Developing Secure Web Applications -Security
More informationPromoting Application Security within Federal Government. AppSec DC November 13, 2009. The OWASP Foundation http://www.owasp.org
Promoting Application Security within Federal Government AppSec DC November 13, 2009 Dr. Sarbari Gupta, CISSP, CISA Founder/President Electrosoft sarbari@electrosoft-inc.com 703-437-9451 ext 12 The Foundation
More informationCloud Security Framework (CSF): Gap Analysis & Roadmap
Cloud Security Framework (CSF): Gap Analysis & Roadmap Contributors: Suren Karavettil, Bhumip Khasnabish Ning So, Gene Golovinsky, Meng Yu & Wei Yinxing Please send comments & suggestions to Suren Karavettil
More informationApplying Cryptography as a Service to Mobile Applications
Applying Cryptography as a Service to Mobile Applications SESSION ID: CSV-F02 Peter Robinson Senior Engineering Manager RSA, The Security Division of EMC Introduction This presentation proposes a Cryptography
More informationThe Panoptix Building Efficiency Solution: Ensuring a Secure Delivery of Building Efficiency
logo The Panoptix Building Efficiency Solution: Ensuring a Secure Delivery of Building Efficiency Understanding the Multiple Levels of Security Built Into the Panoptix Solution Published: October 2011
More informationBig Data, Big Risk, Big Rewards. Hussein Syed
Big Data, Big Risk, Big Rewards Hussein Syed Discussion Topics Information Security in healthcare Cyber Security Big Data Security Security and Privacy concerns Security and Privacy Governance Big Data
More informationFORBIDDEN - Ethical Hacking Workshop Duration
Workshop Course Module FORBIDDEN - Ethical Hacking Workshop Duration Lecture and Demonstration : 15 Hours Security Challenge : 01 Hours Introduction Security can't be guaranteed. As Clint Eastwood once
More informationJVA-122. Secure Java Web Development
JVA-122. Secure Java Web Development Version 7.0 This comprehensive course shows experienced developers of Java EE applications how to secure those applications and to apply best practices with regard
More informationRational AppScan & Ounce Products
IBM Software Group Rational AppScan & Ounce Products Presenters Tony Sisson and Frank Sassano 2007 IBM Corporation IBM Software Group The Alarming Truth CheckFree warns 5 million customers after hack http://infosecurity.us/?p=5168
More informationCloud Computing. Benefits and Risks. Bill Wells, CISSP, CISM, CISA, CRISC, CIPP/IT bill.wells@transamerica.com
Cloud Computing Benefits and Risks Bill Wells, CISSP, CISM, CISA, CRISC, CIPP/IT bill.wells@transamerica.com 10/3/2012 1 Let s make sure we re all talking about the same thing. WHAT IS CLOUD COMPUTING?
More informationHow To Protect Your Network From Threats From Your Network (For A Mobile) And From Your Customers (For An Enterprise)
Plugging the Holes in Mobile Security: The Rising Threat Jennifer M. Pigg, VP of Research, Yankee Group Nick Wade, Group Product Manager, Symantec June 2011 Copyright 2011. Yankee Group Research, Inc.
More information5th Annual State of Application Security Report Perception vs. Reality
Healthcare Edition 5th Annual State of Application Security Report Perception vs. Reality L January 2016 2 Table of Contents Executive Summary... 2 Methodology... 3 Research Findings... 4 Recommendations...
More informationLoophole+ with Ethical Hacking and Penetration Testing
Loophole+ with Ethical Hacking and Penetration Testing Duration Lecture and Demonstration: 15 Hours Security Challenge: 01 Hours Introduction Security can't be guaranteed. As Clint Eastwood once said,
More informationMobile Application Security
Mobile Application Security Jack Mannino Anand Vemuri June 25, 2015 About Us Jack Mannino CEO at nvisium UI and UX development impaired Enjoys: Scala, Elixir Tolerates: Java Allergic To: Cats, Pollen,.NET
More informationKASPERSKY SECURITY INTELLIGENCE SERVICES. EXPERT SERVICES. www.kaspersky.com
KASPERSKY SECURITY INTELLIGENCE SERVICES. EXPERT SERVICES www.kaspersky.com EXPERT SERVICES Expert Services from Kaspersky Lab are exactly that the services of our in-house experts, many of them global
More informationLBSEC. http://www.liveboxcloud.com
2014 LBSEC http://www.liveboxcloud.com LiveBox Srl does not release declarations or guarantee regarding this documentation and its use and declines any expressed or implied commercial or suitability guarantee
More informationOWASP Mobile Top Ten 2014 Meet the New Addition
OWASP Mobile Top Ten 2014 Meet the New Addition Agenda OWASP Mobile Top Ten 2014 Lack of Binary Protections added Why is Binary Protection important? What Risks Need to be Mitigated? Where to Go For Further
More informationDevelopment Processes (Lecture outline)
Development*Process*for*Secure* So2ware Development Processes (Lecture outline) Emphasis on building secure software as opposed to building security software Major methodologies Microsoft's Security Development
More informationConnected Cars Combining Security and Safety
Connected Cars Combining Security and Safety At Home on All Continents. Key figures 2014 Revenues in millions of euros 1,731 Foreign portion (%) 49.0 EBIT (%) 6.4 Employees 19,320 Foreign portion (%) 60.0
More informationMobile Application Threat Analysis
The OWASP Foundation http://www.owasp.org Mobile Application Threat Analysis Ari Kesäniemi Nixu Copyright The OWASP Foundation Permission is granted to copy, distribute and/or modify this document under
More informationIoT Security Concerns and Renesas Synergy Solutions
IoT Security Concerns and Renesas Synergy Solutions Simon Moore CTO - Secure Thingz Ltd Agenda Introduction to Secure.Thingz. The Relentless Attack on the Internet of Things Building protection with Renesas
More informationBut... It s an App/Play Store Download: Research Exposes Mobile App Flaws
SESSION ID: BR-W01 But... It s an App/Play Store Download: Research Exposes Mobile App Flaws Andrew Hoog CEO and Co-founder NowSecure @ahoog42 Ryan Welton Engineer NowSecure @Fuzion24 Mobile is different
More informationData Protection: From PKI to Virtualization & Cloud
Data Protection: From PKI to Virtualization & Cloud Raymond Yeung CISSP, CISA Senior Regional Director, HK/TW, ASEAN & A/NZ SafeNet Inc. Agenda What is PKI? And Value? Traditional PKI Usage Cloud Security
More informationIT TRENDS AND FUTURE CONSIDERATIONS. Paul Rainbow CPA, CISA, CIA, CISSP, CTGA
IT TRENDS AND FUTURE CONSIDERATIONS Paul Rainbow CPA, CISA, CIA, CISSP, CTGA AGENDA BYOD Cloud Computing PCI Fraud Internet Banking Questions The Mobile Explosion Mobile traffic data in 2011 was nearly
More informationProtect Yourself in the Cloud Age
Protect Yourself in the Cloud Age Matthew Wu Consultant Hong Kong Computer Emergency Response Team Coordination Centre About HKCERT HKCERT ( 香 港 電 腦 保 安 事 故 協 調 中 心 ) Established in 2001 Funding & Operation
More informationCNT5410 - Computer and Network Security Review/Wrapup
CNT5410 - Computer and Network Security Review/Wrapup Professor Kevin Butler Fall 2015 Review What did we talk about this semester? Cryptography secret vs public-key key exchange (Diffie-Hellman) symmetric
More informationCredential Management for Cloud Computing
Credential Management for Cloud Computing Workshop Cloud Security, 16.07.2014 Dr. Johannes Luyken Page 1 Security breaches increase in their impact by exploiting online access to confidential data that
More informationPentests more than just using the proper tools
Pentests more than just using the proper tools Agenda 1. Information Security @ TÜV Rheinland 2. Penetration testing Introduction Evaluation scheme Security Analyses of web applications Internal Security
More informationPanel: SwA Practices - Getting to Effectiveness in Implementation
Panel: SwA Practices - Getting to Effectiveness in Implementation (EMC s Evolution of Product Security Assurance) Dan Reddy, CISSP, CSSLP EMC Product Security Office Software Assurance Forum Gaithersburg,
More informationSecuring the Internet of Things: Mapping Attack Surface Areas Using the OWASP IoT Top 10
SESSION ID: ASD-T10 Securing the Internet of Things: Mapping Attack Surface Areas Using the OWASP IoT Top 10 Daniel Miessler Security Research HP Fortify on Demand @danielmiessler HP Fortify on Demand
More informationVerfahren zur Absicherung von Apps. Dr. Ullrich Martini IHK, 4-12-2014
Verfahren zur Absicherung von Apps Dr. Ullrich Martini IHK, 4-12-2014 Agenda Introducing G&D Problem Statement Available Security Technologies Smartcard Embedded Secure Element Virtualization Trusted Execution
More informationSecurity Testing Guidelines for mobile Apps
The OWASP Foundation http://www.owasp.org Security Testing Guidelines for mobile Apps Florian Stahl Johannes Ströher AppSec Research EU 2013 Who we are Florian Stahl Johannes Ströher Lead Consultant for
More informationHardware Security Modules for Protecting Embedded Systems
Hardware Security Modules for Protecting Embedded Systems Marko Wolf, ESCRYPT GmbH Embedded Security, Munich, Germany André Weimerskirch, ESCRYPT Inc. Embedded Security, Ann Arbor, USA 1 Introduction &
More informationWe are Passionate about Total Security Management Architecture & Infrastructure Optimisation Review
We are Passionate about Total Security Management Architecture & Infrastructure Optimisation Review The security threat landscape is constantly changing and it is important to periodically review a business
More informationSECURE MOBILE APP DEVELOPMENT: DIFFERENCES FROM TRADITIONAL APPROACH
SECURE MOBILE APP DEVELOPMENT: DIFFERENCES FROM TRADITIONAL APPROACH Suhas Desai Aujas Information Risk Services Session ID: MBS-T02 Session Classification: Intermediate Agenda Trends in Mobile Technology
More informationIT Security in Germany - A Review
Munich IT Security Research Group Reality Check: Practical Limitations of Technical Privacy Protection Hans-Joachim Hof MuSe - Munich IT Security Research Group Munich University of Applied Sciences hof@hm.edu
More informationWHITE PAPER. FortiWeb and the OWASP Top 10 Mitigating the most dangerous application security threats
WHITE PAPER FortiWeb and the OWASP Top 10 PAGE 2 Introduction The Open Web Application Security project (OWASP) Top Ten provides a powerful awareness document for web application security. The OWASP Top
More informationCloud Computing Security Considerations
Cloud Computing Security Considerations Roger Halbheer, Chief Security Advisor, Public Sector, EMEA Doug Cavit, Principal Security Strategist Lead, Trustworthy Computing, USA January 2010 1 Introduction
More informationSecurity Testing and Vulnerability Management Process. e-governance
Security Testing and Vulnerability Management Process for e-governance Draft DEPARTMENT OF ELECTRONICS AND INFORMATION TECHNOLOGY Ministry of Communication and Information Technology, Government of India.
More informationAddressing the blind spots in your security strategy. BT, Venafi & Blue Coat
Addressing the blind spots in your security strategy BT, Venafi & Blue Coat Agenda Welcome & Introductions Phil Rodrigues, Director of Security Architecture, Asia Pacific, BT A blueprint for the perfect
More informationJoint Universities Computer Centre Limited ( JUCC ) Information Security Awareness Training - Session One
Joint Universities Computer Centre Limited ( JUCC ) Information Security Awareness Training - Session One End User Security, IS Control Evaluation & Self- Assessment Information Security Trends and Countermeasures
More informationMobility Challenges & Trends The Financial Services Point Of View
Mobility Challenges & Trends The Financial Services Point Of View Nikos Theodosiou Cloud Computing Solutions Presales/Marketing Engineer The New World Agenda The Mobile World The Challenges The Solutions
More informationTHEODORA TITONIS VERACODE Vice President Mobile
THEODORA TITONIS VERACODE Vice President Mobile MOBILE SECURITY Increasing Threat MOBILE RISK 64% 34% 47% Companies with no BYOD policy. 3 Companies with no app security program. 4 614% Nearly half of
More informationNetwork Security in Building Networks
Network Security in Building Networks Prof. Dr. (TU NN) Norbert Pohlmann Institute for Internet Security - if(is) Westphalian University of Applied Sciences Gelsenkirchen, Germany www.if-is.net Content
More informationSAST, DAST and Vulnerability Assessments, 1+1+1 = 4
SAST, DAST and Vulnerability Assessments, 1+1+1 = 4 Gordon MacKay Digital Defense, Inc. Chris Wysopal Veracode Session ID: Session Classification: ASEC-W25 Intermediate AGENDA Risk Management Challenges
More informationUnified Identity Management
Unified Identity Management Across Data Center, Cloud and Mobile Enterprise of Things = More Complexity DESKTOPS + MOBILE DATA CENTER APPS CLOUD (SaaS) by Red Hat + DATA CENTER SERVERS + CLOUD (IaaS &
More informationMike Zusman 3/7/2011. OWASP Goes Mobile SANS AppSec Summit 2011
Mike Zusman 3/7/2011 OWASP Goes Mobile SANS AppSec Summit 2011 Agenda Introductions OWASP Summit Recap OWASP Mobile Top 10 v0.1 (DRAFT) 2 Who Are We Other than carbon-based multi-cellular life forms 3
More information05.0 Application Development
Number 5.0 Policy Owner Information Security and Technology Policy Application Development Effective 01/01/2014 Last Revision 12/30/2013 Department of Innovation and Technology 5. Application Development
More informationThe Key to Secure Online Financial Transactions
Transaction Security The Key to Secure Online Financial Transactions Transferring money, shopping, or paying debts online is no longer a novelty. These days, it s just one of many daily occurrences on
More informationSecuring The Cloud. Foundational Best Practices For Securing Cloud Computing. Scott Clark. Insert presenter logo here on slide master
Securing The Cloud Foundational Best Practices For Securing Cloud Computing Scott Clark Agenda Introduction to Cloud Computing What is Different in the Cloud? CSA Guidance Additional Resources 2 What is
More informationVICTORIA UNIVERSITY OF WELLINGTON Te Whare Wānanga o te Ūpoko o te Ika a Māui
VICTORIA UNIVERSITY OF WELLINGTON Te Whare Wānanga o te Ūpoko o te Ika a Māui School of Engineering and Computer Science Te Kura Mātai Pūkaha, Pūrorohiko PO Box 600 Wellington New Zealand Tel: +64 4 463
More informationHow to start a software security initiative within your organization: a maturity based and metrics driven approach OWASP
How to start a software security initiative within your organization: a maturity based and metrics driven approach Marco Morana OWASP Lead/ TISO Citigroup OWASP Application Security For E-Government Copyright
More informationCybersecurity: Learn Critical Strategies to Protecting Your Enterprise November 6, 2013 1:00PM EST
Cybersecurity: Learn Critical Strategies to Protecting Your Enterprise November 6, 2013 1:00PM EST November 6, 2013 Copyright 2013 Trusted Computing Group 1 November 6, 2013 Copyright 2013 Trusted Computing
More informationSecuring the future of mobile services. SIMalliance Open Mobile API. An Introduction v2.0. Security, Identity, Mobility
1 An Introduction v2.0 September 2015 Document History 2 Version Date Editor Remarks 1.0 06/04/2011 OMAPI Working Group Public release 2.0 27/09/2015 OMAPI Working Group Public release Copyright 2015 SIMalliance
More information