Attack Trends software security? Gary McGraw, Ph.D. Chief Technology Officer, Cigital Cigital
|
|
|
- Frederica Bell
- 8 years ago
- Views:
Transcription
1 Attack Trends orwhy software security? Gary McGraw, Ph.D. Chief Technology Officer, Cigital
2 Cigital n n Founded in 1992 to provide software security and software quality professional services Recognized experts in software security and software quality n Widely published in books, white papers, and articles n Industry thought leaders
3 What do wireless devices, cell phones, PDAs, browsers, operating systems, servers, routers, personal computers, public key infrastructure systems, and firewalls have in common? Pop quiz Software badness-ometer
4 Technology Trends
5 Today s computer and network security mechanisms are like the walls, moats, and drawbridges of medieval times. At one point, effective for defending against isolated attacks, mounted on horseback. Unfortunately, today s attackers have access to airplanes and laser-guided bombs! Defending castles is passé
6 Attaining software security gets harder The Trinity of Trouble n n n Connectivity n The Internet is everywhere and most software is on it Complexity n Networked, distributed, mobile code is hard Extensibility n Systems evolve in unexpected ways and are changed on the fly issimple this complex program This interface
7 Social networking technology Twitter Facebook Myspace AIM Wave/buzz Orkut Tumblr Risk tradeoffs are very interesting and often counter-intuitive Spearfishing anyone? Security and social networking All 20-somethings expect this stuff---at work! is hacking around controls a "gateway drug"? is there a line between purely social interaction and professional interaction? is there a parallel to the history of phones in the workplace? how about ?
8 Mobile security Think the Internet Is big? There are approximately 1,000,000,000 people on the internet There are approximately 3,000,000,000 mobile handsets in use What sort of attack surface, computational power, and force multiplication do cell phones and their apps have? Friday, September 30,
9 Internet connectivity Data convergence Contacts, SMS, Pictures, Location VPN keys?! Location based services A mobile device is a rich target for snoops Attackers know where you are Theft or loss How does a user revoke their own phone/pad? Who do they call? HOW do they call them? Mobile risks
10 Example: Phishing at the app store Many publishers have sent in applications purporting to be for mobile banking These applications simply prompt for usernames, passwords, PINs, or account numbers... This means the user is at the mercy of the application store s (lame) search function! 10
11 Cyberwar rears its head Using computer security attacks as weapons of war Reality Fake 1982 pipeline attack 2007 syrian reactor bombing 2010 stuxnet Estonia/Georgia ddos Chinese BGP error We all live in glass houses, so building security in is our only recourse
12 Malware Trends
13 Modern malicious code Zeus Banking Trojan toolkit Targets banking info Defeats multi-factor authentication with attacker in the browser pdf, and drive by download install using social network G2 Persistent web threat Zeus, Sinowal.CP, MPACK Wrap the browser in a VM Invincea
14 Malicious code for the cell phone = not new Blue tooth Blue Snarfing attack (Nov 2003) Connect and gain access silently w/o pairing Nokia 6310i (firmware 5.50) Sony Ericsson T610 (firmware R1A081) Disrupt a phone call Initiate a voice/data/fax call Hijack a phone call by forwarding speaker and microphone to attacker Read / Write Phonebook entries Read / Write Messages Send SMS to any number Send Fax to any number NOKIA Cabir virus (June 2004) Smartphones running on Symbian and Series 60 software Spreads by bluetooth Proof of concept Kills battery PHONE BOTNET?
15 Stuxnet Very sophisticated, targeted collection of malware Delivery 4 0days Stolen private keys USB injection Network C&C The PAYLOAD matters Inject code into a running control system Siemens SIMATIC PLC (step 7) Cyberwar? Natanz in Iran How to p0wn a Control System with Stuxnet (9/23/10)
16 The attacker s toolkit The standard attacker s toolkit has lots of (software analysis) stuff Disassemblers and decompilers Control flow and coverage tools APISPY32 Breakpoint setters and monitors Buffer overflow Shell code Rootkits
17 The apex of software exploit complete control of the machine Live in the kernel XP kernel rootkit in Exploiting Software See Hide files and directories by controlling access to process tables Provide control and access over the network Attacker s toolkit: rootkits Get into the EEPROM (hardware viruses)
18 The Future
19 Online games are a bellwether Online games (like World of Warcraft) have up to 900,000 simultaneous users on six continents 10,000,000 people subscribe to WoW 16,000,000+ play MMORPGs Clients and servers are massively distributed Time and state errors are rampant MMORPGs push the limits of software technology Modern distributed systems in other domains are evolving toward similar models SOA, Web 2.0 Time and state errors are the XSS of tomorrow
20 Thread hijacking in online games Used in a few WoW botting programs WoW.EXE MAIN THREAD INJECTED DLL RenderWorld(..) DETOUR PATCH Loops hundreds of times per second
21 super MAIN THREAD RenderWorld(..) HARDWARE BP uncloak INJECTED CODE PAGE MAIN THREAD branch CastSpellByID(.. ) ScriptExecute(.. ) ClearTarget(.. ) complete MSG MAIN THREAD RenderWorld(..) restore recloak
22 Classic arms race
23 Software Security
24 The bugs/flaws continuum gets() attacker in the middle BUGS FLAWS Architectural risk analysis Commercial SCA tools: Fortify, Ounce Labs, Coverity Customized static rules (Fidelity) Open source tools: ITS4, RATS, grep()
25 Code review Widespread Customized tools Training ARA Components help Apprenticeship Training Pen testing No longer solo Security testing Training Abuse cases and security requirements Training Touchpoints adoption
26 BSIMM: Software Security Measurement n n n n Real data from (42) real initiatives 81 measurements 11 over time McGraw, Chess, & Migues PlexLogic
27 Intel + 15 anonymous firms 27
28 Twelve things everybody does (well, 66%) Core activities identify gates know PII obligations awareness training data classification identify features security standards review security features static analysis tool QA boundary testing external pen testers good network security close ops bugs loop
29 Compare a firm with peers using the high water mark view Descriptive (not prescriptive) Incredible insight for planning BSIMM3 as a measuring stick
30 BSIMM2 to BSIMM3 n n n BSIMM3 released September 2011 under creative commons n n Italian and German translations available soon BSIMM is a yardstick n Use it to see where you stand n Use it to figure out what your peers do BSIMM3à BSIMM4 n BSIMM is growing n Target of 50 firms
31 Where to Learn More
32 informit & Justice League No-nonsense monthly security column by Gary McGraw In-depth thought leadership blog from the Cigital Principals Scott Matsumoto Gary McGraw Sammy Migues John Steven
33 IEEE Security & Privacy Magazine + Podcast Building Security In Software Security Best Practices column edited by John Steven
34 Software Security: the book How to DO software security Best practices Tools Knowledge Cornerstone of the Addison- Wesley Software Security Series
35 Cigital s Software Security Group invents and delivers Software Security See the Addison-Wesley Software Security series Send gem@cigital.com For more So now, when we face a choice between adding features and resolving security issues, we need to choose security. -Bill Gates
Cyber Security: Software Risk Management for Utilities
Cyber Security: Software Risk Management for Utilities Gary McGraw, Ph.D. Chief Technology Officer, Cigital Founded in 1992 to provide software security and software quality professional services Recognized
Software Security Touchpoint: Architectural Risk Analysis
Software Security Touchpoint: Architectural Risk Analysis Gary McGraw, Ph.D. Chief Technology Officer, Cigital Founded in 1992 to provide software security and software quality professional services Recognized
Exploiting Online Games: Cheating massively distributed systems
Exploiting Online Games: Cheating massively distributed systems Gary McGraw, Ph.D. CTO, Cigital http://www.cigital.com Cigital Founded in 1992 to provide software security and software quality professional
Scaling a Software Security Initiative: Lessons from the BSIMM
Scaling a Software Security Initiative: Lessons from the BSIMM GARY MCGRAW, PH.D. SEPTEMBER 29, 2014 @cigitalgem Gary McGraw, PH.D. Chief Technology Officer, Cigital Email: gem@cigital.com Cigital Providing
Software Security Testing: Seeking security in an insecure world
Software Security Testing: Seeking security in an insecure world Gary McGraw, Ph.D. CTO, Cigital http://www.cigital.com Software security is getting harder The Trinity of Trouble Connectivity The Internet
Who, What, Where, How: Five Big Questions in Mobile Security
Who, What, Where, How: Five Big Questions in Mobile Security Jacob West CTO, Fortify Products HP Enterprise Security Session ID: ASEC-R31 Session Classification: Intermediate Why is mobile security an
Lecture Embedded System Security A. R. Sadeghi, @TU Darmstadt, 2011 2012 Introduction Mobile Security
Smartphones and their applications have become an integral part of information society Security and privacy protection technology is an enabler for innovative business models Recent research on mobile
The Mobile Malware Problem
The Mobile Malware Problem Eddy Willems Security Evangelist G Data Security Labs Director Security Industry Relationships - EICAR eddy.willems@gdata.de Introduction Security Evangelist at G Data: Privately
FORBIDDEN - Ethical Hacking Workshop Duration
Workshop Course Module FORBIDDEN - Ethical Hacking Workshop Duration Lecture and Demonstration : 15 Hours Security Challenge : 01 Hours Introduction Security can't be guaranteed. As Clint Eastwood once
When a student leaves this intensive 5 day class they will have hands on understanding and experience in Ethical Hacking.
Ethical Hacking and Countermeasures Course Description: This class will immerse the student into an interactive environment where they will be shown how to scan, test, hack and secure their own systems.
5 Steps to Advanced Threat Protection
5 Steps to Advanced Threat Protection Agenda Endpoint Protection Gap Profile of Advanced Threats Consensus Audit Guidelines 5 Steps to Advanced Threat Protection Resources 20 Years of Chasing Malicious
Combating the Next Generation of Advanced Malware
Peter McNaull Director of Technical Marketing WatchGuard Combating the Next Generation of Advanced Malware Surviving APT Attacks Current State of AV Solutions Nearly 88% of malware morphs to evade signature-based
Detailed Description about course module wise:
Detailed Description about course module wise: Module 1: Basics of Networking and Major Protocols 1.1 Networks and its Types. 1.2 Network Topologies 1.3 Major Protocols and their Functions 1.4 OSI Reference
Web Application Worms & Browser Insecurity
Web Application Worms & Browser Insecurity Mike Shema Welcome Background Hacking Exposed: Web Applications The Anti-Hacker Toolkit Hack Notes: Web Security Currently working at Qualys
Secure Programming Lecture 9: Secure Development
Secure Programming Lecture 9: Secure Development David Aspinall, Informatics @ Edinburgh 24th February 2014 Outline Overview Lifecycle security touchpoints 1. Code review and repair 2. Architectural risk
In Building Security In, Gary McGraw proposes three pillars to use throughout the lifecycle: I: Applied Risk Management
Secure Programming Lecture 9: Secure Development David Aspinall, Informatics @ Edinburgh 24th February 2014 Outline Overview Lifecycle security touchpoints 1. Code review and repair 2. Architectural risk
Loophole+ with Ethical Hacking and Penetration Testing
Loophole+ with Ethical Hacking and Penetration Testing Duration Lecture and Demonstration: 15 Hours Security Challenge: 01 Hours Introduction Security can't be guaranteed. As Clint Eastwood once said,
Introduction. Secure Software Development 9/03/2015. Matias starts. Daan takes over. Matias takes over. Who are we? Round of introductions
Matias starts Who are we? Applying Static Analysis Matias Madou and Daan Raman, Leuven, Feb 27, 2015 1 At NVISO, I m responsible for the software security practice. Next to the client work, I also leads
Certified Ethical Hacker Exam 312-50 Version Comparison. Version Comparison
CEHv8 vs CEHv7 CEHv7 CEHv8 19 Modules 20 Modules 90 Labs 110 Labs 1700 Slides 1770 Slides Updated information as per the latest developments with a proper flow Classroom friendly with diagrammatic representation
Development Processes (Lecture outline)
Development*Process*for*Secure* So2ware Development Processes (Lecture outline) Emphasis on building secure software as opposed to building security software Major methodologies Microsoft's Security Development
Emerging Security Technological Threats
Emerging Security Technological Threats Jamie Gillespie Training and Education Team Leader, AusCERT About AusCERT Australia s national CERT Collect, monitor, advise on threats and vulnerabilities Incident
Ethical Hacking and Information Security. Foundation of Information Security. Detailed Module. Duration. Lecture with Hands On Session: 90 Hours
Ethical Hacking and Information Security Duration Detailed Module Foundation of Information Security Lecture with Hands On Session: 90 Hours Elements of Information Security Introduction As technology
Penetration Testing The Red Pill
Penetration Testing The Red Pill Mehis Hakkaja, Mait Peekma www.clarifiedsecurity.com Agenda What is security testing, penetration testing (pen-testing)? Why pentest? Threat landscape Web application attacks
VESZPROG ANTI-MALWARE TEST BATTERY
VESZPROG ANTI-MALWARE TEST BATTERY 2012 The number of threats increased in large measure in the last few years. A set of unique anti-malware testing procedures have been developed under the aegis of CheckVir
(General purpose) Program security. What does it mean for a pgm to be secure? Depends whom you ask. Takes a long time to break its security controls.
(General purpose) Program security These ideas apply also to OS and DB. Read Chapter 3. What does it mean for a pgm to be secure? Depends whom you ask. Takes a long time to break its security controls.
Security Evaluation CLX.Sentinel
Security Evaluation CLX.Sentinel October 15th, 2009 Walter Sprenger walter.sprenger@csnc.ch Compass Security AG Glärnischstrasse 7 Postfach 1628 CH-8640 Rapperswil Tel.+41 55-214 41 60 Fax+41 55-214 41
WHITE PAPER. Understanding How File Size Affects Malware Detection
WHITE PAPER Understanding How File Size Affects Malware Detection FORTINET Understanding How File Size Affects Malware Detection PAGE 2 Summary Malware normally propagates to users and computers through
Incident Response 101: You ve been hacked, now what?
Incident Response 101: You ve been hacked, now what? Gary Perkins, MBA, CISSP Chief Information Security Officer (CISO) Information Security Branch Government of British Columbia Agenda: threat landscape
Overview. Common Internet Threats. Spear Phishing / Whaling. Phishing Sites. Virus: Pentagon Attack. Viruses & Worms
Overview Common Internet Threats Tom Chothia Computer Security, Lecture 19 Phishing Sites Trojans, Worms, Viruses, Drive-bydownloads Net Fast Flux Domain Flux Infiltration of a Net Underground economy.
Department of Computer & Information Sciences. INFO-450: Information Systems Security Syllabus
Department of Computer & Information Sciences INFO-450: Information Systems Security Syllabus Course Description This course provides a deep and comprehensive study of the security principles and practices
Stuxnet Malware. Official communication presented at CIP Seminar 02-11-2010 by Thomas Brandstetter. Siemens AG 2010. All Rights Reserved.
Official communication presented at CIP Seminar 02-11-2010 by Thomas Brandstetter What is the Stuxnet and what can it do? Stuxnet is a high sophisticated malware that targets very specific configurations
CISA, CISM, CGEIT, CRISC COBIT Foundations Certificate CISSP, OSCP ITIL v3 Foundations Certificate
La nueva generación de vulnerabilidades d Casos Prácticos Ing Miguel Angel Aranguren Romero Ing. Miguel Angel Aranguren Romero CISA, CISM, CGEIT, CRISC COBIT Foundations Certificate CISSP, OSCP ITIL v3
Certified Cyber Security Expert V 2.0 + Web Application Development
Summer Training Program Certified Cyber Security Expert V + Web Application Development A] Training Sessions Schedule: Modules Ethical Hacking & Information Security Particulars Duration (hours) Ethical
Ethical Hacking & Cyber Security Workshop
Ethical Hacking & Cyber Security Workshop i3indya Technologies (A unit of ithree Infotech Pvt. Ltd.) Delhi Office: 37, First Floor, Defence Enclave, Preet Vihar, New Delhi-110092 Contact us: Email: info@i3indya.com
Botnets Die Hard Owned and Operated
Botnets Die Hard Owned and Operated,,, Las Vegas, 2012 Aditya K Sood Richard J Enbody SecNiche Security Department of Computer Science and Engineering Michigan State University Aditya K Sood About Us PhD
Innovations in Network Security
Innovations in Network Security Michael Singer April 18, 2012 AT&T, the AT&T logo and all other AT&T marks contained herein are trademarks of AT&T Intellectual Property and/or AT&T affiliated companies.
Post-Stuxnet Industrial Security: Zero-Day Discovery and Risk Containment of Industrial Malware
Post-Stuxnet Industrial Security: Zero-Day Discovery and Risk Containment of Industrial Malware A White Paper presented by: Torsten Rössel Director of Business Development Innominate Security Technologies
Analysis of advanced issues in mobile security in android operating system
Available online atwww.scholarsresearchlibrary.com Archives of Applied Science Research, 2015, 7 (2):34-38 (http://scholarsresearchlibrary.com/archive.html) ISSN 0975-508X CODEN (USA) AASRC9 Analysis of
Security+ Guide to Network Security Fundamentals, Third Edition. Chapter 2 Systems Threats and Risks
Security+ Guide to Network Security Fundamentals, Third Edition Chapter 2 Systems Threats and Risks Objectives Describe the different types of software-based attacks List types of hardware attacks Define
Mobile Application Security Sharing Session May 2013
Mobile Application Security Sharing Session Agenda Introduction of speakers Mobile Application Security Trends and Challenges 5 Key Focus Areas for an mobile application assessment 2 Introduction of speakers
A Systems Engineering Approach to Developing Cyber Security Professionals
A Systems Engineering Approach to Developing Cyber Security Professionals D r. J e r r y H i l l Approved for Public Release; Distribution Unlimited. 13-3793 2013 The MITRE Corporation. All rights reserved.
Jort Kollerie SonicWALL
Jort Kollerie Cloud 85% of businesses said their organizations will use cloud tools moderately to extensively in the next 3 years. 68% of spend in private cloud solutions. - Bain and Dell 3 Confidential
Security Testing in Critical Systems
Security Testing in Critical Systems An Ethical Hacker s View Peter Wood Chief Executive Officer First Base Technologies Who is Peter Wood? Worked in computers & electronics since 1969 Founded First Base
Trends in Malware DRAFT OUTLINE. Wednesday, October 10, 12
Trends in Malware DRAFT OUTLINE Presentation Synopsis Security is often a game of cat and mouse as security professionals and attackers each vie to stay one step ahead of the other. In this race for dominance,
It s 2 o clock: Who Has Your Data? Josh Krueger Chief Technology Officer Integrity Technology Solutions
It s 2 o clock: Who Has Your Data? Josh Krueger Chief Technology Officer Integrity Technology Solutions Your home is your business and your farm is your network. But who has access to it? Can you protect
Attacks from the Inside
Attacks from the Inside Eddy Willems, G Data Righard J. Zwienenberg, Norman Attacks from the Inside. Agenda - Social Networking / Engineering - Where are the threats coming from - Infection vectors - The
Top five strategies for combating modern threats Is anti-virus dead?
Top five strategies for combating modern threats Is anti-virus dead? Today s fast, targeted, silent threats take advantage of the open network and new technologies that support an increasingly mobile workforce.
Five Trends to Track in E-Commerce Fraud
Five Trends to Track in E-Commerce Fraud Fraud is nothing new if you re in the e-commerce business you probably have a baseline level of fraud losses due to stolen credit cards, return fraud and other
The Key to Secure Online Financial Transactions
Transaction Security The Key to Secure Online Financial Transactions Transferring money, shopping, or paying debts online is no longer a novelty. These days, it s just one of many daily occurrences on
Certified Ethical Hacker (CEH) Ethical Hacking & Counter Measures Course 9962; 5 Days, Instructor-Led
Certified Ethical Hacker (CEH) Ethical Hacking & Counter Measures Course 9962; 5 Days, Instructor-Led Course Description This class will immerse the student into an interactive environment where they will
Windows Operating Systems. Basic Security
Windows Operating Systems Basic Security Objectives Explain Windows Operating System (OS) common configurations Recognize OS related threats Apply major steps in securing the OS Windows Operating System
Post-Stuxnet Industrial Security
Post-Stuxnet Industrial Security Zero-Day Discovery and Risk Containment of Industrial Malware with Innominate mguard Technology Introduction Following its discovery in June 2010, the Stuxnet worm triggered
Advancements in Botnet Attacks and Malware Distribution
Advancements in Botnet Attacks and Malware Distribution HOPE Conference, New York, July 2012 Aditya K Sood Rohit Bansal Richard J Enbody SecNiche Security Department of Computer Science and Engineering
The Leading Provider of Endpoint Security Solutions
The Leading Provider of Endpoint Security Solutions Innovative Policies to Defend Against Next-Generation Threats Conrad Herrmann CTO and Co-Founder Zone Labs, Inc. Network Security Is an Uphill Battle
THE HACKERS NEXT TARGET
Governance and Risk Management THE HACKERS NEXT TARGET YOUR WEB AND SOFTWARE Anthony Lim MBA CISSP CSSLP FCITIL Director, Security, Asia Pacific Rational Software ISC2 CyberSecurity Conference 09 Kuala
A Network Administrator s Guide to Web App Security
A Network Administrator s Guide to Web App Security Speaker: Orion Cassetto, Product Marketing Manager, Incapsula Moderator: Rich Nass, OpenSystems Media Agenda Housekeeping Presentation Questions and
Anthony Minnaar Dept of Criminology & Security Science School of Criminal Justice College of Law University of South Africa
SECURING THE DIGITAL DIVIDE: COMBATING CYBERCRIME Anthony Minnaar Dept of Criminology & Security Science School of Criminal Justice College of Law University of South Africa INTRODUCTION q Given modern
Enterprise Mobile Threat Report
Enterprise Mobile Threat Report The State of ios and Android Security Threats to Enterprise Mobility I. Introduction This report examines enterprise security threats for ios and Android. While Android
Trust Digital Best Practices
> ARMING IT AGAINST SMARTPHONE THREATS Trust Digital Best Practices April 2009 The information contained herein is subject to change at any time, and Trust Digital makes no warranties, either express or
RMAR Technologies Pvt. Ltd.
Course Name : StartXHack V2.0 Ethical Hacking & Cyber Security Course Duration : 2 Days (8Hrs./day) Course Fee : INR 1000/participant Course Module : 1. Introduction to Ethical Hacking a. What is Ethical
The Silver Bullet Security Podcast, episode 21: A Panel Discussion with Cigital s Principals
The Silver Bullet Security Podcast, episode 21: A Panel Discussion with Cigital s Principals Listen to this show at http://www.cigital.com/silverbullet/show-021/ Gary McGraw: This is a Silver Bullet security
IBM Smarter Cities Cybersecurity Update
IBM Smarter Cities Cybersecurity Update October 2012 Kent Blossom, Vice President, IBM Security Solutions kblossom@us.ibm.com 1 Discussion Topics IBM Security Systems Evolving Client Priorities & Approaches
Tutorial on Smartphone Security
Tutorial on Smartphone Security Wenliang (Kevin) Du Professor wedu@syr.edu Smartphone Usage Smartphone Applications Overview» Built-in Protections (ios and Android)» Jailbreaking and Rooting» Security
Indian Computer Emergency Response Team (CERT-In) Annual Report (2010)
Indian Computer Emergency Response Team (CERT-In) Annual Report (2010) Indian Computer Emergency Response Team (CERT-In) Department of Information Technology Ministry of Communications & Information Technology
Application Code Development Standards
Application Code Development Standards Overview This document is intended to provide guidance to campus system owners and software developers regarding secure software engineering practices. These standards
Intel Cyber-Security Briefing: Trends, Solutions, and Opportunities
Intel Cyber-Security Briefing: Trends, Solutions, and Opportunities John Skinner, Director, Secure Enterprise and Cloud, Intel Americas, Inc. May 2012 Agenda Intel + McAfee: What it means Computing trends
OCT Training & Technology Solutions Training@qc.cuny.edu (718) 997-4875
OCT Training & Technology Solutions Training@qc.cuny.edu (718) 997-4875 Understanding Information Security Information Security Information security refers to safeguarding information from misuse and theft,
Your Web and Applications
Governance and Risk Management Your Web and Applications The Hacker s New Target Anthony Lim MBA CISSP CSSLP FCITIL Director, Security, Asia Pacific Rational Software Social Engineering in the Business
Agenda. John Veldhuis, Sophos The playing field Threats Mobile Device Management. Pagina 2
Mobile Security Agenda John Veldhuis, Sophos The playing field Threats Mobile Device Management Pagina 2 The Changing Mobile World Powerful devices Access everywhere Mixed ownership User in charge Powerful
CEH Version8 Course Outline
CEH Version8 Course Outline Module 01: Introduction to Ethical Hacking Information Security Overview Information Security Threats and Attack Vectors Hacking Concepts Hacking Phases Types of Attacks Information
Thanks for showing interest in Vortex IIT Delhi & What After College (WAC) Ethical Hacking Workshop.
Thanks for showing interest in Vortex IIT Delhi & What After College (WAC) Ethical Hacking Workshop. Our aim is to address the students apprehensions and anxieties regarding their career prospects in Ethical
FERPA: Data & Transport Security Best Practices
FERPA: Data & Transport Security Best Practices April 2013 Mike Tassey Privacy Technical Assistance Center FERPA and Data Security Unlike HIPAA and other similar federal regulations, FERPA does not require
COURSE NAME: INFORMATION SECURITY INTERNSHIP PROGRAM
COURSE NAME: INFORMATION SECURITY INTERNSHIP PROGRAM Course Description This is the Information Security Training program. The Training provides you Penetration Testing in the various field of cyber world.
BlackBerry Device Software. Protecting BlackBerry Smartphones Against Malware. Security Note
BlackBerry Device Software Protecting BlackBerry Smartphones Against Malware Security Note Published: 2012-05-14 SWD-20120514091746191 Contents 1 Protecting smartphones from malware... 4 2 System requirements...
Promoting Network Security (A Service Provider Perspective)
Promoting Network Security (A Service Provider Perspective) Prevention is the Foundation H S Gupta DGM (Technical) Data Networks, BSNL hsgupta@bsnl.co.in DNW, BSNL 1 Agenda Importance of Network Security
WEB ATTACKS AND COUNTERMEASURES
WEB ATTACKS AND COUNTERMEASURES February 2008 The Government of the Hong Kong Special Administrative Region The contents of this document remain the property of, and may not be reproduced in whole or in
A Critical Investigation of Botnet
Global Journal of Computer Science and Technology Network, Web & Security Volume 13 Issue 9 Version 1.0 Year 2013 Type: Double Blind Peer Reviewed International Research Journal Publisher: Global Journals
MODERN THREATS DRIVE DEMAND FOR NEW GENERATION MULTI-FACTOR AUTHENTICATION
Whitepaper MODERN THREATS DRIVE DEMAND FOR NEW GENERATION MULTI-FACTOR AUTHENTICATION A SURVEY SHOWS THAT 90% OF ALL COMPANIES HAD BEEN BREACHED IN THE LAST 12 MONTHS. THIS PAIRED WITH THE FACT THAT THREATS
Smartphone Botnets. Berlin Institute of Technology FG Security in Telecommunications SPRING 2010
Berlin Institute of Technology FG Security in Telecommunications Smartphone Botnets SPRING 2010 Weiss Collin Mulliner, July 7 th 2010 collin@sec.t-labs.tu-berlin.de Agenda Introduction Motivation Project
Workshop on Infrastructure Security and Operational Challenges of Service Provider Networks
Workshop on Infrastructure Security and Operational Challenges of Service Provider Networks Farnam Jahanian University of Michigan and Arbor Networks IFIP Working Group 10.4 June 29-30, 2006 What s the
WHITE PAPER Security in M2M Communication What is secure enough?
WHITE PAPER Security in M2M Communication What is secure enough? Motivation Wireless Machine-To-Machine (M2M) communication has grown dramatically over the past decade and is still growing rapidly. In
Enterprise Cybersecurity Best Practices Part Number MAN-00363 Revision 006
Enterprise Cybersecurity Best Practices Part Number MAN-00363 Revision 006 April 2013 Hologic and the Hologic Logo are trademarks or registered trademarks of Hologic, Inc. Microsoft, Active Directory,
The Increasing Threat of Malware for Android Devices. 6 Ways Hackers Are Stealing Your Private Data and How to Stop Them
The Increasing Threat of Malware for Android Devices 6 Ways Hackers Are Stealing Your Private Data and How to Stop Them INTRODUCTION If you own a smartphone running the Android operating system, like the
Mobile Banking. Secure Banking on the Go. Matt Hillary, Director of Information Security, MX
Mobile Banking Secure Banking on the Go Matt Hillary, Director of Information Security, MX Mobile Banking Channels SMS / Texting Mobile Banking Channels Mobile Web Browser Mobile Banking Channels Mobile
Malware. Björn Victor 1 Feb 2013. [Based on Stallings&Brown]
![Malware. Björn Victor 1 Feb 2013. [Based on Stallings&Brown]](/thumbs/40/20589514.jpg "Malware. Björn Victor 1 Feb 2013. [Based on Stallings&Brown]")
Malware Björn Victor 1 Feb 2013 Ask Sofia if anything is unclear/too difficult with the lab. Coordinate meetings between you? BadStore: demo version New York Times, Wall Street Journal attacks from China,
10 Smart Ideas for. Keeping Data Safe. From Hackers
0100101001001010010001010010101001010101001000000100101001010101010010101010010100 0100101001001010010001010010101001010101001000000100101001010101010010101010010100000 0100101001001010010001010010101001010101001000000100101001010101010010101010010100000
Information Security. CS526 Topic 1
Information Security CS 526 Topic 1 Overview of the Course 1 Today s Security News Today: 220 million records stolen, 16 arrested in massive South Korean data breach A number of online gaming & movie ticket
Securing your Mobile Applications. Karson Chan Security Consultant
Securing your Mobile Applications Karson Chan Security Consultant NTT Com Security Threat can come from anywhere that s why we are everywhere 1,000+ Staff Our knowledge is your security 8,000+ Customers
[CEH]: Ethical Hacking and Countermeasures
![[CEH]: Ethical Hacking and Countermeasures](/thumbs/25/6744290.jpg "[CEH]: Ethical Hacking and Countermeasures")
[CEH]: Ethical Hacking and Countermeasures Length Audience(s) Delivery Method : 5 days : This course will significantly benefit security officers, auditors, security professionals, site administrators,
Internet Banking Attacks. Karel Miko, CISA DCIT, a.s. (Prague, Czech Republic) miko@dcit.cz
Internet Banking Attacks Karel Miko, CISA DCIT, a.s. (Prague, Czech Republic) miko@dcit.cz Contents Agenda Internet banking today The most common attack vectors The possible countermeasures What protection
Securing mobile devices in the business environment
IBM Global Technology Services Thought Leadership White Paper October 2011 Securing mobile devices in the business environment By I-Lung Kao, Global Strategist, IBM Security Services 2 Securing mobile
INDUSTRIAL CONTROL SYSTEMS CYBER SECURITY DEMONSTRATION
INDUSTRIAL CONTROL SYSTEMS CYBER SECURITY DEMONSTRATION Prepared for the NRC Fuel Cycle Cyber Security Threat Conference Presented by: Jon Chugg, Ken Rohde Organization(s): INL Date: May 30, 2013 Disclaimer
Smartphone Security. A Holistic view of Layered Defenses. David M. Wheeler, CISSP, CSSLP, GSLC. (C) 2012 SecureComm, Inc. All Rights Reserved
Smartphone Security A Holistic view of Layered Defenses David M. Wheeler, CISSP, CSSLP, GSLC 1 The Smartphone Market The smartphone security market is expected to grow at a rate of 44 percent annually
I Hunt Penetration Testers!
I Hunt Penetration Testers! More Weaknesses in Tools and Procedures Wesley McGrew, Ph.D. Distributed Analytics and Security Institute Mississippi State University http://mcgrewsecurity.com wesley@mcgrewsecurity.com
Ohio University Computer Services Center October, 2004 Spyware, Adware, and Virus Guide
Ohio University Computer Services Center October, 2004 Spyware, Adware, and Virus Guide Definitions Malware is term meaning malicious software. Malware is software designed to disrupt a computer system.
OPC & Security Agenda
OPC & Security Agenda Cyber Security Today Cyber Security for SCADA/IS OPC Security Overview OPC Security Products Questions & Answers 1 Introduction CYBER SECURITY TODAY The Need for Reliable Information
APPLICATION SECURITY: FROM WEB TO MOBILE. DIFFERENT VECTORS AND NEW ATTACK
APPLICATION SECURITY: FROM WEB TO MOBILE. DIFFERENT VECTORS AND NEW ATTACK John T Lounsbury Vice President Professional Services, Asia Pacific INTEGRALIS Session ID: MBS-W01 Session Classification: Advanced
Security threats and attackers are turning
SECURITY Application Security: Countering The Professionals Robin Layland Robin Layland is president of Layland Consulting, a firm that specializes in network architecture and new technology. He has more
Network Security in Building Networks
Network Security in Building Networks Prof. Dr. (TU NN) Norbert Pohlmann Institute for Internet Security - if(is) Westphalian University of Applied Sciences Gelsenkirchen, Germany www.if-is.net Content
CS 356 Lecture 9 Malicious Code. Spring 2013
CS 356 Lecture 9 Malicious Code Spring 2013 Review Chapter 1: Basic Concepts and Terminology Integrity, Confidentiality, Availability, Authentication, and Accountability Types of threats: active vs. passive,