Evolution of Penetration Testing
|
|
- Franklin Evans
- 8 years ago
- Views:
Transcription
1 Alexander Polyakov, QSA,PA-QSA CTO Digital Security (dsec.ru) Head of DSecRG (dsecrg.com) ERPSCAN Architect (erpscan.com) Head of OWASP-EAS
2 Pentests? Again? Why? Many companies are doing this Many companies need this (PCI DSS) Still many questions 2
3 Pentest 101 A penetration test, occasionally pentest, is a method of evaluating the security of a computer system or network by simulating an attack from a malicious source, known as a Black Hat Hacker, or Cracker. The process involves an active analysis of the system for any potential vulnerabilities that could result from poor or improper system configuration, both known and unknown hardware or software flaws, or operational weaknesses in process or technical countermeasures. Wikipedia 3
4 Is It Enough? We have gained unauthorized access to your corporate environment by sending an with social engineering text and 0-day for Adobe. Is it ok to show only one Way? Is it ok if your doctor talks only about neck pain? There is an obvious need to show ALL POSSIBLE WAYS 4
5 Why is It Enough? Can you guarantee that after you ve patched ALL vulnerabilities nobody will hack us? Even doctor Haus is mistaken That is why you need to make pentests regularly That is why you need to think twice before choosing a contractor 5
6 Purpose??? Let s look through the evolution 6
7 First Era before 2000 Objects Network, OS Purpose Penetration from the Internet Methods Not formal, State of art Teaching Blackhat methodologies, Improving the security of your site by breaking into it, Dan Farmer & Wietse Venema, 1993 Result of Pentest Screenshots with shell and couple of words 7
8 First Era Why? To prove that networks are vulnerable (many people do not believe it) Why now? To show the business that there is a need in security (pre-sales) C in PDCA if you have PDCA 8
9 After 2000 Era 2 VIVA LA WEB Objects Network, OS,WEB Purpose Methods Teaching Penetration from the Internet Hacking WEB-site The first version of OSSTMM, Programs like CORE IMPACT Different books (hacking exposed), conference materials Result of Pentest Report with vulnerabilities and their countermeasures 9
10 Second Era Why? More complex pentest Why now? To show the business that there is a need in security (pre-sales) Part of SDLC for WEB development after secure development and code analysis PCI DSS 10
11 Middle 2000 Third Era Objects Networks, OS, DBMS, Applications, ERP, Mobile,.. Wireless, SCADA, Users (social engineering) Internal pentesting, Purpose Deep assessment of a application or technology Firewall pentesting, Cloud pentesting, ALL Methods WEB pentesting, OSTMM, NIST, ISSAF. Database THAT pentesting OWASP, WASC, OWASP-EAS.. SAP pentesting, Teaching YOU WIFI pentesting, Certifications: CEH, CREST, CPT, GPEN.. SS7 pentesting, WANT Training: Blackhat/HITB/Offensive security SCADA pentesting, Result of pentest Standardized reports with the list of GSM pentesting, vulnerabilities, their risks and countermeasures Mobile pentesting 11
12 Third Era Why now? Network is good and there is a need to assess security more deeply Deep segregation inside a company (a clerk with DBA access ) Part of PDCA for Application/Technology implementation 12
13 2010 HOUSTON, WE'VE GOT A PROBLEM Do we know more about current threats? Have we become more secure?? Does the business understand all security risks? 13
14 They don t care about us )) Business making business If it doesn t bring money we don t need this If they don t understand us it means that we explain it incorrectly 14
15 Technical Fail We don t use SAP. All business migrates to JDE. 15
16 Business Fail We ve found 5 critical vulnerabilities. You can read about them and the countermeasures in the report. What is this? Just 10 pages? For the money I pay you it must be 10 times more! 16
17 Business Fail We ve found a vulnerability in DC that can give unauthorized access to the server. We have the latest antivirus that makes us secure. 17
18 Technical Fail We ve found a buffer overflow vulnerability at the server which can be used to run the code execution, making possible to bypass ASLR and DEP countermeasures. See the screenshot for the results. DOS box? We don t use DOS :) 18
19 Technical Fail We ve found a XSS vulnerability in the payment system and we can gain access to user accounts. All money transfers are confirmed by SMS. This vulnerability is not so critical. 19
20 What s Next? Era 4 Business-oriented pentest Purpose show how technical vulnerabilities can be used for business threats Instead of Integrity, Availability Confidentiality Espionage, Sabotage and Fraud I don t care about exploits, show to steal money? 20
21 Example 1 We have: Internal user inside a company, with no knowledge Purpose: Find the ways of stealing money 21
22 Classic Payment Scheme SAP File server All is analyzed using Blackbox Bank Net Accountant Client-Bank 22
23 Example 2 We have: Business-critical system for gasoline sales Purpose: Find technical vulnerabilities and show how they can be used for fraud in the system 23
24 Scheme of Gasoline Station Some help needed GreyBox Managing server Database Terminal Gasoline station 24
25 Example 3 We Have: Payment system Purpose: Find technical vulnerabilities that can be used for fraud and money stealing in the system 25
26 Payment System Analysis Found XSS vulnerability Binding of the session to IP (cannot just steal the cookies) Money sending needs SMS confirmation Function found for issuing an invoice Find XSS in receipt request information field User can approve the receipt or not Using XSS + XSRF we can automatically approve the receipt As a result user loses money by clicking on the receipt 26
27 Example 4 We have: SAP system inside a company Purpose: Need to gain access to critical data through the Internet 27
28 Attacking SAP Users Sending an with social engineering link Link consists of exploits for SAPGUI Exploit gains access to user workstation Collects the saplogon.ini info Connects to the SAP servers using default passwords, passwords in shortcuts and bruteforce Gains critical data (user password hashes and banking accounts) Sends it to the server More on Sapsploit Tool by DSecRG automates all these things Presentation from HITB Conference 28
29 Forth Era Business-oriented Pentest Objects Purpose Methodology Teaching Business-critical systems Show how technical vulnerabilities can be used for business threats OSTMM, NIST, ISSAF + business process analysis All that we have plus business-process analysis, specific knowledge of business area Result of Pentest Report that shows real business risks which can cause Fraud, Sabotage and Espionage 29
30 Problems and Things for the Next Presentations Contractors Need additional professional knowledge in business area for pentesters Need more complex checks of business logic Lack methodologies Clients Need to engage personnel Raise legal issues of access to data 30
31 Conclusion Business must understand that: Hackers are ready to learn something new Hackers are the only ones that can help to secure systems from cybercrimes 31
32 Conclusion Hackers must: Know more about business processes and business needs Speak the business language 32
33 Both Respect and understand problems of each other Understand that both have the same aims 33
34 Respect to all these guys and their presentations (by timeline) Tactical Exploitation By Val Smith & HDM (Blackhat 2007) The pentest is dead, long live the pentest! By Taylor Banks & Carric (Defcon 16) Why Black Hats Always Win By Val Smith & Cris (Blackhat 2010) Security Chasm By Anton Chuvakin (HITB AMS 2010) Building Bridges: Forcing Hackers and Business to "Hug it Out By Andrew Hay & Chris Nickerson (SourceBarcelona 2010) 34
35 Questions??? Mail: Twitter: Blog: dsecrg.blogspot.com (in Russian (in Russian 35
Security Testing. Vulnerability Assessment vs Penetration Testing. Gabriel Mihai Tanase, Director KPMG Romania. 29 October 2014
Security Testing Vulnerability Assessment vs Penetration Testing Gabriel Mihai Tanase, Director KPMG Romania 29 October 2014 Agenda What is? Vulnerability Assessment Penetration Testing Acting as Conclusion
More informationPenetration Testing in Romania
Penetration Testing in Romania Adrian Furtunǎ, Ph.D. 11 October 2011 Romanian IT&C Security Forum Agenda About penetration testing Examples Q & A 2 What is penetration testing? Method for evaluating the
More informationKASPERSKY SECURITY INTELLIGENCE SERVICES. EXPERT SERVICES. www.kaspersky.com
KASPERSKY SECURITY INTELLIGENCE SERVICES. EXPERT SERVICES www.kaspersky.com EXPERT SERVICES Expert Services from Kaspersky Lab are exactly that the services of our in-house experts, many of them global
More informationSECURITY TRENDS & VULNERABILITIES REVIEW 2015
SECURITY TRENDS & VULNERABILITIES REVIEW 2015 Contents 1. Introduction...3 2. Executive summary...4 3. Inputs...6 4. Statistics as of 2014. Comparative study of results obtained in 2013...7 4.1. Overall
More informationWhere every interaction matters.
Where every interaction matters. Peer 1 Vigilant Web Application Firewall Powered by Alert Logic The Open Web Application Security Project (OWASP) Top Ten Web Security Risks and Countermeasures White Paper
More informationEAS-SEC Project: Securing Enterprise Business Applications
EAS-SEC Project: Securing Enterprise Business Applications SESSION ID: SEC-W06 Alexander Polyakov CTO ERPScan @Twitter sh2kerr Alexander Polyakov CTO of the ERPScan inc EAS-SEC.org President Business application
More informationForgotten World: Corporate Business Application Systems
Forgotten World: Corporate Business Application Systems Alexander Polyakov (dsecrg.com) Val Smith (AttackResearch.com) BlackHat DC 2011 1. Abstract... 3 2. Intro... 4 2.1. Threat... 4 2.2. Introduction
More informationPassing PCI Compliance How to Address the Application Security Mandates
Passing PCI Compliance How to Address the Application Security Mandates The Payment Card Industry Data Security Standards includes several requirements that mandate security at the application layer. These
More informationLEADING CYBER SECURITY AND PENETRATION TESTING COMPANY
LEADING CYBER SECURITY AND PENETRATION TESTING COMPANY www.secupent.com service@secupent.com WEBSITE PENETRATION TESTING Do you know in the modern era websites and related applications are tantalizing
More informationERP Security. Myths, Problems, Solutions
ERP Security. Myths, Problems, Solutions Digital Security Ilya Medvedovskiy CEO of the Digital Security company Network security research since 1994 (NoVell networks) Book bestseller Attack through the
More informationPenetration: from Application down to OS
April 13, 2010 Penetration: from Application down to OS Getting OS Access Using Lotus Domino Application Server Vulnerabilities Digitаl Security Research Group (DSecRG) www.dsecrg.com Alexandr Polyakov.
More informationAbout Effective Penetration Testing Methodology
보안공학연구논문지 (Journal of Security Engineering), 제 5권 제 5호 2008년 10월 About Effective Penetration Testing Methodology Byeong-Ho KANG 1) Abstract Penetration testing is one of the oldest methods for assessing
More informationTop 10 most interesting SAP vulnerabilities and attacks Alexander Polyakov
Invest in security to secure investments Top 10 most interesting SAP vulnerabilities and attacks Alexander Polyakov CTO at ERPScan May 9, 2012 Me Business application security expert What is SAP? Shut
More informationSECURITY B-SIDES: ATLANTA STRATEGIC PENETRATION TESTING. Presented by: Dave Kennedy Eric Smith
SECURITY B-SIDES: ATLANTA STRATEGIC PENETRATION TESTING Presented by: Dave Kennedy Eric Smith AGENDA Penetration Testing by the masses Review of current state by most service providers Deficiencies in
More informationPentesting for fun... and profit! David M. N. Bryan and Rob Havelt
Pentesting for fun... and profit! David M. N. Bryan and Rob Havelt Agenda Who are David & Rob? Why are we experts? Why do penetration tests? What is a penetration test? What is the goal? Some says it s
More informationCORE Security and the Payment Card Industry Data Security Standard (PCI DSS)
CORE Security and the Payment Card Industry Data Security Standard (PCI DSS) Addressing the PCI DSS with Predictive Security Intelligence Solutions from CORE Security CORE Security +1 617.399-6980 info@coresecurity.com
More informationNorth Dakota 2013 IT Security Audit Vulnerability Assessment & Penetration Test Project Briefing
North Dakota 2013 IT Security Audit Vulnerability Assessment & Penetration Test Project Briefing Introduction ManTech Project Manager Mark Shaw, Senior Executive Director Cyber Security Solutions Division
More informationHow Security Testing can ensure Your Mobile Application Security. Yohannes, CEHv8, ECSAv8, ISE, OSCP(PWK) Information Security Consultant
How Security Testing can ensure Your Mobile Application Security Yohannes, CEHv8, ECSAv8, ISE, OSCP(PWK) Information Security Consultant Once More Consulting & Advisory Services IT Governance IT Strategic
More informationPenetration Testing Service. By Comsec Information Security Consulting
Penetration Testing Service By Consulting February, 2007 Background The number of hacking and intrusion incidents is increasing year by year as technology rolls out. Equally, there is no hiding place your
More informationProfessional Penetration Testing Techniques and Vulnerability Assessment ...
Course Introduction Today Hackers are everywhere, if your corporate system connects to internet that means your system might be facing with hacker. This five days course Professional Vulnerability Assessment
More informationSecuring Your Web Application against security vulnerabilities. Ong Khai Wei, IT Specialist, Development Tools (Rational) IBM Software Group
Securing Your Web Application against security vulnerabilities Ong Khai Wei, IT Specialist, Development Tools (Rational) IBM Software Group Agenda Security Landscape Vulnerability Analysis Automated Vulnerability
More informationWEB APPLICATION VULNERABILITY STATISTICS (2013)
WEB APPLICATION VULNERABILITY STATISTICS (2013) Page 1 CONTENTS Contents 2 1. Introduction 3 2. Research Methodology 4 3. Summary 5 4. Participant Portrait 6 5. Vulnerability Statistics 7 5.1. The most
More informationDevice Hardening, Vulnerability Remediation and Mitigation for Security Compliance
Device Hardening, Vulnerability Remediation and Mitigation for Security Compliance Produced on behalf of New Net Technologies by STEVE BROADHEAD BROADBAND TESTING 2010 broadband testing and new net technologies
More informationExternal Supplier Control Requirements
External Supplier Control s Cyber Security For Suppliers Categorised as Low Cyber Risk 1. Asset Protection and System Configuration Barclays Data and the assets or systems storing or processing it must
More informationMaking your web application. White paper - August 2014. secure
Making your web application White paper - August 2014 secure User Acceptance Tests Test Case Execution Quality Definition Test Design Test Plan Test Case Development Table of Contents Introduction 1 Why
More informationIf I want a perfect cyberweapon, I'll target ERP
If I want a perfect cyberweapon, I'll target ERP Alexander Polyakov / ERPScan Session ID: ADS-R07 Session Classification: Advanced Intro I hate CYBER talks and all that buzz I usually do more technical
More informationThe SAProuter An Internet Window to your SAP Platform (and beyond)
The SAProuter An Internet Window to your SAP Platform (and beyond) July 2, 2010 HITBSecConf, Amsterdam Disclaimer This publication is copyright 2010 Onapsis SRL All rights reserved. No portion of this
More informationIntroduction to Web Application Security. Microsoft CSO Roundtable Houston, TX. September 13 th, 2006
Introduction to Web Application Security Microsoft CSO Roundtable Houston, TX September 13 th, 2006 Overview Background What is Application Security and Why Is It Important? Examples Where Do We Go From
More informationApplication Backdoor Assessment. Complete securing of your applications
Application Backdoor Assessment Complete securing of your applications Company brief BMS Consulting is established as IT system integrator since 1997 Leading positons in Eastern Europe country Product
More informationWeb Engineering Web Application Security Issues
Security Issues Dec 14 2009 Katharina Siorpaes Copyright 2009 STI - INNSBRUCK www.sti-innsbruck.at It is NOT Network Security It is securing: Custom Code that drives a web application Libraries Backend
More informationPenetration Testing - a way for improving our cyber security
OWASP EU Tour Bucharest 2013 The OWASP Foundation http://www.owasp.org Penetration Testing - a way for improving our cyber security Adrian Furtunǎ, PhD, OSCP, CEH adif2k8@gmail.com Copyright The OWASP
More informationITEC441- IS Security. Chapter 15 Performing a Penetration Test
1 ITEC441- IS Security Chapter 15 Performing a Penetration Test The PenTest A penetration test (pentest) simulates methods that intruders use to gain unauthorized access to an organization s network and
More informationIs your Web Application. "Hacking Proof"?
w Hackers Locked Security Testing Services v Is your Web Application Hackers Locked Security Testing Services "Hacking Proof"? Hackers Locked Penettrattiion Testtiing Serviices www.hackerslocked.com HL
More informationAttacks to SAP. Web Applications Your crown jewels online. Mariano Nuñez Di Croce. Troopers, Germany. March 30th, 2011. mnunez@onapsis.
Attacks to SAP Web Applications Your crown jewels online Mariano Nuñez Di Croce mnunez@onapsis.com March 30th, 2011 Troopers, Germany Disclaimer This publication is copyright 2011 Onapsis SRL All rights
More informationSimple Steps to Securing Your SSL VPN
Simple Steps to Securing Your SSL VPN A five-point strategy for secure remote access Managing secure remote access is a tough job. Because remote systems may directly connect to the Internet rather than
More informationNetwork Security Audit. Vulnerability Assessment (VA)
Network Security Audit Vulnerability Assessment (VA) Introduction Vulnerability Assessment is the systematic examination of an information system (IS) or product to determine the adequacy of security measures.
More informationInfoSec Academy Application & Secure Code Track
Fundamental Courses Foundational Courses InfoSec Academy Specialized Courses Advanced Courses Certification Preparation Courses Certified Information Systems Security Professional (CISSP) Texas Security
More informationPenetration Testing //Vulnerability Assessment //Remedy
A Division Penetration Testing //Vulnerability Assessment //Remedy In Penetration Testing, part of a security assessment practice attempts to simulate the techniques adopted by an attacker in compromising
More informationETHICAL HACKING 010101010101APPLICATIO 00100101010WIRELESS110 00NETWORK1100011000 101001010101011APPLICATION0 1100011010MOBILE0001010 10101MOBILE0001
001011 1100010110 0010110001 010110001 0110001011000 011000101100 010101010101APPLICATIO 0 010WIRELESS110001 10100MOBILE00010100111010 0010NETW110001100001 10101APPLICATION00010 00100101010WIRELESS110
More informationWHITE PAPER. FortiWeb and the OWASP Top 10 Mitigating the most dangerous application security threats
WHITE PAPER FortiWeb and the OWASP Top 10 PAGE 2 Introduction The Open Web Application Security project (OWASP) Top Ten provides a powerful awareness document for web application security. The OWASP Top
More informationAbout This Document. Response to Questions. Security Sytems Assessment RFQ
Response to Questions Security Sytems Assessment RFQ Posted October 1, 2015 Q: Which specific security assessment processes are sought for this engagement? The RFQ mentions several kinds of analysis and
More informationA crushing blow at the heart of SAP J2EE Engine. For BlackHat USA 2011. Version 1.0
A crushing blow at the heart of SAP J2EE Engine. Architecture and program vulnerabilities in SAP s J2EE engine For BlackHat USA 2011. Version 1.0 Alexander Polyakov CTO at ERPScan Head of DSecRG Research
More informationInformation Security Services
Information Security Services Information Security In 2013, Symantec reported a 62% increase in data breaches over 2012. These data breaches had tremendous impacts on many companies, resulting in intellectual
More informationDetailed Description about course module wise:
Detailed Description about course module wise: Module 1: Basics of Networking and Major Protocols 1.1 Networks and its Types. 1.2 Network Topologies 1.3 Major Protocols and their Functions 1.4 OSI Reference
More informationCYBER-ATTACKS & SAP SYSTEMS Is our business-critical infrastructure exposed?
CYBER-ATTACKS & SAP SYSTEMS Is our business-critical infrastructure exposed? by Mariano Nunez mnunez@onapsis.com Abstract Global Fortune 1000 companies, large governmental organizations and defense entities
More informationMetasploit The Elixir of Network Security
Metasploit The Elixir of Network Security Harish Chowdhary Software Quality Engineer, Aricent Technologies Shubham Mittal Penetration Testing Engineer, Iviz Security And Your Situation Would Be Main Goal
More information10 Best Practices to Protect Your Network presented by Saalex Information Technology and Citadel Group
10 Best Practices to Protect Your Network presented by Saalex Information Technology and Citadel Group Presented by: Michael Flavin and Stan Stahl Saalex Information Technology Overview Saalex Information
More informationPenetration testing & Ethical Hacking. Security Week 2014
Penetration testing & Ethical Hacking Security Week 2014 Agenda Penetration Testing Vulnerability Scanning Social engineering Security Services offered by Endava 2 3 Who I am Catanoi Maxim Information
More informationTechnical Testing. Application, Network and Red Team Testing DATA SHEET. Test your security defenses. Expert Testing, Analysis and Assessments
DATA SHEET Technical Testing Application, Network and Red Team Testing The Dell SecureWorks Technical Testing services deliver the independent expertise, experience and perspective you need to enhance
More informationTechnical Testing. Network Testing DATA SHEET
DATA SHEET Technical Testing Network Testing The Dell SecureWorks Technical Testing services deliver the independent expertise, experience and perspective you need to enhance your security posture, reduce
More informationPenetration Testing Guidelines For the Financial Industry in Singapore. 31 July 2015
For the Financial Industry in Singapore 31 July 2015 TABLE OF CONTENT 1. EXECUTIVE SUMMARY 3 2. INTRODUCTION 4 2.1 Audience 4 2.2 Purpose and Scope 4 2.3 Definitions 4 3. REQUIREMENTS 6 3.1 Overview 6
More informationBlack Box Penetration Testing For GPEN.KM V1.0 Month dd "#$!%&'(#)*)&'+!,!-./0!.-12!1.03!0045!.567!5895!.467!:;83!-/;0!383;!
Sample Penetration Testing Report Black Box Penetration Testing For GPEN.KM V1.0 Month dd "#$%&'#)*)&'+,-./0.-121.030045.5675895.467:;83-/;0383; th, yyyy A&0#0+4*M:+:#&*#0%+C:,#0+4N:
More informationWhite Paper. Guide to PCI Application Security Compliance for Merchants and Service Providers
White Paper Guide to PCI Application Security Compliance for Merchants and Service Providers Contents Overview... 3 I. The PCI DSS Requirements... 3 II. Compliance and Validation Requirements... 4 III.
More informationDemystifying Penetration Testing for the Enterprise. Presented by Pravesh Gaonjur
Demystifying Penetration Testing for the Enterprise Presented by Pravesh Gaonjur Pravesh Gaonjur Founder and Executive Director of TYLERS Information Security Consultant Certified Ethical Hacker (CEHv8Beta)
More informationIntroduction to Penetration Testing Graham Weston
Introduction to Penetration Testing Graham Weston March 2014 Agenda Introduction and background Why do penetration testing? Aims and objectives Approaches Types of penetration test What can be penetration
More informationAlexander Polyakov CTO ERPScan
Invest in security to secure investments ERP Security. Myths, Problems, Solu6ons Alexander Polyakov CTO ERPScan About ERPScan The only 360- degree SAP Security solu8on - ERPScan Security Monitoring Suite
More informationKerem Kocaer 2010/04/14
Kerem Kocaer 1 EHLO Kerem is: a graduate from ICSS a security consultant at Bitsec Consulting AB a security enthusiast Kerem works with: administrative security security standards and frameworks, security
More information05.0 Application Development
Number 5.0 Policy Owner Information Security and Technology Policy Application Development Effective 01/01/2014 Last Revision 12/30/2013 Department of Innovation and Technology 5. Application Development
More informationVulnerability Assessment and Penetration Testing
Vulnerability Assessment and Penetration Testing Presenters: Bruce Upton CISSP, CISA, C EH bruce.upton@protectmybank.com Jerry McClurg CISSP, CISA, C EH jerry.mcclurg@protectmybank.com Agenda and Overview:
More informationCyber Exploits: Improving Defenses Against Penetration Attempts
Cyber Exploits: Improving Defenses Against Penetration Attempts Mark Burnette, CPA, CISA, CISSP, CISM, CGEIT, CRISC, QSA LBMC Security & Risk Services Today s Agenda Planning a Cyber Defense Strategy How
More informationDFW INTERNATIONAL AIRPORT STANDARD OPERATING PROCEDURE (SOP)
Title: Functional Category: Information Technology Services Issuing Department: Information Technology Services Code Number: xx.xxx.xx Effective Date: xx/xx/2014 1.0 PURPOSE 1.1 To appropriately manage
More informationBarracuda Web Site Firewall Ensures PCI DSS Compliance
Barracuda Web Site Firewall Ensures PCI DSS Compliance E-commerce sales are estimated to reach $259.1 billion in 2007, up from the $219.9 billion earned in 2006, according to The State of Retailing Online
More informationFINAL DoIT 11.03.2015 - v.4 PAYMENT CARD INDUSTRY DATA SECURITY STANDARDS APPLICATION DEVELOPMENT AND MAINTENANCE PROCEDURES
Purpose: The Department of Information Technology (DoIT) is committed to developing secure applications. DoIT s System Development Methodology (SDM) and Application Development requirements ensure that
More informationBest Practices - Remediation of Application Vulnerabilities
DROISYS APPLICATION SECURITY REMEDIATION Best Practices - Remediation of Application Vulnerabilities by Sanjiv Goyal CEO, Droisys February 2012 Proprietary Notice All rights reserved. Copyright 2012 Droisys
More informationWhitepaper on AuthShield Two Factor Authentication with ERP Applications
Whitepaper on AuthShield Two Factor Authentication with ERP Applications By INNEFU Labs Pvt. Ltd Table of Contents 1. Overview... 3 2. Threats to account passwords... 4 2.1 Social Engineering or Password
More informationWeb Application Security
Chapter 1 Web Application Security In this chapter: OWASP Top 10..........................................................2 General Principles to Live By.............................................. 4
More informationIoT IT Security and Secure Development Life Cycle
IoT IT Security and Secure Development Life Cycle Security BSides Ljubljana, 2015 By Christopher Scheuring, ERNW Germany #2 /whoami Christopher Scheuring Security Analyst @ ERNW Since 2010 IT Security
More informationThe purpose of this report is to educate our prospective clients about capabilities of Hackers Locked.
This sample report is published with prior consent of our client in view of the fact that the current release of this web application is three major releases ahead in its life cycle. Issues pointed out
More informationOverview of Network Security The need for network security Desirable security properties Common vulnerabilities Security policy designs
Overview of Network Security The need for network security Desirable security properties Common vulnerabilities Security policy designs Why Network Security? Keep the bad guys out. (1) Closed networks
More information"The only truly secure system is one that is powered off, cast in a block of concrete and sealed in a lead-lined room with armed guards.
Pwned Bulletin Septemeber 2014 Volume - 6 1 index 02 executive summary 03 responsible disclosures 04 smartermail 0-day xss vulnerability 07 siemens simatic S7-3000 exploit 09 network compromised using
More informationNew IBM Security Scanning Software Protects Businesses From Hackers
New IBM Security Scanning Software Protects Businesses From Hackers Chatchawun Jongudomsombut Web Application Security Situation Today HIGH AND INCREASING DEPENDENCE ON WEB SERVICES Work and business Communications
More informationTHE STATE OF SAP SECURITY 2013: VULNERABILITIES, THREATS AND TRENDS
THE STATE OF SAP SECURITY 2013: VULNERABILITIES, THREATS AND TRENDS Alexander Polyakov ERPScan Session ID: DAS-T03 Session Classification: Intermediate Agenda SAP: Intro SAP: vulnerabilities SAP: threats
More informationA GLOBAL SURVEY 2001 2013 Authors:
12 YEARS OF SAP SECURITY IN FIGURES: A GLOBAL SURVEY 2001 2013 Authors: Alexander Polyakov Alexey Tyurin Other contributors: Kirill Nikitenkov Evgeny Neyolov Alina Oprisko Dmitry Shimansky A GLOBAL SURVEY
More informationUnderstanding Security Testing
Understanding Security Testing Choosing between vulnerability assessments and penetration testing need not be confusing or onerous. Arian Eigen Heald, M.A., Ms.IA., CNE, CISA, CISSP I. Introduction Many
More informationData Security for the Hospitality
M&T Bank and SecurityMetrics Present: Data Security for the Hospitality Industry Featuring Lee Pierce, SecurityMetricsStrategicStrategic Accounts Dave Ellis, SecurityMetrics Forensic Investigator Doug
More informationWhite Paper. April 2006. Security Considerations for Utilities Utilities Tap Into the Power of SecureWorks
White Paper April 2006 Security Considerations for Utilities Utilities Tap Into the Power of SecureWorks According to a recent Harris Interactive survey, the country s leading business executives consider
More informationPenetration Testing Services. Demonstrate Real-World Risk
Penetration Testing Services Demonstrate Real-World Risk Penetration Testing Services The best way to know how intruders will actually approach your network is to simulate a real-world attack under controlled
More informationProfessional Services Overview
Professional Services Overview INFORMATION SECURITY ASSESSMENT AND ADVISORY NETWORK APPLICATION MOBILE CLOUD IOT Praetorian Company Overview HISTORY Founded in 2010 Headquartered in Austin, TX Self-funded
More informationSecurity Chasm! Dr. Anton Chuvakin
Security Chasm! Hack in The Box Amsterdam, The Netherlands July 2010 Why Are We Here? Risk of DEATH vs Risk of $60 fine? WTH is security? How we got here? Outline Security and/or/=/vs Compliance? Security
More informationInformation Technology Policy
Information Technology Policy Enterprise Web Application Firewall ITP Number ITP-SEC004 Category Recommended Policy Contact RA-ITCentral@pa.gov Effective Date January 15, 2010 Supersedes Scheduled Review
More informationNational Information Security Group The Top Web Application Hack Attacks. Danny Allan Director, Security Research
National Information Security Group The Top Web Application Hack Attacks Danny Allan Director, Security Research 1 Agenda Web Application Security Background What are the Top 10 Web Application Attacks?
More informationCourse Title: Penetration Testing: Network & Perimeter Testing
Course Title: Penetration Testing: Network & Perimeter Testing Page 1 of 7 Course Description: The Security Analyst Series from EC-Council Press is comprised of five books covering a broad base of topics
More informationCyber R &D Research Roundtable
Cyber R &D Research Roundtable 2 May 2013 N A T I O N A L S E C U R I T Y E N E R G Y & E N V I R O N M E N T H E A L T H C Y B E R S E C U R I T Y Changing Environment Rapidly Evolving Threat Changes
More informationGoal Oriented Pentesting Getting the most value out of Penetration Testing
Goal Oriented Pentesting Getting the most value out of Penetration Testing June 15, 2010 About me Joshua Jabra Abraham Joined Rapid7 in 2006 as a Security Consultant Extensive IT Security and Auditing
More informationTop Security Challenges Facing Credit Unions Today. Chris Gates Lares Consulting
Top Security Challenges Facing Credit Unions Today Chris Gates Lares Consulting 24 September 2013 A Little About Me Chris Gates Employment History: Partner, Lares Senior Security Consultant-Rapid7 Network
More information900 Walt Whitman Road, Suite 304 Melville, NY 11747 Office: 631-230-5100
W E P R O V I D E Cyber Safe Solutions was designed and built from the ground up to help organizations across multiple verticals to defend against modern day attacks. Unlike other security vendors that
More informationSecure Web Applications. The front line defense
Secure Web Applications The front line defense Agenda Web Application Security Threat Overview Exploiting Web Applications Common Attacks & Preventative techniques Developing Secure Web Applications -Security
More informationLegal Notice Knowledge Consulting Group All rights reserved 2013
Application Remediation Test Executive Summary Report 10/22/2013 1 Legal Notice Knowledge Consulting Group All rights reserved 2013 This document contains confidential and proprietary information. It is
More informationThreats and Attacks. Modifications by Prof. Dong Xuan and Adam C. Champion. Principles of Information Security, 5th Edition 1
Threats and Attacks Modifications by Prof. Dong Xuan and Adam C. Champion Principles of Information Security, 5th Edition 1 Learning Objectives Upon completion of this material, you should be able to:
More informationWhat is Penetration Testing?
White Paper What is Penetration Testing? An Introduction for IT Managers What Is Penetration Testing? Penetration testing is the process of identifying security gaps in your IT infrastructure by mimicking
More informationSecurity Implications Associated with Mass Notification Systems
Security Implications Associated with Mass Notification Systems Overview Cyber infrastructure: Includes electronic information and communications systems and services and the information contained in these
More informationElevation of Mobile Security Risks in the Enterprise Threat Landscape
March 2014, HAPPIEST MINDS TECHNOLOGIES Elevation of Mobile Security Risks in the Enterprise Threat Landscape Author Khaleel Syed 1 Copyright Information This document is an exclusive property of Happiest
More informationExternal Penetration Assessment and Database Access Review
External Penetration Assessment and Database Access Review Performed by Protiviti, Inc. At the request of Internal Audit April 25, 2012 Note: This presentation is intended solely for the use of the management
More informationIs your business prepared for Cyber Risks in 2016
Is your business prepared for Cyber Risks in 2016 The 2016 GSS Find out Security with the Assessment Excellus BCBS customers hurt by security breach Hackers Access 80 Mn Medical Records At Anthem Hackers
More informationAuditing the Security of an SAP HANA Implementation
Produced by Wellesley Information Services, LLC, publisher of SAPinsider. 2015 Wellesley Information Services. All rights reserved. Auditing the Security of an SAP HANA Implementation Juan Perez-Etchegoyen
More informationCritical Security Controls
Critical Security Controls Session 2: The Critical Controls v1.0 Chris Beal Chief Security Architect MCNC chris.beal@mcnc.org @mcncsecurity on Twitter The Critical Security Controls The Critical Security
More informationWhite Paper - Crypto Virus. A guide to protecting your IT
White Paper - Crypto Virus A guide to protecting your IT Contents What is Crypto Virus?... 3 How to protect yourself from Crypto Virus?... 3 Antivirus or Managed Agents... 3 Enhanced Email Services & Extra
More informationMcAfee Database Security. Dan Sarel, VP Database Security Products
McAfee Database Security Dan Sarel, VP Database Security Products Agenda Databases why are they so frail and why most customers Do very little about it? Databases more about the security problem Introducing
More informationSAP. Penetration Testing. with Onapsis Bizploit. Mariano Nuñez. Di Croce. HITB Security Conference, Dubai. April 22, 2010. mnunez@onapsis.
SAP Penetration Testing with Onapsis Bizploit Mariano Nuñez Di Croce mnunez@onapsis.com April 22, 2010 HITB Security Conference, Dubai Disclaimer This publication is copyright Onapsis SRL 2010 All rights
More information