IoT IT Security and Secure Development Life Cycle
|
|
|
- Bryan Potter
- 8 years ago
- Views:
Transcription
1 IoT IT Security and Secure Development Life Cycle Security BSides Ljubljana, 2015 By Christopher Scheuring, ERNW Germany
2 #2 /whoami Christopher Scheuring Security ERNW Since 2010 IT Security Architect and Analyst Before: 8 years software development cscheuring@ernw.de
3 #3 ERNW GmbH ERNW provides vendor independent security services to support our customers business. Established employees Vendor Independent We understand corporate Deep technical knowledge Structured (assessment) approach Business reasonable recommendations Customers predominantly large/very large enterprises
4 #4 Agenda The Big Question: IoT how secure we are? IT-Security in IoT we need it! The SDLC and IoT - and why it becomes difficult. The challenges and problems with IoT.
5 #5 What IoT means what do we talk about?
6 #6 IoT Internet of Things Sounds cool ;-) Other Buzz Words Industry 4.0 Connected Cars Smart Home Cloud Apps Yadda-yadda-yadda
7 #7 IoT The Idea Everything becomes accessible from every where. Your fridge generates the shopping list. Systems detect wear and tear to order new parts. Robots order 3 rd party parts for the next product they will build. Your smartphone switch of the lights or open your home door. Cars tell other cars the current traffic situation and control the traffic flow.
8 #8 IoT The Problems Everything becomes accessible from everywhere which means: Everything needs to be connected to the Internet at any time: Your smart TV (with smart cam) Your home automation with door-openingcapability Your car with GPS so you could find it easier or open doors remote The industrial system to interact with 3 rd party partners perhaps in booth direction -Yadda-yadda-yadda ;-)
9 #9 IoT The Real Live Did you ever pentest or perform a security analysis for IoT devices? Smart home components Industrial components (robots, switches, welding machines, sensors and actors ) Cars (inside buses or the GSM connectivity think about WiFi) The network infrastructure Your smartphone If yes you know how secure they are!
10 #10 IoT What we re Talking We are talking about systems designed to work in an autonomous and secure environment. The communication infrastructure origin was designed for safety and availability (like RS486, Fieldbus, CAN ) No needs to secure theme in an IT- Security point of view. They are secure by dedicated connection matrixes.
11 #11 IoT Becomes Real Live Those systems now are connected to the Internet or company WANs. By just applying TCP/IP interfaces. Following the rapid development needed for IoT. And forgot the IT Security needs Systems designed for an autonomous and secure environment become reachable all over the world.
12 #12 Why SDLC becomes important for IoT
13 #13 SDLC Secure Development Life Cycle Is the inclusion of IT security belongings into the (software) Development Live Cycle. Focus is checking: Company policies Legal requirements Technical IT-Security requirements Efficacy of security measures
14 #14 IoT and SDLC Let s talk about IoT and SDLC. E.g. a small and cute home automation system. Something really everyone needs because we can do it: Check our temperature and window stats by our smart phone.
15 #15 Our Design Cool and smart mobile app very important! Using whatever cloud service for data exchange because it s easy to develop. Cheap and easy programmable hardware (like an Arduino its cool for developing smart projects).
16 #16 Our Infrastructure Seems to be isolated everything is inside our home. The only connection to the world is by a dedicated one way communication to the cloud service. Our smart phone only talks to the cloud service end displays the temperature and state of the windows. Everything is fine implement it :-)
17 #17 Our Project Goes Live Cool Arduino with a real cheap WiFi module, temperature and window sensors (costs some less EURs). Easy software development because there are a lot of cool stuff available from the internet (GPL or free). Finding a usable cloud service is also an easy step. Rapid development in real live: Everything works after 1,2-3 days.
18 #18 Our Project Grows We feel like the king of the hill. Eyes glow and new ideas are sparkling: Open the front door. Change the temperature. Switch the lights. Yadda-yadda-yadda And control all cool features by smartphone. OK you turn back to a child ;-)
19 #19 Small IoT RL Excursion The guys selling the IoT / smart home application feel like king of the hill. Eyes glow and new ideas are sparkling: Open the front door. Change the temperature. Switch the lights. Yadda-yadda-yadda And control all cool features by smartphone. OK they got Dollar signs in the eyes ;-)
20 #20 Keep in mind the real live of software development ;-)
21 #21 What Now Happens Your isolated environment gets connected to the world in both ways! The origin design was only specified for a one-way connection initiated from inside your isolated environment into the Internet. Your concept becomes broken in a view of security point Your now need a back connection
22 Unfortunately Point of view sales man: What s the problem? You could open your front door even if you forgot your key at home! You remember the BMW hack? Maybe some one could get access to your home unauthorized caused by a bug? 03/12/2015 #22
23 #23 Here we go and deal with the new challenge.
24 #24 IoT & The Challenge Changing our way of life using IoT also means knowing the threats. And (possible) vulnerabilities caused by new connectivity and being connected every time. And therefore it s very important using SDLC measures in the early project phase. Think about what would be the unbelievable feature and include it into your SDLC process :-)
25 #25 The Threats Surprise the already known ;-) E.g. STRIDE Spoofing user identity Tampering Data Repudiation Information disclosure (privacy breach or data leak) Denial of service (DoS) Elevation of privilege
26 #26 Our IoT Project It was designed to use in ideal world. After enhancing we need to check for possible/new threats. And if there are any vulnerabilities concerning to the threats. This will be a security analysis process inside the DLC => Secure DLC.
27 Attacks 03/12/2015 #27 Big Picture Smart Home System Temp Sensor Window Sens. Door Opening Change Temp WiFi Home Router IoT/Smart Cloud Service User credential Mobile Device Exploits against the system Local attacks Attacks against WiFi Default credentials Exploits against the router Web- App Hacking Brutforcing Malware MitM Eavesdropping Theft Unkown access
28 #28 Are you vulnerable? Yes, You Are Vulnerable!
29 #29 Our Smart IoT App Vulns Weak encryption for storage of the user credentials inside the smartphone app. Easy to brutforce user credentials of the used cloud server because of missing measures. Hard coded cloud credentials inside the Arduino app code. Becomes a serious problem we want to open the front door... Hard coded encryption key for WiFi Could leak your WiFi key by the source-code and you need a way to handle changing the key
30 #30 Like The Reality? Are their any existing vulnerabilities? Yes of course :-) It s like at any known application. Plus extra spread over different communication partners and systems.
31 #31 Some known Vulns (2) CVE : Cisco Transport Gateway for Smart Call Home framework multiple cross-site scripting (XSS) vulnerabilities. Allows remote attackers inject arbitrary web script or HTML. CVE : Smartwebsites SmartCMS Multiple XSS (Cross-Site Scripting) Security Vulnerabilities.
32 #32 Some known Vulns (1) CVE : ucontrol Mobile App no X.509 SSL certificate verification. Allows Man-in-the-Middle attacks like accessing sensible data or trigger action. CVE : Cisco Transport Gateway for Smart Call Home DOS vulnerability in framework. Allows breaking the availability.
33 Some known Vulns (3) Loxone Smart Home : Multiple vulnerabilities found by SEC Consult Vulnerability Lab like: Cross-site request-forgery (XSRF) Multiple reflected cross-site scripting (XSS) vulnerabilities plus stored. Denial of service (DoS) by simple synflood. Credential Leakage because of storing in cleartext. 03/12/2015 #33
34 #34 Automation could harder Want to have more fun? Go performing penetration tests on automation components. Yes for sure only in a test lab environment ;-) And you will get ICSA-Numbers from the ICS-Cert
35 #35 War Story Scalance Switch ICSA : Siemens Scalance X Buffer Overflow Vulnerability Found by performing a brutforce stability test. Missing password length check in web GUI causes a reboot of the switch. What leads to a safety stop!
36 #36 War Story Siemens CP 1604/1616 ICSA : Siemens CP 1604/1616 Improper Access Control Found by performing a security test of a robot. Accessible remote debugging port. While playing with the debugging port the card crashes What leads to not any more controllable robot (needed to restart)!
37 #37 War Story BTW Robots Sorry not public So only in the talk ;-)
38 #38 SDLC for IoT is necessary!
39 #39 IoT & Threats & SDLC (1) Start thinking like a hacker to understand threats and why possible vulnerabilities could become a serious problem. Understand possible IT security problems at the IoT environment and all involved 3 rd party systems. Identify weakness inside your concept in every phase of you development live cycle. React as soon as possible this makes live a lot easier and more secure :-)
40 #40 IoT & Threats & SDLC (2) And the biggest challenge: The Life Time! IoT, Automation Components, Smart Home Device etc. will run longer than your smartphone. Where talking about 10 up to 30 years! Remind it for your IoT SDLC.
41 #41 SDLC & IoT (1) A complete/holistic SDLC for IoT is necessary. Security should be taken into consideration in each phase of application/system development. Existing SSDLC methodologies focus on Governance, Construction, Verification and Deployment business functions and their relevant security activities. And for Operation!
![com] These methodologies can help to improve security of IoT systems and](/docs-images/29/13471615/images/42-0.png "applications.")
42 #42 SDLC & IoT (2) Use Software Assurance Maturity Models e.g. OpenSAMM [ BSIMM (Building Security In Maturity Model) [ These methodologies can help to improve security of IoT systems and applications. Don t forgot to include all involved partners and used communication links into your analysis.
43 #43 Conclusion Smart and IoT systems will be widely spread in the future. They will cover a lot of our daily work and live. So they need to be designed to protect our privacy and our safety. And they will run longer as expected. Smart and IoT should not become an acronym for unsecure
44 #44 Thanks a lot for you attention :-)
45 #45 Questions
46 #46
Cloud Security Fails & How the SDLC could (not?) have prevented them
Cloud Security Fails & How the SDLC could (not?) have prevented them CSA CEE Summit 2015, Ljubjana By Christopher Scheuring, ERNW Germany #2 /whoami Christopher Scheuring Security Analyst @ ERNW Since
Secure Code Development
ISACA South Florida 7th Annual WOW! Event Copyright Elevate Consult LLC. All Rights Reserved 1 Agenda i. Background ii. iii. iv. Building a Business Case for Secure Coding Top-Down Approach to Develop
Is Drupal secure? A high-level perspective on web vulnerabilities, Drupal s solutions, and how to maintain site security
Is Drupal secure? A high-level perspective on web vulnerabilities, Drupal s solutions, and how to maintain site security Presented 2009-05-29 by David Strauss Thinking Securely Security is a process, not
Security Issues with Integrated Smart Buildings
Security Issues with Integrated Smart Buildings Jim Sinopoli, Managing Principal Smart Buildings, LLC The building automation industry is now at a point where we have legitimate and reasonable concern
Securing Your Web Application against security vulnerabilities. Ong Khai Wei, IT Specialist, Development Tools (Rational) IBM Software Group
Securing Your Web Application against security vulnerabilities Ong Khai Wei, IT Specialist, Development Tools (Rational) IBM Software Group Agenda Security Landscape Vulnerability Analysis Automated Vulnerability
Virtualization System Security
Virtualization System Security Bryan Williams, IBM X-Force Advanced Research Tom Cross, Manager, IBM X-Force Security Strategy 2009 IBM Corporation Overview Vulnerability disclosure analysis Vulnerability
Veracode White Paper The Internet of Things: Security Research Study. The Internet of Things: Security Research Study
The Internet of Things: Security Research Study Introduction As the Internet of Things (IoT) continues to gain traction and more connected devices come to market, security becomes a major concern. Businesses
Juniper Networks Secure
White Paper Juniper Networks Secure Development Lifecycle Six Practices for Improving Product Security Copyright 2013, Juniper Networks, Inc. 1 Table of Contents Executive Summary...3 Introduction...3
2. From a control perspective, the PRIMARY objective of classifying information assets is to:
MIS5206 Week 13 Your Name Date 1. When conducting a penetration test of an organization's internal network, which of the following approaches would BEST enable the conductor of the test to remain undetected
Mobile Application Threat Analysis
The OWASP Foundation http://www.owasp.org Mobile Application Threat Analysis Ari Kesäniemi Nixu Copyright The OWASP Foundation Permission is granted to copy, distribute and/or modify this document under
THE HACKERS NEXT TARGET
Governance and Risk Management THE HACKERS NEXT TARGET YOUR WEB AND SOFTWARE Anthony Lim MBA CISSP CSSLP FCITIL Director, Security, Asia Pacific Rational Software ISC2 CyberSecurity Conference 09 Kuala
Mobile Application Security Sharing Session May 2013
Mobile Application Security Sharing Session Agenda Introduction of speakers Mobile Application Security Trends and Challenges 5 Key Focus Areas for an mobile application assessment 2 Introduction of speakers
Threat Modeling. Categorizing the nature and severity of system vulnerabilities. John B. Dickson, CISSP
Threat Modeling Categorizing the nature and severity of system vulnerabilities John B. Dickson, CISSP What is Threat Modeling? Structured approach to identifying, quantifying, and addressing threats. Threat
Web Application Security
Chapter 1 Web Application Security In this chapter: OWASP Top 10..........................................................2 General Principles to Live By.............................................. 4
David Rook. The Principles of Secure Development. OWASP Ireland Conference, Dublin
David Rook The Principles of Secure Development OWASP Ireland Conference, Dublin if (slide == introduction) System.out.println("I m David Rook"); Security Analyst, Realex Payments, Ireland CISSP, CISA,
External Supplier Control Requirements
External Supplier Control s Cyber Security For Suppliers Categorised as Low Cyber Risk 1. Asset Protection and System Configuration Barclays Data and the assets or systems storing or processing it must
Reducing Application Vulnerabilities by Security Engineering
Reducing Application Vulnerabilities by Security Engineering - Subash Newton Manager Projects (Non Functional Testing, PT CoE Group) 2008, Cognizant Technology Solutions. All Rights Reserved. The information
iviz Security Inc (In) Security in Security Products 2013
iviz Security Inc (In) Security in Security Products 2013 iviz Security Inc 2013 Introduction We use security products to secure our systems and our businesses. However, the very security products we use,
If you know the enemy and know yourself, you need not fear the result of a hundred battles.
Rui Pereira,B.Sc.(Hons),CIPS ISP/ITCP,CISSP,CISA,CWNA/CWSP,CPTE/CPTC Principal Consultant, WaveFront Consulting Group ruiper@wavefrontcg.com 1 (604) 961-0701 If you know the enemy and know yourself, you
Introduction to Penetration Testing Graham Weston
Introduction to Penetration Testing Graham Weston March 2014 Agenda Introduction and background Why do penetration testing? Aims and objectives Approaches Types of penetration test What can be penetration
Hong Kong Information Security Outlook 2015 香 港 資 訊 保 安 展 望
Hong Kong Information Security Outlook 2015 香 港 資 訊 保 安 展 望 Agenda Information Security Trends Year 2014 in Review Outlook for 2015 Advice to the Public Hong Kong Computer Emergency Response Team Coordination
Your Web and Applications
Governance and Risk Management Your Web and Applications The Hacker s New Target Anthony Lim MBA CISSP CSSLP FCITIL Director, Security, Asia Pacific Rational Software Social Engineering in the Business
Application Security Testing
Tstsec - Version: 1 09 July 2016 Application Security Testing Application Security Testing Tstsec - Version: 1 4 days Course Description: We are living in a world of data and communication, in which the
Essential IT Security Testing
Essential IT Security Testing Application Security Testing for System Testers By Andrew Muller Director of Ionize Who is this guy? IT Security consultant to the stars Member of OWASP Member of IT-012-04
Hacking Medical Devices
Hacking Medical Devices Cloud Context #2 Blog: Florian Grunow Security Analyst ERNW in Heidelberg Team Lead: Pentest ERNW Academy Research: Medical Devices Connected Cars Conference: #3 Agenda Motivation
Penetration Testing Service. By Comsec Information Security Consulting
Penetration Testing Service By Consulting February, 2007 Background The number of hacking and intrusion incidents is increasing year by year as technology rolls out. Equally, there is no hiding place your
Cloud and Security (Cloud hacked via Cloud) Lukas Grunwald
Cloud and Security (Cloud hacked via Cloud) Lukas Grunwald About DN-Systems Global Consulting and Technology Services Planning Evaluation Auditing Operates own Security Lab Project Management Integral
Smart (and safe) Lighting:
Smart (and safe) Lighting: An Overview of Cyber Security October 29, 2015 Jason Brown CISO, Merit Network Agenda 2 The New Normal Discuss Methodologies of Security Recap Q & A Target Hack 3 40,000 credit
The Top Web Application Attacks: Are you vulnerable?
QM07 The Top Web Application Attacks: Are you vulnerable? John Burroughs, CISSP Sr Security Architect, Watchfire Solutions jburroughs@uk.ibm.com Agenda Current State of Web Application Security Understanding
FIREWALLS & NETWORK SECURITY with Intrusion Detection and VPNs, 2 nd ed. Chapter 4 Finding Network Vulnerabilities
FIREWALLS & NETWORK SECURITY with Intrusion Detection and VPNs, 2 nd ed. Chapter 4 Finding Network Vulnerabilities Learning Objectives Name the common categories of vulnerabilities Discuss common system
Passing PCI Compliance How to Address the Application Security Mandates
Passing PCI Compliance How to Address the Application Security Mandates The Payment Card Industry Data Security Standards includes several requirements that mandate security at the application layer. These
What someone said about junk hacking
What someone said about junk hacking Yes, we get it. Cars, boats, buses, and those singing fish plaques are all hackable and have no security. Most conferences these days have a whole track called "Junk
Research Report: Addressing Security Concerns for Connected Devices in the Internet of Things Era
Sponsored by Oracle Research Report: Addressing Security Concerns for Connected Devices in the Internet of Things Era Introduction About Survey Respondents The Internet of Things (IoT) and the rise of
Board Portal Security: How to keep one step ahead in an ever-evolving game
Board Portal Security: How to keep one step ahead in an ever-evolving game The views and opinions expressed in this paper are those of the author and do not necessarily reflect the official policy or position
CMPT 471 Networking II
CMPT 471 Networking II Firewalls Janice Regan, 2006-2013 1 Security When is a computer secure When the data and software on the computer are available on demand only to those people who should have access
SiteLock. Internet Security: Big Threats for Small Business. Presented by: Neill Feather, President
SiteLock Internet Security: Big Threats for Small Business Presented by: Neill Feather, President Protect your Small Business Customers They are a sizable investment Number of U.S. Small Businesses 26.9
Web application testing
CL-WTS Web application testing Classroom 2 days Testing plays a very important role in ensuring security and robustness of web applications. Various approaches from high level auditing through penetration
National Endowment for the Arts Evaluation Report. Table of Contents. Results of Evaluation... 1. Areas for Improvement... 2. Exit Conference...
NEA OIG Report No. R-13-03 Table of Contents Results of Evaluation... 1 Areas for Improvement... 2 Area for Improvement 1: The agency should implement ongoing scanning to detect vulnerabilities... 2 Area
How to start a software security initiative within your organization: a maturity based and metrics driven approach OWASP
How to start a software security initiative within your organization: a maturity based and metrics driven approach Marco Morana OWASP Lead/ TISO Citigroup OWASP Application Security For E-Government Copyright
Threat Modeling. Frank Piessens (Frank.Piessens@cs.kuleuven.be ) KATHOLIEKE UNIVERSITEIT LEUVEN
Threat Modeling Frank Piessens (Frank.Piessens@cs.kuleuven.be ) Secappdev 2007 1 Overview Introduction Key Concepts Threats, Vulnerabilities, Countermeasures Example Microsoft s Threat Modeling Process
APIs The Next Hacker Target Or a Business and Security Opportunity?
APIs The Next Hacker Target Or a Business and Security Opportunity? SESSION ID: SEC-T07 Tim Mather VP, CISO Cadence Design Systems @mather_tim Why Should You Care About APIs? Amazon Web Services EC2 alone
KASPERSKY SECURITY INTELLIGENCE SERVICES. EXPERT SERVICES. www.kaspersky.com
KASPERSKY SECURITY INTELLIGENCE SERVICES. EXPERT SERVICES www.kaspersky.com EXPERT SERVICES Expert Services from Kaspersky Lab are exactly that the services of our in-house experts, many of them global
Web Application Report
Web Application Report This report includes important security information about your Web Application. Security Report This report was created by IBM Rational AppScan 8.5.0.1 11/14/2012 8:52:13 AM 11/14/2012
WHITE PAPER Security in M2M Communication What is secure enough?
WHITE PAPER Security in M2M Communication What is secure enough? Motivation Wireless Machine-To-Machine (M2M) communication has grown dramatically over the past decade and is still growing rapidly. In
12 Security Camera System Best Practices - Cyber Safe
12 Security Camera System Best Practices - Cyber Safe Dean Drako, President and CEO, Eagle Eye Networks Website version of white paper Dean Drako video introduction for cyber security white paper Introduction
Understanding Security Testing
Understanding Security Testing Choosing between vulnerability assessments and penetration testing need not be confusing or onerous. Arian Eigen Heald, M.A., Ms.IA., CNE, CISA, CISSP I. Introduction Many
Enterprise Computing Solutions
Business Intelligence Data Center Cloud Mobility Enterprise Computing Solutions Security Solutions arrow.com Security Solutions Secure the integrity of your systems and data today with the one company
Auditing the Security of an SAP HANA Implementation
Produced by Wellesley Information Services, LLC, publisher of SAPinsider. 2015 Wellesley Information Services. All rights reserved. Auditing the Security of an SAP HANA Implementation Juan Perez-Etchegoyen
Crosscheck Web Services Patent Pending Automated SOA Compliance and Security Assessment
Pagina 1 di 5 Hacking News Malwares Cyber Attack Vulnerabilities Hacking Groups Spying e.g. Hacking Facebook +1,310,745 163,900 392,600 +10m Follow Firing Range Open Source Web App Vulnerability Scanning
INTRUSION DETECTION SYSTEM (IDS) D souza Adam Jerry Joseph 0925910 I MCA
INTRUSION DETECTION SYSTEM (IDS) D souza Adam Jerry Joseph 0925910 I MCA OVERVIEW Introduction Overview The IDS Puzzle Current State of IDS Threats I have a good firewall, why do I need an IDS? Expectations
Securing ios Applications. Dr. Bruce Sams, OPTIMAbit GmbH
Securing ios Applications Dr. Bruce Sams, OPTIMAbit GmbH About Me President of OPTIMAbit GmbH Responsible for > 200 Pentests per Year Ca 50 ios Pentests and code reviews in the last two years. Overview
Oracle Security Auditing
Introduction - Commercial Slide. RISK 2008, Oslo, Norway, April 23 rd 2008 Oracle Security Auditing By Pete Finnigan Written Friday, 25th January 2008 Founded February 2003 CEO Pete Finnigan Clients UK,
Oracle Security Auditing
RISK 2008, Oslo, Norway, April 23 rd 2008 Oracle Security Auditing By Pete Finnigan Written Friday, 25th January 2008 1 Introduction - Commercial Slide. Founded February 2003 CEO Pete Finnigan Clients
PCI Compliance Updates
PCI Compliance Updates E-Commerce / Cloud Security Adam Goslin, Chief Operations Officer AGoslin@HighBitSecurity.com Direct: 248.388.4328 PCI Guidance Google: PCI e-commerce guidance https://www.pcisecuritystandards.org/pdfs/pci_dss_v2_ecommerce_guidelines.pdf
New IBM Security Scanning Software Protects Businesses From Hackers
New IBM Security Scanning Software Protects Businesses From Hackers Chatchawun Jongudomsombut Web Application Security Situation Today HIGH AND INCREASING DEPENDENCE ON WEB SERVICES Work and business Communications
How users bypass your security!
How users bypass your security! IT Days Security issues 20 th November 2014 Tom Leclerc, Security Consultant SAGS - Security Audits and Governance Services, a Telindus Security department Classification:
Strategic Information Security. Attacking and Defending Web Services
Security PS Strategic Information Security. Attacking and Defending Web Services Presented By: David W. Green, CISSP dgreen@securityps.com Introduction About Security PS Application Security Assessments
Out of the Fire - Adding Layers of Protection When Deploying Oracle EBS to the Internet
Out of the Fire - Adding Layers of Protection When Deploying Oracle EBS to the Internet March 8, 2012 Stephen Kost Chief Technology Officer Integrigy Corporation Phil Reimann Director of Business Development
10- Assume you open your credit card bill and see several large unauthorized charges unfortunately you may have been the victim of (identity theft)
1- A (firewall) is a computer program that permits a user on the internal network to access the internet but severely restricts transmissions from the outside 2- A (system failure) is the prolonged malfunction
Automotive Ethernet Security Testing. Alon Regev and Abhijit Lahiri
Automotive Ethernet Security Testing Alon Regev and Abhijit Lahiri 1 Automotive Network Security Cars are evolving Number of ECUs, sensors, and interconnects is growing Moving to Ethernet networks utilizing
WEB APPLICATION SECURITY
WEB APPLICATION SECURITY Governance and Risk Management YOUR LAST LINE OF DEFENSE Aug 06 2009 ANSES RAH RAH Anthony Lim MBA CISSP CSSLP FCITIL Director, Security, Asia Pacific Rational Software Prolog
SECURITY B-SIDES: ATLANTA STRATEGIC PENETRATION TESTING. Presented by: Dave Kennedy Eric Smith
SECURITY B-SIDES: ATLANTA STRATEGIC PENETRATION TESTING Presented by: Dave Kennedy Eric Smith AGENDA Penetration Testing by the masses Review of current state by most service providers Deficiencies in
Security threats and attackers are turning
SECURITY Application Security: Countering The Professionals Robin Layland Robin Layland is president of Layland Consulting, a firm that specializes in network architecture and new technology. He has more
Jort Kollerie SonicWALL
Jort Kollerie Cloud 85% of businesses said their organizations will use cloud tools moderately to extensively in the next 3 years. 68% of spend in private cloud solutions. - Bain and Dell 3 Confidential
Network Security: Introduction
Network Security: Introduction 1. Network security models 2. Vulnerabilities, threats and attacks 3. Basic types of attacks 4. Managing network security 1. Network security models Security Security has
White Paper. Guide to PCI Application Security Compliance for Merchants and Service Providers
White Paper Guide to PCI Application Security Compliance for Merchants and Service Providers Contents Overview... 3 I. The PCI DSS Requirements... 3 II. Compliance and Validation Requirements... 4 III.
Evolution of Penetration Testing
Alexander Polyakov, QSA,PA-QSA CTO Digital Security (dsec.ru) Head of DSecRG (dsecrg.com) ERPSCAN Architect (erpscan.com) Head of OWASP-EAS Pentests? Again? Why? Many companies are doing this Many companies
G- Cloud Specialist Cloud Services. Security and Penetration Testing. Overview
Description C Service Overview G- Cloud Specialist Cloud Services Security and Penetration Testing This document provides a description of TVS s Security and Penetration Testing Service offered under the
Intrusion Detection and Cyber Security Monitoring of SCADA and DCS Networks
Intrusion Detection and Cyber Security Monitoring of SCADA and DCS Networks Dale Peterson Director, Network Security Practice Digital Bond, Inc. 1580 Sawgrass Corporate Parkway, Suite 130 Sunrise, FL 33323
FORBIDDEN - Ethical Hacking Workshop Duration
Workshop Course Module FORBIDDEN - Ethical Hacking Workshop Duration Lecture and Demonstration : 15 Hours Security Challenge : 01 Hours Introduction Security can't be guaranteed. As Clint Eastwood once
ensuring security the way how we do it
ensuring security the way how we do it HUSTEF, 2015.11.18 Attila Tóth 1 Nokia Solutions and Networks 2014 Disclaimer The ideas, processes, tools are presented from a practitioner s point of view working
Risk Management in the Development Process A Progress Report
Risk Management in the Development Process A Progress Report 1 Introduction 2 Smart Meter Gateway - basic facts 3 Real Life Example Introduction Industry 4.0 and IoT gain importance of Embedded Systems
Hands on, field experiences with BYOD. BYOD Seminar
Hands on, field experiences with BYOD. BYOD Seminar Brussel, 25 september 2012 Agenda Challenges RIsks Strategy Before We Begin Thom Schiltmans Deloitte Risk Services Security & Privacy Amstelveen tschiltmans@deloitte.nl
WISE-4000 Series. WISE IoT Wireless I/O Modules
WISE-4000 Series WISE IoT Wireless I/O Modules Bring Everything into World of the IoT WISE IoT Ethernet I/O Architecture Public Cloud App Big Data New WISE DNA Data Center Smart Configure File-based Cloud
What is Really Needed to Secure the Internet of Things?
What is Really Needed to Secure the Internet of Things? By Alan Grau, Icon Labs alan.grau@iconlabs.com The Internet of Things (IoT) has become a ubiquitous term to describe the tens of billions of devices
ArcGIS Server Security Threats & Best Practices 2014. David Cordes Michael Young
ArcGIS Server Security Threats & Best Practices 2014 David Cordes Michael Young Agenda Introduction Threats Best practice - ArcGIS Server settings - Infrastructure settings - Processes Summary Introduction
This session was presented by Jim Stickley of TraceSecurity on Wednesday, October 23 rd at the Cyber Security Summit.
The hidden risks of mobile applications This session was presented by Jim Stickley of TraceSecurity on Wednesday, October 23 rd at the Cyber Security Summit. To learn more about TraceSecurity visit www.tracesecurity.com
OSMOSIS. Open Source Monitoring Security Issues HACKITO ERGO SUM 2014 / April 2014 / Paris
OSMOSIS Open Source Monitoring Security Issues HACKITO ERGO SUM 2014 / April 2014 / Paris AGENDA Who are we? Open Source Monitoring Software Results Demonstration Responses Mitigations and conclusion 4/25/14
Security Implications Associated with Mass Notification Systems
Security Implications Associated with Mass Notification Systems Overview Cyber infrastructure: Includes electronic information and communications systems and services and the information contained in these
Web App Security Audit Services
locuz.com Professional Services Web App Security Audit Services The unsecured world today Today, over 80% of attacks against a company s network come at the Application Layer not the Network or System
The monsters under the bed are real... 2004 World Tour
Web Hacking LIVE! The monsters under the bed are real... 2004 World Tour Agenda Wichita ISSA August 6 th, 2004 The Application Security Dilemma How Bad is it, Really? Overview of Application Architectures
Chapter 4 Application, Data and Host Security
Chapter 4 Application, Data and Host Security 4.1 Application Security Chapter 4 Application Security Concepts Concepts include fuzzing, secure coding, cross-site scripting prevention, crosssite request
Security Goals Services
1 2 Lecture #8 2008 Freedom from danger, risk, etc.; safety. Something that secures or makes safe; protection; defense. Precautions taken to guard against crime, attack, sabotage, espionage, etc. An assurance;
What is Web Security? Motivation
brucker@inf.ethz.ch http://www.brucker.ch/ Information Security ETH Zürich Zürich, Switzerland Information Security Fundamentals March 23, 2004 The End Users View The Server Providers View What is Web
ADC Survey GLOBAL FINDINGS
ADC Survey GLOBAL FINDINGS CONTENTS Executive Summary...4 Methodology....8 Finding 1: Attacks Getting More Difficult to Defend... 10 Finding 2: Attacks Driving High Costs to Organizations.... 14 Finding
Entire contents 2011 Praetorian. All rights reserved. Information Security Provider and Research Center www.praetorian.com
Entire contents 2011 Praetorian. All rights reserved. Information Security Provider and Research Center www.praetorian.com Threat Modeling "Threat modeling at the design phase is really the only way to
AVOIDING THE BREACH 5 Common Ways Technology Vendors Put Their Healthcare Customer's PHI at Risk
AVOIDING THE BREACH 5 Common Ways Technology Vendors Put Their Healthcare Customer's PHI at Risk Chris Bowen, MBA, CISSP, CIPP/US, CIPT Founder, Chief Privacy & Security Officer The majority of breaches
Data Security Best Practices & Reasonable Methods
Data Security Best Practices & Reasonable Methods September 2013 Mike Tassey Technical Security Advisor Privacy Technical Assistance Center (PTAC) http://ptac.ed.gov/ E-mail: PrivacyTA@ed.gov Phone: 855-249-3072
Ethical Hacking Penetrating Web 2.0 Security
Ethical Hacking Penetrating Web 2.0 Security Contact Sam Bowne Computer Networking and Information Technology City College San Francisco Email: sbowne@ccsf.edu Web: samsclass.info 2 Two Hacking Classes
Hack Proof Your Webapps
Hack Proof Your Webapps About ERM About the speaker Web Application Security Expert Enterprise Risk Management, Inc. Background Web Development and System Administration Florida International University
APPLICATION SECURITY: FROM WEB TO MOBILE. DIFFERENT VECTORS AND NEW ATTACK
APPLICATION SECURITY: FROM WEB TO MOBILE. DIFFERENT VECTORS AND NEW ATTACK John T Lounsbury Vice President Professional Services, Asia Pacific INTEGRALIS Session ID: MBS-W01 Session Classification: Advanced
Web Application Remediation. OWASP San Antonio. March 28 th, 2007
Web Application Remediation OWASP San Antonio March 28 th, 2007 Agenda Introduction The Problem: Vulnerable Web Applications Goals Example Process Overview Real World Issues To Address Conclusion/Questions
Table of Contents. Application Vulnerability Trends Report 2013. Introduction. 99% of Tested Applications Have Vulnerabilities
Application Vulnerability Trends Report : 2013 Table of Contents 3 4 5 6 7 8 8 9 10 10 Introduction 99% of Tested Applications Have Vulnerabilities Cross Site Scripting Tops a Long List of Vulnerabilities
Protecting Your Organisation from Targeted Cyber Intrusion
Protecting Your Organisation from Targeted Cyber Intrusion How the 35 mitigations against targeted cyber intrusion published by Defence Signals Directorate can be implemented on the Microsoft technology
Application Security Best Practices. Wally LEE <wally.lee@scs.com.sg> Principal Consultant
Application Security Best Practices Wally LEE Principal Consultant 17/18 March 2009 Speaker Profile Wally LEE CISSP BS7799 Lead Auditor Certified Ultimate Hacking Instructor Certified
Overview of Network Security The need for network security Desirable security properties Common vulnerabilities Security policy designs
Overview of Network Security The need for network security Desirable security properties Common vulnerabilities Security policy designs Why Network Security? Keep the bad guys out. (1) Closed networks
ISSECO Syllabus Public Version v1.0
ISSECO Syllabus Public Version v1.0 ISSECO Certified Professional for Secure Software Engineering Date: October 16th, 2009 This document was produced by the ISSECO Working Party Syllabus Introduction to
CARRIOTS TECHNICAL PRESENTATION
CARRIOTS TECHNICAL PRESENTATION Alvaro Everlet, CTO alvaro.everlet@carriots.com @aeverlet Oct 2013 CARRIOTS TECHNICAL PRESENTATION 1. WHAT IS CARRIOTS 2. BUILDING AN IOT PROJECT 3. DEVICES 4. PLATFORM
CERT's role in national Cyber Security: policy suggestions
CERT's role in national Cyber Security: policy suggestions Subject: Legal Aspect of Cyber Security. Author: Vladimir Chitashvili Lecture: Anna-Maria Osula What is national Cyber Security is? In another