Hacking for your Security - Penetration Testing
|
|
|
- George Thornton
- 9 years ago
- Views:
Transcription
1 November 6th, 2009 Entrepreneurial Marketing, RWTH Aachen, WIN
2 Agenda 1 RedTeam Pentesting, Dates and Facts 2 3 4
3 RedTeam Pentesting, Dates and Facts Founded in 2004 Specialisation exclusively on penetration tests 8 penetration testers
4 Laptop: a portable microcomputer having its main components (as processor, keyboard, and display screen) integrated into a single unit capable of battery-powered operation (merriam-webster.com - Merriam Webster Online) Laptop: A computer designed to allow employees to easily store vast amounts of customer data in the backseat of a taxicab (The Devil s Infosec Dictionary)
5 Laptop: a portable microcomputer having its main components (as processor, keyboard, and display screen) integrated into a single unit capable of battery-powered operation (merriam-webster.com - Merriam Webster Online) Laptop: A computer designed to allow employees to easily store vast amounts of customer data in the backseat of a taxicab (The Devil s Infosec Dictionary)
6 ? Attacking a network or product with the owner s consent Question: How deeply can a real attacker penetrate the security? Same methods as the bad guys Conducted from the attacker s perspective Individualised search of security vulnerabilities by experts Detailed documentation from the beginning
7 RWTH Research Group RedTeam Founded December 2004 at the RWTH Aachen University Research group at the chair of Dependable Distributed Systems (Prof. Felix Freiling) All participants in the group already have many years of experience in IT security Research question: How to conduct efficient penetration tests resulting in the highest benefit for the client
8 RWTH Research Group RedTeam The research group is informally called Red Team: a term describing the opposing force in military simulations First pentests of chairs at the RWTH (free of charge) Many are shocked how vulnerable they are
9 RWTH Research Group RedTeam The methodology used in the pentests is positively received The word spreads that RedTeam identifies security weaknesses of practical relevance in a short time Parallel research of security vulnerabilities generates the first press coverage: ITAN
10 RWTH Research Group RedTeam The interest in RedTeam s work remains high Prospective customers are willing to pay for the service In the middle of 2005: the chair moves to the University of Mannheim RedTeam has two choices: either quit or start a company
11 RedTeam Pentesting The problem: an adequate legal form Risk of liability Founding a company takes time RedTeam does not have Nomis Development GmbH lets RedTeam work as an independent divison Needs an official name, RedTeam is too generic The new name: RedTeam Pentesting
12 Financing The next issue: How to finance the new company RedTeam Pentesting s advantage: no need to finance anything in advance No machines No producer goods No suppliers (Almost) no external service providers Pentests belong to the service sector Most valuable assets of the company: Its employees Intellectual work
13 Financing Biggest costs at the beginning: Fixed costs for rent, telephone, internet... Travel costs Later: Salaries. Good people in IT security are rare Financing of the first months is covered from payed work during the time at the RWTH No need for Venture Capital, EU Fundings etc. No dependencies, no expectations, no regulations
14 Technology Centre Aachen In late 2005, the first offices at the TZA are rented Focus on technology-oriented companies Inexpensive rent Availability of small offices Flexible (even with unusual demands) Direct access by autobahn Already existing infrastructure: Reception Cafeteria Conference rooms Site security in the evening/night
15 RedTeam Pentesting GmbH The trademark RedTeam Pentesting gets more and more established RedTeam Pentesting starts its own company in parallel to its day-to-day business RedTeam Pentesting GmbH is in the course of formation as of December 2006 Fully established as of January 1st, 2007
16 RedTeam Pentesting GmbH Today Working worldwide Medium to large companies and international corporations Small companies with special security interests Branches of trade: industry, banks and insurance companies, trading business, operators of data centers, public administration... Press coverage in online and print media, radio and TV Expanded to bigger offices at the TZA
17 What is Marketing? Who is your customer? What does she want/need? Design your product/service to your customer s needs. Communicate the value of your product/service to your customer.
18 RedTeam Pentesting Seriousness Specialisation exclusively on penetration tests Teamwork Discretion Transfer of know-how
19 Thank you for listening. Questions?
Introduction to Penetration Testing Graham Weston
Introduction to Penetration Testing Graham Weston March 2014 Agenda Introduction and background Why do penetration testing? Aims and objectives Approaches Types of penetration test What can be penetration
Man-in-the-Middle Attacks against the chiptan comfort Online Banking System
Man-in-the-Middle Attacks against the chiptan comfort Online Banking System RedTeam Pentesting GmbH November 23, 2009 ChipTAN comfort is a new system which is supposed to securely authorise online banking
Monetizing Mobile. How Broadcasters Can Generate Revenue With Mobile Apps. 2016 jācapps
Monetizing Mobile How Broadcasters Can Generate Revenue With Mobile Apps 2016 jācapps Contents Mobile Revenue Growth 4 5 Principles for Monetizing Mobile. 6 1: An Ad is Not an Ad 7 2: Embrace What Differentiates
Penetration Testing - a way for improving our cyber security
OWASP EU Tour Bucharest 2013 The OWASP Foundation http://www.owasp.org Penetration Testing - a way for improving our cyber security Adrian Furtunǎ, PhD, OSCP, CEH [email protected] Copyright The OWASP
A Common Process Model for Incident Response and Digital Forensics
A Common Process Model for Incident Response and Digital Forensics IMF 2007, Stuttgart, September 2007 Felix C. Freiling Laboratory for Dependable Distributed Systems University of Mannheim, Germany Bastian
TLP WHITE. Denial of service attacks: what you need to know
Denial of service attacks: what you need to know Contents Introduction... 2 What is DOS and how does it work?... 2 DDOS... 4 Why are they used?... 5 Take action... 6 Firewalls, antivirus and updates...
Vulnerability Management
Quelle: fotolia Vulnerability Management The early bird catches the worm Dipl.-Ing. Lukas Memelauer, BSc [email protected] calpana business consulting gmbh Blumauerstraße 43, 4020 Linz 1 Agenda
Non-personal communication
Week 8: Promotions Integrated Marketing Communications: advertising, Sales Promotion, Public Relations, and Direct Marketing Strategic Goals Of Marketing Communication Create awareness Build positive images
lesson 1 An Overview of the Computer System
essential concepts lesson 1 An Overview of the Computer System This lesson includes the following sections: The Computer System Defined Hardware: The Nuts and Bolts of the Machine Software: Bringing the
Pentests more than just using the proper tools
Pentests more than just using the proper tools Agenda 1. Information Security @ TÜV Rheinland 2. Security testing 3. Penetration testing Introduction Evaluation scheme Security Analyses of web applications
Pentests more than just using the proper tools
Pentests more than just using the proper tools Agenda 1. Information Security @ TÜV Rheinland 2. Penetration testing Introduction Evaluation scheme Security Analyses of web applications Internal Security
THE MORAY COUNCIL. Guidance on data security breach management DRAFT. Information Assurance Group. Evidence Element 9 appendix 31
THE MORAY COUNCIL Guidance on data security breach management Information Assurance Group DRAFT Based on the ICO Guidance on data security breach management under the Data Protection Act 1 Document Control
Job Description. Director of Fundraising and Marketing
Job Title: Brand Manager Salary and Pay Band: Band F, Level 2 Hours: Job Holder: Team (Directorate/ Nation): Location: Manager: 35 hours per week Vacant Fundraising and Marketing, MS National Centre North
MARKETING Market research market strategy target market market mix Market Research
MARKETING Marketing is the management process for identifying and anticipating customer requirements profitably. All company policies and activities should be directed toward satisfying customer needs.
SECURING YOUR SMALL BUSINESS. Principles of information security and risk management
SECURING YOUR SMALL BUSINESS Principles of information security and risk management The challenge Information is one of the most valuable assets of any organization public or private, large or small and
Guide to Penetration Testing
What to consider when testing your network HALKYN CONSULTING 06 May 11 T Wake CEH CISSP CISM CEH CISSP CISM Introduction Security breaches are frequently in the news. Rarely does a week go by without a
No time for heroes: creating effective high performing leadership teams. By Professor Peter Hawkins - Leadership Team Breakfast Seminar
No time for heroes: creating effective high performing leadership teams By Professor Peter Hawkins - Leadership Team Breakfast Seminar Bath Consultancy Group 2011 2 Three conditions necessary for effective
New Zealand Company Six full time technical staff Offices in Auckland and Wellington
INCREASING THE VALUE OF PENETRATION TESTING ABOUT YOUR PRESENTER Brett Moore Insomnia Security New Zealand Company Six full time technical staff Offices in Auckland and Wellington Penetration Testing Web
AUTOMOBILE LIABILITY & PHYSICAL DAMAGE COVERAGE AGREEMENT PART A GENERAL
AUTOMOBILE LIABILITY & PHYSICAL DAMAGE COVERAGE AGREEMENT PART A GENERAL I. The TASB Risk Management Fund (Fund) provides coverage as outlined in this Automobile Liability & Physical Damage Coverage Agreement.
Penetration Testing in Romania
Penetration Testing in Romania Adrian Furtunǎ, Ph.D. 11 October 2011 Romanian IT&C Security Forum Agenda About penetration testing Examples Q & A 2 What is penetration testing? Method for evaluating the
GENERATING VALUE WITH CONTINUOUS SECURITY TESTING
GENERATING VALUE WITH CONTINUOUS SECURITY TESTING AND MEASUREMENT A Spire Research Report Sponsored by Core Security Technologies 2010-2011 Spire Security, LLC. All rights reserved. The Value of Continuous
Security Testing. Vulnerability Assessment vs Penetration Testing. Gabriel Mihai Tanase, Director KPMG Romania. 29 October 2014
Security Testing Vulnerability Assessment vs Penetration Testing Gabriel Mihai Tanase, Director KPMG Romania 29 October 2014 Agenda What is? Vulnerability Assessment Penetration Testing Acting as Conclusion
Buying a Franchise. www.vetbizresourcecenter.org Copyright 2009 Virginia SBDC Network All rights reserved
Buying a Franchise An important step in the small business startup process is deciding whether or not to go into business at all. Each year, thousands of potential entrepreneurs are faced with this difficult
Securing Critical Information Assets: A Business Case for Managed Security Services
White Paper Securing Critical Information Assets: A Business Case for Managed Security Services Business solutions through information technology Entire contents 2004 by CGI Group Inc. All rights reserved.
The Business Plan and You
The Business Plan and You BUSINESS START-UP For more information, contact: The Business Link Edmonton: 100 10237 104 Street NW Edmonton, Alberta T5J 1B1 Calgary: 250 639 5 Avenue SW Calgary, Alberta T2P
Guidance on data security breach management
Guidance on data security breach management Organisations which process personal data must take appropriate measures against unauthorised or unlawful processing and against accidental loss, destruction
If a Client and a Freelancer enter an independent contractor relationship, then this Freelancer Agreement ( Freelancer Agreement ) will apply.
Freelancer Agreement If a Client and a Freelancer enter an independent contractor relationship, then this Freelancer Agreement ( Freelancer Agreement ) will apply. This Agreement is effective as of March
Addressing the SANS Top 20 Critical Security Controls for Effective Cyber Defense
A Trend Micro Whitepaper I February 2016 Addressing the SANS Top 20 Critical Security Controls for Effective Cyber Defense How Trend Micro Deep Security Can Help: A Mapping to the SANS Top 20 Critical
ITEC441- IS Security. Chapter 15 Performing a Penetration Test
1 ITEC441- IS Security Chapter 15 Performing a Penetration Test The PenTest A penetration test (pentest) simulates methods that intruders use to gain unauthorized access to an organization s network and
Four Top Emagined Security Services
Four Top Emagined Security Services. www.emagined.com Emagined Security offers a variety of Security Services designed to support growing security needs. This brochure highlights four key Emagined Security
Why Your Business Needs a Website: Ten Reasons. Contact Us: 727.542.3592 [email protected]
Why Your Business Needs a Website: Ten Reasons Contact Us: 727.542.3592 [email protected] Reason 1: Does Your Competition Have a Website? As the owner of a small business, you understand
BUYING OR SELLING A BUSINESS: A CHECKLIST FOR SUCCESSFULLY NEGOTIATING PRICE
BUYING OR SELLING A BUSINESS: A CHECKLIST FOR SUCCESSFULLY NEGOTIATING PRICE Phil Thompson Business Lawyer, Corporate Counsel www.thompsonlaw.ca A COMMON GOAL AND COMMON UNDERSTANDINGS Agreed: Our common
Penetration Testing and Its Methodologies
Penetration Testing and Its Methodologies By Bhashit Pandya Web Security Researcher Penetration Testing and Methodologies is licensed under a Creative Commons Attribution-NoDerivs 3.0 Unported License.
What is Penetration Testing?
White Paper What is Penetration Testing? An Introduction for IT Managers What Is Penetration Testing? Penetration testing is the process of identifying security gaps in your IT infrastructure by mimicking
Who owns non-personal data? Legal aspects and challenges related to the creation of new industrial data rights
GRUR meets Brussels Workshop 2016 Who owns non-personal data? Legal aspects and challenges related to the creation of new industrial data rights Prof. Dr. Andreas Wiebe, LL.M. Chair for Civil Law, Intellectual
Cybersecurity Strategic Consulting
Home Overview Challenges Global Resource Growth Impacting Industries Why Capgemini Capgemini & Sogeti Cybersecurity Strategic Consulting Enabling business ambitions, resilience and cost efficiency with
WHITE PAPER ON SECURITY TESTING IN TELECOM NETWORK
WHITE PAPER ON SECURITY TESTING IN TELECOM NETWORK DATE OF RELEASE: 27 th July 2012 Table of Contents 1. Introduction... 2 2. Need for securing Telecom Networks... 3 3. Security Assessment Techniques...
Glossary of Accounting Terms
Glossary of Accounting Terms Accruals or Income & Expenditure Accounts This is where accounts are prepared in a way that shows not only what happened in a period, but what should have happened in the period.
Preventive Approach for Web Applications Security Testing OWASP 10/30/2009. The OWASP Foundation http://www.owasp.org
Preventive Approach for Web Applications Security Testing 10/30/2009 Luiz Otávio Duarte Ferrucio de Franco Rosa Walcir M. Cardoso Jr. Renato Archer Information Technology Center Brazilian Ministry of Science
Business Models of Innovation Closed Innovation and Open Innovation (Topic 7 (c))
Business Models of Innovation Closed Innovation and Open Innovation (Topic 7 (c)) NATIONAL WORKSHOP ON INNOVATION PROMOTION AND TECHNOLOGY TRANSFER Belgrade, June 21 and 22, 2011 What is Open Innovation?
Introduction to PCI DSS
Month-Year Introduction to PCI DSS March 2015 Agenda PCI DSS History What is PCI DSS? / PCI DSS Requirements What is Cardholder Data? What does PCI DSS apply to? Payment Ecosystem How is PCI DSS Enforced?
IoT & INFOSEC: A REPORT FROM THE TRENCHES - AGC IT Conference- July 2015 [email protected]
IoT & INFOSEC: A REPORT FROM THE TRENCHES - AGC IT Conference- July 2015 SECURITY IS A PROCESS, NOT A STATE CARVE SYSTEMS LLC [email protected] Carve s Roots (tl;dr)
What s Wrong with Information Security Today? You are looking in the wrong places for the wrong things.
What s Wrong with Information Security Today? You are looking in the wrong places for the wrong things. AGENDA Current State of Information Security Data Breach Statics Data Breach Case Studies Why current
Guidance on data security breach management
ICO lo Guidance on data security breach management Data Protection Act Contents... 1 Data Protection Act... 1 Overview... 1 Containment and recovery... 2 Assessing the risks... 3 Notification of breaches...
How To Teach A Sales Management Course
THE AMERICAN UNIVERSITY IN CAIRO SCHOOL OF BUSINESS DEPARTMENT OF MANAGEMENT SYLLABUS SALES MANAGEMENT (MBA) MARKETING 523 (01) FALL SEMESTER 2012 Instructor name: Mohamed Radwan Office number: BEC 2047
Dual DVI USB KVM Switch
SV231DD2DUA SV431DD2DUA Instruction Manual Dual DVI USB KVM Switch 2/4-Port Dual DVI, USB KVM Switch with Audio and USB 2.0 Hub Manual Revision:08/19/2010 For the most up-to-date information, please visit
Penetration Testing for iphone Applications Part 1
Penetration Testing for iphone Applications Part 1 This article focuses specifically on the techniques and tools that will help security professionals understand penetration testing methods for iphone
Web application security: automated scanning versus manual penetration testing.
Web application security White paper January 2008 Web application security: automated scanning versus manual penetration testing. Danny Allan, strategic research analyst, IBM Software Group Page 2 Contents
NEW YORK STATE TEACHER CERTIFICATION EXAMINATIONS
NEW YORK STATE TEACHER CERTIFICATION EXAMINATIONS TEST DESIGN AND FRAMEWORK September 2014 Authorized for Distribution by the New York State Education Department This test design and framework document
INTRODUCTION TO PENETRATION TESTING
82-02-67 DATA SECURITY MANAGEMENT INTRODUCTION TO PENETRATION TESTING Stephen Fried INSIDE What is Penetration Testing? Terminology; Why Test? Types of Penetration Testing; What Allows Penetration Testing
Data breach, cyber and privacy risks. Brian Wright Lloyd Wright Consultants Ltd
Data breach, cyber and privacy risks Brian Wright Lloyd Wright Consultants Ltd Contents Data definitions and facts Understanding how a breach occurs How insurance can help to manage potential exposures
SAP FI - Automatic Payment Program (Configuration and Run)
SAP FI - Automatic Payment Program (Configuration and Run) Applies to: SAP ECC 6.0. For more information, visit the Financial Excellence homepage. Summary This document helps you to configure and run Automatic
CBEST FAQ February 2015
CBEST Frequently Asked Questions: February 2015 At this time, the UK Financial Authorities have only made CBEST available to firms and FMIs which they consider to be core to the UK financial system. Those
6 Myths About Copyrights That Put Your Church At Risk ChristianCopyrightSolutions.com 1.855.576.5837 The information contained herein is for
6 Myths About Copyrights That Put Your Church at Risk Overview Music performance rights represent a fairly simple concept, but one that is often misunderstood by churches. Myths often spread when there
Terms and Conditions for Visma Solutions ISV Partner Programs and usage of API of Netvisor, Severa, Maventa and Navita solutions
Terms and Conditions for Visma Solutions ISV Partner Programs and usage of API of Netvisor, Severa, Maventa and Navita solutions Please read carefully these terms and conditions before you join the programs
IAM APPROVED EXAMINATION VENUES
IAM APPROVED EXAMINATION VENUES TECHNICAL REQUIREMENTS Introduction to IAM Examinations and Examination Venues... 2 General Requirements... 2 Technical requirements... 3 Becoming an IAM Approved Examination
HIPAA: Privacy/Info Security
HIPAA: Privacy/Info Security Jeff Jones HIPAA Privacy Officer HIPAA Information Security Officer KY Region What you should know Discussion Topics Protected Health Security Awareness Information(PHI) Disclosure
The Trading Profit and Loss Account
The Trading Profit and Loss Account Businesses usually calculate their profit level by creating a Trading Profit and Loss Account (TPL) The TPL is produced because: It is a legal requirement It summarises
Digital Pathways. Penetration Testing
Penetration Testing [email protected] Penetration testing, vulnerability tests, assurance projects, ethical hacking it all means broadly the same thing; testing a corporate network to determine
An approach to Web Application Penetration Testing. By: Whiskah
An approach to Web Application Penetration Testing By: Whiskah #whiskah Security enthusiast NOT a CI$$P, CIS*, GIAC, MCS*, CCN* NOT Lulzsec or Anonymous :) Don t be confused Vulnerability assessment identify,
WHY WRITE A BUSINESS PLAN?
KANSAS SMALL BUSINESS DEVELOPMENT CENTER PITTSBURG STATE UNIVERSITY PITTSBURG, KS 66762 PHONE: 620 235 4920; FAX: 620 235 4919 e mail: [email protected] WHY WRITE A BUSINESS PLAN? A business plan is
Creating and Maintaining a Professional Practice
Creating and Maintaining a Professional Practice Provided by The AIA Trust in coordination with Victor O. Schinnerer & Company, Inc. Starting your own firm is a challenge; structuring it to survive is
Latvian National Project Management Association (LNPMA) and its major directions of operation during 10 years
Latvian National Project Management Association (LNPMA) and its major directions of operation during 10 years Prof. Dr.oec. Žanete Ilmete, LNPMA Board Chairwoman 1 Factors promoting rapid development of
CPS122 Lecture: State and Activity Diagrams in UML
CPS122 Lecture: State and Activity Diagrams in UML Objectives: last revised February 14, 2012 1. To show how to create and read State Diagrams 2. To introduce UML Activity Diagrams Materials: 1. Demonstration
CYBER SECURITY: A REPORT FROM THE TRENCHES 2015 AGC NATIONAL & CHAPTER LEADERSHIP CONFERENCE [email protected]
CYBER SECURITY: A REPORT FROM THE TRENCHES 2015 AGC NATIONAL & CHAPTER LEADERSHIP CONFERENCE SECURITY IS A PROCESS, NOT A STATE CARVE SYSTEMS LLC [email protected] How did I get here? (short
Dipl.-Ing. Frank Ganssloser, CEO AVAT Automation
Broschuere_Image_Final 14.05.2007 16:29 Uhr Seite 1 O U R C A PA B I L I T I ES Comprehensive knowledge of large engine technology Market-leading competence in the development of control technology Total
Creative Industries Workshop Key IPR Issues
THE INSTITUTE OF BUSINESS ADVISERS LONDON BRANCH Creative Industries Workshop Key IPR Issues Dr Rosanna Cooper, Principal, RT Coopers Telfords Yard, 6/8 The Highway London, E1W 2BS Tel: +44 207 488 2985
Information Security Services
Information Security Services Information Security In 2013, Symantec reported a 62% increase in data breaches over 2012. These data breaches had tremendous impacts on many companies, resulting in intellectual
2014 NETWORK SECURITY & CYBER RISK MANAGEMENT: THE THIRD ANNUAL SURVEY OF ENTERPRISE-WIDE CYBER RISK MANAGEMENT PRACTICES IN EUROPE
2014 NETWORK SECURITY & CYBER RISK MANAGEMENT: THE THIRD ANNUAL SURVEY OF ENTERPRISE-WIDE CYBER RISK MANAGEMENT PRACTICES IN EUROPE February 2014 Sponsored by: 2014 Network Security & Cyber Risk Management:
3 Email Marketing Security Risks. How to combat the threats to the security of your Email Marketing Database
3 Email Marketing Security Risks How to combat the threats to the security of your Email Marketing Database Email Marketing Guide June 2013 Security Threats PROTECTING YOUR EMAIL DATABASE FROM HACKERS
Business Plan template
template If you re considering establishing or purchasing a small business, it s important that you have a Business Plan. This plan will help provide you with an essential road map for your new business.
Keren Elazari Hackers: The Internet s Immune System
Keren Elazari Hackers: The Internet s Immune System For the past three decades, hackers have done a lot of things, but they have also impacted civil liberties, innovation and Internet freedom, so I think
20 th Year of Publication. A monthly publication from South Indian Bank. www.sib.co.in
To kindle interest in economic affairs... To empower the student community... Open YAccess www.sib.co.in [email protected] A monthly publication from South Indian Bank 20 th Year of Publication Experience
BARRY F. LORENZETTI MISSION STATEMENT A MESSAGE FROM THE PRESIDENT
15 MISSION STATEMENT To be the most professional, client-oriented and innovative insurance brokerage and consulting firm in Canada, through a disciplined and dedicated team approach. A MESSAGE FROM THE
The Emergence of the ISO in Community Banking Patrick H. Whelan CISA IT Security & Compliance Consultant
THE MARKET LEADER IN IT, SECURITY AND COMPLIANCE SERVICES FOR COMMUNITY FINANCIAL INSTITUTIONS The Emergence of the ISO in Community Banking Patrick H. Whelan CISA IT Security & Compliance Consultant Agenda