Securing the Internet of Things: Mapping Attack Surface Areas Using the OWASP IoT Top 10
|
|
|
- Job Lang
- 8 years ago
- Views:
Transcription
1 SESSION ID: ASD-T10 Securing the Internet of Things: Mapping Attack Surface Areas Using the OWASP IoT Top 10 Daniel Miessler Security Research HP Fortify on
2 HP Fortify on Demand Security Research & Development Penetration Testing OWASP Project Leader (IoT, Mobile) 2
3 The Plan Let s Talk About Naming A Vision of the Future (Universal Daemonization) Why IoT is Currently Broken Examples From Research The OWASP IoT Project Applying What We ve Learned One more thing 3
4 What does it mean? 4
5 What does it mean? [ WIKIPEDIA ] The Internet of Things (IoT) is the network of physical objects or "things" embedded with electronics, software, sensors and connectivity to enable it to achieve greater value and service by exchanging data with the manufacturer, operator and/or other connected devices. [ OXFORD ] A proposed development of the Internet in which everyday objects have network connectivity, allowing them to send and receive data. 5
6 Better Names Universal Daemonization Universal Object Interaction Programmable Object Interfaces (POIs) Transfurigated Phase Inversion 6
7 The Real Internet of Things 7
8 The Real Internet of Things 8
9 Universal Daemonization 9
10 The Current IoT Security Problem 10
11 The Current IoT Security Problem network services, encryption, firewall, input 11
12 The Current IoT Security Problem network application authn, authz, input validation, etc. 12
13 The Current IoT Security Problem network application mobile insecure APIs, lack of encryption, etc. 13
14 The Current IoT Security Problem network application mobile cloud yadda yadda AuthSessionAccess 14
15 IoT Security is the Worst-of-All-Worlds network application mobile cloud services, encryption, firewall, input authn, authz, input validation, etc. insecure APIs, lack of encryption, etc. yadda yadda AuthSessionAccess IoT net + app + mobile + cloud = IoT 15
16 The Current IoT Security Problem network application mobile cloud IoT = 5 16
17 IoT Security Fail Examples network application mobile cloud IoT 17
18 IoT Security Fail Examples (Authentication) network application mobile cloud IoT 10/10 security systems accept Account enumeration Lack of account lockout 18
19 IoT Security Fail Examples (Update Systems) network application mobile cloud IoT No signing of updates Download over FTP Server was world-writeable Server held ALL products 19
20 IoT Security Fail Examples network application mobile cloud IoT 10/10 security systems accept /10 security systems with no lockout 10/10 security systems with enumeration SSH listeners with root/ access 6/10 web interfaces with XSS/SQLi 70% of devices not using encryption 8/10 collected personal information 9/10 had no two-factor options Unauthenticated video streaming Completely flawed software update systems 20
21 The Need for a Methodology network application mobile cloud IoT 21
22 Mapping IoT Attack Surface Areas 22
23 OWASP IoT: I1 Insecure Web Interface 23
24 OWASP IoT: I1 Insecure Web Interface 24
25 OWASP IoT: I2 Insecure Network Services 25
26 OWASP IoT: I3 Lack of Transport Encryption 26
27 OWASP IoT: I5 Privacy Concerns 27
28 OWASP IoT: I6 Insecure Cloud Interface 28
29 OWASP IoT: I7 Insecure Mobile Interface 29
30 OWASP IoT: I8 Insufficient Security Configurability 30
31 OWASP IoT: I9 Insecure Software/Firmware 31
32 OWASP IoT: I10 Poor Physical Security 32
33 OWASP IoT Project Goals 1. Understand the main attack surface areas for any IoT device or ecosystem 33
34 OWASP IoT Project Goals 1. Understand the main attack surface areas for any IoT device or ecosystem 2. As a tester, be able to hit the major issues for each surface area for the product you re testing 34
35 OWASP IoT Project Goals 1. Understand the main attack surface areas for any IoT device or ecosystem 2. As a tester, be able to hit the major issues for each surface area for the product you re testing 3. As a manufacturer, be able to ensure that you ve done your due diligence in security across the main surface areas 35
36 OWASP IoT Project Goals 1. Understand the main attack surface areas for any IoT device or ecosystem 2. As a tester, be able to hit the major issues for each surface area for the product you re testing 3. As a manufacturer, be able to ensure that you ve done your due diligence in security across the main surface areas 4. As a developer, be able to ensure that you re avoiding the top security issues while building your particular component 36
37 OWASP IoT Project Goals 1. Understand the main attack surface areas for any IoT device or ecosystem 2. As a tester, be able to hit the major issues for each surface area for the product you re testing 3. As a manufacturer, be able to ensure that you ve done your due diligence in security across the main surface areas 4. As a developer, be able to ensure that you re avoiding the top security issues while building your particular component 5. As a consumer, ensure you re using the technology safely 37
38 OWASP IoT Project Goals 1. Understand the main attack surface areas for any IoT device or ecosystem 2. As a tester, be able to hit the major issues for each surface area for the product you re testing 3. As a manufacturer, be able to ensure that you ve done your due diligence in security across the main surface areas 4. As a developer, be able to ensure that you re avoiding the top security issues while building your particular component 5. As a consumer, ensure you re using the technology safely 38
39 OWASP IoT Project Organization 39
40 OWASP IoT Project (Context-based Recommendations) 40
41 OWASP IoT Project (Consumer Recommendations) 41
42 OWASP IoT Project (FAQ) 1. If IoT is just a collection of other technologies, why not just use existing OWASP projects? 42
43 OWASP IoT Project (FAQ) 1. If IoT is just a collection of other technologies, why not just use existing OWASP projects? (one place, multiple spaces) 2. Why call it a Top 10 List, which is traditionally a list of vulnerabilities? 43
44 OWASP IoT Project (FAQ) 1. If IoT is just a collection of other technologies, why not just use existing OWASP projects? (one place, multiple spaces) 2. Why call it a Top 10 List, which is traditionally a list of vulnerabilities? (tradition, approachability) 3. Why not have X category, or Y category, or you should move I7 to I2, etc. 44
45 OWASP IoT Project (FAQ) 1. If IoT is just a collection of other technologies, why not just use existing OWASP projects? (one place, multiple spaces) 2. Why call it a Top 10 List, which is traditionally a list of vulnerabilities? (tradition, approachability) 3. Why not have X category, or Y category, or you should move I7 to I2, etc. (excellent, come help) 45
46 How to Apply This Concept Application 46
47 How to Apply This Concept Application The Internet of Things is not just about sensors and machines. It s about people, and how they will continuously interact with their environments through their personal assistants and Universal Daemonization. 47
48 How to Apply This Concept The Internet of Things is not just about sensors and machines. It s about people, and how they will continuously interact with their environments through their personal assistants and Universal Daemonization. Application You now know the future before others do, and can use that knowledge to inform better decisions. 48
49 How to Apply This Concept The Internet of Things is not just about sensors and machines. It s about people, and how they will continuously interact with their environments through their personal assistants and Universal Daemonization. Application You now know the future before others do, and can and use that knowledge to inform better decisions. IoT Security is broken for three reasons: it s worst-of-all-worlds scenario, nobody is paid to secure IoT, and 1+1=5 when it comes to security and complexity. 49
50 How to Apply This Concept The Internet of Things is not just about sensors and machines. It s about people, and how they will continuously interact with their environments through their personal assistants and Universal Daemonization. Application You now know the future before others do, and can use that knowledge to inform better decisions. IoT Security is broken for three reasons: it s worst-of-all-worlds scenario, nobody is paid to secure IoT, and 1+1=5 when it comes to security and complexity. You can now identify the common causes for the mistakes, and look out for them in projects you consult on. 50
51 How to Apply This Concept Application The Internet of Things is not just about sensors and machines. It s about people, and how they will continuously interact with their environments through their personal assistants and Universal Daemonization. Know the future before others do, and use that knowledge to inform better decisions. IoT Security is broken for three reasons: it s worst-of-all-worlds scenario, nobody is paid to secure IoT, and 1+1=5 when it comes to security and complexity. You can now identify the common causes for the mistakes, and look out for them in projects you consult on. The OWASP IoT Top 10 Project maps IoT attack surface areas and gives contextual and prescriptive guidance on how to avoid vulnerabilities within each. 51
52 How to Apply This Concept Application The Internet of Things is not just about sensors and machines. It s about people, and how they will continuously interact with their environments through their personal assistants and Universal Daemonization. Know the future before others do, and use that knowledge to inform better decisions. IoT Security is broken for three reasons: it s worst-of-all-worlds scenario, nobody is paid to secure IoT, and 1+1=5 when it comes to security and complexity. You can now identify the common causes for the mistakes, and look out for them in projects you consult on. The OWASP IoT Top 10 Project maps IoT attack surface areas and gives contextual and prescriptive guidance on how to avoid vulnerabilities within each. You can now use the OWASP IoT Project as a tangible guide to securing the IoT systems you work with. 52
53 Other IoT Resources Build It Securely Project (connects SMBs with researchers) Mark Stanislav and Zach Lanier I am the Cavalry (focuses on automotive IoT security) Josh Corman IoT Firmware Testing Training Paul Asadoorian (BlackHat) 53
54 Just One More Thing OWASP IoT Top 10 Mini-poster! Card stock Two-sided Covers Top 10 Surface Areas Available for download as well 54
What someone said about junk hacking
What someone said about junk hacking Yes, we get it. Cars, boats, buses, and those singing fish plaques are all hackable and have no security. Most conferences these days have a whole track called "Junk
Security in Smart Grid / IoT. Nenad Andrejević Comtrade Solutions Engineering
Security in Smart Grid / IoT Nenad Andrejević Comtrade Solutions Engineering Introduction Why is security important With so much of our lives connected to the Internet from our critical infrastructure
IoT Potential Risks and Challenges
IoT Potential Risks and Challenges GRIFES / GITI / EPFL Alumni Conference, Lausanne, May 7 th, 2015 Stefan Schiller, HP ESP Fortify Solution Architect D/A/CH IoT Potential Risks and Challenges Agenda IDC
Passing PCI Compliance How to Address the Application Security Mandates
Passing PCI Compliance How to Address the Application Security Mandates The Payment Card Industry Data Security Standards includes several requirements that mandate security at the application layer. These
Cloud Security:Threats & Mitgations
Cloud Security:Threats & Mitgations Vineet Mago Naresh Khalasi Vayana 1 What are we gonna talk about? What we need to know to get started Its your responsibility Threats and Remediations: Hacker v/s Developer
Goals. Understanding security testing
Getting The Most Value From Your Next Network Penetration Test Jerald Dawkins, Ph.D. True Digital Security p. o. b o x 3 5 6 2 3 t u l s a, O K 7 4 1 5 3 p. 8 6 6. 4 3 0. 2 5 9 5 f. 8 7 7. 7 2 0. 4 0 3
Using Nessus In Web Application Vulnerability Assessments
Using Nessus In Web Application Vulnerability Assessments Paul Asadoorian Product Evangelist Tenable Network Security pasadoorian@tenablesecurity.com About Tenable Nessus vulnerability scanner, ProfessionalFeed
Security Advice for Instances in the HP Cloud
Security Advice for Instances in the HP Cloud Introduction: HPCS protects the infrastructure and management services offered to customers including instance provisioning. An instance refers to a virtual
Security Testing. Vulnerability Assessment vs Penetration Testing. Gabriel Mihai Tanase, Director KPMG Romania. 29 October 2014
Security Testing Vulnerability Assessment vs Penetration Testing Gabriel Mihai Tanase, Director KPMG Romania 29 October 2014 Agenda What is? Vulnerability Assessment Penetration Testing Acting as Conclusion
OWASP Top Ten Backdoors
OWASP Top Ten Backdoors 1 Yaniv Simsolo, COMSEC Consulting The news about the above agreement was posted on Cisco site in mid 1998. Shortly this news was removed from Cisco website. Gradually all this
Security and the Internet of Things (IoT)
Security and the Internet of Things (IoT) Analysis and Recommendations for IoT Manufacturers and IT/Business Executives Wei (Weslay) Xu Tuck School of Business at Dartmouth 03/20/2015 High Level Description
ETHICAL HACKING 010101010101APPLICATIO 00100101010WIRELESS110 00NETWORK1100011000 101001010101011APPLICATION0 1100011010MOBILE0001010 10101MOBILE0001
001011 1100010110 0010110001 010110001 0110001011000 011000101100 010101010101APPLICATIO 0 010WIRELESS110001 10100MOBILE00010100111010 0010NETW110001100001 10101APPLICATION00010 00100101010WIRELESS110
Web App Security Audit Services
locuz.com Professional Services Web App Security Audit Services The unsecured world today Today, over 80% of attacks against a company s network come at the Application Layer not the Network or System
IoT & SCADA Cyber Security Services
IoT & SCADA Cyber Security Services RIOT SOLUTIONS PTY LTD P.O. Box 10087, Adelaide St Brisbane QLD 4000 BRISBANE HEAD OFFICE Level 4, 60 Edward St, Brisbane, QLD 4000 T: 1300 744 028 Email: sales@riotsolutions.com.au
Weak Spots in Enterprise Mobility Management Dennis Schröder
Weak Spots in Enterprise Mobility Management Dennis Schröder Personal details TÜV Informationstechnik GmbH TÜV NORD GROUP Dennis Schröder, M. Sc. IT Security Business Security & Privacy Product Manager
Penetration Testing in Romania
Penetration Testing in Romania Adrian Furtunǎ, Ph.D. 11 October 2011 Romanian IT&C Security Forum Agenda About penetration testing Examples Q & A 2 What is penetration testing? Method for evaluating the
Great Now We Have to Secure an Internet of Things. John Pescatore SANS Director, Emerging Security Trends @John_Pescatore
Great Now We Have to Secure an Internet of Things John Pescatore SANS Director, Emerging Security Trends @John_Pescatore 1 What the Heck is That?? 2 Different Views of the Internet of Things 3 Different
PCI Compliance Updates
PCI Compliance Updates E-Commerce / Cloud Security Adam Goslin, Chief Operations Officer AGoslin@HighBitSecurity.com Direct: 248.388.4328 PCI Guidance Google: PCI e-commerce guidance https://www.pcisecuritystandards.org/pdfs/pci_dss_v2_ecommerce_guidelines.pdf
Secure Services and Quality Testing SST. Security Engineering Privacy by Design Trusted Solutions. Mario Hoffmann. for Service Ecosystems
Secure Services and Quality Testing SST Security Engineering Privacy by Design Trusted Solutions for Service Ecosystems Mario Hoffmann Head of Department Fraunhofer AISEC in a nutshell Fraunhofer Profile
The Top Web Application Attacks: Are you vulnerable?
QM07 The Top Web Application Attacks: Are you vulnerable? John Burroughs, CISSP Sr Security Architect, Watchfire Solutions jburroughs@uk.ibm.com Agenda Current State of Web Application Security Understanding
Mobile Application Security
Mobile Application Security Jack Mannino Anand Vemuri June 25, 2015 About Us Jack Mannino CEO at nvisium UI and UX development impaired Enjoys: Scala, Elixir Tolerates: Java Allergic To: Cats, Pollen,.NET
From the Bottom to the Top: The Evolution of Application Monitoring
From the Bottom to the Top: The Evolution of Application Monitoring Narayan Makaram, CISSP Director, Security Solutions HP/Enterprise Security Business Unit Session ID: SP01-202 Session 2012 Classification:
Application Security Testing
Tstsec - Version: 1 09 July 2016 Application Security Testing Application Security Testing Tstsec - Version: 1 4 days Course Description: We are living in a world of data and communication, in which the
Mobile Application Security Study
Report Mobile Application Security Study 2013 report Table of contents 3 Report Findings 4 Research Findings 4 Privacy Issues 5 Lack of Binary Protection 5 Insecure Data Storage 5 Transport Security 6
Bring Your Own Internet of Things: BYO IoT
SESSION ID: CSV F02 Bring Your Own Internet of Things: BYO IoT Carsten Eiram Chief Research Officer Risk Based Security @carsteneiram Jake Kouns CISO Risk Based Security @jkouns Agenda What is IoT? What
The Internet of Things: 4 security dimensions of smart devices
The Internet of Things: 4 security dimensions of smart devices Like all major technological revolutions, digital transformation is spreading over many areas: home automation, physical security, mobility,
Bridging the BYOD Gap Leveraging Existing Infrastructure and Policies
Bridging the BYOD Gap Leveraging Existing Infrastructure and Policies BYOD Stats Bring Your Own Device a Growing Trend Creating Concern Amongst IT Decision Makers (ITDM) Currently In One Year 21% 8% 51%
Security and the Internet of Things
Security and the Internet of Things Joe Sanford 1. Abstract More and more smart devices are being introduced to the market, allowing end-users to have more of the devices they use every day to be connected
Android (in)security. Having fun with Android. Sarantis Makoudis
Android (in)security Having fun with Android Sarantis Makoudis About Me BSc in Digital Systems, University of Piraeus, 2010 MSc in Information Security, Royal Holloway, University of London,2012 Penetration
Workday Mobile Security FAQ
Workday Mobile Security FAQ Workday Mobile Security FAQ Contents The Workday Approach 2 Authentication 3 Session 3 Mobile Device Management (MDM) 3 Workday Applications 4 Web 4 Transport Security 5 Privacy
ITEC441- IS Security. Chapter 15 Performing a Penetration Test
1 ITEC441- IS Security Chapter 15 Performing a Penetration Test The PenTest A penetration test (pentest) simulates methods that intruders use to gain unauthorized access to an organization s network and
PCI-DSS Penetration Testing
PCI-DSS Penetration Testing Adam Goslin, Co-Founder High Bit Security May 10, 2011 About High Bit Security High Bit helps companies obtain or maintain their PCI compliance (Level 1 through Level 4 compliance)
FINAL DoIT 04.01.2013- v.8 APPLICATION SECURITY PROCEDURE
Purpose: This procedure identifies what is required to ensure the development of a secure application. Procedure: The five basic areas covered by this document include: Standards for Privacy and Security
Penetration Testing for iphone Applications Part 1
Penetration Testing for iphone Applications Part 1 This article focuses specifically on the techniques and tools that will help security professionals understand penetration testing methods for iphone
1. Why is the customer having the penetration test performed against their environment?
General Questions 1. Why is the customer having the penetration test performed against their environment? Assess vulnerabilities in order to improve security and protect client information. 2. Is the penetration
PKI: THE SECURITY SOLUTION FOR THE INTERNET OF THINGS
PKI: THE SECURITY SOLUTION FOR THE INTERNET OF THINGS TABLE OF CONTENTS 2 EXECUTIVE SUMMARY 3 THE EMERGENCE OF THE INTERNET OF THINGS 4 SECURITY RISKS IN NETWORKED DEVICES 6 PKI S FOUNDATION OF STRONG
PCI Security Standards Council
PCI Security Standards Council Ralph Poore, Director, Emerging Standards 2013 About PCI Emerging Technologies OWASP and Mobile Guidelines About PCI About the PCI Council Open, global forum Founded 2006
Reducing Application Vulnerabilities by Security Engineering
Reducing Application Vulnerabilities by Security Engineering - Subash Newton Manager Projects (Non Functional Testing, PT CoE Group) 2008, Cognizant Technology Solutions. All Rights Reserved. The information
IoT BBQ Carve Systems
IoT BBQ Carve Systems Outline About us (Carve) About IoT Our IoT assessment methodology The Sacred Tenants of IoT Security Some bugs IoT IRL 0xGROG Carve Systems BouDque InformaDon Security ConsulDng Firm
Web attacks and security: SQL injection and cross-site scripting (XSS)
Web attacks and security: SQL injection and cross-site scripting (XSS) License This work by Z. Cliffe Schreuders at Leeds Metropolitan University is licensed under a Creative Commons Attribution-ShareAlike
Adobe Systems Incorporated
Adobe Connect 9.2 Page 1 of 8 Adobe Systems Incorporated Adobe Connect 9.2 Hosted Solution June 20 th 2014 Adobe Connect 9.2 Page 2 of 8 Table of Contents Engagement Overview... 3 About Connect 9.2...
ABSTRACT' INTRODUCTION' COMMON'SECURITY'MISTAKES'' Reverse Engineering ios Applications
Reverse Engineering ios Applications Drew Branch, Independent Security Evaluators, Associate Security Analyst ABSTRACT' Mobile applications are a part of nearly everyone s life, and most use multiple mobile
APPLICATION SECURITY: FROM WEB TO MOBILE. DIFFERENT VECTORS AND NEW ATTACK
APPLICATION SECURITY: FROM WEB TO MOBILE. DIFFERENT VECTORS AND NEW ATTACK John T Lounsbury Vice President Professional Services, Asia Pacific INTEGRALIS Session ID: MBS-W01 Session Classification: Advanced
Quick Start Guide: Utilizing Nessus to Secure Microsoft Azure
Quick Start Guide: Utilizing Nessus to Secure Microsoft Azure Introduction Tenable Network Security is the first and only solution to offer security visibility, Azure cloud environment auditing, system
Columbia University Web Security Standards and Practices. Objective and Scope
Columbia University Web Security Standards and Practices Objective and Scope Effective Date: January 2011 This Web Security Standards and Practices document establishes a baseline of security related requirements
Testing Your Security A Security Testing How To From Someone Who s Likely Broken Into An Organization Just Like Yours
Testing Your Security A Security Testing How To From Someone Who s Likely Broken Into An Organization Just Like Yours Tom Liston Senior Security Consultant InGuardians, Inc. Director InGuardians Labs tom@inguardians.com
Web Application Report
Web Application Report This report includes important security information about your Web Application. OWASP Top Ten 2010 The Ten Most Critical Web Application Report This report was created by IBM Rational
IoT & INFOSEC: A REPORT FROM THE TRENCHES - AGC IT Conference- July 2015 MIKE.ZUSMAN@CARVESYSTEMS.COM
IoT & INFOSEC: A REPORT FROM THE TRENCHES - AGC IT Conference- July 2015 SECURITY IS A PROCESS, NOT A STATE CARVE SYSTEMS LLC MIKE.ZUSMAN@CARVESYSTEMS.COM Carve s Roots (tl;dr)
SERVER HARDENING. Presented by: Daniel Waymel and Corrin Thompson at TexSAW 2014 at the University of Texas at Dallas
SERVER HARDENING Presented by: Daniel Waymel and Corrin Thompson at TexSAW 2014 at the University of Texas at Dallas OUTLINE Intro Securing Your Access Restricting Unwanted Access Monitoring and Alerts
Visa U.S.A Cardholder Information Security Program (CISP) Payment Application Best Practices
This document is to be used to verify that a payment application has been validated against Visa U.S.A. Payment Application Best Practices and to create the Report on Validation. Please note that payment
Connected Intelligence and the 21 st Century Digital Enterprise
Connected Intelligence and the 21 st Century Digital Enterprise Lewis Carr Senior Director, HP Software May 25 th, 2015 By 2025 we will become a deeply connected, digital world Digital everything everywhere,
Introduction to Cyber Security / Information Security
Introduction to Cyber Security / Information Security Syllabus for Introduction to Cyber Security / Information Security program * for students of University of Pune is given below. The program will be
Web Application Security
Chapter 1 Web Application Security In this chapter: OWASP Top 10..........................................................2 General Principles to Live By.............................................. 4
Elevation of Mobile Security Risks in the Enterprise Threat Landscape
March 2014, HAPPIEST MINDS TECHNOLOGIES Elevation of Mobile Security Risks in the Enterprise Threat Landscape Author Khaleel Syed 1 Copyright Information This document is an exclusive property of Happiest
The Android Developers Guide to 3 rd -Party SDK Assessment and Security
SESSION ID: MBS-F02 The Android Developers Guide to 3 rd -Party SDK Assessment and Security Yang Yang( 杨 德 志 ) Mobile Security Researcher and Developer, Trend Micro Advantages of 3 rd -Party SDKs Speed
IoT Security: Problems, Challenges and Solutions
IoT Security: Problems, Challenges and Solutions Liwei Ren, Ph.D Trend Micro Background Liwei Ren Research interests Data security & privacy, network security Data compression, math modeling & algorithms
Secure Software Programming and Vulnerability Analysis
Secure Software Programming and Vulnerability Analysis Christopher Kruegel chris@auto.tuwien.ac.at http://www.auto.tuwien.ac.at/~chris Operations and Denial of Service Secure Software Programming 2 Overview
How the Barracuda Web Application Firewall Secures Your Mobile and IoT Services. Whitepaper
How the Barracuda Web Application Firewall Secures Your Mobile and IoT Services Whitepaper Executive Summary The mobile application space has experienced an unprecedented growth in recent years, and it
Security from a customer s perspective. Halogen s approach to security
September 18, 2015 Security from a customer s perspective Using a cloud-based talent management program can deliver tremendous benefits to your organization, including aligning your workforce, improving
Learning objectives for today s session
Black Box versus White Box: Different App Testing Strategies John B. Dickson, CISSP Learning objectives for today s session Understand what a black box and white box assessment is and how they differ Identify
Secure Cloud and Remote Service Connections for AllJoyn Applications
Secure Cloud and Remote Service Connections for AllJoyn Applications Art Lancaster CTO, Affinegy Chair, Gateway Agent Working Group 12 November 2014 AllSeen Alliance 1 Agenda 1. Gateway Agent Working Group
Building A Secure Microsoft Exchange Continuity Appliance
Building A Secure Microsoft Exchange Continuity Appliance Teneros, Inc. 215 Castro Street, 3rd Floor Mountain View, California 94041-1203 USA p 650.641.7400 f 650.641.7401 ON AVAILABLE ACCESSIBLE Building
How to start a software security initiative within your organization: a maturity based and metrics driven approach OWASP
How to start a software security initiative within your organization: a maturity based and metrics driven approach Marco Morana OWASP Lead/ TISO Citigroup OWASP Application Security For E-Government Copyright
The purpose of this report is to educate our prospective clients about capabilities of Hackers Locked.
This sample report is published with prior consent of our client in view of the fact that the current release of this web application is three major releases ahead in its life cycle. Issues pointed out
SAST, DAST and Vulnerability Assessments, 1+1+1 = 4
SAST, DAST and Vulnerability Assessments, 1+1+1 = 4 Gordon MacKay Digital Defense, Inc. Chris Wysopal Veracode Session ID: Session Classification: ASEC-W25 Intermediate AGENDA Risk Management Challenges
Great ideas, big data and little privacy? Bart Preneel iminds and COSIC KU Leuven
Great ideas, big data and little privacy? Bart Preneel iminds and COSIC KU Leuven 2 3 NSA calls the iphone users public 'zombies' who pay for their own surveillance 4 Snowden revelations NSA: Collect it
Secure Cloud and Remote Service Connections for AllJoyn Applications
Secure Cloud and Remote Service Connections for AllJoyn Applications Art Lancaster CTO, Affinegy Chair, Gateway Agent Working Group 5 February 2015 AllSeen Alliance 1 Agenda 1. Gateway Agent Working Group
Application Security Testing. Generic Test Strategy
Application Security Testing Generic Test Strategy Page 2 of 8 Contents 1 Introduction 3 1.1 Purpose: 3 1.2 Application Security Testing: 3 2 Audience 3 3 Test Strategy guidelines 3 3.1 Authentication
Learning from Patient Zero: Dissecting Recent Data Breaches to Evolve Our Defenses. March 25, 2015; New York; Andrew Hay
Learning from Patient Zero: Dissecting Recent Data Breaches to Evolve Our Defenses March 25, 2015; New York; Andrew Hay Agenda Overview of Recent Data Breaches Investigating Past Breaches Assessing the
PI Cloud Connect. Frequently Asked Questions
PI Cloud Connect Frequently Asked Questions Version 1.0.5 Content FAQ...3 General questions... 3 Signing up... 4 Deployment... 5 Publishing... 5 Subscribing... 6 User accounts... 7 Security... 8 Pricing...
THE HACKERS NEXT TARGET
Governance and Risk Management THE HACKERS NEXT TARGET YOUR WEB AND SOFTWARE Anthony Lim MBA CISSP CSSLP FCITIL Director, Security, Asia Pacific Rational Software ISC2 CyberSecurity Conference 09 Kuala
2016.04.17 Firenze. Iottly, open source Internet of Things distribution
2016.04.17 Firenze About me Stefano Terna Technical co-founder @ TomorrowData @stefanoterna stefanoterna stefano.terna@tomorrodata.io About TomorrowData Domain: IoT & Machine Learning for SMEs Open Source:
Black Box versus White Box: Different App Testing Strategies John B. Dickson, CISSP
Black Box versus White Box: Different App Testing Strategies John B. Dickson, CISSP Learning objectives for today s session Understand different types of application assessments and how they differ Be
White Paper. Guide to PCI Application Security Compliance for Merchants and Service Providers
White Paper Guide to PCI Application Security Compliance for Merchants and Service Providers Contents Overview... 3 I. The PCI DSS Requirements... 3 II. Compliance and Validation Requirements... 4 III.
Inadequacies of Current Risk Controls for the Cloud
Inadequacies of Current Risk Controls for the Cloud Name: Michael Goldsmith Michael Auty, Sadie Creese and Paul Hopkins Venue: CPSRT@CloudCom2010, Indianapolis Date: 2 December 2010 Research supported
TELE 301 Network Management. Lecture 17: File Transfer & Web Caching
TELE 301 Network Management Lecture 17: File Transfer & Web Caching Haibo Zhang Computer Science, University of Otago TELE301 Lecture 17: File Transfer & Web Caching 1 Today s Focus FTP & Web Caching!
Overview of the Penetration Test Implementation and Service. Peter Kanters
Penetration Test Service @ ABN AMRO Overview of the Penetration Test Implementation and Service. Peter Kanters ABN AMRO / ISO April 2010 Contents 1. Introduction. 2. The history of Penetration Testing
05.0 Application Development
Number 5.0 Policy Owner Information Security and Technology Policy Application Development Effective 01/01/2014 Last Revision 12/30/2013 Department of Innovation and Technology 5. Application Development
Security testing the Internet-of-things
Security testing the Internet-of-things Lindholmen Software Development Day 2014-10-16 Emilie Lundin Barse Informa(on Security Consultant, Combitech emilie.barse@combitech.se Contents State of security
How To Protect Your Cloud Computing Resources From Attack
Security Considerations for Cloud Computing Steve Ouzman Security Engineer AGENDA Introduction Brief Cloud Overview Security Considerations ServiceNow Security Overview Summary Cloud Computing Overview
FINAL DoIT 11.03.2015 - v.4 PAYMENT CARD INDUSTRY DATA SECURITY STANDARDS APPLICATION DEVELOPMENT AND MAINTENANCE PROCEDURES
Purpose: The Department of Information Technology (DoIT) is committed to developing secure applications. DoIT s System Development Methodology (SDM) and Application Development requirements ensure that
WEB SITE SECURITY. Jeff Aliber Verizon Digital Media Services
WEB SITE SECURITY Jeff Aliber Verizon Digital Media Services 1 SECURITY & THE CLOUD The Cloud (Web) o The Cloud is becoming the de-facto way for enterprises to leverage common infrastructure while innovating
Cloud-Security: Show-Stopper or Enabling Technology?
Cloud-Security: Show-Stopper or Enabling Technology? Fraunhofer Institute for Secure Information Technology (SIT) Technische Universität München Open Grid Forum, 16.3,. 2010, Munich Overview 1. Cloud Characteristics
MAXIMUM DATA SECURITY with ideals TM Virtual Data Room
MAXIMUM DATA SECURITY with ideals TM Virtual Data Room WWW.IDEALSCORP.COM ISO 27001 Certified Account Settings and Controls Administrators control users settings and can easily configure privileges for
How to Build a Trusted Application. John Dickson, CISSP
How to Build a Trusted Application John Dickson, CISSP Overview What is Application Security? Examples of Potential Vulnerabilities Strategies to Build Secure Apps Questions and Answers Denim Group, Ltd.
OWASP Omaha. The Open Web Application Security Project Omaha Chapter
OWASP Omaha The Open Web Application Security Project Omaha Chapter What is OWASP? The Open Web Application Security Project (OWASP) is a 501(c)(3) worldwide not-for-profit charitable organization focused
Where every interaction matters.
Where every interaction matters. Peer 1 Vigilant Web Application Firewall Powered by Alert Logic The Open Web Application Security Project (OWASP) Top Ten Web Security Risks and Countermeasures White Paper
Penetration Testing Report Client: Business Solutions June 15 th 2015
Penetration Testing Report Client: Business Solutions June 15 th 2015 Acumen Innovations 80 S.W 8 th St Suite 2000 Miami, FL 33130 United States of America Tel: 1-888-995-7803 Email: info@acumen-innovations.com
How to break in. Tecniche avanzate di pen testing in ambito Web Application, Internal Network and Social Engineering
How to break in Tecniche avanzate di pen testing in ambito Web Application, Internal Network and Social Engineering Time Agenda Agenda Item 9:30 10:00 Introduction 10:00 10:45 Web Application Penetration
How to Sell PCI 3.1 to Your Merchants. Matt Brown, Director of Business Development
How to Sell PCI 3.1 to Your Merchants Matt Brown, Director of Business Development MAC is an organization of Bankcard professionals involved in the risk management side of Card Processing. We have members
Application security testing: Protecting your application and data
E-Book Application security testing: Protecting your application and data Application security testing is critical in ensuring your data and application is safe from security attack. This ebook offers
Secure Authentication for the Development of Mobile Internet Services Critical Considerations
Secure Authentication for the Development of Mobile Internet Services Critical Considerations December 2011 V1 Mobile Internet Security Working Group, SIMalliance AGENDA SIMalliance presentation What s
Secure and Reliable Data Exchange with IoT Devices. Vinny Sakore & Amit Trivedi February 29, 2016
Secure and Reliable Data Exchange with IoT Devices Vinny Sakore & Amit Trivedi February 29, 2016 Mobile and Internet of Things (IoT) Security Risk With IoT Technology Nepal Earthquake (April 25, 2015)
Security Considerations in Cloud Deployments Matthew Garrett <matthew.garrett@nebula.com>
Security Considerations in Cloud Deployments Matthew Garrett (cloud) Computing for the Enterprise Security concerns in traditional hosting Someone hacks your system Your hosting
CHANCES AND RISKS FOR SECURITY IN MULTICORE PROCESSORS
CHANCES AND RISKS FOR SECURITY IN MULTICORE PROCESSORS Prof. Dr.-Ing. Georg Sigl Institute for Security in Information Technology Technical University Munich sigl@tum.de Fraunhofer Research Institution
SECURING MOBILE APPLICATIONS
SECURING MOBILE APPLICATIONS Ulf Larson Göteborg ulf.larson@owasp.org ulf.larson@adecco.se A REAL WORLD EXAMPLE TO GET US STARTED Google ClientLogin Authentication Protocol https un/pw auth token... Google
Attack and Penetration Testing 101
Attack and Penetration Testing 101 Presented by Paul Petefish PaulPetefish@Solutionary.com July 15, 2009 Copyright 2000-2009, Solutionary, Inc. All rights reserved. Version 2.2 Agenda Penetration Testing
Pentests more than just using the proper tools
Pentests more than just using the proper tools Agenda 1. Information Security @ TÜV Rheinland 2. Penetration testing Introduction Evaluation scheme Security Analyses of web applications Internal Security
IONA Security Platform
IONA Security Platform February 22, 2002 Igor Balabine, PhD IONA Security Architect Copyright IONA Technologies 2001 End 2 Anywhere Agenda IONA Security Platform (isp) architecture Integrating with Enterprise
Web Application Vulnerability Testing with Nessus
The OWASP Foundation http://www.owasp.org Web Application Vulnerability Testing with Nessus Rïk A. Jones, CISSP rikjones@computer.org Rïk A. Jones Web developer since 1995 (16+ years) Involved with information