ITDays Security issues
|
|
|
- Stewart Warner
- 10 years ago
- Views:
Transcription
1 ITDays Security issues Malicious Intrusion, are we concerned in our Organiza;on? 7 steps to evaluate your situa;on! Christophe Bianco - Christophe Rosenkranz Paul Jung November
2 Agenda Are you concerned? Anatomy of an asack But how i can evaluate if i m concerned? How to implemented that in my organiza;on? Q&A 2
3 Who are we? Paul" Jung!! Security Consultant" Christophe" Rosenkranz! SOC Technical leader" christophe" Bianco!! Managing Partner" Excellium Services Founded in Dec 2012 Focus on Applica;on Security and Intrusion Management 22 Security consultants and analysts An opera;onal Security Opera;on Center and a official Cert Your speakers Christophe B. In charge of the service offering Christophe R. Monitoring and Incident management Specialist Paul J. Intrusion & Forensic Specialist 3
4 Let s start with a ques;on! Who has suffered an intrusion over the last 6 months? How do you discovered it? 4
5
6
7
8
9 Our recent engagements Penetra;on Tes;ng Mission (100% in over the last 3) Passwords Web App vuln Network segmenta;on Forensic Engagement (3 in 2 weeks) Patchs Passwords AV not up to date And we are not considering 0- day a2acks! 9
10 Statements According to mul;ple sources (Verizon DBIR report, M- Trends, Circl,...) Things do not look so good for organiza;on Company are breached with impact repeatedly Intrusion is discovered because someone else told the organisa;on... Many many months ajer the compromise AND issue is that most organiza;ons are more than 80% preven;ve (with no reac;ve capability). 10
11 Anatomy of an asack Advanced post- exploita;on (Encrypted C2 & outbound 443) Lateral Movement/Pivo;ng (Av bypass)? Client- side Exploita;on Detec;on ;meline: - DBIR: 62% take months or more - M- Trends: on average 243 days 11
12 But can t be just a keyword to look for! 12
13 Step 0 - Preven;on Password Strength Regular assessment Plugin Patches 13
14 Ok let s look in detail! 14
15 First look in 7 steps! A first stage of the Con6nuous Security Monitoring Concept! 15
16 Step 1 Profiling (assets, outbound traffic)!!!! New form of asacks are less and less stupid You need to understand normal behavior and look for oddi;es and anomalies What is your network? (network mapping Host, port and service discovery or DHCP logs or CAM table) How much data is sent? Who sends the data (at proxy and firewall levels) Where are you sending the data (ip geolocated and port numbers)? When is the data sent? Reco: Perform this analysis over a 3 month volume of data and the scans at different 8me periods (nighly, week- end,...) 16
17 17
18 Long Tail Principle 18
19 Step 2 Do we have illegal Registry Startup Keys? Long Tail Analysis 1 Query all startup registry keys on all systems 2 Save to a file 3 Sort in order of duplicates, least to most 4 Then inspect the least frequently seen registry keys (works for windows event logs, installed sojware, startup registry keys & DNS logs) The first pass may be somewhat ;me consuming Once that process is complete re- run the script nightly report any new entries 19
20 Step 2 Do we have illegal autorun? Long Tail Analysis Use Group Policy to audit registry keys or WMI by scrip;ng to extract and monitor changes on: Run, RunOnce, Start HKLM\SOFTWARE\Microsoj\Windows\CurrentVersion\Run HKLM\SOFTWARE\Microsoj\Windows\CurrentVersion\RunOnce HKCU\SOFTWARE\Microsoj\Windows\CurrentVersion\Run HKCU\SOFTWARE\Microsoj\Windows\CurrentVersion\RunOnce SOFTWARE\Microsoj\Windows\CurrentVersion\Explorer\Shared Task %userprofile%\appdata\roaming\microsoj\windows\start Menu\Programs \Startup C:\ProgramData\Microsoj\Windows\Start Menu\Programs\Startup And HKCU\SOFTWARE\Wow6432node\Microsoj\Windows\CurrentVersion\Run HKCU\SOFTWARE\Wow6432node\Microsoj\Windows\CurrentVersion\RunOnce 20
21 Or Powershell is your friend (or beser a logon script!!!) $user="starbuck $password="cyl0n $array " ") foreach ($ip in $array) { net use \\$ip $password /u:$user out- null $ip reg query \\$ip\hklm\software\microso`\windows\currentversion\run reg query \\$ip\hklm\so`ware\microso`\windows\currentversion\runonce reg query \\$ip\hku\.default\so`ware\microso`\windows\currentversion\run reg query \\$ip\hklm\software\wow6432node\microso`\windows\currentversion\run 2> $null reg query \\$ip\hklm\software\wow6432node\microso`\windows\currentversion \RunOnce 2> $null } 21
22 Step 3 Persistent / abnormal outbound connexions? Detect recurrent / regular illegal connexions (10 minutes or so is a good threshold) Start by a snapshot of night traffics Hackers make mistakes so look also filtered traffic on the proxy or inner firewall 22
23 Step 4 Proxy logs? Setup correct logging Source / Des;na;on URL Category User Agent Bytes & header Size Referrer Look for: Abnormal volume logs Check 403 denied and 407 Proxy Authrequest Abnormal User Agents Headers size (to catch the malicious ones) 23
24 Step 5 Password & Rights Gain visibility of your privileged account environment Discover all privileged and non- privileged accounts Locate all privileged creden;als including: Passwords SSH keys Password hashes On a regular basis check the resistance of your key password Control usage of the Maleficent Seven Debug Programs - Load drivers Impersonate a client - Take Ownership Act as Part of the OS - Restore files Create a token 24
25 Step 6 Specific Monitoring On Systems (Windows) Registry Key crea;on Service crea;on User crea;on Admin right changes Clearing the Event Log Parsing the psexec, consider specific alerts like AV catching mimikatz, wce,.. On the Network DNS log local DNS requests and resolu;on look for long requests and responses (fail) 25
26 Step 7 Windows Logs Analyses of the following events Type Event IDs Log Create service 7030, 7045 System Create user 4720, 4722, 4724, 4738 Security Add user to group 4732 Security Clear Event log 1102 Security Create RDP cer;ficate 1056 System Insert USB 10000,100001,10100,20001,20002, 20003,24576,24577,24579 System Disable firewall 2003 Firewall 26
27 Step 7 Windows Logs By script Get- WinEvent - ID=4720,4722,4724,4738,4732,1102} Get- WinEvent - ID=7030,7045,1056,7045,10000,100001,10100,20001,20002,20003,24576, 24577,24579} Get- WinEvent - Windows- Windows Firewall With Advanced Security/Firewall"; ID=2003} Control User Rights Allow/deny Log On Locally Allow Log On Through Remote Desktop Services Deny Access via the Network Logon as a service 27
28 How to implement that? Script and do it yourself Or Call us!!!! Mission our EyeGuard Infec;on Assessment Implement log / siem consolida;on tool Subscribe to our Eyeguard Services 28
29 Conclusion While exploits and 0- days are seriously cool and fun to talk about... Who cares? The focus of modern cyber defense is to detect the post- exploita;on ac;vity (what is the end goal)! 1er goal: detec;ng adversary ac;vity toward their goal 2 nd goal: responding to the detec;on (responding to the detec;on before they own the domain) Tools for this new security paradigm Defensible Security Architecture Security opera;on Network Security Monitoring Con;nuous Security Monitoring And do not wait to be breach to start to think about your detec;on capability you can not inves;gate with no info "The only way a domain compromise can be remediated with a high level of certainty is a complete rebuild of it. h'p://blogs.technet.com/b/srd/archive/2014/11/18/addi<onal- informa<on- about- cve aspx 29
30 Spend some ;mes on the SANS Cri;cal Security Controls 1: Inventory of Authorized and Unauthorized Devices 2: Inventory of Authorized and Unauthorized So`ware 3: Secure Configura8ons for Hardware and So`ware on Mobile Devices, Laptops, Worksta8ons, and Servers 4: Con8nuous Vulnerability Assessment and Remedia8on 5: Malware Defenses 6: Applica8on So`ware Security 7: Wireless Access Control 8: Data Recovery Capability 9: Security Skills Assessment and Appropriate Training to Fill Gaps 10: Secure Configura8ons for Network Devices such as Firewalls, Routers, and Switches 11: Limita8on and Control of Network Ports, Protocols, and Services 12: Controlled Use of Administra8ve Privileges 13: Boundary Defense 14: Maintenance, Monitoring, and Analysis of Audit Logs 15: Controlled Access Based on the Need to Know 16: Account Monitoring and Control 17: Data Protec8on 18: Incident Response and Management 19: Secure Network Engineering 20: Penetra8on Tests and Red Team Exercises 30
31 La Code hackademy... (codehackademy.lu) Ini;a;ve Excellium & Cases.lu Première session en janvier 2015 Forma;on à des;na;on des professionnels du développement applica;f En;èrement gratuite, sur 10 semaines, un soir par semaine Théma;ques abordées Principes de sécurité des applica;ons Web introduc;on De l architecture logicielle à la mise en oeuvre Test sécurité des applica;ons Techniques de hacking Infrastructures sécurisées pour héberger les applica;ons Illustra;on de la sécurité d un code Java Security Sécurité des bases de données L exemple d Oracle Approche d un Sojware Developement Life Cycle Malwares et leur analyse U;lisa;on du Cloud Paiement en ligne 31
32 Thanks! Thanks! Excellium Services services.com 32
What s Wrong with Information Security Today? You are looking in the wrong places for the wrong things.
What s Wrong with Information Security Today? You are looking in the wrong places for the wrong things. AGENDA Current State of Information Security Data Breach Statics Data Breach Case Studies Why current
Critical Controls for Cyber Security. www.infogistic.com
Critical Controls for Cyber Security www.infogistic.com Understanding Risk Asset Threat Vulnerability Managing Risks Systematic Approach for Managing Risks Identify, characterize threats Assess the vulnerability
Larry Wilson Version 1.0 November, 2013. University Cyber-security Program Critical Asset Mapping
Larry Wilson Version 1.0 November, 2013 University Cyber-security Program Critical Asset Mapping Part 3 - Cyber-Security Controls Mapping Cyber-security Controls mapped to Critical Asset Groups CSC Control
Top 20 Critical Security Controls
Top 20 Critical Security Controls July 2015 Contents Compliance Guide 01 02 03 04 Introduction 1 How Rapid7 Can Help 2 Rapid7 Solutions for the Critical Controls 3 About Rapid7 11 01 INTRODUCTION The Need
SANS Top 20 Critical Controls for Effective Cyber Defense
WHITEPAPER SANS Top 20 Critical Controls for Cyber Defense SANS Top 20 Critical Controls for Effective Cyber Defense JANUARY 2014 SANS Top 20 Critical Controls for Effective Cyber Defense Summary In a
Pervade Software. Use Case PCI Technical Controls. PCI- DSS Requirements
OpAuditTM from is the first compliance management product on the market to successfully track manual controls and technical controls in the same workflow-based system. This ingenious solution gathers &
Critical Security Controls
Critical Security Controls Session 2: The Critical Controls v1.0 Chris Beal Chief Security Architect MCNC [email protected] @mcncsecurity on Twitter The Critical Security Controls The Critical Security
Kaseya Fundamentals Workshop DAY THREE. Developed by Kaseya University. Powered by IT Scholars
Kaseya Fundamentals Workshop DAY THREE Developed by Kaseya University Powered by IT Scholars Kaseya Version 6.5 Last updated March, 2014 Day Two Overview Day Two Lab Review Patch Management Configura;on
One-Man Shop. How to build a functional security program with limited resources DEF CON 22
One-Man Shop How to build a functional security program with limited resources DEF CON 22 One-Man Shop Agenda Caveats & Considerations People and Processes Network Architecture System Design Continuous
No Cloud Allowed. Denying Service to DDOS Protection Services
No Cloud Allowed Denying Service to DDOS Protection Services Presented by: Allison Nixon [email protected] Pentesting, Incident Response PaulDotCom host Cloud Based DDOS Protection How it works
5 Steps to Advanced Threat Protection
5 Steps to Advanced Threat Protection Agenda Endpoint Protection Gap Profile of Advanced Threats Consensus Audit Guidelines 5 Steps to Advanced Threat Protection Resources 20 Years of Chasing Malicious
Concierge SIEM Reporting Overview
Concierge SIEM Reporting Overview Table of Contents Introduction... 2 Inventory View... 3 Internal Traffic View (IP Flow Data)... 4 External Traffic View (HTTP, SSL and DNS)... 5 Risk View (IPS Alerts
GFI White Paper PCI-DSS compliance and GFI Software products
White Paper PCI-DSS compliance and Software products The Payment Card Industry Data Standard () compliance is a set of specific security standards developed by the payment brands* to help promote the adoption
Defending Against Data Beaches: Internal Controls for Cybersecurity
Defending Against Data Beaches: Internal Controls for Cybersecurity Presented by: Michael Walter, Managing Director and Chris Manning, Associate Director Protiviti Atlanta Office Agenda Defining Cybersecurity
Chapter 9 Firewalls and Intrusion Prevention Systems
Chapter 9 Firewalls and Intrusion Prevention Systems connectivity is essential However it creates a threat Effective means of protecting LANs Inserted between the premises network and the to establish
THE TOP 4 CONTROLS. www.tripwire.com/20criticalcontrols
THE TOP 4 CONTROLS www.tripwire.com/20criticalcontrols THE TOP 20 CRITICAL SECURITY CONTROLS ARE RATED IN SEVERITY BY THE NSA FROM VERY HIGH DOWN TO LOW. IN THIS MINI-GUIDE, WE RE GOING TO LOOK AT THE
Application White Listing and Privilege Management: Picking Up Where Antivirus Leaves Off
Application White Listing and Privilege Management: Picking Up Where Antivirus Leaves Off Times have Changed & A/V Executives Agree An A/V product as your sole endpoint protection solution isn t enough.
74% 96 Action Items. Compliance
Compliance Report PCI DSS 2.0 Generated by Check Point Compliance Blade, on July 02, 2013 11:12 AM 1 74% Compliance 96 Action Items Upcoming 0 items About PCI DSS 2.0 PCI-DSS is a legal obligation mandated
End-user Security Analytics Strengthens Protection with ArcSight
Case Study for XY Bank End-user Security Analytics Strengthens Protection with ArcSight INTRODUCTION Detect and respond to advanced persistent threats (APT) in real-time with Nexthink End-user Security
Security Management. Keeping the IT Security Administrator Busy
Security Management Keeping the IT Security Administrator Busy Dr. Jane LeClair Chief Operating Officer National Cybersecurity Institute, Excelsior College James L. Antonakos SUNY Distinguished Teaching
Addressing the SANS Top 20 Critical Security Controls for Effective Cyber Defense
A Trend Micro Whitepaper I February 2016 Addressing the SANS Top 20 Critical Security Controls for Effective Cyber Defense How Trend Micro Deep Security Can Help: A Mapping to the SANS Top 20 Critical
Network and Security Controls
Network and Security Controls State Of Arizona Office Of The Auditor General Phil Hanus IT Controls Webinar Series Part I Overview of IT Controls and Best Practices Part II Identifying Users and Limiting
RSA Security Anatomy of an Attack Lessons learned
RSA Security Anatomy of an Attack Lessons learned Malcolm Dundas Account Executive John Hurley Senior Technology Consultant 1 Agenda Advanced Enterprise/ Threats The RSA Breach A chronology of the attack
How To Protect A Network From Attack From A Hacker (Hbss)
Leveraging Network Vulnerability Assessment with Incident Response Processes and Procedures DAVID COLE, DIRECTOR IS AUDITS, U.S. HOUSE OF REPRESENTATIVES Assessment Planning Assessment Execution Assessment
An Overview of Information Security Frameworks. Presented to TIF September 25, 2013
An Overview of Information Security Frameworks Presented to TIF September 25, 2013 What is a framework? A framework helps define an approach to implementing, maintaining, monitoring, and improving information
Linux Server Support by Applied Technology Research Center. Proxy Server Configuration
Linux Server Support by Applied Technology Research Center Proxy Server Configuration We configure squid for your LAN. Including transparent for HTTP and proxy for HTTPS. We also provide basic training
NETWORK DEVICE SECURITY AUDITING
E-SPIN PROFESSIONAL BOOK VULNERABILITY MANAGEMENT NETWORK DEVICE SECURITY AUDITING ALL THE PRACTICAL KNOW HOW AND HOW TO RELATED TO THE SUBJECT MATTERS. NETWORK DEVICE SECURITY, CONFIGURATION AUDITING,
How NETGEAR ProSecure UTM Helps Small Businesses Meet PCI Requirements
How NETGEAR ProSecure UTM Helps Small Businesses Meet PCI Requirements I n t r o d u c t i o n The Payment Card Industry Data Security Standard (PCI DSS) was developed in 2004 by the PCI Security Standards
Check Point and Security Best Practices. December 2013 Presented by David Rawle
Check Point and Security Best Practices December 2013 Presented by David Rawle Housekeeping o Mobiles on Silent o No File Alarms planned o Fire exits are in front and behind and down the stairs o Downstairs
The Protection Mission a constant endeavor
a constant endeavor The IT Protection Mission a constant endeavor As businesses become more and more dependent on IT, IT must face a higher bar for preparedness Cyber preparedness is the process of ensuring
Company Co. Inc. LLC. LAN Domain Network Security Best Practices. An integrated approach to securing Company Co. Inc.
Company Co. Inc. LLC Multiple Minds, Singular Results LAN Domain Network Security Best Practices An integrated approach to securing Company Co. Inc. LLC s network Written and Approved By: Geoff Lacy, Tim
CS 356 Lecture 17 and 18 Intrusion Detection. Spring 2013
CS 356 Lecture 17 and 18 Intrusion Detection Spring 2013 Review Chapter 1: Basic Concepts and Terminology Chapter 2: Basic Cryptographic Tools Chapter 3 User Authentication Chapter 4 Access Control Lists
Speed Up Incident Response with Actionable Forensic Analytics
WHITEPAPER DATA SHEET Speed Up Incident Response with Actionable Forensic Analytics Close the Gap between Threat Detection and Effective Response with Continuous Monitoring January 15, 2015 Table of Contents
The Future Is SECURITY THAT MAKES A DIFFERENCE. Overview of the 20 Critical Controls. Dr. Eric Cole
The Future Is SECURITY THAT MAKES A DIFFERENCE Overview of the 20 Critical Controls Dr. Eric Cole Introduction Security is an evolution! Understanding the benefit and know how to implement the 20 critical
Windows Operating Systems. Basic Security
Windows Operating Systems Basic Security Objectives Explain Windows Operating System (OS) common configurations Recognize OS related threats Apply major steps in securing the OS Windows Operating System
High End Information Security Services
High End Information Security Services Welcome Trion Logics Security Solutions was established after understanding the market's need for a high end - End to end security integration and consulting company.
Enterprise Cybersecurity: Building an Effective Defense
: Building an Effective Defense Chris Williams Scott Donaldson Abdul Aslam 1 About the Presenters Co Authors of Enterprise Cybersecurity: How to Implement a Successful Cyberdefense Program Against Advanced
Reneaué Railton Sr. Informa2on Security Analyst, Duke Medicine Cyber Defense & Response
Reneaué Railton Sr. Informa2on Security Analyst, Duke Medicine Cyber Defense & Response Incident Response What is the most importance component of an Incident Response Program? Tools? Processes? Governance?
Advanced Visibility. Moving Beyond a Log Centric View. Matthew Gardiner, RSA & Richard Nichols, RSA
Advanced Visibility Moving Beyond a Log Centric View Matthew Gardiner, RSA & Richard Nichols, RSA 1 Security is getting measurability worse Percent of breaches where time to compromise (red)/time to Discovery
Locking down a Hitachi ID Suite server
Locking down a Hitachi ID Suite server 2016 Hitachi ID Systems, Inc. All rights reserved. Organizations deploying Hitachi ID Identity and Access Management Suite need to understand how to secure its runtime
Jumpstarting Your Security Awareness Program
Jumpstarting Your Security Awareness Program Michael Holcomb Director, Information Security HO20110473 1 Jumpstarting Your Security Awareness Program Classification: Confidential Owner: Michael Holcomb
Internet Security Protecting Your Business. Hayden Johnston & Rik Perry WYSCOM
Internet Security Protecting Your Business Hayden Johnston & Rik Perry WYSCOM Introduction Protecting Your Network Securing Your Information Standards & Best Practices Tools & Options Into The Future Creating
Looking at the SANS 20 Critical Security Controls
Looking at the SANS 20 Critical Security Controls Mapping the SANS 20 to NIST 800-53 to ISO 27002 by Brad C. Johnson The SANS 20 Overview SANS has created the 20 Critical Security Controls as a way of
Stephen Coty Director, Threat Research
Emerging threats facing Cloud Computing Stephen Coty Director, Threat Research Cloud Environments 101 Cloud Adoption is Gaining Momentum Cloud market revenue will increase at a 36% annual rate Analyst
CS 356 Lecture 25 and 26 Operating System Security. Spring 2013
CS 356 Lecture 25 and 26 Operating System Security Spring 2013 Review Chapter 1: Basic Concepts and Terminology Chapter 2: Basic Cryptographic Tools Chapter 3 User Authentication Chapter 4 Access Control
INFORMATION SECURITY TRAINING CATALOG (2015)
INFORMATICS AND INFORMATION SECURITY RESEARCH CENTER CYBER SECURITY INSTITUTE INFORMATION SECURITY TRAINING CATALOG (2015) Revision 3.0 2015 TÜBİTAK BİLGEM SGE Siber Güvenlik Enstitüsü P.K. 74, Gebze,
Network Security: 30 Questions Every Manager Should Ask. Author: Dr. Eric Cole Chief Security Strategist Secure Anchor Consulting
Network Security: 30 Questions Every Manager Should Ask Author: Dr. Eric Cole Chief Security Strategist Secure Anchor Consulting Network Security: 30 Questions Every Manager/Executive Must Answer in Order
How To Protect Your Network From Attack From Outside From Inside And Outside
IT 4823 Information Security Administration Firewalls and Intrusion Prevention October 7 Notice: This session is being recorded. Lecture slides prepared by Dr Lawrie Brown for Computer Security: Principles
The Role of Security Monitoring & SIEM in Risk Management
The Role of Security Monitoring & SIEM in Risk Management Jeff Kopec, MS, CISSP Cyber Security Architect Oakwood Healthcare Jeff Bell, CISSP, GSLC, CPHIMS, ACHE Director, IT Security & Risk Services CareTech
Automate PCI Compliance Monitoring, Investigation & Reporting
Automate PCI Compliance Monitoring, Investigation & Reporting Reducing Business Risk Standards and compliance are all about implementing procedures and technologies that reduce business risk and efficiently
Comprehensive Malware Detection with SecurityCenter Continuous View and Nessus. February 3, 2015 (Revision 4)
Comprehensive Malware Detection with SecurityCenter Continuous View and Nessus February 3, 2015 (Revision 4) Table of Contents Overview... 3 Malware, Botnet Detection, and Anti-Virus Auditing... 3 Malware
How To Protect Virtualized Data From Security Threats
S24 Virtualiza.on Security from the Auditor Perspec.ve Rob Clyde, CEO, Adap.ve Compu.ng; former CTO, Symantec David Lu, Senior Product Manager, Trend Micro Hemma Prafullchandra, CTO/SVP Products, HyTrust
Software that provides secure access to technology, everywhere.
Software that provides secure access to technology, everywhere. Joseph Patrick Schorr @JoeSchorr October, 2015 2015 BOMGAR CORPORATION ALL RIGHTS RESERVED WORLDWIDE 1 Agenda What are we dealing with? How
Cybercrime myths, challenges and how to protect our business. Vladimir Kantchev Managing Partner Service Centrix
Cybercrime myths, challenges and how to protect our business Vladimir Kantchev Managing Partner Service Centrix Agenda Cybercrime today Sources and destinations of the attacks Breach techniques How to
Computer Security CS 426 Lecture 36. CS426 Fall 2010/Lecture 36 1
Computer Security CS 426 Lecture 36 Perimeter Defense and Firewalls CS426 Fall 2010/Lecture 36 1 Announcements There will be a quiz on Wed There will be a guest lecture on Friday, by Prof. Chris Clifton
Protecting Your Organisation from Targeted Cyber Intrusion
Protecting Your Organisation from Targeted Cyber Intrusion How the 35 mitigations against targeted cyber intrusion published by Defence Signals Directorate can be implemented on the Microsoft technology
Appalachian Regional Commission Evaluation Report. Table of Contents. Results of Evaluation... 1. Areas for Improvement... 2
Report No. 13-35 September 27, 2013 Appalachian Regional Commission Table of Contents Results of Evaluation... 1 Areas for Improvement... 2 Area for Improvement 1: The agency should implement ongoing scanning
PCI COMPLIANCE REQUIREMENTS COMPLIANCE CALENDAR
PCI COMPLIANCE REQUIREMENTS COMPLIANCE CALENDAR AUTHOR: UDIT PATHAK SENIOR SECURITY ANALYST [email protected] Public Network Intelligence India 1 Contents 1. Background... 3 2. PCI Compliance
ARE YOU REALLY PCI DSS COMPLIANT? Case Studies of PCI DSS Failure! Jeff Foresman, PCI-QSA, CISSP Partner PONDURANCE
ARE YOU REALLY PCI DSS COMPLIANT? Case Studies of PCI DSS Failure! Jeff Foresman, PCI-QSA, CISSP Partner PONDURANCE AGENDA PCI DSS Basics Case Studies of PCI DSS Failure! Common Problems with PCI DSS Compliance
Industrial Security for Process Automation
Industrial Security for Process Automation SPACe 2012 Siemens Process Automation Conference Why is Industrial Security so important? Industrial security is all about protecting automation systems and critical
ISSA Phoenix Chapter Meeting Topic: Security Enablement & Risk Reducing Best Practices for BYOD + SaaS Cloud Apps
ISSA Phoenix Chapter Meeting Topic: Security Enablement & Risk Reducing Best Practices for BYOD + SaaS Cloud Apps Agenda Security Enablement Concepts for BYOD & SaaS Cloud Apps! Intro and background! BYOD
CMPT 471 Networking II
CMPT 471 Networking II Firewalls Janice Regan, 2006-2013 1 Security When is a computer secure When the data and software on the computer are available on demand only to those people who should have access
SIEM Optimization 101. ReliaQuest E-Book Fully Integrated and Optimized IT Security
SIEM Optimization 101 ReliaQuest E-Book Fully Integrated and Optimized IT Security Introduction SIEM solutions are effective security measures that mitigate security breaches and increase the awareness
Centre for the Protection of National Infrastructure Effective Log Management
Centre for the Protection of National Infrastructure Effective Log Management Tom Goldsmith, 2nd April 2014 [email protected] Effective Log Management / Contents Contents 1 Executive Summary 5 2 About
IDENTITY & ACCESS. Privileged Identity Management. controlling access without compromising convenience
IDENTITY & ACCESS Privileged Identity Management controlling access without compromising convenience Introduction According to a recent Ponemon Institute study, mistakes made by people Privilege abuse
Overview of Network Security The need for network security Desirable security properties Common vulnerabilities Security policy designs
Overview of Network Security The need for network security Desirable security properties Common vulnerabilities Security policy designs Why Network Security? Keep the bad guys out. (1) Closed networks
RSA Security Analytics
RSA Security Analytics This is what SIEM was Meant to Be 1 The Original Intent of SIEM Single compliance & security interface Compliance yes, but security? Analyze & prioritize alerts across various sources
Top Five Data Security Trends Impacting Franchise Operators. Payment System Risk September 29, 2009
Top Five Data Security Trends Impacting Franchise Operators Payment System Risk September 29, 2009 Top Five Data Security Trends Agenda Data Security Environment Compromise Overview and Attack Methods
How to Grow and Transform your Security Program into the Cloud
How to Grow and Transform your Security Program into the Cloud Wolfgang Kandek Qualys, Inc. Session ID: SPO-207 Session Classification: Intermediate Agenda Introduction Fundamentals of Vulnerability Management
Breach Found. Did It Hurt?
ANALYST BRIEF Breach Found. Did It Hurt? INCIDENT RESPONSE PART 2: A PROCESS FOR ASSESSING LOSS Authors Christopher Morales, Jason Pappalexis Overview Malware infections impact every organization. Many
Defending Against Web App A0acks Using ModSecurity. Jason Wood Principal Security Consultant Secure Ideas
Defending Against Web App A0acks Using ModSecurity Jason Wood Principal Security Consultant Secure Ideas Background Info! Penetra?on Tester, Security Engineer & Systems Administrator!!!! Web environments
Cyber Essentials KAMI VANIEA 2
Cyber Essentials DR. KAMI VANIEA KAMI VANIEA 2 First, the news Office of Personnel Management http://www.usatoday.com/story/news/politics/2015/06/23/op m-hack-senate-archuleta-hearing/29153773/ KAMI VANIEA
Evolving Threat Landscape
Evolving Threat Landscape Briefing Overview Changing Threat Landscape Profile of the Attack Bit9 Solution Architecture Demonstartion Questions Growing Risks of Advanced Threats APT is on the rise 71% increase
How I Learned to Stop Worrying and Love Compliance Ron Gula, CEO Tenable Network Security
How I Learned to Stop Worrying and Love Compliance Ron Gula, CEO Tenable Network Security PART 1 - COMPLIANCE STANDARDS PART 2 SECURITY IMPACT THEMES BUILD A MODEL THEMES MONITOR FOR FAILURE THEMES DEMONSTRATE
Honeywell Industrial Cyber Security Overview and Managed Industrial Cyber Security Services Honeywell Process Solutions (HPS) June 4, 2014
Industrial Cyber Security Overview and Managed Industrial Cyber Security Services Process Solutions (HPS) June 4, Industrial Cyber Security Industrial Cyber Security is the leading provider of cyber security
Network Security Policy
Network Security Policy I. PURPOSE Attacks and security incidents constitute a risk to the University's academic mission. The loss or corruption of data or unauthorized disclosure of information on campus
FIREWALL CHECKLIST. Pre Audit Checklist. 2. Obtain the Internet Policy, Standards, and Procedures relevant to the firewall review.
1. Obtain previous workpapers/audit reports. FIREWALL CHECKLIST Pre Audit Checklist 2. Obtain the Internet Policy, Standards, and Procedures relevant to the firewall review. 3. Obtain current network diagrams
SANS Institute First Five Quick Wins
#1 QUICK WIN- APPLICATION WHITELISTING SANS Critical Controls: #2: Inventory of Authorized and Unauthorized Software 1) Deploy application whitelisting technology that allows systems to run software only
Securing Web Applications...at the Network Layer
Securing Web Applications......at the Network Layer OWASP Spain Chapter Meeting 16 th June, 2006 Barcelona (ES) Carlos Fragoso Mariscal Chief Technical Director [email protected] Securing Web Applications
Detecting Threats Via Network Anomalies. Paul Martini Cofounder and CEO iboss Cybersecurity
Detecting Threats Via Network Anomalies Paul Martini Cofounder and CEO iboss Cybersecurity Why is Anomaly Detection Important? Largest enterprises with the biggest investment in prevention are still getting
ITEC441- IS Security. Chapter 15 Performing a Penetration Test
1 ITEC441- IS Security Chapter 15 Performing a Penetration Test The PenTest A penetration test (pentest) simulates methods that intruders use to gain unauthorized access to an organization s network and
Nessus Agents. October 2015
Nessus Agents October 2015 Table of Contents Introduction... 3 What Are Nessus Agents?... 3 Scanning... 4 Results... 6 Conclusion... 6 About Tenable Network Security... 6 2 Introduction Today s changing
INCIDENT RESPONSE CHECKLIST
INCIDENT RESPONSE CHECKLIST The purpose of this checklist is to provide clients of Kivu Consulting, Inc. with guidance in the initial stages of an actual or possible data breach. Clients are encouraged
Defence Cyber Protection Partnership Cyber Risks Profile Requirements
Good Governance L.01 Define and assign information security relevant roles and responsibilities. L.02 Define and implement a policy that addresses information security risks within supplier relationships.
Using TS-ACCESS for Remote Desktop Access
Using TS-ACCESS for Remote Desktop Access Introduction TS-ACCESS is a remote desktop access feature available to CUA faculty and staff who need to access administrative systems or other computing resources
The Cloud App Visibility Blindspot
The Cloud App Visibility Blindspot Understanding the Risks of Sanctioned and Unsanctioned Cloud Apps and How to Take Back Control Introduction Today, enterprise assets are more at risk than ever before
All Information is derived from Mandiant consulting in a non-classified environment.
Disclaimer: All Information is derived from Mandiant consulting in a non-classified environment. Case Studies are representative of industry trends and have been derived from multiple client engagements.
Global Partner Management Notice
Global Partner Management Notice Subject: Critical Vulnerabilities Identified to Alert Payment System Participants of Data Compromise Trends Dated: May 4, 2009 Announcement: To support compliance with
VoIP Security How to prevent eavesdropping on VoIP conversa8ons. Dmitry Dessiatnikov
VoIP Security How to prevent eavesdropping on VoIP conversa8ons Dmitry Dessiatnikov DISCLAIMER All informa8on in this presenta8on is provided for informa8on purposes only and in no event shall Security