Agile Chennai 2022 - Shyam Sundar | Everything there is to know about Cyber security is from movies and web series

•

0 likes•13 views

The document discusses various topics related to cyber security including: 1) Types of cyber attacks seen during the COVID-19 pandemic like typo squatting domains and command and control servers. 2) Web application attacks like SQL injection, XSS, and how to prevent them through input filtering, encoding and CORS. 3) Secure development practices like establishing secure coding norms, separating duties, and fixing issues in a time-bound manner. 4) Quantifying cyber risks using techniques like Six Sigma and creating threat models.

Technology

Everything there is
to know about cyber
security is from
movies and web
series
SHYAM SUNDAR RAMASWAMI
SR. STAFF CYBER SECURITY ARCHITECT,
CYBER LABS – GE HEALTHCARE

© 2019 Cisco and/or its affiliates. All rights reserved. Cisco Confidential
 Lead Security Researcher
 Threat and Malware Hunter
 #ambatman
Who am I?
Sr.Staff Cyber Security Architect
Threat and Malware Hunter
#ambatman

Can you
identify the
issues in this
unattended
desk?

COVID 19 based cyber
attacks region wise

COVID
OutBreak
HeatMaps
Dashboards
Covid -19 Trackers

Real World Scenes
 Threat actors often use the latest world events
 COVID 19 was popular

Typo Squatting
Domains
 wuhan
 clinics
 lab
 tests
 selftestkit
 purchase kits
 helpline

The DNS traffic for Typo Squatted
Domain

How does this
work ?
 Image Source: DNSFilter

Web Application attacks
 OWASP Top 10
 Injection Attacks
 Permission based attacks
 Forms and Fields
 Application based attacks

Types of XSS
Stored XSS
Reflected XSS
DOM Based attacks

Preventing XSS
 Filters
 Encoding
 Verify inputs
 CORS

Secure
coding the
AGILE Way ?
Establish a
norm
Failing
securely
Separation
duties
Fixing
issues
Time
bound
Ownership
Mitigations
Minimize
blast radius

Quantifying Cyber attack
risks using Six Sigma?
 Cyber Risk Quantification (CRQ)
 Technical Nature of product -> Risks
- > Impacts
 Mitigating Risks
 Quantify risks

How can we do this in a week?
 Two hours a day
 Be an expert of your product
 Implement learning on your product
 Understand nuts and bolts of a product
 Be a security champion

Lean and Research
TIMELINES EASIER RISK
MITIGATIONS
THE 3 OUTCOMES ( IT’S
ME, LISTEN TO THIS ! )
DELIVERABLES

AGILE BASED RESEARCH LEADS TO ...
 Blog Series or post
 Conference talk
 Patent or defensive publication
 There is nothing called as FAILED RESEARCH !

What is APT ?
ATTACK CAMPAIGN IN WHICH
INTRUDER OR TEAM SITS LONG
TERM IN A NETWORK
GETS SENSITIVE DATA TARGETS ARE CAREFULLY
CHOSEN

More about APT
APT is super covert Nation state actors
Financial gain
Political espionage

How does it happen ?
 1. Scan the target
 2. Intelligence gathering
 3. Lateral movement by taking down one computer
 4. Back door installation or exploiting a flaw

Bronze Mohawk APT
Steganography domain typosquatting multi-hop proxies
Protocol Tunnelling
Archive, encrypt, and
stage collected data
locally and remotely for
exfiltration
C2 channel

What can you do to become the
ultimate cyber security guy ?
 Don’t learn cyber security to apply to any product
 Acquire product knowledge and then apply cyber security kills
 Build Threat models
 Spend 2 hrs a day to try out the skills learnt
 5-8 learning hours a week will get you there

As the industry’s first Secure Internet Gateway in the cloud, Cisco Umbrella provides the first line of defense against threats on the internet, protecting all your users within minutes. Cisco Advanced Malware Protection offers global threat intelligence, advanced sandboxing and real-time malware blocking to prevent breaches while it continuously analyzes file activity across your network, so that you can quickly detect, contain and remove advanced malware. Presentation of Cisco Security Architecture and Solutions such as Cisco Advanced Malware Protection (AMP) and Cisco Umbrella during Simplex-Cisco Technology Session that took place at the Londa Hotel in Limassol on 14 March 2018.

Asegurarme de la Seguridad?, Un Vistazo al Penetration Testing

Software Guru

Smart Bombs: Mobile Vulnerability and Exploitation

Tom Eston

Kevin Johnson, John Sawyer and Tom Eston have spent quite a bit of time evaluating mobile applications in their respective jobs. In this presentation they will provide the audience an understanding of how to evaluate mobile applications, examples of how things have been done wrong and an understanding of how you can perform this testing within your organization. This talk will work with applications from the top three main platforms; iOS, Android and Blackberry. Kevin, Tom and John have used a variety of the top 25 applications for each of these platforms to provide real world examples of the problems applications face.

Estratégia de segurança da Cisco (um diferencial para seus negócios)

Cisco do Brasil

The Next Generation Security

Cybera Inc.

WannaCry Ransomware Attack: What to Do Now

IBM Security

View on-demand webinar: http://bit.ly/2qoNQ8v What you need to know and how to protect against the WannaCry Ransomware Attack, the largest coordinated cyberattack of its kind. WannaCry has already crippled critical infrastructure and multiple hospitals and telecommunications organizations, infecting 100s of thousands of endpoints in over 100 countries. In this on-demand webinar, we discuss the anatomy of this unprecedented attack and IBM Researchers share expert insights into what you can do now to protect your organization from this attack and the next one.

Join Mike Rothman, Analyst & President of Securosis and Ted Julian, VP of Product Management and co-founder of IBM Resilient, for a webinar on common automation use cases for the Security Operations Center (SOC). Security Orchestration, Automation and Response (SOAR) tools are garnering interest in enterprise security teams due to tangible short-term benefits. Watch the recording: https://event.on24.com/wcc/r/2007717/385A881A097E8EFCE493981972303416?partnerref=LI

So You Want a Job in Cybersecurity

Teri Radichel

cybersecurity-careers.pdf

RakeshKumar442494

Advanced red teaming all your badges are belong to us

Priyanka Aash

Next Generation Firewall and IPS

Data#3 Limited

A pinguin as a bouncer... Open Source Security Solutions

B.A.

Cisco Connect Vancouver 2017 - Anatomy of Attack

Cisco Canada

CYBER SECURITY CAREER GUIDE CHEAT SHEET

TravarsaPrivateLimit

In an increasingly interconnected and digital world, the importance of cybersecurity cannot be overstated. "Cybersecurity Mastery" is your essential guide to mastering the art and science of cybersecurity. This comprehensive book not only provides a roadmap for studying cybersecurity effectively but also delves into the essential tools, strategies, and certifications required to excel in this critical field. Cybersecurity relies on a diverse set of tools to detect, prevent, and respond to threats. "Cybersecurity Mastery" introduces you to these tools and guides you on how to leverage them effectively. From antivirus software and firewalls to intrusion detection systems (IDS) and vulnerability scanners, you'll gain practical insights into the tools that protect digital environments. To validate your expertise in cybersecurity, this book also outlines the certifications that hold significant weight in the industry. Certifications such as Certified Information Systems Security Professional (CISSP), Certified Ethical Hacker (CEH), CompTIA Security+, and Certified Information Security Manager (CISM) are recognized globally and serve as valuable credentials in your cybersecurity career. "Cybersecurity Mastery" provides guidance on how to prepare for these certifications, ensuring you're well-prepared to pass the exams. Upon completing your journey through "Cybersecurity Mastery," you'll be well-prepared to pursue a range of exciting career opportunities. Designations such as Cybersecurity Analyst, Information Security Manager, Network Security Engineer, and Ethical Hacker are within reach for those who master the principles and techniques outlined in this book.

Criminal IP ASM | Threat Intelligence-based Automated Attack Surface Managem...

Criminal IP

Businesses and organizations have numerous network devices, databases, servers, applications, and domains, and all of these IT assets are through IP addresses and Ports. Attack Surface Management refers to the proactive detection and management of attack vectors such as open ports, server vulnerabilities, similar domains, phishing, and domains distributing malicious code. Criminal IP ASM automatically monitors and generates a report on assets exposed to the attack surface. All IT assets are thoroughly detected globally, with a streamlined introduction procedure requiring registration of only one primary domain. Request a FREE Demo of Criminal IP ASM at: https://www.criminalip.io/asm/attack-surface-management

Ceh certified ethical hackerbestip

Event - Internet Thailand - Total Security Perimeters

Somyos U.

Zlatibor asseco-fire eyeDejan Jeremic

ANIn Ahmedabad June 2024 | Metrics in Agile Business by Angana Sharma

AgileNetwork

ANIn Ahmedabad June 2024 | Business outcomes directly proportional to mindset...

AgileNetwork

Similar to Agile Chennai 2022 - Shyam Sundar | Everything there is to know about Cyber security is from movies and web series

PCM Vision 2019 Breakout: IBM | Red Hat

PCM

Implementing a comprehensive application security progaram - Tawfiq

OWASP-Qatar Chapter

Super1neelakanteswarreddy

Ethical hacking

Anumadil1

Next Dimension and Cisco | Solutions for PIPEDA Compliance

Cisco amp for meraki

Ethical hacking

Malware Analysis

Automation: Embracing the Future of SecOps

IBM Security

So You Want a Job in Cybersecurity

Teri Radichel

cybersecurity-careers.pdf

RakeshKumar442494

Advanced red teaming all your badges are belong to us

Priyanka Aash

Next Generation Firewall and IPS

Data#3 Limited

A pinguin as a bouncer... Open Source Security Solutions

B.A.

Cisco Connect Vancouver 2017 - Anatomy of Attack

Cisco Canada

CYBER SECURITY CAREER GUIDE CHEAT SHEET

TravarsaPrivateLimit

Criminal IP ASM | Threat Intelligence-based Automated Attack Surface Managem...

Criminal IP

Ceh certified ethical hackerbestip

Event - Internet Thailand - Total Security Perimeters

Somyos U.

Zlatibor asseco-fire eyeDejan Jeremic

Similar to Agile Chennai 2022 - Shyam Sundar | Everything there is to know about Cyber security is from movies and web series (20)

PCM Vision 2019 Breakout: IBM | Red Hat

Implementing a comprehensive application security progaram - Tawfiq

Super1

Ethical hacking

Next Dimension and Cisco | Solutions for PIPEDA Compliance

Cisco amp for meraki

Ethical hacking

Malware Analysis

Automation: Embracing the Future of SecOps

So You Want a Job in Cybersecurity

cybersecurity-careers.pdf

Advanced red teaming all your badges are belong to us

Next Generation Firewall and IPS

A pinguin as a bouncer... Open Source Security Solutions

Cisco Connect Vancouver 2017 - Anatomy of Attack

CYBER SECURITY CAREER GUIDE CHEAT SHEET

Criminal IP ASM | Threat Intelligence-based Automated Attack Surface Managem...

Ceh certified ethical hacker

Event - Internet Thailand - Total Security Perimeters

Zlatibor asseco-fire eye

Recently uploaded

Connector Corner: Automate dynamic content and events by pushing a button

DianaGray10

Here is something new! In our next Connector Corner webinar, we will demonstrate how you can use a single workflow to: Create a campaign using Mailchimp with merge tags/fields Send an interactive Slack channel message (using buttons) Have the message received by managers and peers along with a test email for review But there’s more: In a second workflow supporting the same use case, you’ll see: Your campaign sent to target colleagues for approval If the “Approve” button is clicked, a Jira/Zendesk ticket is created for the marketing design team But—if the “Reject” button is pushed, colleagues will be alerted via Slack message Join us to learn more about this new, human-in-the-loop capability, brought to you by Integration Service connectors. And... Speakers: Akshay Agnihotri, Product Manager Charlie Greenberg, Host

IOS-PENTESTING-BEGINNERS-PRACTICAL-GUIDE-.pptx

Abida Shariff

Key Trends Shaping the Future of Infrastructure.pdf

Cheryl Hung

UiPath Test Automation using UiPath Test Suite series, part 4

DianaGray10

Welcome to UiPath Test Automation using UiPath Test Suite series part 4. In this session, we will cover Test Manager overview along with SAP heatmap. The UiPath Test Manager overview with SAP heatmap webinar offers a concise yet comprehensive exploration of the role of a Test Manager within SAP environments, coupled with the utilization of heatmaps for effective testing strategies. Participants will gain insights into the responsibilities, challenges, and best practices associated with test management in SAP projects. Additionally, the webinar delves into the significance of heatmaps as a visual aid for identifying testing priorities, areas of risk, and resource allocation within SAP landscapes. Through this session, attendees can expect to enhance their understanding of test management principles while learning practical approaches to optimize testing processes in SAP environments using heatmap visualization techniques What will you get from this session? 1. Insights into SAP testing best practices 2. Heatmap utilization for testing 3. Optimization of testing processes 4. Demo Topics covered: Execution from the test manager Orchestrator execution result Defect reporting SAP heatmap example with demo Speaker: Deepak Rai, Automation Practice Lead, Boundaryless Group and UiPath MVP

Neuro-symbolic is not enough, we need neuro-*semantic*

Frank van Harmelen

Neuro-symbolic (NeSy) AI is on the rise. However, simply machine learning on just any symbolic structure is not sufficient to really harvest the gains of NeSy. These will only be gained when the symbolic structures have an actual semantics. I give an operational definition of semantics as “predictable inference”. All of this illustrated with link prediction over knowledge graphs, but the argument is general.

State of ICS and IoT Cyber Threat Landscape Report 2024 preview

Prayukth K V

The IoT and OT threat landscape report has been prepared by the Threat Research Team at Sectrio using data from Sectrio, cyber threat intelligence farming facilities spread across over 85 cities around the world. In addition, Sectrio also runs AI-based advanced threat and payload engagement facilities that serve as sinks to attract and engage sophisticated threat actors, and newer malware including new variants and latent threats that are at an earlier stage of development. The latest edition of the OT/ICS and IoT security Threat Landscape Report 2024 also covers: State of global ICS asset and network exposure Sectoral targets and attacks as well as the cost of ransom Global APT activity, AI usage, actor and tactic profiles, and implications Rise in volumes of AI-powered cyberattacks Major cyber events in 2024 Malware and malicious payload trends Cyberattack types and targets Vulnerability exploit attempts on CVEs Attacks on counties – USA Expansion of bot farms – how, where, and why In-depth analysis of the cyber threat landscape across North America, South America, Europe, APAC, and the Middle East Why are attacks on smart factories rising? Cyber risk predictions Axis of attacks – Europe Systemic attacks in the Middle East Download the full report from here: https://sectrio.com/resources/ot-threat-landscape-reports/sectrio-releases-ot-ics-and-iot-security-threat-landscape-report-2024/

FIDO Alliance Osaka Seminar: Passkeys at Amazon.pdf

FIDO Alliance

GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using Deplo...

James Anderson

Effective Application Security in Software Delivery lifecycle using Deployment Firewall and DBOM The modern software delivery process (or the CI/CD process) includes many tools, distributed teams, open-source code, and cloud platforms. Constant focus on speed to release software to market, along with the traditional slow and manual security checks has caused gaps in continuous security as an important piece in the software supply chain. Today organizations feel more susceptible to external and internal cyber threats due to the vast attack surface in their applications supply chain and the lack of end-to-end governance and risk management. The software team must secure its software delivery process to avoid vulnerability and security breaches. This needs to be achieved with existing tool chains and without extensive rework of the delivery processes. This talk will present strategies and techniques for providing visibility into the true risk of the existing vulnerabilities, preventing the introduction of security issues in the software, resolving vulnerabilities in production environments quickly, and capturing the deployment bill of materials (DBOM). Speakers: Bob Boule Robert Boule is a technology enthusiast with PASSION for technology and making things work along with a knack for helping others understand how things work. He comes with around 20 years of solution engineering experience in application security, software continuous delivery, and SaaS platforms. He is known for his dynamic presentations in CI/CD and application security integrated in software delivery lifecycle. Gopinath Rebala Gopinath Rebala is the CTO of OpsMx, where he has overall responsibility for the machine learning and data processing architectures for Secure Software Delivery. Gopi also has a strong connection with our customers, leading design and architecture for strategic implementations. Gopi is a frequent speaker and well-known leader in continuous delivery and integrating security into software delivery.

LF Energy Webinar: Electrical Grid Modelling and Simulation Through PowSyBl -...

DanBrown980551

Do you want to learn how to model and simulate an electrical network from scratch in under an hour? Then welcome to this PowSyBl workshop, hosted by Rte, the French Transmission System Operator (TSO)! During the webinar, you will discover the PowSyBl ecosystem as well as handle and study an electrical network through an interactive Python notebook. PowSyBl is an open source project hosted by LF Energy, which offers a comprehensive set of features for electrical grid modelling and simulation. Among other advanced features, PowSyBl provides: - A fully editable and extendable library for grid component modelling; - Visualization tools to display your network; - Grid simulation tools, such as power flows, security analyses (with or without remedial actions) and sensitivity analyses; The framework is mostly written in Java, with a Python binding so that Python developers can access PowSyBl functionalities as well. What you will learn during the webinar: - For beginners: discover PowSyBl's functionalities through a quick general presentation and the notebook, without needing any expert coding skills; - For advanced developers: master the skills to efficiently apply PowSyBl functionalities to your real-world scenarios.

Kubernetes & AI - Beauty and the Beast !?! @KCD Istanbul 2024

Tobias Schneck

As AI technology is pushing into IT I was wondering myself, as an “infrastructure container kubernetes guy”, how get this fancy AI technology get managed from an infrastructure operational view? Is it possible to apply our lovely cloud native principals as well? What benefit’s both technologies could bring to each other? Let me take this questions and provide you a short journey through existing deployment models and use cases for AI software. On practical examples, we discuss what cloud/on-premise strategy we may need for applying it to our own infrastructure to get it to work from an enterprise perspective. I want to give an overview about infrastructure requirements and technologies, what could be beneficial or limiting your AI use cases in an enterprise environment. An interactive Demo will give you some insides, what approaches I got already working for real.

Smart TV Buyer Insights Survey 2024 by 91mobiles.pdf

91mobiles

Assuring Contact Center Experiences for Your Customers With ThousandEyes

ThousandEyes

How world-class product teams are winning in the AI era by CEO and Founder, P...

Product School

Unsubscribed: Combat Subscription Fatigue With a Membership Mentality by Head...

Product School

Builder.ai Founder Sachin Dev Duggal's Strategic Approach to Create an Innova...

Ramesh Iyer

In today's fast-changing business world, Companies that adapt and embrace new ideas often need help to keep up with the competition. However, fostering a culture of innovation takes much work. It takes vision, leadership and willingness to take risks in the right proportion. Sachin Dev Duggal, co-founder of Builder.ai, has perfected the art of this balance, creating a company culture where creativity and growth are nurtured at each stage.

Transcript: Selling digital books in 2024: Insights from industry leaders - T...

BookNet Canada

The publishing industry has been selling digital audiobooks and ebooks for over a decade and has found its groove. What’s changed? What has stayed the same? Where do we go from here? Join a group of leading sales peers from across the industry for a conversation about the lessons learned since the popularization of digital books, best practices, digital book supply chain management, and more. Link to video recording: https://bnctechforum.ca/sessions/selling-digital-books-in-2024-insights-from-industry-leaders/ Presented by BookNet Canada on May 28, 2024, with support from the Department of Canadian Heritage.

De-mystifying Zero to One: Design Informed Techniques for Greenfield Innovati...

Product School

Designing Great Products: The Power of Design and Leadership by Chief Designe...

Product School

"Impact of front-end architecture on development cost", Viktor Turskyi

Fwdays

I have heard many times that architecture is not important for the front-end. Also, many times I have seen how developers implement features on the front-end just following the standard rules for a framework and think that this is enough to successfully launch the project, and then the project fails. How to prevent this and what approach to choose? I have launched dozens of complex projects and during the talk we will analyze which approaches have worked for me and which have not.

To Graph or Not to Graph Knowledge Graph Architectures and LLMs

Paul Groth

Recently uploaded (20)