Applying Fuzzy Hashing to Phishing Page Identification
•
0 likes•217 views
Adrian Hada in Bucharest, Romania on November 8-9th 2018 at DefCamp #9. The slides and other presentations can be found on https://def.camp/archive
Report
Share
Report
Share
Download to read offline
Recommended
10 Steps To Global Data Compliance
Data compliance in the modern technology landscape feels like a constantly moving target as more and different laws, rules and regulations are passed locally, nationally and internationally. The days when only some organizations or certain countries had to worry about data compliance are gone. It’s everyone’s problem.
However, it is possible to define a core set of processes that will help to enable your ability to assist your business, or government agency, in meeting these compliance requirements. This session will walk you through the 10 steps you need to implement in order to move your organization towards full compliance with any, or all, of the regulations we all now face. From identifying where your data lives to monitoring for compliance and all the steps in between, you can meet this challenge.
Conquest Security Capabilities
Conquest Security is an information security service provider serving government and commercial markets.
We offer services, training, and products to address key information security, regulatory and operational requirements of today’s enterprise organizations, from small businesses up to large government agencies.
Our offerings include:
- Vulnerability Assessments
- Penetration Testing
- Remediation Services
- Cyber Intelligence Services
- Information Security Training
- Advanced Solutions from Industry Leading Manufacturers
Founded in 2005 and based in Bethesda, Maryland, Conquest Security provides comprehensive solutions that address the challenges facing information technology professionals.
APT(Advanced Persistent Threats) & strategies to counter APT
An advanced persistent threat (APT) is a network attack in which an unauthorized person gains access to a network and stays there undetected for a long period of time. The intention of an APT attack is to steal data rather than to cause damage to the network or organization. APT attacks target organizations in sectors with high-value information, such as national defense, manufacturing and the financial industry.
‘Advanced’ means it gets through your existing defenses.
‘Persistent’ means it succeeds in hiding from your existing level of detection.
‘Threat’ means it causes you harm.”
Because APTs operate covertly and are difficult to detect, months can pass with no visible compromises to the organization quietly under attack. Moreover, single instances may be detected while multiple others inside the same organization go unnoticed. Comparable to combating a life-threatening disease, early detection is vital. So to defeat the APT, all you need is a strategy. No single tool can help you defeat APT.
Monitorama 2017 - Who Watches the Watchers?
Operations and monitoring professionals have a unique position astride the unprecedented technologies that are monitoring the public. As a profession, we must cultivate and apply a professional ethics to ensure that these systems respect privacy and protect vulnerable populations.
Reporte de Seguridad Anual de Cisco 2014 - Por Carlos Rienzi
The document appears to be a 2014 security report presented by Carlos Rienzi, a Systems Engineer. It discusses security threats, objectives of attackers, anatomy of attacks, infection strategies, security alerts by industry, and recommendations for improving security practices before, during, and after attacks. Key statistics mentioned include over 1 million security professionals issued alerts in 2013 and Java and Android being frequently targeted.
From Mirai to Monero – One Year’s Worth of Honeypot Data
Adrian Hada and Mihai Vasilescu in Bucharest, Romania on November 8-9th 2018 at DefCamp #9.
The slides and other presentations can be found on https://def.camp/archive
PPT TEST
The document advertises an upcoming webinar from Cisco on reducing security risks to protect networks. It provides details on the webinar such as the date, presenter, and topics to be discussed including assessing security strategies, maintaining postures, and security services. Information is also provided on Cisco's security services and upcoming webinar sessions.
Shadow IT: The CISO Perspective on Regaining Control
In this on-demand webinar, we've discussed:
- Key takeaways on Shadow IT you need to know to protect your data in the cloud.
- Surprising Shadow IT statistics are disclosed and how to proactively take charge.
- Recommendations on cloud management strategies.
The panelists include renowned security experts Chenxi Wang - former Principal Analyst at Forrester Research, Rob McGillen - CIO for Grant Thornton, and Paul Simmonds - former Global CISO for AstraZeneca.
***Please Note: The link to the recorded on-demand webinar is on the last slide.
Recommended
10 Steps To Global Data Compliance
Data compliance in the modern technology landscape feels like a constantly moving target as more and different laws, rules and regulations are passed locally, nationally and internationally. The days when only some organizations or certain countries had to worry about data compliance are gone. It’s everyone’s problem.
However, it is possible to define a core set of processes that will help to enable your ability to assist your business, or government agency, in meeting these compliance requirements. This session will walk you through the 10 steps you need to implement in order to move your organization towards full compliance with any, or all, of the regulations we all now face. From identifying where your data lives to monitoring for compliance and all the steps in between, you can meet this challenge.
Conquest Security Capabilities
Conquest Security is an information security service provider serving government and commercial markets.
We offer services, training, and products to address key information security, regulatory and operational requirements of today’s enterprise organizations, from small businesses up to large government agencies.
Our offerings include:
- Vulnerability Assessments
- Penetration Testing
- Remediation Services
- Cyber Intelligence Services
- Information Security Training
- Advanced Solutions from Industry Leading Manufacturers
Founded in 2005 and based in Bethesda, Maryland, Conquest Security provides comprehensive solutions that address the challenges facing information technology professionals.
APT(Advanced Persistent Threats) & strategies to counter APT
An advanced persistent threat (APT) is a network attack in which an unauthorized person gains access to a network and stays there undetected for a long period of time. The intention of an APT attack is to steal data rather than to cause damage to the network or organization. APT attacks target organizations in sectors with high-value information, such as national defense, manufacturing and the financial industry.
‘Advanced’ means it gets through your existing defenses.
‘Persistent’ means it succeeds in hiding from your existing level of detection.
‘Threat’ means it causes you harm.”
Because APTs operate covertly and are difficult to detect, months can pass with no visible compromises to the organization quietly under attack. Moreover, single instances may be detected while multiple others inside the same organization go unnoticed. Comparable to combating a life-threatening disease, early detection is vital. So to defeat the APT, all you need is a strategy. No single tool can help you defeat APT.
Monitorama 2017 - Who Watches the Watchers?
Operations and monitoring professionals have a unique position astride the unprecedented technologies that are monitoring the public. As a profession, we must cultivate and apply a professional ethics to ensure that these systems respect privacy and protect vulnerable populations.
Reporte de Seguridad Anual de Cisco 2014 - Por Carlos Rienzi
The document appears to be a 2014 security report presented by Carlos Rienzi, a Systems Engineer. It discusses security threats, objectives of attackers, anatomy of attacks, infection strategies, security alerts by industry, and recommendations for improving security practices before, during, and after attacks. Key statistics mentioned include over 1 million security professionals issued alerts in 2013 and Java and Android being frequently targeted.
From Mirai to Monero – One Year’s Worth of Honeypot Data
Adrian Hada and Mihai Vasilescu in Bucharest, Romania on November 8-9th 2018 at DefCamp #9.
The slides and other presentations can be found on https://def.camp/archive
PPT TEST
The document advertises an upcoming webinar from Cisco on reducing security risks to protect networks. It provides details on the webinar such as the date, presenter, and topics to be discussed including assessing security strategies, maintaining postures, and security services. Information is also provided on Cisco's security services and upcoming webinar sessions.
Shadow IT: The CISO Perspective on Regaining Control
In this on-demand webinar, we've discussed:
- Key takeaways on Shadow IT you need to know to protect your data in the cloud.
- Surprising Shadow IT statistics are disclosed and how to proactively take charge.
- Recommendations on cloud management strategies.
The panelists include renowned security experts Chenxi Wang - former Principal Analyst at Forrester Research, Rob McGillen - CIO for Grant Thornton, and Paul Simmonds - former Global CISO for AstraZeneca.
***Please Note: The link to the recorded on-demand webinar is on the last slide.
CASB — Your new best friend for safe cloud adoption?
CASB — Your new best friend for safe cloud adoption?
The explosive growth of cloud adoption, “cloud first” initiatives and BYOD have created security and compliance blind spots.
Forcepoint’s session examines the growing popularity of the Cloud Access Security Broker as a means to assist security leaders to support business innovation and manage cloud risk.
Kondo-ing API Authorization
API transactions are subjected to many authorization decisions at many different layers. User identities, application scopes, attributes, roles, data privacy, user consent, contracts… Tidy up your decision-making responsibilities across your stack. This presentation will discuss the benefits and tradeoffs of decoupling authorization from service implementation.
Personal Branding for LinkedIn at Silicon Slopes
Slides from my presentation on personal branding and LinkedIn, delivered 05 June, 2018 at Silicon Slopes in Lehi, Utah.
The first part focuses on creating a powerful personal brand that aligns with your business interests. The second part is all about how to make sure your LinkedIn profile is optimized and aligned with your personal brand, how to make meaningful, high quality connections, and create compelling content.
APIdays London 2019 - Why the Financial Industry Needs Intelligent API Securi...
Why the Financial Industry Needs Intelligent API Security
Wesley Dunnington,
Field CTO East Region at Ping Identity
Move and Secure Your Data
Standing in the way of executing application development projects faster is data access from different data sources. Delphix Dynamic Data Platform allows data from a diverse set of data sources in the enterprise to be securely delivered to every stakeholder, across on-premise, cloud and hybrid environments at the speed and scale required to enable rapid development and delivery of applications.
Drupalgeddon 2 – Yet Another Weapon for the Attacker
Radu-Emanuel Chiscariu in Bucharest, Romania on November 8-9th 2018 at DefCamp #9.
The videos and other presentations can be found on https://def.camp/archive
Confessions of DBA Webinar
The document introduces Dhiraj Sehgal and Woody Evans as speakers and discusses how time is a valuable asset for DBAs. It notes that DBAs often have to work in gaps between scheduled work, downtime, and personal time. The document also states that database restores can be frustrating and that most data masking provides only superficial protection. It presents Delphix as taking a different approach using separation, delegation, and automation to provide DBAs with less worry, better sleep, and more time. A quote is provided from Anup Anand of Gain Capital saying Delphix has increased their output by 20% and left more time for innovation.
Confessions of a DBA: “I always avoid requests from DevOps” and Other Admissions
The document introduces Dhiraj Sehgal and Woody Evans as speakers and discusses how time is a valuable asset for DBAs. It notes that DBAs often have to work in gaps between scheduled work, downtime, and personal time. The document also states that database restores can be frustrating and that most data masking provides only superficial protection. It presents an alternative approach of separating, delegating, and automating tasks to give DBAs more worry-free time and sleep. A quote from Anup Anand of Gain Capital says that using Delphix has increased their output by 20% and freed up more time for innovation.
Webinar: Insights from CYREN's Q1 2015 Cyber Threats Trend Report
This document summarizes a CYREN CyberThreat Report from April 2015. It discusses several cybersecurity topics from the first quarter of 2015, including a watering hole attack on Forbes.com, advanced blackhat search engine optimization techniques called SEOHide, the continuing rise of macro malware, lessons learned from security breaches at Slack and HipChat, and how secure hashed passwords are. It also provides statistics on Android threats, phishing, and spam for Q1 2015. The document is intended to discuss current cybersecurity issues and threats based on CYREN's threat intelligence gathered from over 500,000 global data points.
Identity Live Sydney 2018 Keynote Presentation
This document discusses an event for ForgeRock and identity management. It thanks sponsors and introduces several speakers at the event: Steve Ferris, Fran Rosch, Robert Humphrey. Fran Rosch's presentation discusses how identity is at the heart of business relationships, compliance, security and customer experience. Robert Humphrey talks about trends in technology and the importance of omnichannel capabilities. The document emphasizes that with the power of digital identity comes great responsibility and that building trusted customer relationships requires focusing on identity, experience, privacy and consent.
Cloud Ramps Up at DOD--Here's What You Need to Know
As the Department of Defense ramps up its cloud initiatives, it also grapples with various challenges like security, as well as how to make sure the its cloud approach isn’t disjointed among its various organizations. View a sampling of slides from our recent webinar. To view the rest of the slides and hear the webinar, visit https://goo.gl/YCHRNw.
Cisco Girls IT Day
I had a tremendous opportunity to meet remarkable young women interested in Information Technology careers. I shared my career learnings and decisions in my career journey.
The Four Pitfalls of Privilege: Defend Critical Accounts & Systems Against Cy...
This document discusses the four common pitfalls of privilege: 1) Protecting only passwords without securing access pathways, 2) Failing to manage privileges for partners and vendors, 3) Not addressing privilege sprawl due to cloud services and non-traditional accounts, and 4) Prioritizing people over securing machine credentials. It emphasizes the need for a comprehensive privileged access management strategy that enforces least privilege and prevents lateral movement within an organization's systems.
The Future of Marketing Automation is More
The document discusses the future of marketing automation moving from Automation 1.0 to Automation 2.0. Automation 1.0 refers to automation that happens within a single marketing automation tool, while Automation 2.0 involves automation across multiple tools and technologies in a decentralized way. The presentation provides examples of companies like Airbnb that were able to grow through decentralized automations without spending on ads. It also discusses how best-in-class companies use more tools on average and how the focus should be on connecting tools rather than just the number used.
Presentación Jeff Brown, HP en VI Summit País Digital 2018
Exposición “WW Security Trends and Solutions” de Jeff Brown, Head of WW Professional Services, HP, en el marco del VI Summit País Digital 2018 (4 y 5 de septiembre 2018)
Marketing Your Open Source Project (All Things Open 2018)
Your open source project competes with millions of others for users, contributors, and perhaps financial support. To stand out from the crowd, your project needs… marketing. If that term makes you shudder, or you simply don’t think you know how, this talk (aimed at anyone involved in open source) will help you understand the why and the how of open source marketing.
A Definition of Done for DevSecOps
DevOps needs to consider many different aspects of software quality, including security. The term DevSecOps was developed to highlight that security is a focus of the pipeline, not a second-class citizen.
Fortunately, we can define done for our pipeline so that it includes security. Continuous integration can invoke static analysis tools to test for security errors and check if we are using components with known vulnerabilities. Automated deployments and virtualization make dynamic environments available for testing in a production-like setting. Regression tests can drive traffic through proxies for security analysis. From the code to the systems where we deploy the software, the process can be designed to make sure that we follow security best practices, and not produce insecure software.
Participants will learn how to construct a definition of done that focuses on security in a DevOps pipeline. They will see how to define security practices that build confidence that they are doing DevSecOps, and how those practices and criteria might mature over time.
Bootstrapping UX
This talk was presented at NoVA UX event on August 21, 2019. One year ago Jim Lane joined Virtru, a data protection and privacy organization in Washington DC, to build out UX as a discipline in a seven-year-old security company. In his talk Jim outlines establishing a charter, hiring a team, establishing user-centered product development process, choosing tools for scale and speed, and design strategy.
Making the Case for Stronger Endpoint Data Visibility
As security practitioners, we often get caught up worrying about protecting against the latest threat or patching the latest zero-day, however we should spend at least an equal amount of time understanding the data risks of our users and how to offer both better visibility into endpoint data usage, as well as guidance into good data protection practices.
There are a number of different products and vendors that touch on these aspects, but there is no one-stop shop for data protection, and likely never will be. DLP, or Data Loss Prevention, can look at known content types for matches and take protective actions. However, most DLP deployments never moved beyond monitoring due to over-blocking or false positive concerns. Endpoint employee monitoring can take good forensic information, even screenshots to recreate evidence of either inappropriate data usage, or other significant events, though these types of technology are often cumbersome, hard to realize the value and present some serious privacy and ethical concerns. EDR or Endpoint Detection and Response is very threat-focused, with a severe limit on data visibility, and often does little more than capture a checksum of a file, with no content inspection or awareness. UEBA, or User and Entity Behavior Analytics, can often be deployed in conjunction with SIEM or log management capabilities to get a better contextual view of your organization, however, you must first have some semblance of “normal” or a baseline before you can uncover abnormal.
Organizations should begin building the case for stronger endpoint data visibility. This improved data visibility must be easy to use, fast to provide actionable answers, not impede other endpoint security capabilities, and most importantly provide the financial impact of endpoint data and the decisions that users make with that data.
Preventing Fraud and Building an End-to-End Data Science Hub at Feedzai with ...
https://www.elastic.co/elasticon/tour/2019/madrid/preventing-fraud-and-building-an-end-to-end-data-science-hub-at-feedzai-with-elastic
Conoce el testimonio de usuarios locales que han sacado partido a Elastic para llevar a cabo análisis de negocio, analítica de ciberseguridad, moniorización, etc.
Remote Yacht Hacking
Stephan Gerling in Bucharest, Romania on November 8-9th 2018 at DefCamp #9.
The videos and other presentations can be found on https://def.camp/archive
Mobile, IoT, Clouds… It’s time to hire your own risk manager!
Yury Chemerkin in Bucharest, Romania on November 8-9th 2018 at DefCamp #9.
The videos and other presentations can be found on https://def.camp/archive
More Related Content
Similar to Applying Fuzzy Hashing to Phishing Page Identification
CASB — Your new best friend for safe cloud adoption?
CASB — Your new best friend for safe cloud adoption?
The explosive growth of cloud adoption, “cloud first” initiatives and BYOD have created security and compliance blind spots.
Forcepoint’s session examines the growing popularity of the Cloud Access Security Broker as a means to assist security leaders to support business innovation and manage cloud risk.
Kondo-ing API Authorization
API transactions are subjected to many authorization decisions at many different layers. User identities, application scopes, attributes, roles, data privacy, user consent, contracts… Tidy up your decision-making responsibilities across your stack. This presentation will discuss the benefits and tradeoffs of decoupling authorization from service implementation.
Personal Branding for LinkedIn at Silicon Slopes
Slides from my presentation on personal branding and LinkedIn, delivered 05 June, 2018 at Silicon Slopes in Lehi, Utah.
The first part focuses on creating a powerful personal brand that aligns with your business interests. The second part is all about how to make sure your LinkedIn profile is optimized and aligned with your personal brand, how to make meaningful, high quality connections, and create compelling content.
APIdays London 2019 - Why the Financial Industry Needs Intelligent API Securi...
Why the Financial Industry Needs Intelligent API Security
Wesley Dunnington,
Field CTO East Region at Ping Identity
Move and Secure Your Data
Standing in the way of executing application development projects faster is data access from different data sources. Delphix Dynamic Data Platform allows data from a diverse set of data sources in the enterprise to be securely delivered to every stakeholder, across on-premise, cloud and hybrid environments at the speed and scale required to enable rapid development and delivery of applications.
Drupalgeddon 2 – Yet Another Weapon for the Attacker
Radu-Emanuel Chiscariu in Bucharest, Romania on November 8-9th 2018 at DefCamp #9.
The videos and other presentations can be found on https://def.camp/archive
Confessions of DBA Webinar
The document introduces Dhiraj Sehgal and Woody Evans as speakers and discusses how time is a valuable asset for DBAs. It notes that DBAs often have to work in gaps between scheduled work, downtime, and personal time. The document also states that database restores can be frustrating and that most data masking provides only superficial protection. It presents Delphix as taking a different approach using separation, delegation, and automation to provide DBAs with less worry, better sleep, and more time. A quote is provided from Anup Anand of Gain Capital saying Delphix has increased their output by 20% and left more time for innovation.
Confessions of a DBA: “I always avoid requests from DevOps” and Other Admissions
The document introduces Dhiraj Sehgal and Woody Evans as speakers and discusses how time is a valuable asset for DBAs. It notes that DBAs often have to work in gaps between scheduled work, downtime, and personal time. The document also states that database restores can be frustrating and that most data masking provides only superficial protection. It presents an alternative approach of separating, delegating, and automating tasks to give DBAs more worry-free time and sleep. A quote from Anup Anand of Gain Capital says that using Delphix has increased their output by 20% and freed up more time for innovation.
Webinar: Insights from CYREN's Q1 2015 Cyber Threats Trend Report
This document summarizes a CYREN CyberThreat Report from April 2015. It discusses several cybersecurity topics from the first quarter of 2015, including a watering hole attack on Forbes.com, advanced blackhat search engine optimization techniques called SEOHide, the continuing rise of macro malware, lessons learned from security breaches at Slack and HipChat, and how secure hashed passwords are. It also provides statistics on Android threats, phishing, and spam for Q1 2015. The document is intended to discuss current cybersecurity issues and threats based on CYREN's threat intelligence gathered from over 500,000 global data points.
Identity Live Sydney 2018 Keynote Presentation
This document discusses an event for ForgeRock and identity management. It thanks sponsors and introduces several speakers at the event: Steve Ferris, Fran Rosch, Robert Humphrey. Fran Rosch's presentation discusses how identity is at the heart of business relationships, compliance, security and customer experience. Robert Humphrey talks about trends in technology and the importance of omnichannel capabilities. The document emphasizes that with the power of digital identity comes great responsibility and that building trusted customer relationships requires focusing on identity, experience, privacy and consent.
Cloud Ramps Up at DOD--Here's What You Need to Know
As the Department of Defense ramps up its cloud initiatives, it also grapples with various challenges like security, as well as how to make sure the its cloud approach isn’t disjointed among its various organizations. View a sampling of slides from our recent webinar. To view the rest of the slides and hear the webinar, visit https://goo.gl/YCHRNw.
Cisco Girls IT Day
I had a tremendous opportunity to meet remarkable young women interested in Information Technology careers. I shared my career learnings and decisions in my career journey.
The Four Pitfalls of Privilege: Defend Critical Accounts & Systems Against Cy...
This document discusses the four common pitfalls of privilege: 1) Protecting only passwords without securing access pathways, 2) Failing to manage privileges for partners and vendors, 3) Not addressing privilege sprawl due to cloud services and non-traditional accounts, and 4) Prioritizing people over securing machine credentials. It emphasizes the need for a comprehensive privileged access management strategy that enforces least privilege and prevents lateral movement within an organization's systems.
The Future of Marketing Automation is More
The document discusses the future of marketing automation moving from Automation 1.0 to Automation 2.0. Automation 1.0 refers to automation that happens within a single marketing automation tool, while Automation 2.0 involves automation across multiple tools and technologies in a decentralized way. The presentation provides examples of companies like Airbnb that were able to grow through decentralized automations without spending on ads. It also discusses how best-in-class companies use more tools on average and how the focus should be on connecting tools rather than just the number used.
Presentación Jeff Brown, HP en VI Summit País Digital 2018
Exposición “WW Security Trends and Solutions” de Jeff Brown, Head of WW Professional Services, HP, en el marco del VI Summit País Digital 2018 (4 y 5 de septiembre 2018)
Marketing Your Open Source Project (All Things Open 2018)
Your open source project competes with millions of others for users, contributors, and perhaps financial support. To stand out from the crowd, your project needs… marketing. If that term makes you shudder, or you simply don’t think you know how, this talk (aimed at anyone involved in open source) will help you understand the why and the how of open source marketing.
A Definition of Done for DevSecOps
DevOps needs to consider many different aspects of software quality, including security. The term DevSecOps was developed to highlight that security is a focus of the pipeline, not a second-class citizen.
Fortunately, we can define done for our pipeline so that it includes security. Continuous integration can invoke static analysis tools to test for security errors and check if we are using components with known vulnerabilities. Automated deployments and virtualization make dynamic environments available for testing in a production-like setting. Regression tests can drive traffic through proxies for security analysis. From the code to the systems where we deploy the software, the process can be designed to make sure that we follow security best practices, and not produce insecure software.
Participants will learn how to construct a definition of done that focuses on security in a DevOps pipeline. They will see how to define security practices that build confidence that they are doing DevSecOps, and how those practices and criteria might mature over time.
Bootstrapping UX
This talk was presented at NoVA UX event on August 21, 2019. One year ago Jim Lane joined Virtru, a data protection and privacy organization in Washington DC, to build out UX as a discipline in a seven-year-old security company. In his talk Jim outlines establishing a charter, hiring a team, establishing user-centered product development process, choosing tools for scale and speed, and design strategy.
Making the Case for Stronger Endpoint Data Visibility
As security practitioners, we often get caught up worrying about protecting against the latest threat or patching the latest zero-day, however we should spend at least an equal amount of time understanding the data risks of our users and how to offer both better visibility into endpoint data usage, as well as guidance into good data protection practices.
There are a number of different products and vendors that touch on these aspects, but there is no one-stop shop for data protection, and likely never will be. DLP, or Data Loss Prevention, can look at known content types for matches and take protective actions. However, most DLP deployments never moved beyond monitoring due to over-blocking or false positive concerns. Endpoint employee monitoring can take good forensic information, even screenshots to recreate evidence of either inappropriate data usage, or other significant events, though these types of technology are often cumbersome, hard to realize the value and present some serious privacy and ethical concerns. EDR or Endpoint Detection and Response is very threat-focused, with a severe limit on data visibility, and often does little more than capture a checksum of a file, with no content inspection or awareness. UEBA, or User and Entity Behavior Analytics, can often be deployed in conjunction with SIEM or log management capabilities to get a better contextual view of your organization, however, you must first have some semblance of “normal” or a baseline before you can uncover abnormal.
Organizations should begin building the case for stronger endpoint data visibility. This improved data visibility must be easy to use, fast to provide actionable answers, not impede other endpoint security capabilities, and most importantly provide the financial impact of endpoint data and the decisions that users make with that data.
Preventing Fraud and Building an End-to-End Data Science Hub at Feedzai with ...
https://www.elastic.co/elasticon/tour/2019/madrid/preventing-fraud-and-building-an-end-to-end-data-science-hub-at-feedzai-with-elastic
Conoce el testimonio de usuarios locales que han sacado partido a Elastic para llevar a cabo análisis de negocio, analítica de ciberseguridad, moniorización, etc.
Similar to Applying Fuzzy Hashing to Phishing Page Identification (20)
CASB — Your new best friend for safe cloud adoption?
CASB — Your new best friend for safe cloud adoption?
APIdays London 2019 - Why the Financial Industry Needs Intelligent API Securi...
APIdays London 2019 - Why the Financial Industry Needs Intelligent API Securi...
Drupalgeddon 2 – Yet Another Weapon for the Attacker
Drupalgeddon 2 – Yet Another Weapon for the Attacker
Confessions of a DBA: “I always avoid requests from DevOps” and Other Admissions
Confessions of a DBA: “I always avoid requests from DevOps” and Other Admissions
Webinar: Insights from CYREN's Q1 2015 Cyber Threats Trend Report
Webinar: Insights from CYREN's Q1 2015 Cyber Threats Trend Report
Cloud Ramps Up at DOD--Here's What You Need to Know
Cloud Ramps Up at DOD--Here's What You Need to Know
The Four Pitfalls of Privilege: Defend Critical Accounts & Systems Against Cy...
The Four Pitfalls of Privilege: Defend Critical Accounts & Systems Against Cy...
Presentación Jeff Brown, HP en VI Summit País Digital 2018
Presentación Jeff Brown, HP en VI Summit País Digital 2018
Marketing Your Open Source Project (All Things Open 2018)
Marketing Your Open Source Project (All Things Open 2018)
Making the Case for Stronger Endpoint Data Visibility
Making the Case for Stronger Endpoint Data Visibility
Preventing Fraud and Building an End-to-End Data Science Hub at Feedzai with ...
Preventing Fraud and Building an End-to-End Data Science Hub at Feedzai with ...
More from DefCamp
Remote Yacht Hacking
Stephan Gerling in Bucharest, Romania on November 8-9th 2018 at DefCamp #9.
The videos and other presentations can be found on https://def.camp/archive
Mobile, IoT, Clouds… It’s time to hire your own risk manager!
Yury Chemerkin in Bucharest, Romania on November 8-9th 2018 at DefCamp #9.
The videos and other presentations can be found on https://def.camp/archive
The Charter of Trust
Stefan Zarinschi in Bucharest, Romania on November 8-9th 2018 at DefCamp #9.
The videos and other presentations can be found on https://def.camp/archive
Internet Balkanization: Why Are We Raising Borders Online?
Stefan Tanase in Bucharest, Romania on November 8-9th 2018 at DefCamp #9.
The videos and other presentations can be found on https://def.camp/archive
Bridging the gap between CyberSecurity R&D and UX
(1) The document discusses bridging the gap between research and development (R&D) and user experience (UX) in product development.
(2) It emphasizes the importance of asking questions to understand user needs, focusing on user feelings over features, and ensuring users understand how to use products easily.
(3) The key lessons are to thoroughly question requirements, balance R&D and UX priorities, focus on satisfying core users, understand what users truly value, and make products feel intuitive and fast to use.
Secure and privacy-preserving data transmission and processing using homomorp...
Razvan Bocu in Bucharest, Romania on November 8-9th 2018 at DefCamp #9.
The videos and other presentations can be found on https://def.camp/archive
Economical Denial of Sustainability in the Cloud (EDOS)
Raluca Stanciu in Bucharest, Romania on November 8-9th 2018 at DefCamp #9.
The videos and other presentations can be found on https://def.camp/archive
Trust, but verify – Bypassing MFA
This document discusses multi-factor authentication (MFA) and methods for bypassing it. It defines MFA as requiring more than one validation procedure to authenticate individuals. It describes the different factors of authentication as something you know, something you have, and something you are. It outlines various deployment modules for each factor type, including passwords, tokens, biometrics. It also covers challenges of MFA implementation and methods attackers could use to bypass MFA security, such as email filtering or legacy protocol exploitation.
Threat Hunting: From Platitudes to Practical Application
This document discusses threat hunting and practical approaches to threat hunting. It defines threat hunting as proactively searching through data to detect threats that evaded traditional security measures. It argues that threat hunting is more effective than reacting to incidents. The document provides guidance on log collection, developing situational awareness, hunting hosts and networks, maintaining a flexible mindset, and sharing findings. It suggests starting with small data collection and focusing on important systems and network areas. The goal is to understand normal behavior and detect anomalies.
Building application security with 0 money down
Muhammad Mudassar Yamin in Bucharest, Romania on November 8-9th 2018 at DefCamp #9.
The videos and other presentations can be found on https://def.camp/archive
Implementation of information security techniques on modern android based Kio...
Muhammad Mudassar Yamin in Bucharest, Romania on November 8-9th 2018 at DefCamp #9.
The videos and other presentations can be found on https://def.camp/archive
Lattice based Merkle for post-quantum epoch
Maksim Iavich in Bucharest, Romania on November 8-9th 2018 at DefCamp #9.
The videos and other presentations can be found on https://def.camp/archive
The challenge of building a secure and safe digital environment in healthcare
Jelena Milosevic in Bucharest, Romania on November 8-9th 2018 at DefCamp #9.
The videos and other presentations can be found on https://def.camp/archive
Timing attacks against web applications: Are they still practical?
This document discusses the practicality of timing attacks against web applications. It begins by explaining what a timing attack is and detailing the author's plan to conduct one against a target application. The plan involved studying the application's code, pinpointing an exploitable function, collecting timing data, filtering noise, and reducing the search space. The author was able to measure response times and identify spikes but encountered challenges averaging server performance. They demonstrate conducting a timing attack to recover hashed credentials over many requests. Ultimately, while timing attacks can be efficient, they are difficult to execute remotely and most applications and servers have protections that render the attacks impractical. Constant-time algorithms and rate limiting are presented as solutions to prevent these types of attacks.
Tor .onions: The Good, The Rotten and The Misconfigured
Ionut-Cristian Bucur in Bucharest, Romania on November 8-9th 2018 at DefCamp #9.
The videos and other presentations can be found on https://def.camp/archive
Needles, Haystacks and Algorithms: Using Machine Learning to detect complex t...
Ioan Constantin in Bucharest, Romania on November 8-9th 2018 at DefCamp #9.
The videos and other presentations can be found on https://def.camp/archive
We will charge you. How to [b]reach vendor’s network using EV charging station.
This document summarizes a presentation about vulnerabilities found in electric vehicle charging stations. The presentation covered:
1) Several vulnerabilities were found in the Bluetooth and Wi-Fi stacks that could allow access to the vendor's internal network, including arbitrary file writes, command injection, and buffer overflows.
2) The vulnerabilities were disclosed responsibly to the vendor, who developed a detailed plan and released updated firmware within a few months to address all issues.
3) Electric vehicles and charging stations are an important area for continued security research given the protocols for wireless communication, transactions, and vehicle-to-charger interfaces.
Connect & Inspire Cyber Security
Cristian Pațachia-Sultănoiu in Bucharest, Romania on November 8-9th 2018 at DefCamp #9.
The videos and other presentations can be found on https://def.camp/archive
The lions and the watering hole
This document discusses watering hole attacks, a type of cyber attack where hackers compromise frequently visited websites to infect visitors' devices through drive-by exploits. It describes how watering hole attacks work, why they are difficult to detect, and introduces DEKENEAS, an AI-based solution developed by the author to detect watering hole attacks through analyzing obfuscated JavaScript. DEKENEAS trains on over 40,000 malicious redirect samples to recognize behavioral patterns and classify code as malicious or not. When tested on 10,000 new samples and top websites, it achieved 100% detection of unknown implants with no false negatives and a very low false positive rate of 0.00023%.
Catch Me If You Can - Finding APTs in your network
Adrian Tudor & Leo Neagu in Bucharest, Romania on November 8-9th 2018 at DefCamp #9.
The videos and other presentations can be found on https://def.camp/archive
More from DefCamp (20)
Mobile, IoT, Clouds… It’s time to hire your own risk manager!
Mobile, IoT, Clouds… It’s time to hire your own risk manager!
Internet Balkanization: Why Are We Raising Borders Online?
Internet Balkanization: Why Are We Raising Borders Online?
Secure and privacy-preserving data transmission and processing using homomorp...
Secure and privacy-preserving data transmission and processing using homomorp...
Economical Denial of Sustainability in the Cloud (EDOS)
Economical Denial of Sustainability in the Cloud (EDOS)
Threat Hunting: From Platitudes to Practical Application
Threat Hunting: From Platitudes to Practical Application
Implementation of information security techniques on modern android based Kio...
Implementation of information security techniques on modern android based Kio...
The challenge of building a secure and safe digital environment in healthcare
The challenge of building a secure and safe digital environment in healthcare
Timing attacks against web applications: Are they still practical?
Timing attacks against web applications: Are they still practical?
Tor .onions: The Good, The Rotten and The Misconfigured
Tor .onions: The Good, The Rotten and The Misconfigured
Needles, Haystacks and Algorithms: Using Machine Learning to detect complex t...
Needles, Haystacks and Algorithms: Using Machine Learning to detect complex t...
We will charge you. How to [b]reach vendor’s network using EV charging station.
We will charge you. How to [b]reach vendor’s network using EV charging station.
Catch Me If You Can - Finding APTs in your network
Catch Me If You Can - Finding APTs in your network
Recently uploaded
Taking AI to the Next Level in Manufacturing.pdf
Read Taking AI to the Next Level in Manufacturing to gain insights on AI adoption in the manufacturing industry, such as:
1. How quickly AI is being implemented in manufacturing.
2. Which barriers stand in the way of AI adoption.
3. How data quality and governance form the backbone of AI.
4. Organizational processes and structures that may inhibit effective AI adoption.
6. Ideas and approaches to help build your organization's AI strategy.
“Temporal Event Neural Networks: A More Efficient Alternative to the Transfor...
“Temporal Event Neural Networks: A More Efficient Alternative to the Transfor...Edge AI and Vision Alliance
For the full video of this presentation, please visit: https://www.edge-ai-vision.com/2024/06/temporal-event-neural-networks-a-more-efficient-alternative-to-the-transformer-a-presentation-from-brainchip/
Chris Jones, Director of Product Management at BrainChip , presents the “Temporal Event Neural Networks: A More Efficient Alternative to the Transformer” tutorial at the May 2024 Embedded Vision Summit.
The expansion of AI services necessitates enhanced computational capabilities on edge devices. Temporal Event Neural Networks (TENNs), developed by BrainChip, represent a novel and highly efficient state-space network. TENNs demonstrate exceptional proficiency in handling multi-dimensional streaming data, facilitating advancements in object detection, action recognition, speech enhancement and language model/sequence generation. Through the utilization of polynomial-based continuous convolutions, TENNs streamline models, expedite training processes and significantly diminish memory requirements, achieving notable reductions of up to 50x in parameters and 5,000x in energy consumption compared to prevailing methodologies like transformers.
Integration with BrainChip’s Akida neuromorphic hardware IP further enhances TENNs’ capabilities, enabling the realization of highly capable, portable and passively cooled edge devices. This presentation delves into the technical innovations underlying TENNs, presents real-world benchmarks, and elucidates how this cutting-edge approach is positioned to revolutionize edge AI across diverse applications.[OReilly Superstream] Occupy the Space: A grassroots guide to engineering (an...
The typical problem in product engineering is not bad strategy, so much as “no strategy”. This leads to confusion, lack of motivation, and incoherent action. The next time you look for a strategy and find an empty space, instead of waiting for it to be filled, I will show you how to fill it in yourself. If you’re wrong, it forces a correction. If you’re right, it helps create focus. I’ll share how I’ve approached this in the past, both what works and lessons for what didn’t work so well.
Skybuffer SAM4U tool for SAP license adoption
Manage and optimize your license adoption and consumption with SAM4U, an SAP free customer software asset management tool.
SAM4U, an SAP complimentary software asset management tool for customers, delivers a detailed and well-structured overview of license inventory and usage with a user-friendly interface. We offer a hosted, cost-effective, and performance-optimized SAM4U setup in the Skybuffer Cloud environment. You retain ownership of the system and data, while we manage the ABAP 7.58 infrastructure, ensuring fixed Total Cost of Ownership (TCO) and exceptional services through the SAP Fiori interface.
Mutation Testing for Task-Oriented Chatbots
Conversational agents, or chatbots, are increasingly used to access all sorts of services using natural language. While open-domain chatbots - like ChatGPT - can converse on any topic, task-oriented chatbots - the focus of this paper - are designed for specific tasks, like booking a flight, obtaining customer support, or setting an appointment. Like any other software, task-oriented chatbots need to be properly tested, usually by defining and executing test scenarios (i.e., sequences of user-chatbot interactions). However, there is currently a lack of methods to quantify the completeness and strength of such test scenarios, which can lead to low-quality tests, and hence to buggy chatbots.
To fill this gap, we propose adapting mutation testing (MuT) for task-oriented chatbots. To this end, we introduce a set of mutation operators that emulate faults in chatbot designs, an architecture that enables MuT on chatbots built using heterogeneous technologies, and a practical realisation as an Eclipse plugin. Moreover, we evaluate the applicability, effectiveness and efficiency of our approach on open-source chatbots, with promising results.
High performance Serverless Java on AWS- GoTo Amsterdam 2024
Java is for many years one of the most popular programming languages, but it used to have hard times in the Serverless community. Java is known for its high cold start times and high memory footprint, comparing to other programming languages like Node.js and Python. In this talk I'll look at the general best practices and techniques we can use to decrease memory consumption, cold start times for Java Serverless development on AWS including GraalVM (Native Image) and AWS own offering SnapStart based on Firecracker microVM snapshot and restore and CRaC (Coordinated Restore at Checkpoint) runtime hooks. I'll also provide a lot of benchmarking on Lambda functions trying out various deployment package sizes, Lambda memory settings, Java compilation options and HTTP (a)synchronous clients and measure their impact on cold and warm start times.
Connector Corner: Seamlessly power UiPath Apps, GenAI with prebuilt connectors
Join us to learn how UiPath Apps can directly and easily interact with prebuilt connectors via Integration Service--including Salesforce, ServiceNow, Open GenAI, and more.
The best part is you can achieve this without building a custom workflow! Say goodbye to the hassle of using separate automations to call APIs. By seamlessly integrating within App Studio, you can now easily streamline your workflow, while gaining direct access to our Connector Catalog of popular applications.
We’ll discuss and demo the benefits of UiPath Apps and connectors including:
Creating a compelling user experience for any software, without the limitations of APIs.
Accelerating the app creation process, saving time and effort
Enjoying high-performance CRUD (create, read, update, delete) operations, for
seamless data management.
Speakers:
Russell Alfeche, Technology Leader, RPA at qBotic and UiPath MVP
Charlie Greenberg, host
Fueling AI with Great Data with Airbyte Webinar
This talk will focus on how to collect data from a variety of sources, leveraging this data for RAG and other GenAI use cases, and finally charting your course to productionalization.
Columbus Data & Analytics Wednesdays - June 2024
Columbus Data & Analytics Wednesdays, June 2024 with Maria Copot 20
Choosing The Best AWS Service For Your Website + API.pptx
Have you ever been confused by the myriad of choices offered by AWS for hosting a website or an API?
Lambda, Elastic Beanstalk, Lightsail, Amplify, S3 (and more!) can each host websites + APIs. But which one should we choose?
Which one is cheapest? Which one is fastest? Which one will scale to meet our needs?
Join me in this session as we dive into each AWS hosting service to determine which one is best for your scenario and explain why!
Crafting Excellence: A Comprehensive Guide to iOS Mobile App Development Serv...
Crafting Excellence: A Comprehensive Guide to iOS Mobile App Development Serv...Pitangent Analytics & Technology Solutions Pvt. Ltd
Discover top-tier mobile app development services, offering innovative solutions for iOS and Android. Enhance your business with custom, user-friendly mobile applications.Astute Business Solutions | Oracle Cloud Partner |
Your goto partner for Oracle Cloud, PeopleSoft, E-Business Suite, and Ellucian Banner. We are a firm specialized in managed services and consulting.
Leveraging the Graph for Clinical Trials and Standards
Katja Glaß
OpenStudyBuilder Community Manager - Katja Glaß Consulting
Marius Conjeaud
Principal Consultant - Neo4j
Must Know Postgres Extension for DBA and Developer during Migration
Mydbops Opensource Database Meetup 16
Topic: Must-Know PostgreSQL Extensions for Developers and DBAs During Migration
Speaker: Deepak Mahto, Founder of DataCloudGaze Consulting
Date & Time: 8th June | 10 AM - 1 PM IST
Venue: Bangalore International Centre, Bangalore
Abstract: Discover how PostgreSQL extensions can be your secret weapon! This talk explores how key extensions enhance database capabilities and streamline the migration process for users moving from other relational databases like Oracle.
Key Takeaways:
* Learn about crucial extensions like oracle_fdw, pgtt, and pg_audit that ease migration complexities.
* Gain valuable strategies for implementing these extensions in PostgreSQL to achieve license freedom.
* Discover how these key extensions can empower both developers and DBAs during the migration process.
* Don't miss this chance to gain practical knowledge from an industry expert and stay updated on the latest open-source database trends.
Mydbops Managed Services specializes in taking the pain out of database management while optimizing performance. Since 2015, we have been providing top-notch support and assistance for the top three open-source databases: MySQL, MongoDB, and PostgreSQL.
Our team offers a wide range of services, including assistance, support, consulting, 24/7 operations, and expertise in all relevant technologies. We help organizations improve their database's performance, scalability, efficiency, and availability.
Contact us: info@mydbops.com
Visit: https://www.mydbops.com/
Follow us on LinkedIn: https://in.linkedin.com/company/mydbops
For more details and updates, please follow up the below links.
Meetup Page : https://www.meetup.com/mydbops-databa...
Twitter: https://twitter.com/mydbopsofficial
Blogs: https://www.mydbops.com/blog/
Facebook(Meta): https://www.facebook.com/mydbops/
GNSS spoofing via SDR (Criptored Talks 2024)
In the realm of cybersecurity, offensive security practices act as a critical shield. By simulating real-world attacks in a controlled environment, these techniques expose vulnerabilities before malicious actors can exploit them. This proactive approach allows manufacturers to identify and fix weaknesses, significantly enhancing system security.
This presentation delves into the development of a system designed to mimic Galileo's Open Service signal using software-defined radio (SDR) technology. We'll begin with a foundational overview of both Global Navigation Satellite Systems (GNSS) and the intricacies of digital signal processing.
The presentation culminates in a live demonstration. We'll showcase the manipulation of Galileo's Open Service pilot signal, simulating an attack on various software and hardware systems. This practical demonstration serves to highlight the potential consequences of unaddressed vulnerabilities, emphasizing the importance of offensive security practices in safeguarding critical infrastructure.
Your One-Stop Shop for Python Success: Top 10 US Python Development Providers
Simplify your search for a reliable Python development partner! This list presents the top 10 trusted US providers offering comprehensive Python development services, ensuring your project's success from conception to completion.
JavaLand 2024: Application Development Green Masterplan
My presentation slides I used at JavaLand 2024
Recently uploaded (20)
“Temporal Event Neural Networks: A More Efficient Alternative to the Transfor...
“Temporal Event Neural Networks: A More Efficient Alternative to the Transfor...
[OReilly Superstream] Occupy the Space: A grassroots guide to engineering (an...
[OReilly Superstream] Occupy the Space: A grassroots guide to engineering (an...
9 CEO's who hit $100m ARR Share Their Top Growth Tactics Nathan Latka, Founde...
9 CEO's who hit $100m ARR Share Their Top Growth Tactics Nathan Latka, Founde...
High performance Serverless Java on AWS- GoTo Amsterdam 2024
High performance Serverless Java on AWS- GoTo Amsterdam 2024
Connector Corner: Seamlessly power UiPath Apps, GenAI with prebuilt connectors
Connector Corner: Seamlessly power UiPath Apps, GenAI with prebuilt connectors
Choosing The Best AWS Service For Your Website + API.pptx
Choosing The Best AWS Service For Your Website + API.pptx
Crafting Excellence: A Comprehensive Guide to iOS Mobile App Development Serv...
Crafting Excellence: A Comprehensive Guide to iOS Mobile App Development Serv...
Astute Business Solutions | Oracle Cloud Partner |
Astute Business Solutions | Oracle Cloud Partner |
Leveraging the Graph for Clinical Trials and Standards
Leveraging the Graph for Clinical Trials and Standards
Must Know Postgres Extension for DBA and Developer during Migration
Must Know Postgres Extension for DBA and Developer during Migration
Your One-Stop Shop for Python Success: Top 10 US Python Development Providers
Your One-Stop Shop for Python Success: Top 10 US Python Development Providers
JavaLand 2024: Application Development Green Masterplan
JavaLand 2024: Application Development Green Masterplan
Applying Fuzzy Hashing to Phishing Page Identification
- 1. 1© 2018 KEYSIGHT AND/OR ITS AFFILIATES. ALL RIGHTS RESERVED. | APPLYING FUZZY HASHING TO PHISHING PAGE IDENTIFICATION Adrian Hada, Senior Security Researcher
- 2. 2© 2018 KEYSIGHT AND/OR ITS AFFILIATES. ALL RIGHTS RESERVED. | ABOUT ME • Senior Security Researcher • Mostly malware & honeypots • Sometimes phishing • @ht_adrian
- 3. 3© 2018 KEYSIGHT AND/OR ITS AFFILIATES. ALL RIGHTS RESERVED. | PHISHING • We all know what it is • Users know(?) what it is
- 4. 4© 2018 KEYSIGHT AND/OR ITS AFFILIATES. ALL RIGHTS RESERVED. | IP/DOMAIN REPUTATION
- 5. 5© 2018 KEYSIGHT AND/OR ITS AFFILIATES. ALL RIGHTS RESERVED. | VISUAL HASHING
- 6. 6© 2018 KEYSIGHT AND/OR ITS AFFILIATES. ALL RIGHTS RESERVED. | VISUAL HASHING Rendering Failures
- 7. 7© 2018 KEYSIGHT AND/OR ITS AFFILIATES. ALL RIGHTS RESERVED. | VISUAL HASHING Templates
- 8. 8© 2018 KEYSIGHT AND/OR ITS AFFILIATES. ALL RIGHTS RESERVED. | PHISHING PROCESS Template DeployProfit
- 9. 9© 2018 KEYSIGHT AND/OR ITS AFFILIATES. ALL RIGHTS RESERVED. | HTML TEMPLATE
- 10. 10© 2018 KEYSIGHT AND/OR ITS AFFILIATES. ALL RIGHTS RESERVED. | FUZZY HASHES
- 11. 11© 2018 KEYSIGHT AND/OR ITS AFFILIATES. ALL RIGHTS RESERVED. | CLUSTERING
- 12. 12© 2018 KEYSIGHT AND/OR ITS AFFILIATES. ALL RIGHTS RESERVED. |