Appropriate questions for evidence gathering
•Download as PPTX, PDF•
0 likes•226 views
This document provides 10 questions to help gather evidence about a problem: when did the problem start, how did it start, did it happen on its own, what the user was doing, whether an error message appeared, what the error said, if it had happened before, if new software or hardware was installed, if there was a recent power outage, and when a virus scan was last run.
Report
Share
Report
Share
Recommended
Sigma Open Tech Week: Bitter Truth About Software Security
This document discusses common problems with how application security is implemented. It argues that software developers often lack security knowledge and focus on functionality over security. Security teams also lack development experience and focus on compliance over practical security. As a result, security is treated as an afterthought through ineffective practices like sole reliance on penetration testing. The document recommends a proper Secure Development Lifecycle approach involving security training, secure coding practices, testing and ongoing improvements.
Just4Meeting 2012 - How to protect your web applications
Just4Meeting 2012 - How to protect your web applications
Julho de 2012 em Cascais, Portugal.
http://www.just4meeting.com/
10
This document contains questions for troubleshooting a computer problem, asking whether any changes were made before the issue occurred, if new devices were installed without drivers, what error messages appear, if the computer is powered on and plugged in, if virus sweeps or defragging were recently done, if power outages occurred, if the environment is suitable, and if booting in safe mode or consulting help databases were attempted.
10 Reasons Why You Fix Bugs As Soon As You Find Them
The document outlines 10 reasons why software teams should fix bugs as soon as they are found:
1) Unfixed bugs can camouflage other bugs, potentially hiding serious priority 1 bugs. The sooner bugs are fixed, the better.
2) Leaving bugs unfixed suggests to the team that quality is not important, which can negatively impact morale and work quality.
3) Discussing unfixed bugs is a waste of time when the only important question is whether the bug needs to be fixed.
4) Unfixed bugs can lead to duplicate bug reports as it becomes harder to determine if a bug has already been reported when there are many open bugs. This wastes time on unnecessary duplication
DevSecCon Singapore 2018 - Pushing left like a boss by Tanya Janca
- The document discusses "pushing left" in application security, which means involving security teams earlier in the software development lifecycle from requirements through testing.
- It outlines the key elements of an application security program including vulnerability assessments, threat modeling, code reviews, penetration testing, secure coding practices, and bug bounty programs.
- It provides advice for individuals to push left in their own work by testing their own code using a web proxy, conducting threat modeling, reviewing code for security issues, and training themselves in secure coding best practices.
DevSecCon Singapore 2018 - Measuring and maximizing vuln discovery efforts by...
The document discusses strategies for measuring and maximizing vulnerability discovery in a DevSecOps context. It notes that bounty sizes are an imperfect proxy for risk and work. Various discovery methods like scanners, bounties, and pen tests are discussed, along with the issues of noise and prioritizing remediation. The document advocates for shift left security practices like threat modeling and monitoring app inventories to help reduce risk and inform secure development.
Automating your processes with JIRA
Jamie Echlin details how and why to start automating processes and workflows in Atlassian JIRA. Presented at the iDalko event in Antwerp on April 14th 2016.
BHack 2012 - How to protect your web applications
BHack 2012 - How to protect your web applications
Junho de 2012 em Belo Horizonte, MG
http://bhack.com.br/
Recommended
Sigma Open Tech Week: Bitter Truth About Software Security
This document discusses common problems with how application security is implemented. It argues that software developers often lack security knowledge and focus on functionality over security. Security teams also lack development experience and focus on compliance over practical security. As a result, security is treated as an afterthought through ineffective practices like sole reliance on penetration testing. The document recommends a proper Secure Development Lifecycle approach involving security training, secure coding practices, testing and ongoing improvements.
Just4Meeting 2012 - How to protect your web applications
Just4Meeting 2012 - How to protect your web applications
Julho de 2012 em Cascais, Portugal.
http://www.just4meeting.com/
10
This document contains questions for troubleshooting a computer problem, asking whether any changes were made before the issue occurred, if new devices were installed without drivers, what error messages appear, if the computer is powered on and plugged in, if virus sweeps or defragging were recently done, if power outages occurred, if the environment is suitable, and if booting in safe mode or consulting help databases were attempted.
10 Reasons Why You Fix Bugs As Soon As You Find Them
The document outlines 10 reasons why software teams should fix bugs as soon as they are found:
1) Unfixed bugs can camouflage other bugs, potentially hiding serious priority 1 bugs. The sooner bugs are fixed, the better.
2) Leaving bugs unfixed suggests to the team that quality is not important, which can negatively impact morale and work quality.
3) Discussing unfixed bugs is a waste of time when the only important question is whether the bug needs to be fixed.
4) Unfixed bugs can lead to duplicate bug reports as it becomes harder to determine if a bug has already been reported when there are many open bugs. This wastes time on unnecessary duplication
DevSecCon Singapore 2018 - Pushing left like a boss by Tanya Janca
- The document discusses "pushing left" in application security, which means involving security teams earlier in the software development lifecycle from requirements through testing.
- It outlines the key elements of an application security program including vulnerability assessments, threat modeling, code reviews, penetration testing, secure coding practices, and bug bounty programs.
- It provides advice for individuals to push left in their own work by testing their own code using a web proxy, conducting threat modeling, reviewing code for security issues, and training themselves in secure coding best practices.
DevSecCon Singapore 2018 - Measuring and maximizing vuln discovery efforts by...
The document discusses strategies for measuring and maximizing vulnerability discovery in a DevSecOps context. It notes that bounty sizes are an imperfect proxy for risk and work. Various discovery methods like scanners, bounties, and pen tests are discussed, along with the issues of noise and prioritizing remediation. The document advocates for shift left security practices like threat modeling and monitoring app inventories to help reduce risk and inform secure development.
Automating your processes with JIRA
Jamie Echlin details how and why to start automating processes and workflows in Atlassian JIRA. Presented at the iDalko event in Antwerp on April 14th 2016.
BHack 2012 - How to protect your web applications
BHack 2012 - How to protect your web applications
Junho de 2012 em Belo Horizonte, MG
http://bhack.com.br/
What we learned from three years sciencing the crap out of devops
Three years, 20,000 DevOps professionals, and some science... What did we find? Well, the headline is that IT *does* matter if you do it right. With a mix of technology, processes, and a great culture, IT contributes to organizations' profitability, productivity, and market share. We also found that using continuous delivery and lean management practices not only makes IT better -- giving you throughput and stability without tradeoffs -- but it also makes your work feel better -- making your organizational culture better and decreasing burnout. Jez and Nicole will share these findings as well as tips and tricks to help make your own DevOps transformation awesome.
Making disaster routine
This document discusses how organizations can prepare for disasters by making failures routine through practices like chaos engineering and active monitoring. It recommends:
1) Practicing failure scenarios as a team to improve disaster response procedures and checklists.
2) Introducing variables like server crashes and network issues in production environments using chaos engineering to test resiliency.
3) Monitoring application health over time to detect performance trends that could indicate future issues.
4) Treating failures as routine events by having established procedures and checklists to minimize panic and focus response efforts.
What We Learned from Three Years of Sciencing the Crap Out of DevOps
This document summarizes research from three years of studying DevOps practices. Some key findings include:
- Continuous delivery practices like reducing lead time and increasing release frequency are correlated with higher IT performance. However, tools like configuration management tools are not correlated.
- Ineffective testing practices include developers not creating tests or environments being difficult to reproduce. But having QA primarily create tests is not ineffective.
- While managing work-in-progress is thought to be important, the correlation between WIP and IT performance is actually negligible.
- DevOps culture and practices around information sharing and collaboration are valid constructs that are predictive of both IT and organizational performance. But data testing is needed to validate assumptions.
«OWASP Top 10 hands on workshop» by Stanislav Breslavskyi
This document summarizes an OWASP Top-10 Hands-on Workshop. It introduces OWASP as a non-profit organization focused on web application security. It then outlines the top 10 vulnerabilities according to OWASP: Injection, Broken Authentication and Session Management, Cross-Site Scripting (XSS), Insecure Direct Object References, Security Misconfiguration, Sensitive Data Exposure, Missing Function Level Access Control, Cross-Site Request Forgery (CSRF), Using Components with Known Vulnerabilities, and Unvalidated Redirects and Forwards. The rest of the document demonstrates examples of these vulnerabilities on a vulnerable web application and provides guidance on how to test for and fix security issues.
Sandstorm or Significant? The evolving role of situational context in inciden...
Providing Situational Context to first responders is one of the most nuanced and critical success factors teams need as they manage and resolve incidents. It’s critical at all stages of incident management, from alert detection through postmortem. Provide no context, and you’ll materially impede resolution efforts. Overwhelm a team with data, and chaos ensues.
Testing Javascript Apps with Mocha and Chai
Testing code is very important and leads to more well-thought-out designs and more stable codebases. But how do we test javascript applications? Tools like Sinon.js, Mocha, and Chai can alleviate some of the pain as we try to bring testing benefits into our applications
Microservices Summit - The Human Side of Services
This document discusses the importance of the human side of services at Yelp and outlines several best practices for operating microservices. It emphasizes the importance of clear organizational objectives, service level agreements to define key metrics like performance and reliability, emphasis on cooperation between teams with varied skills, and avoiding common pitfalls like depending too heavily on libraries or assuming all developers can do operations work. The overall message is that successful microservices require both technical excellence and a focus on the human factors of collaboration, clear goals, and ownership.
Lean startup part iii
This document discusses ways to develop projects faster by checking viability through batch processing. It notes advantages of batch processing include immediately detecting and removing defects, notifying relevant teams, and blocking further changes until the root cause is identified and fixed. The document also discusses growing sustainably through word of mouth, advertising, repeat customers, and engines of growth including sticky, viral, and paid methods.
Christopher nolan
Christopher Nolan is a renowned British-American director known for films like the Dark Knight trilogy and Inception. The Dark Knight is an action thriller that depicts Batman, the police chief, and district attorney attempting to bring order to Gotham city against the criminal plans of the Joker. The Joker threatens to kill one person every day until Batman reveals his identity, so the district attorney sacrifices himself. However, both he and Batman's love interest are captured and Batman must choose who to save. Though he tries to save his love, the Joker has tricked him and she dies while the district attorney is disfigured. The Joker then manipulates the district attorney to seek revenge, forcing Batman to take responsibility for the
Presentation romy laron
The document discusses the benefits of exercise for mental health. Regular physical activity can help reduce anxiety and depression and improve mood and cognitive functioning. Exercise causes chemical changes in the brain that may help protect against mental illness and improve symptoms.
Projectors
The document discusses different types of projectors, including their advantages and disadvantages. Front projection allows for a larger image size but requires careful room lighting design. Rear projection allows for easier interaction and is better for rooms with normal lighting, but has limited screen size and requires space behind the screen. CRT projectors have long service life but are large, heavy, and use more power. LCD projectors display color images using polarized light through LCD panels but require more setup. LED projectors are becoming more popular due to less maintenance and longer life compared to conventional lamps.
K 5 workshop day2
This document discusses a training for elementary teachers on the transition to the Common Core State Standards. It includes objectives to share lessons, discuss text complexity, and focus on productive collaborative conversations. Teachers are asked to design a lesson incorporating reading and speaking/listening standards. Key aspects of the CCSS are reviewed like 21st century skills. The document provides information on text complexity, critical collaborative conversations, and examples of speaking and listening standards. Teachers are tasked with planning lessons using informational texts and incorporating speaking/listening standards.
Goldilocks
Goldilocks went for a walk in the forest and came upon the house of the three bears. She tried their porridge, chairs, and beds. The first of each were too extreme, but the third was just right. When the three bears returned home, they discovered someone had been eating their porridge, sitting in their chairs, and sleeping in their beds. They found Goldilocks asleep in Baby Bear's bed. Goldilocks woke up and ran away in fear upon seeing the three bears.
The Wright Insurance Group Informational Packet.
The document provides information on the various member companies of The Wright Insurance Group, which has been in operation for over 30 years. It includes summaries of Wright Specialty Insurance, Wright Flood, Wright Risk Consulting, Wright Program Management, Wright Risk Management, and their specialized insurance services for sectors like education, flood insurance, risk consulting, food industry insurance programs, and New York reciprocal insurance programs.
Genomineerden voetbalshirt van het jaar 2012
De mooiste voetbalshirts van 2012. De Voetbalshirt van het Jaar Verkiezing is dé publieksprijs die jaarlijks wordt uitgereikt aan het voetbalshirt dat qua design en kleurgebruik als mooiste van het jaar geldt. Zowel de tenues van nationale elftallen als van (inter)nationale clubteams komen voor de prijs in aanmerking.
www.voetbalshirtvanhetjaar.com
More Related Content
What's hot
What we learned from three years sciencing the crap out of devops
Three years, 20,000 DevOps professionals, and some science... What did we find? Well, the headline is that IT *does* matter if you do it right. With a mix of technology, processes, and a great culture, IT contributes to organizations' profitability, productivity, and market share. We also found that using continuous delivery and lean management practices not only makes IT better -- giving you throughput and stability without tradeoffs -- but it also makes your work feel better -- making your organizational culture better and decreasing burnout. Jez and Nicole will share these findings as well as tips and tricks to help make your own DevOps transformation awesome.
Making disaster routine
This document discusses how organizations can prepare for disasters by making failures routine through practices like chaos engineering and active monitoring. It recommends:
1) Practicing failure scenarios as a team to improve disaster response procedures and checklists.
2) Introducing variables like server crashes and network issues in production environments using chaos engineering to test resiliency.
3) Monitoring application health over time to detect performance trends that could indicate future issues.
4) Treating failures as routine events by having established procedures and checklists to minimize panic and focus response efforts.
What We Learned from Three Years of Sciencing the Crap Out of DevOps
This document summarizes research from three years of studying DevOps practices. Some key findings include:
- Continuous delivery practices like reducing lead time and increasing release frequency are correlated with higher IT performance. However, tools like configuration management tools are not correlated.
- Ineffective testing practices include developers not creating tests or environments being difficult to reproduce. But having QA primarily create tests is not ineffective.
- While managing work-in-progress is thought to be important, the correlation between WIP and IT performance is actually negligible.
- DevOps culture and practices around information sharing and collaboration are valid constructs that are predictive of both IT and organizational performance. But data testing is needed to validate assumptions.
«OWASP Top 10 hands on workshop» by Stanislav Breslavskyi
This document summarizes an OWASP Top-10 Hands-on Workshop. It introduces OWASP as a non-profit organization focused on web application security. It then outlines the top 10 vulnerabilities according to OWASP: Injection, Broken Authentication and Session Management, Cross-Site Scripting (XSS), Insecure Direct Object References, Security Misconfiguration, Sensitive Data Exposure, Missing Function Level Access Control, Cross-Site Request Forgery (CSRF), Using Components with Known Vulnerabilities, and Unvalidated Redirects and Forwards. The rest of the document demonstrates examples of these vulnerabilities on a vulnerable web application and provides guidance on how to test for and fix security issues.
Sandstorm or Significant? The evolving role of situational context in inciden...
Providing Situational Context to first responders is one of the most nuanced and critical success factors teams need as they manage and resolve incidents. It’s critical at all stages of incident management, from alert detection through postmortem. Provide no context, and you’ll materially impede resolution efforts. Overwhelm a team with data, and chaos ensues.
Testing Javascript Apps with Mocha and Chai
Testing code is very important and leads to more well-thought-out designs and more stable codebases. But how do we test javascript applications? Tools like Sinon.js, Mocha, and Chai can alleviate some of the pain as we try to bring testing benefits into our applications
Microservices Summit - The Human Side of Services
This document discusses the importance of the human side of services at Yelp and outlines several best practices for operating microservices. It emphasizes the importance of clear organizational objectives, service level agreements to define key metrics like performance and reliability, emphasis on cooperation between teams with varied skills, and avoiding common pitfalls like depending too heavily on libraries or assuming all developers can do operations work. The overall message is that successful microservices require both technical excellence and a focus on the human factors of collaboration, clear goals, and ownership.
Lean startup part iii
This document discusses ways to develop projects faster by checking viability through batch processing. It notes advantages of batch processing include immediately detecting and removing defects, notifying relevant teams, and blocking further changes until the root cause is identified and fixed. The document also discusses growing sustainably through word of mouth, advertising, repeat customers, and engines of growth including sticky, viral, and paid methods.
What's hot (8)
What we learned from three years sciencing the crap out of devops
What we learned from three years sciencing the crap out of devops
What We Learned from Three Years of Sciencing the Crap Out of DevOps
What We Learned from Three Years of Sciencing the Crap Out of DevOps
«OWASP Top 10 hands on workshop» by Stanislav Breslavskyi
«OWASP Top 10 hands on workshop» by Stanislav Breslavskyi
Sandstorm or Significant? The evolving role of situational context in inciden...
Sandstorm or Significant? The evolving role of situational context in inciden...
Viewers also liked
Christopher nolan
Christopher Nolan is a renowned British-American director known for films like the Dark Knight trilogy and Inception. The Dark Knight is an action thriller that depicts Batman, the police chief, and district attorney attempting to bring order to Gotham city against the criminal plans of the Joker. The Joker threatens to kill one person every day until Batman reveals his identity, so the district attorney sacrifices himself. However, both he and Batman's love interest are captured and Batman must choose who to save. Though he tries to save his love, the Joker has tricked him and she dies while the district attorney is disfigured. The Joker then manipulates the district attorney to seek revenge, forcing Batman to take responsibility for the
Presentation romy laron
The document discusses the benefits of exercise for mental health. Regular physical activity can help reduce anxiety and depression and improve mood and cognitive functioning. Exercise causes chemical changes in the brain that may help protect against mental illness and improve symptoms.
Projectors
The document discusses different types of projectors, including their advantages and disadvantages. Front projection allows for a larger image size but requires careful room lighting design. Rear projection allows for easier interaction and is better for rooms with normal lighting, but has limited screen size and requires space behind the screen. CRT projectors have long service life but are large, heavy, and use more power. LCD projectors display color images using polarized light through LCD panels but require more setup. LED projectors are becoming more popular due to less maintenance and longer life compared to conventional lamps.
K 5 workshop day2
This document discusses a training for elementary teachers on the transition to the Common Core State Standards. It includes objectives to share lessons, discuss text complexity, and focus on productive collaborative conversations. Teachers are asked to design a lesson incorporating reading and speaking/listening standards. Key aspects of the CCSS are reviewed like 21st century skills. The document provides information on text complexity, critical collaborative conversations, and examples of speaking and listening standards. Teachers are tasked with planning lessons using informational texts and incorporating speaking/listening standards.
Goldilocks
Goldilocks went for a walk in the forest and came upon the house of the three bears. She tried their porridge, chairs, and beds. The first of each were too extreme, but the third was just right. When the three bears returned home, they discovered someone had been eating their porridge, sitting in their chairs, and sleeping in their beds. They found Goldilocks asleep in Baby Bear's bed. Goldilocks woke up and ran away in fear upon seeing the three bears.
The Wright Insurance Group Informational Packet.
The document provides information on the various member companies of The Wright Insurance Group, which has been in operation for over 30 years. It includes summaries of Wright Specialty Insurance, Wright Flood, Wright Risk Consulting, Wright Program Management, Wright Risk Management, and their specialized insurance services for sectors like education, flood insurance, risk consulting, food industry insurance programs, and New York reciprocal insurance programs.
Genomineerden voetbalshirt van het jaar 2012
De mooiste voetbalshirts van 2012. De Voetbalshirt van het Jaar Verkiezing is dé publieksprijs die jaarlijks wordt uitgereikt aan het voetbalshirt dat qua design en kleurgebruik als mooiste van het jaar geldt. Zowel de tenues van nationale elftallen als van (inter)nationale clubteams komen voor de prijs in aanmerking.
www.voetbalshirtvanhetjaar.com
Viewers also liked (9)
สัญญาจ้างทั่วไปปรับปรุงบ้านพักนักเรียน และบ้านพักครู
สัญญาจ้างทั่วไปปรับปรุงบ้านพักนักเรียน และบ้านพักครู
Appropriate questions for evidence gathering
- 1. APPROPRIATE QUESTIONS FOR EVIDENCE GATHERING
- 2. QUESTION 1 When did the problem start?
- 3. QUESTION 2 How did this problem start?
- 4. QUESTION 3 Did it happen on its own?
- 5. QUESTION 4 What were you doing when it happened?
- 6. QUESTION 5 Did you get an error message?
- 7. QUESTION 6 What did the error say?
- 8. QUESTION 7 Has this or anything like this happened before?
- 9. QUESTION 8 Did you install any new software or hardware?
- 10. QUESTION 9 Was there a power outage recently?
- 11. QUESTION 10 Have you ran a virus scan recently?