The document discusses using machine learning to predict which vulnerabilities are most likely to receive exploits in the future. It describes collecting data on vulnerabilities from CVE databases and observations of exploits and breaches. This data is then used to build a supervised classification model to predict the likelihood of future exploits. The model aims to help prioritize remediation of vulnerabilities that pose the greatest risks. Key challenges addressed include the increasing volume of vulnerabilities and shortening windows between disclosure and exploits.
Vulnerability Prioritization and PredictionJonathan Cran
Delivered at Gartner SRM 2018 - Discusses original research from Kenna Security and the Cyentia Institute about which vulnerabilities are being targeted today, and what organizations can do to protect themselves. Presented with insight from Reid Shelton of CapitalOne.
Light, Dark and... a Sunburst... dissection of a very sophisticated attack.Stefano Maccaglia
The deck covers details about the Sunburst/Solorigate breach including some interesting threat intel paths we are currently evaluating to attribute the attack.
Outpost24 webinar - Mapping Vulnerabilities with the MITRE ATT&CK FrameworkOutpost24
In this webinar we’ll discuss how you can map CVE records with the MITRE ATT&CK framework to enhance vulnerability management process and achieve better risk management.
Still thinking your Ex(cel)? Here are some TIPs - SANS CTI Summit 2021Andreas Sfakianakis
During the past years, cyber threat intelligence (CTI) discipline has been adopted by organisations worldwide. While CTI’s best practices are still developing, finding the right technology to support your CTI analysts’ workflows and daily activities is hard. And advertising from vendors makes it even harder. This session will cut through the propaganda: providing a vendor-agnostic look at the process of selecting the right tools by providing a primer on the CTI cycle. Second, hear an overview of the current threat intelligence platform (TIP) landscape and explore the limitations that have been spotted by researchers and practitioners. Finally, learn tangible recommendations related to TIPs for different user groups.
Dr. Fengmin Gong, Co-Founder and Chief Strategy Officer, presents why an ecosystem-based approach is necessary to defend against modern malware threats. Discussion continues with what it takes to implement cybersecurity using this approach. He also presents a number of use cases where multi-vendor products interacting in a security ecosystem provide the most effective protection for enterprises.
Applied cognitive security complementing the security analyst Priyanka Aash
Security incidents are increasing dramatically and becoming more sophisticated, making it almost impossible for security analysts to keep up. A cognitive solution that can learn about security from structured and unstructured information sources is essential. It can be applied to empower security analysts with insights to qualify incidents and investigate risks quickly and accurately.
(Source : RSA Conference 2017)
Vulnerability Prioritization and PredictionJonathan Cran
Delivered at Gartner SRM 2018 - Discusses original research from Kenna Security and the Cyentia Institute about which vulnerabilities are being targeted today, and what organizations can do to protect themselves. Presented with insight from Reid Shelton of CapitalOne.
Light, Dark and... a Sunburst... dissection of a very sophisticated attack.Stefano Maccaglia
The deck covers details about the Sunburst/Solorigate breach including some interesting threat intel paths we are currently evaluating to attribute the attack.
Outpost24 webinar - Mapping Vulnerabilities with the MITRE ATT&CK FrameworkOutpost24
In this webinar we’ll discuss how you can map CVE records with the MITRE ATT&CK framework to enhance vulnerability management process and achieve better risk management.
Still thinking your Ex(cel)? Here are some TIPs - SANS CTI Summit 2021Andreas Sfakianakis
During the past years, cyber threat intelligence (CTI) discipline has been adopted by organisations worldwide. While CTI’s best practices are still developing, finding the right technology to support your CTI analysts’ workflows and daily activities is hard. And advertising from vendors makes it even harder. This session will cut through the propaganda: providing a vendor-agnostic look at the process of selecting the right tools by providing a primer on the CTI cycle. Second, hear an overview of the current threat intelligence platform (TIP) landscape and explore the limitations that have been spotted by researchers and practitioners. Finally, learn tangible recommendations related to TIPs for different user groups.
Dr. Fengmin Gong, Co-Founder and Chief Strategy Officer, presents why an ecosystem-based approach is necessary to defend against modern malware threats. Discussion continues with what it takes to implement cybersecurity using this approach. He also presents a number of use cases where multi-vendor products interacting in a security ecosystem provide the most effective protection for enterprises.
Applied cognitive security complementing the security analyst Priyanka Aash
Security incidents are increasing dramatically and becoming more sophisticated, making it almost impossible for security analysts to keep up. A cognitive solution that can learn about security from structured and unstructured information sources is essential. It can be applied to empower security analysts with insights to qualify incidents and investigate risks quickly and accurately.
(Source : RSA Conference 2017)
Applied machine learning defeating modern malicious documentsPriyanka Aash
A common tactic adopted by attackers for initial exploitation is the use of malicious code embedded in Microsoft Office documents. This attack vector is not new, but attackers are still having success. This session will dive into the details of these techniques, introduce some machine learning approaches to analyze and detect these attempts, and explore the output in Elasticsearch and Kibana.
(Source : RSA Conference USA 2017)
When dealing with over 300 hundred thousand of malware samples every day, we had to deploy the state-of-the-art techniques to combat cyberthreats. And among them - machine learning algorithms.
In this whitepaper, we start from describing the basic approaches and proceed to explaining the key applications of machine learning algorithms to automated malware detection. Learn more about how Kaspersky Lab protects businesses like yours => https://kas.pr/8dxv
Invincea fake british airways ticket spear-phish malware 03-21-2014Invincea, Inc.
Invincea detects and blocks a Zeus malware spear-phish disguised as a British Airways fake ticket receipt. Information security and endpoint protection benefits from Invincea.
Tech ThrowDown:Invincea FreeSpace vs EMET 5.0Invincea, Inc.
In this webinar, we will take a deep dive look at the protection capabilities offered by Microsoft EMET as an effective means of stopping exploits against the most commonly attacked endpoint applications today and compare against Invincea FreeSpace.
Machine learning cybersecurity boon or boondogglePriyanka Aash
Machine learning (ML) and artificial intelligence (AI) are the latest “shiny new things” in cybersecurity technology but while ML and AI hold great promise for automating routine processes and tasks and accelerating threat detection, they are not a panacea. This session will demonstrate what they can and can’t do in a cybersecurity program through real world examples of possibilities and limits.
(Source: RSA Conference USA 2017)
Machine learning is a powerful tool with many well-suited applications for malware detection, classification, and risk quantification. Despite its reputation as a "black box" component to an enterprise security solution, designing a robust machine learning model for malware detection is an involved process: its success hinges on understanding the problem you're trying to solve, the underlying data you utilize, and most importantly, its limitations.
In this Malware Most Wanted session, we analyze working models discuss the strengths, pitfalls, and high-level trade-offs of using machine learning for successful malware detection.
ARES focuses on the Sweet Spot of threat intelligence and continuous monitoring datasets, enabling you to identify and act on the most relevant and critical threats and findings at cyber speed
Advances in cloud scale machine learning for cyber-defensePriyanka Aash
Picking an attacker’s signals out of billions of log events in near real time from petabyte scale storage is a daunting task, but Microsoft has been using security data science at cloud scale to successfully disrupt attackers. This session will present the latest frameworks, techniques and the unconventional machine-learning algorithms that Microsoft uses to protect its infrastructure and customers.
(Source : RSA Conference USA 2017)
En la actualidad el crecimiento exponencial del malware sofisticado y los métodos de evasión utilizados por cibercriminales se han convertido en una combinación letal para las organizaciones. Los silos de información y la carencia de automatización entre ellos, convierte a las empresas en foco fácil de los atacantes. Hoy las empresas no solo buscan llenar el “check” de Compliance, sino realmente mitigar sus riesgos de seguridad de manera más eficiente y proactiva. Una seguridad conectada, a través de diferentes componentes tecnológicos mediante los cuales se “comparte” la información para tomar conciencia y reaccionar de manera inmediata hace la diferencia entre ser uno más de las estadísticas de incidentes de seguridad o no serlo.
Dirigido a: Jefes o Coordinadores de TI, Gerentes de Sistemas o TI, CIO, CISO, CTO
The Information Security Community on LinkedIn, with the support of Cybereason, conducted a comprehensive online research project to gain
more insight into the state of threat hunting in security
operation centers (SOCs). When the 330 cybersecurity and IT professionals were asked what keeps them up at night, many comments revolved around a central theme of undetected threats slipping through an organization’s defenses. Many
responses included “unknown” and “advanced” when
describing threats, indicating the respondents understand
the challenges and fear those emerging threats.
Read the full report here.
Want to detect threats in your organization? Stop reading every feed and curate your threat intel and content so they actually work for your security architecture. By managing meaningful threat intelligence so the external intel maps to internal threat models and curating your content sensibly, you can create a high-functioning SOC that both detects and defends against cyberattacks.
(Source: RSA Conference USA 2018)
Sharpening your Threat-Hunting Program with ATTACK FrameworkMITRE - ATT&CKcon
From MITRE ATT&CKcon Power Hour December 2020
By Hieu Tran, Threat Detection Team Lead FPT Cybersecurity Division
No matter how sophisticated and thorough your security precautions may be, you cannot assume your security measures are impenetrable. This is why you need a threat hunting program in place. But how can we implement a proper threat hunting program and run it efficiently? In this talk, we will uncover how to sharpen your threat hunting strategy by leveraging ATT&CK. Ultimately, we’ll be demonstrating how effectively employing the hunting methodology in the real-world battlefield, fighting against well-known cyber espionage actors who strongly focus on Southeast Asian countries like Vietnam, the Philippines, Laos, and Cambodia.
NIST Cybersecurity Framework is a good starting point for many enterprises to harden their security posture against advanced threats. In this webinar, we will share the major take-aways from the framework. More importantly, we will explain the 5 critical factors in implementing cybersecurity defense, and how to handle them with best practice.
Applied machine learning defeating modern malicious documentsPriyanka Aash
A common tactic adopted by attackers for initial exploitation is the use of malicious code embedded in Microsoft Office documents. This attack vector is not new, but attackers are still having success. This session will dive into the details of these techniques, introduce some machine learning approaches to analyze and detect these attempts, and explore the output in Elasticsearch and Kibana.
(Source : RSA Conference USA 2017)
When dealing with over 300 hundred thousand of malware samples every day, we had to deploy the state-of-the-art techniques to combat cyberthreats. And among them - machine learning algorithms.
In this whitepaper, we start from describing the basic approaches and proceed to explaining the key applications of machine learning algorithms to automated malware detection. Learn more about how Kaspersky Lab protects businesses like yours => https://kas.pr/8dxv
Invincea fake british airways ticket spear-phish malware 03-21-2014Invincea, Inc.
Invincea detects and blocks a Zeus malware spear-phish disguised as a British Airways fake ticket receipt. Information security and endpoint protection benefits from Invincea.
Tech ThrowDown:Invincea FreeSpace vs EMET 5.0Invincea, Inc.
In this webinar, we will take a deep dive look at the protection capabilities offered by Microsoft EMET as an effective means of stopping exploits against the most commonly attacked endpoint applications today and compare against Invincea FreeSpace.
Machine learning cybersecurity boon or boondogglePriyanka Aash
Machine learning (ML) and artificial intelligence (AI) are the latest “shiny new things” in cybersecurity technology but while ML and AI hold great promise for automating routine processes and tasks and accelerating threat detection, they are not a panacea. This session will demonstrate what they can and can’t do in a cybersecurity program through real world examples of possibilities and limits.
(Source: RSA Conference USA 2017)
Machine learning is a powerful tool with many well-suited applications for malware detection, classification, and risk quantification. Despite its reputation as a "black box" component to an enterprise security solution, designing a robust machine learning model for malware detection is an involved process: its success hinges on understanding the problem you're trying to solve, the underlying data you utilize, and most importantly, its limitations.
In this Malware Most Wanted session, we analyze working models discuss the strengths, pitfalls, and high-level trade-offs of using machine learning for successful malware detection.
ARES focuses on the Sweet Spot of threat intelligence and continuous monitoring datasets, enabling you to identify and act on the most relevant and critical threats and findings at cyber speed
Advances in cloud scale machine learning for cyber-defensePriyanka Aash
Picking an attacker’s signals out of billions of log events in near real time from petabyte scale storage is a daunting task, but Microsoft has been using security data science at cloud scale to successfully disrupt attackers. This session will present the latest frameworks, techniques and the unconventional machine-learning algorithms that Microsoft uses to protect its infrastructure and customers.
(Source : RSA Conference USA 2017)
En la actualidad el crecimiento exponencial del malware sofisticado y los métodos de evasión utilizados por cibercriminales se han convertido en una combinación letal para las organizaciones. Los silos de información y la carencia de automatización entre ellos, convierte a las empresas en foco fácil de los atacantes. Hoy las empresas no solo buscan llenar el “check” de Compliance, sino realmente mitigar sus riesgos de seguridad de manera más eficiente y proactiva. Una seguridad conectada, a través de diferentes componentes tecnológicos mediante los cuales se “comparte” la información para tomar conciencia y reaccionar de manera inmediata hace la diferencia entre ser uno más de las estadísticas de incidentes de seguridad o no serlo.
Dirigido a: Jefes o Coordinadores de TI, Gerentes de Sistemas o TI, CIO, CISO, CTO
The Information Security Community on LinkedIn, with the support of Cybereason, conducted a comprehensive online research project to gain
more insight into the state of threat hunting in security
operation centers (SOCs). When the 330 cybersecurity and IT professionals were asked what keeps them up at night, many comments revolved around a central theme of undetected threats slipping through an organization’s defenses. Many
responses included “unknown” and “advanced” when
describing threats, indicating the respondents understand
the challenges and fear those emerging threats.
Read the full report here.
Want to detect threats in your organization? Stop reading every feed and curate your threat intel and content so they actually work for your security architecture. By managing meaningful threat intelligence so the external intel maps to internal threat models and curating your content sensibly, you can create a high-functioning SOC that both detects and defends against cyberattacks.
(Source: RSA Conference USA 2018)
Sharpening your Threat-Hunting Program with ATTACK FrameworkMITRE - ATT&CKcon
From MITRE ATT&CKcon Power Hour December 2020
By Hieu Tran, Threat Detection Team Lead FPT Cybersecurity Division
No matter how sophisticated and thorough your security precautions may be, you cannot assume your security measures are impenetrable. This is why you need a threat hunting program in place. But how can we implement a proper threat hunting program and run it efficiently? In this talk, we will uncover how to sharpen your threat hunting strategy by leveraging ATT&CK. Ultimately, we’ll be demonstrating how effectively employing the hunting methodology in the real-world battlefield, fighting against well-known cyber espionage actors who strongly focus on Southeast Asian countries like Vietnam, the Philippines, Laos, and Cambodia.
NIST Cybersecurity Framework is a good starting point for many enterprises to harden their security posture against advanced threats. In this webinar, we will share the major take-aways from the framework. More importantly, we will explain the 5 critical factors in implementing cybersecurity defense, and how to handle them with best practice.
451 and Cylance - The Roadmap To Better Endpoint SecurityAdrian Sanabria
In recent years, endpoint security has evolved well beyond signature-based antivirus which proved unable to keep pace with the speed and volume of evolving threats. With the onslaught of new security technologies available, it can be difficult to determine where to begin. In this webinar, 451 Senior Analyst, Adrian Sanabria and Cylance Product Marketing Manager, Steve Salinas will discuss a proven approach to securing your endpoints.
Adrian and Steve will present the fundamental steps to securing endpoints:
• Step 1: A Better Malware Mousetrap
• Step 2: More Resilient Endpoints
• Step 3: Stopping Non-Malware Attacks
• Step 4: Full System Visibility with Endpoint Detection and Response
• Step 5: Dynamic Defense with User Behavior
• Step 6: Data Visibility
• Conclusion: Malware is Solved! What Now?
Endpoint security can be complex. Join us for this webinar to learn how applying a reasoned, results-based approach can help you can take control of your endpoints and silence attackers.
Become a skilled cyber security professional in Kerala with the comprehensive C|PENT course at Blitz Academy. Gain hands-on experience and training. Contact now!
https://blitzacademy.org/coursedetail.php?course_cat=9&course_id=2&Certified-Penetration-Testing-Professional-in-kerala
Four things that are almost guaranteed to reduce the reliability of a softwa...Ann Marie Neufelder
Distressed software projects typically have at least one of the 4 risks shown in the presentation. Avoiding these 4 things is the first step in ensuring software reliability.
Four things that are almost guaranteed to reduce the reliability of a softwa...Ann Marie Neufelder
This presentation shows the four things that have been quantitatively associated with distressed software intensive systems. Identifying these 4 things early in the system life cycle is essential for avoiding or mitigating a failed software project.
Web security – application security roads to software security nirvana iisf...Eoin Keary
Approaching Web Security, Secure application development and how to fix what matters. A useful talk for application developers and security experts alike.
GISEC 2015 Your Network in the Eyes of a Hacker - DTS SolutionShah Sheikh
Mohamed Bedewi, Offense Security Division Head and Sr. Penetration Testing Consultant at DTS presented also during one of the security sessions titled - "Your Network in the Eyes of a Hacker – The 0ff3ns!v3 Version" which raised a few eyebrows to say the least. The presentation slides can be found here….
Microsoft has announced the BlueKeep vulnerability, a wormable Remote Desktop vulnerability that has a high potential of being exploited in legacy operating systems.
Be warned, this vulnerability can be exploited remotely with no authentication required. Protect yourself from what people are calling the next WannaCry.
Outpost24 webinar - Cybersecurity readiness in the post Covid-19 worldOutpost24
The coronavirus pandemic has changed the way we work and how hackers target their victims. But when the lockdown and travel restrictions finally ease, your business needs to be ready to secure your workforce and IT operations in the ‘new normal’ for the long term.
The CIS Top 5 provide the building blocks of a solid security foundation and provide the essential cybersecurity hygiene all companies should have in place. Follow their recommendations and you’ll be able to prevent 85% of modern cyberattacks. But sometimes that’s easier said than done. Let Ivanti IT security expert Chris Goettl guide you through the CIS framework and share best practices for boosting your security defenses.
Exodus Intelligence provides the US and Canadian governments; our NATO allies; security vendors and commercial clients with in-depth vulnerability intelligence related to unknown (0-day) vulnerabilities and known (N-day) vulnerabilities (including where vendor’ patches are failing to properly fix vulnerabilities). Focusing on defensive cyber-weaponization, Exodus identifies HIGH-RISK TARGETS, focusing on the discovery, exploitation and mitigation of undocumented vulnerabilities and known vulnerabilities (N-day) within systems and software affecting high value assets (critical infrastructure/ business-critical data). Exodus works closely with its clients to structure the continuous delivery of high-value intelligence applicable to an organization's infrastructure & business.
Exodus Intelligence provides the US and Canadian governments; our NATO allies; security vendors and commercial clients with in-depth vulnerability intelligence related to unknown (0-day) vulnerabilities and known (N-day) vulnerabilities (including where vendor’ patches are failing to properly fix vulnerabilities). Focusing on defensive cyber-weaponization, Exodus identifies HIGH-RISK TARGETS, focusing on the discovery, exploitation and mitigation of undocumented vulnerabilities and known vulnerabilities (N-day) within systems and software affecting high value assets (critical infrastructure/ business-critical data). Exodus works closely with its clients to structure the continuous delivery of high-value intelligence applicable to an organization's infrastructure & business.
Unlocking Productivity: Leveraging the Potential of Copilot in Microsoft 365, a presentation by Christoforos Vlachos, Senior Solutions Manager – Modern Workplace, Uni Systems
Observability Concepts EVERY Developer Should Know -- DeveloperWeek Europe.pdfPaige Cruz
Monitoring and observability aren’t traditionally found in software curriculums and many of us cobble this knowledge together from whatever vendor or ecosystem we were first introduced to and whatever is a part of your current company’s observability stack.
While the dev and ops silo continues to crumble….many organizations still relegate monitoring & observability as the purview of ops, infra and SRE teams. This is a mistake - achieving a highly observable system requires collaboration up and down the stack.
I, a former op, would like to extend an invitation to all application developers to join the observability party will share these foundational concepts to build on:
Epistemic Interaction - tuning interfaces to provide information for AI supportAlan Dix
Paper presented at SYNERGY workshop at AVI 2024, Genoa, Italy. 3rd June 2024
https://alandix.com/academic/papers/synergy2024-epistemic/
As machine learning integrates deeper into human-computer interactions, the concept of epistemic interaction emerges, aiming to refine these interactions to enhance system adaptability. This approach encourages minor, intentional adjustments in user behaviour to enrich the data available for system learning. This paper introduces epistemic interaction within the context of human-system communication, illustrating how deliberate interaction design can improve system understanding and adaptation. Through concrete examples, we demonstrate the potential of epistemic interaction to significantly advance human-computer interaction by leveraging intuitive human communication strategies to inform system design and functionality, offering a novel pathway for enriching user-system engagements.
GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using Deplo...James Anderson
Effective Application Security in Software Delivery lifecycle using Deployment Firewall and DBOM
The modern software delivery process (or the CI/CD process) includes many tools, distributed teams, open-source code, and cloud platforms. Constant focus on speed to release software to market, along with the traditional slow and manual security checks has caused gaps in continuous security as an important piece in the software supply chain. Today organizations feel more susceptible to external and internal cyber threats due to the vast attack surface in their applications supply chain and the lack of end-to-end governance and risk management.
The software team must secure its software delivery process to avoid vulnerability and security breaches. This needs to be achieved with existing tool chains and without extensive rework of the delivery processes. This talk will present strategies and techniques for providing visibility into the true risk of the existing vulnerabilities, preventing the introduction of security issues in the software, resolving vulnerabilities in production environments quickly, and capturing the deployment bill of materials (DBOM).
Speakers:
Bob Boule
Robert Boule is a technology enthusiast with PASSION for technology and making things work along with a knack for helping others understand how things work. He comes with around 20 years of solution engineering experience in application security, software continuous delivery, and SaaS platforms. He is known for his dynamic presentations in CI/CD and application security integrated in software delivery lifecycle.
Gopinath Rebala
Gopinath Rebala is the CTO of OpsMx, where he has overall responsibility for the machine learning and data processing architectures for Secure Software Delivery. Gopi also has a strong connection with our customers, leading design and architecture for strategic implementations. Gopi is a frequent speaker and well-known leader in continuous delivery and integrating security into software delivery.
PHP Frameworks: I want to break free (IPC Berlin 2024)Ralf Eggert
In this presentation, we examine the challenges and limitations of relying too heavily on PHP frameworks in web development. We discuss the history of PHP and its frameworks to understand how this dependence has evolved. The focus will be on providing concrete tips and strategies to reduce reliance on these frameworks, based on real-world examples and practical considerations. The goal is to equip developers with the skills and knowledge to create more flexible and future-proof web applications. We'll explore the importance of maintaining autonomy in a rapidly changing tech landscape and how to make informed decisions in PHP development.
This talk is aimed at encouraging a more independent approach to using PHP frameworks, moving towards a more flexible and future-proof approach to PHP development.
Removing Uninteresting Bytes in Software FuzzingAftab Hussain
Imagine a world where software fuzzing, the process of mutating bytes in test seeds to uncover hidden and erroneous program behaviors, becomes faster and more effective. A lot depends on the initial seeds, which can significantly dictate the trajectory of a fuzzing campaign, particularly in terms of how long it takes to uncover interesting behaviour in your code. We introduce DIAR, a technique designed to speedup fuzzing campaigns by pinpointing and eliminating those uninteresting bytes in the seeds. Picture this: instead of wasting valuable resources on meaningless mutations in large, bloated seeds, DIAR removes the unnecessary bytes, streamlining the entire process.
In this work, we equipped AFL, a popular fuzzer, with DIAR and examined two critical Linux libraries -- Libxml's xmllint, a tool for parsing xml documents, and Binutil's readelf, an essential debugging and security analysis command-line tool used to display detailed information about ELF (Executable and Linkable Format). Our preliminary results show that AFL+DIAR does not only discover new paths more quickly but also achieves higher coverage overall. This work thus showcases how starting with lean and optimized seeds can lead to faster, more comprehensive fuzzing campaigns -- and DIAR helps you find such seeds.
- These are slides of the talk given at IEEE International Conference on Software Testing Verification and Validation Workshop, ICSTW 2022.
GridMate - End to end testing is a critical piece to ensure quality and avoid...ThomasParaiso2
End to end testing is a critical piece to ensure quality and avoid regressions. In this session, we share our journey building an E2E testing pipeline for GridMate components (LWC and Aura) using Cypress, JSForce, FakerJS…
Encryption in Microsoft 365 - ExpertsLive Netherlands 2024Albert Hoitingh
In this session I delve into the encryption technology used in Microsoft 365 and Microsoft Purview. Including the concepts of Customer Key and Double Key Encryption.
Elevating Tactical DDD Patterns Through Object CalisthenicsDorra BARTAGUIZ
After immersing yourself in the blue book and its red counterpart, attending DDD-focused conferences, and applying tactical patterns, you're left with a crucial question: How do I ensure my design is effective? Tactical patterns within Domain-Driven Design (DDD) serve as guiding principles for creating clear and manageable domain models. However, achieving success with these patterns requires additional guidance. Interestingly, we've observed that a set of constraints initially designed for training purposes remarkably aligns with effective pattern implementation, offering a more ‘mechanical’ approach. Let's explore together how Object Calisthenics can elevate the design of your tactical DDD patterns, offering concrete help for those venturing into DDD for the first time!
Transcript: Selling digital books in 2024: Insights from industry leaders - T...BookNet Canada
The publishing industry has been selling digital audiobooks and ebooks for over a decade and has found its groove. What’s changed? What has stayed the same? Where do we go from here? Join a group of leading sales peers from across the industry for a conversation about the lessons learned since the popularization of digital books, best practices, digital book supply chain management, and more.
Link to video recording: https://bnctechforum.ca/sessions/selling-digital-books-in-2024-insights-from-industry-leaders/
Presented by BookNet Canada on May 28, 2024, with support from the Department of Canadian Heritage.
Climate Impact of Software Testing at Nordic Testing DaysKari Kakkonen
My slides at Nordic Testing Days 6.6.2024
Climate impact / sustainability of software testing discussed on the talk. ICT and testing must carry their part of global responsibility to help with the climat warming. We can minimize the carbon footprint but we can also have a carbon handprint, a positive impact on the climate. Quality characteristics can be added with sustainability, and then measured continuously. Test environments can be used less, and in smaller scale and on demand. Test techniques can be used in optimizing or minimizing number of tests. Test automation can be used to speed up testing.
Securing your Kubernetes cluster_ a step-by-step guide to success !KatiaHIMEUR1
Today, after several years of existence, an extremely active community and an ultra-dynamic ecosystem, Kubernetes has established itself as the de facto standard in container orchestration. Thanks to a wide range of managed services, it has never been so easy to set up a ready-to-use Kubernetes cluster.
However, this ease of use means that the subject of security in Kubernetes is often left for later, or even neglected. This exposes companies to significant risks.
In this talk, I'll show you step-by-step how to secure your Kubernetes cluster for greater peace of mind and reliability.
Sudheer Mechineni, Head of Application Frameworks, Standard Chartered Bank
Discover how Standard Chartered Bank harnessed the power of Neo4j to transform complex data access challenges into a dynamic, scalable graph database solution. This keynote will cover their journey from initial adoption to deploying a fully automated, enterprise-grade causal cluster, highlighting key strategies for modelling organisational changes and ensuring robust disaster recovery. Learn how these innovations have not only enhanced Standard Chartered Bank’s data infrastructure but also positioned them as pioneers in the banking sector’s adoption of graph technology.
3. 3
Complete Remediation is Infeasible
Complexity Abound
Multiple patch releases from major vendors, including microcode updates
Incompatible Antivirus or Endpoint protection
Massive Array of Devices Affected
Affects Printers, Thermostats, Door Locks, Cameras, Phones, etc
Intel’s Nehalem and Westmere (released in 2008 and 2010) affected
Not Just Patches
Code “should be recompiled with the /Qspectre switch enabled”
4. 4
The Modern Stack is COMPLEX
Intel / ARM / AMD CPU
Hypervisor
Java
Management Agent
Docker
Operating System
.NET
Operating System (Container)
Node
3rd
party libs
Your App
Patch Me!
Idea Credit: @samnewman
Python Ruby PHP
App Server / Web Server / etc
9. 9
“Remember the Recall”
Infosec is largely a search problem:
1. We are data rich and signal poor.
2. Multi-stage testing cost-effectively increases
both precision and recall.
3. Analyst time is the capacity constraint for most
security problems
We must aim to create signal for our
analysts.
13. 13
What Matters for Scoring
Is anyone actively targeted?
Could we detect success?
How much effort is required?
What is the attacker payoff?
Does a valid attack path exist?
score = $CVSS_SCORE
score += A if
recent_breaches_exist?
SCORE += B if exploits_exist?
SCORE += C if popular_target?
SCORE += D if
exploit_will_exist?
16. 16
Measuring Remediation Strategies
Coverage: Of the vulns we
fixed, did we pick all (100%)
of the correct ones?
Efficiency: Of the ones we
ended up fixing, did fix any
that didn’t matter?
17. 17
Coverage & Efficiency, Explained
OURS
NEIGHBORS
ROBOT MOWED
Coverage =~ 80%
Efficiency =~ 60%
EFFICIENCY:
Out of all the grass mowed, how
much of the grass should have
been cut
COVERAGE:
How much of the grass we
wanted to cut was actually cut?
wasted
effort
(inefficiency
)
not covered
18. 18
Coverage & Efficiency In Practice
CVES with
known
exploits or
events
CVEs with no known
exploit or event
Coverage
How many vulnerabilities
did we prioritize of those
that ended up with a known
exploit or event
Efficiency (green in the red
area green + blue) =~ 9.28%
Of all the vulnerabilities we
prioritized, how many ended
up with a kown exploit or
event
19. 19
Coverage & Efficiency In Practice
CVES with
known
exploits or
events
CVEs with no known
exploit or event
Total Prioritized CVEs
All CVEs
Vulnerabilities
prioritized
with known
exploits or
events
CVEs prioritized with no
known exploits or events
Coverage (green / red)
How many vulnerabilities
did we prioritize of those
that ended up with a known
exploit or event
Efficiency (green / green +
blue)
Of all the vulnerabilities we
prioritized, how many ended
up with a known exploit or
event
20. 20
Coverage / Efficiency Tradeoff
● There exists a natural tradeoff between coverage and
efficiency.
● We are operating with incomplete information at any given
moment.
● Why would you want <100% efficiency?
○ Abundance of caution (if you can afford it!)
● Why would you want <100% coverage?
○ New campaign can spin up or an older one can spin down. The
world is not static.
Continuous review and adjustment provides the best result.
22. 22
Current Attacker Velocity
Average Days from Publish to Exploit
(639 / 8%): 19.68 Days
Average Days from Publish to Event
(36 / 0.5%): 27.36 Days
Shortest Window: Adobe Reader (zero
days)
Longest Window: IE Edge (months)
24. Increasing Risk
Factoring in Velocity
Created Discovery Disclosure Public
Exploit
Code
Released
Exploitation
Detected In
the Wild
Detection
Generate
d
32. 32
What IS Machine Learning?
• Methods for automatically learning and recognizing
complex patterns from data
• A set of tools for understanding data by buildings
models from data
• measure success on coverage and efficiency
33. 33
Type of Algorithms
Do you have
labeled data?
Supervised Unsupervised
What do you
want to predict?
Classification Regression
Category
NoYes
Quantity
34. 34
We are current really good at:
• “Of my current 300 million vulnerabilities, which
ones should I remediate first?”
• “Old ones with stable, weaponized exploits, known
breaches, high risk meter scores”
36. 36
Asking the right questions:
• Classification: output is qualitative
• prediction:
“Will this vulnerability have an exploit
written for it?”
(== cause more risk later)
38. 38
Predictive - The Expectations
Distribution is not uniform. 77% of dataset is not exploited
1. Accuracy of 77% would be bad
Precision matters more than Recall
1. No one would use this model absent actual exploit available data.
2. False Negatives matter less than false positives - wasted effort.
We are not modeling when something will be exploited, just IF
1. Could be tomorrow or in 6 months. Re-run the model every day.
39. 39
Measuring performance of a
predictive model
The ideal1
10
Precision
Recall
Returns relevant
documents buy misses
many useful ones too
Returns most relevant
documents but
includes lots of junk
45. 45
The Work Averse Attacker
“An attacker massively deploys only one exploit per software
version. The only exception we find is for Internet Explorer; the
exception is characterised by a very low cost to create an
additional exploit, where it is sufficient to essentially copy and
paste code from the old exploit, with only few modifications, to
obtain the new one.”
-The Work-Averse Cyber Attacker Model: Theory and Evidence From Two Million Attack Signatures by
Luca Allodi, Fabio Massacci, Julian Williams
50. 50
Constraints on the Future
Any new rating system must be:
● Simple (in every sense of the word)
● Explainable (cause and effect understandable)
● Defensible (science!)
● an Improvement
And every data source is on the table...
53. 53
Lesson: Probability is our friend
confusing
^
78% of vulns are < 1%
● While initially confusing, probability offers a very intuitive measure
● Most vulnerabilities are predicted to have < 1% probability of exploitation
2,400+ vulnerabilities are predicted > 10%
● How can we validate probabilistic estimates?
54. 54
Lesson: Probability is our friend
confusing
^
~450 vulnerabilities
(what we say)
(what we see)
Dashed line is
“calibrated”
56. 56
Takeaways
Volume, complexity and speed of both vulnerabilities and threats are
modern vulnerability management challenges
Coverage and efficiency allow us to measure vuln management strategies
For all the new vulnerabilities you’ve seen this week… is it truly critical? Will
it be attacked in the future?
Future threats should be addressed, but only after immediate / existing
threats