- The document discusses a major hack that showed existing security tools and next-generation tools have limitations and can be bypassed. It notes how easily malware can detect sandboxes and analyzes new attack surfaces like the Internet of Things. It advocates for building defenses in key "hot zones" like endpoints, networks, data in transit, and cloud infrastructure. It provides best practices around gaining situational awareness, operational excellence, and deploying appropriate countermeasures. The overall message is that security must be a strategic priority requiring budget, skills, vigilance and alliance between security and IT teams.
Keynote on why you should make Infosec a board level strategic item, how you should raise it to this level and how to approach Information Security strategically
Common WebApp Vulnerabilities and What to Do About ThemEoin Woods
With more and more services becoming internet-facing, web application security is now a problem for most of us. In response to this, the OWASP security community have been working for years to catalogue, understand and prioritise common web application vulnerabilities, published as the “OWASP Top 10 List”.
In this session, Eoin will review the OWASP Top 10 list to understand the vulnerabilities and dig into the implementation details of some of the more important of them to identify practical mitigations for them in our own applications.
Share 2015 - 5 Myths that can put your Mainframe at risk (v1.3)Rui Miguel Feio
5 ‘myths’ that can put the future of the mainframe at risk. How can the mainframe survive after 50 years of existence? How bright is the future? How secure is the mainframe?
Keynote on why you should make Infosec a board level strategic item, how you should raise it to this level and how to approach Information Security strategically
Common WebApp Vulnerabilities and What to Do About ThemEoin Woods
With more and more services becoming internet-facing, web application security is now a problem for most of us. In response to this, the OWASP security community have been working for years to catalogue, understand and prioritise common web application vulnerabilities, published as the “OWASP Top 10 List”.
In this session, Eoin will review the OWASP Top 10 list to understand the vulnerabilities and dig into the implementation details of some of the more important of them to identify practical mitigations for them in our own applications.
Share 2015 - 5 Myths that can put your Mainframe at risk (v1.3)Rui Miguel Feio
5 ‘myths’ that can put the future of the mainframe at risk. How can the mainframe survive after 50 years of existence? How bright is the future? How secure is the mainframe?
How to Protect Your Mainframe from Hackers (v1.0)Rui Miguel Feio
This presentation addresses the requirements to protect the mainframe system from hackers. Common problems that need to be addressed, risks and mentalities that need to adapt to the new security realities.
Security is now important to all of us, not just people who work at Facebook. Most developers think about security in terms of security technologies that they want to apply to their systems, and then ask how secure the system is. From a secure systems perspective, this is the wrong way around. To build a secure system, you need to start from the things that need to be protected and the threats to those resources.
In this session, Eoin dives into the fundamentals of system security to introduce the topics we need to understand in order to decide how to secure our systems.
In a digital age of cloud computing and mobile systems; where cyber security, cyber crime and cyber war are part of the day-to-day vocabulary, how secure is the mainframe? Is it safe to assume that the mainframe is secure by default? Can we ignore the fact that the mainframe is just another platform in the great scheme of things? How vital is the mainframe and the data that it stores for you and your company?
(2019) Hack All the Way Through From Fridge to Mainframe (v0.2)Rui Miguel Feio
Have you ever thought the perils of smart home devices? In this presentation we discuss the Internet of Things (IoT) and the concept of Bring Your Own Device (BYOD) and the security challenges and risks they can be to companies, systems, and ultimately to the mainframe.
#MCN2014 - Risk Management, Security, and Getting Things Done: Creating Win-W...Jane Alexander
Jane Alexander,CIO,Cleveland Museum of Art
Brian Dawson, CDO, Canada Science and Technology Museums Corporation
Yvel Guelce, Director of Infrastructure Technology
Children's Museum of Indianapolis
IT staff are often seen as the "Bad Guys," naysayers to anything new and exciting, in the quest to protect the organization from security breaches. In this session, four museum IT leaders will show how common struggles in security can be turned around to develop positive partnerships with other departments for pro-active risk management.
Ranging from simple to complex, the issues each museum faces transcends cost and institution size. The presenters work at wildly diverse organizations but face surprisingly similar issues. Among the topics they will address are how federal policy requirements and PCI compliance affect their organizations, finding budget-conscious ways to meet the rules, encouraging safe practices by end users, using IT risk management to assist senior staff in making informed decisions, and educating employees at all levels. Attention will be given to the everyday struggles common to all IT professionals--for example, changing passwords, Bring Your Own Device, and securely managing information in the cloud. The discussion will then open up to a roundtable format for sharing of successes and frustrations, questions, and comments.
Even In 2014, Attackers are on steroid on Cloud, since the IT spending on Web...Sreejesh Madonandy
Though it is changing for good, IT spending on Web/Cloud security is minuscule. Traditional appliance focused security is not helping the business which is on Internet Cloud
IT Security Spending decisions must be based based on the Adaptive mechanisms that review threat landscape periodically.
API Vulnerabilties and What to Do About ThemEoin Woods
In this talk we will review the current security landscape, particularly as it relates to API-based applications, and explore the OWASP API Security Top 10 vulnerabilities in order to understand the top security threats to our APIs, which ones we might have missed in our systems, and what practical mitigations we can use to address them when we get back to work.
Cloud, DevOps and the New Security PractitionerAdrian Sanabria
First presented at Cloud Security World in Boston on June 15th, 2016.
Once upon a time, walls were erected between the Linux/UNIX crowd, Windows admins and the mainframers. Each architecture had its place and its experts, and they rarely mixed. This time around, we didn’t just get a new domain, we got a new way of doing IT and running businesses. Cloud has created new opportunities and DevOps has capitalized on them. The result of this combination is so unrecognizable that it isn’t uncommon to see IT organizations split down the middle by the new and old approaches. As DevOps continues to gain in popularity, the same split is occurring in the security workforce. Will the traditional security practitioner be in danger of becoming obsolete?
Incident Response in the age of Nation State Cyber AttacksResilient Systems
One of the most important and yet least discussed aspects of any corporate structure is the incident response framework. As recent events have highlighted, the risk of intellectual property and critical infrastructure being the target of a cyber-attack is quite real. More than ever before, corporate preparation and response plans are necessary for any entity operating in the digital age.
This webinar will examine how an organization's incident response framework can help limit the exposure of intellectual property and critical infrastructure to outside, malicious parties. Our presenters will review how to construct corporate response plans that yield best-of-breed preparedness.
Our featured speakers for this timely webinar are:
-Mike Gibbons, Managing Director, Alvarez and Marsal, former FBI Special Agent as Unit Chief, overseeing all cyber crime investigations
-Art Ehuan, Managing Director, Alvarez and Marsal, former FBI Supervisory Special Agent assigned to the Computer Crimes Investigations Program
-Gant Redmon, Esq. CIPP/US General Counsel and Vice President of Business Development at Co3
Mainframe Security - It's not just about your ESM v2.2Rui Miguel Feio
In this session we will be taking a look at some of the other security controls available to help us protect our mainframe systems. Don’t be fooled by the non-mainframe folk who say the mainframe is fine, because it's behind a firewall.
We will discuss and encourage debate around a number of non ESM related security controls that should/must be used to protect our mainframe systems.
Nothing strikes fear into the heart of an engineer more than the installation of a firewall to achieve the laudable goal of defense-in-depth through network segmentation. Security teams demand the implementation of firewalls telling everyone, “It’s for compliance!” But the addition of firewalls and other security appliances (aka chokepoints) into an infrastructure infuriates network engineers who design to optimize speed and minimize latency. Sysadmins and DBAs are equally frustrated, because of the increased complexity in building and troubleshooting applications. So it’s down the rabbit hole we go trying to achieve the unachievable with everyone waxing rhapsodic for those bygone days when the end-to-end principle ruled the Internet. Is it really possible to have security coexist with operational efficiency? Organizations seem happy to throw money at technology and operations, but when it comes to policies and procedures, they fail miserably. This is the biggest problem with building a layered design. As engineers, if we don’t have clear policies as a set of requirements, how will we determine the appropriate network segmentation and protections to put in place? The answer lies in aligning network segmentation with an organizational data classification matrix and understanding that while compliance and security often overlap, they’re not the same.
Corona| COVID IT Tactical Security Preparedness: Threat ManagementRedZone Technologies
Work from Home - Practical Advice on Operations and Security Impact and what to do about it.
DR and BCP Planning Ideas
Widening Attack Surface Solutions
Managing Threats Solutions
How to Protect Your Mainframe from Hackers (v1.0)Rui Miguel Feio
This presentation addresses the requirements to protect the mainframe system from hackers. Common problems that need to be addressed, risks and mentalities that need to adapt to the new security realities.
Security is now important to all of us, not just people who work at Facebook. Most developers think about security in terms of security technologies that they want to apply to their systems, and then ask how secure the system is. From a secure systems perspective, this is the wrong way around. To build a secure system, you need to start from the things that need to be protected and the threats to those resources.
In this session, Eoin dives into the fundamentals of system security to introduce the topics we need to understand in order to decide how to secure our systems.
In a digital age of cloud computing and mobile systems; where cyber security, cyber crime and cyber war are part of the day-to-day vocabulary, how secure is the mainframe? Is it safe to assume that the mainframe is secure by default? Can we ignore the fact that the mainframe is just another platform in the great scheme of things? How vital is the mainframe and the data that it stores for you and your company?
(2019) Hack All the Way Through From Fridge to Mainframe (v0.2)Rui Miguel Feio
Have you ever thought the perils of smart home devices? In this presentation we discuss the Internet of Things (IoT) and the concept of Bring Your Own Device (BYOD) and the security challenges and risks they can be to companies, systems, and ultimately to the mainframe.
#MCN2014 - Risk Management, Security, and Getting Things Done: Creating Win-W...Jane Alexander
Jane Alexander,CIO,Cleveland Museum of Art
Brian Dawson, CDO, Canada Science and Technology Museums Corporation
Yvel Guelce, Director of Infrastructure Technology
Children's Museum of Indianapolis
IT staff are often seen as the "Bad Guys," naysayers to anything new and exciting, in the quest to protect the organization from security breaches. In this session, four museum IT leaders will show how common struggles in security can be turned around to develop positive partnerships with other departments for pro-active risk management.
Ranging from simple to complex, the issues each museum faces transcends cost and institution size. The presenters work at wildly diverse organizations but face surprisingly similar issues. Among the topics they will address are how federal policy requirements and PCI compliance affect their organizations, finding budget-conscious ways to meet the rules, encouraging safe practices by end users, using IT risk management to assist senior staff in making informed decisions, and educating employees at all levels. Attention will be given to the everyday struggles common to all IT professionals--for example, changing passwords, Bring Your Own Device, and securely managing information in the cloud. The discussion will then open up to a roundtable format for sharing of successes and frustrations, questions, and comments.
Even In 2014, Attackers are on steroid on Cloud, since the IT spending on Web...Sreejesh Madonandy
Though it is changing for good, IT spending on Web/Cloud security is minuscule. Traditional appliance focused security is not helping the business which is on Internet Cloud
IT Security Spending decisions must be based based on the Adaptive mechanisms that review threat landscape periodically.
API Vulnerabilties and What to Do About ThemEoin Woods
In this talk we will review the current security landscape, particularly as it relates to API-based applications, and explore the OWASP API Security Top 10 vulnerabilities in order to understand the top security threats to our APIs, which ones we might have missed in our systems, and what practical mitigations we can use to address them when we get back to work.
Cloud, DevOps and the New Security PractitionerAdrian Sanabria
First presented at Cloud Security World in Boston on June 15th, 2016.
Once upon a time, walls were erected between the Linux/UNIX crowd, Windows admins and the mainframers. Each architecture had its place and its experts, and they rarely mixed. This time around, we didn’t just get a new domain, we got a new way of doing IT and running businesses. Cloud has created new opportunities and DevOps has capitalized on them. The result of this combination is so unrecognizable that it isn’t uncommon to see IT organizations split down the middle by the new and old approaches. As DevOps continues to gain in popularity, the same split is occurring in the security workforce. Will the traditional security practitioner be in danger of becoming obsolete?
Incident Response in the age of Nation State Cyber AttacksResilient Systems
One of the most important and yet least discussed aspects of any corporate structure is the incident response framework. As recent events have highlighted, the risk of intellectual property and critical infrastructure being the target of a cyber-attack is quite real. More than ever before, corporate preparation and response plans are necessary for any entity operating in the digital age.
This webinar will examine how an organization's incident response framework can help limit the exposure of intellectual property and critical infrastructure to outside, malicious parties. Our presenters will review how to construct corporate response plans that yield best-of-breed preparedness.
Our featured speakers for this timely webinar are:
-Mike Gibbons, Managing Director, Alvarez and Marsal, former FBI Special Agent as Unit Chief, overseeing all cyber crime investigations
-Art Ehuan, Managing Director, Alvarez and Marsal, former FBI Supervisory Special Agent assigned to the Computer Crimes Investigations Program
-Gant Redmon, Esq. CIPP/US General Counsel and Vice President of Business Development at Co3
Mainframe Security - It's not just about your ESM v2.2Rui Miguel Feio
In this session we will be taking a look at some of the other security controls available to help us protect our mainframe systems. Don’t be fooled by the non-mainframe folk who say the mainframe is fine, because it's behind a firewall.
We will discuss and encourage debate around a number of non ESM related security controls that should/must be used to protect our mainframe systems.
Nothing strikes fear into the heart of an engineer more than the installation of a firewall to achieve the laudable goal of defense-in-depth through network segmentation. Security teams demand the implementation of firewalls telling everyone, “It’s for compliance!” But the addition of firewalls and other security appliances (aka chokepoints) into an infrastructure infuriates network engineers who design to optimize speed and minimize latency. Sysadmins and DBAs are equally frustrated, because of the increased complexity in building and troubleshooting applications. So it’s down the rabbit hole we go trying to achieve the unachievable with everyone waxing rhapsodic for those bygone days when the end-to-end principle ruled the Internet. Is it really possible to have security coexist with operational efficiency? Organizations seem happy to throw money at technology and operations, but when it comes to policies and procedures, they fail miserably. This is the biggest problem with building a layered design. As engineers, if we don’t have clear policies as a set of requirements, how will we determine the appropriate network segmentation and protections to put in place? The answer lies in aligning network segmentation with an organizational data classification matrix and understanding that while compliance and security often overlap, they’re not the same.
Corona| COVID IT Tactical Security Preparedness: Threat ManagementRedZone Technologies
Work from Home - Practical Advice on Operations and Security Impact and what to do about it.
DR and BCP Planning Ideas
Widening Attack Surface Solutions
Managing Threats Solutions
Open Secrets of the Defense Industry: Building Your Own Intelligence Program ...Sean Whalen
Respond proactively to threats like a defense contractor. It’s more realistic than you might think!
A practical guide of how to build intelligence-driven cyber defenses using open source software, based on real implementations of best practices, adapted from the Lockheed Martin Cyber Kill Chain model.
Even though large breaches have hit headline news in years past, some companies are still on the fence about investing in cybersecurity. As a security practitioner (or jack of all trades) how can you be expected to cover your assets with zero budget? Thankfully, there are plenty of open-source tools out there that will allow you to secure your organization. Come join me as I discuss how you can track your network assets, perform vulnerability assessments, prevent attacks with intrusion prevention systems, and even deploy HIDS. We will also jump into finding sensitive data and PII in your network, as well as incident response tools and automation. All it costs is your time (and maybe a VM or two). You really can drastically improve the security posture of your network with little to no budget, and you’ll have fun doing it! OK, maybe it won’t be fun, but at least you’ll learn something, right?
Though the potential of the IoT is vast, adoption can easily be curtailed by security worries. No company wants their products to be a victim of a hack, yet many do not appear to consider security as a primary driver of design decisions. This presentation will look at IoT security and describe what product designers – regardless of platform – need to be aware of if they want to build a secure and successful device.
IoT security encompasses requirements that are new for many product designers – such as provisioning, authentication, OTA upgrades and link encryption – and weaknesses in any one could potentially be used to compromise the security of the end product. From physical attacks to analysis of communications channels, there are many possible attack vectors that need to be considered.
From hacked routers to refrigerators sending spam email, there have been a lot of scary news stories about Internet of Things (IoT) security, or lack of it. According to the 2014 Hewlett-Packard Internet of Things Research Study, 70% of Internet connected devices they surveyed didn’t even use encrypted network connections. The US Federal Trade Commission (FTC) recently weighed in on the issue too, releasing a report that outlines potential IoT security risks, ranging from unauthorized access and misuse of personal information, to facilitation of attacks on other systems and risks to personal safety.
Beware the Firewall My Son: The Jaws That Bite, The Claws That Catch!Michele Chubirka
Nothing strikes fear into the heart of an engineer more than the installation of a firewall to achieve the laudable goal of defense-in-depth through network segmentation. Security teams demand the implementation of firewalls telling everyone, “It’s for compliance!” But the addition of firewalls and other security appliances (aka chokepoints) into an infrastructure infuriates network engineers who design to optimize speed and minimize latency. Sysadmins and DBAs are equally frustrated, because of the increased complexity in building and troubleshooting applications. So it’s down the rabbit hole we go trying to achieve the unachievable with everyone waxing rhapsodic for those bygone days when the end-to-end principle ruled the Internet. Is it really possible to have security coexist with operational efficiency? Organizations seem happy to throw money at technology and operations, but when it comes to policies and procedures, they fail miserably. This is the biggest problem with building a layered design. As engineers, if we don’t have clear policies as a set of requirements, how will we determine the appropriate network segmentation and protections to put in place? The answer lies in aligning network segmentation with an organizational data classification matrix and understanding that while compliance and security often overlap, they’re not the same.
Big Bang Theory: The Evolution of Pentesting High Security EnvironmentsChris Gates
This presentation focuses on pentesting high security environments, new ways of identifying/bypassing common security mechanisms, owning the domain, staying persistent, and ex-filtrating critical data from the network without being detected. The term Advanced Persistent Threat (APT) has caused quite a stir in the IT Security field, but few pentesters actually utilize APT techniques and tactics in their pentests.
The Challenge of Integrating Security Solutions with CI.pdfSavinder Puri
Informational article which will discuss the issues with code signing solutions as they relate to ci/cd workflows (including DIY and HSM solutions).
Targeted Persona: mostly technical decision makers and operational champions (devops/devsecops).
We are all aware of the current risks when developing a connected product, especially with vehicles since much is at stake both from an information and safety perspective. In this workshop, we will learn how to build Security requirements, architect, design, test and produce Safety and Security critical components using a methodology that works in harmony both with Engineering and Security
When you work with a lot of companies scrutinizing their security, you get to see some amazing things. One of the joys of being a commercial security consultant working for big name firms, is that you get to see a lot of innovation and interesting approaches to common problems.
However, as great as this is, the discrete projects you work on are usually a small representation of the overall company. When you look at the company in its entirety, a familiar pattern of weakness begins to reveal itself. While some companies are obviously better than others, the majority of companies are actually weak in remarkably similar ways.
My work in the attacker modeled pentest and enterprise risk assessment realms focuses on looking at a company as a whole. The premise is that, this is what an attacker would do. They won’t just try to attack your quarterly code reviewed main web site, or consumer mobile app. They won’t directly attack your PCI relevant systems to get to customer credit card data. They won’t limit their attacks to those purely against your IT infrastructure. Instead – they’ll look at your entire company, and they will play dirty.
In this session, I’ll focus on the things that plague us all (well most of us), and I’ll offer some simple advice for how to try and tackle each of these areas:
– Weaknesses in Physical Security
– Susceptibility to Phishing
– Vulnerability Management Immaturity
– Weaknesses in Authentication
– Poor Network Segmentation
– Loose Data Access Control
– Terrible Host / Network Visibility
– Unwise Procurement & Security Spending Decisions
A question of trust - understanding Open Source risksTim Mackey
As presented at the Bay Area Cyber Security Meetup on January 25th, 2018.
Open source development paradigms have become the norm for most software development. This is regardless of whether you're making the next great IoT device, a new container microservice, or desktop application. While open source components are often viewed as free, and definately help solve problems in a scalable way, using them in a secure manner requires an understanding of how open source development really works.
In this sesssion, I covered how secure development practices with data center regulations can benefit from an understanding of open source development. Specifically, we looked at fork management, community engagement and patch management. We ended with an open source maturity model.
Big Bang Theory: The Evolution of Pentesting High Security EnvironmentsJoe McCray
This presentation focuses on pentesting high security environments, new ways of identifying/bypassing common security mechanisms, owning the domain, staying persistent, and ex-filtrating critical data from the network without being detected. The term Advanced Persistent Threat (APT) has caused quite a stir in the IT Security field, but few pentesters actually utilize APT techniques and tactics in their pentests.
TRITON: How it Disrupted Safety Systems and Changed the Threat Landscape of I...Priyanka Aash
In 2017, a sophisticated threat actor deployed the TRITON attack framework engineered to manipulate industrial safety systems at a critical infrastructure facility. This talk offers new insights into TRITON attack framework which became an unprecedented milestone in the history of cyber-warfare as it is the first publicly observed malware that specifically targets protection functions meant to safeguard human lives. While the attack was discovered before its ultimate goal was achieved, that is, disruption of the physical process, TRITON is a wakeup call regarding the need to urgently improve ICS cybersecurity.
We are delighted to have Gary Miliefsky on our second Hacker Hotshot of 2013! Gary is the Editor of Cyber Defense Magazine, which he recently founded after years of being a cover story author and regular contributor to Hakin9 Magazine. In partnership with UMASS, he started the Cyber Defense Test Labs to perform independent lab reviews of next generation information security products. Gary is also the founder of NetClarity, Inc., which is the world's first next generation agentless, non-inline network access control (NAC) and bring your own device (BYOD) management appliances vendor based on a patented technology which he invented.
Similar to Keynote at the Cyber Security Summit Prague 2015 (20)
Css 2013 claushoumann Building comprehensively for IT SecurityClaus Cramon Houmann
This is my presentation on how to build an as secure as can be IT % IT security department - the "difficulty level" is novice so if you're already an expert, this probably will not help you much. I presented this at the 2013 Cyber Security summit in Prague
Software Delivery At the Speed of AI: Inflectra Invests In AI-Powered QualityInflectra
In this insightful webinar, Inflectra explores how artificial intelligence (AI) is transforming software development and testing. Discover how AI-powered tools are revolutionizing every stage of the software development lifecycle (SDLC), from design and prototyping to testing, deployment, and monitoring.
Learn about:
• The Future of Testing: How AI is shifting testing towards verification, analysis, and higher-level skills, while reducing repetitive tasks.
• Test Automation: How AI-powered test case generation, optimization, and self-healing tests are making testing more efficient and effective.
• Visual Testing: Explore the emerging capabilities of AI in visual testing and how it's set to revolutionize UI verification.
• Inflectra's AI Solutions: See demonstrations of Inflectra's cutting-edge AI tools like the ChatGPT plugin and Azure Open AI platform, designed to streamline your testing process.
Whether you're a developer, tester, or QA professional, this webinar will give you valuable insights into how AI is shaping the future of software delivery.
Transcript: Selling digital books in 2024: Insights from industry leaders - T...BookNet Canada
The publishing industry has been selling digital audiobooks and ebooks for over a decade and has found its groove. What’s changed? What has stayed the same? Where do we go from here? Join a group of leading sales peers from across the industry for a conversation about the lessons learned since the popularization of digital books, best practices, digital book supply chain management, and more.
Link to video recording: https://bnctechforum.ca/sessions/selling-digital-books-in-2024-insights-from-industry-leaders/
Presented by BookNet Canada on May 28, 2024, with support from the Department of Canadian Heritage.
Key Trends Shaping the Future of Infrastructure.pdfCheryl Hung
Keynote at DIGIT West Expo, Glasgow on 29 May 2024.
Cheryl Hung, ochery.com
Sr Director, Infrastructure Ecosystem, Arm.
The key trends across hardware, cloud and open-source; exploring how these areas are likely to mature and develop over the short and long-term, and then considering how organisations can position themselves to adapt and thrive.
Neuro-symbolic is not enough, we need neuro-*semantic*Frank van Harmelen
Neuro-symbolic (NeSy) AI is on the rise. However, simply machine learning on just any symbolic structure is not sufficient to really harvest the gains of NeSy. These will only be gained when the symbolic structures have an actual semantics. I give an operational definition of semantics as “predictable inference”.
All of this illustrated with link prediction over knowledge graphs, but the argument is general.
Search and Society: Reimagining Information Access for Radical FuturesBhaskar Mitra
The field of Information retrieval (IR) is currently undergoing a transformative shift, at least partly due to the emerging applications of generative AI to information access. In this talk, we will deliberate on the sociotechnical implications of generative AI for information access. We will argue that there is both a critical necessity and an exciting opportunity for the IR community to re-center our research agendas on societal needs while dismantling the artificial separation between the work on fairness, accountability, transparency, and ethics in IR and the rest of IR research. Instead of adopting a reactionary strategy of trying to mitigate potential social harms from emerging technologies, the community should aim to proactively set the research agenda for the kinds of systems we should build inspired by diverse explicitly stated sociotechnical imaginaries. The sociotechnical imaginaries that underpin the design and development of information access technologies needs to be explicitly articulated, and we need to develop theories of change in context of these diverse perspectives. Our guiding future imaginaries must be informed by other academic fields, such as democratic theory and critical theory, and should be co-developed with social science scholars, legal scholars, civil rights and social justice activists, and artists, among others.
State of ICS and IoT Cyber Threat Landscape Report 2024 previewPrayukth K V
The IoT and OT threat landscape report has been prepared by the Threat Research Team at Sectrio using data from Sectrio, cyber threat intelligence farming facilities spread across over 85 cities around the world. In addition, Sectrio also runs AI-based advanced threat and payload engagement facilities that serve as sinks to attract and engage sophisticated threat actors, and newer malware including new variants and latent threats that are at an earlier stage of development.
The latest edition of the OT/ICS and IoT security Threat Landscape Report 2024 also covers:
State of global ICS asset and network exposure
Sectoral targets and attacks as well as the cost of ransom
Global APT activity, AI usage, actor and tactic profiles, and implications
Rise in volumes of AI-powered cyberattacks
Major cyber events in 2024
Malware and malicious payload trends
Cyberattack types and targets
Vulnerability exploit attempts on CVEs
Attacks on counties – USA
Expansion of bot farms – how, where, and why
In-depth analysis of the cyber threat landscape across North America, South America, Europe, APAC, and the Middle East
Why are attacks on smart factories rising?
Cyber risk predictions
Axis of attacks – Europe
Systemic attacks in the Middle East
Download the full report from here:
https://sectrio.com/resources/ot-threat-landscape-reports/sectrio-releases-ot-ics-and-iot-security-threat-landscape-report-2024/
GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using Deplo...James Anderson
Effective Application Security in Software Delivery lifecycle using Deployment Firewall and DBOM
The modern software delivery process (or the CI/CD process) includes many tools, distributed teams, open-source code, and cloud platforms. Constant focus on speed to release software to market, along with the traditional slow and manual security checks has caused gaps in continuous security as an important piece in the software supply chain. Today organizations feel more susceptible to external and internal cyber threats due to the vast attack surface in their applications supply chain and the lack of end-to-end governance and risk management.
The software team must secure its software delivery process to avoid vulnerability and security breaches. This needs to be achieved with existing tool chains and without extensive rework of the delivery processes. This talk will present strategies and techniques for providing visibility into the true risk of the existing vulnerabilities, preventing the introduction of security issues in the software, resolving vulnerabilities in production environments quickly, and capturing the deployment bill of materials (DBOM).
Speakers:
Bob Boule
Robert Boule is a technology enthusiast with PASSION for technology and making things work along with a knack for helping others understand how things work. He comes with around 20 years of solution engineering experience in application security, software continuous delivery, and SaaS platforms. He is known for his dynamic presentations in CI/CD and application security integrated in software delivery lifecycle.
Gopinath Rebala
Gopinath Rebala is the CTO of OpsMx, where he has overall responsibility for the machine learning and data processing architectures for Secure Software Delivery. Gopi also has a strong connection with our customers, leading design and architecture for strategic implementations. Gopi is a frequent speaker and well-known leader in continuous delivery and integrating security into software delivery.
Essentials of Automations: Optimizing FME Workflows with ParametersSafe Software
Are you looking to streamline your workflows and boost your projects’ efficiency? Do you find yourself searching for ways to add flexibility and control over your FME workflows? If so, you’re in the right place.
Join us for an insightful dive into the world of FME parameters, a critical element in optimizing workflow efficiency. This webinar marks the beginning of our three-part “Essentials of Automation” series. This first webinar is designed to equip you with the knowledge and skills to utilize parameters effectively: enhancing the flexibility, maintainability, and user control of your FME projects.
Here’s what you’ll gain:
- Essentials of FME Parameters: Understand the pivotal role of parameters, including Reader/Writer, Transformer, User, and FME Flow categories. Discover how they are the key to unlocking automation and optimization within your workflows.
- Practical Applications in FME Form: Delve into key user parameter types including choice, connections, and file URLs. Allow users to control how a workflow runs, making your workflows more reusable. Learn to import values and deliver the best user experience for your workflows while enhancing accuracy.
- Optimization Strategies in FME Flow: Explore the creation and strategic deployment of parameters in FME Flow, including the use of deployment and geometry parameters, to maximize workflow efficiency.
- Pro Tips for Success: Gain insights on parameterizing connections and leveraging new features like Conditional Visibility for clarity and simplicity.
We’ll wrap up with a glimpse into future webinars, followed by a Q&A session to address your specific questions surrounding this topic.
Don’t miss this opportunity to elevate your FME expertise and drive your projects to new heights of efficiency.
"Impact of front-end architecture on development cost", Viktor TurskyiFwdays
I have heard many times that architecture is not important for the front-end. Also, many times I have seen how developers implement features on the front-end just following the standard rules for a framework and think that this is enough to successfully launch the project, and then the project fails. How to prevent this and what approach to choose? I have launched dozens of complex projects and during the talk we will analyze which approaches have worked for me and which have not.
Builder.ai Founder Sachin Dev Duggal's Strategic Approach to Create an Innova...Ramesh Iyer
In today's fast-changing business world, Companies that adapt and embrace new ideas often need help to keep up with the competition. However, fostering a culture of innovation takes much work. It takes vision, leadership and willingness to take risks in the right proportion. Sachin Dev Duggal, co-founder of Builder.ai, has perfected the art of this balance, creating a company culture where creativity and growth are nurtured at each stage.
3. Me
• Father of 3, happily married.
• I work for a Bank. Am also independent IT/Infosec
consultant. Any opinions presented here are my own
and do not represent my employer.
• Contributor to ”@TheAnalogies project” making IT and
Infosec understandable outside the echo chambers
• Member of the I am the Cavalry movement – trying to
make connected devices worthy of our trust
• @ClausHoumann
• I present on security a lot at conferences -> Find my
work on slideshare
4. The big picture
• Existing tools, and even Next-
Generation APT tools have limits/are
broken:
– Examples: https://blog.mrg-effitas.com/wp-
content/uploads/2014/11/Crysys_MRG_APT_detection_test_20
14.pdf
– He created the stupidest malware imaginiable. No one detected
it.
– http://archive.hack.lu/2014/Bypasss_sandboxes_for_fun.pdf
– Paul Jung -> Present here today -> shows how easily malware
can detect sandboxes
7. The Vendor threat
• No silver bullets exist. Beware of vendors using the phrases:
– ”Counter any threat”
– ”Detect any malware”
– ”You only need our solution”
– > Proceed with caution
– VPT
(vendor persistent threat)
11. Doing it right
• EURODNS in Luxembourg has just made it
possible for each client to get an SSL
certificate for their website for free
• This simple change makes a difference
12. The job of the enterprise defender:
• Trying to not purchase crappy products
(Lemons -> Source: Haroon Meer @wearetroopers
• While trying to build a real skilled defense
15. Compliance
• Is
• NOT
• Security
• Compliance is preparing to fight a war
–But using antiquated weapons
–And against enemies of decades past
16. BoD: Why worry now?
• Companies that get hacked are fine...look at
Sony, Target, Apple etc. -> stock prices not
affected, end users don’t care.
– Breaches and lawyer expenses following these are
an acceptable cost of doing business
– Right?
– No, maybe not anymore...next slide
17. Board Level Attention required, NOW!
Strategy! THINK!
• EU Data protection regulation:
– Mandatory breach reporting within 72 hours
– 5% of revenue as fine possible
• Threat level increasing sharply
• Attack surface increasing (think IoT, BYOD)
18. Pyramids
- This one is Joshua Corman’s.
Defensible Infrastructure
Operational Excellence
Situational
Awareness
Counter-
measures
19. The Foundation
Defensible Infrastructure
Software and Hardware built as
”secure by default” is ideal
here. Rugged DevOps.
Your choices of tech impacts
you ever after
You must assemble carefully,
like Lego
Without backdoors or Golden Keys!
20. Mastery
Operational Excellence
Master all aspects of your Development,
Operations and Outsourcing. Train like the
Ninjas!
DevOps (Rugged DevOps)
Change Management
Patch Management
Asset Management
Information classification & localization
Basically, all the cornerstones of ITIL
You name it. Master it.
21. Gain the ability to handle situations correctly – Floodlights ON
Situational
Awareness
”People don’t write software anymore, they assemble it” Quote Joshua Corman.
-> Know which lego blocks you have in your infrastructure
-> Actionable threat intelligence
-> Automate as much as you can, example: IOC’s automatically fed from sources
into SIEM with alerting on matches
Are we affected by Poodle? Shellshock?
WinShock? Heartbleed? Should we patch now?
Next week? Are we under attack? Do we have
compromised endpoint? Are there anomalies
in our LAN traffic?
22. Counter that which you profit from
countering
• Decrease attacker ROI below critical threshold
by applying countermeasures
• Most Security tools fall within this category
Counter-
measures
Footnote: Cyber kill chain is patented by Lockheed Martin.
23. Mapping to other strategic approaches
Defensible Infrastructure
Operational Excellence
Situational
Awareness
Counter-
measures
Lockheed Martin patented
Nigel Wilson ->
@nigesecurityguy
24. Defensive hot zones
• Basketball and
other sports
analysis ->
• – FIND the
HOT zones of
your
opponents.
• Defend there.
25. Defensive hot zones
• Basketball and
other sports
analysis ->
• – FIND the
HOT zones of
your
opponents.
• Defend there.
26. Hot zones!
• You need to secure:
– The (Mobile) user/
endpoints
– The networks
– Data in transit
– The Cloud
– Internal systems
Sample protections added only, not the
complete picture of course
27. Best Practices – High level
• Create awareness – Security awareness
training
• Increase the security budget
– Justify investments BEFORE the breach.
– It’s easier when you’re actually being attacked.
But too late.
• Use ”Adversary mind-set” and threat modeling
• Training, skills and people!
28. Hot zone 1:
A real world PC
• Microsoft EMET 5.2
• Executable files kill you, so use:
– Adblocking extension in browser
– Advanced endpoint protection solutions
– No admin credentials left behind
And then cross your fingers
29. Hot zone 1
• PC defense should include:
– Whitelisting
– Blacklisting
– Sandboxing
– Registry defenses
– Change roll-backs
– HIPS
– Domain policies
– Log collection and review
– MFA
– ACL’s/Firewall rules
– Heuristics detection/prevention
– DNS audit and protection
30. Hot zone 2:
The networks
• Baselining everything
• Spot anomalies
• Monitor, observe, record
• Advanced network level tools
– FireEye?
• Test your network resilience/security with Ixia
BreakingPoint. Ask me for free test licenses.
• Network Security Monitoring (NSM)
– Suricata, SecurityOnion, BroIDS?
• Don’t forget the insider threat
31. Hot zone 3+4:
Data in Transit/Cloud
• Trust in encryption
• Remember you secure what you put in the cloud. The Cloud
provider doesn’t
• Great new mobile collaboration tools exist
• SaaS monitoring and DLP tools exist -> ”CloudWalls”
• Cloudcrypters
• CloudTrail, CloudWatch, Config-log/change-trackers, vuln.mgmt
• Story about the Vulnerability patched during Bash/Shellshock public
confusion period
• And this for home study: https://securosis.com/blog/security-best-
practices-for-amazon-web-services
33. Cloud
• Concentration risk
• Secure the administrative credentials and APIs
• ENISA:
– https://www.enisa.europa.eu/activities/risk-
management/files/deliverables/cloud-computing-risk-
assessment
– https://resilience.enisa.europa.eu/cloud-computing-
certification
• A funny story about cloud certification providers
hacking me
34. A more defensible infrastructure
• Avoid expense in depth
• Research and find the best counter measures
• Open Source tools can be awesome
• Full packet capture and Deep packet
inspection/Proxies for visibility
• KNOW WHAT’S GOING ON IN YOUR
NETWORKS
• Watch and learn from attack patterns
36. Automate Threat Intelligence IOC
• Use multiple IOC feeds
• Automate daily:
– IOC feed retrival,
– Insertion into SIEM,
– Correlation against all-time logfiles,
– Alerting on matches
– Manual follow-up on alerts
37. You need to ally up!
• Security and Infrastructure aren’t enemies
• Security and the office of the CIO aren’t
enemies
• Ally up & Bromance!
38. And the unexpected extra win
• Real security will actually make you compliant
in many areas of compliance
39. Q & A
• Ask me question, or I’ll ask you questions
40. Sources used
– http://www.itbusinessedge.com
– Heartbleed.com
– https://nigesecurityguy.wordpress.com/
– Lockheed Martins ”Cyber Kill Chain”
– Joshua Corman and David Etue from RSAC 2014
”Not Go Quietly: Surprising Strategies and
Teammates to Adapt and Overcome”
– Lego
Editor's Notes
Or join these
Paul Jung present & presenting
No, that’s not a moon. Perspective matters. Things are not as they seem.
Paul Jung present & presenting
Also the Microsoft stuxnet vuln patch failed. And signatures fail all the time also – my vendor didnt succesfully create signatures for Shellshock for 1-2 weeks, first few were insufficient
The Egyptians built their pyramids from the bottom up. Because, that’s how you build pyramids. Start there!
Laying a secure foundation matters supremely. History proves this
As with any art, practice makes master. So, Practice!
Automation is key for threat intelligence, threat detection and threat remediation
Dont start by blindly buying tools, do the basics, master it and work from there
In reality, you will have AV, Java and others. And you probably cannot enforce killing all executables
In reality, you will have AV, Java and others. And you probably cannot enforce killing all executables
In reality, you will have AV, Java and others. And you probably cannot enforce killing all executables