Use this catalog to browse Trustwave’s security education offerings, including security awareness training for all staff and secure software development courses for technical staff. If you have questions please contact us.
Security Testing for Testing ProfessionalsTechWell
Today’s software applications are often security critical, making security testing an essential part of a software quality program. Unfortunately, most testers have not been taught how to effectively test the security of the software applications they validate. Join Jeff Payne as he shares what you need to know to integrate effective security testing into your everyday software testing activities. Learn how software vulnerabilities are introduced into code and exploited by hackers. Discover how to define and validate security requirements. Explore effective test techniques for assuring that common security features are tested. Learn about the most common security vulnerabilities and how to identify key security risks within applications, and use testing to mitigate them. Understand how to security test applications—both web- and GUI-based—during the software development process. Review examples of how common security testing tools work and assist the security testing process. Take home valuable tools and techniques for effectively testing the security of your applications going forward.
Use this catalog to browse Trustwave’s security education offerings, including security awareness training for all staff and secure software development courses for technical staff. If you have questions please contact us.
Security Testing for Testing ProfessionalsTechWell
Today’s software applications are often security critical, making security testing an essential part of a software quality program. Unfortunately, most testers have not been taught how to effectively test the security of the software applications they validate. Join Jeff Payne as he shares what you need to know to integrate effective security testing into your everyday software testing activities. Learn how software vulnerabilities are introduced into code and exploited by hackers. Discover how to define and validate security requirements. Explore effective test techniques for assuring that common security features are tested. Learn about the most common security vulnerabilities and how to identify key security risks within applications, and use testing to mitigate them. Understand how to security test applications—both web- and GUI-based—during the software development process. Review examples of how common security testing tools work and assist the security testing process. Take home valuable tools and techniques for effectively testing the security of your applications going forward.
Corporate security is the the best choice to mitigate the risks and maximize the investment. The goal is ensure the survival of the company and add value.
Key Challenges Facing IT/OT: Hear From The ExpertsTripwire
When you think of Information Technology (IT) and Operational Technology (OT), which side are you on? You may not feel that you fall on any side of that technological skirmish, but when you stop to carefully consider the differences in these two disciplines, it is nearly impossible to avoid a tendentious leaning.
However, the time may be upon us when the conflicts of IT and OT will be put to rest for the broader purpose of making businesses more agile, efficient, resilient and ultimately, more profitable. We spoke with experts in the field who offered their insights about the challenges facing IT and OT convergence. Here’s what they shared!
Understanding the Cyber Security Vendor LandscapeSounil Yu
We are often inundated with vendors offering their products and services to solve our various information security problems. How can you make sense of the wide range of technologies and ensure that your control gaps are being covered? Where are opportunities for technology disruption? Where are you overly reliant on technology? This is a framework for understanding security technologies so that you can align vendors in the right bucket to ensure that you have the suite of technologies that you need to execute your information security mission.
Security Testing for Testing ProfessionalsTechWell
Today’s software applications are often security-critical, making security testing an essential part of a software quality program. Unfortunately, most testers have not been taught how to effectively test the security of the software applications they validate. Join Jeff Payne as he shares what you need to know to integrate effective security testing into your everyday software testing activities. Learn how software vulnerabilities are introduced into code and exploited by hackers. Discover how to define and validate security requirements. Explore effective test techniques for assuring that common security features are tested. Learn about the most common security vulnerabilities and how to identify key security risks within applications and use testing to mitigate them. Understand how to security test applications—both web- and GUI-based—during the software development process. Review examples of how common security testing tools work and assist the security testing process. Take home valuable tools and techniques for effectively testing the security of your applications going forward.
knowthyself : Internal IT Security in SA SensePost
Presentation by Charl van der Walt and Roelof Temmingh at IIR in 2000.
The presentation begins with a discussion on global risks, threats, internal risk and security assessments. Steps to building a strong security culture within an organization are discussed. The presentation ends with a brief overview of intrusion detection systems and their use in internal security.
Distributed Immutable Ephemeral - New Paradigms for the Next Era of SecuritySounil Yu
We are rapidly approaching the next era of security where we need to be focused on the ability to recover from irrecoverable attacks. This can also be defined as resiliency. The traditional view of resiliency attempts to quickly restore assets that support services that we care about. This new approach/paradigm looks at resilience in ways that promote design patterns (distributed, immutable, ephemeral) where we do not care about a given asset at all while still keeping the overall service functioning. This new approach allows us to avoid having to deal with security at all.
Source 44 Consulting presentation by Adam Winnington at SC Congress Canada, June 14-15, 2011.
Hiring employees that fit with your current team and have enough knowledge to get work done is the most important thing a manager can do.
So whom can you hire?
Use this catalog to browse Trustwave’s security education offerings, including security awareness training for all staff and secure software development courses for technical staff. If you have questions, please contact us.
Threat Modeling for the Internet of ThingsEric Vétillard
A presentation made in several public events in 2015 about the threats related to the Internet of Things, and how modeling can be used as a way to manage mitigation methods.
Use this catalog to browse Trustwave’s security education offerings, including security awareness training for all staff and secure software development courses for technical staff. If you have questions please contact us.
Cyber Security Management in a Highly Innovative WorldSafeNet
Cyber attacks are reaching pandemic levels. State-sponsored groups and organized crime are successfully stealing valuable intellectual property—including critical infrastructure and operational readiness information, businesses’ and consumers’ financial data—often without anyone realizing the attack has occurred!
But preparedness cannot be delegated solely to the IT department. The involvement of the entire enterprise, armed with an understanding of the highly dynamic landscape, is vital for warding off potential threats.
Author: David Etue, VP of CorpDev Strategy, SafeNet
Watch the webcast on demand: https://www.brighttalk.com/webcast/6319/75109
The world we live in right now is getting more and more digital. All possible things we were reading in sci-fi books or watching in fantasy movies are becoming a reality. Internet of things, drones, e-world, mobility, applications, cloud, digital prototyping, e-voting, quantum computing, 3D printing like in Terminator movies and much more is a reality. On average auditory of this room can agree that it is ok to say that we live in the future. As what has happened to technology for personal use and business in last 25 years is impressive. And we can experience that. We are unique generation and live in unique times.
The digital world gives huge opportunities to any business entering it. There are soon close to 4 billion of potential customers out there in 2015 that are. Digital world introduces new products every day and technology creators are extremely working on to get new products to market as soon as possible.
But like in every book, movie, story, historical reality when there are good forces also there are bad forces. Cyber crime is growing and various things are happening everywhere. New technologies also introduce new risks and those risks are with different configuration. Countries attack countries and we call that a cyber wars, citizens are attacking countries and we call that hacktivism, professionals are attacking everyone for financial gains and we call that organized digital crime. And the methods are getting more and more sophisticated so in the end doesn’t matter how great are technologies of defense every day we have new articles of new indicents, data breeches, companies who have huge financial loses and damages of reputation, lost marketplace, stock market positions, customers, employees or even lives. I won’t touch each different method of attacks but I will simply try to share how we as a system integrator of complex cyber security protection technology solutions look at things and protect our customers.
Corporate security is the the best choice to mitigate the risks and maximize the investment. The goal is ensure the survival of the company and add value.
Key Challenges Facing IT/OT: Hear From The ExpertsTripwire
When you think of Information Technology (IT) and Operational Technology (OT), which side are you on? You may not feel that you fall on any side of that technological skirmish, but when you stop to carefully consider the differences in these two disciplines, it is nearly impossible to avoid a tendentious leaning.
However, the time may be upon us when the conflicts of IT and OT will be put to rest for the broader purpose of making businesses more agile, efficient, resilient and ultimately, more profitable. We spoke with experts in the field who offered their insights about the challenges facing IT and OT convergence. Here’s what they shared!
Understanding the Cyber Security Vendor LandscapeSounil Yu
We are often inundated with vendors offering their products and services to solve our various information security problems. How can you make sense of the wide range of technologies and ensure that your control gaps are being covered? Where are opportunities for technology disruption? Where are you overly reliant on technology? This is a framework for understanding security technologies so that you can align vendors in the right bucket to ensure that you have the suite of technologies that you need to execute your information security mission.
Security Testing for Testing ProfessionalsTechWell
Today’s software applications are often security-critical, making security testing an essential part of a software quality program. Unfortunately, most testers have not been taught how to effectively test the security of the software applications they validate. Join Jeff Payne as he shares what you need to know to integrate effective security testing into your everyday software testing activities. Learn how software vulnerabilities are introduced into code and exploited by hackers. Discover how to define and validate security requirements. Explore effective test techniques for assuring that common security features are tested. Learn about the most common security vulnerabilities and how to identify key security risks within applications and use testing to mitigate them. Understand how to security test applications—both web- and GUI-based—during the software development process. Review examples of how common security testing tools work and assist the security testing process. Take home valuable tools and techniques for effectively testing the security of your applications going forward.
knowthyself : Internal IT Security in SA SensePost
Presentation by Charl van der Walt and Roelof Temmingh at IIR in 2000.
The presentation begins with a discussion on global risks, threats, internal risk and security assessments. Steps to building a strong security culture within an organization are discussed. The presentation ends with a brief overview of intrusion detection systems and their use in internal security.
Distributed Immutable Ephemeral - New Paradigms for the Next Era of SecuritySounil Yu
We are rapidly approaching the next era of security where we need to be focused on the ability to recover from irrecoverable attacks. This can also be defined as resiliency. The traditional view of resiliency attempts to quickly restore assets that support services that we care about. This new approach/paradigm looks at resilience in ways that promote design patterns (distributed, immutable, ephemeral) where we do not care about a given asset at all while still keeping the overall service functioning. This new approach allows us to avoid having to deal with security at all.
Source 44 Consulting presentation by Adam Winnington at SC Congress Canada, June 14-15, 2011.
Hiring employees that fit with your current team and have enough knowledge to get work done is the most important thing a manager can do.
So whom can you hire?
Use this catalog to browse Trustwave’s security education offerings, including security awareness training for all staff and secure software development courses for technical staff. If you have questions, please contact us.
Threat Modeling for the Internet of ThingsEric Vétillard
A presentation made in several public events in 2015 about the threats related to the Internet of Things, and how modeling can be used as a way to manage mitigation methods.
Use this catalog to browse Trustwave’s security education offerings, including security awareness training for all staff and secure software development courses for technical staff. If you have questions please contact us.
Cyber Security Management in a Highly Innovative WorldSafeNet
Cyber attacks are reaching pandemic levels. State-sponsored groups and organized crime are successfully stealing valuable intellectual property—including critical infrastructure and operational readiness information, businesses’ and consumers’ financial data—often without anyone realizing the attack has occurred!
But preparedness cannot be delegated solely to the IT department. The involvement of the entire enterprise, armed with an understanding of the highly dynamic landscape, is vital for warding off potential threats.
Author: David Etue, VP of CorpDev Strategy, SafeNet
Watch the webcast on demand: https://www.brighttalk.com/webcast/6319/75109
The world we live in right now is getting more and more digital. All possible things we were reading in sci-fi books or watching in fantasy movies are becoming a reality. Internet of things, drones, e-world, mobility, applications, cloud, digital prototyping, e-voting, quantum computing, 3D printing like in Terminator movies and much more is a reality. On average auditory of this room can agree that it is ok to say that we live in the future. As what has happened to technology for personal use and business in last 25 years is impressive. And we can experience that. We are unique generation and live in unique times.
The digital world gives huge opportunities to any business entering it. There are soon close to 4 billion of potential customers out there in 2015 that are. Digital world introduces new products every day and technology creators are extremely working on to get new products to market as soon as possible.
But like in every book, movie, story, historical reality when there are good forces also there are bad forces. Cyber crime is growing and various things are happening everywhere. New technologies also introduce new risks and those risks are with different configuration. Countries attack countries and we call that a cyber wars, citizens are attacking countries and we call that hacktivism, professionals are attacking everyone for financial gains and we call that organized digital crime. And the methods are getting more and more sophisticated so in the end doesn’t matter how great are technologies of defense every day we have new articles of new indicents, data breeches, companies who have huge financial loses and damages of reputation, lost marketplace, stock market positions, customers, employees or even lives. I won’t touch each different method of attacks but I will simply try to share how we as a system integrator of complex cyber security protection technology solutions look at things and protect our customers.
An overview of Enterprise Security Architecture (ESA), with a brief description of its key elements: TRA/PIA, Threat Modeling, Security Controls, Risk Assessment and Security Debt.
Man and Machine -- Forming a Perfect Union to Mature Security Programs -- Key...Inno Eroraha [NetSecurity]
"Man and Machine: Forming a Perfect Union to Mature Security Programs" is a Keynote Address given by Inno Eroraha (NetSecurity) at Global Cyber Security in Healthcare & Pharma Summit in London, UK on 2/6/2020. The presentation highlights the following:
- Securing the enterprise is like protecting the human body
- Complement Penetration Testing with Compromise Assessment and/or Threat Hunting
- Be situationally aware and avoid being blinded by adversarial activities
- Compliance IS NOT Security
- Know ALL your assets and risks faced by each
- Establish a Data Breach Response Capability now
- Create a Matured Security Program and measure success frequently
- Leverage machines and automation to mature your Security Program
- And more
Intel Cyber Security Briefing at the Cyberstrat14 Security Conference in Hels...Matthew Rosenquist
Intel® Cyber Security Briefing:Trends, Challenges, and Leadership Opportunities. Matthew Rosenquist, Cyber Security Strategist, Intel Corp
In the digital world, the opportunities and risks coexist. To achieve and maintain a balanced Cyber Strategy by implementing a model of "connected security" has become a new imperative in business and society. Management can drive "cyber" leadership to create value and gain a competitive advantage in the digital world.
This presentation was discussed in a Webinar with MetricStream in September 2016. It is applicable for small, medium and large businesses when considering information and cyber security risk.
Your Challenge
As the market evolves, capabilities that were once cutting edge become default and new functionality becomes differentiating.
Vendors use a lot of marketing jargon, buzzwords, and statistics to sell their solutions, making objective evaluation rather difficult.
The endpoint protection (EPP) market is overcrowded and fragmented, resulting in information overload and consequently, a difficult vendor assessment.
Disparate product solutions are being bundled into one-off solutions or suites, often resulting in less efficient solutions than the more niche players.
Imminent obsolescence is an issue. Previous EPP solutions have not adapted with the rapidly evolving threat landscape and are no longer relevant, resulting in breaches or vulnerabilities.
Critical Insight
Don’t let vendors and market reports define your endpoint protection needs. Identify the use cases and corresponding feature sets that best align with your risk profile before evaluating the vendor marketspace.
Your security controls are diminishing in value (if they haven’t already). Develop a strategy that accounts for the rapid evolution and imminent obsolescence of your endpoint controls. Plan for future needs when making purchasing decisions today.
Endpoint protection is a matter of defense in depth and risk modelling, there is no silver bullet protection and mitigation solution. As end-client-technology providers release regular product/software updates, security tools will become outdated. Multiyear endpoint protection commitments will leave you playing a constant game of catch up.
Impact and Result
The solution is a holistic internal security assessment that not only identifies, but satisfies, your desired endpoint protection feature set with the corresponding endpoint protection suite and a comprehensive implementation strategy.
Use this blueprint to walk through the steps of selecting and implementing an endpoint protection solution that best aligns with your organizational needs.
1. Aligning IT Security Solutions with Business Justification Chaiyakorn ApiwathanokulCISSP,GCFA,IRCA:ISMSChief Security Officer, PTT ICT Solutions
2. Aligning IT Security Solutions with Business Justification Risk-base security investment (ROSI: Return on Security Investment) Global Perspective Beside security solutions, investing in human resource is essential KEY to success Your user: need awareness Your IT staff: need education Your management: need understanding
3. Risk-base Security Investment The Challenges Organization using IT has associated RISK Vendors want to sell new stuff Organization doesn’t want to be outdated Security solution is expensive Limited budget Technology moves fast forward Security prof. is too techy(no business language) Where enough is enough? Requirement base vs. Technology base
4. Sun Tzu – The Art of War “If you know your enemies and know yourself, you will not be imperiled in a hundred battles; if you do not know your enemies but do know yourself, you will win one and lose one; if you do not know your enemies nor yourself, you will be imperiled in every single battle.”, Sun Tzu – The Art of War 6th century BC Understand your business - Yourself Understand the surrounding THREATs – Your ENEMY Understand the PROTECTION requirement, limitation and readiness – Your STRATEGY
8. 1 Identify Asset Value Cost to acquire or develop the asset Cost to maintain and protect the asset Value of the asset to owners and users Value of the asset to adversaries Value of intellectual property that went into developing the information Price others are willing to pay for the asset Cost to replace the asset if lost Operational and production activities that are affected if the asset is unavailable Liability issues if the asset is compromised Usefulness and role of the asset in the organization
9. Identifying threats Earthquake, flood, hurricane, lightening Structural failure, asbestos Utility loss, i.e., water, power, telecommunications Theft of hardware, software, data Terrorists, both political and information Software bugs, virii, malicious code, SPAM, mail bombs Strikes, labor & union problems Hackers, internal/external Inflammatory usenet, Internet & web postings Employee illness, death Outbreak, epidemic, pandemic
10. 1 Calculating (quantifying) Risks Single Loss Expectancy (SLE) SLE = Asset Value x EF Annual Lose Expectancy ALE = SLE x ARO Single Lose Expectancy (SLE) Amount of lose occur once the threat is realized Exposure Factor (EF) A measure of the magnitude of loss or impact on the value of an asset Annualized rate of occurrence (ARO) On an annualized basis, the frequency with which a threat is expected to occur Annualized loss expectancy (ALE) Single loss expectance x annualized rate of occurrence = ALE
11. Cost/benefit Analysis forCountermeasure Valuation Cost of a loss Often hard to determine accurately Cost of prevention Long term/short term Refer as Safeguard Cost (ALEno.SG) – (ALEwith.SG) – (Cost of SG) = Value of SG to the company This value is always referred to when determining Security ROI or ROSI
17. Information Technology (IT) Security Essential Body of Knowledge (EBK) A Competency and Functional Framework for IT Security Workforce Development September 2008 United States Department of Homeland Security
20. Why was the EBK established? Rapid evolution of technology Various aspects and expertise are increasingly required Standard or common guideline in recruiting, training and retaining of workforce Knowledge and skill baseline Linkage between competencies and job functions For public and private sectors
23. IT Security Roles Chief Information Officer Digital Forensics Professional Information Security Officer IT Security Compliance Officer IT Security Engineer IT Security Professional IT Systems Operations and Maintenance Professional Physical Security Professional Privacy Professional Procurement Professional
24. Competency Areas (MDIE in each) Data Security Digital Forensics Enterprise Continuity Incident Management IT Security Training and Awareness IT System Operations and Maintenance Network and Telecommunication Security Personnel Security Physical and Environmental Security Procurement Regulatory and Standards Compliance Security Risk Management Strategic Security Management System and Application Security
ISO has published the first internationally ratified benchmark document addressing incident preparedness and continuity management for organizations in both public and private sectors.The Publicly Available Specification ISO/PAS 22399:2007, Societal security – Guideline for incident preparedness and operational continuity management, is based on best practice from five national standards from Australia, Israel, Japan, the United Kingdom and the United States.Natural disasters, acts of terror, technology-related accidents and environmental incidents have clearly demonstrated that neither public nor private sectors are immune from crises, either intentionally or unintentionally provoked. This has lead to a global awareness that organizations in the public and private sectors must know how to prepare for and respond to unexpected and potentially devastating incidents. ISO/PAS 22399 is the first deliverable from ISO technical committee ISO/TC 223, Societal security, which is charged with developing standards in the area of crisis and continuity management. http://www.continuityforum.org/news/1120/ISO22399