ExpoQA19 slides security awareness Steven Nienhuis
•Download as PPTX, PDF•
0 likes•68 views
The Hackers Eyes
Recommended
Recommended
More Related Content
Similar to ExpoQA19 slides security awareness Steven Nienhuis
Similar to ExpoQA19 slides security awareness Steven Nienhuis (20)
Recently uploaded
Recently uploaded (20)
ExpoQA19 slides security awareness Steven Nienhuis
- 1. #expoQA19
- 2. #expoQA19 Security Awareness “The Hackers Eyes” Steven Nienhuis https://www.slideshare.net/steavy
- 3. #expoQA19 Agenda 1. Goal of this presentation 2. Steps for a succesful hack (part 1) 3. Nowadays security threats by WiFi connections 4. Steps for a succesful hack (part 2) 5. Security inside Agile Teams 6. Questions
- 4. #expoQA19Steps for a succesful hack 1. Reconnaissance Reconnaissance
- 5. #expoQA19Steps for a succesful hack 1. Reconnaissance 2. Scanning Reconnaissance Scanning
- 6. #expoQA19Steps for a succesful hack 1. Reconnaissance 2. Scanning 3. Gaining Access Reconnaissance Scanning Gaining Access
- 7. #expoQA19Steps for a succesful hack 1. Reconnaissance 2. Scanning 3. Gaining Access 4. Maintaining Access Reconnaissance Scanning Gaining Access Maintaining Access
- 8. #expoQA19Steps for a succesful hack 1. Reconnaissance 2. Scanning 3. Gaining Access 4. Maintaining Access 5. Clearing Tracks Reconnaissance Scanning Gaining Access Maintaining Access Clearing Tracks
- 9. #expoQA19Security threats by WiFi connections Open WiFi network to join: FreeWifiExpoQA19
- 10. #expoQA19
- 11. #expoQA19Security threats by WiFi connections
- 12. #expoQA19Steps for a succesful hack
- 13. #expoQA19Steps for a succesful hack
- 14. #expoQA19Steps for a succesful hack
- 15. #expoQA19Security priority inside Agile Teams 1. Focus on non-functional requirements during refinement sessions
- 16. #expoQA19Security priority inside Agile Teams 1. Focus on non-functional requirements during refinement sessions
- 17. #expoQA19Security priority inside Agile Teams 1. Focus on non-functional requirements during refinement sessions
- 18. #expoQA19Security priority inside Agile Teams 1. Focus on non-functional requirements during refinement sessions 2. Knowledge of security aspects inside Agile Teams
- 19. #expoQA19Security priority inside Agile Teams 1. Focus on non-functional requirements during refinement sessions 2. Knowledge of security aspects inside Agile Teams 3. The extra role for a Tester inside Agile Teams
- 20. #expoQA19Security priority inside Agile Teams 1. Focus on non-functional requirements during refinement sessions 2. Knowledge of security aspects inside Agile Teams 3. The extra role for a Tester inside Agile Teams
- 21. #expoQA19Security priority inside Agile Teams 1. Focus on non-functional requirements during refinement sessions 2. Knowledge of security aspects inside Agile Teams 3. The extra role for a Tester inside Agile Teams 4. Tooling and heuristics to use
- 22. #expoQA19Security priority inside Agile Teams 1. Focus on non-functional requirements during refinement sessions 2. Knowledge of security aspects inside Agile Teams 3. The extra role for a Tester inside Agile Teams 4. Tooling and heuristics to use
- 23. #expoQA19Security priority inside Agile Teams 1. Focus on non-functional requirements during refinement sessions 2. Knowledge of security aspects inside Agile Teams 3. The extra role for a Tester inside Agile Teams 4. Tooling and heuristics to use *https://github.com/danielbilling/security-test-learning
- 24. #expoQA19Security priority inside Agile Teams 1. Focus on non-functional requirements during refinement sessions 2. Knowledge of security aspects inside Agile Teams 3. The extra role for a Tester inside Agile Teams 4. Tooling and heuristics to use 5. Security as a Acceptance Criteria or by Design
- 25. #expoQA19Security priority inside Agile Teams 1. Focus on non-functional requirements during refinement sessions 2. Knowledge of security aspects inside Agile Teams 3. The extra role for a Tester inside Agile Teams 4. Tooling and heuristics to use 5. Security as a Acceptance Criteria or by Design 6. Security trainings
- 26. #expoQA19
- 27. #expoQA19 Top tip • OWASP checklist - https://www.owasp.org/index.php/Top_10-2017_Top_10 Advanced • Burpsuite - https://portswigger.net/burp • OWASP Zed Attack Proxy - https://www.zaproxy.org/
- 28. #expoQA19
Editor's Notes
- This is the first step of Hacking. It is also called as Footprinting and information gathering Phase. This is the preparatory phase where we collect as much information as possible about the target. We usually collect information about three groups, Network Host People involved There are two types of Footprinting: Active: Directly interacting with the target to gather information about the target. Eg Using Nmap tool to scan the target Passive: Trying to collect the information about the target without directly accessing the target. This involves collecting information from social media, public websites etc.
- Three types of scanning are involved: Port scanning: This phase involves scanning the target for the information like open ports, Live systems, various services running on the host. Vulnerability Scanning: Checking the target for weaknesses or vulnerabilities which can be exploited. Usually done with help of automated tools Network Mapping: Finding the topology of network, routers, firewalls servers if any, and host information and drawing a network diagram with the available information. This map may serve as a valuable piece of information throughout the haking process.
- This phase is where an attacker breaks into the system/network using various tools or methods. After entering into a system, he has to increase his privilege to administrator level so he can install an application he needs or modify data or hide data.
- Hacker may just hack the system to show it was vulnerable or he can be so mischievous that he wants to maintain or persist the connection in the background without the knowledge of the user. This can be done using Trojans, Rootkits or other malicious files. The aim is to maintain the access to the target until he finishes the tasks he planned to accomplish in that target.
- No thief wants to get caught. An intelligent hacker always clears all evidence so that in the later point of time, no one will find any traces leading to him. This involves modifying/corrupting/deleting the values of Logs, modifying registry values and uninstalling all applications he used and deleting all folders he created.