I participated in the Nebraska CERT Conference this week and gave a talk on Building the Perfect Backtrack 4USB Thumb Drive. Below is the slide deck from my talk.
Let me know if you have any comments or questions.
-Kevin
{ 4 comments }
August 2009
Hi everybody! I hope your day is going well. Sorry about missing the Bits post yesterday. I was presenting at the Nebraska CERT Conference and the day just got away from me.
Here are today's Interesting Information Security Bits from around the web.
- Rich shares some interesting information about the heartland breach.
Securosis Blog | New Details, and Lessons, on Heartland Breach
Tags: ( heartland ) - Graham has a survey up that asks some questions about encryption on smart devices and whether you are using it or not.
Is your smartphone encrypted? | Graham Cluley's blog
Tags: ( survey smartphone ) - Here is a nice calendar that is being setup to track security events. Not incidents, events like RSA, DefCon, BruCon, etc.
/dev/random >> Security Events Calendar
Tags: ( calendar ) - I haven't listened yet, but with Martin McKeay, Mike Rothman, Alex Hutton, Nick Selby and Josh Corman together about PCI, there has got to be some good stuff in there.
Network Security Blog >> Ranting Roundtable on PCI
Tags: ( pci )
That's it for today. Have fun!
Subscribe to my RSS Feed if you enjoy these daily Interesting Bits posts.
Kevin
{ 0 comments }
Good afternoon everybody! I hope your day is going well.
Here are today's Interesting Information Security Bits from around the web.
- Jack has a FAQ about about this bit of legislation that is a moving target.
Uncommon Sense Security: Frequently Asked Question Regarding 201 CMR 17.00
Tags: ( 2001-cmr-17.00 ) - We have all heard excuses for why it isn't necessary to embark on a path to bolster our application development programs with a bit of security specific effort. Jeremiah has put up great post that gives us a little ammunition for that discussion.
Jeremiah Grossman: Overcoming Objections to an Application Security Program
Tags: ( wepappsec ) - JJ has some content available on Tech Targets Network Security School on securing your network on a budget. You should check it out if you are in that boat. Ignore her comment about getting tired of listening to her, that won't happen, but go ahead and check out the other content too.
Security Uncorked >> Network Security on a Budget: Video, Podcast and Tips
Tags: ( network training ) - The "huh?" factor in this one is pretty staggering. Not the reporting of it, the actual thing being reported on.
Law Enforcement Altered r00t-y0u Frontpage - SpywareGuide Greynets Blog
Tags: ( general ) - Ron offers up some valuable thoughts on making sure we are doing what we do for the right reasons. The we being information security professionals.
The GOAL of Security : The Security Catalyst
Tags: ( general risk ) - A couple ways that malware/evil hackers can try to determine if you are in a virtual machine or not.
Jeremiah Grossman: Web pages Detecting Virtualized Browsers and other tricks
Tags: ( browser detection )
That's it for today. Have fun!
Subscribe to my RSS Feed if you enjoy these daily Interesting Bits posts.
Kevin
{ 0 comments }
Good afternoon everybody! I hope your day is going well.
Here are today's Interesting Information Security Bits from around the web.
- Here's a new challenge for you. The winner will be announced in San Diego in September.
philosecurity >> Blog Archive >> Network Forensics Puzzle Contest!
Tags: ( challenge network-forensics ) - This is just a lot of fun. Link goes directly to PDF.
WHEN ZOMBIES ATTACK!: MATHEMATICAL MODELLING OF AN OUTBREAK OF ZOMBIE INFECTION (PDF)
Tags: ( general ) - Here is a huge list of cheat sheets you will find useful.
System Advancements at the Monastery >> Blog Archive >> What's in Your Folder: Security Cheat Sheets
Tags: ( cheatsheet ) - Steve has written a post on things not to do when implementing VDI. He calls them anti-patterns. I like that term. Going to have to remember it. This is a good read if you are considering rolling out this type of infrastructure and especially if you already have.
ViewYonder >> Feeding the IT Shriekometer: 5 VDI anti-patterns
Tags: ( vdi ) - As I have mentioned before, the team I participated on for the Mystery Challenge at Defcon 17 tied for second place this year. Cutaway has written up a great recap that makes me even more bummed that I missed out this year and more motivated to be there for next years challenge.
Security Ripcord >> Blog Archive >> MysteryChallenge - DefCon 17
Tags: ( mystery-challenge ) - Some guidance on surviving a third-party on-site audit. Good stuff.
Surviving a third party onsite audit
Tags: ( audit ) - "Run, run away. We've been hacked......um, never mind, it was something else." The Security Shoggoth reminds us, that it isn't always about security. Which brings the following saying to mind, "When all you have is a hammer, every problem looks like a nail."
The Security Shoggoth: Its Not Always A Security Issue
Tags: ( general ) - There are an increasing number of conversations going on about whether Facebook and its ilk should be allowed on corporate networks. The Marines have taken the stance that social networking sites are not allowed. This post by Chris reinforces that decision. It's dangerous out there folks. Be careful.
Two Facebook Threats In One Day... - SpywareGuide Greynets Blog
Tags: ( facebook ) - One of the three legs of the CIA triad, which is the foundation of information security, is availability. This post is the first of a series that will be exploring this facet of information security.
A Data Protection Reference Architecture - Part 1 - Backup & Beyond
Tags: ( availability backup ) - Here is an interesting article about Windows 7, XP Mode, Vista and a few other tidbits.
Roger's Security Blog : Why Windows 7 XP Mode makes sense from a security perspective
Tags: ( microsoft windows-7 xp )
That's it for today. Have fun!
Subscribe to my RSS Feed if you enjoy these daily Interesting Bits posts.
Kevin
{ 0 comments }
Good afternoon everybody! I hope your day is going well.
Here are today's Interesting Information Security Bits from around the web.
- NSS Labs has published their third quarter Browser Security Test.
Comparative Browser Security Testing - Phishing & Socially Engineered Malware - nsslabs.com
Tags: ( browser ) - The Call for Speakers for RSA USA 2010 has been extended a week. Deadline is now August 21st.
Call for Speakers
Tags: ( rsa cfp ) - Brian talks about hype in the information security market.
Hyper Security - fudsec.com
Tags: ( fud ) - It has been talked about quite a bit over the last year or more. Can a cloud based solution be PCI compliant? Looks like the answer to that question has been given and by one of the larger cloud providers.
Network Security Blog >> Cannot achieve PCI compliance with Amazon EC2/S3
Tags: ( pci cloud ) - This is interesting. A botnet being controlled via Twitter.
>> Twitter-based Botnet Command Channel * Security to the Core | Arbor Networks Security
Tags: ( twitter botnet ) - Is your cell phone telling tales on you? Looks like the Palm Pre might be.
Is Your Palm Pre Watching You? : Liquidmatrix Security Digest
Tags: ( surveillance ) - Dave offers up a tutorial on encrypting your data backups on the cheap.
IT Security Expert: Secure Encrypted Data Backup on a Budget Tutorial
Tags: ( backup encryption )
That's it for today. Have fun!
Subscribe to my RSS Feed if you enjoy these daily Interesting Bits posts.
Kevin
{ 0 comments }
Good afternoon everybody! I hope your day is going well.
Here are today's Interesting Information Security Bits from around the web.
- Here is a great list of state and country links to privacy information. Via @PrivacyProf
Links to Privacy Laws
Tags: ( privacy regulation ) - Rsnake has updated his XSS cheat sheet.
XSS (Cross Site Scripting) Cheat Sheet
Tags: ( cheatsheet xss ) - Per ISC, PacketLife is updating their cheat sheets. Must have stuff.
Cheat Sheets - PacketLife.net
Tags: ( cheatsheet ) - Want to play around with CRSF? Here is a tool that lets you do so. Don't forget, only use it in your lab or on sites you have permission to test.
Neohaxor.org >> Blog Archive >> MonkeyFist Fu: The Intro
Tags: ( tools csrf ) - Here is the answer to the hard version of the recent I Smell Packets challenge.
Solution to The Crypto Kitchen Packet Challenge (Hard Version) << I Smell Packets
Tags: ( challenge answer ) - An interesting exploration of a possible way to detect encrypted sessions.
Detecting encrypted traffic with frequency analysis << wirewatcher
Tags: ( encryption detection ) - Bill Brenner had the opportunity to interview Robert Carr, the CEO of Heartland Payment Systems Inc., regarding the massive breach that occurred. Mr. Carr's responses have generated quite a bit of conversation. The I find most disturbing about Mr. Carr's responses is that someone is his position would take this approach to dealing with the situation. Seems like a lot of finger pointing and 'it wasn't me' language for an issue which is ultimately his responsibility. Please read the next few links after you read the interview to see what others, who are much more eloquent than I, have to say.
Heartland CEO on Data Breach: QSAs Let Us Down - CSO Online - Security and Risk
Tags: ( heartland ) - Rich's response to the Heartland CEO's comments.
Securosis Blog | An Open Letter to Robert Carr, CEO of Heartland Payment Systems
Tags: ( heartland ) - Alan's take on the Heartland issue.
StillSecure, After All These Years: Heartland CEO thought QSAs would make him compliant and secure
Tags: ( hearland ) - Mike's take on the Heartland issue.
One Man's View: Heartland CEO Must Accept Responsibility - CSO Online - Security and Risk
Tags: ( heartland ) - Andy's take on the Heartland issue.
Will the real leader please step forward >> Andy ITGuy
Tags: ( heartland ) - Jeff tells it like it is! Actually, he does, but read the whole article to know what I mean.
The Auditor's Prerogative : The Security Catalyst
Tags: ( audit ) - David may call it an incomplete thought, but I don't.
Incomplete Thought: Compliance, Governance, Audit and Risk aka GRC We're Doing It Wrong << The New School of Information Security
Tags: ( grc )
That's it for today. Have fun!
Subscribe to my RSS Feed if you enjoy these daily Interesting Bits posts.
Kevin
{ 0 comments }
Good afternoon everybody! I hope your day is going well.
Here are today's Interesting Information Security Bits from around the web.
- JJ talks to Anuesystems in their interview series. Good stuff.
Security Pros on Twitter (SPoT): Jennifer Jabbusch/@jjx - The Network View
Tags: ( interview ) - Anton talks about the expert vs generalist issue many in information security are faced with today.
Anton Chuvakin Blog - "Security Warrior": A Myth of An Expert Generalist
Tags: ( career ) - I'm not sure I agree with the title of Lori's post, but I agree with the sentiment of the post completely. Information Security mandate is not lock it all down. Our job is to ensure that appropriate controls are in place based on informed risk decisions and business need. Sometimes that means things happen that make us cringe, but we cannot force things that make it impossible for the business to function, no matter how "secure" we think that might make us.
WILS: InfoSec Needs to Focus on Access not Protection
Tags: ( general ) - Richard offers some thoughts on the expert vs generalist topic.
TaoSecurity: Thoughts on Security Careers
Tags: ( career ) - Some additional information has been published by Mastercard dealing with their recent statements about compliance levels.
Branden Williams' Security Convergence Blog: MasterCard Clarifies their Position
Tags: ( pci mastercard ) - This post takes a look at whether we need a CBK for the "Human Factor" or not.
/dev/random >> And What About the Human Factor?
Tags: ( general )
That's it for today. Have fun!
Subscribe to my RSS Feed if you enjoy these daily Interesting Bits posts.
Kevin
{ 0 comments }
Good afternoon everybody! I hope your day is going well.
Here are today's Interesting Information Security Bits from around the web.
- A very nice analysis of the current WordPress admin password reset issue. BYW - Go fix your installs.
Digital Soapbox - Preaching Security to the Digital Masses: WordPress Bugs... A Disturbing Vulnerability
Tags: ( wordpress ) - PCI v1.2.1 is official now. See inside for the details.
Branden Williams' Security Convergence Blog: PCI DSS Goes v1.2.1
Tags: ( pci ) - Looking for some pcap data sets to play with. Richard points to some recent ones published some by West Point.
TaoSecurity: 2009 CDX Data Sets Posted
Tags: ( pcap ) - You really owe it to yourself to check out this post and attendant white paper. CRSF is some scary stuff.
Neohaxor.org >> Blog Archive >> Dynamic Cross-Site Request Forgery (CSRF)
Tags: ( crsf )
That's it for today. Have fun!
Subscribe to my RSS Feed if you enjoy these daily Interesting Bits posts.
Kevin
{ 0 comments }
Good afternoon everybody! I hope your day is going well.
Here are today's Interesting Information Security Bits from around the web.
- MasterCard has published their fine schedule.
MasterCard Becomes The First Card Brand To Publish PCI Fines | SecTechno
Tags: ( pci fines ) - Nick's rant/opining that is worth a read.
Showing The Oblomovs The Door - fudsec.com
Tags: ( general ) - Check out Jack's "rantbuttal." His word, not mine, but I really like it
Uncommon Sense Security: Smart people saying dumb stuff, again.
Tags: ( testing ) - An interesting discussion of multi-tenancy.
Rational Survivability >> There's A Difference Between Application/OS Multitenancy and Data(base) Multitenancy
Tags: ( cloud ) - I saw Trey give a version of "Making Money the Blackhat Way" at Secure360 this year. This blog post talks about some interesting issues related to that.
Jeremiah Grossman: Security Religions and Risk Windows
Tags: ( general ) - Mike's response to Nick's post on Fudsec.
Chaordic Mind >> Personal Responsibility in Information Security
Tags: ( general ) - Details for the August Atlanta NSAIG meeting are inside.
NAISG - August Atlanta Meeting >> Andy ITGuy
Tags: ( naisg atlanta ) - Here is a tutorial on lock picking for the beginner.
Lock Picking 101 * View topic - Beginner's Lockpicking Exercise - by digital_blue
Tags: ( lockpicking )
That's it for today. Have fun!
Subscribe to my RSS Feed if you enjoy these daily Interesting Bits posts.
Kevin
{ 2 comments }
Good afternoon everybody! I hope your day is going well.
Here are today's Interesting Information Security Bits from around the web.
- I missed Blackhat and Defcon this year and I was bummed about it. The SecurityBSides event that I also missed just made it worse.
SecurityBSides: The Best-Kept Vegas Secret - Hacked Off - Dark Reading
Tags: ( securitybsides ) - The Infosec Cynic gets stuck in the lift with Rebecca Herold.
Rebecca Herold - Stuck in the lift with the cynic | The Infosec Cynic
Tags: ( interview ) - Here is a Google talk from Nate Lawson on common cryptology flaws.
Google Tech Talk on common crypto flaws << root labs rdist
Tags: ( cryptography ) - A new tool is available from GNUCITIZEN. Unfortunately, it is only available for Mac right now. Windows and Linux releases to come in the future.
Free Web Application Security Testing Tool | GNUCITIZEN
Tags: ( webappsec tools )
That's it for today. Have fun!
Subscribe to my RSS Feed if you enjoy these daily Interesting Bits posts.
Kevin
{ 0 comments }