Andrew Wilson – Source Code Review for Penetration Testers (1/2 Day)
Course Rationale
This course is designed to expose penetration testers to various approaches used in professional source code reviews. This course will not focus on specific vulnerabilities, but instead focus on strategies and tactics outlined in “The Art of Software Security Assessment” which have been vetted through the personal experience of the instructor. This is a hands-on workshop.
Prerequisites
A student should have prior exposure to testing dynamic applications, as well as exposure to programming languages.
Learning Outcomes
Upon successful completion of this course, students will be able to:
- Find more security issues, more consistently
- Identify an appropriate approach to source code review that depends on client needs, scope and personal skill
- Demonstrate and apply the basic principles of code review strategies, such as:
- Design generalization
- Candidate point
- Code comprehension
- Leverage code review tactics to not get miserably lost during a review
- Develop a basic understanding of how to scale a review from several hundred lines to several thousand
- Build a custom list of candidate points for targeted reviews
BIO: Andrew Wilson is a Senior Security Associate for Stach & Liu. In this role, Andrew focuses mainly on application assessments and security training. His primary areas of expertise are application penetration testing, secure developer training and the design and implementation of secure applications. Prior to Stach & Liu, Andrew worked for 9 years as a senior .NET engineer building secure applications in a variety of industries. Andrew has worked extensively in higher education and banking fraud, and is a Microsoft MVP in Developer Security.
Joe McCray – CyberWar (Full Day)
Google, Sony, Lockheed Martin, several large financial institutions, several large oil companies, the stock market, and countless other large organizations have all targeted and systematically compromised by hackers commonly referred to as Advanced Persistent Threat (APT). These hackers, use an attack methodology focused on stealth, data collection, and persistence.
This course picks up where the wildly successful “Advanced Penetration Tester: Pentesting High Security Environments” left off. Taking Intrusion Detection System (IDS) evasion, and Anti-virus bypass to the next level.
There are a few things to note that will be different from the “Advanced Penetration Tester: Pentesting High Security Environments” and from any other hacking course for that matter:
1. Per student request there will be NO Windows XP, or Vista in the course. Only Windows 7, and Server 2008 RC2, and new Linux distributions as the targets for students to go after.
2. Students attack a network of fully patched, and hardened Windows 7, Server 2008 RC2 hosts. Each target computer will be running a Host-Based Intrusion Detection System (HIDS), updated Anti-Virus, and a logging agent that reports to a Security Information and Event Management (SIEM) solution.
3. There will also be a Network Intrusion Detection System (NIDS), a web content filtering proxy, and a stateful inspection firewall as well.
4. The classroom will have 4 projectors running to show in real time the events triggered by the HIDS, NIDS, Proxy, and the logs so the student can learn exactly what attacks and defenses really work in today’s high security environment.
Students that are Network/System Administrators with three or more years experience working in environments such as financial institutions, DoD networks, or similar high security environments will benefit greatly from this course.
It is however primarily designed for Network/Web Application Penetration testers that are looking for the little tips and tricks that will help them better attack high security environments.
BIO: Joe McCray is an Air Force Veteran and has been in security for over 10 years. Joe has been involved in over 150 very high level pentesting assessments and has some major hacking accomplishments that he can share with his classes. His extensive experience and deep knowledge, mixed with his comedic style has lead Joe to be one of the most highly sought after speaking experts in the industry. Joe makes speaking appearances and gives seminars at major events in the security community such as Black Hat, DefCon, BruCon, Hacker Halted and more. Joe is the recipient of the 2009 EC-Council Instructor Circle of Excellence Award and the 2010 EC-Council Instructor of the Year Award. Joe is the founder and CEO of Strategic Security, Inc. an IT Security consulting firm that provides in-depth technical security assessments of your network, web application, and regulatory compliance gap analysis.
Mike Landeck, assisted by Ken Estes and Alex Stover - Introduction to Wireless Pen Testing and Assessment (1/2 Day)
This is an easy to learn, hands-on approach for anyone who wants to learn about pen testing wireless networks.
Interactive exercises will teach participants how to test WEP and WPA/WPA2 using the aircrack-ng suite, reaver and other tools found in Backtrack. This workshop provides both a hands-on experience as well as the fundamental concepts behind securing and testing a SOHO wireless network.
This workshop is intended for beginners so no experience is necessary. Some basic Linux skills would be helpful but not required. Attendees should bring their own laptops and have Backtrack installed and bootable. Attendees should visit http://www.backtrack-linux.
BIO: Mike Landeck has had a diverse career starting off in the behavior sciences as a researcher as well as a practitioner. Mike converted his hobby of recreational programming to an information technology career which has focused on application security and information security management. Mike currently is a corporate security type and in his free time volunteers teaching computer sciences to kids.
