For those who don’t already know, Security BSides events are organized by-and-for the...»Read the full article]]> With the August 5th & 6th show fast approaching, this will be the last in our series highlighting some of the great presentations that are scheduled to take place at Security BSides Las Vegas.

For those who don’t already know, Security BSides events are organized by-and-for the security community, attracts some of the most innovative security practitioners from around the world, and BSidesLV has the reputation for being one of the biggest events of the series.

We previously featured sessions on vulnerabilities in URL schemes, a talk on conference swag hacking strategies, a session on how to be successful in social engineering attacks, another on attacking Drupal, one titled IDS and NSM: Cut the Sh**!, one on Pwning the Hapless or How to Make Your Security Program Not Suck, and the last was for a talk titled No Info Sec Staff? No Problem.

Next up is a session being presented by Patrick Orzechowski (@shftleft), titled Bridging the Air Gap: Cross Domain Solutions, which will examine how in the commercial realm, we seem to be obsessed with cobbling together security systems to bolt around our data instead of building systems that are aware of what’s supposed to be passing through the network and into our applications.

Orzechowski notes that in the beginning, the only way data could be sent between classification levels was by physically transferring it via media, hence the term: “sneakernet.”

Analysts that wanted to move data from a “secret” system to an “unclassified” system would need to copy the data to a piece of media, scan it for “dirty words” and, if it passed the requisite tests, the data could be considered “sanitized” and moved to a lower classification level.

“At some point folks decided that systems could do this kind of thing, the term ‘trusted computing’ was thrown around, and the ‘CDS’ (Cross Domain Solutions) was born. At its core, the CDS provides those functions that the old sneakernet provided, but it has grown into much more,” Orzechowski said.

“For example, today’s next generation firewalls tout that they are ‘application aware,’ understanding what protocol moves across what port, while the CDS is ‘data aware’ – not only does it know that only XML is supposed to pass from host/port to host/port, it knows what specific XML tags, what data is contained in those tags, and how often the data is passed.”

Orzechowski says CDS acts somewhat like Web Application Firewalls are supposed to work, but are much more type-driven and formal.

“I believe these CDS solutions need to be reviewed and tested as any COTS product should be, not just because they’re what’s used to protect the nation’s secrets, but because they could act as a model for data protection in the commercial world,” Orzechowski explained.

“As we look at adopting the ‘data driven’ firewalling principles adopted by CDS in the commercial side of the industry, we can adopt the best practices employed by systems that are considered COTS.”

Orzechowski believes the idea of an “air gapped” network – whether it be military, infrastructure, or utilities – has gone the way of the dodo.

“There are no more air gapped networks, as shown by Stuxnet,” Orzechowski said. “The concept of Cross-Domain solutions, solutions that are specifically designed to bridge those air gaps, is a very important one, and I think we need to take a closer look at vendors and solutions to make sure these things are keeping our critical networks safe.

The target audience for Orzechowski’s talk are those people in positions charged with protecting the most critical networks: Military, infrastructure, nuclear, etc., but he says the same concepts that apply to CDS for a “critical” network could also be applied to traditional layered networks on the commercial side.

“I want the audience to have a solid understanding of what Cross-Domain Solutions are and how they’re used,” Orzechowski continued. “Hopefully this talk will spur discussion about CDS and CDS-like systems, how they’re implemented, tested for vulnerabilities and maintained. Protecting these critical systems should be a top priority.”

Orzechowski says that obviously the biggest challenge with these systems are potential vulnerabilities or misconfigurations that could ultimately costs lives.

“The idea that a critical infrastructure or highly classified network could potentially be accessed from the Internet should be a scary one for everyone – hopefully these systems, if they continue being deployed, will get safer and more secure,” Orzechowski said.

“On the upside, these systems are amongst the most heavily scrutinized and tested in the industry. On the downside, as we see in security time and again, it takes a major incident for serious action and attention to come to a vulnerable system.”

http://www.tripwire.com/state-of-security/security-data-protection/bsideslv-preview-bridging-the-air-gap-cross-domain-solutions/

For those who don’t already know, Security BSides events are organized by-and-for the security community, attracts...»Read the full article]]> With the August 5th & 6th show fast approaching, we are continuing our series highlighting some of the coolest presentations that are scheduled to take place at Security BSides Las Vegas.

For those who don’t already know, Security BSides events are organized by-and-for the security community, attracts some of the most innovative security practitioners from around the world, and BSidesLV has the reputation for being one of the biggest events of the series.

We previously featured sessions on vulnerabilities in URL schemes, a talk on conference swag hacking strategies, a session on how to be successful in social engineering attacks, another on attacking Drupal, one titled IDS and NSM: Cut the Sh**!, and the last one on Pwning the Hapless or How to Make Your Security Program Not Suck.

Next up is a session presented by Anthony Czarnik titled No Info Sec Staff? No Problem, where he will share his proven methodology, including key, actionable recommendations to help you meet the challenge and manage IT risk to a level that is acceptable to your small business.

Czarnik’s security experience covers the roles of security engineer, project manager, partner/channels manager, practice manager, marketing and business development, giving him a perfect 360 degree background with which to lead an information security firm.

His initial role was pre-sales engineer for SenSage, a SIEM vendor, where he designed and developed the Cerner HIPAA prototype implemented at Kansas University Medical. He then joined Klocwork, an application security and quality development platform vendor.

Czarnik integrated Klocwork into clients’ S-SDLC, designed and led an e-learning courseware development project, and then after managing an information security practice for five years, he founded Czartek, an information security firm.

Previously Czarnik has presented at the Chicago chapters of Cloud Security Alliance, Security Meetup, Software Quality Improvement Process (SPIN), Mobile Security Meetup and numerous corporate webinars, and he also published an article on software security and the S-SDLC in the international publication hackin9.

Czarnik says that cyber attacks on small and medium size businesses (SMB’s) rarely make headlines, making it is easy for these IT organizations to develop a false sense of security, and that information security is becoming increasingly challenging as both IT complexity and the threat landscape are evolving at an accelerated pace.

“In reality, 40% of security incidents involved SMB’s; 1 in 5 reported being victimized during previous 24 months; 69% lost productivity, 65% lost information and 47% lost revenue. The risk is real,” Czarnik said.

Yet for many SMB’s, information security commonly becomes a secondary responsibility of IT leadership, whose primary responsibility is to provide IT systems and services. Software as a Service (in the cloud) and virtualization provide cost savings.

“Users demand systems that are easy to use and provide them with lightning-fast performance, while also accessing the network with their mobile device of choice (BYOD),” Czarnik continued. “Partners need access to your network or cloud application. These recent technological advancements have resulted in increasingly complex IT environments. As IT complexity increases, so does the challenge of information security.”

To compound your challenge, Czarnik says, the threat landscape is evolving and now includes web applications, advanced social engineering and internal threats.

“A data breach will have an impact on the entire organization. The responsibility is yours. That includes CEO’s and COO’s of small businesses who do not have internal IT staff either,” Czarnik said. “You can outsource security, but you can’t outsource risk, so it’s a daunting challenge.”

Czarnik’s session will address that challenge, and key take-aways will include:

• A proven approach to effectively managing the business risk inherent to information technology and systems
• Key factors in determining when to use internal resources and when to invest in 3rd party services
• Valuable yet inexpensive tools and trusted information sources
• How to uncover vulnerabilities before attackers do [many vulnerabilities that lead to exploitation are relatively easy to find and inexpensive to fix]
• How information security can also solve compliance mandates
• Effectively communicating security and risk with non-IT executives

“You will also get a glimpse into the future; a future where vendors are required to document industry standard security ratings, the first mature wave of data scientists raise network analytics to level well beyond today’s correlation effectiveness,” Czarnik said, “and as an industry, mad as hell, we will rage offensive security.”

http://www.tripwire.com/state-of-security/security-data-protection/bsideslv-preview-no-infosec-staff-no-problem/

For those who don’t already know, Security BSides events are organized by-and-for the security community, and...»Read the full article]]> With the August 5th & 6th show fast approaching, we are continuing our series highlighting some of the coolest presentations that are scheduled to take place at Security BSides Las Vegas.

For those who don’t already know, Security BSides events are organized by-and-for the security community, and attracts some of the most innovative security practitioners from around the world, and BSidesLV has the reputation for being one of the biggest events of the series.

We previously featured sessions on vulnerabilities in URL schemes, a talk on conference swag hacking strategies, a session on how to be successful in social engineering attacks, another on attacking Drupal, and one titled IDS and NSM: Cut the Sh**!

Next up is a talk being presented by Casey Dunham (@CaseyDunham) and Emily Pience (@obfusicationx2), titled Pwning the Hapless or How to Make Your Security Program Not Suck, which will explore the lack of security awareness most employees continually make which can lead to a major security event, as well as discussing useful training, resource organization and allocation.

The presenters will walk attendees through a few scenarios – some successful and some not – and share what they have learned about human behavior and how it can be applied to enforcing security policies by creating a “culture of care.”

We discussed the session with Pience, an insurance industry professional with ten years experience of working for three of the biggest U.S. based disability insurance companies. Her co-speaker Casey is a Security Engineer with a history working for commercial financial firms.

“Customer data is our business.  Whether within the financial or healthcare industries, the root of our business is to safely house and transmit information to and from trusted parties,” Pience said.

“With the growing demand of increased access – in healthcare, from providers, employees, visitors and patients, from a variety of devices, increased federal enforcements of privacy and security requirements under the new HIPAA Omnibus Rule, there is an ongoing challenge of ensuring patient and customer information is adequately protected.”

Pience points out that numerous breaches within both the healthcare and financial fields have involved lost or stolen devices that are unencrypted, and that these kinds of mistakes by employees continue to be the biggest security threats to all businesses.

The session will examine why these breaches keep occurring and how you as an IT professional – or merely an employee with the safety of your customers’ data of concern – can help your business create useful prevention strategies that employees will pay attention to, as well as how to train employees to not be susceptible to social engineering attacks.

“Technical solutions will not be discussed specifically, as the focus will be on employee awareness, education and how we can do better,” Pience said. “By working through a few scenarios that we have personally encountered, we will address the topics of ‘why to care’ – or problems with people caring about security – testing your people, getting the ‘peons’ out of the loop, and rewarding security efforts.”

Pience says she and Casey are passionate about this topic because, as employees of Fortune 100 companies with large training budgets for security awareness, they continually see the same security mistakes being made by employees – both techy and non-techy – over and over again.

“With everyone wanting instant access to their own data – personal banking, medical records and bills – and companies clamoring to provide this access in multiple forms, the opportunities for human error have increased infinitely, and the human errors we have seen publicized in the media have been ‘duh’ lapses by ‘intelligent’ people,” Pience said.

“In many cases, the efforts of the people responsible for the security of an organization fail to properly get their point across, and it is even harder when trying to explain something that doesn’t have a quick fix and involves more technical astuteness on the part of the user –  oftentimes the difference between a successful security campaign and a non-successful one is simply communication.”

The session will be of utmost interest to anyone who handles or protects customer data on a daily basis, or creates proprietary programs and processes of obtaining customer data within company systems.

“We feel it may be more vital to those who have influence over in creating, sponsoring or financing security awareness programs within companies handling customer data, as these people are better able to identify their specific audience and create effective training with levity they will better prepare their workforce to prevent lapses in judgment and error,” Pience said.

“Security developers will be aware of how to introduce changes to their applications that will create checks and balances to gain access to customer data, thus preventing employees from accessing data without appropriate information.”

Pience said she and Casey are hoping audience members come away with new ideas for creating security training within their own company, and a renewed sense of awareness of how important and effective these trainings can be within their own organization.

“And we hope that during this presentation someone who has already been running an awareness program or is putting one together will leave with at least one idea that can make their program more effective,” Pience said.

“We are also hoping that developers come away with the notion that they can create checks and balances within their proprietary systems to prevent attacks, and we hope they find inspiration for changing or upgrading their programs to include such checks and balances.”

While there will always be people who remain computer operators rather than true users, Pience and Casey point out that as generations of more technologically aware people enter the workforce and hacking force, there will be new methods of exploiting human error and lack of awareness.

“Developers can create new ways to assist in creating processes that will prevent opportunities for common attacks and human errors,” Pience said.

http://www.tripwire.com/state-of-security/security-awareness/bsideslv-preview-how-to-make-your-security-program-not-suck/