Security Ripcord

My first article for The Ethical Hacker Network has been published.  It details some of the things that security professionals working from home should take into consideration before they start doing assessments and penetration testing.

Self-employed security professionals, or those who are involved with small businesses, will invariably find themselves conducting security assessments and penetration tests of Internet facing systems and services. These activities will happen through resources that are generally not as robust as those supplied to security professionals in medium and large organizations. The following is a list of a few items that a security team should take into consideration before performing security related activities under these conditions.

Please go check it out and let me know what you think.  This should be the first in a series of helpful tips for people doing home based consulting.

Go forth and do good things,
Cutaway

Technorati Tags: EHN, Security Ripcord, penetration testing

WOW! Has it been a year?

I noticed that Mike Rothman just had his one year anniversary on March 14th (Congrats, BTW) and that got me thinking. I looked back and sure enough my first post was written on March 21st, 2006.

This post will be 122 and there have been 9 podcasts. I guess I am not completely consistent but then again sometimes I just don’t have anything to say. In the security blogging world I know that might be a rare thing but I can live with it.

I would like to thank everybody who has continued to read my musings, technical tips, and cries for help. I hope that I have added a little spice and education to your lives. I would also like to thank everybody who has powered through my podcasts. Hopefully those are getting better and you will continue.

I am not about to review the year nor am I going to predict the future. I am going to continue on and I hope that you find value enough to stick with me.

As to the security blogging community out there. Keep up the good work. There are a lot of people to educate out there and whether or not we are ruffling their feathers or just ruffling our own it does not matter. The word is getting out. You have all inspired me in some form or fashion. Calling you all by name would mean I missed somebody, so I won’t do it. Besides, who needs another list?

Go forth and do good things,
Cutaway

Security Ripcord

I was interviewed by Martin McKeay of the Network Security Blog for PodTech at RSA 2007. I had the pleasure of running around with Martin a lot during the conference. He worked really hard and we should be seeing more than a few interviews coming from the footage taken at the Verizon Business and F5 booths.

In this interview we talk about how big the Vendor Exposition floor was and how it was almost overwhelming for a first time, large conference, attendee. The product I mention in the video is the Norman Malware Analyzer. I still think that this type of product would be a good step for an incident response team who has found themselves responding to many malware incidents and outsourcing the analysis of that code to determine the actual intent of the malware. I do have to say, though, that this is the first product I have seen to perform this task so although there may be others out there this is the first to which I have been exposed. Something I just found, but haven’t watched yet is a SANS webcast covering this product: Ask The Expert Webcast: Malware Analysis Shortcuts. Check it out and let me know what you think in the comments.

Here is the interview. I hope you enjoy.

I just realized that there are two videos. This second one is a mixture of several interviews that Martin did throughout the conference. Nothing new from me but the other interviews are worth checking out.

Thank you, Martin, for this and all rest of your support throughout the year.

UPDATE: I corrected the glaring mistake I made in the name of the Norman Malware Sandbox Analyzer. Thank you to Kurt Wismer for pointing that out to me and my apologies to Norman for the mistake

Go forth and do good things,
Cutaway

RSA, Norman, McKeay, PodTech, SANS, F5, Security Ripcord

The results to the Christmas (Hacking) Story Skillz Challenge have been posted at The Ethical Hacker Network .  I had hoped that my answer was sufficient enough to win top prize.  Alas, it was not.  I did, however, get honorable mention in the Creative category which pleases me very much.

This was my first attempt at the Skillz Challenges and I had a great time coming up with my answer.  I am looking forward to the future challenges hopefully I will be able to pull in a prize one day.  But for now I am very pleased with the knowledge I have obtained from this challenge. 

I was also very glad to see the Ed posted his recommendations for solving the challenge.  This is an important aspect of teaching we should all take note of for our own training sessions.  Providing the solution and alternative methods of achieving the same goal will help everybody involved improve by expanding their current knowledge and skill sets.

Great job, Ed.  We are waiting patiently for the next challenge.

Go forth and do good things,

Cutaway 

Security Ripcord, Skillz Challenge, The Ethical Hacker Network

This week I contributed to the The Security Catalyst's Security Friday Fast Facts .  Below I have reprinted the original article.

How does Secure Sockets Layer (SSL) protect me?  Well, unless you understand network traffic, encryption, and web applications then you probably do not know the answer to this question.  Fortunately, if you are reading this you probably do understand how SSL works as well as the benefits and problems in its design.  If you do understand I want you to do something when you finish reading this article.  Stand up, step outside your office or cubicle so that you can see other people, and ask yourself if those people understand how SSL is designed to protect them.  Notice anybody who does not?

Here is where the Trusted Catalysts challenge you.  We would like you to walk over to a person, or better yet, get a group of people together and have a group discussion about this technology.  To facilitate this conversation here are a few points to help you:

•    Keep the conversation simple; avoid getting too technical, and do not talk down to anybody who does not understand.  They will when you are done, so be patient.  If you are in a group let others interject with their experiences and anecdotes.  Group discussions are always better learning environments.
•    Describe how SSL is a shared secret between their browser and the computer at the other end of the connection.  Although the traffic will flow through other computers and devices on the Internet the only thing they will see is a bunch of numbers, letters, and characters that do not make sense.  Show them how to look for the “https” portion of the URL within the browser’s address bar.
•    Explain that although the communication is protected the data stored on the other system might not be given the same consideration.  Suggest that they only provide information to sites that they specifically trust (double check those URLs).  Also, emphasize that if they are prompted to permit the storage of their personal or credit card information they should NOT allow it.
•    Talk about sites whose certificates produce an error window which will require end user interaction to continue.  Let them know that they must read the message to determine if they would like to continue with the transaction.  A good example site for demonstration purposes is the Center for Internet Security.  When you navigate to https://www.cisecurity.org the error window pops up because they are using the certificate that has been validated for the SANS.org domain.  Not a problem here but it IS a problem if you are unfamiliar with the site.
•    A good way to finish the conversation is to cover what to do if a person feels bad about a transaction.  Talk about how these people should immediately contact their bank or credit card company and talk to them about the situation.  These companies usually have very helpful departments dedicated to protecting accounts from fraud and monitoring them for strange or unauthorized behavior.

Now, don’t you feel better about yourself?  You have become a catalyst within your environment.

Go forth and do good things,
Cutaway

TCC, SSL, SANS, FFF, Security Ripcord, Security Catalyst

Personal Kudos on this one.

I have been included in another SANS Advisor article. This time the subject concerned moving from SSH password authentication to Pre-shared key authentication. It briefly (very briefly as we only have 250 words to work with) covers the importance of the moving way from the usual password authentication as well is pointing out a few concerns that go along with the move. The SANS newsletter is published in PDF format and the December, 2005 version is titled Advisor Vol.1 No. 5.