Security Ripcord

I stopped reading Jeremiah Grossman‘s blog post Indirect Hard Losses to write this poll.  I am happy to see that people are showing their opinions to breaches through their wallets or the services they accept.  But should the customers be more forth coming?  Should companies have to mark on their web pages (all web pages that they provide to the public) that data in their possession was compromised?

This is a tricky situation.  In many states, persons who have abused children are required to disclose themselves to persons in their neighborhood.  We are also all aware of state or county run websites that display the name, offense, picture, and the last recorded address for these people.  Now, you might be thinking to yourself that this is a completely different situation and risk.  While I do admit that the situation is different I have to say that the level of risk could be considered similar.  If a victim of identity theft can go to jail because nobody will believe his story, I think the risks can be pretty high.  Also, although the risk of a sex offender is higher in cost to a community, company websites have the potential to affect a very large portion of the United States and even the international community.

Another argument against this is that the business is the victim of a crime and not the perpetrator.  I do admit that I understand and sympathize with this argument.  One way around this is to allow the business to provide information about the new protections that they have implemented to increase the security around the data they maintain (insert “mandatory information disclosure” argument here) and to provide a hot line to their support department.

So, without further ado, here is the poll.

Go forth and do good things,

Don C. Weber

Over the past couple weeks I have had a growing appreciation for the hard work that Harlan Carvey has put into his Windows Registry parsing tool RegRipper.  Although tools such as MiTeC’s RFV are still necessary when reviewing Windows Registry Hives, RegRipper provides an easy means to gather data into a text document for exporting into case notes and reports.

What really makes RegRipper worth while is that Harlan has gone out of his way to create a tool that is easily extensible. RegRipper pulls data out of Windows Registry Hives through the use of plugins.  Although he has created many plugins that are already included in RegRipper there are always going to be something else that would be useful to pull and document.

A good example is a recent case I was working on.  I needed to know how big a Windows Event Log was set to grow.  Through a little research I discovered the very useful Windows article, Eventlog Key, covering the subject.  Using the information in this article I was able to pull out the information using RFV.  Of course, I had already run RegRipper and determined that this information had not been pulled by an existing plugin.  I started thinking that this information would be useful in the future but I didn’t have time to write a plugin so I just exported the data by hand and drove on.

Later, in the same case, it became necessary to look for system and program crash dumps.  This meant that I needed to know whether the system had been configured to dump the contents of memory to a file when the operating system detected a crash.  Searching the output of RegRipper again showed that this information had not been pulled by a plugin.  After a little research I found Overview of memory dump file options for Windows Server 2003, Windows XP, and Windows 2000 and Dr Watson.  The first article explains the configuration settings for crash dumps that occur when a Windows system experiences the Blue Screen of Death (BSOD).  The second article details the Windows Registry configuration for Dr. Watson which “is a program error debugger that gathers information about your computer when an error (or user-mode fault) occurs with a program.”  Although I did have to pull the information by hand, this made me realize the creating a few RegRipper plugins might be worth while for future reports.

So, I did it.  I wrote three new plugins titled eventlog.pl, drwatson.pl, and crashdump.pl.  These plugins have been posted to the RegRipper Forum (registration required) where you can copy and include them in your plugin directory.  For now, if you want to run these plugins you will not be able to use them with the GUI version of the tool as they have only been tested by running them with rip.pl.  Your comments, updates, review, etc would be greatly appreciated.  Leaving your comments in the RegRipper Forum would be even better as everybody would benefit.

It is my understand that Harlan will include these, or at least his own version of these plugins as he will probably want the formating to remain consistent, in his next release.  Hopefully you find them useful.

NOTE: I just spoke with Harlan and there will be no need to update RegRipper to include these plugins.  Just grab them from the RegRipper forums, include them in your plugins directory, and you are off to the races.

Formatting, hmmm.  That brings up a good question.  Should there be an XML output for RegRipper?  Not that I know of any tools that would pull it in, but who knows what the future will bring.  But, it does sound like a good poll question.

n

Go forth and do good things,

Don C. Weber

I have noticed that more and more people are beginning to lock their Twitter accounts.  This means that people have to ask permission to follow them and that their tweets are not part of the public stream.  Doesn’t this defeat the purpose of Twitter?

So, here is a poll to figure this out.  If you have a better solution let me know and I will add it to the list.

Go forth and do good things,

Don C. Weber

So far Windows Incident Response With Only System Resources has gotten a lot of attention. Mostly due to Harlan Carvey‘s post about it, but I like to think that it is something people needed help with and can use.

To help understand peoples positions on incident response I have created the latest Security Ripcord Poll. I tried to think of different ways to approach this poll. How do I distinguish between big business, SMB, and home users? Do I want to focus on just one? How do I list out the different approaches?

Here is what I decided. Keep it simple. Focus on SMBs because as focus grows there are more options and as the focus shrinks there are less. Plus, if anybody wants to provide additional insight they can just do so in the comments of this post.

So, vote and show your opinion.

Go forth and do good things,

Don C. Weber

poll, security, incident response, Security Ripcord, harlan carvey

Personally I feel that presenting and guiding group discussions are key skills necessary for all security professionals. But, are these separate skill sets and are they necessary for all security professionals whether technological experts or management. It is time to find out.

You can check the results of previous Security Ripcord Polls.

Go forth and do good things,
Don C. Weber

speaking, presenting, Security Ripcord, Don C. Weber, guided discussions

Well, the results are in for the Blog Disclosure poll. I let this one run a while to get more responses and partly because I was out of the loop for a while.

The original question was:

Should you tell your employer about your blog?

The winning answer, receiving 15 of the 30 votes cast:

You should tell them during your interview or before you start blogging.

So I guess you definitely want to tell your employer that you are a blogger. This makes very good sense. You don’t want them finding out after the fact as there may be strict policies about blogging. Also, as blogging is becoming a marketing initiative in some companies, it might even work in your favor during an interview or for your reviews.

You can check out the full results on the Security Ripcord Polls page where you will find the results of this and other Security Ripcord Polls.

Go forth and do good things,
Don C. Weber

poll, blogging, Security Ripcord, Don C. Weber

In honor of Rich Mogull’s return to the security blogsphere I have created a new poll.

I thought about limiting it to security blogs but, what the hell, I guess there are some other blog out there.

Welcom back, Rich.

Go forth and do good things,
Cutaway

securosis, blogging, poll, Security Ripcord, Rich Mogull

The results are in. Just click on view results below (there is no easy way to force the results or I would have) or checkout the new Security Ripcord Polls page. For those who don’t want to click it was a tie between “No” and “Yes, if my employer paid for it.” “Yes, I would pay for it myself” did not get a single vote.

Unfortunately the results reflect what I recently found out with my attempt to Mentor a SANS GSEC here in Corpus Christi. People are not going to pay for this type of training out of their pocket. So, unfortunately my first attempt at being a SANS Mentor was not successful. I am going to try and get out a little more in the Corpus Christi community before I try to spin up a class again. I think I just need to come to the realization that there are not enough large businesses here in Corpus Christi to support this type of training event. Everybody wants the knowledge but they all tend to balk when they see the price tag associated with the training and certification.

I would like to thank Martin and Michael for their attempts to get the word out for me. It was very much appreciated.

Go forth and do good things,
Cutaway

mentor, SANS, GSEC, poll, Security Ripcord, SANS Mentor

Inspired by AndyITGuy I have decided to start doing polls. The first poll has to do with the SANS Mentoring program since I will be participating in this program by Mentoring a GSEC here in Corpus Christi.

So cast your vote and let me know if you think this program is worth its salt or, at least, the GIAC GSEC certification you will achieve by participating in this program.

So, vote here in this post and keep your eye out for future polls in the right sidebar.

Go forth and do good things,
Cutaway

AndyITGuy, SANS, GIAC, GSEC, Security Ripcord, SANS Mentor