Security site to bookmark: www.lares.com

An elegant way to sell security

Every now and then we need to get a chance to slow down our professional tactical everyday pace and think strategically. For those moments, I propose to visit lares.com. Lares is a boutique-alike security company founded by Chris Nickerson and staffed also by Eric M. Smith. Both are reputable security professionals that have greatly contributed to the security community.

Chris Nickerson conducted the famous and irreverent "Exotic Liability" security podcast. Unfortunately, the last available episode dates already from 2013. Chris is also a regular presenter at many international security conferences. He is also one of the authors of the Penetration Testing Execution standard. The amount of followers he has in his twitter account confirms his relevance in the community.

Eric M. Smith has also presented at events such as DefCon 22 in 2014: Along with Josh Perrymon, they studied the topic of RFID chip security.

Let's go now through some of the sections of the lares.com site:

- Lares in action can inspire us to come up with alternative ideas to the traditional way of creating and selling security services. It contains more than a dozen videos, and their presentations, of appearances at conferences like BSides, Troopers or Source Barcelona. The historical and practical approaches they propose on how to implement security are worth thinking about.

As an example, we find almost 80 pages on how to increase the value of traditional security testing (both for vulnerability management and penetration testing). That slidedeck is not only fun but also innovative. They use useful concepts such as insider threat assessment, adversary modeling and the
continuous implementation of security tests along any technological process.


- It is great to see in their services section that, together with traditional vulnerability assessments and security testing, they also offer business impact analysis as a value added security deliverable.

- There is a social engineering section, labeled "Layer 8 labs". This is an appropriate name considering the human element as another layer on top of the 7 layers of the OSI communication model. "Layer 8 labs" provide controlled  "phishing" campaigns to increase security awareness among employees in companies and organisations.


As a final comment, I would highlight the modern design of this website: It helps underlining the valuable security content they provide.

Happy ninja reading!

Adversary modeling

Security site to bookmark: www.openioc.org

Sharing information about real threats and real attacks

We human beings live in communities. The threats that may affect our group are an important information element communicated to our peers. This piece of information brings greater preparedness against potential risks. In addition, if those risks do really materialise, a faster and more effective reaction is possible.

Something similar can be seen on the Internet: www.openioc.org is an example of this. It proposes an automated way to share information about real threats on the Internet.

According to its homepage, OpenIOC "facilitates the exchange of indicators of compromise ("IOCs") in a computable format" i.e. ready to be processed by information systems such as intrusion detection systems and application layer filtering firewalls.

Each compromise indicator contains three elements:
- First, the metadata, which provide contextual information such as the author of the indicator, the name of the indicator and a brief description.
- Second, references, so you can link the indicator to a particular wave of attacks.
- Third, its definition, which describes its specific infection mechanisms and operation.

A valuable detail of this format is the possibility of using Boolean logic to filter indicators automatically.

OpenIOC is an extensible XML encoding protocol initially designed for Mandiant security products such as "IOC Editor", a free XML editor for indicators of compromise, and "Redline", a compromise verification tool for Windows installations, also free.

Security incident responders were interested in this initiative and finally Mandiant OpenIOC standardised and made it available to the open source community ("open source") in 2011.

OpenIOC is currently an open initiative. For example, in OpenIOC Google Groups there is a very active forum where you can get information on how to use this format with log analysis tools like "Splunk" or references of indicator repositories such as www.iocbucket.com.

Based on the increasing number of security incidents on the Internet, related information sharing will grow over the coming years, especially among companies with a similar risk profile.

Perhaps a pending task of this project is to implement a non-intrusive compromise detection service for end users outside major corporations.

Happy protection!

You can also read this post in Spanish here.

Fly high!

Security sites to bookmark: blog.didierstevens.com and rootshell.be

Belgium: Waffles... and security

The professional activities that we undertake within our company, be it our own shop or our employer, can, and should, benefit from all our other security related activities. The two Security Sites I recommend to visit confirm this. Both are written by well known names in the European Information Security community: The Belgians Didier Stevens and Xavier Mertens.

As securityandrisk, Didier Stevens created his blog blog.didierstevens.com in 2006. Since then, he regularly publishes very practical and technical security articles. Didier pays special attention to network security. The quality of the blog invites you to visit his own business' site didierstevenslabs.com, especially dedicated to pdf and "shellcode" analysis.  His company site is accessible from blog.didierstevens.com.

Xavier Mertens, with his unique "Belgian balloon fish" avatar, present both in his twitter account and blog, is the author of rootshell.be. On the Internet since 2003, rootshell.be publishes, together with his presented papers, very detailed summaries of the security conferences he attends. This is an opportunity to know what happened and what was said there. As in the case of Didier,  rootshell.be also links to truesec.be, his own security company, specialized in log management and security testing.

Both authors discuss security issues that are useful to our everyday job. From the pages of their blogs, they both link to some security tools (both Didier and Xavier). Didier proposes his own Microsoft Windows process-related utilities and Xavier introduces evasion tools such as "PingTunnel" and "Dns2tcp".

Information security is still a working field in which many breakthroughs, ideas and new developments come from "informal" channels such as blogs and security conferences rather than through formal academic degrees and scientific journals in the field. These two sites confirm this trend.

In short, the visit of these two personal sites from well-known Belgian security experts gives us ideas for our professional life while they nicely introduce the security companies they have created.

You can also read this post in Spanish here.

Happy Belgian security reading!

Making bridges

Security site to bookmark: securityerrata.org

Controversial but worth-reading

In the past, guilds regulated and controlled the practice of a craft. Securityerrata.org, an initiative from the attrition.org volunteer crew, aims to protect the information security profession from intruders.

In an almost irreverent way, they publish news that is charged with irony (for example, a security company that promises 100% security with its products and that, interestingly enough, is successfully attacked and compromised) and references to security snake oil sellers.

All this controversial content is organized into twelve sections that reveal:

- Companies that sell products containing malware before they even reach customers.

- Legal threats to security researchers who have found a security vulnerability.

- Failures in automated software update processes.

- Charlatans, be it individuals or companies, who introduce themselves as security gurus. The subsection dealing with companies can be controversial.

- Plagiarism: A long list of authors and books that turn out to be copies of previous publications.

- Firms offering security services or products that have been attacked and compromised themselves.

- Security companies that send unsolicited e-mail ("spam") to prospective customers.

- Security incidents involving Internet-related companies, such as the case of Stratfor, a company that suffered loss of confidential information in 2011.

- Invented or manipulated security statistics.

- Examples of how media confuse their audience with not confirmed security news. This section stopped being updated a long time ago. The authors could not keep with the rhythm of appearance of such pieces of news.

- Vulnerabilities and data leakage items from initiatives like osvdb.org, the Open Source Vulnerability Database, and datalossdb.org, a site that I already recommended in this blog.

Definitely securityerrata.org shows the great influence of mass media and acts as a whistle blower against charlatans. It is an Internet-based antidote to identify attempted fraud in information security. Therefore, before buying a product or a security book, have a look at their pages.

Happy errata reading!

You can also read this post in Spanish here.

Dark night

Security site to bookmark: www.secdocs.org

A valuable security research repository

Every single week, somewhere in the world, a security conference or presentation takes place. Attending all those events is not feasible. Sometimes we do not even know whether they will offer the minimum required quality. A website publishing high-quality security content presented in these events would provide great value to our security community.

This is the aim of secdocs.org, an elegant collection of links to documents, presentations, videos and audios presented at security conferences, events and podcasts organised in the past years and months. Examples of linked videos are:
- SSL and the future of authentication, by Moxie Marlinspike, presented at the "Black Hat 2011".
- Are we getting better? - Hacking Todays Technology, by Dave Kennedy, presented at "Hack in Paris 2013".

Secdocs.org is an initiative of the Italian Alessandro Tanasi. From Bologna, he is present in twitter with the nickname @jekil and he is also the author of a small security-related web titled www.lonerunners.net.

Its value proposition is to post links to high-quality security documentation, both from the content and format viewpoint. This documentation is, at least, worth checking. Secdocs.org helps us to distinguish the wheat from the chaff: the site currently links to over half a terabyte of information. I imagine the first user of these links is Alessandro Tanasi himself.

Every linked content is also tagged. This facilitates searching. We can find links by tag, author, date and event.

New publications linked in secdocs.org can be tracked via its twitter account. One suggestion for Alessandro would be to offer the chance to contribute as a content reviewer. Maybe each content curator could appear in a reputation rank according to the value they provide.

In short, this site is a demonstration of how you can create a quality product that gives value back to our community. A nice initiative to grow the personal and professional brand.

Thanks Alessandro!

A version of this article in Spanish can be found here.

Navigating through rough waves

Security sites to bookmark: krebsonsecurity.com and grahamcluley.com

Information security journalism: Creating a Personal Brand

Human Resources 2.0 is revolutionizing the workplace. The relationship between employers and professionals is changing. The traditional long-term contract is giving way to other means of collaboration. These are much more varied and adapted to specific needs from both sides. In this context, the creation and maintenance of a personal and professional public brand becomes a clear value.

The world of information security also lives this change. These two sites are two examples of this new trend: krebsonsecurity.com by Brian Krebs, a former Washington Post reporter and grahamcluley.com by Graham Cluley, an antivirus developer in the nineties.

Brian Krebs worked as a reporter on security issues at the Washington Post for 14 years, until 2009. His interest on digital security grew since 2001, when his home network was compromised.

Unlike Brian Krebs, Graham Cluley is a security professional with a technical background. He wrote the first version of the Windows-based Dr. Solomon antivirus and, outside the security field, two MS-DOS based games, still available on their website. He was one of the security specialists blogging for "naked security", the Sophos antivirus vendor's site. In June 2013 he left Sophos, a company where he worked since 1999 and released his own information portal for Internet security,  grahamcluley.com, to market his personal brand as independent security analyst. This site deals with IT security topics and it is not so cybercrime-focused as krebsonsecurity.com.

As they both confirm, they are now their own bosses. They regularly publish security news that could well appear in general-purpose newspapers and news portals, related to espionage, newly discovered vulnerabilities or the latest security breaches.

The simple architecture of these sites makes them easy to read and follow. Krebsonsecurity.com and Grahamcluley.com are platforms that both authors use to publish news while growing their personal professional brand and marketing their expert security analysis services in the form e.g. of articles in the case of Brian and public appearances in the case of Graham.

Finally, two questions I would like to pose to the reader:
- One for security entrepreneurs: have you already created your own personal brand?
- One for security practitioners in order to facilitate public awareness of the need for 'effective' security in the organization: do you regularly provide security news to your top executives?

A version of this post in Spanish is available here.

Looking through the glass

Happy reading!

Security site to bookmark: www.pentest-standard.org

In current times, the option to abandon a company's payroll and become an entrepreneurial Information Security freelancer appears as a plausible option to many IT Sec professionals. This choice comes either as a thoughtful decision or as a "last resort" before "being forced" to leave the industry and test their luck in other, more generic, IT areas.

Firms depend heavily on IT. They increasingly engage security professionals. A typically demanded service is the security analysis of their information systems, also known as a penetration test. Pentest-standard.org is a valuable initiative that provides both security vendors and their customers with one common "pen testing" language and scope, as you can read in their FAQ section.

Key players such as Chris Nickerson , Dave Kennedy , Chris John Riley , Carlos Perez and Wim Remes, among many others, have contributed to make pentest-standard.org a necessary go-to site for security pen testers. First thought of in 2009 and created in 2010, the site has had over 1800 content reviews and it continues evolving. Pentest-standard.org uses a handy wiki format and it welcomes contributions from the community via either the corresponding Linkedin group or a PDF-based collaboration site powered by Adobe.

I highlight two components of this site:

• The seven pen-testing execution stages: Each of them starts off with a valuable mind map that could very well be the script to follow in a formal pen-testing engagement. Non-technical, but pivotal, elements such as scoping and payment methods are also present.

• The technical guidelines: An excellent compilation of links and tools, both free and commercial software, required for each of the pen-test phases.

Finally , I would like to thank everyone involved in this "pen-testing vademecum" and invite the Infosec community to contribute. A revealing question would be: How much of what you can read in pentest-standard.org do you already know?

A version of this post in Spanish is available here.

A nice tool to fly ... and to pen test?

Security site to bookmark: www.reddit.com/r/netsec - The IT Security global bulletin board on the Internet

Wikipedia reminds us that the Agora was a meeting place, an open space, the center of commerce, culture and political life in Ancient Greece. The section in reddit.com devoted to information technology security, located at reddit.com/r/ netsec, is the agora of our security community and profession. The place to visit to stay on top of the security news, both politically correct and incorrect.
 
Since its foundation in 2005, reddit became the global Internet bulletin board, especially for US-based users, living up the role that the "Bulletin Board Systems" (BBS) played in past decades. As an example of the relevance and currency of reddit net sec articles, the same day that Cisco has announced the purchase of Sourcefire, on July 23, 2013, a user on reddit (they are called "redditors") shared the piece of news in reddit.com/r/netsec. Reading the comments shared on reddit posted by users after reading the news hints the so important "market sentiment". It is comparable to follow a related "hashtag" on twitter.  

This network security section in reddit links to related subsections. For example, the social engineering, computer forensics or reverse engineering pages are valuable. The popularity of this site makes it an optimal site to witness and to participate in fruitful conversations between Information Security professionals (itsecuriteers) on technical, organizational and business-related topics. Anyone asking questions can receive interesting and alternative answers. Noteworthy is the link to a jobs site. While most positions are based in the U.S., there is a growing number of postings for positions in Europe and to work remotely.

Finally, there is also a place for those who starting in this field: The academic discussion forum (e.g. the "2013 Q3 Academic Program Thread"). There, students post their evaluations regarding security degrees and training courses. 
A wise piece of general advice given by reddit.com to those who want to post news or comments is to avoid creating unnecessary conflict: Something that we can also apply almost in any aspect of our lives.

Sometimes there is no room to manoeuvre

You can also read this entry in Spanish here.

Happy redditing!

Security site to bookmark: www.wtfuzz.com

The information security practitioners community in emerging countries is worth mentioning. The author of the blog that I recommend on this occasion, wtfuzz.com, is from India. His name is Rishi Narang. On twitter he defines himself as a consultant, author and researcher in cyber psychology and threat intelligence.

The first posts date from 2010. As of 2011, Rishi Narang writes about security at least six times a year. This no-frills blog is an example of the value of Internet as a marketing and personal branding vehicle. He published in 2013 two articles with detailed and useful hands-on content about the (in)security of session "cookies"  in renowned places like Outlook, Google, Twitter, Linkedin, Facebook and Yahoo. Both articles were accompanied by a video, a proof of concept "script" to "guess" those "cookies" and a summarizing table of the analyzed "cookies".

The three conclusions drawn from these two articles on "cookie-based" session maintenance are:

- "Cookies" need to expire on the server that sends them, at least when the session expires and, preferably, periodically.

- The preference of using HTTPS and HTTP as transport protocol.

- These session "cookies" need to be created in a truly random manner.

The popular security publication SC magazine reported the vulnerabilities that Rishi Narang found in those big Internet names and published a link to his blog. Surely he has received an invitation to share his analysis and contribute to improving the security of some of these companies' cookies or the proposal to join a web development security provider.

In short, wtfuzz.com card is an excellent presentation of an inquisitive security professional.

Outside the typical IT security, in this blog you can find a non-technical article titled "It's you and me". It was published in October 2012. It talks about human emotions and differences between women and men. Perhaps this is why Rishi defines himself as a cyber psychology researcher?

Vulnerable tower... and cookies?
 

Happy cooking!

You can also read this entry in Spanish.

Security sites to recommend - articles for Spanish-speakers

For those able to read Spanish, there are already 8 articles in a popular security magazine recommending and introducing top-notch security sites. You can find them here:

1- pauldotcom.com
2- sans.org
3- commandlinekungfu.com
4- gnucitizen.org
5- irongeek.com
6- taosecurity.blogspot.com
7- www.socialengineer.org
8- jarlsberg.appspot.com
9- www.ethicalhacker.net
10- www.darkreading.com
11- ha.ckers.org
12- shadowserver.org 
13- www.securitywizardry.com
14- infosecisland.com

Happy reading!