<![CDATA[[SecurityRatty] tag: presentation]]> http://securityratty.com/tag/presentation Tue, 26 Aug 2008 17:16:43 +0000 iRatty Engine http://blogs.law.harvard.edu/tech/rss <![CDATA[Nmap presentation for the ISSA in Louisville Kentucky]]> http://securityratty.com/article/3b8d1a1f88e7e66d464e3f1c20d672fa http://securityratty.com/article/3b8d1a1f88e7e66d464e3f1c20d672fa Kentuckiana ISSA on the security tool Nmap. I've also posted the slides and other media so you can follow along if you like. Topics covered include: port scanning concepts, TCP three way handshake, stealth scans, idle scans, bounce scans, version detection, OS detection, NSE/LUA scripting and firewall logs. Hope some of you can make it to the free class we will be holding at Ivy Tech Sellersburg on Sept 20th, 2008 at 1pm. Contact me to RSVP. The video is about an hour long. Enjoy.

]]> Sat, 06 Sep 2008 13:03:27 +0000 ivy tech sellersburg detection version detection security tool nmap bounce scans sept 20th presentation firewall logs free class Nmap presentation for the ISSA in Louisville Kentucky <![CDATA[Nmap presentation for the ISSA in Louisville Kentucky]]> http://securityratty.com/article/4993e62d52cab95ea4f31b73af8b1f0e http://securityratty.com/article/4993e62d52cab95ea4f31b73af8b1f0e Kentuckiana ISSA on the security tool Nmap. I've also posted the slides and other media so you can follow along if you like. Topics covered include: port scanning concepts, TCP three way handshake, stealth scans, idle scans, bounce scans, version detection, OS detection, NSE/LUA scripting and firewall logs. Hope some of you can make it to the free class we will be holding at Ivy Tech Sellersburg on Sept 20th, 2008 at 1pm. Contact me to RSVP. The video is about an hour long. Enjoy.]]> Sat, 06 Sep 2008 13:03:27 +0000 ivy tech sellersburg detection version detection security tool nmap bounce scans sept 20th presentation firewall logs free class Nmap presentation for the ISSA in Louisville Kentucky <![CDATA[Louisville ISSA Nmap presentation slides and media posted]]> http://securityratty.com/article/bbd469872f1364ae4fd2a7434ef471c1 http://securityratty.com/article/bbd469872f1364ae4fd2a7434ef471c1 Kentuckiana ISSA. You should be able to find the codec for the videos in the zip file.  If you plan to come to the free class at Ivy Tech (Sellersburg Indiana) on the 20th please contact me.

]]> Thu, 04 Sep 2008 17:07:08 +0000 nmap presentation ivy tech slides zip file media sellersburg indiana free class kentuckiana issa codec Louisville ISSA Nmap presentation slides and media posted <![CDATA[Louisville ISSA Nmap presentation slides and media posted]]> http://securityratty.com/article/f387eebef71a2cc826a73e5f487aa218 http://securityratty.com/article/f387eebef71a2cc826a73e5f487aa218 Kentuckiana ISSA. You should be able to find the codec for the videos in the zip file.  If you plan to come to the free class at Ivy Tech (Sellersburg Indiana) on the 20th please contact me.]]> Thu, 04 Sep 2008 17:07:08 +0000 nmap presentation ivy tech slides zip file media sellersburg indiana free class kentuckiana issa codec Louisville ISSA Nmap presentation slides and media posted <![CDATA[Blue Box SE#026 - Astricon 2007 presentation on VoIP security and Asterisk]]> http://securityratty.com/article/ceff3c168541790ec71113285297b6e6 http://securityratty.com/article/ceff3c168541790ec71113285297b6e6

Synopsis:  Blue Box Special Edition #26: Astricon 2007 presentation - "Hacking and Attacking VoIP Systems: What you need to worry about"

Welcome to Blue Box: The VoIP Security Podcast Special Edition #26, a 55-minute podcast  from Dan York and Jonathan Zar covering VoIP security news, comments and opinions.   

Download the show here (MP3, 6MB) or subscribe to the RSS feed to download the show automatically. 

You may also listen to this podcast right now:

Show Content:

A year ago in September 2007, I (Dan York) spoke at Astricon 2007 in Arizona, USA, about "Hacking and Attacking VoIP Systems: What You Need To Worry About" My presentation covered a lot of the typical VoIP security threats, tools and best practices but also expanded a bit into specific security issues with Asterisk.  Please do keep in mind that it has been a year since this presentation and so some of the issues I mention have been addressed. (Astricon, for those who don't know, is an annual developer conference for those who work with the Asterisk open source telephony platform. Astricon 2008 is, in fact, coming up in about 3 weeks but I will not be attending this year.)

The slides for this talk are available from Slideshare:

Hacking and Attacking VoIP Systems - What You Need To Know
View SlideShare presentation or Upload your own. (tags: voip voipsecurity)

(And yes, at some point I'll sync the audio with the slides.)

Production assistance on this Special Edition was provided by Michael Graves who had a very tough task given the poor quality of the recording that I gave to him!  Kudos to Michael for getting it to sound as good as it does.

Comments, suggestions and feedback are welcome either as replies to this post  or via e-mail to blueboxpodcast@gmail.com.  Audio comments sent as attached MP3 files are definitely welcome and will be played in future shows.  You may also call the listener comment line at either +1-415-830-5439 or via SIP to 'bluebox@voipuser.org' to leave a comment there. 

Thank you for listening and please do let us know what you think of the show.

]]> Wed, 03 Sep 2008 15:54:03 +0000 presentation astricon view slideshare presentation slideshare voip systems audio comments audio specific security issues listener comment line Blue Box SE#026 - Astricon 2007 presentation on VoIP security and Asterisk <![CDATA[Blue Box SE#026 - Astricon 2007 presentation on VoIP security and Asterisk]]> http://securityratty.com/article/f2bb50144dae112aaea9593bf1748c51 http://securityratty.com/article/f2bb50144dae112aaea9593bf1748c51

Synopsis:  Blue Box Special Edition #26: Astricon 2007 presentation - "Hacking and Attacking VoIP Systems: What you need to worry about"

Welcome to Blue Box: The VoIP Security Podcast Special Edition #26, a 55-minute podcast  from Dan York and Jonathan Zar covering VoIP security news, comments and opinions.   

Download the show here (MP3, 6MB) or subscribe to the RSS feed to download the show automatically. 

You may also listen to this podcast right now:

Show Content:

A year ago in September 2007, I (Dan York) spoke at Astricon 2007 in Arizona, USA, about "Hacking and Attacking VoIP Systems: What You Need To Worry About" My presentation covered a lot of the typical VoIP security threats, tools and best practices but also expanded a bit into specific security issues with Asterisk.  Please do keep in mind that it has been a year since this presentation and so some of the issues I mention have been addressed. (Astricon, for those who don't know, is an annual developer conference for those who work with the Asterisk open source telephony platform. Astricon 2008 is, in fact, coming up in about 3 weeks but I will not be attending this year.)

The slides for this talk are available from Slideshare:

Hacking and Attacking VoIP Systems - What You Need To Know
View SlideShare presentation or Upload your own. (tags: voip voipsecurity)

(And yes, at some point I'll sync the audio with the slides.)

Production assistance on this Special Edition was provided by Michael Graves who had a very tough task given the poor quality of the recording that I gave to him!  Kudos to Michael for getting it to sound as good as it does.

Comments, suggestions and feedback are welcome either as replies to this post  or via e-mail to blueboxpodcast@gmail.com.  Audio comments sent as attached MP3 files are definitely welcome and will be played in future shows.  You may also call the listener comment line at either +1-415-830-5439 or via SIP to 'bluebox@voipuser.org' to leave a comment there. 

Thank you for listening and please do let us know what you think of the show.

]]> Wed, 03 Sep 2008 14:54:03 +0000 presentation astricon view slideshare presentation slideshare voip systems audio comments audio specific security issues listener comment line Blue Box SE#026 - Astricon 2007 presentation on VoIP security and Asterisk <![CDATA[Nmap presentation and class in Louisville area]]> http://securityratty.com/article/fba5f949cefda2cf331d68c8dbb27300 http://securityratty.com/article/fba5f949cefda2cf331d68c8dbb27300 Kentuckiana ISSA chapter to give a presentation on Nmap and its use.  The event happens Sept 5, 11:30AM at the following location:

Innovative Productivity / McConnell Technology
401 Industry Rd, Louisville, KY 40208

The ISSA would like to have an RSVP. Also, I'll be giving a longer hands on demonstration and lab later on in September where people can bring their own laptops and use a private network to get some hands on experience with Nmap. We are not sure of all of the details yet, but it will likely be held Sept 20th at the Ivy Tech campus in Sellersburg, IN.

Also, this month's Louisville 2600 meeting is coming up on Thursday, Sept 24th. More details can be found here: http://louisville2600.org/

]]> Thu, 28 Aug 2008 15:03:44 +0000 sept sept 24th issa held sept 20th louisville nmap kentuckiana issa chapter ivy tech campus mcconnell technology Nmap presentation and class in Louisville area <![CDATA[Nmap presentation and class in Louisville area]]> http://securityratty.com/article/2f6458dad28d7d34cf1af16a26adb2a7 http://securityratty.com/article/2f6458dad28d7d34cf1af16a26adb2a7 Kentuckiana ISSA chapter to give a presentation on Nmap and its use.  The event happens Sept 5, 11:30AM at the following location:

Innovative Productivity / McConnell Technology
401 Industry Rd, Louisville, KY 40208

The ISSA would like to have an RSVP. Also, I'll be giving a longer hands on demonstration and lab later on in September where people can bring their own laptops and use a private network to get some hands on experience with Nmap. We are not sure of all of the details yet, but it will likely be held Sept 20th at the Ivy Tech campus in Sellersburg, IN.

Also, this month's Louisville 2600 meeting is coming up on Thursday, Sept 24th. More details can be found here: http://louisville2600.org/]]> Thu, 28 Aug 2008 15:03:44 +0000 sept sept 24th issa held sept 20th louisville nmap kentuckiana issa chapter ivy tech campus mcconnell technology Nmap presentation and class in Louisville area <![CDATA[Web Services and XML Security Training at OWASP]]> http://securityratty.com/article/6d12835067b0b2251fdc4b658b6928cc http://securityratty.com/article/6d12835067b0b2251fdc4b658b6928cc I am teaching Web Services and XML Security training at OWASP's AppSec conference in NYC, Sept 22-23. Web services provide the backbone that integrates many things in the enterprise from application servers, databases, ERP, and CRM.  Increasingly we are seeing Web services in more B2C roles with Rest, Federation and other technologies. The class looks at how Web services applications are built, what are common threats and vulnerabilities in Web services, and how to build your Web services application to defend against them.


I have often said that OWASP conferences are my favorite ones because they are in depth technically and very practical. I always look forward to teaching at OWASP and the speaker lineup for this conference looks excellent.

Here is a quick list of tools we have used in past classes

Web Services frameworks
Apache CXF - very interesting open source Web services framework with support for JMS, SOAP, and Rest
Apache Axis & Axis2
.Net
Metro - interesting framework from Sun for interop with WCF

Identity 
PingFederate - leading federation tool, we'll look at browser based SSO with SAML
PingFederate Web Services - we'll look at how to implement a STS in Web services
Bandit - Cardspace, authorization, and auditing

Security Services
VordelSecure - XML gateway, comprehensive web services security policy creation and enforcement, deploying decentralized security services
Apache Ramparts
modecurity

Testing
Soapbox - web services security testing
WebScarab - web services fuzzing

Static Analysis
Fortify SCA - how to scan your web services code for security bugs *before* you deploy


This is just a quick list, new tools are added periodically. If you are using tools of these types in your company you may find it interesting to attend.

Testimontials on past classes

"High quality detailed overview of SOA security standards and approaches. Well thought-out and structured presentation."
- Sr. IT Architect, Fortune 10 enterprise

"The knowledge and transfer was a great baseline and with the additional resources Gunnar made available, made this one of the best one day classes I've taken."
- IT Security Lead, Fortune 10 enterprise

"This class was a thorough and well-organized trek through the current Web Services Security landscape. Going beyond just describing the standards and the options available in the Web Services Security world, this class discusses real-world use cases and offers implementable solutions, best practices, even vendor choices in several key areas.  This class provided me with actionable tasks that I took back to my project teams the very next day!"
-Jesse Aalberg, Sr. Enterprise Application Architect, United Healthcare

"The class was distinctly focused on Security requirements and the strength and weaknesses of the various solution approaches we could consider. The result of the course was actionable approaches to providing security in our SOA environment."
-Brad Sillman, Director IT Security, Deluxe Corp.

"Anyone who wants up-to-date information on SOA Security, security standards and best practices should take this class."
-Kevin Beam, Senior Systems Engineer, Union Pacific Railroad

"Good comprehensive overview of subject, standards, and threats" 
- Sr.Security Consultant, Ubizen

"The class helped me get my head around what "SOA" and WS-Security is really all about"
- Mike Zusman, Independent consultant

"Topics addressed are timely and relevant. Labs are hands-on and help see concepts in action"
- Jerry Tan, Systems Analyst, DTCC

"This class was concise and covered a majority of the problem set my company is looking at and dealing with." 
- Steve Reilley, Technical consultant, Commerce Insurance

"Excellent two day overview of security topics as related to Web Services."
- Daniel Reznick, Information Security, ADP

"Issue affecting most of us today & for those that don't - will soon. Very necessary education and technology."
Aaron Delashmutt

"Great class! Effective and relevant teaching in an area without much guidance."
- Mark DiSabato, Senior Information Security Architect, Roche

"The class cut through jargon to communicate concepts and implementation details."
- Developer, Fortune 100 insurance company

"Good overview regarding SOA Security. Contains new technology like AMQP and REST" 
- Lars Loland, Statoil

"The course covered what I had to learn about Web services"
- Sven Vetsch, Dreamlab Technologies

"Very good, eye opening especially for websecurity noob."
-Michael Brandon

"Presenter has very broad and deep technical knowledge on subject. Content: good overview and comparison of SAML and WS-*"
- Security consultant, ING

"Good to learn where our application is vulnerable to attacks and how we can avoid them."
- Application Development Programmer Lead, Fortune 100 Insurance company

"Entirely thorough overview of technology surrounding the use of web services with a 1 day presentation"
- Technical consultant Contextis

"Gave a good overview of the Web services security environment"
- Francesco Degrassi, Emaze Networks

"A great entry point for securing your web services"
- Stig Kluver

"Lots of good technical information about an emerging area that's very useful"
- Rory McClune, HBOS PLC

"This class reinforced the importance of software security assurance to me as it lucidly demonstrated why being 'behind the firewall' is an outdated concept."
-Senior Support Engineer, Software Security vendor

"The area of SOA Security is complicated and youg. A course such as this helps bring it into focus."
-Jayme Frye, System Engineer, Union Pacific Railroad

"Web services security class provided application security concepts valuable for applications audits."
- Mary Ma, IT Auditor, DTCC

"Very knowledgeable coverage of security requirements for Web services."
- David Libershal, Network Security Engineer, Johns Hopkins University Applied Physics Laboratory

"WS/XML security is not a "black art", but you do need to know about it to be able to take it into consideration."
- Applications Specialist, Global 500 manufacturer

"Good overview of techniques worth considering when planning secure apps"
- EAI Specialist, Leading Mobility company

"Brought concepts in very easily understood terms."
-Glenn Bernard, Systems Engineer

"Gives ideas about the latest Web services security standards in the industry"
- Security Coordinator, Global 500 manufacturer

"Class cleared up various WS-* standards and gave great concrete examples of how to build a message using each standard. Very good general thoughts on security groups' role in IT."
- Matt Kasselman, UP Systems Engineering

"I found this very useful as an IT architect in a "security critical environment"."
- Mika Pullinen, IT Architect, Finnish Defense Forces

"Lots of useful information packed in a small amount of time. Good overall picture."
- Jari Pirhonen, Security Director, Samlink

"Gunnar is very knowledgeable about security topics and has a great ability to explain complex ideas using simple, appropriate, and amusing language and analogies."
- Scott Redd, Sr. Project Engineer, Union Pacific

"Excellent instructor who had a good pace to go through the presentation" 
- Anna Vaahtokan, Specialist, Nordea

"Good application security principles."
- Tuomas Kivinen, IT Security Specialist, Nordea

"I liked the class quite a bit. I took it in a "survey mode" where I wanted to learn about topics at a high level, and this was accomplished. It was good to listen to those in the class that were much more familiar with SAO than I."
- John Glazeski, Senior Systems Engineer

]]> Thu, 28 Aug 2008 04:55:59 +0000 security soa security standards security standards soa security soa security critical environment information security information application security principles Web Services and XML Security Training at OWASP <![CDATA[Blue Box #81: iSkoot vulnerability, OFCOM legislation, VoIP security news and more]]> http://securityratty.com/article/40c512ffa3724f6d4a41f0c63caad84d http://securityratty.com/article/40c512ffa3724f6d4a41f0c63caad84d

Synopsis:  Blue Box #81: iSkoot vulnerability, OFCOM legislation, VoIP security news and more

Welcome to Blue Box: The VoIP Security Podcast #81, a 42-minute podcast  from Dan York and Jonathan Zar covering VoIP security news, comments and opinions.   

Download the show here (MP3, 19MB) or subscribe to the RSS feed to download the show automatically. 

NOTE: This show was originally recorded on May 21, 2008.

You may also listen to this podcast right now:

Show Content:

Comments, suggestions and feedback are welcome either as replies to this post  or via e-mail to blueboxpodcast@gmail.com.  Audio comments sent as attached MP3 files are definitely welcome and will be played in future shows.  You may also call the listener comment line at either +1-415-830-5439 or via SIP to 'bluebox@voipuser.org' to leave a comment there. 

Thank you for listening and please do let us know what you think of the show.

]]> Tue, 26 Aug 2008 17:16:43 +0000 voip voip security news voip users based enterprise voip planet voip calls voip privacy security voip news voip security podcast Blue Box #81: iSkoot vulnerability, OFCOM legislation, VoIP security news and more