|
|
|||
 |
 |
|||
Video Library
Skimming for ID theft
Views: 179 Comments: 1 11-01-2008 00:18 Latest version of ATM skimmer hidden behind a speaker looking device
Views: 193 Comments: 0 11-01-2008 00:11 ATM Scam, do check your ATM machine before using it
Views: 180 Comments: 1 10-31-2008 23:59 CyberSecurity NBISEForums Posts Environment for testing tools help Jersey City, NJ, United States Welcome to the GCIA Certification from SANS/GIAC Study material besides the official SANS books How to prepare effectively for an exam Which is better for my friend's career Magazines For SEO Security+ Study Mailing list Study material for SEC+ Smart cards and certsMethodologiesRecommended PodCastsRecommended SitesSecurity BlogsAJAX Blog LEGAL INFO BLOGS Security ForumsBest Downloads· 1: Web Application Testing Cheat Sheet
· 2: Reconnaissance CheatSheet · 3: Sample Get out of Jail Card by Clement · 4: NMAP and Nessus Cheatsheet from Skillz · 5: Tool Matrix for CEH Exam V1 · 6: Advanced/Other Techniques for ByPassing Firewalls · 7: NIST Guidelines on Network Security Testing · 8: The ISSAF Framework · 9: The beginner guide to Wardriving · 10: Brute Force Exploitation of Web Application Session ID Best Web Links· 1: Binary Revolution Hack TV
· 2: Iron Geek Hacking Tutorial · 3: Root Secure Videos Links · 4: UnderGround Film · 5: Domain 1 - System Security - Flash Based Tutorial · 6: AEROSOL · 7: Hack this site! · 8: ExitFrame · 9: PacketSniffers.Org · 10: Moloch TV SurveyWho's OnlineThere are currently, 86 guest(s) and 0 member(s) that are online. You are Anonymous user. You can register for free by clicking here |  |
2nd. OWASP Ibero-American Web-Applications Security conference 2010 (IBWAS 10)
|
|||||||||||||||||
 |
Taking Penetration Testing In-House
Weighing the risks and benefits of do-it-yourself pen testing
By Keith Ferrell, Special To Dark Reading, DarkReading
April 16, 2010
URL:http://www.darkreading.com/story/showArticle.jhtml?articleID=224400589
Conducting penetration testing in-house rather than using an outside consultant is worth considering for reasons of both cost and security expertise -- but it's also a step not to be taken lightly.
"The advantage of having in-house penetration testers is the focus they provide," says Chris Nickerson, founder of security firm Lares Consulting. "They're able to keep track of the latest exploits and vulnerabilities, constantly monitor systems, and practice and sharpen their skills. But in order to achieve those benefits, they have to be focused. "
Nickerson points out that while some really large enterprises are fielding teams wholly dedicated to testing, for most companies pen tests are only part of the testers' responsibilities. "It's all too common to find penetration tests delayed or put off because the tester has too many other open tickets to deal with," he says.
While even a part-time pen-test specialist on staff can be a step in the right direction, it can also be risky. "The variety of tools available for pen tests today is remarkable, and I pretty much applaud them all," he says. "Metasploit, Canvas, Core, Nessus, and others have spent a lot of time ensuring that installing their agents don't blow the boxes that are being tested. That's the default: Once the agent is installed and it's determined whether or not the exploit works, the agent is uninstalled."
The problem is, the tools also offer high levels of tuning and customization, which in inexperienced hands can lead to problems, Nickerson notes. "The tools themselves aren't a particular danger, but with an inexperienced tester driving and tuning those tools, there's some risk of something going wrong," he says.
Steve Stasiukonis, vice president of Secure Network Technologies, makes a similar point. "Hit a critical server too hard and you can create all sorts of problems," he says. "Even a telnet or pingsweep needs to be run with extreme caution when you're testing the most sensitive systems."
That sort of caution comes as a result of both experience and acquired expertise, Stasiukonis suggests, neither of which are included in off-the-shelf testing products. "Working your way up the ladder takes time, and there's no way around that," he says.
It's best to stage the introduction of internal penetration tests, Nickerson says. "The most business-critical systems should only be approached by the most experienced testers, whether they're internal or consultants from outside the organization."
Can even the most experienced and expert in-house pen tester mount fair tests? Does their unavoidable knowledge of the company they work for automatically compromise their ability to approach their tests as an outsider would? "No question," Stasiukonis says. "But more than that, there's the risk that an internal tester will be too easy on some aspects of the company. Strict password rules, for instance, are one area where in-house testers are sometimes too lenient on the people they work with."
More troubling for him is the potential for in-house testers to overestimate their knowledge of the company they work for. "It's too easy for a staff tester to assume they know everything about the company and its systems, particularly with larger companies. They test against the numbers they know and end up overlooking whole segments or even whole networks."
And company awareness that a pen tester is on staff can compromise the tests, too. "The point of pen testing is to see if your defenses are effective against real-world threats," Nickerson says. "Making the company aware that tests are going on [takes] away that real-world aspect."
He suggests testers notify only those personnel who must know of tests for business and operations criticality reasons.
Perhaps the most frequently touted benefit of in-house testing is cost savings. But there are levels of consideration to take into account here, as well. Nickerson argues that cost must be approached not only from the standpoint of in-house personnel dedicated to pen testing versus the cost of outside pen testers, but also the return on investment of the in-house investment. That investment's return, he says, can extend far beyond the tests themselves and even the security benefits of having skilled testers on staff.
Among the chief returns derived from having an in-house penetration tester or team is education -- the testers' ability to communicate clearly and pointedly why pen testing is a vital component of an aggressive security posture, Nickerson says. Another point to be made: why testing, whether in-house or outsourced, trumps vulnerability assessments.
"Automated vulnerability scans generate a lot of information that may not be 100 percent accurate, may not apply to the company's most critical processes, and may not mean a lot to a not particularly tech-savvy CFO or other executive," he says. "The information is at a lower level of resolution than an effective pen test provides."
An experienced penetration tester, he says, can show the executive exactly why penetration testing is a worthwhile investment.
For example, tell an executive that you have X number of vulnerabilities, and the message may or may not get through. "But show the CFO how those vulnerabilities allow the company's general ledger to be altered and, in doing so, fundamentally alter the history and course of the company, and you've delivered a driver that they can really understand," Nickerson says. "You've provided a clear picture of the real-world impact that vulnerabilities can have, and you've increased the company's security education at the same time."
Nickerson believes the constantly evolving and mutating threat environment will have more and more companies considering the addition of internal penetration testing. "The important thing is to provide the testers with the time and focus that lets them concentrate wholly on testing and on keeping their skills and knowledge up-to-date," he says. "Companies need to keep an eye on the tipping point where leveraging external expertise costs more than investing in having an expert penetration tester on the inside."
Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.
Copyright © 2007 CMP Media LLC
"(comments? | Score: 0)
HITB Amsterdam final call for Paper
Posted by cdupuis on Thursday, 08 April 2010 @ 14:53:52 EDT (1209 reads)
Topic Training
This is the FINAL CALL to submit your talk / presentation proposals for the inaugural HITB Security Conference in Europe!
Submissions are due by 19TH APRIL 2010.
HITBSecConf2010 - Amsterdam takes place at the Grand Krasnapolsky
From the 29th of June till the 2nd of July (Tuesday - Friday)
With keynote speakers Anton Chuvakin and Mark Curphey
This is our first ever QUAD TRACK conference.
To submit your presentation proposals and for further details on our submission process, please see:
http://cfp.hackinthebox.org/
On a related note, online registration for HITBSecConf2010 - Dubai is closing on the 14TH OF APRIL - Walk in registrations are still accepted thereafter.
http://conference.hitb.org/hitbsecconf2010dxb/register/
See you there!
---
Hafez Kamal
HITB Crew
Hack in The Box (M) Sdn. Bhd.
Suite 26.3, Level 26, Menara IMC,
No. 8 Jalan Sultan Ismail,
50250 Kuala Lumpur,
Malaysia
Tel: +603-20394724
Fax: +603-20318359
(comments? | Score: 0)
The Honeynet Project Forensic Challenge 2010
Posted by cdupuis on Sunday, 28 February 2010 @ 09:42:45 EST (620 reads)
Topic Training
The Honeynet Project has revived an successful program from the past: The Honeynet Project Forensic Challenge 2010. The purpose of the Forensic Challenges is to take learning one step farther. Instead of having the Honeynet Project analyze attacks and share their findings, Forensic Challenges give the security community the opportunity to do so. In the end, individuals and organizations not only learn about threats, but also learn how to analyze them. Even better, individuals can access the write-ups from other individuals, and learn about new tools and techniques for analyzing attacks. Best of all, the attacks of the Forensic Challenge are attacks encountered in the wild, real hacks, provided by our members.
It has been several years since we provided Forensic Challenges and with the Forensic Challenge 2010, we will provide desperately needed upgrades. Currently, we are running our second challenge provided by Nicolas Collery from the Singapore Chapter and Guillaume Arcas from the French Chapter. It deals with client-side attacks and is titled browsers under attack. (accessible at https://www.honeynet.org/challenges/2010_2_browsers_under_attack)
The deadline for submissions is Monday, Match 8th 2010 and results (including a sample solution) will be posted on Monday, March 22nd 2010. The top 3 submissions will be awarded with prizes.
Christian Seifert
Chief Communications Officer
The Honeynet Project
(comments? | Score: 0)
REC0N 2010 MONTREAL CANADA JULY 9-11
Posted by cdupuis on Friday, 05 February 2010 @ 09:29:31 EST (1450 reads)
Topic Training
R E C O N 2 0 1 0 .
Call For Papers (C F P)
REC0N 2010
MONTREAL
JULY 9-11
+ RECON returns for 2010
- Training sessions + conference
+ We are accepting submissions
- Single track
- 45-60 minute presentations, or longer, we are flexible
- There will be time for short, informal lightning talks
+ Especially on these topics
- Reverse engineering (Software, Protocols, Hardware, Human)
- Exploit development and vulnerability assessment
- Data analysis and visualization techniques
- Crypto and anonymity
- Physical security countermeasures
- Anything elite
+ Please include
- Speaker name(s) and/or handle
- Contact information (e-mail and cell phone)
- Brief biography
- Any presentation Supporting materials
- Why it is cool and/or why you want to present it
+ You want to speak!
- Please send the above information to cfp2010 (at) recon.cx by 15 May, 2010
You can visit the main site at: http://www.recon.cx/2010/index.html
(Read More... | Score: 0)
STRATEGIC SECURITY TESTING WEBCAST by Dr. Eric Cole
Posted by cdupuis on Thursday, 21 January 2010 @ 22:03:37 EST (835 reads)
Topic Training
STRATEGIC SECURITY TESTING WEBCAST
Cutting-Edge Attack Techniques” – featuring Dr. Eric Cole,
SANS fellow and senior scientist with Lockheed Martin Information Technology.
Dr. Eric Cole, SANS fellow and senior instructor
Host: Core Security Technologies Date: Wednesday, January 27, 2010
Time: 2pm EST / 11am PST (GMT -5:00, New York)
Register: http://www.coresecurity.com/Form/generic/campaign/cuttingEdge
A recording of the webcast will be sent to everyone who registers, so be sure to sign-up even if you can’t make the live session.
In this webcast, noted security and penetration testing expert Dr. Eric Cole will share his insight into how organizations can rapidly improve their resiliency to today’s most advanced malware and hacking techniques via more frequent and proactive assessment. Attackers continue to take advantage of widespread security vulnerabilities located throughout the enterprise IT stack to infiltrate sensitive assets and access protected data, perhaps best evidenced by the recent IE zero day attacks that compromised massive companies including Google. Register here: http://www.coresecurity.com/Form/generic/campaign/cuttingEdge
Best Regards,
Core Security Technologies
41 Farnsworth Street Boston, MA 02210
http://www.coresecurity.com
http://blog.coresecurity.com
http://www.twitter.com/coresecurity
(Read More... | Score: 0)
nullcon Goa, India, 2010 International Security & Hacking Conference
Posted by cdupuis on Thursday, 14 January 2010 @ 10:08:12 EST (960 reads)
Topic Training
NOTE FROM CLEMENT:
GOA is an amazing place with georgous beaches and everything is VERY inexpensive. I was there last spring to deliver training and I had a really great time. If you have the chance, do combine your training with a few days on the northern beach where you have miles and miles of deserted beaches almost to yourself. Here is the announcement about the conference:
Hi all,
null is proud to announce the launch of it's security & hacking conference nullcon Goa 2010 nullcon Goa 2010, India's first 'community' driven security & hacking conference will bring together Security Researchers, security professionals, vendors, CXOs, Law Enforcements agencies from all over the country to a common platform to discuss latest research in field of Information Security and in particular the major security threats faced by everyone today.
We are extremely thankful to SANS for providing us a free seat as a prize for the hacking challenge winner at nullcon for their SEC 504: Hacker Techniques, Exploits & Incident Handling class (worth USD 4095) to be held in Feb at the Ramada Bangalore.
Details of the class can be found at: http://www.sans.org/india-2010/
email: AsiaPacific@sans.org
nullcon is one of a kind of conference showcasing the latest research and trends in information security by renowned security researchers/professionals. Any conference cannot be successful without the right audience. That's why your presence is very essential for making nullcon successful.
Website: http://nullcon.net
Legend:
** - BONUS Talk
+ - new(new version)Tool being released
First list of speakers (not in any specific order):
**0. Anonymous - Desi Special(pronounced pay-sul, as in chai) Hacking
+1. Abhisek Datta - Software Fuzzing with Wireplay
2. WhiteKnight - The art of cyber-warfare
3. Veysel Ozer - The evil Karmetasploit upgrade
+4. Anant Kochhar - Malware detection tool for Websites - A proof of Concept
5. Cassio Goldshmidt - Tracking the progress of SDL program
6. Vinoth Sivasubramanian - Defending Industrial espionage in Today's
Environment.
7. Vishwas Sharma & Amandeep - Intelligent Debugging and in-memory fuzzing.
+8. Lavakumar Kuppan - Imposter ke Karnamey: The browser phishing tool
9. Harshad Patil - Botnet mitigation, monitoring and management.
10. Prince Komal Boonlia - Steganography: Data hiding and Data Carving
11. Bhaskar Jain - Incomplete implementation of SAML
12. Navin Pai - Quantum computing: Challenges in the field of security
nullcon Details
--------------
Dates: 6-7th Feb 2010
Venue: The Retreat by Zuri,
Pedda, Uttor Doxi, Varca, Salcete
Goa 403 721
INDIA
Registration:
------------
Conference Pass - INR 2000/- (till 15th Jan 2010, avail the discounted
price now)
Details: http://nullcon.net/register
We are also accepting offline registrations for Conference Pass (and
stay at The Retreat, if required).
About null:
null - The open security community is a non-profit community with
focus on spreading security awareness, advanced research in security
and helping govt. and private institutions with security related issues.
website: http://null.co.in
Thanks to our sponsors:
Gold Sponsor: SANS http://www.sans.org/india-2010/
Bronze sponsor: Timblo Group www.timblos.com
Best Regards,
null Team
(comments? | Score: 0)
26C3 THe world largest hacker conference in Berlin - Recording now online
Posted by cdupuis on Thursday, 14 January 2010 @ 05:55:23 EST (1103 reads)
Topic Training
The 26th edition of the world's largest annual hacker conference, 26C3, took place in Berlin last week.
With about 2,500 attendees, a combined total of 9,000 participants worldwide (via live streams), and
an array of features that no other conference in the world can match, it was very much a milestone.
You can get the conference recording at:
http://events.ccc.de/congress/2009/wiki/Conference_Recordings
(comments? | Score: 0)
ClubHack presentations and photos are now online
Posted by cdupuis on Monday, 04 January 2010 @ 19:01:42 EST (931 reads)
Topic Training
ClubHack2009 presentations and photos are online.
Presentations: http://clubhack.com/2009/presentations
Photos: http://www.flickr.com/photos/tags/clubhack09/
thanks
team ClubHack
Presentations
| Rohas Nagpal - Indian IT Act 2000 vs 2009
|
Manindra Kishore - Incident Handling and Log Analysis for Web Based Incidents  |
|
Anant Kochar - Revealing the Secrets: Source Code Disclosure, Techniques and Impacts |
Abhijit Tannu - Facilitate Collaboration with Information Rights Management
|
|
Nikhil Wagholikar in abstentia of K K Mookhey - Risk Based Penetration Testing |
Suhas Desai - Open source for securing data with advanced Crypto-Steganography technology
|
|
Vinoo Thomas & Rahul Mohandas - India Cyber Crime Scene - Caught in the Crossfire |
Lavakumar Kuppan - Lust 2.0 – Desire for free WiFi and the threat of the Imposter
|
|
Kush Wadhwa - Advance Computer Forensic concepts (windows) |
Gursev Singh Kalra - Mobile Application Security Testing
|
"
(comments? | Score: 0)
CarolinaCon Call for Paper
Posted by cdupuis on Friday, 25 December 2009 @ 11:53:29 EST (1755 reads)
Topic Training
CarolinaCon is now accepting speaker/paper/demo submissions for its 6th annual event in March 2010!!!
What is this "CarolinaCon"?
CarolinaCon is an annual Technology Conference whose mission/purpose is to:
- Enhance local and global awareness of current technology issues and developments,
- Provide affordable technology education sessions to the unwashed masses,
- Deliver varied/informative/interesting presentations on a wide variety of InfoSec/hacking/technology/science topics, and
When/Where is CarolinaCon?
This year's event will be held on the weekend of March 19th-21st, 2010.
The event will mostly occur at a Holiday Inn in Raleigh, NC. Raleigh is about 30 minutes from Durham, Chapel Hill, and Research Triangle Park.
Who develops/delivers CarolinaCon?
CarolinaCon is proudly brought to you by "The CarolinaCon Group".
The CarolinaCon Group is a non-profit organization registered in the state of NC, dedicated to educating the local and global communities about technology, information/network/computer security, and information rights.
What events will be at CarolinaCon?
CarolinaCon is mainly about the talks/presentations/demos. Alongside of those we'll surely have several other technology-related contests/challenges, as we've had in past years. Details on other events will be announced soon.
Who will be presenting which topics this year?
That's where YOU possibly come in. If you are somewhat knowledgeable in some interesting field of technology, hacking, science, etc., and are interested in speaking/presenting at CarolinaCon, we invite you to submit your proposal (in brief) for our review. If you're interested in presenting please send;
- your name or handle,
- the topic/presentation name,
- estimated time-length of presentation, and
- a brief topic abstract
....via e-mail to:
speakers carolinacon.org
*NOTE:
All submissions are due BY January 29, 2010! Please be timely in submission if you're committed to being part of the elite cadre of presenters. We value diversity, so please don't hesitate to propose
your ideas no matter how outlandish.
If you speak at the Con, you will receive;
- free Con admission for you and one guest,
- a free Con t-shirt,
- minimal fame, glory, and possibly notoriety, and
- mad props from our staff and attendees
I'm excited and I want to present! What do I do know?
If you're interested in speaking, send the 411 requested to:
speakers carolinacon.org
(BY/BEFORE January 29th 2010)
And if you're interested in attending, watch this space for more details:
www.carolinacon.org
...and don't forget to mark the dates on your calendar!
Peace,
Vic
(Read More... | 22 comments | Score: 0)
Our Sponsors
Login
Latest Windows Tools
·Comodo Internet Security 5.0.161695.1120 RC
·WinGuard Pro 7.3.5
·Rising PC Doctor 6.0.2.39
·CCleaner 2.35.1223
·REFOG Personal Monitor 6.2.2.1107
·BestCrypt 8.20.7.2
·Wireshark 1.4.0
·Outpost Security Suite Pro 7.0.3 (3392.517.1242)
·Spytech SpyAgent 7.20.10
read more...
Latest Linux Tools
Virtual Machines VM's
IBM Virtualization
MS Virtual Server
Parallels Software
Virtual Box
Virtual Iron Inc.
Virtuozzo
VMWare Server
VMWare Player
VMWare Appliances
XEN
------------------------
Download VM's
------------------------
Enspeed Collection
Linhost VM Collection
VirtualAppliances.Net
VMPlanet.Net
VMWare.Com
ThoughtPolice
Hacker's Magazine
Web & Apps Security
Scanning Service
AlertSite
Counterpane
Critical Watch
Qualys
SecureWorks
SecuritySpace
VSS
OFFLINE SCANNERS
Acunetix
ISS/IBM Scanner
Nessus
Retina
Saint
Reverse Engineering
Vulnerabilities Research
Big Story of Today
2nd. OWASP Ibero-American Web-Applications Security conference 2010 (IBWAS 10)
Old Articles
Older Articles
You can syndicate our news using the file backend.php or ultramode.txt
All logos and trademarks in this site are property of their respective owner. The comments are property of their posters, all the rest © 2003-2008 by Clement Dupuis and Nathalie Lambert (Site Maintainers).
- Home Page
- TRAINING
- Network Penetration Testing and Ethical Hacking (GPEN)
- Network Penetration Testing: Maximizing the Effectiveness of Reports, Exploits, and Command Shells
- Hacker Techniques, Exploits & Incident Handling (GCIH)
- Defending Web Applications Security Essentials
- Security Essentials Course (GSEC) Bootcamp Style
- Wireless Ethical Hacking, Penetration Testing, and Defenses (GAWN)
- Reverse-Engineering Malware: Malware Analysis Tools and Techniques (GREM)
- Computer Forensic Essentials
- Computer Forensics, Investigation, and Response (GCFA)
- Essential Secure Coding in Java/JEE
- Start Here First
- GSEC
- FOR MEMBERS
- GPEN
- CONTRIBUTE
- GCIH
- CONFERENCES
- CEH Certification
- TOOLS
- QEH Certification
- CONTACT US
- Security+ CompTIA
Page Generation: 0.64 Seconds