BSides St. John's, 2012

Today I attended the BSides  security conference in St. John's, Newfoundland. Although it's not particularly an area of interest or an area pertinent to my current position, there were some interesting talks.

Mark Nunnikhoven talks about three things he believes we should be using more (in ops):

1. Automation is key.

   • Stop doing repetitive tasks, because that's what computers were designed for!

2. Document everything.

   • Comments help keep you on track and simplifies the ramp-up process
   • Use plain text documents instead of word, because it's more likely to be read. Need something more readable? Use something like markdown, which is human-readable, but with more semantics.

3. Don't focus on awareness, educate.

   • Engage users and integrate them into the flow.

Jamie Goodyear introduces us to the process of submitting a vulnerability report to Apache whenever some exploit/vulnerability exists in an Apache project. Roughly, this process goes like the following:

1. Report the vulnerability
2. Investigation into whether or not the problem is pertinent to the project
3. Common Vulnerabilities and Exposure (CVE) number requested (internally)
4. The project team discusses and agrees on a fix
5. Release
6. Announcement for the fix, with full disclosure of the vulnerability

This is followed with a section on secure release management. Apache focuses on two technologies:

1. MD5 hashes for all artifacts released
2. PGP signatures to verify the release came from a trusted source

Russ Doucet talks about webfiltering and making the right web use policy in your company:

• A typical webfilter may
  • Monitor/log/report everything
  • Blocking by categories and sub-categories
  • Block unknown sites
• One should have
  • Policy, to ensure consequences are clear. The policy needs to be clear.
  • Webfiltering, so that action is being taken.
  • Monitoring, e.g., for referencing of multiple offences.

Karim Nathoo introduces us to interesting of dealing with C2 (command and control), a malicious piece of code or software that facilitates controlling and/or ex-filtrating data on a system, and Exfiltration, the process of extracting data from a secure system. He shows several examples using file sharing services (e.g., Box.net, DropBox) and DNS tunneling.

Kellman Meghu takes us on a whimsical journey into data loss incidents, using a "Star Wars" perspective on how to do security. The moral was simple: the most basic security policies are often the ones that mitigate issues.

Darryl MacLeod gave his opinion on becoming a Certified Information Systems Security Professional (CISSP), and what he felt it has done for him. To sum up his opinion: "it's worth it."

Symantec representative Stefano Tiranardi talks about the internet security threat report from 2011. Four trends were discovered:

1. Malware attacks up 81%
2. Targeted attacks expand
3. Mobile threats expose all
4. Data breaches on rise

Bruno Germain focused on how he believes it's time for security to consider a different model for defending one's systems. He introduced a service-centric approach to security.