Tag Archives: InfoSec

AnyCon 2017 Review

I will preface this review by stating that putting on such events is by far not an easy task.  There is a ton of planning that goes into these.  On the day of the event not everything will go as planned and you will have to improvise.  Speakers will pull out, a sponsor may not deliver, or your CTF has a bunch of technical problems.  But you push through and rely on your team to help you through it.

On to the review…

This past weekend I was able to attend the first annual AnyCon security conference which took place at the Albany Capitol Center.  Overall, it was not a bad conference for a first time run.  It was the typical large conference setup with keynotes from Dave Kennedy (TrustedSec, Binary Defense, DerbyCon) and Sanjay Goel (University of Albany).  There were three tracks – Offensive, Defensive, and Educational.  For the full track listing you can hit the site up http://www.anycon.info/agenda/.  In between the talks you could head over to their onsite CTF, hardware hacking village, or play some ping pong.

The Content – As expected for a first run conference.

It was your typical set of conference talks.  Irongeek (Adrian Crenshaw) has them all posted up on his YouTube Channel.  I will let you be the judge of their quality.  Some of the talks certainly showed that pool of submitted content was not very deep and no real due diligence was done to vet the speakers.  One speaker, in fact, claimed during his talk that he single-handedly brought down the Teslacrypt C2 servers and forced the attackers to cease their DDoS attacks on his employer’s network.  That prompted some investigation by conference attendees on the legitimacy of the speaker, there is a pretty entertaining thread on Twitter.  But these things happen and will continue to happen so long as proper vetting isn’t done.  But as a first run conference, you can’t be too picky.  Speakers are not exactly knocking down your door to get accepted.  But that all comes with time.

It was pretty clear their target audience was not the seasoned professional, but that is ok.  In fact, you are hoping that those guys and gals will fill in your talk slots.  There were a good number of students attending which, I think, is great!  Hopefully they came away with more than I did from the conference and will continue to grow their skills and get out to some of the bigger conferences.

The Cost – No swag, no food, what did my 125 bucks get me?

When deciding to put on such an event, the topic of cost will be a big piece of the puzzle.  The goal should be to keep the cost low for the attendees.  Not many people are going to want shell out a ton of cash for a first run conference.  Even with the cost of $125 for a non-student, I still registered to attend as I am an avid supporter of furthering the education of the community and Albany is not a far drive.  Unfortunately, I left the conferencing wondering what I actually paid for?  I didn’t get any real swag besides what was available at the vendor tables, no free conference t-shirt, the badge was a basic plastic card badge, there was no breakfast or lunch provided on either day.  I’ve attended BSides events with a much lower cost to register ($20 or less) that included a t-shirt, breakfast, and lunch.  That is what your sponsors are for!  Your purpose for this first run conference should be to get people in the door so that they will come back next year.  As your conference grows you can bump the cost up as the demand to attend may increase.  Now, thankfully, not everyone had to pay the higher cost.  Students were offered a $50 ticket, still pretty high in my opinion.  Hopefully they pay attention to their feedback survey and work to bring the costs down or at least offer more to justify it.

Other thoughts…

Time management certainly needs some improvement.  It did not appear that any of the talks had a time keeper.  This caused the more long-winded speakers to go well over their allotted time which ate into the next speaker’s block.  Things like this can certainly throw off the whole schedule if your talks are tight.  But you will luck out during these first runs by the less experience speaker ending early.  After the keynote on Friday, there was little direction from the conference organizers on logistics.  There was no mentioning of lunch possibilities or plans for later that evening.  We were kind of left to figure that out on our own.  You need to assume that there may be a fair amount of people coming in from outside the area.  You don’t need to have a big party but you should look to the sponsors for possibly hosting a happy hour.  After the last talk, attendees just sort of went off on their own as they were not sure what else to do.  Again, if I was paying $20 bucks for a BSides event, it probably wouldn’t be a big deal, but this was close to the same price as DerbyCon but with a fraction of the content.

Summary of suggestions for next year:

  • Better time management.
  • Better vetting of speakers – don’t pollute the minds of the young by subjecting them to charlatans!
  • Swag bag – give me something to take back with me other than your event program!
  • Food, at least cover breakfast for those driving in the morning of the event.
  • Keep in contact with the attendees throughout the event, not just at the beginning and the end.
  • Look at adding a lock picking village separate from the Hardware hacking village.
  • Make the CTF an internet based one so people can work on it from their hotel rooms.

InfoSec Career “Quick-start” guide

  1. Install Kali
  2. Pwn all the things
  3. Collect big paycheck!

So what I really want to accomplish with this post is to provide a series of sources to help you get going in your infosec career.  I had a much longer post going on about building a good base of other technical skills and such but lets just get to the meat of it.

Online Training

Free Resources:

  • Codecademy – Offers a number of free courses with added features if you upgrade to a pro subscription.  Great place to learn Python and Ruby.
  • Udacity – Much wider selection of programming courses, possibly better place to start for you App Sec types.
  • Microsoft Virtual Academy – Yes, even MS has a ton of free training resources.  Powershell to .NET C#!

Paid Sources

  • PluralSight – 30 bucks a month and a free trial.  They cover a wide variety of topics from CISSP to OWASP Top 10 for .NET with Troy Hunt.
  • ITProTV – Covers a wide variety of content spanning IT, probably a good place to start if you need to build up those base skills.  A bit pricier than PluralSight but has a stronger focus on IT in general.  Also you can probably find a discount code if you listen to Paul’s Security Weekly.

Podcasts

  • Security Weekly – They have expanded beyond the initial Security Weekly podcast to cover Enterprise, Startups, and Securing your digital life.  Listen to them all or pick and choose!  The team is great and you can’t go wrong, they will get you asking “What is the problem we are trying to solve??”
  • Risky Business – Covers the weekly security news from an Aussie perspective and includes special segments and interviews.
  • Southern Fried Security – Weekly-ish topical security discussions from the south.
  • SANS Internet Storm Center (ISC) – a quick 5-7 minute daily micro-cast covering security highlights.

Social Media

Twitter – Pretty much start with the people who host the above podcasts and the ones followed by our twitter account.  It is a great place to start interacting with the active security community.

Conferences / Meetups

  • Security BSides –  Spawned out of rejected CFPs from Blackhat 2009, Security BSides has evolved into a global series of events put on by local security communities.  This is a great place to get your feet wet and the cost is free to minimal.
  • DerbyCon –  5 day con down in Louisville, KY.  One of my personal favorites if you can fly and afford the hotel.  If you are in a reasonable distance you can also drive.  They have 2 days of training sessions before the actual conference.  It is a more intimate conference compared to the likes of DEF CON.  They also include nightly activities and a CTF that has something for all skill levels.  When you are there make sure to stop by the hardware hacking and lockpick villages!
  • CircleCity Con – I can’t speak on this one but the organizers are a great bunch.  If you can get to Indianapolis in June, check this one out!
  • Thotcon – another small con, it already happened this year but put it on your calendar for next year if you are going to be in the Chicago area.
  • DEFCON – Can’t mention the others without mentioning this one.  Without Blackhat and DEFCON we would not have the community that we have now.  I have yet to attend either of these but it is on the bucket list.
  • Meetups – Google search for local groups in your area.  Check around at Maker and Hacker spaces.

Other Resources

So that is it for now, hopefully you found this useful.  If you have other resources you come across feel free to message me on twitter and I will post an updated list.  Good luck and remember, if you are looking for your first official security gig, don’t be afraid to apply even if you think you are not qualified.  The smart employers may look past the lack of skills if you can demonstrate the right mindset for this work.

 

Goings on in and around the Nutmeg State…

Apologies for not posting anything in a while.  Hopefully that will change over the next couple weeks.  We will keep it simple and this will just be a simple events posting…

Source Conference Boston 2016
May 18-19th with training on the 16-17th.  Timing is great as this rolls right into…

BSidesBoston 2016
Training on May 20th, conference on May 21st.  Tickets are almost sold out!

Further down the line in July, BSidesCT comes back! CFP is open and it will once again be held at Quinnipiac University’s Rocky Top Student Center.

 

Regarding the Dell Security Bug

First of all read up on the details over at Krebs On Security.  He has a pretty good explanation as to what Dell did as well as additional reference sites on the matter.  The Reddit discussion in the reference section has some good technical details.  But what does all this mean to the regular folks out there who buy their Dell laptops and like to enjoy their drink while using the free wi-fi at the local coffee shop?   Continue reading

“But I need have local admin to run this!”

March is finally here!  The walls of snow are melting down quickly here in New England.  I can finally see grass!  Well ok… it is more like torn up chunks of sod from completely missing the side walk with the snow blower, but it has remnants of grass.

During my hibernation, I remembered some conversations from the past.  Mainly they had to do with “discussions” with users about their needs on their systems.  They commonly revolved around the requirement of administrative rights on their local workstations.  Which of course lead them to believe their current user account was the one that needed those rights.  Well most of us in security, as well as many others in the Systems Admin side of things, know that this is bad and should never be granted without a really good reason.  But does this mean it isn’t possible to grant these users their wishes? Continue reading

Network Security Protections when not in the office…

So in a previous life, I worked for a large enterprise which had many laptop users and a good size remote workforce. When I first took my laptop home for the night, I realized that for one, I could connect to any wireless network… and two I was no longer behind my web filtering servers. This article reminded me on how often this issue is overlooked: Postal Service Suspends Telecommuting

Continue reading

Last Week’s Meetup

We had a couple new faces come out to the kickoff of Nutmeg InfoSec Meetup. We discussed the state of the CT InfoSec community over some beer and pizza. Thankfully we all seem to believe that it exists and just needs a push to get more people involved. We eventually moved over to the classroom to a talk about Shodan.io.  The slides will be posted shortly, but you will get more out of actually checking it out and searching the “Internet of Things.”

If you couldn’t make it out to last week’s meetup, don’t worry!  We plan to do this every month.  We will most likely finish out the year at NESIT Hackerspace, but after the holidays we will look at moving around the State.  If you happen to know of  a good location between Hartford and New Haven, let us know!

Looking forward to the next one!

The first official NutmegInfoSec Meetup is just around the corner!

So what do you need to know for Wednesday October 15th?

  • Laptops not required, unless you are planning to present on something.
  • For those presenting, projector supports VGA input, so bring adapters if you need to.
  • The event is free, but NESIT is kind enough to allow us to use the space, so donations are welcomed.  NESIT is a 501(3)(c) so it is tax deductible.
  • Pizza and Soda and other cold beverages will be provided courtesy of the host.
  • If the building entrance (East Entrance) is locked, call the NESIT number (sign on door) and someone will come down to let you in.
  • Be ready to participate, this is not intended to be a “Death by PowerPoint” night, we get enough of that at work!
  • Bring a friend!
  • Bring some business cards, after all it is a networking event.
  • Where’s NESIT?  – 290 Pratt St,, Meriden, CT – East entrance go up one floor and follow the signs.

Any questions you can send them to info(at)nutmeginfosec.com

Things are happening!

We are being quite productive over here.  The site is up and running, a calendar of events has been added, and now we are running over SSL!  Eventually the stuff over on Meetup.com will be moved over to here.  Feel free to register to become part of the CT InfoSec community!

Also don’t forget the first official Meetup night on October 15th @ NESIT Hackerspace!

-@NutmegInfoSec