BrakeSec Education Podcast - TopPodcast.com

View Top 200 Chart

Back to Rankings Page

BrakeSec Education Podcast — News
BrakeSec Education Podcast

A podcast about the world of Cybersecurity, Privacy, Compliance, and Regulatory issues that arise in today’s workplace. Co-hosts Bryan Brake, Brian Boettcher, and Amanda Berlin teach concepts that aspiring Information Security professionals need to know, or refresh the memories of seasoned veterans.

Copyright: © Copyright 2019. All rights reserved

Latest Episodes:

2019-021-Chris Sanders discusses a cognitive crisis, mental models, and dependence on tools Jun 04, 2019

Show notes

https://chrissanders.org/2019/05/infosec-mental-models/

I've argued for some time that information security is in a growing state of cognitive crisis…

Demand outweighs supply

Because so many organizations need experience, they are unable to appropriately invest in entry-level jobs and devote the necessary time for internal training.

That's an HR and hiring manager issue, right? --brbr No. --bboettcher

Information cannot be validated or trusted

There are few authoritative sources of knowledge about critical components and procedures.

Large systemic issues persist with no ability to tackle them in a large, mobilized, or strategic manner.

The industry is unable to organize or widely combat the biggest issues they face.

Groups of individuals, everyone thinking they have the 'right answer', just like linux flavors --brbr

https://www.fireeye.com/blog/threat-research/2015/06/caching_out_the_val.html

https://www.helpnetsecurity.com/2018/07/10/windows-shimcache-threat-hunting/

Dependence on tools: http://traffic.libsyn.com/brakeingsecurity/2016-006-Moxie_vs_Mechanism-dependence_on_tools.mp3

https://en.wikipedia.org/wiki/Cognitive_revolution

https://buzzmachine.com/2019/04/25/a-crisis-of-cognition/

How do we solve it?

We must thoroughly understand the processes used to draw conclusions.
1. S.M.A.R.T.?
Experts must develop repeatable, teachable methods and techniques.
Educators must build and advocate pedagogy that teaches practitioners how to think.

https://www.maximumfun.org/shows/sawbones - sawbones podcast (amanda mentioned)

Mental Model?

We use them all the time? Gotta simplify the complex...

Distribution and the Bell Curve

Operant Conditioning

https://www.latimes.com/science/la-sci-emotional-stereotypes-about-women-20190530-story.html

The Scientific Method

Applied Models

13 Organ Systems

4 Vital Signs

10 Point Pain scale

Defense in Depth

OSI model

Investigation Process

https://en.wikipedia.org/wiki/Inductive_reasoning

Model Desperation

Companies dumping existing models and embracing something else

The problem is that we're model hungry and we'll rapidly use and abuse any reasonable model that presents itself. Ultimately, we want good models because we want a robust toolbox. But, not everything is a job for a hammer and we don't need fourteen circular saws.

What makes a good model?

Simple

Useful

Imperfect? (wuh?)-brbr

Creating models

Begins by asking a question… (what is the weather going to look like tomorrow? --brbr)

What defines the sandwich? (kind of like "https://en.wikipedia.org/wiki/Theory_of_forms" --brbr)

Discuss the Rural Tech Fund https://twitter.com/RuralTechFund

https://ruraltechfund.org/

Practical Threat Hunting - https://twitter.com/chrissanders88/status/1133388347194454018

Practical Packet Analysis - https://nostarch.com/packetanalysis3

Suggesting books:

https://www.amazon.com/Thinking-Fast-Slow-Daniel-Kahneman/dp/0374533555

https://www.amazon.com/Undoing-Project-Friendship-Changed-Minds/dp/0393354776

More references on Chris' site https://chrissanders.org/2019/05/infosec-mental-models/

Book Club

Cult of the dead cow - June

Tribe of Hackers - July

The Mastermind - August

The Cuckoo's Egg - September

Check out our Store on Teepub! https://brakesec.com/store

Join us on our #Slack Channel! Send a request to @brakesec on Twitter or email bds.podcast@gmail.com

#Brakesec Store!:https://www.teepublic.com/user/bdspodcast

#Spotify: https://brakesec.com/spotifyBDS

#RSS: https://brakesec.com/BrakesecRSS

#Youtube Channel: http://www.youtube.com/c/BDSPodcast

#iTunes Store Link: https://brakesec.com/BDSiTunes

#Google Play Store: https://brakesec.com/BDS-GooglePlay

Our main site: https://brakesec.com/bdswebsite

#iHeartRadio App: https://brakesec.com/iHeartBrakesec

#SoundCloud: https://brakesec.com/SoundcloudBrakesec

Comments, Questions, Feedback: bds.podcast@gmail.com

Support Brakeing Down Security Podcast by using our #Paypal: https://brakesec.com/PaypalBDS OR our #Patreon

https://brakesec.com/BDSPatreon

#Twitter: @brakesec @boettcherpwned @bryanbrake @infosystir

#Player.FM : https://brakesec.com/BDS-PlayerFM

#Stitcher Network: https://brakesec.com/BrakeSecStitcher

#TuneIn Radio App: https://brakesec.com/TuneInBrakesec

2019-020-email_security_controls-windows_scheduler May 29, 2019

Show notes

Bryan got phished (almost) - story time!

https://isc.sans.edu/forums/diary/Do+you+block+new+domain+names/17564/

Through OpenDNS

https://learn-umbrella.cisco.com/product-videos/newly-seen-domains-in-cisco-umbrella

Available January 2017, Umbrella filters newly seen or created domains. By using new domains to host malware and other threats, attackers can outsmart security systems that rely on reputation scores or possibly outdated block lists. Umbrella now stops these domains before they even load.

Also "unknown" category? pros/cons

Good filter time for domains?

Amanda: windows logging issues

well…. FUCKING EVERYTHING CREATES TASKS IN SCHEDULER

https://www.microsoft.com/en-us/windowsforbusiness/windows-atp

Breach news:

https://www.dutchnews.nl/news/2019/05/hackers-steal-key-info-about-home-hunters-from-housing-agency/

FTA: The hackers now have their name, address, contact information and copies of their passport or ID card, which includes their personal identification number, or BSN.

This is sufficient to allow the hackers to open bank accounts or take out loans by using other people's identity.

https://www.bleepingcomputer.com/news/security/over-757k-fraudulently-obtained-ipv4-addresses-revoked-by-arin/

Mostly colos, data centers, 'aaS' providers

Many in the Mid-West

Book Club

Cult of the dead cow - June

Tribe of Hackers - July

The Mastermind - August

The Cuckoo's Egg - September

https://www.infoseccampout.com

EventBrite Link:https://www.eventbrite.com/e/infosec-campout-tickets-61915087694

Check out our Store on Teepub! https://brakesec.com/store

Join us on our #Slack Channel! Send a request to @brakesec on Twitter or email bds.podcast@gmail.com

#Brakesec Store!:https://www.teepublic.com/user/bdspodcast

#Spotify: https://brakesec.com/spotifyBDS

#RSS: https://brakesec.com/BrakesecRSS

#Youtube Channel: http://www.youtube.com/c/BDSPodcast

#iTunes Store Link: https://brakesec.com/BDSiTunes

#Google Play Store: https://brakesec.com/BDS-GooglePlay

Our main site: https://brakesec.com/bdswebsite

#iHeartRadio App: https://brakesec.com/iHeartBrakesec

#SoundCloud: https://brakesec.com/SoundcloudBrakesec

Comments, Questions, Feedback: bds.podcast@gmail.com

Support Brakeing Down Security Podcast by using our #Paypal: https://brakesec.com/PaypalBDS OR our #Patreon

https://brakesec.com/BDSPatreon

#Twitter: @brakesec @boettcherpwned @bryanbrake @infosystir

#Player.FM : https://brakesec.com/BDS-PlayerFM

#Stitcher Network: https://brakesec.com/BrakeSecStitcher

#TuneIn Radio App: https://brakesec.com/TuneInBrakesec

2019-019-Securing your RDP and ElasticSearch, InfoSec Campout news May 20, 2019

Show notes

https://static1.squarespace.com/static/556340ece4b0869396f21099/t/5cc9ff79c830253749527277/1556742010186/Red+Team+Practice+Lead.pdf

https://www.reddit.com/r/netsec/comments/bonwil/prevent_a_worm_by_updating_remote_desktop/

https://blogs.technet.microsoft.com/msrc/2019/05/14/prevent-a-worm-by-updating-remote-desktop-services-cve-2019-0708/

https://security.berkeley.edu/resources/best-practices-how-articles/system-application-security/securing-remote-desktop-rdp-system

https://www.bleepingcomputer.com/news/security/unsecured-survey-database-exposes-info-of-8-million-people/

https://www.elastic.co/guide/en/elasticsearch/reference/current/configuring-security.html

https://www.elastic.co/blog/found-elasticsearch-security

https://dzone.com/articles/securing-your-elasticsearch-cluster-properly

Auth is possible, using reverse proxy… this is basic auth :( https://github.com/Asquera/elasticsearch-http-basic

Here's one that uses basic auth and LDAP: https://mapr.com/blog/how-secure-elasticsearch-and-kibana/

2fa setup: https://www.elastic.co/guide/en/cloud/current/ec-account-security.html

Check out our Store on Teepub! https://brakesec.com/store

Join us on our #Slack Channel! Send a request to @brakesec on Twitter or email bds.podcast@gmail.com

#Brakesec Store!:https://www.teepublic.com/user/bdspodcast

#Spotify: https://brakesec.com/spotifyBDS

#RSS: https://brakesec.com/BrakesecRSS

#Youtube Channel: http://www.youtube.com/c/BDSPodcast

#iTunes Store Link: https://brakesec.com/BDSiTunes

#Google Play Store: https://brakesec.com/BDS-GooglePlay

Our main site: https://brakesec.com/bdswebsite

#iHeartRadio App: https://brakesec.com/iHeartBrakesec

#SoundCloud: https://brakesec.com/SoundcloudBrakesec

Comments, Questions, Feedback: bds.podcast@gmail.com

Support Brakeing Down Security Podcast by using our #Paypal: https://brakesec.com/PaypalBDS OR our #Patreon

https://brakesec.com/BDSPatreon

#Twitter: @brakesec @boettcherpwned @bryanbrake @infosystir

#Player.FM : https://brakesec.com/BDS-PlayerFM

#Stitcher Network: https://brakesec.com/BrakeSecStitcher

#TuneIn Radio App: https://brakesec.com/TuneInBrakesec

2019-018-Lesson's I learned, github breach, ransoming github repos May 14, 2019

Show notes

Things I learned this week:

https://www.securusglobal.com/community/2013/12/20/dumping-windows-credentials/

https://www.helpnetsecurity.com/2019/04/29/docker-hub-breach/

https://www.zdnet.com/article/a-hacker-is-wiping-git-repositories-and-asking-for-a-ransom/

https://attack.mitre.org/techniques/T1003/

https://github.com/giMini/PowerMemory

https://en.wikipedia.org/wiki/Local_Security_Authority_Subsystem_Service

https://attack.mitre.org/techniques/T1208/

2019-017-K8s Security, Kamus, interview with Omer Levi Hevroni May 05, 2019

Show notes

K8s security with Omer Levi Hevroni (@omerlh)

service tickets -

Super-Dev

Omer's requirements for storing secrets:

Gitops enabled

Kubernetes Native

Secure

"One-way encryption"

Omer's slides and youtube video:

https://www.slideshare.net/SolutoTLV/can-kubernetes-keep-a-secret

https://www.youtube.com/watch?v=FoM3u8G99pc&&index=14&t=0s

We've all experienced it: you're working on a task, adding some code, and then you need to store some sensitive configuration value. It could be an API key, client secret or an encryption key ― something that's highly sensitive and must be kept secret. And this is where things get messy. Usually, secret storage is highly coupled with how the code is deployed, and different platforms have different solutions. Kubernetes has a promise to simplify this process by using the native secret object, which, as the name implies, can be used to store secrets or sensitive configurations. Unfortunately, Kubernetes secrets are fundamentally broken, and a developer who tries to use them will definitely have some issues. But no need to worry ― there are solid alternatives for storing secrets securely on Kubernetes platform. One solution is to use Kamus, an open-source, git-ops solution, that created by Soluto, for managing secrets on Kubernetes. Kamus can encrypt a secret so it can be decrypted only by your app on runtime - and not by anyone else. The first part of this session will cover the challenges faced when using Kubernetes secrets (from a usability and security point of view). The second part will discuss some of the existing solutions (Sealed Secrets, Helm Secrets and others), their pros, and cons, and then feature Kamus: how it works, what problems it solves, how it differs from other solutions, and what threats it can help mitigate (and what threats it can't). The talk will cover all that is required to know so you can run Kamus on your own cluster and use it for secret management. Join me for this session to learn how you can build a Kubernetes cluster than can keep a secret ― for real. Speakers Omer Levi Hevroni

Kubernetes Secrets

Bad, because manifest files hold the user/password, and are encoded in Base64

Could be uploaded to git = super bad

https://kubernetes.io/docs/concepts/configuration/secret/

https://docs.travis-ci.com/user/encryption-keys/

Kamus threat model on Github: https://kamus.soluto.io/docs/threatmodeling/threats_controls/

https://medium.com/@BoweiHan/an-introduction-to-serverless-and-faas-functions-as-a-service-fb5cec0417b2

"FaaS is a relatively new concept that was first made available in 2014 by hook.io and is now implemented in services such as AWS Lambda, Google Cloud Functions, IBM OpenWhisk and Microsoft Azure Functions."

Best practices: https://kubernetes.io/docs/tasks/administer-cluster/securing-a-cluster/

https://github.com/owasp-cloud-security/owasp-cloud-security

https://www.omerlh.info/2019/01/19/threat-modeling-as-code/

https://telaviv.appsecglobal.org/

https://github.com/Soluto/kamus

https://kamus.soluto.io

Infosec Campout = www.infoseccampout.com

2019-016-Conference announcement, and password spray defense Apr 29, 2019

Show notes

Agenda:

Announce the conference

CFP: up soon

CFW: up soon

Campers: Friday night/Saturday night

Like "toorcamp", but if it sucks, you can drive home… :D

Limiting tickets, looking for sponsors

To support the conference and future initiatives:

"Infosec Education Foundation"

501c3 non-profit (we are working on the charity part)

www.infoseccampout.com

Password spraying

https://github.com/dafthack/DomainPasswordSpray

Stories:

https://blog.stealthbits.com/using-stealthdefend-to-defend-against-password-spraying/

http://blog.quadrasystems.net/post/password-spray-attacks-and-four-sure-steps-to-disrupt-them

https://www.trimarcsecurity.com/single-post/2018/05/06/Trimarc-Research-Detecting-Password-Spraying-with-Security-Event-Auditing

https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/simplifying-password-spraying/

Detecting one to many…..and at what point/threshold during an attack would it be a PITA for the redteam to slow down to

Annoying NXLog CE limitation

Log-MD can help detect? Yep

CTF Club is happening again

Pinkie Pie is running it.

Saturdays at 2 -3 pm

2019-015-Kevin_johnson-incident_response_aftermath Apr 22, 2019

Show notes

Announcements:

https://www.workshopcon.com/

SpecterOps (red Team operations) and Tim Tomes (PWAPT)

Bsides Nashville

https://blog.secureideas.com/2019/04/we-take-security-seriously-and-other-trite-statements.html

"We take security seriously and other trite statements"

Wordpress infrastructure (supply chain failure)

WordPress plugin called Woocommerce was at fault.

Vuln late last year: https://www.bleepingcomputer.com/news/security/wordpress-design-flaw-woocommerce-vulnerability-leads-to-site-takeover/

"According to new research by Simon Scannell, a researcher for PHP Security firm RIPS Tech, when WooCommerce is installed it will create a Shop Manager role that has the "edit_users" WordPress capability/permission. This capability allows users to edit ANY WordPress user, including the Administrator account."

"https://blog.ripstech.com/2018/wordpress-design-flaw-leads-to-woocommerce-rce/"

You (Kevin) discovered the admin accounts, but could not remove them. Was that when you considered this an 'incident'?

Timeline:"[2019-03-22 09:03 EST] Kevin assigns members of the Secure Ideas team with reconnaissance and mapping of the AoM system. Kevin reminds these members that Secure Ideas doesn't have permission to test AoM. They are advised not to do anything that could harm the AoM's production environment."

What is the line they should not cross in this case?

You did not have access to logs, you asked that an audit plugin be installed to be able to view logs. Is that permanent, and why did they not allow access to logs prior to?

[2019-03-22 13:11 EST] AoM Support fixes the audit log plugin access. AoM Support has found that a purchase of a course through a Woocommerce plugin resulted in users being granted admin access. AoM Support provides specific order numbers. They have also done an analysis of the database backups from the last 60 days and believe that the attackers did not do anything after they got access. AoM Support announces that the Secure Ideas training site will be set up on a separate server and Secure Ideas will be granted a new level of access.

Seems like working with AoM wasn't difficult. Was giving you access to your own instance, and allowing you to administer it a big deal for them?

Lessons Learned? Anything you'd do differently next time?

Update IR plan?

Did they reach out for additional testing?

Did the people who got admin get removed?

Consult with AoM on better security implementation? Your env wasn't damaged, but did they suffer issues with other customers? *answered*

https://www.wordfence.com/

https://en.wikipedia.org/wiki/Gremlins

Gas Station skimmer video - https://www.facebook.com/michellepedraza.journalist/videos/2135141863465247/

https://www.helpnetsecurity.com/2019/04/12/cybersecurity-incident-response-plan/

https://www.guardicore.com/2018/11/security-incident-response-plan/

https://www.zdnet.com/article/security-risks-of-multi-tenancy/

Upcoming SI events

IANS forum (Wash DC)

ShowmeCon

Webcasts

ISC2 security Congress (Wash DC)

Patreon

Slack

Twitter handles

iTunes

Google

Check out our Store on Teepub! https://brakesec.com/store

Join us on our #Slack Channel! Send a request to @brakesec on Twitter or email bds.podcast@gmail.com

#Brakesec Store!:https://www.teepublic.com/user/bdspodcast

#Spotify: https://brakesec.com/spotifyBDS

#RSS: https://brakesec.com/BrakesecRSS

#Youtube Channel: http://www.youtube.com/c/BDSPodcast

#iTunes Store Link: https://brakesec.com/BDSiTunes

#Google Play Store: https://brakesec.com/BDS-GooglePlay

Our main site: https://brakesec.com/bdswebsite

#iHeartRadio App: https://brakesec.com/iHeartBrakesec

#SoundCloud: https://brakesec.com/SoundcloudBrakesec

Comments, Questions, Feedback: bds.podcast@gmail.com

Support Brakeing Down Security Podcast by using our #Paypal: https://brakesec.com/PaypalBDS OR our #Patreon

https://brakesec.com/BDSPatreon

#Twitter: @brakesec @boettcherpwned @bryanbrake @infosystir

#Player.FM : https://brakesec.com/BDS-PlayerFM

#Stitcher Network: https://brakesec.com/BrakeSecStitcher

#TuneIn Radio App: https://brakesec.com/TuneInBrakesec

2019-014-Tesla fails encryption, Albany and Sammamish ransomware attacks. Apr 15, 2019

Show notes

Announcements: WorkshopCon Training with SpecterOps and Tim Tomes

www.workshopcon.com

redteam operations with SpecterOps

PWAPT with Tim Tomes

Source Boston: [Boston, MA 2019 (April 29 – May 3, 2019) (https://sourceconference.com/events/boston19/)Trainings: April 29 - April 30, 2019 | Conference: May 1 - 3, 2019

Cybernauts CTF meetup in Austin Texas at Indeed offices, 23 April at 5pm Central time.

https://nakedsecurity.sophos.com/2019/04/02/wrecked-teslas-hang-onto-your-unencrypted-data/

My last car sync'ed the contact list.

Video is a different story, but safety for the vehicle and owner, they'll probably continue to store it.

Telemetry data is for changing road conditions, navigation, etc

Enable encryption at rest… or pop a fuse to scram the data when/if an accident is detected

Level of difficulty, no fuse, requires hardware upgrade

Encryption at rest, ensuring HTTPS on all incoming/outgoing.

https://www.bleepingcomputer.com/news/software/major-browsers-to-prevent-disabling-of-click-tracking-privacy-risk/

Annoying "do you want notifications from this site?"

Like an annoying RSS feed… 'Hey, we added a new banner ad!'

https://www.phoronix.com/scan.php?page=news_item&px=Linux-Improve-CPU-Spec-Switches

Why add the switches to allow vulnerabilities?

Slippery slope --disable-dirtycow?

https://www.bleepingcomputer.com/ransomware/decryptor/planetary-ransomware-decryptor-gets-your-files-back-for-free/

https://www.wamc.org/post/details-still-few-city-albany-s-ransomware-attack

Threat intelligence and software detections…

Got an email… *Story Time from Mr. Boettcher*

Twitter: why do companies not allow copy/paste in password fields? Tesla

2019-013-ASVSv4 discussion with Daniel Cuthbert and Jim Manico - Part 2 Apr 07, 2019

Show notes

Announcements:

SpecterOps and Tim Tomes are giving training at WorkshopCon https://www.workshopcon.com

Rob Cheyne Source Boston - https://sourceconference.com/events/boston19/

Austin Cybernauts meetup - https://www.eventbrite.com/e/cybernauts-ctf-meetup-indeed-tickets-58816141663

SHOW NOTES:

Architecture is not an implementation, but a way of thinking about a problem that has potentially many different answers, and no one single "correct" answer.

https://github.com/OWASP/ASVS

"is to normalize the range in the coverage and level of rigor available in the market when it comes to performing Web application security verification using a commercially-workable open standard. "

#ASVS team:

Daniel Cuthbert @dcuthbert
Andrew van der Stock
Jim Manico @manicode
Mark Burnett
Josh C Grossman

https://github.com/OWASP/ASVS/raw/master/4.0/OWASP%20Application%20Security%20Verification%20Standard%204.0-en.pdf

https://github.com/OWASP/ASVS/raw/master/4.0/OWASP%20Application%20Security%20Verification%20Standard%204.0-en.docx

https://drive.google.com/file/d/17-NDN7TWdC-vZLbsKkkBFhrYmUhF6907/view?usp=sharing

https://www.owasp.org/images/3/33/OWASP_Application_Security_Verification_Standard_3.0.1.pdf - old version

http://traffic.libsyn.com/brakeingsecurity/2015-046_ASVS_with_Bill_Sempf.mp3 - Older BrakeSec Episode

ASVS Page 14 - "If developers had invested in a single, secure identity provider model, such as SAML federated identity, the identity provider could be updated to incorporate new requirements such as NIST 800-63 compliance, while not changing the interfaces of the original application. If many applications shared the same security architecture and thus that same component, they all benefit from this upgrade at once. However, SAML will not always remain as the best or most suitable authentication solution - it might need to be swapped out for other solutions as requirements change. Changes like this are either complicated, so costly as to necessitate a complete re-write, or outright impossible without security architecture."

What are the biggest differences between V3 and V4?

Why was a change needed?

https://xkcd.com/936/ - famous XKCD password comic

David Cybuck: Appendix C: IoT

Why was this added?

These controls are in addition to all the other ASVS controls?

How do they see section 1 architecture and section 14, configuration --- in the context of rapid deployment, infrastructure as code, containerization.

You added IoT, but not ICS or SCADA?

https://www.owasp.org/index.php/OWASP_ICS_/_SCADA_Security_Project

BrakeSec IoT Top 10 discussion:

http://traffic.libsyn.com/brakeingsecurity/2019-001.mp3

http://traffic.libsyn.com/brakeingsecurity/2019-002-aaron_guzman_pt2.mp3

Seems incomplete… (Section 1.13 "API")

Will this be added later?

What is needed to fill that in? (manpower, SME's, etc?)

3 levels of protection… why have levels at all?

Why shouldn't everyone be at Level 3?

I just don't like the term 'bare minimum' (level 1)--brbr

Threat modeling blog (leviathan): https://www.leviathansecurity.com/blog/the-calculus-of-threat-modeling

Adam Shostack ThreatModeling Book: https://www.amazon.com/Threat-Modeling-Designing-Adam-Shostack/dp/1118809998

https://www.owasp.org/images/archive/6/65/20170626175919!TM-Lessons-Star-Wars-May-2017.pdf

https://www.youtube.com/watch?v=2C7mNr5WMjA

Cost to get to L2? L3?

https://manicode.com/ secure coding education

https://www.blackhat.com/presentations/bh-usa-09/WILLIAMS/BHUSA09-Williams-EnterpriseJavaRootkits-PAPER.pdf

Check out our Store on Teepub! https://brakesec.com/store

Join us on our #Slack Channel! Send a request to @brakesec on Twitter or email bds.podcast@gmail.com

#Brakesec Store!:https://www.teepublic.com/user/bdspodcast

#Spotify: https://brakesec.com/spotifyBDS

#RSS: https://brakesec.com/BrakesecRSS

#Youtube Channel: http://www.youtube.com/c/BDSPodcast

#iTunes Store Link: https://brakesec.com/BDSiTunes

#Google Play Store: https://brakesec.com/BDS-GooglePlay

Our main site: https://brakesec.com/bdswebsite

#iHeartRadio App: https://brakesec.com/iHeartBrakesec

#SoundCloud: https://brakesec.com/SoundcloudBrakesec

Comments, Questions, Feedback: bds.podcast@gmail.com

Support Brakeing Down Security Podcast by using our #Paypal: https://brakesec.com/PaypalBDS OR our #Patreon

https://brakesec.com/BDSPatreon

#Twitter: @brakesec @boettcherpwned @bryanbrake @infosystir

#Player.FM : https://brakesec.com/BDS-PlayerFM

#Stitcher Network: https://brakesec.com/BrakeSecStitcher

#TuneIn Radio App: https://brakesec.com/TuneInBrakesec

2019-012: OWASP ASVSv4 discussion with Daniel Cuthbert and Jim Manico - Part 1 Apr 01, 2019

Show notes

Show Notes

SpecterOps and Tim Tomes are giving training at WorkshopCon https://www.workshopcon.com

Rob Cheyne Source Boston - https://sourceconference.com/events/boston19/

Architecture is not an implementation, but a way of thinking about a problem that has potentially many different answers, and no one single "correct" answer.

https://github.com/OWASP/ASVS

"is to normalize the range in the coverage and level of rigor available in the market when it comes to performing Web application security verification using a commercially-workable open standard. "

ASVS team:

Daniel Cuthbert @dcuthbert
Andrew van der Stock
Jim Manico @manicode
Mark Burnett
Josh C Grossman

https://github.com/OWASP/ASVS/raw/master/4.0/OWASP%20Application%20Security%20Verification%20Standard%204.0-en.pdf

https://github.com/OWASP/ASVS/raw/master/4.0/OWASP%20Application%20Security%20Verification%20Standard%204.0-en.docx

Don't post these links in show notes

ASVS list (google sheet): https://drive.google.com/open?id=1xFLmvNoR2tohk08cQDLU46FWNgpx28wd

ASVS PDF: https://drive.google.com/file/d/17-NDN7TWdC-vZLbsKkkBFhrYmUhF6907/view?usp=sharing

https://www.owasp.org/images/3/33/OWASP_Application_Security_Verification_Standard_3.0.1.pdf - old version

http://traffic.libsyn.com/brakeingsecurity/2015-046_ASVS_with_Bill_Sempf.mp3 - Older BrakeSec Episode

ASVS Page 14 - "If developers had invested in a single, secure identity provider model, such as SAML federated identity, the identity provider could be updated to incorporate new requirements such as NIST 800-63 compliance, while not changing the interfaces of the original application. If many applications shared the same security architecture and thus that same component, they all benefit from this upgrade at once. However, SAML will not always remain as the best or most suitable authentication solution - it might need to be swapped out for other solutions as requirements change. Changes like this are either complicated, so costly as to necessitate a complete re-write, or outright impossible without security architecture."

What are the biggest differences between V3 and V4?

Why was a change needed?

https://xkcd.com/936/ - famous XKCD password comic

David Cybuck: Appendix C: IoT

Why was this added?

These controls are in addition to all the other ASVS controls?

How do they see section 1 architecture and section 14, configuration --- in the context of rapid deployment, infrastructure as code, containerization.

You added IoT, but not ICS or SCADA?

https://www.owasp.org/index.php/OWASP_ICS_/_SCADA_Security_Project

BrakeSec IoT Top 10 discussion:

http://traffic.libsyn.com/brakeingsecurity/2019-001.mp3

http://traffic.libsyn.com/brakeingsecurity/2019-002-aaron_guzman_pt2.mp3

Seems incomplete… (Section 1.13 "API")

Will this be added later?

What is needed to fill that in? (manpower, SME's, etc?)

3 levels of protection… why have levels at all?

Why shouldn't everyone be at Level 3?

I just don't like the term 'bare minimum' (level 1)--brbr

Threat modeling blog (leviathan): https://www.leviathansecurity.com/blog/the-calculus-of-threat-modeling

Adam Shostack ThreatModeling Book: https://www.amazon.com/Threat-Modeling-Designing-Adam-Shostack/dp/1118809998

https://www.owasp.org/images/archive/6/65/20170626175919!TM-Lessons-Star-Wars-May-2017.pdf

https://www.youtube.com/watch?v=2C7mNr5WMjA

Cost to get to L2? L3?

https://manicode.com/ secure coding education

https://www.blackhat.com/presentations/bh-usa-09/WILLIAMS/BHUSA09-Williams-EnterpriseJavaRootkits-PAPER.pdf

Check out our Store on Teepub! https://brakesec.com/store

Join us on our #Slack Channel! Send a request to @brakesec on Twitter or email bds.podcast@gmail.com

#Brakesec Store!:https://www.teepublic.com/user/bdspodcast

#Spotify: https://brakesec.com/spotifyBDS

#RSS: https://brakesec.com/BrakesecRSS

#Youtube Channel: http://www.youtube.com/c/BDSPodcast

#iTunes Store Link: https://brakesec.com/BDSiTunes

#Google Play Store: https://brakesec.com/BDS-GooglePlay

Our main site: https://brakesec.com/bdswebsite

#iHeartRadio App: https://brakesec.com/iHeartBrakesec

#SoundCloud: https://brakesec.com/SoundcloudBrakesec

Comments, Questions, Feedback: bds.podcast@gmail.com

Support Brakeing Down Security Podcast by using our #Paypal: https://brakesec.com/PaypalBDS OR our #Patreon

https://brakesec.com/BDSPatreon

#Twitter: @brakesec @boettcherpwned @bryanbrake @infosystir

#Player.FM : https://brakesec.com/BDS-PlayerFM

#Stitcher Network: https://brakesec.com/BrakeSecStitcher

#TuneIn Radio App: https://brakesec.com/TuneInBrakesec

Related Podcasts