Month: April 2016

May 2016 – Deep Dive with Wireshark

/ roanokeinfosec / Leave a comment

sharks-1

Meeting info: May 12th, @6pm, at ECPI (directions below).

This meeting is a can’t miss opportunity for a hands on deep dive with Wireshark. David Raymond  (@dnomyard, bio below) who has previously spoken at Black Hat USA, RSA and Scmoocon will be presenting.

wireshark2

Wireshark is a great tool for quick-and-dirty network traffic analysis and it is widely used for network troubleshooting and incident response. In this hands-on discussion, we will review the basics of Wireshark and discuss capture filters, display filters, and basic protocol analysis. We’ll then go beyond the basics to talk about more advanced features of Wireshark and touch on some of the command-line utilities that come with it, such as tshark, editcap, mergecap, and randcap.

To get the most from the discussion, attendees should bring a laptop with the latest version of Wireshark installed.

ECPI  (5234 Airport Rd NW #200, Roanoke, VA 24012 or Google Maps) will be hosting the meeting and there will be some lab machines available for use by those without a laptop available.

David Raymond currently serves as Deputy Director in the Virginia Tech IT Security Office and Lab. In this position he helps oversee the security of the VT network, advises graduate students and undergrads doing cybersecurity research, and teaches courses in computer networking and security in the Department of Electrical and Computer Engineering. David holds a Ph.D. in Computer Engineering from Virginia Tech, a Masters in Computer Science from Duke University, and a Bachelors in CS from West Point. He has published over 25 journal and conference publications on a variety of topics and has spoken at numerous industry and academic conferences to include Black Hat USA, RSA, Shmoocon, and the NATO Conference on Cyber Conflict.

Advertisement

RBTC Cyber Security Forum: Vulnerability Management – May 24th

/ roanokeinfosec / Leave a comment

cyber-security-forum_post-image_may16-d

Don’t miss another great local opportunity to network with area security professionals. The RBTC Cyber Security Form next month is all about vulnerability management. Prior RBTC events have been excellent, and the hors d’oeuvres are not to be missed! Details on the event can be found on the RBTC website: https://rbtc.tech/2016/04/cyber-security-forum-vulnerability-management-may/

 

We’re Growing

/ roanokeinfosec / Leave a comment

growing2

It was awesome to see so many new faces and so many familiar ones at last Thursday’s meeting, thanks again to ECPI for hosting. We ended up running out of chairs!

April meeting1

April meeting2

I hope to see everyone again next month, where we will dive back down in to the weeds and take an in-depth look at Wireshark.

wireshark

Get on the mailing list or check the site for more details once we get them finalized.

When is the Next RISE (Roanoke Information Security Exchange) Meeting?

/ roanokeinfosec

jedi council

We meet every 2nd Thursday of the month at 5:30pm. The meeting location rotates between several local businesses and colleges. Please see below to find out how to get on the email list for the meeting announcements. The meeting locations will also be posted to this site.

What is RISE?

We are a group of Roanoke and NRV Information Security Professionals. We get together the 2nd Thursday every month to discuss current security topics. Meetings are free, usually so is the beer, and they are open to anyone.

How Can I Get Added to the Email List for RISE meetings?

Please send an email to RoanokeInfoSec@gmail.com if you would like to be added to the email notification list.

April 2016 – Here come the Feds!

/ roanokeinfosec / Leave a comment

gty_fbi_ferguson_ml_141121_16x9_992

Our next meeting is April 14th at ECPI in Roanoke (address is below) at 5:30pm.  The speaker will be an FBI Special Agent who has been with the FBI for 12 years and is currently in the Richmond Division with a focus toward the Roanoke area.  He is currently working national security matters and has agreed to come and share with us his experiences and his thoughts on how we can assist in protecting our companies, valley and country.fbi_logo_twitter

It’s always good to meet your local FBI liaison. If you have a serious breach at your company or discover illegal activity on your network, you need to know who to contact.

Special thanks to Michael for opening up the ECPI facility to us and to Stephan for lining up our speaker.

Meeting Location:

ECPI University
5234 Airport Rd NW #200
Roanoke, VA 24012

Google Maps:
https://www.google.com/maps/place/ECPI+University,+5234+Airport+Rd+NW+%23200,+Roanoke,+VA+24012/@37.319834,-79.959449,16z/data=!4m2!3m1!1s0x884d0e5e69f5c107:0x6c5be18e3d3f596f

March 2016 – Common Network Penetration Testing Techniques

/ roanokeinfosec / Leave a comment

hack all the things

Our discussion subject for the month of March was Network Pen Tests.

  • What are they?
  • Do they provide value?
  • How are they done?
  • What do you do with the results?

Our guest speaker was Russel C. Van Tuyl (@Ne0nd0g). Russel is an experienced Network Pen Tester with Sword & Shield in Knoxville, TN and has agreed to walk us through his Network Pen Testing procedures.

Here is a quick write up about his presentation:

Attackers can take complete control of a Windows domain by establishing full administrative rights to networks resources. This access can then be used to steal your organizations crown jewels, the thing that makes your organization money. This talk will introduce common attack paths used to compromise a domain. Additionally, a brief introduction to the tools used to perform some of these common attacks will be covered. This presentation will conclude by providing information on mitigating or detecting these common attacks. The audience will be provided with an opportunity to ask any questions, even if they’re not related to the presentation.

Update: Russel did a fantastic job presenting. His presentation was entertaining and had a ton of great information. He not only covered some of the techniques he uses when pen testing, he also talked about ways to mitigate them. If you didn’t walk away with a “To Do” list of things to check on your network, or a list of fun new things to try, you weren’t paying attention.

Here are the slides from the presentation:

Common Pen Testing Techniques

RISE - March 2016

PowerShell Empire

 

He demonstrated how PowerShell can be an admins best friend, or worst enemy, by showing us how easy it was to use PowerShell Empire to compromise a box.

 

Our own Grant Sims has since created step by step video showing how to use one of the PowerShell techniques Russel spoke about. He shows how to use PowerSploit to get a meterpreter shell:

Feb 2016 – The Life of a Packet

/ roanokeinfosec / Leave a comment

collection-of-ethernet-wires

In the Feb meeting we heard from Mark Cairns from Cisco about how Cisco fits the security niche.  Here is what Tom Spitnale from SyCom had to say about Mark’s presentation:
“I was impressed with the presentation he delivered to a group in Richmond just before the holidays.  A very granular view of the “life of a packet” as it intersects with security dependent on the circumstances…on premise user, on premise resource, hybrid or cloud resources in the mix, off-premise users, etc. etc.  While the presentation is admittedly developed to deliver a “why Cisco meets this market uniquely” message (and spotlights the functionality that different elements of Cisco’s portfolio addresses, both as point solutions and as a collective/integrated umbrella strategy), the discussion points and path from one scenario into the next really painted the picture, for me, of what modern security professionals are tasked with addressing.  So I feel like “the pitch” aspect is worth “the story” that he tells.”

Mark spoke about some unique ways Cisco can leverage an end to end solution to provide visibility into the network and how it compares to open source solutions.

Jan 2016 – Onions Make You Cry Tears of Joy

/ roanokeinfosec / Leave a comment

How to Improve Your Network Security Monitoring Capabilities Using Security Onion Sensors and Network Architecture

We will be kicking off the New Year with the first part of a two part series. (Open Source Security vs Commercial Products).

open source vs

This month we will be discussing open source security and how our own Nate Sykes and Grant Sims (bios below) are using open source products to secure their network. Next month we will have Cisco come in and give us an overview of what they can offer from a commercial software standpoint.

Nate and Grant have been working to transition their security posture from a purely prevention based model to a prevent, detect and respond model. Nate and Grant put it this way “Prevention WILL fail. As a defender you have to consider/protect EVERYTHING. An attacker only has to find ONE flaw overlooked, unknown, unpatched or misconfigured.” To that end Nate and Grant will give us an overview of how they use open source security sensors to defend their network.

They will discuss:

Here are the slides from the first part of the presentation:

you shall not pass

Security Onion – Part 1

For the second part of the presentation, Grant demoed how to use Security Onion to investigate an AnglerEK incident:

Brief bios:
Nate Sykes (@n8sec) is the IT Manager at R&K Solutions, he has been working in IT for 19yrs. Nate has worked in all areas of system and network administration. He has been involved in different aspects of security for the last 6yrs, mostly involving blue team work. He holds GSEC, GMON and Security+ certifications.

Grant Sims (@ChiefRiverSims) is the Sr Security Analyst at R&K Solutions, he has been working in IT for 9yrs. He has a networking background, developed while working in a major DoD data center. He holds CCNA-Voice, CCDP, CCNP, Security+ and GPEN certifications.