Meeting info: May 12th, @6pm, at ECPI (directions below).
This meeting is a can’t miss opportunity for a hands on deep dive with Wireshark. David Raymond (@dnomyard, bio below) who has previously spoken at Black Hat USA, RSA and Scmoocon will be presenting.
Wireshark is a great tool for quick-and-dirty network traffic analysis and it is widely used for network troubleshooting and incident response. In this hands-on discussion, we will review the basics of Wireshark and discuss capture filters, display filters, and basic protocol analysis. We’ll then go beyond the basics to talk about more advanced features of Wireshark and touch on some of the command-line utilities that come with it, such as tshark, editcap, mergecap, and randcap.
To get the most from the discussion, attendees should bring a laptop with the latest version of Wireshark installed.
ECPI (5234 Airport Rd NW #200, Roanoke, VA 24012 or Google Maps) will be hosting the meeting and there will be some lab machines available for use by those without a laptop available.
David Raymond currently serves as Deputy Director in the Virginia Tech IT Security Office and Lab. In this position he helps oversee the security of the VT network, advises graduate students and undergrads doing cybersecurity research, and teaches courses in computer networking and security in the Department of Electrical and Computer Engineering. David holds a Ph.D. in Computer Engineering from Virginia Tech, a Masters in Computer Science from Duke University, and a Bachelors in CS from West Point. He has published over 25 journal and conference publications on a variety of topics and has spoken at numerous industry and academic conferences to include Black Hat USA, RSA, Shmoocon, and the NATO Conference on Cyber Conflict.
Don’t miss another great local opportunity to network with area security professionals. The RBTC Cyber Security Form next month is all about vulnerability management. Prior RBTC events have been excellent, and the hors d’oeuvres are not to be missed! Details on the event can be found on the RBTC website: https://rbtc.tech/2016/04/cyber-security-forum-vulnerability-management-may/
It was awesome to see so many new faces and so many familiar ones at last Thursday’s meeting, thanks again to ECPI for hosting. We ended up running out of chairs!
I hope to see everyone again next month, where we will dive back down in to the weeds and take an in-depth look at Wireshark.
Get on the mailing list or check the site for more details once we get them finalized.
We meet every 2nd Thursday of the month at 5:30pm. The meeting location rotates between several local businesses and colleges. Please see below to find out how to get on the email list for the meeting announcements. The meeting locations will also be posted to this site.
What is RISE?
We are a group of Roanoke and NRV Information Security Professionals. We get together the 2nd Thursday every month to discuss current security topics. Meetings are free, usually so is the beer, and they are open to anyone.
How Can I Get Added to the Email List for RISE meetings?
Please send an email to RoanokeInfoSec@gmail.com if you would like to be added to the email notification list.
Our next meeting is April 14th at ECPI in Roanoke (address is below) at 5:30pm. The speaker will be an FBI Special Agent who has been with the FBI for 12 years and is currently in the Richmond Division with a focus toward the Roanoke area. He is currently working national security matters and has agreed to come and share with us his experiences and his thoughts on how we can assist in protecting our companies, valley and country.
It’s always good to meet your local FBI liaison. If you have a serious breach at your company or discover illegal activity on your network, you need to know who to contact.
Special thanks to Michael for opening up the ECPI facility to us and to Stephan for lining up our speaker.
5234 Airport Rd NW #200
Roanoke, VA 24012
Our discussion subject for the month of March was Network Pen Tests.
- What are they?
- Do they provide value?
- How are they done?
- What do you do with the results?
Our guest speaker was Russel C. Van Tuyl (@Ne0nd0g). Russel is an experienced Network Pen Tester with Sword & Shield in Knoxville, TN and has agreed to walk us through his Network Pen Testing procedures.
Here is a quick write up about his presentation:
Attackers can take complete control of a Windows domain by establishing full administrative rights to networks resources. This access can then be used to steal your organizations crown jewels, the thing that makes your organization money. This talk will introduce common attack paths used to compromise a domain. Additionally, a brief introduction to the tools used to perform some of these common attacks will be covered. This presentation will conclude by providing information on mitigating or detecting these common attacks. The audience will be provided with an opportunity to ask any questions, even if they’re not related to the presentation.
Update: Russel did a fantastic job presenting. His presentation was entertaining and had a ton of great information. He not only covered some of the techniques he uses when pen testing, he also talked about ways to mitigate them. If you didn’t walk away with a “To Do” list of things to check on your network, or a list of fun new things to try, you weren’t paying attention.
Here are the slides from the presentation:
Common Pen Testing Techniques
He demonstrated how PowerShell can be an admins best friend, or worst enemy, by showing us how easy it was to use PowerShell Empire to compromise a box.
Our own Grant Sims has since created step by step video showing how to use one of the PowerShell techniques Russel spoke about. He shows how to use PowerSploit to get a meterpreter shell:
In the Feb meeting we heard from Mark Cairns from Cisco about how Cisco fits the security niche. Here is what Tom Spitnale from SyCom had to say about Mark’s presentation:
“I was impressed with the presentation he delivered to a group in Richmond just before the holidays. A very granular view of the “life of a packet” as it intersects with security dependent on the circumstances…on premise user, on premise resource, hybrid or cloud resources in the mix, off-premise users, etc. etc. While the presentation is admittedly developed to deliver a “why Cisco meets this market uniquely” message (and spotlights the functionality that different elements of Cisco’s portfolio addresses, both as point solutions and as a collective/integrated umbrella strategy), the discussion points and path from one scenario into the next really painted the picture, for me, of what modern security professionals are tasked with addressing. So I feel like “the pitch” aspect is worth “the story” that he tells.”
Mark spoke about some unique ways Cisco can leverage an end to end solution to provide visibility into the network and how it compares to open source solutions.
How to Improve Your Network Security Monitoring Capabilities Using Security Onion Sensors and Network Architecture
We will be kicking off the New Year with the first part of a two part series. (Open Source Security vs Commercial Products).
This month we will be discussing open source security and how our own Nate Sykes and Grant Sims (bios below) are using open source products to secure their network. Next month we will have Cisco come in and give us an overview of what they can offer from a commercial software standpoint.
Nate and Grant have been working to transition their security posture from a purely prevention based model to a prevent, detect and respond model. Nate and Grant put it this way “Prevention WILL fail. As a defender you have to consider/protect EVERYTHING. An attacker only has to find ONE flaw overlooked, unknown, unpatched or misconfigured.” To that end Nate and Grant will give us an overview of how they use open source security sensors to defend their network.
They will discuss:
Here are the slides from the first part of the presentation:
Security Onion – Part 1
For the second part of the presentation, Grant demoed how to use Security Onion to investigate an AnglerEK incident:
Nate Sykes (@n8sec) is the IT Manager at R&K Solutions, he has been working in IT for 19yrs. Nate has worked in all areas of system and network administration. He has been involved in different aspects of security for the last 6yrs, mostly involving blue team work. He holds GSEC, GMON and Security+ certifications.
Grant Sims (@ChiefRiverSims) is the Sr Security Analyst at R&K Solutions, he has been working in IT for 9yrs. He has a networking background, developed while working in a major DoD data center. He holds CCNA-Voice, CCDP, CCNP, Security+ and GPEN certifications.