We spend a lot of time discussing the on-line portion of InfoSec: application vulnerabilities, buffer overflows, log review, and network traffic analysis. But physical security remains an important part of an organization’s plan for dealing with threats. Environments that house particularly sensitive data may need to track or detect wireless devices for inventory tracking and secure area sanitization.
Selecting a Managed Security Services Provider shouldn’t be like speed dating, but rather like finding a life partner. This presentation will help guide you in finding an MSSP that meets your organization’s needs so you can “swipe left” on MSSPs that are all show and no go.
Note: This cooperative event will start at 6:30pm!
Capture the Flag challenges offer the opportunity to improve your InfoSec skills whether you are a seasoned penetration tester or just starting your journey. An InfoSec novice may not sweep the competition but they will certainly improve their knowledge. Trying new things can be hard especially in a profession that contains talent that, at times, seems untouchable. Let’s calm those fears with a CtF demonstration and review.
Hope everyone had a great holiday break! Our next RISE meeting will be this coming Thursday the 11th at 5:30 pm R&K Solutions. We will be trying our hand at the SANS 2017 Holiday Hack. Please see the link below to setup your account and then bring your laptop on the 11th. While we won’t be getting through the entire thing we will have a chance to hang out and share ideas. This is an excellent opportunity to learn some new chops and to show off the ones you have. Come on out, you don’t want to miss out on this year’s event.
2797 Frontage Rd NW
Roanoke, VA 24017
Let’s do this!!!
We had a great time at our December meeting trying our hand at the SANS Holiday Hack and we are planning on our next meeting being just as entertaining. This month we will having an “Open Mic Night” at ECPI on January 12th at 5:30pm.
Here’s how it works, collect those burning IT Security questions and bring them to the group. We will give everyone an opportunity to ask the group questions and then see what we as a group of security professionals can contribute as a whole. The idea is that one of us is never as smart as all of us so let’s share our questions and our knowledge to better secure the valley. If you don’t have any questions that’s fine, we still need you to share your experiences with those of us that do have questions.
We look forward to seeing everyone on Thursday the 12th at ECPI.
The SANS Holiday Hack Challenge is going to be released on Dec 9th, we’re going to party on Dec 15th:
If you’re not familiar with the challenge it is an annual event put on by Ed Skoudis and his team. It is essentially a game that involves a series of cyber security challenges designed to get you to learn a wide variety of skills. The team does a phenomenal job. It has elements for all skill levels and hints as you go along the way. Last year’s challenge was EPIC and I think my wife was ready to kill me if I didn’t stop playing. I’ll warn you, it can get addictive.
The challenges are kept online each year so you can continue to play, even if you didn’t complete it by the deadline. Here is last year’s challenge if you want take a look: https://holidayhackchallenge.com/ This link will likely update to the 2016 challenge on 12/9. If so, here is a list of past challenges: https://pen-testing.sans.org/holiday-challenge/
I can honestly say, after playing last year, I have looked forward to this year’s challenge all year long. My wife, maybe not so much, since I had my head buried in my laptop for 2 weeks last time 🙂 Here are just a few of the things I either learned about, or added skills to while playing last years challenge: sed, awk, scapy, python, JSON, SQL injection techniques, numerous web application pentesting techniques, Burp Suite, mondoDB, firmware extraction, DNS CnC and data exfil. And when I wasn’t pulling out my hair, I had an absolute blast doing it!
Join us on 12/15 to work on the Holiday Hack Challenge. It is for all skill levels and you will be surprised how much you will learn. We will have wifi access available so everyone can work on the challenge. If you are a student and want to participate but don’t have a laptop, let us know and I will make arrangements so you will have somethig to work on.
To make the best use of the time at the party, go ahead and sign up for an account once the challenge is posted on 12/9. You can start playing anytime after you get an account. I also recommend having some sort of virtualization software on your laptop such as VirtualBox or VMWare Player, both are free. And having a VM running Kali set up. Or if Kali is your main OS you may want to have a Windows VM setup. All of that will aid you in the challenge.
As usual we’ll have beer/soda and snacks. Just bring your brains because you’re going to need them.
The meeting will be at 5:30pm on 12/15 at R&K Solutions, 2797 Frontage Rd NW, STE 1000, Roanoke, VA 24017. Google Maps.
We are in for a treat in September! Jeremy Dorrough is going to do an updated version of the presentation he did at DEF CON last year.
USB Attack to Decrypt Wi-Fi Communications
Jeremy Dorrough Senior Network Security Architect / Genworth Financial
The term “Bad USB” has gotten some much needed press in last few months. There have been talks that have identified the risks that are caused by the inherent trust between the OS and any device attached by USB. I found in my research that most of the available payloads for the USB rubber ducky would be stopped by common enterprise security solutions. I then set out to create a new exploit that would force the victim to trust my Man-In-The-Middle access point. After my payload is deployed, all Wi-Fi communications will be readable, including usernames, passwords and authentication cookies. The attack will work without the need of elevating privileges, which makes it ideal for corporate environments.
Bio: Jeremy has built his career around protecting assets in the most critical IT sectors. He started his career working in a Network Operations Security Center for the US Army. He then went on to work as a Network Security Engineer defending Dominion’s North Anna Nuclear Power Station. He is currently a Senior Network Security Engineer/Architect at Genworth Financial. He is a MBA, CISSP, CEH, GIAC GPPA, CSA CCSK, ABCDEFG… Blah Blah Blah.
Jeremy has spent over 10 years researching and implementing new ways to defend against the latest attacks. He enjoys creating new exploits and feels it makes him a more well-rounded defensive Security Engineer. He is happily married and a father to two soon to be hackers. When he’s not staring at a command prompt, he is busy building and driving demolition derby cars.
ECPI was kind enough to host this month, the meeting will be on Sept. 8th @ 5:30pm.
Our own Rob Garbee (Bio below) will be presenting Thursday, August 11th, at R&K Solutions (Google Maps). Rob will be talking about 5 steps to getting the funding you need for IT Security. As we all know getting the funding for personnel or security tools can often be difficult. If you haven’t had a breach everyone often assumes everything is fine. Why do we need all this security stuff? Rob will cover some strategies to win the battle with management to justify the security funding you need.
Bio: Robert Garbee works as a Technical Security Analyst with a mid-tier medical service provider in Roanoke, VA. In this role, Robert is responsible for managing risk and compliance aspects for both HIPAA related activities and overarching business concerns. Robert has more than 20 years of experience in information technology and during that time has held IT positions in the banking industry, DOD contracting, and most recently HIPAA security and compliance. Robert is a graduate of Liberty University with a BMIS degree and holds an ISC2 CISSP certification. Prior to starting his information technology career Robert served seven years as a crew chief on C-5 Galaxies in the United States Air Force.