Dec 2017 – Hack-Lab with Oracle Ravello Cloud

thebat

We will be meeting on Dec. 14th at ECPI at 5:30 pm

Grant Sims will be presenting Oracle Ravello Cloud and how it can be used as a training platform, in a “Hack-Lab” scenario. The presentation will explain the benefits of utilizing the Ravello Cloud and how the underlying “Nested Virtualization” technology can expand our InfoSec training & testing capabilities. The short presentation will be followed by a demo of the Ravello platform and the “Hack-Lab” Grant has created within.

Grant Sims

Grant Sims has been an IT professional for over the last 10 years. His professional path began as a Network Engineer for the US DoD and is now currently a Security Engineer for Advance Auto Parts. He has a passion for security and an even greater passion for sharing his knowledge! Grant claims not to be an expert of any kind but rather a firm believer in that we all possess knowledge and experiences to share that would benefit likeminded individuals.

ECPI

5234 Airport Rd NW #200,

Roanoke, VA 24012

 

Cancelled!!! November 2017 – Intro to KALI

KALI

I’m sorry but we have had to cancel this meeting due to an unforeseen scheduling conflict at ECPI.  We will be meeting next month.

Our next meeting will be on Nov. 9th at ECPI in Roanoke, VA. at 5:30pm.  Our subject will be an Intro to KALI Linux.   We will be going through some of the more popular tools such as Metasploit, AirCrack-NG and OpenVAS as well as Offensive Security cert paths.

 

More info about KALI below:

Kali Linux is a Debian-based Linux distribution aimed at advanced Penetration Testing and Security Auditing. Kali contains several hundred tools which are geared towards various information security tasks, such as Penetration Testing, Security research, Computer Forensics and Reverse Engineering. Kali Linux is developed, funded and maintained by Offensive Security, a leading information security training company.

ECPI’s address:

5234 Airport Rd NW #200

Roanoke, VA 24012

The Software Defined Enterprise

puzzle-prepration

The next RISE meeting will be July 13th at 5:30 pm at ECPI in Roanoke (address is below).  Our discussion will be The Software Defined Enterprise, Building Security into the Infrastructure with Darrell Hix.  This will fall right in line with our recent discussion of Zero Trust Networks and should be an excellent opportunity to dig deeper into how virtualization technologies are helping push the Zero Trust Network methodology forward.

Here is Darrell’s Bio.

Darrell has spent 25 years in the Information Technology field beginning as a system administrator, then as a System Engineer/Analyst, Data Center Architect, Enterprise Architect and now as his current role as a Technical Account Manager for VMware.  He has worked with the Department of Defense, managed professional services teams for a System Integration firm, worked for Defense Contractors and now works for the leading virtualization and cloud software company in the world.  His experience ranges from developing early secure messaging networks for the US Navy, designing enterprise virtual desktop architectures for a Fortune 500 defense contractor and leading an initiative to leverage cloud computing capabilities to better support software development teams for project collaboration.  Darrell now acts as a technical adviser and advocate for key VMware, Inc. customers within the US Department of Defense spectrum.

ECPI
5234 Airport Rd NW #200
Roanoke, VA 24012

So Hot Right Now!

1ozagu

Let me just start off by saying The reports of our death are greatly exaggerated!  RISE is not dead, we were merely dormant due to issues beyond our control.  We are back now and better than ever!

So what’s next?  Well we thought we would cover the most recent attack, WannaCry.  Seems like we were all covered up pretty good with this one, so with that in mind we want to discuss it.  What was it?  Why was it successful?  How can we prevent it?  This will be an open discussion so be prepared to share your thoughts.  What crazy things did your senior management team have you do in preparation for this one?  Did it work?  What is your war story?  We want to know.  Come on out, have a beverage and share your thoughts among friends.

We will be meeting on June 8th at 5:30 at R&K Solutions.  (Thanks Nate)

See you all there!

 

R&K Solutions

2797 Frontage Rd NW

Roanoke, VA 24017

 

 

March 2017 – 20 Critical Security Controls

technology.png

Hello all,

I am very pleased to announce that Randy Marchany (I’m sure he’ll sign autographs later) from Virginia Tech has agreed to speak about the 20 Critical Security Controls at our next meeting.  This will be a great presentation from a great speaker, you really want to make this one if you can.  Our meeting will be at ECPI in Roanoke at 5:30pm on the 9th.  I have included the address below.  Thanks to ECPI for hosting this month and all those that make our meetings possible.  You guys rock!

The 20 Critical Security Controls

Defending information systems is becoming more complicated with the introduction of personally owned mobile devices (BYOD) and the Internet of Things (IoT) controllers. Where to spend your cyber defense budget effectively depends on your ability to prioritize where these dollars should be spent.  The 20 Critical Security controls provide a prioritized set of controls and metrics to give you the best chance of actually defending your IT assets. The controls align with a number of well established security standards/frameworks such as ISO 27002, NIST 800-53, PCI among them. This talk describes what the controls are and provides some metrics and spreadsheets for performing a gap analysis of the controls implementation. Virginia Tech is actively implementing the controls and this talk will discuss some of the successes and roadblocks encountered so far.

OK so normally I put a little bio together for our speaker so you have a chance to read a little background on the speaker but honestly Randy is such a cyber superstar that his bio is literally a page long.  So, while not complete here are some highlights of Randy’s bio.  Please check out the link at the bottom of the message for more info on Randy.

Randy is University Information Security Officer for Virginia Tech. He is also the director of the VA Tech IT Security Lab, a component of the university’s Information Technology Security Office.  He is the author of VA Tech’s Acceptable Use Statement and a co-author of the original FBI/SANS Institute’s “Top 10/20 Internet Security Vulnerabilities” document. He is a co-author of the SANS Institute’s “Responding to Distributed Denial of Service Attacks” document that was prepared at the request of the White House in response to the DDOS attacks of 2000.  He is also one of the founders of the Virginia Alliance for Secure Computing and Networking (www.vascan.org), a consortium of security practitioners and researchers from VA Tech, U of Virginia, James Madison Univ., George Mason Univ. He has been a frequent speaker at national and international conferences such as Educause, SANS, IIA, ISACA, ACUA, International CISO symposium, IEEE, NIST, NY State OIT Security conference, FBI-Infraguard chapters, RSA.

Randys Bio

https://members.educause.edu/randy-marchany

ECPI

5234 Airport Rd NW Suite 200

Roanoke, VA 24012

November 2016 – Continuous Pentesting

continuous-battle

The next RISE meeting will be at Virginia Western community college in the Natural Science Center (directions are below). Our speaker will be Darren Manners from SyCom and he will be discussing Redspy365 and the rise of automated pentesting.

redspy

Darren designed this automated approach and he has a list of certs longer than a Nascar race. Come out and learn from one of the innovators in the field.

Here is Darren’s Bio:
Darren is the Lead Penetration Tester for SyCom Technologies, 9 years Royal Naval Intelligence (Communication Technician (Analyst)) Worked for 15 years in various security roles with VAR’s and education. Certifications obtained include; SANS Cyber Guardian (Red/Blue), SANS GSE (#42), CCIE sec (18929), OSCP, CISSP, CISA and others. Written papers on iPhone backup files for penetration testing and anomaly detection using user agent headers. Designer of RedSpy 365, Sphere of Influence (security visualization tool) and Ice-hole. (email phishing tool)
We will be meeting at our usual time of 5:30 pm on November the 10th.
Snacks and drinks will be provided as always.

Location: Charles L. Downs Natural Science Center, Roanoke, VA 24015

Oct 2016 – Your Money or Your Data

robbery-ransomware

Join us for an interactive forensics scavenger hunt analyzing a pcap with some of the latest variants of ransomware. We will be looking at how Angler EK can, and often will deliver multiple infections such as Locky, CryptXXX and even some unknown goodies.

This will be an interactive session and I will try to come up with some small goodies to give away for those that solve the pieces to the puzzle first. Please bring a laptop with Wireshark installed to participate. Wireshark is a free protocol analyzer and an excellent tool for you toolbox. You can download it here: https://www.wireshark.org/

If you aren’t sure how to use Wireshark you can review the notes from our May session about Wireshark. There are also some good tutorials on Youtube. These both use the old Wireshark interface, the new one looks a bit different. All of the concepts are the same, some of the menus have just been moved around. If you have it installed, and are familiar with it, the session will be a lot more beneficial to you.

The meeting will be on 10/13 at R&K Solutions, 2797 Frontage Rd NW, STE 1000, Roanoke, VA 24017 at 5:30pm. Google Maps.

Presenter Bio:

Nate Sykes is the IT Director at R&K Solutions. Nate has worked in all areas of system and network administration. He has been involved in different aspects of security for the last 6yrs, mostly involving prevention and detection. He holds GSEC, GMON and Security+ certifications.

Twitter: @n8sec