BSides San Antonio 2017

The BSides San Antonio conference was good again this year. The more I attend the conferences the more I enjoy the turbo talks. The local hacker communities in Austin, Houston, and San Antonio always bring forth great content for them. My only complaint was that the venue rooms were a little too small this year. Each room only held around 30 people. There were spillover rooms but the video conference system used to show the presenter in the other room was quirky and the audio would cut out some. I made it a point to get to each talk I wanted to see really early in order to get a seat. Hopefully next year they are able to upgrade to a better conference or space within the university. I bought $20 in raffle tickets for the benefit of Hackers for Charity. I ended up winning a Cyber Threat Defender card game and an Amazon Echo Dot in the raffle.

BSides Austin 2017

I volunteered for BSides Austin this year. After attending a few BSides conferences I felt it was a nice way to give back to the information security community. The conferences are great for learning about various subjects, networking with people in different areas of the industry, and for sharing ideas.

InfoSec Southwest 2017

The InfoSec Southwest 2017 was great. My turbo talk on OSINT went well and afterward I received some good feedback. Joe Gray from Advanced Persistent Security did a talk on OSINT as well after mine and I learned about some useful tools from him. Joe mentioned Michael Bazzell as being an expert on OSINT and that he had some books available. Michael Bazzell wrote Open Source Intelligence Techniques: Resources for Searching and Analyzing Online Information. My copy should be here next week.

OWASP Meeting March 2017

Derek Weeks from Sonatype was the guest speaker at this the monthly OWASP meeting. The focus was on the the parallels between the auto industry of 35 years ago and software development practices in place today. DevOps teams around the world are consuming billions of open source components and containerized applications to improve productivity at a massive scale. The good news: they are accelerating time to market. The bad news: many of the components and containers they are using are fraught with defects including critical security vulnerabilities.

Open source download components for java increased from 10,000,000,000 in July 2014 to 50,000,000,000 in July 2016. A good percentage of the downloads have known vulnerabilities and are being repackaged into things like healthcare applications. Software developers outnumber security professionals 100 to 1 at this time. And information security teams are considered a hindrance to development cycles. Removing vulnerable components causes issues for developers also because old versions are re-written at times to patch vulnerabilities. While other times known vulnerabilities are re-released into the wild.

For now companies need to be taking more time into reviewing the packages and components going into software being developed. Maintaining an inventory of open source components is done at a small level currently and that needs to change.

Cyberpatriot Competition

The Cyberpatriots took a week off and were back last week for a competition round. They scored well on the Windows and Linux tests averaging around 18 out of 20 answers. The Cisco testing was not started until late after the Windows and Linux tests were completed. The Cisco test seems to be a little bit easier to complete because it walks each student through the steps in the Cisco Packet Tracer app. Once the students know where to click and edit the settings they should be able to complete the sections faster. We had been focusing more on Windows and Linux up until now. Last week I recorded a video on how to review local policy settings and some other various Windows steps that each team had trouble with. Seeing how to click through and make the changes
helped them understand what to do better. I’m proud of how well they are progressing so far.

Cyberpatriots Meeting 10/26

Last week I had to skip one of the practice sessions. This week I reviewed the results with the team to help determine where they were having problems. After checking the readme file instructions they all missed setting up security policies to enforce password strength. The second half of the class I talked to the students about careers in IT and did an overview of various types of security and how hackers will circumvent security measures. The students became more engaged once I started talking about hacking and social engineering some. Usually they are pretty tired because it’s after their last class for the day. Some students stayed after class to ask more questions this time. I’m glad that they are taking more interest now and that they are seeing the potential for finding careers in IT and/or Information Security.