摘要: 继加入浙江省网络空间安全协会之后，闪捷信息再次得到行业高度认可，于近日喜获中国信息协会量子信息分会颁发的会员单位证书，正式成为协会的成员之一。 量子信息技术已经被国家列入十三五优先发展的国家级重大科技项目之中，作为战略性新兴产业的重要组成部分，其在提升我国信...

继加入浙江省网络空间安全协会之后，闪捷信息再次得到行业高度认可，于近日喜获中国信息协会量子信息分会颁发的会员单位证书，正式成为协会的成员之一。

量子信息技术已经被国家列入十三五优先发展的国家级重大科技项目之中，作为战略性新兴产业的重要组成部分，其在提升我国信息产业的核心竞争力、加快产业结构调整、推动产业转型升级方面起到越来越显著的作用。

中国信息协会量子信息分会是国内首个定位于面向量子信息领域的专业社团机构，在我国量子信息相关的政、产、学、研、用等各方面，起着引导、组织、协调的作用，并可积极提供产业资讯。量子信息分会以推进量子技术的开发利用和信息服务业的发展为重点，致力于搭建政府与企业、政府与公众之间的桥梁。

发展量子信息产业，需要构建完整的产业链条，协同发展才有可能实现。闪捷信息作为国内专业的数据安全解决方案提供商，有幸成为中国信息协会量子信息分会会员单位，将严格履行会员单位的责任和义务，积极参与国家量子信息产业的应用推广。今后，闪捷信息将利用自身在数据安全领域的技术优势，积极探索量子加密技术在数据安全领域的发展方向，并致力于完善量子加密技术在数据安全领域的产品研发和成果转化，竭力为用户提供业界领先的数据安全防护系列产品及解决方案，帮助用户实现数据安全严密防护和合规管理。

相关文章 闪捷信息入选安全牛数据库安全领域厂商矩阵图 闪捷信息首亮相世界互联网大会，齐力构建互信共治的数字世界 大咖齐聚合肥网络安全大会，闪捷信息护航数字未来 大型连锁酒店数据泄露风波再起，数据安全问题几时休？ 金融大鳄齐聚2018未来银行创新峰会，闪捷信息受邀出席

Post Syndicated fromBruce Schneier original https://www.schneier.com/blog/archives/2018/12/your_personal_d.html

In an excellent blog post , Brian Krebs makes clear something I have been saying for a while:

Likewise for individuals, it pays to accept two unfortunate and harsh realities:

Once you’ve owned both of these realities, you realize that expecting another company to safeguard your security is a fool’s errand, and that it makes far more sense to focus instead on doing everything you can to proactively prevent identity thieves, malicious hackers or other ne’er-do-wells from abusing access to said data.

His advice is good.

The Sitecore Roles-In-Roles is an extension to the basic authorization that have been around ever since Sitecore 5.

Roles-In-Roles allows you to have nested roles, so when you add a role to a user, the user is granted that role, including all the nested roles.

The roles in Sitecore does not only grant access to content, but also to functions, such as publishing , account managing , translating etc. In an attempt to simplify the process of granting authors access to content AND functions, the idea of embedding function roles into one access role was born.

So with roles-in-roles you can create a super-role that grants access to content and functions at the same time.

In the sitecore.config you will find the rolesInRolesManager configuration setting that points to the database where the rolesinroles table is defined.

Look at the “Developer” roles in the Roles Manager:

Roles Manager

If you click the “ Member Of ” button you will see all the roles that is embedded into the “Developer” roles:

Roles Manager Member Of

That means that when my user is granted the “ Developer ” role:

User Manager Select Roles

The user will automatically be granted the “ Developer ” roles, plus any embedded roles within the “ Developer ” role. Also, if any roles inside the “ Developer ” role has embedded roles, these roles are also included.

User Manager Roles

This article was originally published in Forbes

For years, deploying an IT solution meant first buying computers and storage devices, then connecting them inside a corporate data center and then installing software on them. All this has changed significantly in the past decade at many enterprises worldwide. Consuming different IT solutions “as a service” means that one doesn’t need to acquire the hardware and care for them; instead, one gets either a complete turn-key application or an infrastructure for running one “as a service” and can just use it.

While for some kinds of applications ― for example, an email server or a CRM ― consumption as a service has become the mainstream and has, by far, surpassed the usage of self-hosted equivalents, other areas, such as IT security, remain mostly self-hosted/managed, even at organizations that are adopting modern cloud-based IT solutions. My company provides infrastructure as a service to our corporate customers, and having real enterprise-grade security is a must.

Below are my largest concerns with adopting security as a service and explanations on how I personally resolved them. I welcome any feedback, comments and expression of other opinions, especially if they are different from mine.

Health care: When we are sick, we rely on accredited and certified health care providers to cure us. Usually, we have a wide variety of such providers to choose from, and this will usually guarantee a better result than trying home cures.

Finances: We keep our money with financial services (banks, insurance companies) most of the time. Doing so gets us much better certainty and management of our wealth than keeping money hidden in our basements.

Homes: The safest place any of us ever has ― his or her home ― in most cases was built by a professional construction services provider, rather than by any of us.

Naturally, we could think of many more examples, having the following common quality: When the problem we are trying to solve is critical and requires expertise to solve, modern society is built on relying on external service providers (rather than turning each society member into a universal genius/MacGyver capable of solving all problems by himself/herself). It is only about realizing that external parties can be more competent at solving a wide variety of IT security problems, doing so more efficiently and finding a universal way of relying on them. It’s not that different than trusting your doctor or your bank: something that all of us do.

In various cases, this data can be sensitive to our business or to our customers, and we would want to guard it to the best of our ability. Does guarding the data mean keeping it to ourselves (and our own employees)? How many cases of malicious employee or internal data leaks are there versus cases of service providers being the sources of the data leaks?

Performing due diligence for data sub-processors that we use in our company has taught me that serious service providers are taking earnest steps to protect their customers’ data. Based on my previous experience of over a decade and a half with organizations, running “self-hosted” IT security and infrastructure operations, I seriously doubt that even a third of these measures are usually taken internally. It’s definitely made me think.

While I cannot speak for all possible verticals and all regulatory frameworks, any reasonable regulator understands the modern business reality. It isn’t feasible to build a resilient IT infrastructure all by one’s self and have a TCO comparable to an alternative that is using various service providers. All commonsense considerations dictate that organizations that focus on providing infrastructure (or application) services, and specializing in their fields, will always have a competitive advantage in the delivery of such a service in comparison to an organization with a different focus that tries to deliver such an infrastructure by itself.

Regulators understand that, and regulatory frameworks now define duties of sub-processors and sub-contractors that can be leveraged in order to deliver an effective competitive solution. Just choose the right sub-contractors, and you’ll remain compliant with the regulations.

In my humble opinion, the decision on which IT security tools to use has to be driven by choosing the best and most efficient solutions. Just as my physician ― who isn’t necessarily smarter or more intelligent than I am, but is much more experienced at providing medical services (seeing patients every day) and has received education, training and certification in his field ― many serious IT security providers are positioned to deliver a service that offers much better security, resilience, reliability and cost-effectiveness than if I did it myself. It is all about choosing the right physician to visit and the right IT security service provider. Luckily, the industry is developing, and we are getting more and more common tools and unbiased ways to assess the level of service delivered by different providers, allowing us to make calculated choices.

I stand firmly behind my choices as expressed here and welcome any comments or suggestions.

Cyber risk management is significantly more difficult today than it was two years ago.

That's according to new ESG research involving 340 enterprise cybersecurity, GRC, and IT professionals who were asked to compare cyber risk management today to two years ago. (Note: I am an employee of ESG.) The data indicates that 39 percent of survey respondents believe that cyber risk management is significantly more difficult today than it was two years ago, while another 34 percent say that cyber risk management is somewhat more difficult today than it was two years ago.

Why do 73 percent of cybersecurity, GRC, and IT professionals believe cyber risk management is more problematic? Several issues stand out:

Think about this data from a CISO perspective. Your bosses are pushing you for more frequent updates on cyber risk management, and they want it presented in a business context. Meanwhile, your staff ― which is likely incrementally bigger than it was two years ago, if at all ― must collect, process, analyze, and report on risk management across from an increasing and vulnerable attack surface, being targeted by more sophisticated cyber-adversaries.

Let’s face it, CISOs are being forced to bring knives to a cyber risk management gun fight ― this model is completely broken. Fortunately, there is hope. Stay tuned for future blog posts.

The term hacking has been around for a long time now. The first recorded instance of hacking dates back to the early 1960s in MIT where both the terms, ‘Hacking’ and ‘Hacker’ were coined. Since then, hacking has evolved into a broadly followed discipline for the computing community. In this “What is Ethical Hacking” article, we are going to go through the fundamentals of Ethical Hacking!

The following topics are discussed in this blog:

Hacking is the process of finding vulnerabilities in a system and using these found vulnerabilities to gain unauthorized access into the system to perform malicious activities ranging from deleting system files to stealing sensitive information. Hacking is illegal and can lead to extreme consequences if you are caught in the act. People have been sentenced to years of imprisonment because of hacking.

Nonetheless, hacking can be legal if done with permission. Computer experts are often hired by companies to hack into their system to find vulnerabilities and weak endpoints so that they can be fixed. This is done as a precautionary measure against legitimate hackers who have malicious intent. Such people, who hack into a system with permission, without any malicious intent, are known as e thical hackers and the process is known as e thicalhacking.

So now that we know what exactly ethical hacking is, and who ethical hackers are, let’s go over the different types of hackers.

Hackers can be segregated according to their intent.

White Hat Hacker

Black Hat Hacker

Grey Hat Hacker

Suicide Hacker

Now that we have discussed the various types of Hackers, let’s go over the different types of hacking. We can segregate hacking into different types depending on what the hacker is trying to achieve.

Website Hacking

Network Hacking

Hacking a network means gathering information about a network by using tools like Telnet, NS lookup, Ping, Tracert, Netstat, etc. with the intent to harm the network system and hamper its operation.

Email Hacking

Password Hacking

Computer Hacking

Like every discipline out there in the world, ethical hacking is divided into distinct phases. Ethical hacking has 6 distinct phases. These phases are not strict rules, but more like a guideline to be followed.

Reconnaissance

Reconnaissance is the process of information gathering. In this phase, the hacker gathers relevant information regarding the target system. These include detecting services, operating systems, packet-hops to reach the system, IP configuration etc. Various tools like Nmap, Hping, Google Dorks etc are used for reconnaissance purposes

Scanning

In the scanning phase, the hacker begins to actively probe the target machine or network for vulnerabilities that can be exploited. Tools like Nessus, Nexpose, and NMAP are widely used by hackers in this process.

Cybersecurity Certification Course

Gaining Access

In this phase, the vulnerability located during scanning is exploited using various methods and the hacker tries to enter the target system without raising any alarms. The primary tool that is used in this process is Metasploit.

Maintaining Access

This is one of the most integral phases. In this phase, the hacker installs various backdoors and payloads onto the target system. Just in case you don’t know, Payload is a term used for activities performed on a system after gaining unauthorized access. Backdoors help the hacker gaining quicker access onto the target system in the future.

Clearing Tracks

This process is an unethical activity. It has to do with the deletion of logs of all the activities that take place during the hacking process. Nonetheless, Ethical Hackers still have to perform this phase to demonstrate how a Black Hat Hacker would go about his activities.

Reporting

Reporting is the last step of finishing the ethical hacking process. Here the Ethical Hacker compiles a report with his findings and the job that was done such as the tools used, the success rate, vulnerabilities found, and the exploit processes.

去年遇到一套这个程序而挖的, 主要也就是因为开发者过于的相信php自带的FILTER_VALIDATE_EMAIL邮箱验证。

在使用了filter_var($email,FILTER_VALIDATE_EMAIL);

验证邮箱后, 没有进一步做处理 直接格式化字符串进了sql语句导致了注入。

本地调试版本: PHP5.4.5

首先来看看PHP的filter_var($email,FILTER_VALIDATE_EMAIL);是如何来验证邮箱是否合法的。

https://github.com/php-src/php/blob/2b86a89193c151b5e9b098cc9aa8411abd7f30ea/ext/filter/filter.c

php_filter_call里调用php_zval_filter,

根据id, 查找到filter_func, 然后调用指定的方法。

filter_var第二个参数为FILTER_VALIDATE_EMAIL时, 调用的是 php_filter_validate_email方法。

https://github.com/php-src/php/blob/PHP-5.4.5/ext/filter/logical_filters.c

去年提交这个漏洞的时候, 一直不知道怎么才能插入括号, 那时候用的双参数拼接的方法注入。

不过看这正则可以发现,

如果email的local part不以双引号开头和结尾, 允许的字符为

\x21\x23-\x27\x2A\x2B\x2D\x2F-\x39\x3D\x3F\x5E-\x7E

如果以双引号开头和结尾, 允许的字符为

\x01-\x08\x0B\x0C\x0E-\x1F\x21\x23-\x5B\x5D-\x7F

且如果前面的字符为\x5c, 后面紧跟的字符允许范围为 \x00-\x7F。

在local part以双引号开头和结尾这种情况中, 括号\x28 \x29在允许的字符范围内, 所以可以把括号写到双引号中。

虽然php_filter_validate_email允许邮箱最长为320个字符, 但是local part被正则限制到最多64个字符。

(直接复制当初的邮件了~~~)

In the latest version of phpMyFAQ, there is a SQL Injection vulnerability in ajaxservice.php.

The email variable uses FILTER_VALIDATE_EMAIL to validate, but FILTER_VALIDATE_EMAIL lter cannot completely prevent SQL Injection. With this lter, single quotes and some special characters can still be used, that’s enough for SQL Injection.

The mail variable is loaded into the commentData variable,

and the commentData variable is inserted into the database directly, thus leads to SQL Injection vulnerability.

test the phpMyFAQ demo.

Firstly, add a question and got the question id.

Secondly ,

在安全圈，404安全实验室是个非常火的团队。它活跃在安全圈，也活跃在社交媒体上。

它为什么这么火，有人总结道，这是因为知道创宇内部的成员自发的进行分享，成为了一种文化。

它就是是个怎样的团队？知道创宇404安全实验室的副总监隋刚为我们展现了团队真实的一面：如果用一个词来形容404安全实验室，那就是务实。

事实上，知道创宇404安全实验室是一个技术非常强的团队。它曾多次获Adobe、Oracle、Evernote等多个致谢；从2014年的“心脏出血”漏洞，到永恒之蓝，背后都有404安全实验室为整个行业作出了自己的一份贡献。

这一次，嘶吼小编和知道创宇404安全实验室的副总监隋刚展开了对话，带我们领略知道创宇实验室的分享精神。

小编 ： 我看到“404”这个字，第一反应是HTTP 404，知道创宇404的名字由来是什么？

隋刚 ： 很多人都问过我这个问题，404的来源其实就是来源于门牌号。当时我们是在金威大厦的404室，之前叫研究部，现在就叫404安全研究实验室了。

小编 ： 您是什么时候加入知道创宇404安全实验室的的？为什么选择加入？加入后的第一印象是什么？

隋刚 ： 我是15年下半年的时候加入的。我有个很不错的哥们，他原本就已经来到知道创宇了，和我分享到，当时整个404团队都在打CTF。这种比赛现在很流行，但早在三四年前它还不是特别火，比赛是对漏洞的理解和漏洞利技能的考量。我原来所在的在传统网络安全公司里面是看不到的， 一旦有了这种氛围之后，你就会有那种激情澎湃的状态。

小编 ： 传统安全企业当时是什么样的？

隋刚：传统的这种网络安全公司更多的针对于设备上的安全、企业内网的安全。

小编：以防护为主吗？比如杀毒软件、防火墙、堡垒机？

小编：知道创宇和传统安全企业有什么区别？

隋刚：互联网安全它的性质和传统安全不同，这个范围变大了很多。比如2014年“心脏出血”的那个漏洞，如果把它放在企业内网的话可能这只是发了一条公告：有个“心脏出血”漏洞出现了。而这个漏洞的影响面或影响范围以及它能造成什么影响这些都是没有的。 但如果你站在知道创宇404安全实验室角度去看，因为有ZoomEye网络空间安全搜索引擎，那么整个放眼过去看的是整个互联网空间，我们看到更多的是漏洞在全球层面的影响，它能够间接的看到不同国家区域的处理情况和应急效率。这其实是一个量变到质变的过程。

小编：我近期看了404安全实验室的专栏，发现从15年到现在我们的研究方向有着很大的变化。团队最早期发表关于挖洞的文章比较多，而近期则是区块链安全等方向。我们的研究方向是如何进化的？

隋刚：最早的时候创宇404安全实验室所关注的是“猥琐流派”：WSL（web方向）+CSL（二进制研究方向）。但是随着这个整个业务发展和互联网安全的变化，我们404安全实验室也在积极应对变化，404安全实验室就会针对不同的业务会产生了新的团队，到目前知道创宇404安全实验室已发展为包括404安全漏洞研究团队、404网络空间研究团队、404积极防御团队、404先进技术研究团队、404未来安全研究团队、404区块链安全研究团队、404安全保障支撑团队、404 ScanV安全服务研究团在内的综合安全研究团队，安全能力覆盖各细分领域和行业未来发展方向。

小编：知道创宇的业务发展路线是什么，实验室在发展的过程中秉承着什么样的理念？每个研究团队在内部产品生态中的分工和背后的逻辑是什么？

隋刚：在上一个问题里其实已经提到了404安全实验室工作都是围绕“打造公司的安全核心能力及品牌建设”的职能展开的，那么404的理念就是服务支持好公司业务的发展，打造成为世界一流安全实验室。团队的分工和背后的逻辑就是源于此。

如何不Out：越往前走，对个人的素质的要求越高

小编：我们在采访时还听到隔壁有团队成员在进行分享，404安全实验室是不是一个特别热衷于分享的团队。

隋刚：是的，我跟黑哥（知道创宇首席安全官周景平）一直以来都非常认同坚持与分享。团队内部比如有一些不错的一些技巧，不管是漏洞方面还是极客方面的，我们都会去推进。这样就会带来一种信息的互通，包括技术上的一些沟通交流，由此可能会碰撞出一些不错的一些点子或者火花。

举一个例子，我们404武汉团队有一个成员，他发现了一个XSS漏洞，他把这个漏洞的具体细节跟我们小伙伴分享了出来，我们的小伙伴又继续去复现这个漏洞，然后进一步的去跟踪，最后发现可以这漏洞进行RCE（远程命令执行），等于把这个漏洞又提升了一次，找到一个更牛逼一些的漏洞，最终获得了致谢。

小编：您作为404安全实验室的“禁军教头”之一，在日常工作中有没有什么感触？

隋刚：我觉得是要 帮小伙伴们充分发挥自己的特长 ，就是更聚焦吧。 因为这些小伙伴如果看不到自己明确的方向，他们会茫然。如果你只是只是告诉他该去做什么事儿，而不告诉他做这个有什么意义，或者有什么目的的话，时间长了他会很茫然，就找不到方向感，他不清楚真正的目标在哪儿。他可能只是针对一个事儿完成的很好，但是他不知道一个长远的规划或者说一个目标。

小编：有没有特别感谢你的小伙伴？

隋刚：有好几个，不是一个。比如说我们有一个小伙，他最初进入404安全实验室的时候什么都搞，也什么都想搞，而且他很羡慕我们团队其他小伙伴的环境。为什么羡慕呢？因为他原来在学校的时候没有这种安全研究社团组织，就是只是说自己觉得这个东西挺有趣的，去琢磨一下；但是他相对于其他有社团这种氛围来说小伙伴来说，其实没有一个比较好的根基。我后来就慢慢把他带到IOT方面，现在他在这个方面也算小有成绩了，他已经做出了一些漏洞分析和挖掘的工作。

小编：知道创宇的博客上有一个研发技能表，（http://blog.knownsec.com/Knownsec_RD_Checklist/index.html）可否详细介绍知道创宇的小伙伴有什么样的技能，加入知道创宇需要有哪些技能？

隋刚： 这个技能的话是死的，其实更多看的还是个人的一种态度。 我们提供的技能表只能能够提供给你一个大致的方向感， 主要还是个人去努力、去坚持、去做。 我认为技能学习是无止境的，技多不压身嘛。但是需要注意的是岗位基本技能匹配，根据不同岗位可能需要的技能侧重点不一样，至于加入我们相比技术技能之外我们更看重人的道德人品及学习能力。 一些被忽视的软能力也非常重要，比如文档、沟通等能力。

小编：努力和坚持只是一方面，其实方法也很重要，您和404的团队成员是如何保持自己的学习能力，让自己不Out的？

隋刚：我们会有一个大致的能力模型。在我们内部，比如说实习生会先做漏洞应急，去熟练整个的这种漏洞的这种复现；那么再往上一层就是要把漏洞具体细节整理成Paper。再往上就是我们会尝试着把这些东西通过写成POC等方式给它展现出来。

小编：作为一个404安全实验室的安全研究成员，如何走在技术的最前列？

我们刚才聊到是为什么我们从Web一直走，走到现在区块链呢。安全也是在发展的，到了现在，我们很难发现一个非常严重的漏洞，攻击方法也发生了变化，以往的攻击可能一个洞打遍天下，现在很难。现在的攻击方式更侧重于针对供应链的攻击、漏洞的组合利用等。 如果你要想挖更好的洞，那么你要对底层的技术要更清楚，对你来说也是一种更高的一种要求。

除了技能之外，的我们更看重的是人的态度和一个学习能力，和道德人品。为什么这样说？因为大家都知道就是我们是一个白帽公司，那么在互联网上这种黑产其实是非常猖狂的，因为你如果道德人品不过关的话，很容易就去做黑产，反而就不太好了。

小编：安全技术从病毒特征码时代到了人工智能时代，整个技术日新月异。未知的领域它的技术，机会和挑战在哪里？我们是如何做的？

隋刚： 更多的是学习，多去学习。 整个知道创宇公司也是一个学习成长性的一个公司，404安全实验室也是一个不断成长的团队，你肯定要面临不同的环境，这种变化而作出挑战。比如说我们404安全实验室，就有可能会像黑产“学习”，这个“学习”不是说去做坏事，而是我们会去部署一些蜜罐，会发现黑产的套路其实是在变化的。我们去年永恒之蓝爆发出来之后，就发现黑产会利用永恒之蓝的漏洞在攻击全球的服务器，搞定服务器后去下载挖矿代码，最初我们觉得也没怎么样，但是后面我们发现挖矿代码是呈直线往上升，我们觉得这个可能有点问题了，因为黑产对经济的追求是非常敏感的，他们一旦发现有巨大的经济利益价值存在的时候就立马就扑上去了。知道创宇一直以来都在对抗黑产，我们就赶紧掉头去学习了区块链相关技术。

但是等到下半年的时候我们会发现整个区块链的世界在走下坡路。从我们观测到的数据发现黑产也在转向，又转回了以前流量攻击的老路线，他们也在变，所以 我们要根据黑产的变化去调整，这是一个对抗的过程。

小编：知道创宇404安全实验室为行业做出哪些贡献？

隋刚：不敢说我们404实验室引领安全行业潮流，但是在我们擅长的领域确实做过不少行业创新的事情，比如说我们在2013年发布了网络空间搜索引擎ZoomEye、基于Seebug漏洞平台漏洞应急体系包括“照妖镜”在线漏洞扫描模式，到我们今年推出的基于暗网空间测绘及情报系统及区块链方向上的系列研究等等，都可以说在国内甚至可能是国际上都是走在行业前列的输出，当然还包括了一些具体的安全研究上的成果， 我这里谈一个点，暂不谈虚的只谈实的。

比如说2014年的那个心脏滴血，15年的Java 反序列化化，16年到17年的永恒之蓝，这些时间点上你要注意看，知道创宇404安全实验室文章也好或者说报告也好，其实跟的是非常紧的。早在14年的时候，整个国内可能还没有漏洞应急响应的这个概念，或者是比较弱化的；但是你现在再看一看，其实是已经推动了整个国家层面的这个变化了。不能说知道创宇404安全实验室是最主要的，但它在这一方面是做出不少的贡献的，比如说对永恒之蓝病毒的研究，其实我们都会有数据支撑的， 就早在永恒之蓝没有爆发之前，方程式组织泄露工具的时候，我们已经对全球各方面进行了排查、应急。

如果用一个词形容404，那就是务实

小编：如果用一个词来形容404安全实验室，您认为哪个词比较合适？

隋刚： 我认为是务实，因为整个公司的业务，404团队的成长其实是随着公司的那个发展而变化的，整个过程是一个循序渐进的过程。为什么说务实呢？就是我们比如说还拿漏洞应急来说，我们都会实际的去复现或者验证，我们现在每年做应急就已经做了一百多份。此外，我们的研究，我们的Paper，都是我们实际亲自去动手做过的，就是我们对技术其实是有这种追求的，就是坚持不懈的追求。所以我认为务实这个词比较合适。

小编：在404安全实验室的眼中，极客精神是什么？

隋刚： 在维基百科上的共同点是：对技术的崇拜与对创新的不断追求。 这个定义我其实挺赞同的，引用黑哥经常给我们提的一句：坚持与分享。我认为这个就是我们的极客精神，有兴趣的可以关注我们的paper.seebug.org这个平台，我们很多最新的研究成果paper都会在这里共享发布。

小编：您有没有什么想要对大家说的话？

隋刚：其实抛开技术和金钱而言，情怀其实也挺重要的，我经常会跟黑哥一起谈这个情怀这个问题，就是虽说现在这个物质很重要，但是在这个互联网安全的这个空间里面如果没有了情怀，这个你作为安全研究其实就会变味，就是不管是，因为你稍有差池就有可能会出一些问题，比如永恒之蓝已经被武器化了，变成了一个大杀器，如果没有情怀会很很危险。 我不提国外怎么样，中国人心里面始终有一种家国情怀，这个前几天跟同事一起喝酒我也提过，家国情怀其实还是挺重要的。

小编：在404安全实验室前行的过程中，我们会灌输这种精神吗？

隋刚：会，肯定会的。不过这个东西真不好说，它不是具体的技术，好与坏，时间能证明一切，就跟刚才那个问题一样，时间能证明一切，我们会努力。虽然可能不一定达不到很高的巅峰，但是我们会一直朝着这个目标去往前走。

我不知道你们有没有看我们办公室走廊上面，就是有一幅照片：创始人IC和老杨扮成大侠，在这里我想提八个字，也是金庸先生笔下的话：侠之大者，为国为民，这就对我们的精神有了很好的诠释。

小编：被金帽子奖提名有什么样的感受？

隋 刚： 非常荣幸，也非常的高兴，这是对我们工作的一种认可，我们也希望能跟更多的人分享我们的研究成果，感谢主办方，也感谢一直支持我们的404安全实验室的朋友们。

It is no shock to those in the cyber community that cybersecurity has become a board-level issue for many enterprises. A PwC survey showed a 20% increase in CEO’s concern over cyber threats. With more and more eyes on CISO’s and their teams, the cybersecurity skills gap has continued to widen a current estimated 350,000 open cybersecurity positions in the US, and a predicted global shortfall of 3.5 million cybersecurity jobs by 2021, reports CSOOnline . The primary shift occurring is the fact that IT is integrating with almost every aspect of the business, where security for years was a siloed function it is now necessary to permeate the entire organization.

Every IT position is also a cybersecurity position now. Every IT worker, every technology worker, needs to be involved with protecting and defending apps, data, devices, infrastructure, and people. The cybersecurity workforce shortage is even worse than what the jobs numbers suggest. ( Source )

Two factors put the cybersecurity industry on a course for this job shortage with the massive wave of outsourcing 10 years ago, we lost a massive body of knowledge as those industry veterans are now leaving altogether. Combined with the state of flux that enterprises and the security organizations specifically find themselves in as a result of digitization has left many leaders questioning what skills are necessary to set their organization up for success in the future. According to the most recent Gartner security and risk survey, 86% of respondents say the digital world is creating new business risk.

First, begin by recognizing that building a security organization for tomorrow starts now. To ensure that your team can support the necessary functions that a digitized enterprise needs, you will need to begin investing in transitioning your teams into those roles. Through 2019, 20% of enterprises will build a security skills management program including experimental recruiting and talent retention practices, up from less than 2% today. (Gartner)

The fastest way to begin is looking internally. This is not a new practice for many senior-level executives, however, in order to support innovative roles you will need innovative hiring practices: widen your scope. Arguably, the cybersecurity skills gap exists because members of the industry don’t know what to prioritize. To transition your organization into the digital age will require new roles and innovative hiring practices.

The Digital Risk Officer (DRO) take a holistic view of risk across the entire enterprise. This includes traditional areas of focus such as IT as well as non-technical organizations leveraging digital technology where they are not aware of the risks associated. This individual will also work closely with more advanced technologies that the enterprise is working with including operational technology (OT), industrial internet of things (IIoT), IoT and mobile.

This role requires technology business leader with experience leading innovative projects, brings strong connections across the enterprise to facilitate buy-in, and has a rich background in program management.

Mid- to senior-level IT management from a team that has exposure to cybersecurity. This individual is going to be working closely with the CISO as a peer but working primarily to ensure that risk is managed and mitigated throughout the organization. They will also be working with new forms of technology as they make their way into the enterprise. Therefore, they must be an effective communicator with a strong background in technology. As the hiring manager, be prepared to invest in an understanding of the regulatory environment and developing their knowledge of security specifically.

Much like a newspaper ombudsman reconciling coverage with the public good, this individual ensures that the clients ― often line-of-business customers ― are supported by security measures (Gartner). This position can be defined as a stakeholder security advocate. They act as a conduit between the core security team and the rest of the enterprise representing and relaying the concerns of non-technical stakeholders and interpreting the strategy of the security team to the rest of the enterprise.

A successful individual in this role will bring strong communication skills (written, oral, and interpersonal) and a rich understanding of cybersecurity at a functional and granular level.

Start with your auditing committee and internal auditors. These individuals have the rich background in security and compliance that this position will require. Be prepared, however, to invest in their ability to solicit buy-in and hype the organization’s security program. Starting with a technical individual and helping them develop soft skills will require that you support them with mentorship and incentivize the development of those skills.

As the name suggests, this position sits at the intersection of data science and data security. Data science, a more attractive discipline in today’s market, uses advanced mathematical models to manipulate large volumes of data and supplement business decisions. Data security works with large volumes of data to predict, prioritize, and mitigate risk mainly through advanced anomaly detection.

A strong candidate will bring a background in data science (bonus points for projects that cross disciplines). As well as an understanding of the data collected by security teams.

Start with your organization’s data analysts. Since this role is a narrower scope than a broad spectrum business analytics position, the probability you will find the right fit from that talent pool is significantly higher. Furthermore, as data science is the baseline skillset necessary, you will need to invest some time in their knowledge of the security space which is significantly less than training a security professional in data science.

As the enterprise continues to outsource peripheral functions and integrate automation technologies, they become less like an entity and more like an ecosystem. The Digital ecosystem manager ensures that the enterprise ecosystem stays secure. Where the DRO is focused on the internal risk within the organization, the digital ecosystem manager is concerned with the other players that interact with the enterprise.

Think of this role as vendor risk management expanded. As a result, a successful ecosystem manager will bring the skills necessary for that role as well as an effective communication style and a background capable of managing the expansive supply chain and vendor risk for the enterprise.

Prioritize security professionals with experience assessing your supply chain. This role hinges on the individual’s ability to communicate effectively with many parties outside of your organization and experience working with third-parties is key. As you may find that this role is the most security specific (and hardest to fill), consider using tools to augment their ability. Specifically, an AI backed IRM solution like CyberStrong that provides automated risk quantification which eases the need for this in hiring an individual with that experience.

As the role of the CISO shifts from the periphery of the c-suite to a critical business function and their organization expands, the definition of their role needs to be altered as well. The chief of staff for security works to alleviate the administrative burden that the CISO could previously manage themselves.

This individual has remarkable communication abilities working with both technical and non-technical stakeholders. They also have reasonable program management experience and ability to translate strategic vision into action.

This role hinges more on the individuals experience managing a staff than it does on their experience in security. Look closely at senior level staff leads at IT-related organizations within your enterprise that may touch security in some way. The skills that have taken them years to develop are worth prioritizing. Be prepared to invest in developing their knowledge of cybersecurity specifically as they may bring a background in tech ops but potentially limited knowledge in security specifically.

As security moves into the spotlight in the enterprise, the need to grow the function only gets stronger. To date, traditional talent acquisition practices have failed and as a result security leaders need to reassess these practices in order to ensure their teams are prepared for the future.

As security teams change, though, so do the tools available to them. As you begin to scale your organization into a fully fledged business function, take the opportunity to reassess your software stack. Examine the tools your teams are using and question whether newer tools can augment these new practices. Specifically, look at how integrated risk management and AI backed systems like CyberStrong are about to supplement skillsets and help you fill in the gaps in your organization.

It is no shock to those in the cyber community that cybersecurity has become a board-level issue for many enterprises. A PwC survey showed a 20% increase in CEO’s concern over cyber threats. With more and more eyes on CISO’s and their teams, the cybersecurity skills gap has continued to widen a current estimated 350,000 open cybersecurity positions in the US, and a predicted global shortfall of 3.5 million cybersecurity jobs by 2021, reports CSOOnline . The primary shift occurring is the fact that IT is integrating with almost every aspect of the business, where security for years was a siloed function it is now necessary to permeate the entire organization.

Every IT position is also a cybersecurity position now. Every IT worker, every technology worker, needs to be involved with protecting and defending apps, data, devices, infrastructure, and people. The cybersecurity workforce shortage is even worse than what the jobs numbers suggest. ( Source )

Two factors put the cybersecurity industry on a course for this job shortage with the massive wave of outsourcing 10 years ago, we lost a massive body of knowledge as those industry veterans are now leaving altogether. Combined with the state of flux that enterprises and the security organizations specifically find themselves in as a result of digitization has left many leaders questioning what skills are necessary to set their organization up for success in the future. According to the most recent Gartner security and risk survey, 86% of respondents say the digital world is creating new business risk.

First, begin by recognizing that building a security organization for tomorrow starts now. To ensure that your team can support the necessary functions that a digitized enterprise needs, you will need to begin investing in transitioning your teams into those roles. Through 2019, 20% of enterprises will build a security skills management program including experimental recruiting and talent retention practices, up from less than 2% today. (Gartner)

The fastest way to begin is looking internally. This is not a new practice for many senior-level executives, however, in order to support innovative roles you will need innovative hiring practices: widen your scope. Arguably, the cybersecurity skills gap exists because members of the industry don’t know what to prioritize. To transition your organization into the digital age will require new roles and innovative hiring practices.

The Digital Risk Officer (DRO) take a holistic view of risk across the entire enterprise. This includes traditional areas of focus such as IT as well as non-technical organizations leveraging digital technology where they are not aware of the risks associated. This individual will also work closely with more advanced technologies that the enterprise is working with including operational technology (OT), industrial internet of things (IIoT), IoT and mobile.

This role requires technology business leader with experience leading innovative projects, brings strong connections across the enterprise to facilitate buy-in, and has a rich background in program management.

Mid- to senior-level IT management from a team that has exposure to cybersecurity. This individual is going to be working closely with the CISO as a peer but working primarily to ensure that risk is managed and mitigated throughout the organization. They will also be working with new forms of technology as they make their way into the enterprise. Therefore, they must be an effective communicator with a strong background in technology. As the hiring manager, be prepared to invest in an understanding of the regulatory environment and developing their knowledge of security specifically.

Much like a newspaper ombudsman reconciling coverage with the public good, this individual ensures that the clients ― often line-of-business customers ― are supported by security measures (Gartner). This position can be defined as a stakeholder security advocate. They act as a conduit between the core security team and the rest of the enterprise representing and relaying the concerns of non-technical stakeholders and interpreting the strategy of the security team to the rest of the enterprise.

A successful individual in this role will bring strong communication skills (written, oral, and interpersonal) and a rich understanding of cybersecurity at a functional and granular level.

Start with your auditing committee and internal auditors. These individuals have the rich background in security and compliance that this position will require. Be prepared, however, to invest in their ability to solicit buy-in and hype the organization’s security program. Starting with a technical individual and helping them develop soft skills will require that you support them with mentorship and incentivize the development of those skills.

As the name suggests, this position sits at the intersection of data science and data security. Data science, a more attractive discipline in today’s market, uses advanced mathematical models to manipulate large volumes of data and supplement business decisions. Data security works with large volumes of data to predict, prioritize, and mitigate risk mainly through advanced anomaly detection.

A strong candidate will bring a background in data science (bonus points for projects that cross disciplines). As well as an understanding of the data collected by security teams.

Start with your organization’s data analysts. Since this role is a narrower scope than a broad spectrum business analytics position, the probability you will find the right fit from that talent pool is significantly higher. Furthermore, as data science is the baseline skillset necessary, you will need to invest some time in their knowledge of the security space which is significantly less than training a security professional in data science.

As the enterprise continues to outsource peripheral functions and integrate automation technologies, they become less like an entity and more like an ecosystem. The Digital ecosystem manager ensures that the enterprise ecosystem stays secure. Where the DRO is focused on the internal risk within the organization, the digital ecosystem manager is concerned with the other players that interact with the enterprise.

Think of this role as vendor risk management expanded. As a result, a successful ecosystem manager will bring the skills necessary for that role as well as an effective communication style and a background capable of managing the expansive supply chain and vendor risk for the enterprise.

Prioritize security professionals with experience assessing your supply chain. This role hinges on the individual’s ability to communicate effectively with many parties outside of your organization and experience working with third-parties is key. As you may find that this role is the most security specific (and hardest to fill), consider using tools to augment their ability. Specifically, an AI backed IRM solution like CyberStrong that provides automated risk quantification which eases the need for this in hiring an individual with that experience.

As the role of the CISO shifts from the periphery of the c-suite to a critical business function and their organization expands, the definition of their role needs to be altered as well. The chief of staff for security works to alleviate the administrative burden that the CISO could previously manage themselves.

This individual has remarkable communication abilities working with both technical and non-technical stakeholders. They also have reasonable program management experience and ability to translate strategic vision into action.

This role hinges more on the individuals experience managing a staff than it does on their experience in security. Look closely at senior level staff leads at IT-related organizations within your enterprise that may touch security in some way. The skills that have taken them years to develop are worth prioritizing. Be prepared to invest in developing their knowledge of cybersecurity specifically as they may bring a background in tech ops but potentially limited knowledge in security specifically.

As security moves into the spotlight in the enterprise, the need to grow the function only gets stronger. To date, traditional talent acquisition practices have failed and as a result security leaders need to reassess these practices in order to ensure their teams are prepared for the future.

As security teams change, though, so do the tools available to them. As you begin to scale your organization into a fully fledged business function, take the opportunity to reassess your software stack. Examine the tools your teams are using and question whether newer tools can augment these new practices. Specifically, look at how integrated risk management and AI backed systems like CyberStrong are about to supplement skillsets and help you fill in the gaps in your organization.

Millennials are the largest generation in the U.S. labor force―a position they’ve held since 2016―and they’re involved in the majority (73%) of B2B purchasing decisions. Raised in the age of the Internet, they’re digital natives and easily adopt and adapt to new technologies. And mobile apps are their lifelines.

Why does this matter? Well, when you combine Millennials’ tech savviness with their business acumen, their clout in a digital economy comes into focus. As both decision-makers and connoisseurs of mobile technology, they can make or break you in a low-growth economy if your business model doesn’t square with their preferences.

In other words, if you’re not embracing mobile commerce, you may soon be ancient history. This generation has little-to-no use for brick-and-mortar storefronts, banks, etc., instead preferring to use apps for shopping, financial transactions and more.

Of course, making m-commerce a linchpin of your business model isn’t risk free; cybersecurity concerns are of critical importance. Increasingly, personal data protection is tied directly to consumer loyalty to a particular brand, and Millennials in particular care about how their data is used and safeguarded.

While Millennials are renowned for an “ I want it fast, and I want it now ” attitude (which explains why 63% of them use their smartphone to shop every day, versus trekking to a store), the biggest mistake you can make is overlooking security in a rush to roll out a mobile strategy.

The fact is, vulnerabilities on m-commerce platforms can result in severe financial impacts; the average cost of a corporate data breach is $3.86 million . If a mobile app or mobile responsive e-commerce site is hit by an application attack, for example, short-term profit loss (which can escalate quickly) and longer-term reputation loss are serious risks. And as we move into 2019, there are several mobile security threats that we need to take seriously.

Baking cybersecurity into your mobile strategy―as a core component, not an add-on―is, without question, necessary. The reason is manifold: For one thing, mobile devices (where your app primarily lives) are more susceptible to attacks. Secondly, mobile commerce websites are often implemented with a web application firewall to protect it. Thirdly, Millennials’ reliance on m-commerce, both as B2B and B2C consumers, means you stand to lose significant business if your app or website go “down.” And finally, Millennials are security conscious.

So how can you help ensure your m-commerce platform, and thereby your Millennial customer base, is secure? A number of ways:

Of course, this isn’t an exhaustive list of proactive security measures you can take, but it’s a good start. As I’ve said time and time again, in an increasingly insecure world where security and availability are the cornerstones of the digital consumer, cybersecurity should never be placed on the back burner of company priorities. Don’t wait for an attack to up your security game. At that point, trust is broken with your Millennial customer base and your business is in trouble. Be proactive. Always.

Secure

Coders

Product Evangelist and Security Engineer Jaap Karan Singh, that includes

videos and hands-on challenges covering the top thirty security

vulnerabilities found in software applications today.

Each week, beginning today December 6, a new post will take an in-depth

exploration of one security vulnerability, rounding out the top thirty

risks developers need to be able to defend against. The series will

cover the OWASP Top 10 and far beyond, creating a free library of guides

and training aimed at helping junior developers write better, more

secure code. The first posts will focus on cross-site scripting and SQL

injection, with subsequent releases delving into vulnerabilities such as

typecasting, unrestricted file uploads and LDAP injection.

Pieter

culture within their development teams, utilizing the SCW platform to

deliver them the right knowledge, tools and positive engagement to make

a significant impact towards security best practice. A push towards this

holistic solution has proved measurably beneficial, with one of Secure

Code Warrior’s customers reporting a 60% increase in secure development

capability across a group of hundreds of developers. They required their

developers to play a single, five-minute challenge every day for two

months, testing their skills before and after the training period and

observed this significant improvement.

Danhieux said that providing junior developers with helpful, free guides

and training on finding and fixing security vulnerabilities is aimed at

lifting engagement and interest in secure coding, especially for

developers who lack experience with significant security theory:

“With so many developers leaving formal education institutions without

good security knowledge, and most companies not providing adequate

security training, we knew this was a gap we could help address. It is

our aim to provide these free blogs, videos, and challenges to all

developers to showcase the top vulnerabilities, and most importantly,

how to fix them. It is this sense of achievement and upskilling that

could spark a whole new interest in secure coding for developers while

improving their personal standard of code.”

A new Coders Conquer Security guide will appear weekly on the Secure

Code Warrior blog from December 6, and will feature the following:

From there, it is hoped that junior developers will work on their

security mindset and champion secure code within their teams.

“I would love to see more developers championing security, fostering a

higher standard within their team. Often, this can be key to successful

risk mitigation and getting developer and security teams working

together more efficiently. Secure Code Warrior can certainly continue to

assist this upskilling with our highly engaging, gamified online

training.” Danhieux said.

The Coders Conquer Security: Share and Learn Series will begin from

December 6 and can be found at https://insights.securecodewarrior.com .

About Secure Code Warrior

Secure Code Warrior is a global

security company that makes software development better and more secure.

Our vision is to empower developers to be the first line of defense in

their organization by making security highly visible and providing them

with the skills and tools to write secure code from the beginning.

We have built a powerful platform that moves the focus from reaction to

prevention, training and equipping developers to think and act with a

security mindset as they build and verify their skills, gain real-time

advice and monitor skill development. Our customers include financial

institutions, telecommunications providers and global technology

companies in Europe, North America and the Asia Pacific.

Contacts

Kari Walker for Secure Code Warrior, 703-928-9996

The Australian Computer society has released a guide for businesses to start using artificial intelligence in their organisations, outlining what AI is and what it can do.

The guide ― Artificial Intelligence: A Starter Guide to the Future of Business ― was released on Thursday, with a number of Australian AI companies present and showing off their wares.

These included the chief executives and founders of Sortal, Gameface and Hyper Anna.

“Artificial intelligence promises to revolutionise the way we do business, optimising business processes and creating entirely new revenue streams,” said ACS president Yohan Ramasundara.

“Many business leaders think AI may be too hard, and don’t consider it as a solution to the issues they face today.

"If Australia is to remain a competitive leader in technology, we must both inspire the current and future entrepreneurs, and encourage adoption and experimentation with existing AI solutions.

"Our message today to Australian business is to get in now, or risk missing out on the largest business opportunity since the Internet.”

Sortal chief executive Majella Edwards said: "When we speak with enterprises about artificial intelligence, too often we find that business leaders focus on what the technology will achieve in the future.

"While there is an enormous amount of potential as the field develops, we can already do incredible things with AI in the here and now and by investing in AI now, businesses can set themselves up to thrive rather than play catch up later on.

"We welcome this initiative from ACS to help educate Australian businesses about what can be done, and the opportunity to showcase Australian innovation in this space."

Ramasundara added that more must be done to keep Australian AI talent from going overseas.

“The government has committed to invest $29.9 million over four years to pump up Australia’s AI and machine-learning capabilities in fields such as cyber security, health and energy," he said.

"This is a very small step in the right direction and if we are genuinely committed to harnessing the power of AI a more demonstrably significant investment will be required.

“AI experts in the US and China, for example, can demand salaries as high as US$300,000 (A$400,000). We also know there is a gap when it comes to the adoption of AI solutions in the Australian enterprise. Our report today aims to bring knowledge of what is possible to business decision makers.”

The guide is available here .

With 4 keynotes + 33 talks + 10 in-depth workshops from world-class speakers, YOW! is your chance to learn more about the latest software trends, practices and technologies and interact with many of the people who created them.

Speakers this year include Anita Sengupta (Rocket Scientist and Sr. VP Engineering at Hyperloop One), Brendan Gregg (Sr. Performance Architect Netflix), Jessica Kerr (Developer, Speaker, Writer and Lead Engineer at Atomist) and Kent Beck (Author Extreme Programming, Test Driven Development).

Register now for YOW! Conference

Sydney 29-30 November

Brisbane 3-4 December

Melbourne 6-7 December

Register now for YOW! Workshops

Sydney 27-28 November

Melbourne 4-5 December

REGISTER NOW!

Australia is a cyber espionage hot spot.

As we automate, script and move to the cloud, more and more businesses are reliant on infrastructure that has the high potential to be exposed to risk.

It only takes one awry email to expose an accounts’ payable process, and for cyber attackers to cost a business thousands of dollars.

In the free white paper ‘6 Steps to Improve your Business Cyber Security’ you’ll learn some simple steps you should be taking to prevent devastating and malicious cyber attacks from destroying your business.

Cyber security can no longer be ignored, in this white paper you’ll learn:

How does business security get breached?

What can it cost to get it wrong?

6 actionable tips

DOWNLOAD NOW!

SPONSORED NEWS.

By Scott Lundgren, Chief Technology Officer, Carbon Black

Recently MITRE , a not-for-profit organisation that solves problems for a safer world, published the results of its first public evaluation of endpoint detection and response (EDR) vendors based on its increasingly-popular ATT&CK framework.

The ATT&CK evaluations are a new approach to EDR testing open, sophisticated, rigorous, and reflective of the real world. At Carbon Black we applaud MITRE’s efforts and are very pleased with the results for our CB Response solution, which had zero delayed and zero tainted detections throughout the evaluation.

The evaluations for this initial testing period used a MITRE-developed APT3 emulation plan and measured various solutions on behaviour detection, telemetry and enrichment, among other elements. Along with the other seven vendors included in this evaluation, we have worked alongside MITRE and their methodology for months, ensuring that the results gave an honest and accurate representation of what our product is able to achieve.

The open nature of this evaluation, and the fact that MITRE intentionally does not provide specific scores, rankings, ratings that are able to be skewed by vendor sponsorships, made this particular evaluation one that we at Carbon Black are extremely excited about.

And while the published results are extensive and extremely detailed, there are a few high level trends that particularly stood out to us:

Our work with the MITRE ATT&CK framework hasn’t stopped with this evaluation. Along with the recent announcement of the results, we also announced that we’ve added a MITRE ATT&CK threat intelligence feed directly into CB Response, in addition to our recently announced CB ThreatHunter product, which offers all of the same powerful detection, response and threat hunting capabilities through our Predictive Security Cloud platform.

As I mentioned, we’re proud to be among the initial vendors evaluated by MITRE to be among the initial vendors evaluated by MITRE and we’re extremely proud of our results. Objective, transparent and open testing is critical as a means of driving the industry forward and the MITRE ATT&CK framework offers a critical look at how real-world attacks play out.

The ATT&CK framework closely aligns with Carbon Black’s belief that detecting attacker behaviour is exponentially more important than detecting malware alone. MITRE has set an excellent standard for how testing should be conducted and Carbon Black has set the standard for quick and conclusive detection.

We look forward to continuing to our work with MITRE as their testing evolves.

With 4 keynotes + 33 talks + 10 in-depth workshops from world-class speakers, YOW! is your chance to learn more about the latest software trends, practices and technologies and interact with many of the people who created them.

Speakers this year include Anita Sengupta (Rocket Scientist and Sr. VP Engineering at Hyperloop One), Brendan Gregg (Sr. Performance Architect Netflix), Jessica Kerr (Developer, Speaker, Writer and Lead Engineer at Atomist) and Kent Beck (Author Extreme Programming, Test Driven Development).

Register now for YOW! Conference

Sydney 29-30 November

Brisbane 3-4 December

Melbourne 6-7 December

Register now for YOW! Workshops

Sydney 27-28 November

Melbourne 4-5 December

REGISTER NOW!

Australia is a cyber espionage hot spot.

As we automate, script and move to the cloud, more and more businesses are reliant on infrastructure that has the high potential to be exposed to risk.

It only takes one awry email to expose an accounts’ payable process, and for cyber attackers to cost a business thousands of dollars.

In the free white paper ‘6 Steps to Improve your Business Cyber Security’ you’ll learn some simple steps you should be taking to prevent devastating and malicious cyber attacks from destroying your business.

Cyber security can no longer be ignored, in this white paper you’ll learn:

How does business security get breached?

What can it cost to get it wrong?

6 actionable tips

DOWNLOAD NOW!

【财新网】（记者 侯奇江） 针对英国电信集团（BT Group）将把华为设备从现有3G、4G网络核心网中移出等消息，华为方面12月6日对财新回应，网络安全问题不应该被“泛政治化”，更不该由于厂商所在国而被区别对待。在现今ICT供应链高度全球化的时代，禁止某一个厂家，并不能有效识别和解决网络安全问题。

据《金融时报》报道，BT将在两年内从其4G核心网络中剥离华为设备，以使其移动电话业务符合英国内部政策。该政策要求把中国公司的设备置于电信基础设施的外围。

Computer systems and networks contain valuable information, and hackers are out there trying to steal that data. This has led to the development of the red team assessment, a test to help an organization identify and correct vulnerabilities and flaws in their cybersecurity defenses before a hacker can find and exploit them.

To do so, an organization hires a red team to perform an assessment. The red team’s job is to think and act as a hacker does in order to find the vulnerabilities in an organization’s network that are the most likely to be exploited. Once they’ve done so, the red team reports their results to the organization.

Every red team assessment is unique, but they tend to follow a flow through seven main phases, as described in the following section.

The basic steps of a red team assessment can be broken up into seven main phases, and most red team assessments will include all phases in roughly that order. However, the specifics of the situation may mean that certain phases are skipped (as in a white-box assessment) or performed out of order (for example, if an attempt to gain access fails and the red team has to start over). The phases of a red team assessment are useful in understanding how a red team assessment works but are not set in stone.

The first phase of a red team assessment usually involves planning and setting objectives for the assessment. The organization being assessed may have specific wishes for the red team assessment. For example, the red team may only be required to demonstrate the ability to access sensitive information, not exfiltrate it. A common limitation is disallowing the use of social engineering as part of the assessment.

A crucial (Read more...)

CSRF is, while still prevalent, no longer an unknown type of security vulnerability. It’s brother, SSRF, however, is. Most developers, or even DevOps engineers don’t know about it. So how does it work?

SSRF is, at it’s core, very simple. Let’s say you have a web application that needs to download some data from external sources. So we trick this web application to, instead of accessing the external site, download the data from an internal server that is publicly not accessible.

Sounds unimpressive, right? However, keep in mind that more and more database, like redis, etcd, or ElasticSearch can be accessed over HTTP. What if I trick the application to download some data from etcd? Maybe your AWS API keys are stored in there and I can just grab them?

Or, if I can trick the application to make a PUT or POST request instead of a GET request, I may even be able to change data.

Now, you may be asking in what kind of scenarios SSRF can even happen. After all, not many web applications download data from external sources at the request of the user?

You may think that, but just a few obscure examples include:

Even if your application initially doesn’t download data from external sources, later on there may be a business requirement and you may not think of it.

Additionally, even a developer could be tricked into opening a link that, under certain circumstances, could load data from the internal service.

I’ve talked about layered security before, so my recommendations follow that principle. You will want to have more than method of defense.

First of all, all internal services, no matter if they are behind a firewall or not, should be put behind some sort of authentication. Sometimes that will be usernames and passwords, sometimes it will be TLS client certificates. (TLS certificates will also enable encryption of the traffic.) If you use authentication, that will prevent clients that don’t have access to the authentication data to connect the service.

Second, you should (of course) set up an internal firewall between your application servers and internal services. If you are using Kubernetes, you should set up a network policy.

And last, your application should vet the URL. At the very least it should check what IP address the URL resolves to.

SSRF is a tricky vulnerability because it abuses a trusted component of your system: the application code. It’s hard to think of our own components as a potential threat.

2018年11月28日，由中央网信办、工业和信息化部指导，湖南省人民政府、中国工程院、中国科学技术协会、国防科技大学和中国电子信息产业集团有限公司共同主办的2018中国（长沙）网络安全智能制造大会在长沙国际会展中心隆重召开。

华为应邀展出了全栈全场景AI、智能制造、智能计算以及华为安全能力四大部分内容。

其中，华为安全能力重点展示了SDSec安全解决方案、基于自研芯片的AI防火墙产品、SDSec核心技术价值、安全态势感知产品以及安全研究成果等内容。

随着制造业的逐步发展，企业办公网络与生产网络一直以来通过物理隔离或间接隔离实现的安全体系正在被打破，生产控制系统越来越多的采用通用硬件和通用软件，开放性与日俱增，增加了系统漏洞被所利用、感染病毒的可能，其一体化融合在促进数字化转型的同时也给大企业带来了诸多安全挑战：

为解决以上问题，华为全新推出基于SDSec（软件定义安全）架构的制造业安全解决方案，主要内容包括：

在IT/OT融合的过程中，办公网和生产网采用物理隔离的方式逐渐消失，通过梳理企业办公园区、数据中心区和生产厂房的资产分布、网络拓扑和数据流量等情况，划分多个安全区域，并通过部署防火墙、安全沙箱和入侵检测系统来构建边界安全能力，减少企业的被攻击面。

部署第三代沙箱和文件交换服务器，只有通过沙箱的安全性检测，该文件才能进入生产网，可解决U盘拷贝、邮件附件带来的安全隐患。对于新加入的操作站等设备通过逻辑网络划分的方式先行部署在该区域以进行入网验证，只有通过漏洞检测等安全验证后才能正式接入生产网。对于进入生产网的运维流量通过堡垒机进行跳转，防止来自于运维终端的安全威胁扩散。部署流探针实时采集并上送流量特征信息，用于识别安全威胁行为。

部署安全分析器CIS（网络安全智能系统），通过采集办公网、生产网和安全隔离区中关键节点上的日志信息、流量信息和恶意文件检测信息，并基于大数据分析和AI识别技术，发现隐藏在正常流量中的高级安全威胁，及时告警呈现并下发处置任务。

办公网、生产网和安全隔离区均可部署网络诱捕系统，可利用交换机和防火墙作为诱捕探针，通过构造虚假网络来主动响应攻击者，并将其引流至构造了虚假业务的诱捕器来进行混淆欺骗。该系统通过确认攻击意图来识别攻击行为，而无需被动的安全数据分析，降低了真实业务被攻击的可能，及早发现攻击源。

部署安全控制器SecoManager，该系统北向对接CIS系统实现威胁处置任务的接收与编排，南向纳管各安全边界上的防火墙等防御类设备。经过Secomanager安全管理系统的中枢控制，可将企业网络中的安全防御设备形成统一调度的安全响应资源，一旦发现安全威胁，可在安全隔离区与生产网之间、各生产厂房之间等安全边界进行隔离阻断，阻止威胁的扩散。

华为SDSec安全解决方案与制造业的深度融合，将安全防护从办公网延伸至生产网，实现IT/OT一体化安全防护，安全能力对生产环境的正常运行“零”影响，并引入安全大数据分析和AI识别技术，帮助大企业抵御高级持续性威胁。华为希望通过SDSec软件定义安全架构进一步促进安全产业的不断进步，通过人工智能、大数据等安全技术的创新，为客户提供更可靠更贴心的安全解决方案，为制造业的持续健康发展做出贡献。

If adding a windows machine to a Samba domain fails and the below “solves” your issue, then you need to tighten the security on the Samba side:

jeroen

According to BetaNews, among the 30 best applications with more than 500,000 downloads, 94% contain at least 3 average risk vulnerabilities, while 77% contain at minimum two high-level vulnerabilities . Among the 30 applications 17% were vulnerable to MITM attacks exposing all data to interception by malicious users.

Furthermore, 44% of applications contain confidential data with strict encryption requirements, including passwords or API keys, while 66% utilize functional abilities which can compromise users’ confidentiality .

This is exactly why mobile devices are subject to numerous security discussions. Bearing this in mind, we at Hacken have decided to address the OWASP Mobile TOP 10 methodology in order to demonstrate the process of conducting vulnerability analysis for mobile applications.

First, we decompiled “PasswordManager-1.3-release.apk” application with the help of the Apktool program (see Figure 1). Apktool decompilation doesn’t allow us to receive the source code in an understandable format but allows to access other program resources which will describe the architecture, libraries the program uses etc.

Figure 1. Decompilation of “PasswordManager-1.3-release.apk”.

Figure 2. Structure of “PasswordManager-1.3-release.apk”.

Figure 2 shows the structure of the program’s apk-file, as follows:

In order to view the program’s source code, we utilized the dex2jar tool (see Figure 3). It provided the opportunity to analyze the source code of the program with a help of VCG-scanner static code analyzer and manually. (see Figure 4).

Figure 3. Getting the source code of “PasswordManager-1.3-release.apk” with the help of dex2jar

Figure 4. Structure of packages and classes of “PasswordManager-1.3-release.apk” shown with the help of dex2jar

Figure 5. AndroidManifest.xml file

Access to AndroidManifest.xml file provides the following information about the program:

Some part of the debugging information in the program can be displayed in the system logs (see Figures 6 and 7). In this case, an outside program which has the READ_LOGS permission (for example, logcat or pidcat), can get access to sensitive data, thereby breaching confidential information.

Figure 6. Encrypted password

Figure 7. During the work of the program, the saved password is displayed in logs .

Recommendations on closing vulnerabilities delete or comment out the source code line which displays the debugging information in logs.

With the help of the app.provider.query module we received access to the local database of the software application.

Figure 9. Exported URI-ContentProvider and examples of vulnerability implementation.

While analyzing source code, the insert to program local database was found (see Figure 10). The data obtained makes it possible to get unauthorized access to the system.

Figure 10. Data storage in an open form in the source code.

Recommendations on fixing the discovered vulnerability:

The minimum OS Android version which is identified by the program doesn’t allow for the use of Proxy. This peculiarity of the operating system provides the protection of traffic decryption with Proxy by switching the certificate.

However, an automatic switching from HTTPS to HTTP protocol is implemented in the program if the latter (HTTP) supports encrypting. This can lead to data transmission by an open channel.

This post assumes that you already know what GPG is, and why you want to use it, but you don't have your own set of keys yet. If you are further along (e.g. you already have your own set of keys), you can skip those parts and use your already existing keys instead of generating new ones.

It also assumes that your YubiKey can hold 4096 bits RSA keys. As far as I know, this is true for all of the 5th generation Yubikeys, but it is not true for the YubiKey 4 NFC. If your YubiKey can only hold 2048 bits RSA keys, you will need to generate smaller subkeys in the appropriate step (the master key should still be kept at 4096 bits).

If you are using windows, you will need gpg4win . When I was writing this post, the latest version was 3.1.5.

If you are on linux, you likely already have gpg installed, but you should check it's version -- e.g. on Ubuntu 16.04 LTS, gpg is GPG in version 1.4.20. I strongly recommend getting GPG in version 2.x.x.

If you want to use gpg from within WSL together with YubiKey, you have to install gpg in version 2.x.x inside WSL and install gpg4win on the side of Windows.

On Windows, GPG (and related) settings are in AppData/Roaming/gnupg . On Linux, the settings can be found in ~/.gnupg/ . The settings files themselves are gpg.conf for the gpg binary, scdaemon.conf for the SmartCard daemon and gpg-agent.conf for the gpg-agent.

These will become important later, but if you are on Windows I recommend placing charset utf-8 into gpg.conf straight away.

After the previous step, you should have GPG set up and ready to generate keys. In my case, the executable name ended up being gpg2 , so I will use that in examples through this post. We will need to generate 3-4 keys, or rather 1 key and 2-3 subkeys. They will be

The master key is used for issuing/revoking subkeys and confirming other people's identities. This makes it essentially a person's online identity and thus should be kept securely backed up on offline medium and removed from the PC where it was generated afterwards.

The Encryption and Signing keys are the keys used during everyday activity, and because they are bound to the master key, if they are ever compromised they can be easily revoked, at least as long as you retain control over your master key. The Authentication key is a bit different in that some people think it is pointless (or even that it shouldn't be used), while other people are using it regularly. This post assumes that you will want to use it as well, but you can always just skip those steps.

Because GPG (at least in the version I have) still defaults to 2048 bits RSA keys and we want to generate 4096 bits RSA keys in the interest of future-proofing, we will have to run GPG with the --full-key-gen option so we can customize properties of the generated key. GPG will then ask you about various properties of your new key, as you can see below, where gpg X> means that GPG is asking you about X:

You should always have your key expire eventually -- as long as you have access to it, you can extend its expiration date when it becomes relevant -- and you should also always have a passphrase on your master key. Real name and email address are hopefully self-explanatory, but comments are controversial. Some people hold the opinion that comments are a mistake and should not be used , while other people see comments as OK, as long as you avoid pointless redundancy (e.g. repeating your email address in the comment). Personally, I don't really care if your user-id looks like this

Sir Mix-A-Lot (I like big butts, and I cannot lie) mixalot@yahoo.com

but I would prefer if it didn't look like this

Jan Novák ( jan.novak@gmail.com ) jan.novak@gmail.com

If the key generation was successful, you should see something like this:

This tells you that 2 keys were created, a master key with id 6129F208 and an encryption sub key with id BF36D4AC . For now, the master key id is the important one, the subkey id is not. Also note that both of these ids are in so-called "short" (32 bits) format, which is generally considered insecure , and either the long (64 bits) key id, or the full key fingerprint should be used instead. To get the long key id, you can pass --keyid-format long flag to gpg, e.g.:

This means we actually want to use A8F90C096129F208 as the master key id during the next steps.

Because we are using newer gpg, something called revocation certificate has also been generated -- a revocation certificate can be uploaded to key servers if you lose control of a key to mark the key as invalid. Obviously, you should back up the revocation certificate somewhere.

You might want to have more than one user identity ( userid ) in your master key. This is primarily used to either connect an internet screen name with a real-world name or to add associate more email addresses with your identity. In either case, you can do that by editing the master key:

We already have the encryption subkey, now we also have to add the signing and authentication subkeys. This is done by editing the master key in expert mode (note that without --expert we can't set the key type by ourselves) and using the addkey command:

this will open up a menu where you can select what capabilities the new key should have. When using it, keep in mind that "toggle" does mean toggle and that the key starts with the S(ign) and E(ncryption) bits enabled. After you select the right set of capabilities (for this tutorial it means the key has only S or only A capability), you will get to the dialogue for creating keys -- set the size of the key to 4096 bits, expiration date to something reasonable and pick a passphrase again.

After creating both S(ign) and A(uthentication) keys, you should end the editing session and check that your keys were created properly:

You should see something like this:

i.e. 4 keys, 3 of which are subkeys (marked with sub ) and each of the subkeys has only one of the A/E/S capabilities.

Now that we have our keys ready, it is time to

Publishing is easy enough, as long as you find a keyserver that accepts uploads. I had some trouble finding one, but as of the time of writing, fks.pgpkeys.edu worked:

If this succeeds, people can download your key by its id from the public key server pools.

Backing the key up is also relatively simple, the first step is to export it. This is usually done in a format called ASCII armor , because cat ing a binary file into your terminal is no fun:

The second step is to securely back up secret-key.asc -- the usual recommendation is to use 1 or more encrypted USB cards. You should also delete the master key from the computer, but doing so right now would prevent you from moving the subkeys to the YubiKey.

If you used gpg inside WSL to generate your keys, you will have to first set up a bridge between gpg-agent inside WSL and gpg-agent inside Windows. See "Extras: gpg-agent bridge" for details.

First, we need to check that gpg can see the YubiKey when it is plugged in -- If it does not, check section "Extras: gpg does not detect YubiKey" for help.

The option to move keys to the YubiKey is once again under --edit-key :

keytocard is a destructive operation and removes the private subkey from the local key store. Now that the subkeys are stored on the YubiKey, you should delete the master key. To do that, you need to know its keygrip:

from the listing above, the keygrip of the master key is 5436620CA40373692E45B41A7831BEC2ACE624AB and it can be deleted via

You can verify that it has been deleted by listing the private keys again -- the master key should have a # next to it to signify that it cannot be used (the > next to the subkeys means that they are on the YubiKey).

All YubiKeys share the same factory PIN, 123456, and the same admin PIN, 12345678. Because PIN is what the YubiKey asks for to use a key, you need to change it. You can either do this via Yubico's management utility or via gpg:

I also recommend enabling touch protection for GPG keys on the YubiKey. This means that to use any of the GPG keys on the YubiKey, you need to do 2 things:

The upside is that even in the case a piece of malware manages to get onto your machine and intercepts your PIN, it still will not be able to use the GPG keys on your YubiKey. The downside is that you will be made painfully aware of every single usage of your GPG keys, which can sometimes be annoying.

To enable touch protection, you will need the Yubikey Manager utility . Once you have it installed, you can enable the touch protection for each key slot separately:

And that is it, now you have your GPG subkeys on the YubiKey, the YubiKey is set up correctly and you should be able to just use it with gpg.

Signing git commits seems to be the most common reason for using GPG, so here are the necessary configuration steps.

This section does not apply to using YubiKey for SSH auth inside WSL.

To use your Auth subkey for SSH auth, you need to enable ssh support in gpg-agent.

To do so, you need to add enable-ssh-support to gpg-agent.conf , restart the gpg-agent and set it up to run on login (so that it is available when SSH asks for keys). You also need to set environment variable SSH_AUTH_SOCK to ~/.gnupg/S.gpg-agent.ssh .

You can check that everything works with ssh-add -L -> you should see the auth key from YubiKey in SSH format.

Note that keys in Auth slot on the YubiKey are given to SSH even if they are not in the sshcontrol file.

The most common reason for GPG not to see the YubiKey is that there are multiple SmartCard readers in the system. This is caused by the fact that if there is more than one SmartCard reader in the system, scdaemon just defaults to checking the first one and if that is not a GPG compatible smart card (in our case the YubiKey), it does not try the other ones.

To solve this, you will need to add reader-port <port id or device name> to scdaemon.conf . You can find the proper name from scdaemon logs, because it enumerates all readers, even though it only picks one:

Afterwards, you need to find lines saying "detected reader", specifically the one talking about YubiKey.

Going by this log you should set reader-port to Yubico YubiKey OTP+FIDO+CCID 0 .

Because the only devices visible from WSL are drives, which the YubiKey is not, gpg inside WSL cannot use the YubiKey directly. Luckily, we can work around that by redirecting requests to gpg-agentunder WSL to the gpg-agent running under Windows.

This can be done by combining the npiperelay utility on the Windows side with socat on the Linux side.

There are two ways to get the npiperelay.exe binary

The second option has a small problem in that if you install an older version of go (e.g. 1.6.2 from apt on Ubuntu 16.04), it will compile fine, but it will fail at runtime, and that the Readme in the linked repo is not updated to reflect the fork's address.

You will need the Windows-side gpg-agent to run right after startup. The easiest way of doing that is to add a shortcut to "C:\Program Files (x86)\GnuPG\bin\gpg-connect-agent.exe" /bye in the %AppData%\Microsoft\Windows\Start Menu\Programs\Startup folder. You should also set the shortcut to run minimized, to avoid pointless cmd pop-up on login.

On the WSL side, you should add this to ~/.profile or similar:

with paths modified accordingly.

I was unable to create a bridge between the WSL gpg-agent and Windows gpg-agent that would use gpg-agent's ssh support, but I managed to get it to work with gpg-agent's PuTTY support thanks to WSL-SSH-Pageant , and here are the steps:

If everything worked correctly, you can now call ssh-add -L from WSL and see the GPG Auth key on YubiKey in SSH format. If it works, it is time to set up autorun.

Because running wsl-ssh-pageant blocks the terminal for as long as it is running, if we just set up an autorun shortcut the terminal will remain open until you log off. To avoid this, we will write a trivial Visual Basic script that will run wsl-ssh-pageant in a hidden window, and place it in the autorun folder:

wsl-ssh-pageant will silently fail if you give it path into a folder that does not exist. This means that you should double check the paths you pass to it.