Ed Smiley's Blog

As I looked at my calendar last weekend, I wondered why it was so packed.  Aside: Hey, I am a Sys Admin.  My meetings tend to be more spontaneous, like my computer is on fire or the website is down.

Turns out there were 6 great events going on this week:

1.  Pauldotcom put on Part 2 of Zen and the Art of an Internal Penetration Testing, which covered using tools such as Nessus, Core Impact, and Metasploit for tying vulnerability scanning, penetration testing and reporting into an efficient, repeatable testing process.  I did not get a chance to listen to all of this, but look forward to a recording being released at a later time.

2.  Rob Lee brought us Memory Analysis for Incident Responders and Forensic Analysts.  I thought that this was an incredible webcast which gave great insight about why memory analysis is important, which tools to use for acquisition and analysis, and sample cases on memory analysis.  I would highly recommend anyone interested in security/forensics to go back and listen to this webcast.  Also, version 1.3 of the SIFT Workstation just released, so be sure to pick that up.

3.  Larry Pesce brought us the monthly Late-Breaking Attack Vectors Webcast where he discusses the latest happenings in attacks.  Items covered were the every so popular Mikeyy Twitter worm, OS X botnets, and many others.  Larry did an excellent job and this webcast is always worth a listen.

4.  Chris Nickerson and Mike Murray discussed Modern Social Engineering Part II – Top 5 Ways to Manipulate Humans Over the Wire.  Social Engineering is a technique usually not discussed as much as using vulnerabilities or exploits to get inside a network, but Chris and Mike go deep into how to manipulate people.  They do an excellent job expanding on Part I and give real world examples throughout.  Also at the end there is a fairly long Q&A which discusses some interesting techniques.  If you would like to learn more, check out ChicagoCon coming up.  Looks like a great opportunity to interact with some of the great minds in security and it is cheap! ($100).  Also be sure to check out Chris’ new podcast Exotic Liability.

5.  Pauldotcom celebrated its 150th episode with a 12 hour extravaganza featuring guests such as Lenny Zeltser, Martin McKeay, Johnny Long, Stephen Northcutt, and many others.  This episode will surly keep you entertained for a long while to come!

6.  Mike Murray and Danni Lupisella presented on many of the threats that popped up in quarter 1 2009 in their Midnight Hacking webcast.  This was a great webcast that allowed for interaction directly with the presenters and covered great content such as mobile phone vulnerabilities, SSL exploits, and Conficker.  These appear to be monthly and I look forward to attending them on a regular basis.

A little while back this question came up to the SecurityTwits feed from michealc:

Well Micheal, here is your answer.  These types of webcasts are probably the best online security training you can have for the money (free).  They allow you to hear an excellent presentation from some of the best minds in information security and then interact with those great minds during question and answer sessions.  I have been to a few trainings in the last year or so, but some of these webcasts are much better as far as content, presenter knowledge and style.  Keep your eyes on Twitter and the securitytwits feed for great more great webcasts/podcasts.

These questions have been on my mind for a while, and a recent data breach makes me want to get some answers from the experts.

On plenty of breaches I read the following lines:

“We have no reason to believe that this information was accessed by unauthorized individuals…”

“It cannot be determined with certainty that any data was pulled from a computer by infectious software…”

“there is no indication that any of the information has been misused…”

These lines seem to be from the first pages of the “Breach Notification for Dummies” because I have hardly read an announcement without one of these type of statements.� My questions are how do they know that it has not been misused and if they know that is has not been misused, why can it not be determined if the data has been pulled from the computer?� I kinda thought that this was the whole point of forensic investigation, finding out what the bad guy did once they were on the machine.� Is it money, time, notification time (i.e cannot analyze the drive quick enough before notification is necessary), historical data (obviously every breached computer with PII does not lead to ID fraud) or a combination of everything?

Am I missing something here? � I would love to hear what everyone thinks.

UPDATE 04/16/2009: Dave Hull tweeted a link the Security Breach Notification Symposium that should give some great insight to the topics discussed in this post.� The audio/slides for the talks have recently been posted.� Thanks everyone for the great comments!