Portcullis Labs » SnoopCon https://labs.portcullis.co.uk Research and Development en-US hourly 1 http://wordpress.org/?v=3.8.5 Security Engineering – A manifesto for defensive security https://labs.portcullis.co.uk/presentations/security-engineering-a-manifesto-for-defensive-security/ https://labs.portcullis.co.uk/presentations/security-engineering-a-manifesto-for-defensive-security/#comments Fri, 28 Jun 2019 06:27:47 +0000 https://labs.portcullis.co.uk/?p=6858 Presentation on the need to re-examine how we engineer systems (taking service providers as an example) and the implications on how we quantify cyber risk if we want to take this message into the board room (as given at BT’s SnoopCon 2019 and Cisco’s June 2019 Knowledge Network webinar for service providers). Having delivered security […]

The post Security Engineering – A manifesto for defensive security appeared first on Portcullis Labs.

]]> Presentation on the need to re-examine how we engineer systems (taking service providers as an example) and the implications on how we quantify cyber risk if we want to take this message into the board room (as given at BT’s SnoopCon 2019 and Cisco’s June 2019 Knowledge Network webinar for service providers).

Having delivered security consultancy as part of Portcullis/Cisco for over 15 years, I’ve seen a variety of shades of broken. Since I recently spent some time on secondment to one of our customers to help them design, build and operationalise security as part of their digital transformation programme, I got to thinking: what would I do if I wanted to get projects delivered right? With apologies to grsec, Jericho Forum, BeyondCorp and Trusted Computing, what followed was part philosophy, part technical brain dump, the result being my take on security engineering and how to build defensible systems. This talk includes the following hits:

  • Helping the blue team – a case study in 3 parts…
  • Blue doesn’t have the man power to adopt gift wrapped improvements let alone offensive research thrown over the wall
  • Static passwords – why the hell are we still using them?
  • Vulnerability management – didn’t we say blacklists were bad?
  • Forget about penetration testing – what are your controls?
  • Is there another way to report – why don’t businesses listen to us?
  • Monetising MITRE – can we make money out of CVEs?
SEAMFDS
SEAMFDS.pdf
June 28, 2019
311.8 KiB
MD5 hash: 185701fbc113ca2a676e802b61df53e2
Details

The post Security Engineering – A manifesto for defensive security appeared first on Portcullis Labs.

]]> https://labs.portcullis.co.uk/presentations/security-engineering-a-manifesto-for-defensive-security/feed/ 0 44CON uncovered https://labs.portcullis.co.uk/presentations/44con-uncovered/ https://labs.portcullis.co.uk/presentations/44con-uncovered/#comments Sat, 21 Jun 2014 12:01:45 +0000 https://labs.portcullis.co.uk/?p=4567 Presentation on system level vulnerabilities (as given at BT’s SnoopCon 2014). This talk references previous presentations including: “I miss LSD“ “Big Game Hunting: Simple techniques for bug hunting on big iron UNIX“ “Breaking the Links: Exploiting the Linker“

The post 44CON uncovered appeared first on Portcullis Labs.

]]> Presentation on system level vulnerabilities (as given at BT’s SnoopCon 2014).

This talk references previous presentations including:

44CU
44CU.pdf
June 20, 2014
247.5 KiB
MD5 hash: 22527f212e79dffdb8a91c56b878130f
Details

The post 44CON uncovered appeared first on Portcullis Labs.

]]> https://labs.portcullis.co.uk/presentations/44con-uncovered/feed/ 0