Archive, Volume 1: conference talks and papers on security and risk, 2010 to 2018. Zola 2013-10-18T00:00:00+00:00 https://blog.itys.net/vol1/tags/isc2-twin-cities/atom.xml 2013-10-18T00:00:00+00:00 2013-10-18T00:00:00+00:00 Unknown https://blog.itys.net/vol1/posts/ddos-survival-isc2tc/ <h2 id="summary">Summary</h2> <p>Matthew J. Harmon and Phil Reno present at the (ISC)2 Twin Cities Area Chapter on DDoS Survival, delivered on October 18, 2013, provides a comprehensive primer on Distributed Denial of Service (DDoS) attacks and how organizations can withstand and mitigate them. It begins by defining DDoS as resource exhaustion aimed at disrupting servicesand tracing its roots from IRC-driven pranks to sophisticated protest and extortion campaigns.</p> <h2 id="threats-and-attack-techniques">Threats and Attack Techniques</h2> <p>The first section surveys real-world threats and attack techniques. The presenters highlight notable incidents such as Anonymous/AntiSec campaigns and itsoknoproblembro browser-based botnets and reference data on rising attack volumes from sources like Arbor Networks. They categorize attack vectors across the OSI stack (TCP/SSL floods, HTTP-level assaults like Slowloris and chunked-header exploits, and ICMP/UDP floods) and assess attacker skill levels, from low-effort LOIC/XOIC scripts to more advanced injection-driven browser botnets.</p> <h2 id="defense-and-resilience">Defense and Resilience</h2> <p>The second section focuses on defense and resilience strategies. Harmon and Reno outline four architectural approaches: ISP-level scrubbing, Cloud SOC via proxy/DNS redirection, full-service cloud scrubbing with BGP rerouting, and in-house solutions. Detailing the pros and cons of each. They emphasize risk transference through CDNs and anti-DDoS services, null-routing tactics, and bigger pipes, supplemented by application-level tweaks. The presentation concludes with guidance on selecting providers (key questions on SLAs, mitigation capabilities, and cost structures), proactive load testing, and leveraging automation tools (Chef, Puppet, Ansible, SaltStack, Fabric) to scale and verify infrastructure readiness under attack.</p> <h2 id="presentation">Presentation</h2> <p><a href="/attachments/56583_2013-10-18_DDoS_Survival-ISC2TC.pdf">DDoS Survival</a></p> 2013-06-18T00:00:00+00:00 2013-06-18T00:00:00+00:00 Unknown https://blog.itys.net/vol1/posts/cloudsecurity-isc2tc/ <h2 id="summary">Summary</h2> <p>The (ISC)2 Twin Cities Area Chapter presentation Cloud Security by Matthew J. Harmon at the 2013 Annual Meeting introduces the fundamentals of virtualization and cloud computing, emphasizing both their transformative potential and the security considerations they entail.</p> <h2 id="cloud-technology">Cloud Technology</h2> <p>First, Harmon unpacks virtualization basics like defining hypervisors (Type 1 and Type 2), guests, and core virtualization architecturesand maps these concepts onto cloud service models such as Software-as-a-Service (SaaS), Infrastructure-as-a-Service (IaaS), and Anything-as-a-Service. He highlights key benefits including server consolidation, rapid provisioning and decommissioning of resources, auto-patching and silent upgrades, reduced operational overhead, and the ability to harvest processing power on demand. This framing positions cloud computing as a natural extension of traditional virtualization that delivers scale, flexibility, and cost efficiency.</p> <h2 id="security-and-privacy-risks">Security and Privacy Risks</h2> <p>Second, the presentation shifts to the security and privacy risks inherent in cloud environments. Harmon details confidentiality challenges in multi-tenant platformswhere co-located data often lacks provider-managed encryption and availability threats stemming from service outages, contractual lock-in, or disputes with providers. He also addresses integrity risks due to limited transparency into vendor operations and the potential for insider threats. To mitigate these issues, he advocates a trust but verify approach: enforce end-to-end encryption (in transit, processing, and at rest), conduct rigorous vendor audits, codify security requirements in contracts, and maintain continuous risk assessments to ensure that cloud-hosted assets remain under organizational control and resilient against data breaches.</p> <h2 id="presentation">Presentation</h2> <p><a href="/attachments/56461_2013-06-18_CloudSecurity-ISC2TC.pdf">Cloud Security</a></p> 2012-10-24T00:00:00+00:00 2012-10-24T00:00:00+00:00 Unknown https://blog.itys.net/vol1/posts/java-exploits/ <h2 id="summary">Summary</h2> <p>Matthew J. Harmons (ISC)2 Twin Cities Chapter presentation Java Exploits: Offense and Defense, delivered on October 24, 2012, examines the pervasive risk of client-side Java vulnerabilities and outlines why these flaws represent a critical attack vector for organizations. Harmon, drawing on his two decades of security experience, highlights how the Java sandbox can be bypassed via reflection and code injectiondemonstrated by high-impact exploits documented by researchers like Joshua Drake and Adam Gowdiakand underscores the urgency of addressing these pervasive weaknesses.</p> <h2 id="attacks">Attacks</h2> <p>The talk begins by quantifying the threat: in 2012 alone, 23 out of 50 Oracle JRE vulnerabilities carried a CVSS score of 10, signaling complete system compromise without authentication. Harmon dissects sample exploit code that disables the Java SecurityManager by injecting an AllPermission-granted ProtectionDomain, illustrating how easily an attacker can escalate privileges. He reviews major sandbox escapes and stresses that patch cycles alone cannot keep pace with adversaries who weaponize newly discovered flaws .</p> <h2 id="defense">Defense</h2> <p>To counter these risks, Harmon presents a two-pronged defense strategy. On the technical side, he advocates strict whitelisting of Java applets via Group Policy, Click-to-Run settings in browsers to prevent drive-by code execution, and deployment of inline or local sandboxessuch as Invinceas VM-based isolation or FireEye appliancesto contain untrusted code. Complementing this, he urges policy-driven measures: eliminate Java where it isnt business-critical, enforce inventory and configuration controls per the SANS Critical Security Controls (especially Controls 15), and integrate Java risk assessments into broader security governance. By combining these controls, organizations can substantially reduce their Java attack surface and stay ahead of emerging exploit techniques .</p> <h2 id="presentation">Presentation</h2> <p><a href="/attachments/56224_2012-10-24_JavaExploitsOffenseAndDefense-ISC2TC.pdf">Java Exploits Offense and Defense</a></p>