Archive, Volume 1: conference talks and papers on security and risk, 2010 to 2018. Zola 2015-06-01T00:00:00+00:00 https://blog.itys.net/vol1/tags/patch-management/atom.xml 2015-06-01T00:00:00+00:00 2015-06-01T00:00:00+00:00 Unknown https://blog.itys.net/vol1/posts/taking-control-with-critical-security-controls-csooutlook/ <h2 id="summary">Summary</h2> <p>The CSO Outlook article Taking Control of IT Operations through the Critical Security Controls by Matthew J. Harmon explains how embedding the first five of the SANS/CIS 20 Critical Security Controls into everyday IT processes can transform security from a reactive cost center into a proactive, measurable discipline.</p> <h2 id="starting-easy">Starting Easy</h2> <p>First, Harmon shows that many breaches start with unknown or low-priority systems, devices and software not inventoried or patched. Controls 1 (Inventory of Authorized and Unauthorized Devices) and 2 (Inventory of Authorized and Unauthorized Software) create visibility by correlating DHCP, ARP, and DHCP assignments for hardware and using WMIC, RPM/APT, or SCCM to catalog installed applications. This foundational inventory maps assets to owners, enables application whitelisting, and allows organizations to detect unauthorized additions before attackers can pivot.</p> <p>Next, the article tackles Controls 3 through 5: secure configurations, continuous vulnerability assessment and remediation, and malware defenses. Harmon advocates applying vendor and CIS hardening guidelines via Group Policy Objects or configuration-management tools (Puppet, Chef), enforcing a 48-hour patch window for critical flaws through tiered testing and deployment, and layering defenses beyond antivirus, such as host firewalls, DNS filtering (e.g., OpenDNS), and threat-intelligence driven proxies. He concludes by recommending a gap assessment against the remaining controls and a phased implementation roadmap to embed these practices into routine IT operations and gauge their impact over time .</p> <h2 id="presentation">Presentation</h2> <p><a href="/attachments/57174_2015-06-01_Taking_Control_with_Critical_Security_Controls-CSOOutlook.pdf">CSO Outlook: Taking Control of IT Operations Through the Critical Secuity Controls</a></p> 2012-10-24T00:00:00+00:00 2012-10-24T00:00:00+00:00 Unknown https://blog.itys.net/vol1/posts/java-exploits/ <h2 id="summary">Summary</h2> <p>Matthew J. Harmons (ISC)2 Twin Cities Chapter presentation Java Exploits: Offense and Defense, delivered on October 24, 2012, examines the pervasive risk of client-side Java vulnerabilities and outlines why these flaws represent a critical attack vector for organizations. Harmon, drawing on his two decades of security experience, highlights how the Java sandbox can be bypassed via reflection and code injectiondemonstrated by high-impact exploits documented by researchers like Joshua Drake and Adam Gowdiakand underscores the urgency of addressing these pervasive weaknesses.</p> <h2 id="attacks">Attacks</h2> <p>The talk begins by quantifying the threat: in 2012 alone, 23 out of 50 Oracle JRE vulnerabilities carried a CVSS score of 10, signaling complete system compromise without authentication. Harmon dissects sample exploit code that disables the Java SecurityManager by injecting an AllPermission-granted ProtectionDomain, illustrating how easily an attacker can escalate privileges. He reviews major sandbox escapes and stresses that patch cycles alone cannot keep pace with adversaries who weaponize newly discovered flaws .</p> <h2 id="defense">Defense</h2> <p>To counter these risks, Harmon presents a two-pronged defense strategy. On the technical side, he advocates strict whitelisting of Java applets via Group Policy, Click-to-Run settings in browsers to prevent drive-by code execution, and deployment of inline or local sandboxessuch as Invinceas VM-based isolation or FireEye appliancesto contain untrusted code. Complementing this, he urges policy-driven measures: eliminate Java where it isnt business-critical, enforce inventory and configuration controls per the SANS Critical Security Controls (especially Controls 15), and integrate Java risk assessments into broader security governance. By combining these controls, organizations can substantially reduce their Java attack surface and stay ahead of emerging exploit techniques .</p> <h2 id="presentation">Presentation</h2> <p><a href="/attachments/56224_2012-10-24_JavaExploitsOffenseAndDefense-ISC2TC.pdf">Java Exploits Offense and Defense</a></p>