Prowling: Better Penetration Testing, at Converge 2018

“But we passed our penetration test,” the person handling the security breach groaned. “How come they missed this?” Since the late 1960s, penetration testing has been about two things: demonstrating that the system can be broken into and finding some vulnerabilities. But, by now? We all know systems can be broken into. The shock and surprise are gone. And we all know there are vulnerabilities. Scores of vulnerabilities. Too many vulnerabilities. In fact, arguably today’s penetration testing doesn’t even identify a fraction of the vulnerabilities. This session will review the state of testing strategies and present predictions on where penetration testing should go in the future.

Watch more videos on my YouTube channel.

A look back at the Therac-25, a medical device from the 1980s, and a look forward at securing the coming devices.

Watch more videos on my YouTube channel.

One of the best examples of security happened this week Indianapolis.

Watch more videos on my YouTube channel.

On the first day of spring, considering all those security tasks. What IT needs cleaning up?

Watch more videos on my YouTube channel.

We need to do more than speak business language. We need to embrace industry processes and terms to drive action. Example? 8-D in manufacturing and SBAR in medical.

Watch more videos on my YouTube channel.

The heist movie Ocean’s 11 wasn’t about using an casino ocean aquarium to steal from high rollers. But maybe it should have been. Turns out, IoT has reached the fish tank.

Watch more videos on my YouTube channel.

It takes on average 90-days to recover from a breach. Equifax did it in 3. If we were to be compromised, do we have the tools and processes for rapid response?

Watch more videos on my YouTube channel.

A couple of examples for tracking adversaries on the web applications, and using those metrics to drive security activities.

Watch more videos on my YouTube channel.

RSA: DevOps Connect, Hosted by Courtney Kissler

As DevOps continues to be adopted across industries, IT security and application security professionals are being asked to secure the workflow and products. And we get asked to evaluate, recommend, and implement security controls well after the DevOps team has been established. Sometimes, months or even years after the team has launched. This talk speaks to that audience, sharing practices on how to start off strong. Approaches for building relationships, creating intuition, and becoming a trusted partner will be discussed and demonstrated. It is imperative we add security without taking away speed and agility, and the first 90-days is a crucial period.

Watch more videos on my YouTube channel.

A brief bit on what we can learn from the RSA Conference app leaking attendee data.

Watch more videos on my YouTube channel.