null Delhi Special Meeting - with Joerg Simon

1. Delhi the Second Adventure
Thorough, Safe and Secure
Fabian + Joerg
jsimon@fedoraproject.org
http://fedoraproject.org

2. /me

3. 3 3Communication Security
[ and this! ]

5. [ Security Lab ]
A Linux based
open source test- and
education platform for
- security-auditing
- forensics
- penetration-testing

6. [ History: @ foss.in Bangalore 2009 ]
- pick up the Idea - give it a home - http://fedorahosted.org/security-spin/
- Contributor Wishlist – https://bugzilla.redhat.com/show_bug.cgi?id=563471
- Improve spin section content – went to spins.fedoraproject.org/security
- move to SLiM as desktop manager – moved to SLiM -> moved to LXDM ...
- move to LXDE as window manager – we moved to LXDE -> move to XFCE in Fedora20
- become a official spin in Fedora 13 – we made it as a official Fedora Security Spin in
Fedora 13, 14, 15, 16, 17 and will be for 18
- LIMITS - Webapplication testing tools + implementing OSSTMM upstreams – we
packaged SCARE, unicornscan also brought up limits of a large FOSS Project
- become the official OSSTMM Distro – ISECOM´s Pete Herzog announced OSSTMM Lab
as the “New live linux distro for OSSTMM users” - on 12.September 2012
- new features in the current Version of the OSL (v3.8b4 (F17))with input from the
ISECOM HHS Team!
- collect input and suggestions
- Working on a Test-Bench for Students

7. [ possible benefits ]
- usecase for the FSL
- new cool upstreams
- implemented methodology
- fedora get taught along the OSSTMM

8. OSSTMM- Lab
Modified Version of the
Fedora Security Lab
Packaging upstream
Tools from the OSSTMM Team
A stable platform
for teaching the curriculum
For OSSTMM and HHS
Integrate the Methodology Flow
Into one possible Toolset
[ benefits ]

9. 9 9
HIC Audit Services
[ From Risk to Operations ]

10. From Risk to Operations

12. 12 12
[ but we have problem ]

13. [ Security - Industry ]

14.  Comply!?
But not secure?
Blocked?
 Get the Audit Result you need?
But not secure?
Blocked?
 Secure?
But not compliant?
Blocked?
[ Compliance? ]
Quelle: OSSTMM ISECOM

16. Spend your money on
„Bad Security“?

17. 17 17Communication Security
Security ?
Cloud – Social Media – Mobile Plattform

18. 18 18Communication Security
Trusts
neue
Angriffsvektoren!

19. [ Reports
Management & Real world
compatible ]
[ reproducible
with the right
Standards
& Methods! ]
[ neutral
unbiased
by relying on
Open Standards ]
[ comparable
real working Metrics
– based on scientific research ]

20. [ know ]
- a way for proper testing!

21. [ there is a Open Source
way]
 How do current operations work?
 How do they work differently from
how management thinks they work?
 How do they need to work?

22. 22 22
HIC Audit Services
[ Controls <> Trusts ]
[ Security <> Safety? ]
[ Operations ]
[ Compliance ]
[ the terrible truth? ]

23. Human risk will never change
„In Security people are as much a part of the process as are the
machines.“
derived from ISECOM, OSSTMM 3.0

25. ● Industrie 74,49%
● Military 97,16%
● Banks 84,36%
● Software­Vendors 73,12%
● Politik 76,58%

27. Usual testing synonyms
Blind/Blackbox Pentest
Graybox/Chrystal/RedTeam
Social Engineering
WarDriving
WarDialing
Configuration­Reviews
Code Reviews
[ common sence ]

28. [ testpath ]

34.  False Positive (Status true – although untrue)
 False Negative (Status untrue – although true)
 GrayPositive (Status always true)
 Gray Negative (always untrue)
 Specter (true or untrue ­ anomaly)
 Indiscretion (true or untrue ­ timedependency)
 Entropy Error (true or untrue ­ Overhead)
 Falsification (true or untrue – unknown Variables)
 Sampling Error (influenced from outside)
 Constraint (true or untrue – Equipment Limit)
 Propagation (not tested)
 Human Error (missing Skill, Expirience)

35. 35 35
From Risk to Operations

36. 36 36Communication Security
[ Quantify Security ]

37. 37 37Communication Security
Metrics
System Schwachstelle Kritikalität Maßnahme
unsichere Verschlüsselung möglich
evtl. veraltete SW-Version
gering bew erten und unterbinden
Parameter mit Code-Injection mittel
Säuberung der Codefragmente aus den
Anfragen
Anw endungsaudit
unsichere Verschlüsselung möglich
evtl. veraltete SW-Version
gering
bew erten
Angriffsfläche verringern
unsichere Verschlüsselung möglich
evtl. veraltete SW-Version
gering
prüfen und beheben
Anw endungsaudit
unverschlüsselte Übertragung von
Authentifizierungsdaten
Cross Site Tracing
mittel
Einschränkung von TRACE Anfragen
unverschlüsselte Übertragung prüfen
und beheben
unsichere Verschlüsselung möglich
Passwortkombinationen unlimitiert
gering bew erten und unterbinden
Adminportale unverschlüsselt
erreichbar
Passwortkombinationen unlimitiert
Offenlegung aller Systemdaten!
Zugang zu privaten Daten
Administrativer Zugang zum
Webserver
hoch
umfangreiche praktische Sofort-
Maßnahmen wurden am 21.08.2010
gemeldet siehe Seite 48
Spamversand möglich
CodeInjection
mittel
Formularverarbeitung ist zu überarbeiten
Säuberung der Codefragmente aus den
Anfragen
Anwendungsaudit
eingeschränkte Verschlüsselung gering Hersteller Patch einspielen
CrossSite Tracing
PHP Version angreifbar
CrossSiteScripting
ParameterTampering
InformationDisclosure
hoch
Einschränkung von TRACE Anfragen
Formularverarbeitung ist zu überarbeiten
Säuberung der Codefragmente aus den
Anfragen
Klassifizierung der Informationen
Vulnerability Mngmt. vs Threat Modelling vs RiskAssessmentValues

38. 38 38Communication Security
RAV
Quelle: OSSTMM ISECOM

39. 39 39Communication Security
[ porosity ]
- Visibility
- Access
- Trust

40. [ how much security do you really need? ]

41. [ Authentication ]

42. [ Indemnification ]

43. [ Resistance ]

44. [ Subjugation ]

45. [ Continuity ]

46. [ non-repudiation ]

47. [ confidentiality ]
[ privacy ]
[ integrity ]

48. [ Alarm ]

49. [ limitations ]

50. Limitations

51. OSSTMM Risk Assessment Value

53. „There are only 2 ways to steal something: either you take it yourself
or you have someone else take it and give it to you“
OSSTMM 3.0

54. 54 54Communication Security
Apps?
Steal something for me?

55. 55 55Communication Security
Steal something for me

56. 56 56Communication Security
Tom is verbose

57. 57 57Communication Security
Tom the Cat is calling home

58. Size Symmetry
Visibility
Subjugation
Consistency
Integrity
Offsets
Value
Components
Porosity
[ quantify Trust! ]

59. 59 59Communication Security
Risk!
sometimes the result
is not what you expect!