Stranger Danger (NodeSummit, 2016)

After my offensive presentation "Testing iOS Apps without Jailbreak in 2018" it is time to focus also on building not just breaking. This talk will cover the most important milestones in reaching secure iOS/macOS apps. I'm going to show you how to develop modern & secure iOS/macOS apps using new security features presented at the latest Apple's Worldwide Developers Conference. Hackers will be satisfied as well, since I'm going to cover also pen tester's perspective. What's more - I will share with you details of multiple vulnerabilities (*including not disclosed previously*) that I found during security assessments and my research of Apple's applications.

In February 2015, Tony Gambacorta presented to the Information Systems Security Association on IoT security.

The Slides cover : Offensive Attack landscape: Analyzing Data from Deep dark and Surface web Tools, Techniques & Trends related to Offensive Attack Simulation: Attack Surface Management (ASM), Continuous Automated Red Teaming (CART) & More How CART (Continuous Automated Red Teaming) can help

This presentation discusses the components of a typical iPhone jailbreak, and how it has become more complex over the last few years.

Fraser and Nick debate the relationship between DevOps and security. Nick argues security is too complex for DevOps approaches, while Fraser argues DevOps and security ultimately have the same goals of reducing risk and increasing value. They propose defining a "risk budget" to measure and manage risk like an "error budget", allowing more frequent deployments if risk is reduced through practices like testing and security engagement. Ultimately they agree DevOps and security need cooperation rather than separation, with security helping scale out practices while DevOps takes security responsibilities.

The document discusses security in software development. It outlines the typical software development life cycle of requirements, design, code, test, and deployment phases. For each phase, it notes that security is usually an afterthought rather than being integrated into the process from the beginning. It encourages improving security perceptions, work, and practices at each stage of development. The presenter is Renato Rodrigues, who wants to continue the security conversation on social media.

This document provides biographical information about the author and discusses various topics related to ransomware, including notable ransomware families, encryption methods, prevention and recovery strategies. The author describes themselves as the creator of several hacking tools and concepts later adopted by cybercriminals. The document offers advice on ransomware prevention both for home and enterprise users, including tips on backups, application control, and making systems appear like a malware analyst's to avoid targeting.

Qrator and Wallarm 2016 State of Network Security report is dedicated to the main events and strong trends in the network security industry. Particular attention is payed to the DDoS, Internet infrastructure, hacks and vulnerabilities in software and hardware, like connected devices.

Penetration tests of iOS applications usually require jailbreak. On the other hand, software developers often enforce a new version of iOS to run the application. Unfortunately, as history shows, with the release of subsequent versions of the iOS system, pentesters have to wait longer and longer for a stable jailbreak. Finally, by testing iDevices, we become participants of the Russian roulette - remain with an out-of-date iOS with the hope that there won’t be an application requiring a newer version; or take the risk of updating and maybe never get the new jailbreak version? During my presentation, I will show you that it is not necessary to put iRevolver to the head and I will present the techniques of conducting the penetration tests without the need to have a jailbreak. The presentation will also include a live demo presenting the solution to the problem of access to protected application resources on the latest version of iOS.

This document discusses building security controls around attack models to enable continuous validation of defenses. It recommends modeling real attack techniques to automatically test each security control as assets are deployed. An example attack on Target is described across stages of initial breach, privilege escalation, access to data stores, and exfiltration. Metrics like detection time and prevention effectiveness are suggested to measure security control performance. Implementing controls informed by relevant attack models is advocated to minimize organizational risk through a data-driven, continuous validation approach.

The document discusses cybersecurity issues related to IoT devices. It begins by describing the 2016 Mirai botnet attacks, which exploited vulnerabilities in IoT devices like IP cameras and DVRs to take down major websites. The document then analyzes the current security situations of IoT, finding that many devices have vulnerabilities due to a lack of focus on security by manufacturers. It also notes that IoT devices could potentially be used as "weapons of mass destruction" due to their ubiquity, connectivity and potential access to users' daily lives. The rest of the document examines common vulnerabilities and attack vectors in IoT devices.

This document discusses DevSecOps, including what it is, why it is needed, and how to implement it. DevSecOps aims to integrate security tools and a security-focused culture into the development lifecycle. It allows security to keep pace with rapid development. The document outlines how to incorporate security checks at various stages of the development pipeline from pre-commit hooks to monitoring in production. It provides examples of tools that can be used and discusses cultural and process aspects of DevSecOps implementation.

This document discusses securing the DevOps pipeline with an automated and agile approach. It recommends including static code analysis, web application scanning, environment compliance checks, and a vulnerability management system in the pipeline. It then provides more details on configuring tasks for each of these tools: static code analysis, web application scanning, infrastructure inspection, and vulnerability management system. The presentation encourages questions and provides contact information for the speaker.

Nowadays REST APIs are behind each mobile and nearly all of web applications. As such they bring a wide range of possibilities in cases of communication and integration with given system. But with great power comes great responsibility. This talk aims to provide general guidance related do API security assessment and covers common API vulnerabilities. We will look at an API interface from the perspective of potential attacker. I will show: how to find hidden API interfaces ways to detect available methods and parameters fuzzing and pentesting techniques for API calls typical problems I will share several interesting cases from public bug bounty reports and personal experience, for example: * how I got various credentials with one API call * how to cause DoS by running Garbage Collector from API

This document discusses security best practices for mobile development. It covers fundamental security principles like vulnerability, threat and mitigation. It details security measures in iOS like application sandboxing, permissions and encryption. It also discusses Android security concepts like application components and permissions. The document recommends practices like static analysis, encryption, jailbreak detection and the use of the Salesforce mobile SDK to help secure mobile apps and data.

Practical use cases on Elastic stack for cyber security leveraging SOC Prime Threat Detection Marketplace. Threat Bounty program, MITRE ATT&CK mapping.

Use security assessment tools during development to detect vulnerabilities early. Open source tools like OpenVAS, OWASP Zap, QARK, and Needle can test networks, web apps, and mobile apps for vulnerabilities at no cost. These tools automate "low hanging fruit" detection and should be used during development to enhance security.

Latvia is located in Northern Europe. It is smaller than France and has fewer inhabitants than Croatia. Latvia's capital is not Liepaja, and its highest point is 312 meters high. Kaletu primary school, located in an old palace building, has fewer than 200 pupils and is led by Headmistress Inese. It is an eco-friendly school.

A pps presentation about Zadar city in Croatia. All of my original pps visible on: http://iszedo.eu/pps1.htm

- The document discusses tourism statistics for Croatia which show steady growth between 2013-2014, with over 13 million tourists and 66.5 million overnight stays in 2014. - It introduces a website that aims to provide one-stop booking for tourists visiting Croatia, allowing them to book accommodation, flights, tours, car rentals, and ferry/bus tickets on a single platform. - The website has signed contracts with 16 travel agencies in Croatia to offer over 200 things to do. It plans to launch bus and ferry booking capabilities soon. - The business model involves taking commissions from partners ranging from 5-20% for different booking types like accommodation, flights, tours. - The founders are raising $150,000

Croatia is a country in Europe with a capital of Zagreb. Some key tourist attractions include the Pula Arena, the town of Rovinj known for its fishing and scenery, and the island of Hvar. Traditional Croatian foods include dried ham, black risotto made from squid ink, and roasted lamb. Croatia's national soccer team was founded in 1912 and plays in Stadium Maksimir. Croatia got its name from Latin during the medieval period.