OWASP Mantra-OS Because the world is cruel. About Me Attended United Stated Air Force Institute of Technology Defense Acquisition University Platform.

Slides:

Advertisements

Similar presentations

Approaches to meeting the PCI Vulnerability Management and Penetration Testing Requirements Clay Keller.

Advertisements

Intrusion Detection/Prevention Systems Charles Poff Bearing Point.

The Most Analytical and Comprehensive Defense Network in a Box.

Penetration Testing Presented by: Elham Hojati Advisor: Dr. Akbar Namin July 2014.

Into the Mind of the Hacker: Hands-On Web Application Hacking Adam Doupé University of California, Santa Barbara 4/23/12.

1 © Copyright 2014 Coveros, Inc. All rights reserved. Web Application Security Testing: Kali Linux Is the Way to Go Gene Gotimer, Senior Architect

Case Studies for Projects. Network Audit A brief description of the systems (via fingerprinting, if black box is used) Network perimeter should be described.

Bela Erdelyi Mike Qaissaunee

© 2012 Avaya – Restricted, Confidential & Proprietary. NDA Presentation Avaya Aura ® Virtualized Environment Avaya Aura ® on VMware.

CyberSecurity for NEEShub: Best-Practices and Lessons Learned Gaspar Modelo-Howard CyberSecurity Engineer George E. Brown, Jr. Network for Earthquake Engineering.

What is OWASP OWASP Live CD Live Demo Omar Sherin-OWASP Egypt.

VMware vCenter Server Module 4.

Copyright © The OWASP Foundation This work is available under the Creative Commons SA 2.5 license The OWASP Foundation OWASP BeNeLux 2010

Team BAM! Scott Amack, Everett Bloch, Maxine Major.

Linux Deploy This application is open source software for quick and easy installation of the operating system (OS) GNU/Linux on your Android device. The.

Introduction to Application Penetration Testing

Brad Baker CS526 May 7 th, /7/ Project goals 2. Test Environment 3. The Problem 4. Some Solutions 5. ModSecurity Overview 6. ModSecurity.

The Most Analytical and Comprehensive Defense Network in a Box.

Copyright © The OWASP Foundation Permission is granted to copy, distribute and/or modify this document under the terms of the OWASP License. The OWASP.

EEye Digital Security    On the Frontline of the Threat Landscape: Simple configuration goes a long way.

CSE 4481 Computer Security Lab Mark Shtern. INTRODUCTION.

Web Application Firewall (WAF) RSA ® Conference 2013.

Copyright © The OWASP Foundation Permission is granted to copy, distribute and/or modify this document under the terms of the OWASP License. The OWASP.

Containers are the future of Cloud Pavel Odintsov CTO, FastVPS Eesti OU

Information Technology at Emory Information Technology Division Technical Services IT Briefing Agenda 7/17/05 New scanning tools EOL/eVax & BTS Oracle.

CSE 4481 Computer Security Lab Mark Shtern. INTRODUCTION.

12 Steps to Cloud Security A guide to securing your Cloud Deployment Vishnu Vettrivel Principal Engineering Lead,

© 2010 VMware Inc. All rights reserved vSphere 4.1: Install, Configure, Manage.

Web Applications Testing By Jamie Rougvie Supported by.

Copyright © The OWASP Foundation This work is available under the Creative Commons SA 2.5 license The OWASP Foundation OWASP Denver February 2012.

Mark Shtern.  Our life depends on computer systems  Traffic control  Banking  Medical equipment  Internet  Social networks  Growing number of.

OWASP ASVS Levels1234 Tools Manual Test and Review Manual Design Review At higher levels in ASVS,the use of tools is encouraged. But to be effective,the.

XCAST team report Yuji IMAI (WIDE Project) 1.Experimental Deployment Method for Router Supported ALM using PlanetLab draft-muramoto-irtf-sam-exp-testbed-00.txt.

Virtualization Redefined: Embedded virtualization through CGE7 and Docker. Paul Farmer Technical Solutions Engineering Manager MontaVista Software

Cyber Security – The Changing Landscape Erick Weber Department of Public Works Khaled Tawfik Cyber Security.

FROM CONTINUOUS INTEGRATION TO VIRTUAL PATCHING BUILDING APPSEC ALL ALONG THE WEB APPLICATION LIFECYCLE.

Koustav Sadhukhan, Rao Arvind Mallari and Tarun Yadav DRDO, Ministry of Defense, INDIA Cyber Attack Thread: A Control-flow Based Approach to Deconstruct.

Vulnerability Analysis Dr. X. Computer system Design Implementation Maintenance Operation.

Software Security Q: What does it mean to say that a program is secure? A: There is a sufficient amount of trust that the program maintains _____________,

Top 10 Hacking Tool Welcome TO hackaholic Kumar shubham.

Daniel P. Berrangé Principal Software Engineer, Red Hat.

Unit 2: Cyber Security Part 3 Monitoring Tools & other Security Products.

Geeks Need Basements. Who am I? Started in computer industry in 1982 Specializing in security for the past 15 years ASS (Application Security Specialist)

On the cheap side of Cybersecurity – via Open Source Valentin NECOARA – PKI&Cybersecurity Director.

[blank page for bug work-around]

Commonly used CTF Tools

Web Application Security

Fortinet NSE8 Exam Do You Want To Pass In First Attempt.

Module: Software Engineering of Web Applications

Hacking SQL Server The best defense is a good offence by Dustin

What is Fedora effectively doing for Open Source?

Penetration Testing Karen Miller.

OWASP Live CD: An open environment for web application security.

Penetration Testing following OWASP

Penetration Test Debrief

Deep Dive into the Blue VCU Infosec Team.

Web Application Penetration Testing

Virtualization & Security real solutions

Security of web applications.

Validating Your Information Security Program (ISP 3 of 3)

Virtual Patching “A security policy enforcement layer which prevents the exploitation of a known vulnerability”

Healthcare Cloud Security Stack for Microsoft Azure

Healthcare Cloud Security Stack for Microsoft Azure

Hacking web applications

Engine Part ID Part 1.

Engine Part ID Part 2.

Engine Part ID Part 2.

Healthcare Cloud Security Stack for Microsoft Azure

Healthcare Cloud Security Stack for Microsoft Azure

Presentation transcript:

OWASP Mantra-OS Because the world is cruel

About Me Attended United Stated Air Force Institute of Technology Defense Acquisition University Platform Security Engineer at

What is Mantra-OS? Mantra-OS is a virtualized attack platform designed around Mantra Security toolkit and OWASP WTE repository.

What was Mantra-OS developed for? SCAP testing and professional pen-testing environment optimized for virtual environments. Such as vSphere, XenDesketop, OpenStack, oVirt. Installation media iso and deployable ovf/ova.

Mantra-OS & HyTrust Mantra-OS was implemented into HyTrust QA cycle It is used for SCAP testing and Vulnerability verification testing. Is deployed through vCenter.

Mantra-OS Virtualization and Security Kernel GrSecurity Kernel patch and OpenVZ Kernel patch. Ganeti for Virtual Cluster KVM implementation as secondary layer of virtualization.

Mantra-OS Containers and Sandboxing OpenVZ is used as container controller and lxc with arkose d-bus hook to sandbox desktop. Libvirtd is used as a job handler for virtualization with glib hook.

Mantra-OS Virtual Core

Mantra-OS Enhanced Security IDS protection with suricata Artillery and honeyd for IPS protection Container based sandboxing AppArmor, SElinux

Mantra-OS Security Audit Tools OWASP Zap Burp Maltego Metasploit & Armitage Zenmap

Mantra-OS Packet Capture Ettercap Wireshark

Mantra-OS Web Application Scanners Skipfish Nikto Gruyere

Mantra-OS SQL Injection Sqlbrute Sqlmap Sqlmap intergration with Zap

Mantra-OS Intel Collection Maltego