Shad Malloy CAaNES, LLC

Wow, I’ve passed a lot of tests! SecurityTube iOS Security Expert (SISE) Web Application Security 360, eLearn Security Certified Security Analyst (ECSA) Certified Information System Security Professional (CISSP) Certified Windows Security Analyst (CWSA), IACRB Certified Ethical Hacker (CEH), EC-Council Certified Intrusion Prevention Specialist (CIPS), IACRB Core Impact Certified Professional (CICP), Core Security Security+, CompTIA DON’T TRUST PEOPLES CERTIFICATIONS! EXCEPT MINE!

What are we going to be talking about? Assumptions Threat Modeling Fundamentals FUD Rant Emerging Threats and Trends

Fear Uncertainty Doubt FUD is rampant in the security industry Don’t tolerate it

Assumptions Target of Opportunity or Convenience Captive Attackers Illogical Attackers

Nation States Are Apex Predators

Traditional Defense Structure

Modern Defense Structure

Actors Malicious or ‘Curious’ Students Malicious or Disgruntled Staff Hacktivists Malicious Actors Criminal Organizations

Threat Model Asset Actor Loss

Fundamentals Asset Inventory Patching Network Segmentation OS Peripherals Network Devices Applications Out of Band Management Network Segmentation Vulnerability Analysis Incident Response Disaster Recovery

Current Trends Cryptographic attacks Client Side Application POODLE Heartbleed Client Side Application Sandworm (I promise these TOTALLY won’t have a nasty surprise) Internet Explorer MS14-064 Operating System Shellshock IoT

This is JAMY. JAMY is a terrible idea. MS14-036? Sun Alert 6483560?

New Hotness Dirty secret of every security consultant is … We don’t need the new hotness Unless your doing the fundamentals well I’m going to use something tried and true.

What is on the horizon Encryption Attacks IPv6 and the circle of life Operation Onymous IPv6 and the circle of life Client Attacks

Ask Me Anything Shad.Malloy@CAaNES.COM Questions Ask Me Anything Shad.Malloy@CAaNES.COM