1. Shad Malloy
CAaNES, LLC

2. Wow, I’ve passed a lot of tests!
SecurityTube iOS Security Expert (SISE)
Web Application Security 360, eLearn Security
Certified Security Analyst (ECSA)
Certified Information System Security Professional (CISSP)
Certified Windows Security Analyst (CWSA), IACRB
Certified Ethical Hacker (CEH), EC-Council
Certified Intrusion Prevention Specialist (CIPS), IACRB
Core Impact Certified Professional (CICP), Core Security
Security+, CompTIA
DON’T TRUST PEOPLES CERTIFICATIONS! EXCEPT MINE!

3. What are we going to be talking about?
Assumptions
Threat Modeling
Fundamentals
FUD Rant
Emerging Threats and Trends

5. Fear Uncertainty Doubt
FUD is rampant in the security industry
Don’t tolerate it

6. Assumptions Target of Opportunity or Convenience Captive Attackers
Illogical Attackers

7. Nation States Are Apex Predators

8. Traditional Defense Structure

9. Modern Defense Structure

10. Actors Malicious or ‘Curious’ Students Malicious or Disgruntled Staff
Hacktivists
Malicious Actors
Criminal Organizations

11. Threat Model
Asset
Actor
Loss

12. Fundamentals Asset Inventory Patching Network SegmentationOS
Peripherals
Network Devices
Applications
Out of Band Management
Network Segmentation
Vulnerability Analysis
Incident Response
Disaster Recovery

13. Current Trends Cryptographic attacks Client Side Application
POODLE
Heartbleed
Client Side Application
Sandworm (I promise these TOTALLY won’t have a nasty surprise)
Internet Explorer MS14-064
Operating System
Shellshock
IoT

14. This is JAMY.
JAMY is a terrible idea.
MS14-036?
Sun Alert ?

15. New Hotness
Dirty secret of every security consultant is … We don’t need the new hotness
Unless your doing the fundamentals well I’m going to use something tried and true.

17. What is on the horizon Encryption Attacks IPv6 and the circle of life
Operation Onymous
IPv6 and the circle of life
Client Attacks

18. Ask Me Anything Shad.Malloy@CAaNES.COM
Questions
Ask Me Anything