Services we do not provide:
Don't pay us to run nessus
At ISE, we offer specialized expert security services. Therefore, we do not perform commodity services such as automated networks scans and firewall configuration.
Common Criteria
ISE also does not do Common Criteria evaluation.
Life is too short.
Nice!!
I don't believe I'll ever have to crack a password (least for windows) again :-) --take that NTLM and NTLMv2!
No Tech Hacking: A Guide to Social Engineering, Dumpster Diving, and Shoulder Surfing by Johnny Long
4 stars
Solid advice on securing the human vulnerability
Johnny Long has a great knack for taking what should be common sense observations on human vulnerabilities and making them unique, entertaining, and most importantly actionable. The book really seems to be a book to go along with his numerous “No Tech Hacking” talks he has given at several security conferences. If you want an example check out the 2007 Shmoocon Archives: shmoocon.org/2007/presentations.html
Here are the chapters:
Dumpster Diving
Tailgating
Shoulder Surfing
Physical Security
Social Engineering with Jack Wiles
Google Hacking
P2P Hacking
People Watching
Kiosks
Vehicle Surveillance
Badge Surveillance
Epilogue
All of the chapters are pretty good, I particularly liked the Physical Security, P2P Hacking, and Kiosks (even though it was a short chapter). Again, a lot of what he talks about is common sense and taken from his talks he gives a security conferences. But it comes from a guy that gets paid to break into buildings for a living so you can trust the advice and situations to be pretty close to reality.
Things I liked about the book:
-The Physical Security section talks about defeating different types of locks and security systems. It was good relevant content with good advice on how to fix it. The Kiosk chapter talks a little bit about breaking out of Kiosks and information you can gather. Using P2P to look for sensitive documents is a good idea as well. Really all the chapters had valuable information in them. In plain words he sums up relevant and dangerous security issues that target the human element of security.
-The large font and lots of pictures make the book a quick read. I also like that there were pictures to go along with all the points he was trying to make. His “arrest me face” on page 95 is the best.
-The book is pretty much without typos and editing issues which says a lot for a syngress book.
-The book is useful for both technicians and managers, I feel like i can give the book to both the techies and management and have them both get something out of it.
Some things I didn't like about the book:
-The book has a slight condescending tone. I think this is the author's attempt to be funny, and in person I think he could have pulled it off. But in print it really comes across as a “you are dumb, so dumb I have to write a book about hacking you without technology to show you how dumb you are.” It doesn't make the book “bad” its just annoying at times.
-The tailgating section (page 24) slams a person for wearing their badge INSIDE and says she is not security conscious. Why would you NOT where your badge inside? On one hand he complains about people not challenging him because of his fake badge or lack of a badge and then he says that wearing a badge inside is an opportunity for someone who sneaks in to take pictures of it, well guess what, they are already inside, there are other bigger issues now. In my opinion, badge on inside=good, badge on outside at lunch=bad.
-The book suffers a bit from the "Everything must be secure... damn the functionality" problem that a lot of security researchers and hard core security proposals suffer from. What I mean by all that is sometimes security people lose sight of why things are they way they are or the fact that changing the way things are done would hinder actually getting work done. The best example I can come up with from the book is his discussion of DoD decals on cars (in the vehicle surveillance chapter) and how they give away too much information. While not arguing his point on giving away information, I'd like to see his proposal for a better solution to access control on DoD bases. I'd also argue that oil change stickers showing where I got my oil changed (that may give you some information on where I live or work) are far less dangerous than that person just following me to home or work now that they have me and my car associated with one another.
With full access to the memory, the tool can then modify Windows' password protection code, which is stored there, and render it ineffective."
Very cool, of course most people know that if you have physical access to a computer its essentially yours anyway. The idea was originally presented in 2006 at Ruxcon, and now the code is released...now where did i put that firewire cable...Article Link: http://www.smh.com.au/news/security/hack-into-a-windows-pc--no-password-needed/2008/03/04/1204402423638.html
Re: CG's comments.
If you are running an operating system/mail client environment that is susceptible to attacks launched by users clicking on attachments -- which they have done without letup since there have been attachments to click on and GUI mail clients that permit them to click, and which they will continue to do no matter what you or I or anyone else ever tells them -- then your software environment is broken. Fix it.
**I guess i'm ignorant, what magical OS and mail system do you propose that allows the functionality that most people have come to expect from a Windows environment?
Part of that fix, if you're not willing to upgrade to superior operating system/mail client software that is immune to this rudimentary problem, might consist of configuring your mail servers to disallow all attachments by default and only permit those for which there is a business need.
**how do I determine for a large organization what is a business need for each individual? what happens when i guess incorrectly? how doest that scale? realistically how do you propose that is done? again in a Windows environment how do you suddenly say you cant email your powerpoint, excel, and word or pdf documents? or do I allow those even though i can trojanize those?
This is by no means a panacea -- fixing/replacing the broken software is clearly a far better idea -- but it can at least partially mitigate the problem, and it's certainly much better than permitting all attachment types by default.
**what if the malware comes through in normal MS office documents?? do i strip all of those out by default?
As to educating users, it's one of the dumbest ideas in security. As Marcus Ranum has famously pointed out, if it was going to work...it would have worked by now. If you are relying on user education as part of your strategy, you are doomed. See "The Six Dumbest Ideas in Security" for a fine explanation of this.
**I don't know Marcus, but some of that list is pure garbage, especially #4. But back to #5, are you proposing i wait for the next generation of people who are going to magically become better educated without any training to come and fill those seats of user's now? that's just fucking stupid. If users can never be fixed"if it was going to work, it would have worked by now" then why havent we developed a technical solution that works yet? Oh yes, its because the code is broken too, and the fix for that is writing secure code from the start...i'm still waiting for my "securely coded" application to replace everything else that is already in place.
Link: http://rationalsecurity.typepad.com/blog/2008/02/mcgoverns-ten-m.html#comment-105150280
-CG
http://rationalsecurity.typepad.com/blog/2008/02/mcgoverns-ten-m.html
I left the comment below and got the response underneath it. Figured I'd address it on here first then cut and paste over there...
---
My comment:
what is the fix to your #4? You can only stick so many technical barriers in place to prevent your users from opening and clicking on emails they shouldnt. why does it seem like the whole industry is saying that users cannot be trained?
Link: http://rationalsecurity.typepad.com/blog/2008/02/mcgoverns-ten-m.html#comment-105104958