Security B-Sides MSP 2014 - Automating Compliance

Last week, our team flew across the ocean, to Minneapolis to attend and present at Security B-Sides MSP 2014.





Security B-Sides is an information security event, that follows an "unconference" format and was setup by a few renowned security experts, in 2012, after large hacking conferences (BlackHat, DefCon) experienced a huge amount of subscriptions to their CfP (Call for Papers) and simply ran out of space to accommodate them all. 

Just discussed the #BSidesMSP 2014 documentary with the crew, this is going to be fantastic. May put it up at #Minnesota film festivals :-)

— Security B-Sides MSP (@BSidesMSP) August 27, 2014

#BSidesMSP 2014 Speaker Presentations Posted! https://t.co/Zx5CkTjvEv http://t.co/Pj47hcVwCu https://t.co/YRePLvQz0I @SecurityBSides

— Security B-Sides MSP (@BSidesMSP) August 26, 2014

#BSidesMSP would like to thank the amazing @TitaniaLimited again for being one of our #sponsors!

— Security B-Sides MSP (@BSidesMSP) August 20, 2014

Our team came to discuss Automating Compliance. Titania's founder, Ian Whiting, spoke about his background as a penetration tester, the concept behind creating the network security auditing and compliance tools, Nipper Studio and Paws Studio and why he thinks it is essential that software "should just work". 


My background is a penetration tester. I used to be one of those geeks, hackers that would sit in the corner of the room, and got the blame for everything that went wrong: "it must be the guy coming in doing the auditing that's causing all of these network problems today."

I used to have to run a wide variety of different kind of tools to do those jobs and it's very important to understand exactly what the software is doing, but also to understand the weaknesses of the software.

I was once given a job, many years ago, to audit some network switches and I think it's very important that auditors' time is best spent doing things that require a human to look at, while things that are fairly mundane and routine are excellent candidates for automation. I truly believe that. So I sat down and someone gave me 30 configs for different switches to go through manually. At this point I thought: "now is the time to start automating this kind of process. It's a very mundane task, computers are ideal at automating those very basic checks".

One of the things that being a penetration tester has led me very strongly to believe is that all software should be easy to use. I don't care if it takes the software developer an extra 6 months to code a bit of software. For the users it should be intuitive and easy to use. It should be there to help you and it should go hand in hand with the way you work, in order to reduce the amount of time that it takes you to audit. It should just work. I don't want a bit of software that I install on a system and then have to tweak  for the next half an hour, using Google to try and work out what's going wrong and fix it along the way. It's one of the founding principles of the software that we develop. 



We have a product called Nipper Studio which automates the auditing of firewalls, routers, switches and your various network infrastructure devices and another called Paws Studio, which does similar things for servers and workstations. Both products offer free evaluations, so that you can give it a go on your own platform. One of the things I think it's very important, is to be able to try these things for yourself. You shouldn't have to go and buy something blind, in the hope that what the sales person told you about the product is true and that it's going to do what they said it'd do. You have to try things out for yourself and that's why we provide evaluations for our software. 

Download your free evaluation license here. 

Although the first edition of the Minnesota chapter, the event was appreciated by the industry and praised by the media. 

Aside from numerous talks from cyber security experts (an overview of the talks can be found in this previous post), the keynote opening speech was delivered by a legend in the Chinese cyber warfare arena: Lt. Col. (ret) William Hagestad (@RedDragon1949). A very worthwhile talk to listen to and the Colonel is a very engaging presence on the scene. The talk can be found here and it is number 2 on the list, right after the Opening Ceremonies from Matthew J. Harmon, Bradley Ammerman and Tom O'Neill. You can also read the story in CSO Online: Why our lack of understanding on China may be the biggest risk 

An overview of all the talks can be found in our previous post, or viewed / downloaded
off the Security B-Sides wiki.



Video and images courtesy of @mjharmon

Titania Presenting At Security B-Sides MSP – Minnesota Chapter of Security B-Sides

Come And See Us At The Nerdery

Titania’s MD, Ian Whiting, and COO, Nicola Whiting are traveling to Minnesota this week to discuss compliance and security with infosec experts at Security B-Sides MSP, hosted at the Nerdery, Minnesota. 

'Workstation Configuration Hardening' talk 

As sponsors and supporters of the B-Sides series, we are contributing a 1h long presentation appropriately called “Workstation Configuration Hardening” featuring our compliance solution – Paws Studio. The talk will take place in the Crypto Party room, from 13.00 – 14.00. In this presentation, Ian Whiting will be discussing configuration management, how compliance fits in with organizational needs, the issue of compliance vs. security and the need for automated solutions, while finishing with an interactive demonstration of Paws Studio. To take part in the demo you only need to bring a device (laptop, tablet) and install Paws Studio on the machine. You also have the option to get an evaluation key to try it later at home, or check out other policies supported. 

You can also come and listen to Ian's talk on “Automating Compliance” which will take place in the Auditorium, from 12:15, followed by Josh Paul, from Dakota State University and Mike Lutgen, from Palo Alto Networks. 

BSides happened for all the ‘great talks that never got heard’

The “mother” organization for BSides MSP is Security BSides and it has since its beginnings spawned a multitude of chapters all over the world B’Sides started in 2009 when Mike Dahn (@MikD), Jack Daniel (@jack_daniel), Chris Nickerson (@isc4thepeople) decided to hold their own conferences ‘on the side’, as the CFP (Call For Papers) at BlackHat or DEF CON was oversubscribed. In its non-conformist style, the event defines itself through a negation: B-Sides is not the All-Conference-Rejects, while adamant that it is not a conference looking to discuss the current big thing. B-Sides is on the lookout for the people who are discussing the NEXT BIG THING. 

The event has a different structure to other established conferences in the industry. The Structured chapters follow a more “official” conference format and are usually run alongside other security conferences (Black Hat, RSA etc.). The other style, which is also what you can expect at the Minnesota chapter, is the Unconference format; it is meant to be relaxed, interactive and the general idea is to take part in the conversation, ask questions and “make it as good as you want it to be”.

What Else Is On?

BSides MSP schedule

There are plenty of exciting keynotes, presentations and competitions to choose from including a Crypto Party, a Capture The Flag competition as well as other initiatives.

The keynote program includes well-known names in the infosec and was determined by community vote:

Opening the keynote track is Lt. Col. William Hagestad II  (@RedDragon1949)  is a renowned expert in Chinese cyber warfare who will be giving an overview of the 'Chinese Use of Computers & Networks as a Strategic Weapon'.

Mike Saunders (@hardwaterhacker) talks about 'Problems with Parameters' - After networks and servers become more secure, the soft belly of the Internet consists of vulnerabilities in Web Applications.

Leonard Jacobs from Netsecuris (@Netsecuris) opens the conversation on 'Using Your Brain To Beat The Hackers' – automated threat monitoring and threat-detection software are not enough to determine whether a threat is real. The human brain is needed.

Dr. Jared DeMott (@JaredDeMott) talk on 'Appsec: Overview, Deep Dive & Trends' will look at the 3 pillars of Application Security: static, dynamic and manual analysis, popular bugs in code auditing, and file fuzzing and network fuzzing.

Paul Dokas (@pauldokas) presents on 'World Class Network Defense', or 'How I Learned To Ignore Vendors And Use Tools That Work' brings a non-commercial perspective on open source tools to create a defense system for the network.

The ending keynote is held by Rafal Los (@RafalLos) Director Solutions Research at Accuvant who makes a compelling case for 'Succeeding in Security by Measuring Your Failure'. When it comes to breaches, understanding what to measure is just as important as understanding how to measure effectively. Here, in the failures, we can find success.

We are proud to join forces with other industry names in sponsoring the Security B-Sides MSP: The Nerdery (@the_nerdery), ISC2 (@ISC2), Palo Alto Networks (@PaloAltoNtwks) DSU Dakota State (@DakotaState), Milton Security Group (@MiltonSecurity), Bromium(@bromium), Symantec (@SYMCPartners), Netsecuris (@Netsecuris), Global Velocity (@GlobalVelocity), Silent Circle (@SilentCircle), IT Risk Limited (@itriskltd). 

Come on over!

If you are in Minnesota on Saturday, 23^rd of August, visit us, talk to us, ask us questions and most important, don’t take our word for it! Try Paws Studio for yourself and tell us what you think. As with all BSides events entry is free, but registration is required. Wheaton’s Law applies. Also, do not socially engineer the staff.