Track: Practical BGP Origin Validation using RPKI: Vendor Support, Signing and Validation Services, and Operational Experience
December 29, 2019
Malicious BGP route hi-jacks and and accidental mis-originations continue to threaten the security and robustness of the global Internet. Over the last several yea …
Incremental threat modeling: Never try to boil an ocean
December 26, 2019
Threat modeling is one of the best techniques for achieving secure architectures. However, introducing it on existing complex projects requires time that architects and developers may not have. Irene Michlin introduces a technique for performing threat modeling in ongoing projects without a prohibitive initial time investment.
Abusing Google and Facebook login: On the risks in trusting third-party logins
December 25, 2019
Using social logins is a good way to boost security. However, this often makes site owners complacent, skipping security measures they still need to maintain. Ido Safruti and Tomer Cohen explain how attackers have found ways to exploit this and bypass the auth providers defenses, attacking some of the worlds largest services, and demonstrate how to protect yourself from such attacks.
Beyond matching: Applying data science techniques to IOC-based detection
December 25, 2019
Alex Pinto demonstrates how to apply descriptive statistics, graph theory, and nonlinear scoring techniques on the relationships of known network IOCs to log data and how to use those techniques to empower IR teams to encode analyst intuition into repeatable data techniques that can be used to simplify the triage stage and get actionable information with minimal human interaction.
Mapping adversary infrastructure using DNS
December 25, 2019
Nothing good or bad can happen on the Internet without involving the Domain Name System (DNS), which provides visibility of the global Internet and unparalleled intelligence on cybercriminals and attack methods. Merike Ko discusses the value of DNS to cyber investigations and explores how real-time DNS observations can improve accuracy and response time to cyberattacks.
Scalable threat modeling with risk patterns
December 24, 2019
Current approaches to threat modeling emphasize manual analysis by trained teams, which can result in a bottleneck in the development process, reducing the appeal of performing this activity. Stephen de Vries presents a technique that uses reusable risk patterns to open the door to automated and scalable threat modeling.
The industrial age of website bots: How to detect and block automated attacks
December 24, 2019
Bots are a reality, and its hard to separate your users and good bots (e.g., search) from the bad ones (brute force, fraud, scrapers, etc.). Ido Safruti and Ariel Sirota review how bots work, explain how to operate a few common bots, and, most importantly, show what you can do to detect and block malicious activity while enabling your users and good bots to work uninterrupted.
Securing Apache Kafka
December 10, 2019
With Apache Kakfa 0.9, the community has introduced a number of features to make data streams secure. Jun Rao explains the motivation for making these changes, discusses the design of Kafka security, and demonstrates how to secure a Kafka cluster. Jun also covers common pitfalls in securing Kafka and talks about ongoing security work.
Only humans need apply: Adding value to the work of very smart machines
December 5, 2019
The automation of decisions and actions now threatens even knowledge-worker jobs. Tom Davenport describes both the threat of automation and the promise of augmentationcombining smart machines with smart peopleand explores five roles that individuals can adopt to add value to AI, as well as what these roles mean for businesses.
Attack trees: Security modeling for Agile teams
December 3, 2019
Traditional security approaches to threat and risk management are highly optimized to work within a traditional software development lifecycle. Michael Brunton-Spall shares a new approach to reviewing systems along with real-life examples to help you prioritize where to focus security efforts and what sorts of security threats you should worry about.
Protecting individual privacy in a data-driven world
November 17, 2019
With the analytic and predictive power of big data comes the responsibility to respect and protect individual privacy. As citizens, we should hold organizations to account; as data practitioners, we must find intelligent ways to analyze data without violating privacy. Jason McFall discusses privacy risks and surveys leading privacy-preserving analysis techniques.
Securing the Open Web Platform
November 5, 2019
One of the Web's greatest strengths is its generalityits openness to new links and unexpected uses. Openness also means that different applications and users have different security goals and threat models: a mash-up desired by one may be dangerous to another. Wendy Seltzer explores design patterns and modularity to support a platform for trustworthy application development.
How to make threat modeling work for you
October 30, 2019
Threat modeling helps us think about what could go wrong and how to prevent it, but often when building software, we can't figure out how to connect threat models to real-world development and prioritiesor we skip threat modeling altogether. Robert Hurlbut offers practical strategies for threat modeling for secure software design and explains how to apply risk management to deal with the threats.
UX for security: Perils of surveillance, pain of dashboards, and power of design
October 10, 2019
User experience designers have an extraordinary opportunity to empower people to take control of their privacy. Ame Elliott shares examples of design for secure experiences and illustrates how UX can make systems more secure by addressing human behavior. Examples are applicable to a range of areas, including personal communication, business transactions, and government and nonprofit projects.