Security Weekly

Risk management

Identity and access

Supply chain

Third-party risk

Architecture

Application security

Container security

Cloud

Cloud security

Device Security

Mobile

Strategy

Vulnerability management

Configuration management

Patch management

Incident response

Security awareness

Email security

Threats

Insider threat

Deception

Policy

Compliance

Privacy

Endpoint Security

SWN #57

North America

Group Podcast

Related Events


<p><strong>(Aired on June 22, 2021)<br></strong><em>Earn up to 3 CPE&#8217;s</em><br><br>Here’s the challenge: Web applications are progressively extending the range of critical business operations they support. But software development for cloud-native environments requires continuous security oversight. Against this backdrop, cybersecurity leaders and strategists must strike a balance between accelerating a business’s go-to-market and safeguarding the applications that fuel its growth and productivity.<br><br>Producing quality code quickly and securely is always the goal. But efforts to integrate security into the software development cycle is more often perceived as a roadblock than a catalyst. Hear from top experts in a series of discussions and presentations focused on application security, topics include:<br><br><span class="has-inline-color has-vivid-red-color">• </span>How to map application security requirements to compliance frameworks<br><span class="has-inline-color has-vivid-red-color">•</span> Embracing and extending DevSecOps principles<br><span class="has-inline-color has-vivid-red-color">•</span> Standardizing application security policies within business lines<br><br>Discover how modern application security programs can operate at the speed and scale that’s required to empower, not deter, the business. </p>



<p class="has-normal-font-size"><strong>AGENDA</strong><br><br><strong><span class="has-inline-color has-vivid-red-color">11:00 AM ET</span></strong><br><strong>KEYNOTE | Preventing the exhaust ports: How not to build a Death Star with your&nbsp;SDLC</strong><br><strong><em>Kevin Johnson,</em></strong><em>&nbsp;CEO, Secure Ideas</em><br>Millions of stormtroopers and galactic empire citizens were lost because engineers didn&#8217;t understand their design flaws.&nbsp;While this is a great movie reference, the reality is that organizations are deploying applications with their version of this fatal flaw every day.&nbsp;In this presentation, Kevin Johnson of Secure Ideas will walk attendees through various examples of application flaws, using real applications he and his team have tested.&nbsp;He will then discuss how the flaws happened and methods for improving your SDLC and security integration to prevent them in the future.&nbsp;</p>



<div class="wp-container-6287ce4193917 wp-block-group"><div class="wp-block-group__inner-container">
<div class="wp-container-6287ce4193712 wp-block-group"><div class="wp-block-group__inner-container">
<div class="wp-container-6287ce4193517 wp-block-group"><div class="wp-block-group__inner-container">
<p class="has-text-color has-normal-font-size" style="color:#444444"><strong><span class="has-inline-color has-vivid-red-color">11:55&nbsp;AM ET</span></strong><br><strong>Beyond DAST: A DAST-first tool with IAST depth</strong>&nbsp;<br><strong><em>Mark Schembri,</em></strong><em>&nbsp;Technical Solutions Engineer, Invicti</em><br>The versatility of modern dynamic tools brings advantages that extend far beyond the typical vulnerability scanning functionality. The inclusion of&nbsp;True IAST functionality maintains the advantages of a DAST solution while going deeper than ever to identify and verify more vulnerabilities with access to the application code. You will learn how&nbsp;Netsparker’s&nbsp;IAST capabilities will help you:</p>



<ul id="block-b68249d0-2801-474a-9579-3e43be3ede32" class="has-vivid-red-color has-text-color"><li><span style="color:#444444" class="has-inline-color">Find more&nbsp;vulnerabilities&nbsp;</span></li><li><span style="color:#444444" class="has-inline-color">Further reduce false positives&nbsp;</span></li><li><span style="color:#444444" class="has-inline-color">Simplify&nbsp;remediation</span></li></ul>
</div></div>
</div></div>
</div></div>



<div class="wp-container-6287ce41945d2 wp-block-group"><div class="wp-block-group__inner-container">
<div class="wp-container-6287ce41943e2 wp-block-group has-text-color" style="color:#444444"><div class="wp-block-group__inner-container">
<div class="wp-container-6287ce41941c9 wp-block-group"><div class="wp-block-group__inner-container">
<p class="has-normal-font-size"><strong><span class="has-inline-color has-vivid-red-color">12:35 PM ET </span></strong><br><strong>Embed&nbsp;sophisticated&nbsp;bot&nbsp;detection into your CI/CD&nbsp;pipeline with a&nbsp;single&nbsp;line of&nbsp;code.</strong><br><strong><em>Peter Craig,</em></strong><em>&nbsp;Director of Product Marketing, Human Security</em><br>Enterprises find it increasingly difficult to defend web applications from automated attacks.&nbsp;Even when apps function as intended, they are vulnerable to criminals using sophisticated bots that mimic human behavior using mouse movements, keystrokes, and fake browser behaviors.&nbsp;Solution: By embedding effective, multilayered, bot detection and mitigation, you can protect your application from automated attacks while providing insight to development on the tactics your adversaries used and the resources they targeted.&nbsp;Learn how you can:&nbsp;</p>



<div class="wp-container-6287ce4193fd1 wp-block-group"><div class="wp-block-group__inner-container">
<ul class="has-vivid-red-color has-text-color"><li><span style="color:#444444" class="has-inline-color">Detect even the most sophisticated, dynamic bots and gain full transparency into each&nbsp;detection&nbsp;</span></li><li><span style="color:#444444" class="has-inline-color">Mitigate malicious bots and nonstandard traffic in&nbsp;real-time&nbsp;</span></li><li><span style="color:#444444" class="has-inline-color">Enhance your application user experience with minimal performance&nbsp;impact</span></li></ul>



<p class="has-normal-font-size"><strong><span class="has-inline-color has-vivid-red-color">1:15 PM ET</span></strong><br><strong>KEYNOTE | Scorched earth: Empirical research in hacking and securing&nbsp;APIs</strong>&nbsp;<br><strong><em>Alissa Knight,&nbsp;</em></strong><em>Partner,&nbsp;Knight Ink</em><br>Application programming interfaces (APIs) are now everywhere, powering the way we live, work and play. But when authentication and authorization is broken, it opens everything up from the data these APIs are serving to remote control of connected passenger vehicles. Unfortunately, many organizations are using the wrong security control to secure their APIs, akin to using a hammer to nail in a screw.<br>Cybersecurity professionals must ensure that APIs are secured correctly, so every request is authenticated and authorized. Solutions should interdict the traffic and ensure the traffic destined for the API is not synthetically generated by malicious tools. In this keynote session, Alissa Knight will share:</p>



<ul id="block-822071bb-1a89-4e27-a30c-b01348f9155b" class="has-vivid-red-color has-text-color"><li><span style="color:#444444" class="has-inline-color">Several years of empirical data gleaned from her hacking of banks, automobile manufacturers, and healthcare providers and payers through their&nbsp;APIs</span></li><li><span style="color:#444444" class="has-inline-color">What her research produced when the wrong security control was used to secure these&nbsp;APIs</span></li><li><span style="color:#444444" class="has-inline-color">What you should be looking for in your API threat management solution</span></li><li><span style="color:#444444" class="has-inline-color">Most importantly, what the indicators of compromise are to the specific tactics and techniques used to breach&nbsp;APIs</span></li></ul>



<p class="has-text-color has-normal-font-size" style="color:#444444"><strong><span class="has-inline-color has-vivid-red-color">1:55 PM ET</span></strong><br><strong>Between the&nbsp;chair and&nbsp;keyboard</strong><br><strong><em>J. Wolfgang Goerlich,&nbsp;</em></strong><em>Advisory CISO, Duo Security&nbsp;at Cisco</em><br>People ultimately decide our security posture. The dreaded end-users.&nbsp;People performing conscientiously&nbsp;and consistently is a lofty goal. Risk management gives us the process to follow.&nbsp;Control&nbsp;frameworks&nbsp;give&nbsp;us the standards to set and meet. Yet it is people who ultimately decide our security posture.&nbsp;In this presentation, we look at the psychology and behavior science of individuals making risk decisions and leaders affecting culture change, and how it affects the security of organizations and the applications on which they rely.&nbsp;Attendees will leave with insights and pragmatic tactics for improving the human element in risk and compliance.</p>



<p class="has-text-color has-normal-font-size" style="color:#444444"><strong><span class="has-inline-color has-vivid-red-color">2:35 PM ET</span></strong><br><strong>How to determine what your open-source risks look like</strong>&nbsp;<br><strong><em>David Lindner,</em></strong><em>&nbsp;CISO, Contrast Security</em>&nbsp;<br>Studies show that upwards of 80% of software code is comprised of open-source libraries. But the reality is that less than 10% of classes within active libraries are ever invoked by the application. Yet, open-source libraries contain significant vulnerability and licensing risks with 34 CVEs per application on average and 35% of applications containing a copyleft license. Attend this session to learn what open-source risks matter and how to focus on fixing them quickly and easily.</p>



<p class="has-text-color has-normal-font-size" style="color:#444444"><strong><span class="has-inline-color has-vivid-red-color">3:15 PM ET</span></strong><br><strong>Best practices for developers for master security</strong>&nbsp;<br><strong><em>Anna Rozin,</em></strong><em>&nbsp;Director of R&amp;D,&nbsp;WhiteSource</em><br><strong><em>Shiri Arad&nbsp;Ivtsan,</em></strong><em>&nbsp;Director of Product,&nbsp;WhiteSource</em><br>When you ask developers what they think of security, they will likely go into the situation without much enthusiasm as in their mind – security is slowing them down and holding them back from doing their “actual” job. But – it doesn’t necessarily have to be that way. The friction between developers and security teams can be&nbsp;reduced if the right tools and processes are in place. Want to learn how handling security can be quick, efficient and integrate into daily workflows?&nbsp;Join Anna Rozin, director of R&amp;D at&nbsp;WhiteSource, and Shiri Arad&nbsp;Ivtsan, director of product at&nbsp;WhiteSource, who will share their hands-on experience in managing&nbsp;open source&nbsp;components with WhiteSource tools. In this session you&#8217;ll learn:</p>



<ul class="has-vivid-red-color has-text-color"><li><span style="color:#444444" class="has-inline-color">Practical advice on testing, managing and fixing vulnerabilities in&nbsp;open source&nbsp;code&nbsp;packages&nbsp;</span></li><li><span style="color:#444444" class="has-inline-color">The tools and processes to handle security in a fast and effective&nbsp;way&nbsp;</span></li><li><span style="color:#444444" class="has-inline-color">How to empower developers with security data through prioritization and remediation tips</span>&nbsp;</li></ul>



<div class="wp-container-6287ce4193ce1 wp-block-group"><div class="wp-block-group__inner-container">
<p class="has-text-color has-normal-font-size" style="color:#444444"><strong><span class="has-inline-color has-vivid-red-color">3:55 PM ET</span></strong><br><strong><strong>KEYNOTE |</strong></strong> <strong>Preventing the next&nbsp;SolarWinds: A look at the evolving app security&nbsp;landscape</strong><br><strong><em>Keith&nbsp;Hoodlet,</em></strong><em>&nbsp;Director, Application Experience, Thermo Fisher Scientific</em><br>Attackers targeting vulnerabilities in applications are growing more sophisticated – looking beyond the low hanging fruit of consumer apps to enterprise software that provides an avenue in for widespread network compromise across an expansive supply chain. Keith&nbsp;Hoodlet,&nbsp;director of application experience at Thermo Fisher Scientific, speaks about the evolving tactics for infiltrating the network via gaps in software security, and must-do-defensive strategies to prevent the next SolarWinds or Accellion hack.&nbsp;<br><br></p>
</div></div>
</div></div>
</div></div>
</div></div>
</div></div>


Generic_215x132_bannerNEW4

DevOps

Asset Management

eSummit

Integrating Application Security: Reengineering AppSec as a business catalyst

ukraine_protest

Analysis

What happens when ‘protestware’ sabotages open source in response to current events?

The White House in Washington DC

Perspective

Add runtime to an SBOM for even stronger security￼

Stores Offer Shopping Times For Elderly And Vulnerable Citizens To Protect Against Coronavirus Transmission

Ransomware

News

Ransomware seen as No. 1 threat of financial organizations￼

Security Weekly News

<p><center><video poster="http://securityweekly.com/wp-content/uploads/2020/08/wordpress_SWN_57-0.png" controls="controls" controlslist="nodownload" width="640" height="360"><source src="https://wpmedia-converted.s3.us-east-2.amazonaws.com/SWN_57-0.mp4" type="video/mp4"></video></center></p>
<p>This week, Dr. Doug talks Russel Kirsch, Carol Baskin, IcedID, Emotet, TeamTNT, and the <span class="caps">CRA</span>! Jason Wood returns for Expert Commentary on how the Secret Service reportedly paid to access phone location data! Visit <a href="https://www.securityweekly.com/swn" rel="nofollow">https://www.securityweekly.com/swn</a> for all the latest episodes!  Visit <a href="https://www.securityweekly.com/swn" rel="nofollow">https://www.securityweekly.com/swn</a> for all the latest episodes!</p>
<p><a href="https://wiki.securityweekly.com/swn57">Full Episode Show Notes</a></p>
<h1>IcedID, &#8216;EmoCrash&#8217; Exploit, &#038; TeamTNT </h1>
<p>None</p>
<h1>Hosts</h1>
<table>
<tr>
<td><div id="attachment_210" style="width: 130px" class="wp-caption alignleft"><img aria-describedby="caption-attachment-210" class="wp-image-210" src="https://securityweekly.com/doug_white-0/" alt="Doug White" width="120" height="96"><p id="caption-attachment-210" class="wp-caption-text">Doug White  &#8211; Professor</p></div></td>
<td><div id="attachment_210" style="width: 130px" class="wp-caption alignleft"><img aria-describedby="caption-attachment-210" class="wp-image-210" src="https://securityweekly.com/jason_wood-0/" alt="Jason Wood" width="120" height="96"><p id="caption-attachment-210" class="wp-caption-text">Jason Wood  &#8211; Founder; Primary Consultant</p></div></td>
</tr>
</table>
</ul>

<audio class="wp-audio-shortcode" id="audio-171431-1" preload="none" style="width: 100%;" controls="controls"><source type="audio/mpeg" src="http://traffic.libsyn.com/sw-all/SWN_57-0_converted.mp3?_=1" /><a href="http://traffic.libsyn.com/sw-all/SWN_57-0_converted.mp3">http://traffic.libsyn.com/sw-all/SWN_57-0_converted.mp3</a></audio>

SWN #57

IcedID, ‘EmoCrash’ Exploit, & TeamTNT

Hosts

Related

What happens when ‘protestware’ sabotages open source in response to current events?

Add runtime to an SBOM for even stronger security￼

Ransomware seen as No. 1 threat of financial organizations￼

Add runtime to an SBOM for even stronger security

Ransomware seen as No. 1 threat of financial organizations