Centre for Cyber Security Thomas Kristmar Centre for Cyber Security - - PowerPoint PPT Presentation

▶
centre for cyber security
SMART_READER_LITE
LIVE PREVIEW

Centre for Cyber Security Thomas Kristmar Centre for Cyber Security - - PowerPoint PPT Presentation

Apr 01, 2023 260 likes •456 views

Centre for Cyber Security Thomas Kristmar Centre for Cyber Security Danish Defence Intelligence Service 05-10-2015 05-10-2015 Who are we? Centre for Cyber Security In respect of the Rule of Law and Privacy Cyber is a priority (Gov.

slide-1
SLIDE 1

Centre for Cyber Security

Thomas Kristmar Centre for Cyber Security Danish Defence Intelligence Service

slide-2
SLIDE 2

05-10-2015

slide-3
SLIDE 3

05-10-2015

slide-4
SLIDE 4

Who are we?

Centre for Cyber Security

  • In respect of the Rule of Law and Privacy – Cyber is a

priority (Gov. Declaration, Oct 2011)

  • National Centre of excellence in Cyber Security
  • DK Defence Intelligence Service
  • 5. oktober 2015

4

slide-5
SLIDE 5
  • SDLC - Theory
slide-6
SLIDE 6
  • Actual SDLC

Requirements Too costly /too late Ship & Fix in future release

slide-7
SLIDE 7
  • 5. oktober 2015

7

Example– SSL certificates

slide-8
SLIDE 8

05-10-2015

Example Directory Traversal

slide-9
SLIDE 9

05-10-2015

“Those who don't know history are doomed to repeat it.”

slide-10
SLIDE 10

05-10-2015

Societal Impact

slide-11
SLIDE 11

05-10-2015

Risk

  • Know your code

http://cynosureprime.blogspot.dk/2015/09/ how-we-cracked-millions-of-ashley.html

slide-12
SLIDE 12

05-10-2015

Risk

  • Know your code

http://qz.com/501073/the-top-100-passwords-on-ashley- madison/

  • XcodeGhost

http://researchcenter.paloaltonetworks.com/2015/09/novel-malware-xcodeghost-modifies- xcode-infects-apple-ios-apps-and-hits-app-store/ Password Number of users 123456 120511 12345 48452 password 39448 DEFAULT 34275 123456789 26620 qwerty 20778

slide-13
SLIDE 13

05-10-2015

Risk

  • Don’t implement your own crypto
  • Pixie Dust Attacks (flaw in three

implementations of WPS)

  • https://docs.google.com/spreadsheets/d/1tSl

bqVQ59kGn8hgmwcPTHUECQ3o9YhXR91A_p 7Nnj5Y/edit?pli=1#gid=2048815923

  • And pls. don’t hardcode passwords
  • CVE-2014-0329 :DSL routers contain

hardcoded password

slide-14
SLIDE 14

05-10-2015

Risk

  • Open source isn’t secure by default

CVE-2014-0160 CVE-2014-6271

slide-15
SLIDE 15

05-10-2015

Lessons Learned

  • Know your code AND be able to update
  • Don’t implement your own crypto
  • Open source isn’t secure by default
  • Read OWASP / SDLC AND do threat

modeling

slide-16
SLIDE 16

05-10-2015

Thank you for your attention

slide-17
SLIDE 17

05-10-2015

slide-18
SLIDE 18

05-10-2015