AppSec California 2014 an off-the-charts success

Surf, Sand, Security! Over 250 people got together at the Annenberg Community Beach House and discussed security on the shores of Santa Monica, California. An All-Star cast of speakers spent two days sharing their knowledge with conference attendees and each other in between breaks looking at the blue waters of the Pacific Ocean and volleyball players on the sands adjacent to the conference. A more perfect setting would have been hard to imagine.

https://appseccalifornia.org/

Video recordings of the 2-day event will be posted next week.

Plans are already under way for AppSec California 2015 at the same location.

OWASP Back in San Francisco during RSA

Jim Manico and Eoin Keary will be offering a free boot camp training on Monday, February 24, 2pm - 5pm, at Jillian's, across the street from the Mascone Center. "This intensive boot camp focuses on the most common web application security problems, including aspects of both the OWASP Top Ten and the MITRE Top 25. The course will introduce and demonstrate application assessment techniques, illustrating how application vulnerabilities can be exploited so students really understand how to avoid introducing such vulnerabilities in their code and understand fixes.

http://owasp.blogspot.com/2014/01/free-owasp-training-and-meet-up-in-san.html

This is great news, as OWASP had earlier pulled out of RSA and cancelled their co-marketing agreement with the RSA Conference.

Surf, Sand, Security!

Get together with your peers and discuss security on the shores of Santa Monica, California.

January 27 — 28, 2014

Come join OWASP Chapters from Los Angeles, Orange County, San Diego, Santa Barbara, and the Bay Area as we gather at the Annenberg Community Beach House to network and share information with the country's leaders in information security. 

https://appseccalifornia.org/

Quick Tips for Handling and Securing your Laptop

Treat your laptop like cash!     

 

If you had a wad of money sitting out in a public place, would you turn your back on it – even just for a minute?  Would you put it in checked luggage?  Leave it on the backseat of your car?  Keep a careful eye on your laptop just as you would a pile of cash. When outside the office, never leave it unattended.

Do not leave your laptop in your car.

Don’t allow your laptop or anything of value to be visible from outside of your car. If you have to leave a laptop in a vehicle, put it in the trunk before you depart, not when you arrive at your destination, thus avoiding anyone seeing a laptop in an unattended vehicle. Never store a laptop in the trunk over night or over the weekend.

Do not allow anyone else to use your laptop

Don’t allow your laptop or anything of value to be visible from outside of your car. If you have to leave a laptop in a vehicle, put it in the trunk before you depart, not when you arrive at your destination, thus avoiding anyone seeing a laptop in an unattended vehicle. Never store a laptop in the trunk over night or over the weekend.

Ensure that your laptop has been encrypted

All laptops should be encrypted, as they are too easy to loose or be stolen, and it is too easy to forget what you may have stored on them. Something could be confidential.

 Record identifying information and mark your equipment

Record the make, model and serial number of your laptop and keep it in a separate location. Have a luggage tag on your laptop case, labeled with your contact information.

Secure your laptop when in the office

Secure your laptop by locking it in a docking station, if available. You can also use a security cable, a locked office or locked cabinet.  Do not set the laptop on the desk and then walk away with it unsecured.

Keep it off the floor                                

No matter where you are in public – at a conference, a coffee shop, or a registration desk – avoid putting your laptop on the floor. If you must put it down, place it between your feet or at least up against your leg, so that you’re aware of it. Laptops on the floor can easily get stepped on, kicked, and stolen

Do not store your password with your laptop

 You should secure your laptop with a strong password, but don’t keep the password in the laptop case or on a piece of paper stuck to the laptop.

Be very careful while travelling with a laptop

You should secure your laptop with a strong password, but don’t keep the password in the laptop case or on a piece of paper stuck to the laptop.

Studies have shown approximately 12,000 laptops per week are lost or misplaced in US Airports!

Consider non-traditional bags for carrying your laptop

When you take your laptop on the road, carrying it in a computer case may advertise what’s inside. Consider using a suitcase, a padded briefcase or a backpack instead.

Do not store your laptop in checked luggage.

 Never store your laptop in checked luggage. Always carry it with you.

Be vigilant in hotels

If you stay in hotels, a security cable may not be enough. Try not to leave your laptop out in your room. Rather, use the safe in your room if there is one. If you’re using a security cable to lock down your laptop, consider hanging the “do not disturb” sign on your door.

Keep track of your laptop when you go through airport screening

Hold onto your laptop until the person in front of you has gone through the metal detector. Watch for your laptop to emerge from the TSA scanners.

Backup your files

 Don't forget to always ensure that the files on your laptop are copies of the originals that you  have on a server somewhere.

Very mixed day: Obama Notifies of Intent to Veto CISPA, but Gun Control Dies

The suspense is over as Obama actually stands tall again, in defense of Americans' privacy. No get out of jail free card for the corporations who want to share private data. Back to the drawing board for Congress. Can they ever get it right? We all know what is needed, but Congress is just too busy trying to manage all that lobbyist money. It's a lot to keep track of! I applaud the efforts of the ACLU in keeping the pressure on Obama; he actually used some of their language in his statements.

However, what is the deal with this lack of responsible gun control? We're not talking about taking guns away from anyone, except possibly those who are so screwed up as to fail a reasonable background check. Now, wouldn't we want this to occur? This one has the major support of the majority of Americans, but the NRA is way out of bounds here. It's almost too absurd and blatant to believe. I don't need to hear another person screaming "guns don't kill people, people do"! Some people should not have the guns that kill people.

Healthcare HITECH Privacy and Security Summit, May 21 at the Universal City Hilton

HIMSS (Healthcare Information and Management Systems Society) Southern California has partnered with ISSA-LA (Information Systems Security Association Los Angeles) to present the Healthcare HITECH Privacy and Security Summit, May 21 at the Universal City Hilton.

This event will bring together leaders in Privacy and Security within government and private industry for a day of collaboration, networking and presentations by leading Privacy and Security professionals. You will learn from experts what you need to know to comply with new HITECH rules and OCR investigations.

Keynote Speaker

Howard Schmidt

White House Cybersecurity Coordinator, Retired

Special Advisor to President Obama

“The Summit is packed with an All-Star cast of speakers, who will share their knowledge and experience to help prepare covered entities and business associates to meet the September 23, 2013 Compliance Deadline of the final omnibus rule”, according to Richard Greenberg, ISSA Fellow, Los Angeles Board member, and Information Security Officer for Los Angeles County Public Health. The U.S. Department of Health and Human Services (HHS) published  the rule, which modifies the privacy and security, breach notification, and enforcement regulations now a part of the Health Insurance Portability and Accountability Act of 1996 (HIPAA).

“You’ll hear directly from a wide variety of professionals, including  Yun-kyung (Peggy) Lee of the U.S. Department of Health and Human Services, Office of Civil Rights, who will prepare attendees in case of an OCR investigation”, continued Mr. Greenberg. “We have attorneys, CISOs, a Privacy Officer, and other experts who will engage with attendees as part of panels on BYOD and Business Associates, and during the Roundtable Luncheon.”

According to the Open Security Foundation's DataLossDB, which tracks the loss, theft, or exposure of personally identifiable information, out of the 1,520 total incidents reported last year, 327 occurred in the medical industry, making it the most widely breached industry in the United States. Healthcare has been one of China’s priorities in its 15-year science and technology development strategy for 2006 to 2020, and has resulted in a surge in campaigns against Healthcare firms.

The Summit provides an excellent opportunity to learn how your peers are handling important privacy and security issues arising from HITECH, such as data breaches, compliance, and mobile device security. The Summit provides a collaborative environment where attendees and speakers can network, share experiences, and learn from one another.

The Summit will be held on Tuesday, May 21, 2013 from 7:30 am to 6:30 pm at the Universal City Hilton.

ISSA-LA is the premier catalyst and information source in Los Angeles for improving the practice of information security. The Chapter provides educational programs for information security and IT professionals. The Chapter conducts outreach programs to businesses, financial institutions, nonprofits, governmental agencies, and consumers.  ISSA-LA is the founding Chapter of the Information Systems Security Association, an international not-for-profit association of information security professionals and practitioners.

For more information or to register for the Healthcare HITECH Privacy and Security Summit, please visit: http://www.issala.org/summit/healthcare-hitech-privacy-and-security-summit/

The agenda can be viewed here:

http://www.issala.org/wp-content/uploads/2013/04/Healthcare-Summit-Schedule-7.2.pdf

Who Should Attend

•       Privacy Professionals

•       Security Professionals

•       Risk Management Professionals

•       Clinicians

•       Hospitals and other Healthcare Providers

•       Health Plan Professionals

•       Employers and Healthcare Purchasers

•       State, Regional and Community-Based Health Information Organizations

•       Public Health Officials

•       Pharmaceutical, Biotechnology and Medical Device Manufacturers

•       Healthcare IT Consultants, Suppliers and Vendors

•       State and Federal Policy Makers

•       Health Services Researchers

•       Academics

•       Chief Executive Officers

•       Chief Operating Officers

•       Chief Technology Officers

•       Chief Financial Officers

•       Compliance Officers

•       Health Law Attorneys

•       Medical Directors

•       Physicians

•       Managed Care Professionals

•       Medical Group Managers

•       Data Managers

•       Ethics Officers

•       Health Insurance Executives

•       Consultants

•       Government Agency Employees

•       Health Administration Faculty

The Los Angeles Chapter of the Information Systems Security Association (ISSA-LA) invites you to partner with us at our Fifth Annual Information Security Summit, “The Growing Cyber Threat: Protect Your Business!”  The Summit is the premier Information Security event in Southern California. Last year we drew 500 people, and our goal for this year is 700.

 

The Summit offers information systems and information security vendors a very high-value marketing opportunity. By taking advantage of Summit and meeting sponsorships, your products and services get associated in the marketplace with ISSA-LA’s leadership; this enhances the market’s perception of you as an industry leader in the 18th largest economy in the world — Los Angeles County. 

 

We have many different sponsorship levels designed for every type of budget, including a set of premier sponsorships that include the full Summit attendee list. The top level sponsorships also bring with them an opportunity to address the full audience.

 

To register to be a Summit V Sponsor, please visit our Registration Page:

http://issa-la-securitysummit-v-sponsorship-es2002.eventbrite.com/

 

For more information about the Summit, including speakers, please visit our Summit website:

http://www.issala.org/summit/

 

For more information about sponsorship, please visit:

http://www.issala.org/summit/sponsor-program/ 

 

OR

 

Contact our Vendor Director, Richard Greenberg, at:

Vendor_Director@issa-la.org

 

We hope to see you there!

Government in bed with Communications Corporations

It is now illegal for wireless customers to purchase and unlock their cell phones! We know that George Orwell's and Aldus Huxley's visions of the future have unfortunately come to pass, but this is getting ridiculous and outrageous. http://tinyurl.com/ahpzo67

Oracle, what the hell are you doing to us with Java? Be merciful, and hire some really good analysts. This cannot continue. And, what is the deal with trying to sneak the Ask Toolbar into our Java updates? You're acting like rogue software companies. Enough is enough!

OWASP Monthly Meeting - January 23, 2013

• 7:00 PM at Symantec Corporation
• 900 Corporate Pointe , Culver City, CA

  owaspla.org
• • Top Ten Web Defenses

  We cannot “firewall” or “patch” our way to secure websites. In the past, security professionals thought firewalls, Secure Sockets Layer (SSL), patching, and privacy policies were enough. Today, however, these methods are outdated and ineffective, as attacks on prominent, well-protected websites are occurring every day. Website developers must learn to code in a secure fashion to have any chance of providing organizations with proper defenses in the current threat-scape. The session will provide specific tips and guidelines to make website code both low risk and less vulnerable.

  • Bio: Jim Manico

  Jim is the VP of Security Architecture for WhiteHat Security. Jim is also the host of the OWASP Podcast Series, is the committee chair of the OWASP Connections Committee, is the project manager of the OWASP Cheatsheet series, and is a significant contributor to several additional OWASP projects. Jim provides secure coding and developer awareness training for WhiteHat Security using his 8+ years of experience delivering developer-training courses for SANS, Aspect Security and others. He brings 16 years of database-driven Web software development and analysis experience to WhiteHat and OWASP as well. Jim works on the beautiful island of Kauai, Hawaii where he lives with his wife Tracey.

  
  

  • Sponsor: WhiteHat Security

  Founded in 2001 and headquartered in Santa Clara, California, WhiteHat Security provides end-to-end solutions for Web security. The company's cloud technology platform and leading security engineers turn verified security intelligence into actionable insights for customers. Through a combination of core products and strategic partnerships, WhiteHat Security provides complete Web security at a scale unmatched in the industry. WhiteHat Sentinel, the company's flagship product line, manages thousands of websites -- including sites in the most regulated industries as well as top ecommerce, finance and healthcare companies.

  www.whitehatsec.com

Portable Device Security

Theft of tablets, laptops, smart phones, and other portable devices is on the rise. Originally stolen for their street value, these devices are becoming more and more a target for the information they carry. As these devices become smaller and lighter, they become more vulnerable to theft.

Common high risk areas of concern continue to be:

• airport security checkpoints
• airport curbsides, ticket counters, and gates
• airplane overhead compartments
• hotel rooms, and
• inside cars.

Losing a laptop is not just the loss of money: it is a significant loss in productivity and resources, especially if the data contained on it is not backed up. Even more serious is the loss of potentially sensitive information.

Basic common sense steps can be taken to help protect these now ubiquitous targets.
• Do not check your laptop with the rest of your baggage. It may become damaged, lost, or stolen.
• Keep your laptop in sight. When going through security checkpoints, do not place your laptop on the belt until the checkpoint is clear for you to walk through. Be especially careful when using the restroom or making a phone call. It takes a thief only a moment to walk off with your belongings. On the plane, if not using the laptop, stow it under the seat in front of you, not in an overhead compartment.
• Do not rest your laptop on top of a rolling luggage carrier.
• Keep your laptop with you on a train instead of putting it in the luggage compartment near the exit, where thieves have easy access.
• Don't leave your laptop or briefcase inside a car. If you must, store it inside the trunk, out of view.
• Never leave your laptop unsecured in a hotel. Use the hotel safe or a locking cable, or hide the laptop. Do not assume that your laptop is safe just because you are staying in a reputable hotel. Consider leaving the TV on at a moderate volume and placing a "Do Not Disturb" sign on the door when leaving the room so potential thieves will think the room is occupied.
• Avoid temperature extremes. To avoid damaging your laptop and data, don't start the computer when it is extremely cold or warm. Manufacturers recommend ambient temperatures of 45-95 degrees Fahrenheit. Allow your laptop to come to room temperature before powering it on.
Protecting the Information
• Ensure current antivirus protection. Connecting from a hotel or other travel site puts you outside the protection provided by the County's firewall, so be sure your laptop's virus definitions are up-to-date before traveling. Virus definitions are normally automatically updated on PCs managed by the company, when connected to the Internet.
• Never store a password on the computer or in the computer bag. A stolen laptop with a stored password provides easy entry to a company’s network.

A Strategic Approach to Vulnerabilities at the Application Layer

Most organizations spend large amounts of time and money to protect their networks and infrastructure from attacks and threats. But, no matter how good a defense may be, it usually falls short in addressing security vulnerabilities inside the network at the application layer.

A number of research findings indicate that organizations' applications are one of the highest-risk areas and where the most damage can be done. As example, look at the amount of confidential and personal information that is stolen each year.

In sharp contrast with ISO/IEC 9126 - Software Quality Standard, all current software development methodologies (agile, waterfall, MSF, and others) hardly mention the word security. In fact, the use of these methodologies has not resulted in a measurable reduction of security related defects, which is evident by the fact that CERT tracking of security attacks continue to grow.

With exceptions, most companies' applications can be targeted, from the outside and from within, with a multitude of attack methodologies, including SQL injection, Cross Site Scripting (XSS) and Cross Site request Forgery (CSRF) vulnerabilities, which can be used to perpetrate various scams, purportedly compromising vast amounts of sensitive and personal information.

Companies need to embark on a "Security Development Lifecycle" (SDL) for all custom application development. One of the needs to support this type of methodology and fulfill this security process is an application security management solution that can test, correlate and manage application security vulnerabilities. The first component is a static scanner that is used with application development that scans source code, alerting development management and developers of security problems within that code as it's being developed. The second component is a dynamic scanner that scans newly developed applications in a staging environment, as well as applications currently in production, to detect security vulnerabilities so they can be quickly addressed by Application Development or, in the case of COTS applications, by the vendor. The third component is an application vulnerability correlation and management application that correlates information gathered by static and dynamic application scanners, network scanners, eliminates false positives and duplicates, and allows escalation of issues to the responsible team based on the vulnerability found (application development or sys admin).

A full and thoughtful approach is necessary to ensure protection of companies' most important assets, their information.

ISSA International 2011 Elections

Hi,

I'm Richard Greenberg, CISSP, and I'm running for the ISSA International Board of Directors. I'm currently the Information Security Officer for the Los Angeles County Department of Public Health. Prior to this appointment, I was the first to hold the same position for the County's Department of Health Services.

I bring over 25 years of management experience and have been a strategic and thought leader in IT and Information Security for both the private and public sectors. My Project Management, Security Operations, and Policy and Compliance experience have helped shape my broad perspective on creating and implementing Information Security Programs in organizations.

I am actively involved in the Information Security community, serving on the Boards of the Los Angeles Chapters of both ISSA and OWASP. I also have been a member of the ISSA CISO Executive Program, where I have collaborated with other Information Security Officers from around the country.

I was recently was awarded Senior Member standing in ISSA by the Fellow Selection Committee. I also served on the ISSA International Conference - Attendee Development Committee and the CISO Forum - Planning Committee.

I currently serve on the OWASP Global Conference Committee, and co-chaired the highly successful OWASP Global AppSec USA 2010 Conference. I am a member of the IANS Pacific Security Forum Steering Committee and the CISO Executive Summit Governing Body in Southern California.

I have been a published author in the ISSA Journal, and have spoken on Information Security, most recently at the OWASP Global AppSec USA 2010 Conference. Besides my CISSP, I have achieved CNA and ITIL Foundation certifications.

The GOALS that I would like to accomplish as a Director on the International Board include:
1. Bring a collaborative approach to the Board
1.1. Leverage my involvement with Global OWASP Committees to encourage engagements with other information security organizations
1.2. Engage ISSA Chapters to share their successes, strategies, and templates to help build strong chapters worldwide
2. Work with other information security organizations to bring more benefits to ISSA membership, such as discounts at InfoSec events around the globe
3. Engage the best and brightest security professionals to be a part of ISSA
4. Ensure the knowledge transfer of threats, technologies, strategies and current regulatory policies to help our members successfully implement strategies at their companies and organizations
5. Support enterprise objectives by educating members on the relationship between IT and the business, business processes and business risks.
6. Advocate for ISSA to have a lead role in helping to build partnerships between private industry and the public sector, to protect critical infrastructure and networks
7. Reach out to achieve more participation from membership
8. Help grow the Cyber Secure Community by reaching out to business leaders
9. Become a better security practitioner from my association with fellow Board members
10. Share my knowledge and experience with fellow Board members

ISSA Web Conference Series - Consumerization of the Workplace

The ISSA Web Conference Series is featuring Consumerization of the Workplace on March 29. Don't miss this free event and opportunity to earn your CPEs.
https://www2.gotomeeting.com/register/558755915

ISSA and OWASP Los Angeles Joint Dinner Meeting

Come join us March 16 at 6PM:
Taix French Country Cuisine
1911 W. Sunset Boulevard
Los Angeles, CA 90026
(213) 484-1265

Hear expert talk on Stuxnet

Net Neutrality on Hit list of new republican majority

They are putting a very weird spin on their stance; pure fiction. Back to saying a lie enough times to make it a truth...for some.

Application Documentation

Keep operational, system, user, and programmer documentation up to date. For applications developed by contractors the system, user, and programmer documentation should be required deliverables. Current system and programmer documentation are critical to implementing changes accurately and quickly. They should be stored in a secure place. Updated users manuals provide good reference for new users and can provide training support. All of this material is also invaluable during an audit.

Why can't the FCC Defend Equal Distribution of Content?

I want to be able to choose my provider for TV content based on quality, features, reliability, support, and price, not on who can deliver what programs or stations. It's called collusion, and it stinks!

OWASP AppSec USA 2010 is Coming to California!

FOR IMMEDIATE RELEASE:
Open Web Application Security Project (OWASP) announces AppSec USA 2010, the premiere web application security conference in North America

Los Angeles, California – July 9, 2010 - Open Web Application Security Project (OWASP) announces AppSec USA, which will be held from September 7 to 10 at the University of California at Irvine.

The conference consists of two days of in-depth training classes on September 7 and 8, followed by two days of plenary sessions on September 9 and 10. BOF (Birds of Feathers) sessions and panel discussions round out the conference offerings.
Jeff Williams, keynote speaker and Chairman of the OWASP Foundation notes, “Software is simultaneously getting radically more critical, complex, and interconnected. This creates a perfect storm for attackers, who are having a field day with our systems. We will never hack our way secure. Instead, we need to change the way we think about software, build software, and buy software. OWASP's audacious goal is to reach all developers everywhere and help them build rugged code - because our future depends on it”.

Williams continues, “I've attended many OWASP AppSec Conferences, and they truly bring together the leading researchers, innovators, and community leaders to focus on application security in a free and open noncommercial forum. There's a fantastic sense of community and shared purpose. We encourage anyone interested in secure code to come and find out what application security is all about. Our 501(c)(3) not-for-profit status allows us to keep prices extremely low”.

Another keynote speaker, Bill Cheswick, is a well known security researcher with AT&T Research; his very popular book Firewalls and Internet Security has influenced many security practitioners.

The third keynote speaker, David Rice, is an internationally recognized information security professional. Mr. Rice , author of the highly acclaimed book, Geekonomics, which promotes awareness of the true cost of insecure software, made significant contributions to advance the security of our nation’s critical infrastructure.

HD Moore, the final keynote speaker, is widely acclaimed for his creativity and technical skills, and brings a distinct perspective to AppSec. Mr. Moore’s best known contribution to the security community is the Metasploit Project, an open-source project which can be used to find vulnerabilities in computer systems in order to protect or exploit them.

Irvine, located in Southern California, is beautiful year-round and the UC Irvine campus offers famous architecture, a large park, art, and modern facilities in a pleasant environment. Irvine is situated in the heart of Orange County and is next door to Los Angeles, San Diego, and many other attractions.

Richard Greenberg, Co-Chair of Conference Organizing Committee, says, “If you can only get away from the office for one conference, this is it. We all are aware of the insidious exploits taking advantage of all types of application security vulnerabilities”.

Greenberg continues, “We need to learn from the experts in order to counter the attacks - to build solid and secure applications. The knowledge we pride ourselves of amassing is insufficient to meet the new evolving threats. Only by sharing our collective wisdom and experiences can we realistically expect to protect our assets”.

The conference is still soliciting sponsors of different levels.
For more information on sponsorship, or to register, please visit http://www.AppSecUSA.org or contact Kate Hartmann at kate.hartmann@owasp.org.

Know Your Neighbor

Protecting sensitive and confidential information at work is everyone's job. There are usually a vast amount of security protections in place, but there are additional safeguards we can all practice.


Something as simple as knowing who your neighbors are can go a long way towards providing these protections. If you know who should be in the neighboring office or looking at the computer on the next desk, you can help protect information by making sure that the person you observe has a right to be there. If you do not believe that the person has that right, asking the simple questions like, “Who are you?” and, “Why are you here?” can be a tremendous help.  Asking your supervisor if the person has a right to be there is another way to protect information. As supervisors and managers, you must respect and support your subordinates’ inquiries.


It is everyone’s responsibility to look out for and report any suspected Privacy or Security breach. You don’t have to be sure there is a breach, you just have to be observant. If something doesn’t look right, alert the people who have the job of being sure. This responsibility to be observant and report what doesn’t look right can protect more than just information. This is a good practice at any time.


The simple question you need to ask yourself is, “If it was my information being displayed, should this person be looking at it or taking it away? If you don’t like the answer, do the right thing and report the situation in a timely manner, before it can become a security incident. Notify your supervisor or your Help Desk if you think things are not right. It is all of our jobs!