April 30, 2010


      Rafal Los from HP Speaking at the May 19th Meeting

We are excited to announce that Rafal Los from HP will be speaking at the May 19th meeting.  He will be giving his talk from the Source Boston conference “Into the Rabbit Hole: Execution Flow-Based Web Application Testing”.  Here is the talk abstract and his bio:

Since the caveman first fashioned a spear humans have been using tools to make them more efficient and effective. Unfortunately, today’s analysts often misunderstand the role tools play in testing web applications. While tools can be quite good at mapping a web application’s attack surface there is still much human analysis that must be done to find the elusive defects that lie just below the surface. That human analysis is daunting and irregular … until now. The answer is an execution-flow-based approach to application security testing. By first understanding application logic and execution flow it is possible to completely map a web application’s attack surface, and therefore fully test the application. Along the way, we will cover the principles of data-flow analysis, application process mapping and building execution-flow diagrams (EFDs), which together form a complete picture of the web application and allow an analyst to uncover potentially critical defects.

Speaker Bio:
Senior Security Specialist and Web Application Security evangelist with Hewlett-Packard’s Application Security Center (ASC), Rafal Los has more than thirteen years of experience in network and system design, security policy and process design, risk analysis, penetration testing, and consulting. For the past eight years, he has focused on information security and risk management, leading security architecture teams, and managing successful enterprise security programs for General Electric and other Fortune 100 companies, as well as SMB enterprises. Previously, Rafal spent three years in-house with GE Consumer Finance, leading its web application security programs.

Stay tuned for the full agenda announcement in the next few days!  We hope to see you May 19th!



del.icio.us|Digg|Furl|ma.gnolia|RawSugar|reddit|Spurl|Google|StumbleUpon



April 18, 2010


      April Meeting Announcement

Our next meeting is WEDNESDAY April 21, 2010.  Pizza and networking start at 6:00 PM.  Talks start at 6:30 PM.  Location: Park Center Plaza #1, 6100 Oak Tree Blvd, off Rockside Road, Independence, Ohio.  Click here for a Google Map! Open to everyone and free as always!  Here are the list of talks and agenda items for this months meeting:

Oracle, Interrupted: Stealing Sessions and Credentials
In a world of free, ever-present encryption libraries, many penetration testers still find a lot of great stuff on the wire. Database traffic is a common favorite, and with good reason: when the data includes PAN, Track, and CVV, it makes you stop and wonder why this stuff isn’t encrypted by default. However, despite this weakness, we still need someone to issue queries before we see the data. Or maybe not… after all, it’s just plaintext.

Recapping his recent Black Hat Europe presentation with Wendel G. Henrique, Steve Ocepek will be taking a look at the world’s most popular relational database: Oracle. Through a combination of downgrade attacks and session take-over exploits, this talk introduces a unique approach to database account hijacking. Using a new tool, thicknet, Steve will demonstrate just how deadly injection attacks can be to database security.

Speaker Bio: Steve Ocepek serves as the Director of Security Research for Trustwave’s SpiderLabs division – the advanced security team focused on penetration testing, incident response, and application security. Steve has been working in the Information Security field for over ten years. As a founder of Wholepoint Corporation, he and his team created one of the first Network Access Control (NAC) systems in 2001, and has been granted four patents in this area to date. After being acquired by Mirage Networks in 2004, Steve continued his research, discovering new, effective ways to profile network devices in real-time. During this process, Steve had the opportunity to fill a number of roles, from research and development to security consulting. At Trustwave, Steve continues to innovate and is frequently referred to in cases where network technologies are concerned. Steve is a CISSP, frequently speaks at security venues, both corporate and academic. Recent venues include Black Hat USA 2009, Black Hat Europe 2010, and Northwestern University.

SIEM’s and Auto-blocking Attacks
SIEM’s are often used in the capacity for intelligence and information gathering within organizations. Often times, the large amount of information used is wasted and not utilized in an efficient manner. At my organization, the SIEM can be used in a much larger capacity when performing responses to actual threats and attacks in an automated fashion. Let’s take a plunge into ArcSight where we can actively block predefined attacks and utilize the SIEM in a responsive measure across an international company.

Speaker Bio: Josh Kelley is an Enterprise Security Analyst for a Fortune 1000 company where his primarily responsibilities are web application security, incident response, vulnerability management, and ensuring that the organization is protected against attack. Much of this is understanding the latest attack vectors and establishing a defense against a large international target.  Josh has recently been working on exploit development and vulnerability research. Josh currently holds the SANS’ GSEC and GCIH certifications and is undergoing the Offensive-Security Certified Professional certification.

Come early, at 6:00 PM, for pizza, pop, water and social networking with your peers.  We hope to see you there!



del.icio.us|Digg|Furl|ma.gnolia|RawSugar|reddit|Spurl|Google|StumbleUpon




Local Security Jobs @ our LinkedIn Group!


Support our Sponsors:


Visit our friends: