Liquid Matrix – Security Podcast

The Liquid Matrix podcasts episodes can be found on:

http://www.liquidmatrix.org/blog/category/podcasts

SWEET & SEED – Online Learning Resources

SWEET (Secure WEb dEvelopment Teaching): http://www.csis.pace.edu/~lchen/sweet/

WHAT IS SWEET?

SWEET (Secure WEb dEvelopment Teaching) is a set of portable teaching modules for secure web development. SWEET features eight teaching modules, six project modules and a virtualized web development platform that allows instructors to conduct hands-on laboratory exercises. The purpose of this project is to enhance the learning experience of computing students through standardized teaching modules and environment in secure web development. We have adopted this teaching tool to introduce web security concepts in both undergraduate and graduate courses. Each SWEET teaching module will be enough for a three-hour class containing lecture materials and hands-on laboratory exercises that are relevant to the contents in the lectures.

WHAT IS VIRTUALIZATION?

SWEET utilizes virtualization technology for laboratory exercises. The virtualization of a computer means to run emulator software, like VMware Player or Microsoft Virtual PC, on a computer (host computer or physical computer) to emulate another desired computer (virtual computer). A virtual computer is implemented by a folder of 2-8 GB files, and the emulator runs these files to emulate the virtual computer as a computer window or the complete computer desktop. To the users a virtual computer is just the same as the physical one. The virtual and host computers can have different operating systems, and share data and Internet access. The users can work on multiple virtual computers and the host computer at the same time. The users can install new applications on the virtual computer as on a physical one. A virtual computer can run most operating systems including all versions of Windows and Linux.

OBJECTIVES & GOALS

The objectives of this project are to generate a new teaching tool in secure web development for undergraduate students in computing field, to create a portable teaching laboratory in both Pace and CUNY, to evaluate the effectiveness of the teaching tool in improving students’ learning experiences, and to foster collaboration relationship among Pace, CUNY and industry partners. The goals of this project are to train a new generation of computing professionals who would understand and be able to solve security problems occurred in web development. We are expecting to attract more undergraduate students studying in computing by providing a new, interesting and innovative teaching tool in secure web development.

---

SEED: Vulnerability and Attack Labs: http://www.cis.syr.edu/~wedu/seed/all_labs.html/

Vulnerability and Attack Labs

People learn from mistakes. In security education, we study mistakes that lead to software vulnerabilities. Studying mistakes from the past not only help students understand why systems are vulnerable, why a “seemly-benign” mistake can turn into a disaster, and why many security mechanisms are needed. More importantly, it also helps students learn the common patterns of vulnerabilities, so they can avoid making similar mistakes in the future. Moreover, using vulnerabilities as case studies, students can learn the principles of secure design, secure programming, and security testing.

Design/Implementation Labs

The objective of the design/implementation labs is to provide students with opportunities to apply security principles in designing and implementing systems. They help students achieve learning by system development.

Exploration Labs

The objective of the exploration labs is two-fold: the first is to enhance students’ learning via observation, playing and exploration, so they can see what security principles “feel” like in a real system; the second objective is to provide students with opportunities to apply security principles in analyzing and evaluatingsystems. The exploration labs provide a feasible means by which the students have “a direct encounter with the phenomena being studied rather than merely thinking about the encounter, or only considering the possibility of doing something about it”.

WATOBO – the unofficial manual

WATOBO is intended to enable security professionals to perform highly efficient (semi-automated) web application security audits. I am convinced that the semi-automated approach is the best way to perform an accurate audit and to identify most of the vulnerabilities.

WATOBO has no attack capabilities and is provided for legal vulnerability audit purposes only. It works like a local proxy, similar to Webscarab, Paros or BurpSuite

Additionally, WATOBO supports passive and active checks. Passive checks are more like filter functions. They are used to collect useful information, e.g. email or IP addresses. Passive checks will be performed during normal browsing activities. No additional requests are sent to the (web) application.

Active checks instead will produce a high number of requests (depending on the check module) because they do the automatic part of vulnerability identification, e.g. during a scan.

The functions of WATOBO:

• Supports session management.
• Detects logout and automatically takes a re-login.
• Supports filter functions
• Inline-Encoder/Decoder
• Includes vulnerability scanner
• Quick-scan for targeted scanning a URL
• Full-scan to scan a whole session
• Manual request editor with special functions
• Session information is updated
• Login can be done automatically
• Transcoder
• URL, Base64, MD5, SHA-1
• Interceptor
• Fuzzer
• Free, Stable and Open source!
• Script code easy to understand
• Easy to extend / adapt
• In real-world scenarios tested and developed
• Speed / usability
• Active and Passive checks
• Runs under Windows, Linux, BackTrack, MacOS

All these great features and functions make WATOBO one of the top free web assessment tools.

The program can be downloaded from: http://sourceforge.net/projects/watobo/

UNIQPASS v15 – Large password list

Usage

UNIQPASS is a large password list for use with John the Ripper (JtR) wordlist mode to translate large number of hashes, e.g. MD5 hashes, into cleartext passwords. While we have had good success rate with our standard password list passwords.txt, we found that the list can be made more useful and relevant by including commonly used passwords from the recently leaked databases that have been made public. As a result, we have compiled millions of these unique passwords into UNIQPASS. Such list is especially handy for pentesters to perform comprehensive password audit and also for IT administrators to expose insecure passwords used by their users.

Specifications

Version 15 released on January 10, 2015 with 243,779,397 entries
1.	For use with JtR wordlist mode with –rules set
2.	All passwords are unique and listed in sorted order according to their native byte values using UNIX sort command
3.	192,916 of the passwords (UNIQPASS v1) came from English dictionary
4.	The remaining passwords were collected from leaked databases from various websites (including major sites e.g. Sony Pictures, Gawker)
5.	Max. password length is 30 characters long
6.	Password may consist of a-z, 0-9, spaces and special characters ` ~ ! @ # $ % ^ & * ( ) _ – + = { [ } ] | \ : ; ” ‘ < , > . ? /
7.	UNIX end-of-line character is used as the newline character
8.	Trailing spaces, trailing tabs and NULL bytes have been removed from all passwords
9.	List compressed size is 435.8 MB, i.e. the downloadable size
10.	The total unmangled entries, 243,779,397, is based on UNIX wc -l output

Performance

In the following test, we compare the success rate of JtR wordlist cracking mode against a list of 551,638 MD5 hashes using our standard password list passwords.txt vs. UNIQPASS v15. We use JtR 1.8.0 community-enhanced version for this test. The hashes are passwords for accounts from several leaked databases published by LulzSec back in June 2011.

$ john --format=raw-MD5 --wordlist=passwords.txt --rules hashes.txt
..
$ john --format=raw-MD5 --show hashes.txt
..
219722 password hashes cracked, 331916 left

passwords.txt cracked 40% of the hashes using JtR wordlist mode with rules enabled.

$ john --format=raw-MD5 --wordlist=uniq.txt --rules hashes.txt
..
$ john --format=raw-MD5 --show hashes.txt
..
515260 password hashes cracked, 36378 left

UNIQPASS v15 cracked 93% of the hashes using JtR wordlist mode with rules enabled.

Upon completing a dictionary attack (wordlist mode), the next step is to resume the same session with JtR incremental mode leaving it to run for a couple hours or until we achieve a desirable yield. This can done with e.g. john –format=raw-MD5 –incremental –max-run-time=3600 hashes.txt.

More information can be found on: http://dazzlepod.com/uniqpass/

SANS Cyber Defense Summit Archives and Whitepapers

Cyber Defense Summit 2014

• https://files.sans.org/summit/cyberdefense2014/
• • Zip file of all PDFs (updated 20140821)

• AntivirusIsNotDead_-_Murr_-_Distro-1.pdf
• Back to Basics – Five Steps to a Secure Future – Dr Eric Cole.pdf
• Cyber Exploits – Improving Defenses Against Penetration Attempts, Mark Burnette, LBMC.pdf
• Delivering Security from the Cloud – Turning Risk into a Weapon – John Pescatore.pdf
• Developing Cyber Threat Intelligence – deBeaupre.pdf
• Identifying Targeted Attacks – 6 Telltale Signs – Matt Hastings, Mandiant.pdf
• Incident Response – How to Fight Back – Torres.pdf
• It’s All About the Money – Peter Kuper, In-Q-Tel.pdf
• Mind the Gap – Building a Bridge from Intrusion to Detection – Bart Hopper, Volunteer Credit Union.pdf
• OODA Security – Kevin Fiscus.pdf
• Prevent Detect Respond – A Framework for Effective Cyber Defense – Dr Eric Cole.pdf
• Security Awareness Metrics – Measuring Human Behavior – Lance Spitzner, SANS.pdf
• Will the REAL Next Generation Security Please Stand Up – Pescatore, Hartig, Kallhoff, Petersen.pdf

SANS Cyber Defense Whitepapers

White Papers are an excellent source for information gathering, problem-solving and learning. Below is a list of White Papers written by cyber defense practitioners seeking GSEC, GCED, and GISP Gold. SANS attempts to ensure the accuracy of information, but papers are published “as is”.

Errors or inconsistencies may exist or may be introduced over time. If you suspect a serious error, please contact webmaster@sans.org.

Featured Papers

• Denial of Service Deterrence

Title	Author	Cert
Minimizing Damage From J.P. Morgan’s Data Breach	Allen Jeng	GSEC
The Role of Static Analysis in Heartbleed	Jeff Sass	GSEC
The Best Defenses Against Zero-day Exploits for Various-sized Organizations	David Hammarberg	GSEC
Denial of Service Deterrence	Ryan Sepe	GSEC
Case Study: Critical Controls that Could Have Prevented Target Breach	Teri Radichel	GSEC
Botnet Tracking Tools	Pierce Gibbs	GSEC
SAMHAIN: Host Based Intrusion Detection via File Integrity Monitoring	Martinus Nel	GSEC
Implementing Public Key Infrastructure (PKI) Using Microsoft Windows Server 2012 Certificate Services	Michael Naish	GSEC
Agile defensive perimiters: forming the security test regression pack	Michael Hendrik Matthee	GSEC
An Early Malware Detection, Correlation, and Incident Response System with Case Studies	Yaser Mansour	GCIA
Home Field Advantage – Using Indicators of Compromise to Hunt down the Advanced Persistent Threat	Matthew Toussain	GSEC
Implementation and use of DNS RPZ in malware and phishing defence	Alex Lomas	GSEC
Securing Static Vulnerable Devices	Chris Farrell	GSEC
HTTP header heuristics for malware detection	Tobias Lewis	GCIA
Straddling the Next Frontier Part 1: Quantum Computing Primer	Eric Jodoin	GCIA
SOHO Remote Access VPN. Easy as Pie, Raspberry Pi…	Eric Jodoin	GSEC
NetFlow Collection and Analysis Using NFCAPD, Python, and Splunk	David Mashburn	GCIA
Using Watermarks to Prevent Leaks	Allison Nixon	GCIA
Analyzing Network Traffic with Basic Linux Tools	Travis Green	GCIA
The Spy with a License to Kill	Matthew Hosburgh	GSEC
Leveraging the SCADA Cloud for Fun and Profit	Matthew Hosburgh	GCIA
Implementing Active Defense Systems on Private Networks	Josh Johnson	GCIA
Finding Evil in the Whitelist	Josh Johnson	GSEC
Password Security– Thirty-Five Years Later	George Khalil	GSEC
Open Source IDS High Performance Shootout	George Khalil	GCIA
Systems Engineering: Required for Cost-Effective Development of Secure Products	Dan Lyon	GSEC
Predicting Control Attributes With Bayesian Networks	Dan Lyon	GCIA
Predicting Control Attributes With Bayesian Networks	Dan Lyon	GCIA
Rootkit Detection with OSSEC	Sally Vandeven	GCIA
SSL/TLS: What’s under the Hood	Sally Vandeven	GSEC
Web Application Attack Analysis Using Bro IDS	Ganesh Kumar Varadarajan	GCIA
Analyzing Polycom Video Conference Traffic	Chris Cain	GCIA
Controlling Vendor Access for Small Businesses	Chris Cain	GSEC
Intrusion Analysis Using Windows PowerShell	Mike Weeks	GCIA
Application White-listing with Bit9 Parity	Mike Weeks	GSEC
A No-Budget Approach to Malware Containment	Paul Ackerman	GSEC
Using the Department of Defense Architecture Framework to Develop Security Requirements	James Richards	GSEC
A Complete Guide on IPv6 Attack and Defense	Atik Pilihanto	GSEC
Discovering Security Events of Interest Using Splunk	Carrie Roberts	GSEC
A Hands-on XML External Entity Vulnerability Training Module	Carrie Roberts	GCIA
Cloud Computing – Maze in the Haze	Godha Iyengar	GSEC
Inside Mac Security	Ben Knowles	GSEC
Security Implications of iOS	Kiel Wadner	GSEC
60 Seconds on the Wire: A Look at Malicious Traffic	Kiel Wadner	GCIA
Faster than a speeding bullet: Geolocation data and account misuse	Tim Collyer	GCIA
Airwatch MDM and Android: a policy and technical review	Tim Collyer	GSEC
Skype and Data Exfiltration	Kenneth Hartman	GSEC
What Every Tech Startup Should Know About Security, Privacy, and Compliance	Kenneth Hartman	GCCC
Using Decision Tree Analysis for Intrusion Detection: A How-To Guide	Jeff Markey	GCIA
Custom Full Packet Capture System	Derek Banks	GSEC
Reducing Organizational Risk Through Virtual Patching	Joseph Faust	GSEC
Validating Security Configurations and Detecting Backdoors in New Network Devices	Christoph Eckstein	GSEC
OS fingerprinting with IPv6	Christoph Eckstein	GCIA
Endpoint Security Through Application Streaming	Adam Walter	GISP
Phishing Detection and Remediation	Rich Graves	GSEC
Using SSL to Secure LDAP Traffic to Microsoft Domain Controllers	Andrew Reid	GSEC
Log2Pcap	Joaquin Moreno	GCIA
Security Analytics: having fun with Splunk and a packet capture file pcap	Alexandre Teixeira	GCIA
Point of Sale (POS) Systems and Security	Wesley Whitteker	GSEC
Creating a Bastioned Centralized Audit Server with GroundWork Open Source Log Monitoring for Event Signatures	Christopher Duffy	GSEC
Beating the IPS	Michael Dyrmose	GCIA
Covert Channels	Erik Couture	GCIA
USB – Ubiquitous Security Backdoor	Erik Couture	GSEC
Implementing a PC Hardware Configuration (BIOS) Baseline	David Fletcher	GSEC
Comparative Risk Analysis Between GPON Optical LAN and Traditional LAN Technologies	Jason Young	GSEC
Beyond the cookie: Using network traffic characteristics to enhance confidence in user identity	Courtney Imbert	GCIA
Daisy Chain Authentication	Courtney Imbert	GSEC
Data Charging Bypass: How your IDS can help	Hassan Mourad	GCIA
Sleeping Your Way out of the Sandbox	Hassan Mourad	GSEC
Security Best Practices for IT Project Managers	Michelle Pruitt	GSEC
Security Best Practices for IT Project Managers	Michelle Pruitt	GSEC
An Analysis of the Snort Data Acquisition Modules	Christopher Murphy	GCIA
Mitigating Insider Sabotage	Joseph Garcia	GSEC
Building an Application Vulnerability Management Program	Jason Pubal	GSEC
Web Application Firewalls	Jason Pubal	GCIA
Snort 3.0 Beta 3 for Analysts	Doug Burks	GCIA
Testing Application Identification Features of Firewalls	William McGlasson	GCIA
Check Point Firewall Log Analysis In-Depth	Mark Stingley	GCIA
Using and Configuring Security Onion to detect and prevent Web Application Attacks	Ashley Deuble	GCIA
Enhancing Intrusion Analysis through Data Visualization	Wylie Shanks	GCIA
Building and Managing a PKI Solution for Small and Medium Size Business	Wylie Shanks	GSEC
The Security Onion Cloud Client Network Security Monitoring for the Cloud	Joshua Brower	GCIA
Securely Integrating iOS Devices into the Business Environment	Joshua Brower	GSEC
A Practical Big Data Kill Chain Framework	Brian Nafziger	GSEC
What’s Running on Your Network?	Francois Begin	GCIA
BYOB: Build Your Own Botnet	Francois Begin	GSEC
Remotely Accessing Sensitive Resources	Jason Ragland	GSEC
An Open Source Layer 2 Switch	Jim Wilson	GSEC
Online Backup: Worth the Risk?	Stephen Strom	GSEC
An Introduction To Securing a Cloud Environment	Todd Steiner	GSEC
Check Point firewalls – rulebase cleanup and performance tuning	Barry Anderson	GSEC
Social Engineering: Manipulating the Source	Jared Kee	GCIA
Logging and Monitoring to Detect Network Intrusions and Compliance Violations in the Environment	Sunil Gupta	GCIA
Profiling Hackers	Larisa Long	GSEC
Spoofing: An Overview of Some Current Spoofing Threats	Neil Riser	GSEC
Using Web Application Firewall to detect and block common web application attacks	Issac Kim	GCIA
Vulnerabilities In TCP And UDP Ports	Robert Davis	GSEC
The Importance of Security Awareness Training	Cindy Brodie	GSEC
Defense in Depth: An Impractical Strategy for a Cyber World	Prescott Small	GSEC
An Analysis of Gameover Zeus Network Traffic	Daryl Ashley	GCIA
Setting up Splunk for Event Correlation in Your Home Lab	Aron Warren	GCIA
Diskless Cluster Computing: Security Benefit of oneSIS and Git	Aron Warren	GSEC
Catching Phishers with Honey-Mail	Dennis Dragos	GSEC
Smart IDS — Hybrid LaBrea Tarpit	Cristian Ruvalcaba	GCIA
Incident Handler’s Handbook	Patrick Kral	GSEC
Business Continuity On A Stick	Patrick Kral	GSEC
Implementing IEEE 802.1x for Wired Networks	Johan Loos	GCWN
Protect Critical Infrastructure Systems With Whitelisting	Dwight Anderson	GSEC
Implementing a Vulnerability Management Process	Tom Palmaers	GSEC
VoIP Security Vulnerabilities	David Persky	GCIA
Documentation is to Incident Response as an Air Tank is to Scuba Diving	Chet Langin	GSEC
Designing and Implementing a Honeypot for a SCADA Network	Charles Scott	GCIA
Auditing and Securing Multifunction Devices	Charles Scott	GSEC
Wireshark: A Guide to Color My Packets	Roy Cheok	GCIA
Host-Based Detection and Data Loss Prevention Using Open Source Tools	Chris Hoke	GCIA
Detecting and Preventing Rogue Devices on the Network	Ibrahim Halil Saruhan	GCIA
Open Source Host Based Intrusion Detections System (OHIDS)	Tom Webb	GCIA
An Architecture for Implementing Enterprise Multifactor Authentication with Open Source Tools	Tom Webb	GSEC
VPNScan: Extending the Audit and Compliance Perimeter	Robert Vandenbrink	GSEC
IOSMap: TCP and UDP Port Scanning on Cisco IOS Platforms	Robert Vandenbrink	GCIA
Defense in Depth: Employing a Layered Approach for Protecting Federal Government Information Systems	Stacy Jordan	GSEC
Building Servers as Appliances for Improved Security	Algis Kibirkstis	GSEC
The Afterglow effect and Peer 2 Peer networks	Jerome Radcliffe	GCIA
Log Management SIMetry: A Step by Step Guide to Selecting the Correct Solution	Jim Beechey	GSEC
SIEM Based Intrusion Detection with Q1Labs Qradar	Jim Beechey	GCIA
A Practical Social Media Incident Runbook	Trenton Bond	GSEC
Visualizing Firewall Log Data to Detect Security	Trenton Bond	GCIA
Protecting Laptop Computers	Greg Hill	GSEC
Laptop Security: Windows® Vista vs. XP	Greg Hill	GSEC
Transparent (Layer 2) Firewalls: A look at 2 Vendor Offerings: Juniper and Cisco	Matt Austin	GPPA
Using rsync to centralize backups in small to medium-sized networks	Jeff Lake	GSEC
Applying Information Security and Privacy Principles to Governance, Risk Management & Compliance	Scott Giordano	GSEC
Intrusion Detection & Response Leveraging Next Generation Firewall Technology	Ahmed Abdel-Aziz	GCIA
Windows 2000 Monitoring from Windows NT in a Workgroup	Frank Vianzon	GCWN
Visual Baselines – Maximizing Economies of Scale Using Round Robin Databases	Kirsten Hook	GCIA
Preparing to face new vulnerabilities	Jacelyn Faucher	GSEC
A Practical Application of Background Investigations for Small Company Security Perimeters	Timothy Cook	GSEC
Successful SIEM and Log Management Strategies for Audit and Compliance	David Swift	GCIA
Monitoring Network Traffic for Android Devices	Angel Alonso-Parrizas	GCIA
Firewall Analysis and Operation Methods	Kim Cary	GPPA
Detecting DNS Tunneling	Greg Farnham	GCIA
Malware Analysis: An Introduction	Dennis Distler	GSEC
Performing Egress Filtering	Dennis Distler	GPPA
Wireless Attacks from an Intrusion Detection Perspective	Gary Deckerd	GCIA
A Virtually Secure Browser	Seth Misenar	GSEC
Corporate Identity Fraud: Life-Cycle Management of Corporate Identity Assets	Bryan Fite	GSEC
Simulating Cyber Operations: A Cyber Security Training Framework	Bryan Fite	GSEC
Integrating Wired and Wireless IDS Data	Michael Stanton	GCIA
Passive Application Mapping	Benjamin Small	GCIA
Corporate vs. Product Security	Philip Watson	GSEC
The User Agent Field: Analyzing and Detecting the Abnormal or Malicious in your Organization	Darren Manners	GCIA
A Framework to Collect Security Events for Intrusion Analysis	Jim Chrisos	GCIA
Trends in Bot Net Command and Control	Will Longman	GSEC
Risks and Rewards of Instant Messaging in the Banking Sector	Nicholas Rose	GSEC
Requirements For Record Keeping and Document Destruction in a Digital World	Craig Wright	GSEC
A comparative study of attacks against Corporate IIS and Apache Web Servers	Craig Wright	GPPA
CURRENT ISSUES IN DNS	Craig Wright	GCIA
Implementing a Secure Wireless Network for a Windows Environment	Dan Thompson	GCWN
A Small Business No Budget Implementation of the SANS 20 Security Controls	Russell Eubanks	GCIA
Application Firewalls: Don’t Forget About Layer 7	Russell Eubanks	GSEC
Something Phishy: How to Avoid Being Caught in the Net of Specialized Spam	Karen Friend	GSEC
GIAC GCFW Assignment – Pass	Arthur Lee	GPPA
Visa’s 3-D Secure™:Secure Online Payment Authentication	Dominique Singer	GSEC
Securing the GPRS Network Infrastructure – a Network Operator&#039s Perspective	Jonathan Sau	GSEC
How to Avoid Inofrmation Disclosure when Managing Windows with WMI	Alex Timkov	GSEC
An Introduction to Metasploit Project for the Penetration Tester	Brandon Greenwood	GSEC
Tuning an IDS/IPS From The Ground UP	Brandon Greenwood	GCIA
Network Security: Layering a 3R Solution @ the Perimeter	Larry Copeland	GSEC
Securing Windows Service Accounts	Gerald Rice	GSEC
Security for Critical Infrastructure SCADA Systems	Andrew Hildick-Smith	GSEC
Apache modules for rapid mitigation of security threats	Stephanie Sullivan	GSEC
Deploying Nagios Monitoring Services on Secured Red Hat Enterprise Linux 3 Environment	Alexey Rogozhkin	GCUX
Phishing for Banks: A Timely Analysis on Identity Theft & Fraud in the Financial Sector	Tony UcedaVelez	GSEC
Securing a virtual fortune cookie saying business in the wired and wireless world	Klaus Wagner	GPPA
How to Configuring Local Logging on Solaris 8 and Use Symantec Intruder Alert for Centralized Logging	Nolan Haisler	GSEC
An Overview of the Wireless Intrusion Detection System	Oliver Poblete	GSEC
Cyberstalking: A Modern Dilemma	Shelli Richard	GSEC
GIAC GCIA Assignment – Pass	Chris Sia	GCIA
Pass – English Version	Marco Brando	GCIA
GIAC GCIA Assignment – Pass	Jax Gough	GCIA
GIAC GCFW Assignment – Pass	Mike Jensen	GPPA
GIAC GCIA Assignment – Pass	Kenneth Foster	GCIA
A Guide to Discovering Web Application Insecurities, Before Attackers Do	Don Williams	GSEC
Measuring effectiveness in Information Security Controls	Manuel Humberto Santander Pelaez	GSEC
GIAC GCIA Assignment – Pass	Manuel Humberto Santander Pelaez	GCIA
Case Study: The Get Connected CD	David Greenberg	GSEC
Secure remote access using a Juniper SSL VPN	Graham Belton	GSEC
GIAC GCIA Assignment – Pass	Adam Kliarsky	GCIA
GIAC GCIA Assignment – Pass	Kevin Holestine	GCIA
Hardening Oracle in a Linux (Unix) Environment	Robert Persick	GSEC
EnterpriseOne Security Solution for Real Estate Management	Ruben A. Amely-Velez	GSEC
GIAC GCFW Assignment – Pass	Robert McKinney	GPPA
Indelicate Balance: The Challenge of Content Filtering Systems in a Litigious Society	Grant Streeter	GSEC
GIAC GCIA Assignment – Pass	Steven Wimmer	GCIA
Incident Management 101: Preparation & Initial Response (aka Identification)	Robin Dickerson	GSEC
Taking control of your Internet email using Sendmail and Mimedefang.	Matthew Schumacher	GSEC
Risk Assessment of Social Media	Robert Shullich	GSEC
Minimizing the effects of infected PCs on a Network	Sean Sheil	GSEC
Voice Over Internet Protocol (VoIP) and Security	Greg Tucker	GSEC
GIAC GCIA Assignment – Pass	Andrew Magnusson	GCIA
An Overview of 802.11 Wireless Network Security Standards & Mechanisms	Luis Carlos Wong Or	GSEC
Information Systems Security Architecture: A Novel Approach to Layered Protection	George Farah	GSEC
Identity Theft:What you need to know	Krzysztof Biernacki	GSEC
A primer for PC secured configuration compliance monitoring solution	Efi Kaufman	GSEC
But I have a firewall, my network’s secure!	Derran Guinan	GSEC
Understanding Oracle Auditing	Wayne Reeser	GSEC
IT Security Awareness Best Practices	James Neidich	GSEC
Case Study: Secure Application Deployment Utilizing Terminal Server and VPN Clients	Greg Croteau	GSEC
GIAC GCIA Assignment – Pass	Alexander Schinner	GCIA
.Securing the Cisco Aironet 1200 Access Point.	Jeffrey Turner	GSEC
GIAC GCFW Assignment – Pass	Craig Howell	GPPA
Thumb Drive Threats and Countermeasures in a Mircosoft Windows Environment	Mark Baggett	GSEC
IP Fragment Reassembly with Scapy	Mark Baggett	GCIA
Configuring a Cisco PIX to use TACACS+ for authentication of a remote user VPN	Charles Brodsky	GSEC
Track 3 – Intrusion Detection In-Depth GIAC Certified Intrusion Analyst (GCIA) Practical Assignment Version 4.0	Jan Stodola	GCIA
Securing Wireless Networks	Brett Thorne	GSEC
Creating A Secure Linux Logging System	Nathaniel Hall	GSEC
GIAC GCFW Assignment – Pass	John Swartzendruber	GPPA
Building a Secure Solaris 9 JumpStart Server	Bayly Eley	GCUX
Setting up a Secure Mail Server with HP-UX 11i v1, Qmail and Qpopper	Patrick Wallek	GCUX
Secure Data. Is there Such a Thing?	Sheetal Sood	GSEC
Steganography in the Corporate Environment	Joann Kennedy	GSEC
Assessment of the Blackberry Enterprise Solution	Robin Killeen	GSEC
3DES and Secure PIN-based Electronic Transaction Processing	Michael Buegler	GSEC
Information Operations: An Orchestra of Protection	John Petropoulos	GSEC
Implementing a Secure WebDAV System	Richard Ross	GSEC
Evil Through the Lens of Web Logs	Russ McRee	GCIA
SMaK	Russ McRee	GSEC
Voice over Internet Protocol: A Discussion on How to Securely Implement on an Existing Data Network	Kevin Larson	GSEC
Look who.s listenin	Richard Sillito	GSEC
PHYSICALLY SECURITY CONSIDERATIONS FOR HIGHLY DISTRIBUTED AUTOMATION NETWORKS	Rob McComber	GSEC
Utilizing Static Packet Filters to Enhance Network Security	Scott Foster	GSEC
Meeting the challenges of automated patch management	John Walther	GSEC
CARP: The Free Fail-over Protocol	Pieter Danhieux	GSEC
Using the FEMA Incident Command System to manage Computer Security Incidents	Chuck Morris	GSEC
Did You Get My Email?	Ray Ellington	GSEC
GIAC GCIA Assignment – Pass	Josh Berry	GCIA
Monitoring the vital signs of a network with Multi Router Traffic Grapher (MRTG)	Peter Chow	GSEC
Surfing the Web Anonymously – The Good and Evil of the Anonymizer	Peter Chow	GSEC
Information Security.s Unlikely Advocae	Matt Sorensen	GSEC
Maintaining a secure network	Robert Droppleman	GSEC
Vulnerability Assessment	Homyar Naterwala	GSEC
Building an Enterprise Ready, Client based VPN Solution.	Kurt Anderson	GSEC
Challenges Associated with Windows 2000Group Policy Object (GPO) Management	Henry Kiiskinen	GSEC
Building a Secure Sun JumpStart Environment Using the Solaris Security Toolkit, Step-by-Step	Mahrlon Willis	GCUX
Automation of Secure Debian/GNU Linux Installations withFully Automatic Installation	Mathew Chrystal	GSEC
Are SSL VPNs Ready for the Mainstream?	Michael Jackson	GSEC
GIAC GCIA Assignment – Pass	Blaine Hein	GCIA
Case for an Intrusion Detection System on the RFInterface of GPRS/EDGE	Vanessa Pegueros	GSEC
An Introduction to the Computer Security Incident Response	Tom Campbell	GSEC
Preparation@Incident Response.security	Dan Widger	GSEC
Web SSL Authentication Using Client X.509 Digital Certificates	Artem Kazantsev	GSEC
A Case Study: Removing Server Based Trust Relationships	Keith Gaughan	GSEC
Detecting Spam with Genetic Regular Expressions	Eric Conrad	GCIA
A Non-technical Perspective: Authentication – AKA: The Idiot’s Guide to Passwords	Matt Galin	GSEC
GIAC GCFW Assignment – Pass	Dan Lazarakis	GPPA
The “Great Firewall” of China: A Real National Strategy to Secure Cyberspace?	Carolyn Pearson	GSEC
Managing Sophos Anti-Virus on a College Network	Steven Blanc	GSEC
iPad Security Settings And Risk Review For iOS 4.X	Jim Horwath	GSEC
Setting Up a Database Security Logging and Monitoring Program	Jim Horwath	GCIA
Building a Cost Effective Enterprise-Wide Monitoring Solution Using Big Brother	Jim Horwath	GCUX
Wireless Security: The Draft IEEE 802.11i Standard	Greg Nowicki	GSEC
GIAC GCIA Assignment – Pass	Ben Allen	GCIA
Active Directory, Group Policy And Auditingsystem Design For Merged Windows 2000 Multiforest Environment	Tomislav Herceg	GCWN
GIAC GCIA Assignment – Pass	Bobby Noell	GCIA
Meeting FISMA Requirements for Systems Constructing a System Security Plan	Daniel Nagy	GSEC
Practical demonstration of 802.11 wireless network system risk for non-technical business managers	Marie Fromm	GSEC
How to Effectively Launch and Maintain Security Policies	Vincent Fitzpatrick	GSEC
GIAC GCIA Assignment – Pass	Hitendra Patel	GCIA
Design and Deployment of a Rapid Response Security Vulnerability Scanning Infrastructure	Eliot Lim	GSEC
Novell NetWare 6 Security Baseline Configuration	John Saley	GSEC
GIAC GCIA Assignment – Pass	Scott Renna	GCIA
Network Security- A Guide for Small and Mid-sized Businesses	Jim Hietala	GSEC
Securing the Employees in a HIPAA-Regulated Environment	Brian LaPointe	GSEC
Securely Operating Windows Terminal Services/Remote Desktop Multiplatform Environment	Keith Lawson	GSEC
Using a Custom LiveCD and Firewall Builder to Provide Enterprise Level Security on a Budget	Jim Gadrow	GSEC
Netfilter and IPTables – A Structural Examination	Alan Jones	GSEC
Case Study – Assessing the Impact of Unsolicited Commercial E-mail in a Large Corporation	Joseph Mccomb	GSEC
CA-ACF2 User Account Cleanup	Scott Meyer	GSEC
The Art of Web Filtering	Robert Alvey	GSEC
GIAC GCFW Assignment – Pass	John Holbrook	GPPA
Step by Step Installation of a Secure Linux Web, DNS and Mail Server	John Holbrook	GSEC
GIAC GCFW Assignment – Pass	Tom Jozwiak	GPPA
Buffer Overflows and Application Security	Craig Sheppard	GSEC
Information Security Gets a Seat at the Table	Kent Nabors	GSEC
Security Best Practice – Novell NetWare 6.5 Remote Management Utilities	Adam Schieman	GSEC
California’sNotice of Security Breach’s What’s it all About and What it Means to You	Vicki Harris	GSEC
A Policy to Prevent Outsider Attacks on the Local Network	Clarissa Evans Brown	GSEC
Securing a NetWare 6.5 Installation and Server Environment	Robert Clarke	GSEC
Basic Lindows Security	Andrew Bernoth	GSEC
GIAC GCIA Assignment – Pass	Vance Victorino	GCIA
Base64 Can Get You Pwned	Kevin Fiscus	GCIA
A Survey of IT Offshoring	Kelly Gieg	GSEC
Department of Defense Public Key Infrastructure	Sandra Felton	GSEC
Audit Of The GIAC Enterprises Production Web And Database Servers	Richard Allen Stone	GCUX
Security Analysis Of GIAC Enterprises FTP Gateway	Ivar Aarsnes	GCUX
Securing Sensitive Data in a Research Environment: A Case Study	Tim Van Acker	GSEC
Row Level Security in Oracle Databases with Virtual Private Database and Label Security	Steve Enevold	GSEC
Wireless Security Dispelling Myths	Eric Smith	GSEC
GIAC GCIA Assignment – Pass	David Lewis	GCIA
Detachable Data Compartmentalization: Layered Defense for Laptop Data Using USB Keychain Hard Drives as Detachable Data Compartmentalization Modules	John Pritchard	GSEC
GIAC GCFW Assignment – Pass	Tim Lewis	GPPA
Case Study in Implementing AAA Servers Using TACACS+	Steve Ingram	GSEC
Disaster Recovery in Healthcare Organizations: The Impact of HIPAA Security	James Murphy	GSEC
How do you like your Internal Security? Hard-Boiled or Scrambled? A Case Study of Hardening Interior Security	Jennifer Gruener	GSEC
Case Study: Improving Security in Corporate (SMTP) E-Mail Delivery	Brian Sommers	GSEC
Network Security Blueprint	Steve Clancy	GSEC
Passed	Maxwell Chi	GSEC
Security Policy and Social Media Use	Maxwell Chi	GSEC
Cyberspace: America’s New Battleground	Maxwell Chi	GSEC
Skimming and Its Side Effects	Nobie Cleaver	GSEC
Highly Available PCs First Step in Business Continuity for Executives	Joseph Fraher	GSEC
Distributed Vulnerability Assessment with Nessus	Faiz Ahmad Shuja	GSEC
GIAC GCIA Assignment – Pass	Bent Mathiesen	GCIA
GIAC GCIA Assignment – Pass	Eric Evans	GCIA
GIAC GCFW Assignment – Pass	Chris Reining	GPPA
GIAC GCIA Assignment – Pass	Chris Reining	GCIA
GIAC GCIA Assignment – Pass	Geoffrey Sanders	GCIA
When Business Need Justifies Leaving RPC Services Enabled	Bertha Marasky	GCUX
A practical guide to OpenSSH	Olivier De Lampugnani	GSEC
Implementing a Windows 2003 PKI from an Existing Windows 2000 Network	Norman Christopher-Knight	GCWN
Managing Security with Group Policy and the Windows Server 2003 Group Policy Management Console	Norman Christopher-Knight	GSEC
Implementing and Configuring IPv6 in Windows 2003 and XP SP1	Keith H Irby	GSEC
Authentication – The simple things in life cannot be forgotten	Simon Clarke	GSEC
GIAC GCFW Assignment – Pass	Richard Park	GPPA
Securing A Wireless LAN: A Case Study	Richard Park	GSEC
Instant Messaging technology for the business market. Do the advantages outweigh the risks?	Phuong Nguyen	GSEC
Security Concerns in Using Open Source Software for Enterprise Requirements	SreenivasaRao Vadalasetty	GSEC
Consumer Oriented Security Information: Common threats on the Internet and how to avoid them	Dave Cadrette	GSEC
Rapid Tactical Reconnaissance Techniques for Extremely Large-Scale, Dynamic Enterprise Networks	Jonathan Ham	GSEC
Secure Server Policies and Procedures for Novell NetWare Compliance	Dale Daugherty	GSEC
Auditor’s Report – GIAC University – Solaris MTA Security Audit	Susan Hanna	GCUX
Linux Kernel Hardening	Taylor Merry	GSEC
Securing the Network in a K-12 Public School Environment	Russ Penner	GSEC
Smartcards: One stop shop? Deploying smartcards	Tyler Tobin	GSEC
GIAC GCFW Assignment – Pass	Miles Parkin	GPPA
Evading Network Security Devices Utilizing Secure Shell	Wesley Brown	GSEC
GIAC GCFW Assignment – Pass	Mike Mahurin	GPPA
Novell Small Business Suite Security Recommendations	Scott Stone	GSEC
Information Assurance Ramifications of Using OpenSSL in the Department of Defense Computing Environment	Joel Kirch	GSEC
Daily Processes for Maintaining a Secure Windows Environment	Larry Arant	GSEC
Wanted Dead or Alive: Snort Intrusion Detection System	Mark Eanes	GSEC
Role-Based Access Control: The NIST Solution	Hazen Weber	GSEC
Case Study: Implementing a Secure Wireless Network using WPA	Randy Hensel	GSEC
GIAC GCFW Assignment – Pass	Eu Jin Justin Ng	GPPA
GIAC GCIA Assignment – Pass	Johnny Wong	GCIA
Slamming the door on the Slammer worm	Matthew Boykin	GSEC
Architecting, Designing and Building a Secure Information Technology Infrastructure, a case study	John Johnston	GSEC
The Third Element (The rise of the NEO hacker)	Jayson Street	GSEC
Viral Polymorphism	Stephen Pearce	GSEC
GIAC GCFW Assignment – Pass	Roberto Obialero	GPPA
GIAC GCFW Assignment – Pass	Bee Seah Li	GPPA
Configuring Watchguard Proxies: A Guideline to Supplementing Virus Protection and Policy Enforcement	Alan Mercer	GSEC
Obstacles to – And Workarounds For – Deploying Secure Systems	Craig Cox	GSEC
An Introduction to SELinux for Administrators	Jeff Pike	GCUX
Auditing-In-Depth For Solaris	Jeff Pike	GSEC
GIAC GCIA Assignment – Pass	Joe Bowling	GCIA
Linux kernel rootkits: protecting the systems Ring-Zero	Raul Siles	GCUX
Security Elements of IIS 6.0	Anthony DeVoto	GSEC
GIAC GCIA Assignment – Pass	Joanne Schell	GCIA
GIAC GCFW Assignment – Pass	Robert Winding	GPPA
Information Security Managing Risk with Defense in Depth	Ken Straub	GSEC
Wireless Security: Past, Present and Future	Keith Morris	GSEC
Brush up on Bluetooth	Jeffrey Hall	GSEC
Examining the RPC DCOM Vulnerability: Developing a Vulnerability-Exploit Cycle	Kevin O’Shea	GSEC
GIAC GCIA Assignment – Pass	David Perez	GCIA
Encrypting Mail in a Windows Network	David Perez	GCWN
Deploying Honeypots and the Security Architecture of a Fictitious Company	David Perez	GPPA
Logging and Reporting : A view from the top	Rick Hislop	GSEC
Building a Secure Backup Server for theSolaris 9 Operating Environment	Shaun McAdams	GCUX
SSH (Secure Shell) Authentication Methods and Security Control	Robert Decker III	GSEC
A Comparison of 3rd Party Anti-Spyware Tools for a Business Environment	Richard Snow	GCWN
Case Study: Spam Blocking, Content Filtering, Virus Scanning and Attachment Blocking in a Novell GroupWise Environment With Guinevere, SpamAssassin and Symantec (Norton) Anti-Virus Corporate Edition	Doug Hitchen	GSEC
Data-Centric Quantitative Computer Security Risk Assessment	Brett Berger	GSEC
Enhancing E-mail Security using Exchange Server 2003 and Outlook 2003	Cheryl Jones	GCWN
Securing Wireless Clients using IPsec via Linux Gateway	Robert King	GSEC
GIAC GCFW Assignment – Pass	Rupert Currey	GPPA
Network- and Host-Based Vulnerability Assessments: An Introduction to a Cost Effective and Easy to Use Strategy.	Ragi Guirguis	GSEC
Keeping Red Hat Linux Systems Secure with up2date	John Mravunac	GSEC
Common issues in PKI implementations – climbing the “Slope of Enlightenment”	Angela Keith	GSEC
Limiting Exposure to Denial of Service Attacks	Heather Burritt	GSEC
GroupWise 6.5 Security	Joyce Noeltner	GSEC
Getting Started: The Impacts of Privacy and Security Under HIPAA – A Case Study	Barbara Filkins	GSEC
Hard Earned Lessons In Implementing Computer Security Incident Response	Jason Chee	GSEC
GIAC GCIA Assignment – Pass	John Petkovsek	GCIA
Implementing Least Privilege at your Enterprise	Jeff Langford	GSEC
Methods for Securing a Multi-Platform Environment	David Lyon	GSEC
Securing Blackboard Learn on Linux	David Lyon	GCUX
Trapping A Monster: An Observation of Honeypots	Enoch Gamble I	GSEC
Securing the Gold through Better Network Design: A Case Study	Todd Sheppard	GSEC
A Best Practices Guide To Secure a Windows(R) XP Professional Installation	Zacharias Groves	GSEC
Branch Office connectivity: Private Frame to VPN’s, makes dollars and sense.	David Boyden	GSEC
Discovery, Eradication and Analysis of an attack on an open system: Welcome to the Jungle	Steve Terrell	GSEC
Secure File Transfer with SSH2	Renato Lozano	GSEC
Lessons in Learning Network Security	Coleen Regalmuto	GSEC
Securing Windows 2000 with Security Templates	Patricia Shirer	GCWN
Why The Need for Internet Content Filtering/Management- A Close Look at Internet Manager Elron Web Inspector 6.03	Michell Singleton	GSEC
GIAC GCFW Assignment – Pass	Timothy Miller	GPPA
Deploying a website built using Oracle9iAS Portal	Stephen Coates	GSEC
GIAC GSEC Assignment – Pass	Colleen Bolan	GSEC
The Need for an Established Security Awareness Training Program	Richard Lewis	GSEC
GIAC GCFW Assignment – Pass	Richard Lewis	GPPA
Enhancing risk management within a research laboratory, from behind an academic institution’s firewall – a case study	Paul Buzzell	GSEC
Long Distance Failover – High Availability using Cisco PIX Firewall	Chris Ellem	GSEC
Case Study in Developing Fault Tolerant and Highly Available Systems with Secure Zones of Protection	Kevin Knox	GSEC
GIAC GCIA Assignment – Pass	Kevin Knox	GCIA
GIAC GCIA Assignment – Pass	Terry MacDonald	GCIA
A New Evolution in Hack Attacks: A General Overview of Types, Methods, Tools, and Prevention	Kelley Ealy	GSEC
Implementing a Security Program from the Beginning, for the Beginner	Thomas Paulger	GSEC
Slippery Slope or Terra Firma? Current and Future Anti-Spam Measures	Charlene LeBlanc	GSEC
Steganography	Michael Meister	GSEC
Case Study: Transforming a Traditional Windows Client/Server Application Into a Secured ASP Offering	David Strubbe	GSEC
Building a Secured OS for a Root Certificate Authority	Don Murdoch	GCUX
SANS and GIAC Together Again	Don Murdoch	GCWN
GIAC GCIA Assignment – Pass	Don Murdoch	GCIA
Putting Eyes on the Wire	Don Murdoch	GSEC
SANS/GIAC Enterprises Active Directory Merger – Design, Security Policy, and Auditing Practices	Ben Schmitt	GCWN
Building a Secure OpenBSD Mail System on a Small Budget	Jesse Trucks	GCUX
GIAC GCIA Assignment – Pass	Bill Young	GCIA
Design a Secure Windows 2000 Infrastructure	Jack Kohn	GCWN
GIAC GCFW Assignment – Pass	Amit Sood	GPPA
Oracle Collaboration Suite Security	Chris Bennett	GSEC
Security Process for the implementation of a Company’s extranet network connections.	Kirk Steinklauber	GSEC
GIAC GCIA Assignment – Pass	Jim Becher	GCIA
Securing a Windows 2000 Application Server With Security Templates	Joshua Sprenger	GCWN
Kerberos and Access Token Limitations	Joshua Sprenger	GSEC
Security in Practice- Reducing the Effort	Leon Pholi	GSEC
Centralized Monitoring of Distributed Systems	Edward Finneran	GCUX
Case study: Implementing Trend Micro antivirus solutions in the enterprise.	Mark De Rijk	GSEC
GIAC GCIA Assignment – Pass	Andrew Patrick	GCIA
Case Study: Using Syslog in a Microsoft & Cisco Environment	Dan Rathbun	GSEC
Limiting Concurrent Logins in Windows NT/2000	Gene Burton	GSEC
GIAC GCIA Assignment – Pass	Ashley Thomas	GCIA
Understanding Wireless LAN Technology and its Security Risks	Julie Schuller	GSEC
Strategies for Improving Vulnerability Assessment Effectiveness in Large Organizations	Robert Huber	GSEC
Cost Effective Firewalling Using Linux Technology In Small Businesses	Steve Lang	GSEC
Facing Security on a Boosted RREN Backbone	Carlos Fragoso Mariscal	GSEC
A Guide to Hash Algorithms	Britt Savage	GSEC
Linux Firewall Audit: GIAC Enterprises	Elaine Madison	GCUX
GIAC GCFW Assignment – Pass	Stanley Yachera	GPPA
Introducing Security to the Small Business Enterprise	Jeff Herbert	GSEC
Windows Update and Its Derivatives – With a focus on SUS	Pei-li Chao	GSEC
ACF2 Mainframe Security	Bethany Hinsch	GSEC
In Search of Secure File Transfer Across the Internet	Robert Solomon	GSEC
GIAC Certified Windows Security Administrator	Bryce Thompson	GCWN
Let’s Slam SQL: The Slammer Worm and Lessons Learned	Brian Greif	GSEC
The Logbook of The World	Ted Demopoulos	GSEC
An Introduction To File Integrity Checking On Unix Systems	Del Armstrong	GCUX
Light at the end of the TCP Tunnel: Freedom or Oncoming Train? Risks, Benefits and Best Practices	James Ault	GSEC
GIAC GCIA Assignment – Pass	Daniel Wesemann	GCIA
Current Steganography Tools and Methods	Erin Michaud	GSEC
NIDS Countermeasures: What, Why, Where, When, and How	Jonathan Kobrick	GSEC
Integrating Real-Time Services on the Web	Pete Kobak	GSEC
Symantec Enterprise VPN Solution: Extending our Network through the Internet	Robin Parrish	GSEC
A Guide to Government Security Mandates	Christian Enloe	GSEC
Building a Security Test Environment	Richard Noel	GSEC
Solaris 9 Secure File Transfer Server Audit	Julie Baumler	GCUX
Scanning for viruses	Dan Boyd	GSEC
GIAC GCIA Assignment – Pass	Ron Shuck	GCIA
Security Assessment Guidelines for Financial Institutions	Karen Nelson	GSEC
The Key to Internet Security Is Education	Cindy James	GSEC
Common Ground – A Discussion of Standards in Network Security and How to Extend Them into the Network Assessment Arena	Timothy Politowicz	GSEC
Web services – why all the talk about security?	Richard Rabinowitz	GSEC
Implementation Methodology for Information Security Management System (to comply with BS 7799 Requirements)	Avinash Kadam	GSEC
Smart Card Authentication: Added Security for Systems and Network Access	Lawrence Thompson	GSEC
Custom IIS Authentication and Access Control using ISAPI Filter	Arsne von Wyss	GCWN
Securing Windows running Trend Micro Services with Security Templates	Curtis Simonson	GCWN
Finding the Right Instant Messaging Solution for Your Company	Jeff Richeson	GSEC
GIAC GCFW Assignment – Pass	Greg Lalla	GPPA
GIAC GCIA Assignment – Pass	Greg Lalla	GCIA
Patching Windows Environments Using Microsoft Software Update Services SUS	Ihaab Dais	GSEC
UNIX System Management and Security: Differences between Linux, Solaris, AIX and HP-UX	Haral Tsitsivas	GSEC
GIAC GCFW Assignment – Pass	Mike Powell	GPPA
Setting Up Controlled Virtual Private Networks Using Microsoft’s Proxy Server and Routing and Remote Access Service	Mike Powell	GSEC
Defending Against Spyware Invasion	Brian Smith	GSEC
Achieving Managements Security Commitment	Sherry Desbrough	GSEC
GIAC GCFW Assignment – Pass	Terry Hasford	GPPA
The Risks Involved With Open and Closed Public Key Infrastructure	Philip Hlavaty	GSEC
Firewall Fingerprinting: Using default TCP/UDP port combinations and Nmap to identify firewall types in a network	Charles Hamby	GSEC
Remote Access VPN Security Concerns and Policy Enforcement	Mike Stines	GSEC
Monitoring Web Server Logs Using Event Log Monitoring	Steven Becker	GSEC
The Difficulty of Detecting Rogue Wireless Access Points on a University or Organization Campus	Anna Zapata	GSEC
Detecting and Protecting Against Word Field Code Abuse	Mark Soderlund	GSEC
Vulnerabilities Secure Base Build of AIX 5.1	Al Un	GSEC
Bastion Build Revisited	Al Un	GCUX
VPN Deployment: Remote Access via Cisco PIX	Dwayne Foley	GSEC
Slapper	Paul Elwell	GSEC
Contingency Planning for ACE/Server 5.0	Tikuo Chen	GSEC
Event Correlation Systems – The New Threat Frontline	Kevin McIntyre	GSEC
GIAC GCIA Assignment – Pass	Alex Wood	GCIA
PGP For Everyday Use	Jeremy Hoel	GSEC
Under the radar: A look at three covert communications channels	Jim Goltz	GSEC
Creating a Home Test Lab	Russell Elliott	GSEC
GIAC GCIA Assignment – Pass	Carl Gibbons	GCIA
Intrusion Detection, Evasion, and Trace Analysis	Michael Wyman	GCIA
PureSecure(TM) Complete Intrusion Detection	Jason Oseen	GSEC
Security for a CRM environment	Jason LaFrance	GSEC
A Novice’s Guide to Securing Windows XP Home Edition	Timothy Potter	GSEC
Building a Cookerpot: Using honeypots to improve Mandrake Linux security	Valter Santos	GSEC
Protecting the Average Consumer-What’s wrong with Firewalls	Thomas Hauer	GSEC
Case Study: Deploying and Configuring a Netscreen 100 Firewall Appliance to Secure the Network	James Murphy	GSEC
Steganography Policies for Protecting Your Web Site	Toni Halley	GSEC
Web Application Security – Layers of Protection	William Fredholm	GSEC
The Need for Information Security in Today’s Economy	Jeff Tarte	GSEC
Distributed Intrusion Detection Systems: An Introduction and Review	Royce Robbins	GSEC
Security Management	Adam Wojnicki	GSEC
Empowering Your IT Call Center as Information Security Advocates	Carrollynn Brown	GSEC
Patch Management, Getting Started	Lee Debruin	GSEC
Securing Wireless Networking Within The College District Case Study	Gregory Evilsizer	GSEC
Case Study On Improving The Security Of A Firm In A Legacy Application Setting	Susan Bradley	GSEC
Protecting Small Business Banking	Susan Bradley	GSEC
Setting Up and Securing a Small Network with OpenBSD	Blair Heiserman	GSEC
Ghosts in the machine: The who, why, and how of attacks on information security	Cary Barker	GSEC
A Case for Forensics Tools in Cross-Domain Data Transfers	Dwane Knott	GSEC
GIAC GCFW Assignment – Pass	Brian States	GPPA
Electronic Medical Records: Success Requires an Information Security Culture	Thomas Roberts	GSEC
Information Security in Higher Education: Threats & Response	Thomas Roberts	GSEC
Group Policy Security Risks and Best Practices	Jenko Shih-jen Edward Hwong	GSEC
Firewall Builder the GUI alternative	James Coffey	GSEC
Securing The Hp Nonstop Himalaya Using Safeguard	Thomas Hamzik	GSEC
GIAC GCIA Assignment – Pass	Thomas Hoffecker	GCIA
Security for Online Transaction Processing in a White Label Financial Switch	Fabian Soler	GSEC
GIAC GCFW Assignment – Pass	Craig Duerr	GPPA
Remote Users: Trust verses Necessity	Chrystal Lionberger	GSEC
A Case Study on Securing Medical Practitioners’ Offices and Making The Offices HIPAA-Aware	Ira Victor	GSEC
Development of a Network Intrusion Detection Policy	Frank Yarnell	GSEC
SSL Appliance Based Solutions for Corporate Web Farms: The Benefits, the Drawbacks, and the Vulnerabilities	Matthew Fries	GSEC
What is Seen is Screened	Todd Emerton	GSEC
InfoWar: Cyber Terrorism in the 21st Century Can SCADA Systems Be Successfully Defended, or are They Our “Achilles Heal”?	Michael Ratledge	GSEC
Securing Microsoft Exchange with Ciphertrust Ironmail	John Warren	GSEC
Impact of Automatic Update installation in Service Pack 3 from Microsoft on Windows 2000 workstation.	Robert Blackwell	GSEC
Bluetooth And Its Inherent Security Issues	Tu Niem	GSEC
GIAC GCFW Assignment – Pass	Lesa Ludwig	GPPA
GIAC GCFW Assignment – Pass	Mark Hillick	GPPA
Securing Our Critical Infrastructures	Chris Brooks	GSEC
PestPatrol in a Corporate Environment: A Case Study In Information Security	Tim Strong	GSEC
Ethics in Your Day, Your Job and Your Next Decision	Norman Witt	GSEC
Help We Just Fired Our Only IT Person!	Doug Cox	GSEC
Mitigating Web Application Risks With A Security Code Review And Appscan.	Michael Blase	GSEC
Linux.Slapper.Worm: Buffer Overflow Attacks Continue to Be a Problem	Richard Fifarek	GSEC
GIAC GCFW Assignment – Pass	Mark Conger	GPPA
Patch Management: Tackling the Remote Laptop and Teleworker – A Case Study	Kay Cornwell	GSEC
GIAC GCIA Assignment – Pass	Erik Montcalm	GCIA
Securing Task Station Computers Using Windows 2000 Group Policy	Roger McClinton	GCWN
Act Now! An Introduction To Canada’s PIPED Act and its Affect on Organizations and IT Departments	Kevin Egan	GSEC
GIAC GCIA Assignment – Pass	Mohammed Haron	GCIA
Is Your Storage Area Network Secure? An Overview of Storage Area Network from Security Perspective	Mohammed Haron	GSEC
A Case Study: Deployment of Virus Protection In The Global Enterprise	Carl Alexander	GSEC
Packet Sniffing In a Switched Environment	Tom King	GSEC
Security Considerations for Sharepoint Team Services on Windows 2000 Server	Jonathan Davies	GSEC
Secure Setup of a Corporate Detection and Scanning Environment	Dieter Sarrazyn	GSEC
GIAC GCIA Assignment – Pass	Antonia Rana	GCIA
Security Awareness – Implementing an Effective Strategy	Chelsa Russell	GSEC
GIAC GCIA Assignment – Pass	Frans Kollee	GCIA
Firewall on a Budget	Scott Schimkowitsch	GSEC
Securing an IIS 5.0 Web Server on Windows 2000 using Security Tools and Templates	Graeme McLintock	GSEC
GIAC GCIA Assignment – Pass	Kerry Long	GCIA
GIAC GCFW Assignment – Pass	Greg Surla	GPPA
Distributed Systems Security: Java, CORBA, and COM+	April Moreno	GSEC
Aladdin Esafe Enterprise v3.0	Stacy Bolton	GSEC
GIAC GCIA Assignment – Pass	Nils Reichen	GCIA
Securing a Web Development Workstation with the NSA Security Template	Bill Sterns	GCWN
Exploring Client-side Web Exploits	Bill Sterns	GSEC
Using A Reverse Proxy To Filter HTTP and HTTPS	Mattison Ward	GSEC
Combating the Lazy User: An Examination of Various Password Policies and Guidelines	Sam Wilson	GSEC
GIAC GCFW Assignment – Pass	Sam Wilson	GPPA
Solaris 10 Filesystem Integrity Protection Using Radmind	Sam Wilson	GCUX
Securing Mac OS X 10.1.5 Using Free Software	David Shinberg	GSEC
GIAC GCFW Assignment – Pass	Penny Hermann-Seton	GPPA
Security Features in IPv6	Penny Hermann-Seton	GSEC
Design a Secure Windows 2000 Infrastructure	Erik Weinmeister	GCWN
Internet Email: Defense in Depth	Howard Edin	GSEC
The Life Cycle of A Security Awareness Program:What has and has not Worked	John Turner	GSEC
Are You a Responsible Internet Neighbour?	Phillip Croft	GSEC
Using IDS to Evaluate Outbound Port Usage for Security and Reduction of IDS Alerts: A Case Study	Ken Underwood	GSEC
GIAC GCIA Assignment – Pass	Dongmei Huang	GCIA
GIAC GCIA Assignment – Pass	Denis Brooker	GCIA
Smart Cards – the All-in-One Security Platform for Today’s Corporate World	Ee Chin Chong	GSEC
Case Study: Adventures in Securing Mom and Pop	Ken Davidson	GSEC
Security Audit Report	Mandar Rege	GCUX
Stopping P2P: How to Rid Your Network of Unwanted P2P Traffic	Russell Meyer	GSEC
Challenges of Managing an Intrusion Detection System (IDS) in the Enterprise	Russell Meyer	GCIA
Information Assurance Using Biometrics	Bryan Feltin	GSEC
GIAC GCIA Assignment – Pass	Jason Tant	GCIA
Deploying Secure Public Kiosk Networks	Jon Shaffer	GSEC
Securing the SNMP Service	Robert Hayden	GCWN
Authenticating Nortel Contivity Clients Using RSA SecurID Tokens	Rusty Fancher	GSEC
Implementing Defense in Depth at the University Level	G Michael Runnels	GSEC
CyberPorn Tricks and Awareness	Stephen Karrick	GSEC
Security Aspects of a Samhain Client/Server Installation to Protect a Solaris Web Server	Winston Holmes	GCUX
System and Network Documentation	Winston Holmes	GSEC
Virii Generators: Understanding the Threat	James Tarala	GSEC
Implementing a Secure Microsoft Windows Server 2003 Terminal Services Infrastructure: A Case Study for ACME Healthcare, Inc.	James Tarala	GCWN
Steganography – See No Evil, Hear No Evil, Speak No Evil	Chris Farrow	GSEC
The University Has a Firewall – Isn’t That Enough? Why Users Still Need to Be Concerned About Computer Security	Sherry Cummins	GSEC
HIPAA/ISO 17799 Security Audit of GIAC Enterprises Onsite Employee Health Clinic Database Server	Sherry Cummins	GCUX
Developing a Secure and Portable Snort Sensor based on Red Hat 9	Frederick Larabee	GCUX
Proactive Vulnerability Assessments with Nessus	Jason Mitchell	GSEC
SPAM: Recourse and Education	Rodney Caudle	GSEC
Assumptions in Intrusion Detection – Blind Spots in Analysis	Rodney Caudle	GCIA
Maintaining Departmental Security in a Centralized Environment: Keeping Things Secure When You Have to Cooperate	Brent Veenstra	GSEC
Novell Server Quick Security Guide for the Overworked Administrator	Tony Flowers	GSEC
Managing Network Firewalls -A Love/Hate Relationship	James Medeiros	GSEC
The Firewall Has Been Installed, Now What? Developing a Local Firewall Security Policy	Richard Walker	GSEC
Critical System Lifecycle: A Security Perspective	Geoffrey Pascoe	GSEC
GIAC GCIA Assignment – Pass	Pedro Bueno	GCIA
Inter-node Security Issues in 802.11b Wireless LAN Environments	Patrick Sweeney	GSEC
Buffer Overflows for Dummies	Josef Nelissen	GSEC
How to Effectively Secure Your Business	Albert Yu	GSEC
Continuously Anticipating the Network Attack	Mark Georgas	GSEC
Public-key Cryptography: PGP, SSL, and SSH	Thomas Jonson	GSEC
Designing a Secure Windows 2000 Network Infrastructure	David Branscome	GCWN
Securing a Red Hat Linux 7.2 Anonymous FTP Server with Security Support syslog Server	Brian Melcher	GCUX
Microsoft Internet Explorer 6.0 Security: Step-by-Step	Chris Christianson	GSEC
Aggressive Patching and the Use of a Standard Build: An OpenBSD example	Michael Sullenszino	GSEC
GIAC GCFW Assignment – Pass	Robert Schiela	GPPA
GIAC GCFW Assignment – Pass	Blair Nason	GPPA
Multi-Layered Approach to Small Office Networking	David Taylor	GSEC
Security Audit Report	Zarina Musa	GCUX
VPN-1 SecureClient – Check Point’s Solution for Secure Intranet Extension	Ryan Gibbons	GSEC
Securing an Anonymous FTP Server in Solaris 8 with WU-FTPD	Mansel Bell	GSEC
GIAC GCIA Assignment – Pass	Jared McLaren	GCIA
Secure Open-Source Network IDS	Jared McLaren	GSEC
GIAC GCFW Assignment – Pass	Jared McLaren	GPPA
GIAC GCIA Assignment – Pass	Michael Meacle	GCIA
How to Install IC Radius and Extend via Custom Perl Script	Michael Meacle	GSEC
Protecting your Internal Systems from a Compromised Host	Michael Nancarrow	GSEC
GIAC GCIA Assignment – Pass	David Manley	GCIA
Nessus: Vulnerability Scanning and Beyond	Paul Schmelzel	GSEC
GIAC GCIA Assignment – Pass	Paul Schmelzel	GCIA
Cyber IPB	Steve Winterfeld	GSEC
A Qualitative Risk Analysis and Management Tool – CRAMM	Zeki Yazar	GSEC
Iris Recognition Technology for Improved Authentication	Penny Khaw	GSEC
LaBrea – A New Approach to Securing Our Networks	Leigh Haig	GSEC
GIAC GCIA Assignment – Pass	Brian Sheffler	GCIA
Building a Secure Solaris 8 Backup Server	Jason Christensen	GCUX
SSH and Intrusion Detection	Heather Larrieu	GSEC
GIAC GCIA Assignment – Pass	Jalal Moloo	GCIA
GIAC GCIA Assignment – Pass	Kris Wicks	GCIA
Implementing n Internet Content Filtering and Reporting Program	Eric Wilkens	GSEC
GIAC GCIA Assignment – Pass	Jon Repaci	GCIA
A Tool for Running Snort in Dynamic IP Address Assignment Environment	Shin Ishikawa	GSEC
The Sun Enterprise Authentication Mechanism	John Douglass	GSEC
GIAC GCIA Assignment – Pass	Mark Embrich	GCIA
IDS Burglar Alarms: A How-To Guide	Mark Embrich	GSEC
GIAC GCIA Assignment – Pass	Tim Newell	GCIA
Echelon: The Dangers of Communication in the 21st Century	Chad Yancey	GSEC
A Solaris Backup Script How-to	Stanley Hearn	GSEC
GIAC GCIA Assignment – Pass	Glenn Larratt	GCIA
GIAC GCFW Assignment – Pass	Glenn Larratt	GPPA
Introduction to the Security Audit Process	Jim Murray	GSEC
GIAC GCIA Assignment – Pass	Michael McDonnell	GCIA
Protecting Against the Unexpected	Keith Seymour	GSEC
Distilling Data in a SIM: A Strategy for the Analysis of Events in the ArcSight ESM	James Voorhees	GCIA
The Limits on Wireless Security: 802.11 in Early 2002	James Voorhees	GSEC
Computing Industry Certifications and Security	Kurt Jensen	GSEC
A Detailed Look at Steganographic Techniques and Their Use in an Open-Systems Environment	Bret Dunbar	GSEC
Deploying Microsoft HiSecurity Template on a Windows 2000 Professional Workstation within a Windows NT 4.0 Domain	Joe Matyaz	GCWN
GIAC GCIA Assignment – Pass	Dan Hawrylkiw	GCIA
Wireless Networking Security: As Part of Your Perimeter Defense Strategy	Daniel Owen	GSEC
Implementing a Windows 2000 Host Based Intrusion Detection System	Richard Springs	GSEC
GIAC GCIA Assignment – Pass	Patrick Ethier	GCIA
GIAC GCIA Assignment – Pass	Karim Merabet	GCIA
Leveraging the Load Balancer to Fight DDoS	Brough Davis	GCIA
Areas to Consider When Planning Virus and Software Updates of Remote Computers	Jeff Markee	GSEC
PGP in a Networked, Multi-user Environment	Mark Fennig	GSEC
GIAC GCFW Assignment – Pass	Mark Fennig	GPPA
GIAC GCFW Assignment – Pass	Mark Ballister	GPPA
Monitoring for Security Events Using Windows Management Instrumentation	Stephen Seigler	GSEC
GIAC GCIA Assignment – Pass	John Hally	GCIA
Steganography: What’s the Real Risk?	John Hally	GSEC
Defeating Perimeter Security With HTTP	Marcus Bailey	GSEC
Twists in Security for Law Enforcement	Conrad Larkin	GSEC
Secure Shell Daemon crc32 Compensations Attack Detector Vulnerability	Tim Yeager	GSEC
An Analysis of Terrorist Groups’ Potential Use of Steganography	Stephen Lau	GSEC
Violations of Basic Computer Security Principles within the Television Broadcast Community and Some Suggested Solutions	Paul Claxton	GSEC
GIAC GCIA Assignment – Pass	James Hoover	GCIA
Securing a Fortune	Marc Westbrock	GCWN
ELECTRONIC DATA RECOVERY A Critical Component of Security, Disaster Recovery and Company Survival	Marc Westbrock	GSEC
An Informal Analysis of One Site’s Attempts to Contact Host Owners	Laurie Zirkle	GSEC
Applying the CIS Linux Benchmark v1.1.0 Recommendations to a Mandrake 9.1 Laptop with Higher Security Enabled	Laurie Zirkle	GCUX
We’re Auditors – We’re Here to Help	James Butler	GSEC
GIAC GCIA Assignment – Pass	Sean-Paul Heare	GCIA
GIAC GCIA Assignment – Pass	Dan Guinane	GCIA
GIAC GCIA Assignment – Pass	Jim Hendrick	GCIA
GIAC GCFW Assignment – Pass	Jim Hendrick	GPPA
Finding dsniff on Your Network	Richard Duffy	GSEC
Host vs. Network-Based Intrusion Detection Systems	David Trzcinski	GSEC
GIAC GCIA Assignment – Pass	Keven Murphy	GCIA
Implementation of a Secure Wireless Network on a University Campus	Greg Redder	GSEC
Making Smart Cards Work in the Enterprise	Brett Lewis	GSEC
Research Guide to Web Resources at Microsoft.com and Applying This to Patching Internet Information Server	Barry Dahling	GSEC
GIAC GCFW Assignment – Pass	Daniel Mengel	GPPA
No Budget, no Policy: Leading the Bull by the Nose or Thank God for the Cisco IOS Firewall Feature Set	Richard Haynal	GSEC
GIAC GCIA Assignment – Pass	Thomas Shepherd	GCIA
An Exploration into Biometrics, Security Architecture Design, and Security Policies	Thomas Shepherd	GPPA
GIAC GCFW Assignment – Pass	Eve Edelson	GPPA
Researching a Topic on the Internet	Eve Edelson	GSEC
Rootkit: Attacker Undercover Tools	Saliman Manap	GSEC
A Secure Windows 2000 Infrastructure	David Heed	GCWN
GIAC GCIA Assignment – Pass	David Heed	GCIA
Step-by-step Guide to Securing Red Hat 7.1 Linux	Lawrence Grim	GCUX
Security Awareness: Help the Users Understand	Kenton Smith	GSEC
Anti-virus Software: The Challenge of Being Prepared for Tomorrow’s MalWare Today	Lisa Galarneau	GSEC
GIAC GCIA Assignment – Pass	Gregory Lajon	GCIA
Overview of Nimda	John Phillips	GSEC
Building a Cost Effective Syslog Server using Solaris For Intel and SunScreen Lite – Honor	Harpal Parmar	GCUX
A Secure Windows 2000 Infrastructure for GIAC Enterprises	Harpal Parmar	GCWN
Securing a Windows 2000 IIS Web Server – Lessons Learned	Harpal Parmar	GSEC
A Guide to Building and Securing an Intranet Mail Server/Hub with AIX 5L Version 5.1 on an IBM RS/6000 Server	Devon Caines	GCUX
GIAC GCFW Assignment – Pass	Orazio Mistretta	GPPA
GIAC GCIA Assignment – Pass	Orazio Mistretta	GCIA
Basic Travel Security Revisited	Thomas Palmer	GSEC
Can Hackers Turn Off Your Lights?	Jonathan Stidham	GSEC
GIAC GCFW Assignment – Pass	Tracy Thurston	GPPA
Conducting an electronic information risk assessment for Gramm-Leach-Bliley Act compliance.	Kevin Bong	GSEC
GIAC GCIA Assignment – Pass	Kevin Bong	GCIA
GIAC GCFW Assignment – Pass	Kevin Bong	GPPA
GIAC GCIA Assignment – Pass	Reuben Rubio	GCIA
GIAC GCIA Assignment – Pass	Alan Woodroffe	GCIA
GIAC GCIA Assignment – Pass	Mark Maher	GCIA
GIAC GCIA Assignment – Pass	Philipp Stadler	GCIA
GIAC GCFW Assignment – Pass	Philipp Stadler	GPPA
GIAC GCFW Assignment – Pass	Justin Ginsberg	GPPA
Proactively Guarding Against Unknown Web Server Attacks	William Geiger	GSEC
The Code Red Worm	John Dolak	GSEC
Security and the 802.11b Wireless LAN	Sean Griffin	GSEC
AIX 4.3 Installation Checklist	Kenneth Lee	GCUX
SuSE Linux 7.1 Professional Installation Checklist	Felix Schallock	GCUX
Disconnect from the Internet – Whale’s e-Gap In-Depth	Kevin Gennuso	GSEC
How to Choose an Intrusion Detection Solution	Baiju Shah	GSEC
Security from Scratch… How to Achieve It	Alan Davies	GSEC
GIAC GCFW Assignment – Pass	Chris Kellogg	GPPA
The Weakest Link: The Human Factor	Bradley Fulton	GSEC
Protecting Sensitive Data in Secure Domains	Mikael Trosell	GSEC
Electronic Data Retention Policy	Brian Wrozek	GSEC
Cisco Router Hardening: Step-by-Step	Dana Graesser Williams	GSEC
GIAC GCIA Assignment – Pass	Harvey Lange	GCIA
Linux Red Hat 7.1 Security Assessment	Bente Petersen	GCUX
GIAC GCIA Assignment – Pass	Bente Petersen	GCIA
GIAC GCIA Assignment – Pass	John Melvin	GCIA
Protect your enterprise against clients centric attacks, using Windows 2000 GPO	Thierry Agassis	GCWN
Information Security: Handling Compromises	Craig Bowser	GSEC
Enforce Network Access Control through Security Policy Management Process and Enforcement	Craig Bowser	GSEC
Why Small Businesses Need to Secure Their Computers (and How to Do It!)	Bruce Diamond	GSEC
A Business Perspective on PKI: Why Many PKI Implementations Fail, and Success Factors to Consider	Leslie Peckham	GSEC
Kerberos Authentication in Windows 2000	Vishwas Gadgil	GSEC
GIAC GCIA Assignment – Pass	Vernon Stark	GCIA
Using Snort v1.8 with SnortSnarf on a Red Hat Linux System	Richard Greene	GSEC
Firewall Rule Review	Rita Will	GSEC
Spyware and Network Security	Lester Cheveallier	GSEC
GIAC GCFW Assignment – Pass	Eric Mroczka	GPPA
A Virus and a Worm: Lessons Learned from Sircam and Code Red in a University Environment	Marc Mazuhelli	GSEC
GIAC GCFW Assignment – Pass	Lorna Hutcheson	GPPA
GIAC Enterprises: Fortunes for the Future – Implementing Active Directory with Defense in Depth	Lorna Hutcheson	GCWN
Successful Partnerships for Fighting Computer Crime	Beth Binde	GSEC
GIAC GCIA Assignment – Pass	Beth Binde	GCIA
How to Build and Secure a General Purpose “Internet Ready” Workstation	Robert Beswick	GCUX
Manage your Security Initiative as a Project	Rex Robitschek	GSEC
Cheese Worm: Pros and Cons of a “Friendly” Worm	Bryan Barber	GSEC
Backup Rotations – A Final Defense	Stephen Lennon	GSEC
Using Open Source to Create a Cohesive Firewall/IDS System	Thomas Dager	GSEC
The China Syndrome	Charles Bacon	GSEC
Logfile Analysis: Identifying a Network Attack	Michael Fleming	GSEC
GIAC GCIA Assignment – Pass	Stephen Pedersen	GCIA
GIAC GCIA Assignment – Pass	Mike Poor	GCIA
Public Servers Vulnerability Assessment Report	Ricky Smith	GCUX
Group Policies for GIAC Enterprises	Ricky Smith	GCWN
GIAC GCIA Assignment – Pass	Ricky Smith	GCIA
Filtering Routers in a Small Office/Home Office with a Mixed OS Environment	Ricky Smith	GSEC
GIAC GCIA Assignment – Pass	Janice Slocumb	GCIA
System Security and Your Responsibilities: Minimizing Your Liability	Gary Holtz	GSEC
Implementing/Re-Implementing Change Control Policies	Derek Milroy	GSEC
Open File Shares: An Unexpected Business Risk	Jaime Carpenter	GSEC
GIAC GCIA Assignment – Pass	Wes Bateman	GCIA
Vulerability Scanning in the Corporate Enterprise	Peter Nichols	GSEC
Risk Assessment in the University Setting	Kent Knudsen	GSEC
Preventing Your Computer from Becoming a Zombie	Jamy Klein	GSEC
GIAC GCFW Assignment – Pass	Jamy Klein	GPPA
Security Awareness – Everyone’s Business	Bev Memory	GSEC
Auditing a University Solaris System	Geoffrey Poer	GCUX
GIAC GCIA Assignment – Pass	Geoffrey Poer	GCIA
GIAC GCIA Assignment – Pass	Nathan Kim	GCIA
GIAC GCIA Assignment – Pass	Brian Credeur	GCIA
Guide to Deploying a Windows 2000/Exchange 2000/File/Print Server in a Single Server Environment	Gary Pasikowski	GCWN
Prosecution: A Subset of Incident Response Procedures	Gary Pasikowski	GSEC
Business Consideration and Network Implementation of Generally Accepted Security Standards	Patrick Nolan	GSEC
Is It Really Gone?	Grant Thompson	GSEC
Creating Security Policies – Lessons Learned	Mark Worthington	GSEC
GIAC GCFW Assignment – Pass	Eric Waddell	GPPA
GIAC GCFW Assignment – Pass	David Stokes	GPPA
Overview of Biometric Encryption	Mark Wood	GSEC
GIAC GCIA Assignment – Pass	Michael Lastor	GCIA
The Future of Fighting Viruses: A History and Analysis of the Digital Immune System	Michael Bussa	GSEC
To CVP or not to CVP	Kurt Koenigsknecht	GSEC
GIAC GCFW Assignment – Pass	Kurt Koenigsknecht	GPPA
GIAC GCFW Assignment – Pass	Georgios Sagos	GPPA
GIAC GCIA Assignment – Pass	Bill Phillips	GCIA
GIAC GCFW Assignment – Pass	Bill Phillips	GPPA
GIAC GCFW Assignment – Pass	Ben Laws	GPPA
Solaris 8 (sparc) Security Checklist for JFY, Inc.	Ben Laws	GCUX
Wireless LANs – the Big New Security Risk	Gordon Mitchell	GSEC
Inverse Mapping Using Disguised TCP Resets	Minna Kangasluoma	GSEC
Securing the Wile Modem: A Case Study on the Use of Policies, War Dialers and Firewalls for Phone Lines	Archie Woodworth	GSEC
Securing Unix Step by Step	George Markham	GCUX
GIAC GCFW Assignment – Pass	Norrie Bennie	GPPA
Certificate Revocation in Public Key Infrastructures	Scott Fairbrother	GSEC
GIAC GCIA Assignment – Pass	Miika Turkia	GCIA
Instruments of the Information Security Trade	Mark Graff	GSEC
GIAC GCFW Assignment – Pass	Mason Richardson	GPPA
Central Auditing of Windows NT Using Windows Script Host (WSH)	Roger Mclaren	GCWN
OpenBSD Escorting Firewall Step by Step Guide	Benjamin Eason	GCUX
GIAC GCIA Assignment – Pass	Charles Hutson	GCIA
Stronger Authentication Methods: Biometrics and Public Acceptance	Mark Wolansky	GSEC
Detecting Torrents Using Snort	Rick Wanner	GCIA
NetTop for Data Privacy through Secure Desktops	Rick Wanner	GSEC
Secure Browsing Environment	Robert Peter Sorensen	GSEC
GIAC GCIA Assignment – Pass	Robert Peter Sorensen	GCIA
GIAC GCFW Assignment – Pass	Robert Peter Sorensen	GPPA
Securing NT4 Workstations in an Educational Computer Lab Environment	Eric Nooden	GSEC
GIAC GCFW Assignment – Pass	Scot Hartman	GPPA
Securing SNMP Windows	Stephen Cicirelli	GSEC
GIAC GCFW Assignment – Pass	Stephen Cicirelli	GPPA
Checklist for Securing RedHat Linux 7.1 on an IBM Thinkpad Laptop	Paul DePriest	GCUX
The Importance of the Ramen Worm	Paul DePriest	GSEC
GIAC GCFW Assignment – Pass	Tanya Baccam	GPPA
Do You Copy? Security Issues with Digital Copiers	Kevin Smith	GSEC
Step-by-step Guide to Securing an IRIX Mediabase Video Web Server	Robert Drollinger	GCUX
GIAC GCIA Assignment – Pass	Peter Szczepankiewicz	GCIA
Usefulness and Shortcomings of the Pre-configured Security Policy Templates that are Included with Windows 2000	Yong Choe	GCWN
Black ICE 2.5 Events, False Positives and Custom Attack Signatures	Alan J Mercer	GSEC
Malicious Code: VBS/OnTheFly (Anna Kournikova)	Marco Smitshoek	GSEC
GIAC GCFW Assignment – Pass	Marco Smitshoek	GPPA
Intrusion Report for SANS University	Gaspar Modelo Howard	GCIA
The Hacking of Microsoft	Ernest Quaglieri	GSEC
Implementing Site-to-Site IPSEC VPNs Using Cisco Routers	Millie Ives	GSEC
GIAC GCFW Assignment – Pass	Gavin Vallance	GPPA
Kerberos Network Authentication Security Protocol – Recent Security Vulnerabilities	Jay Holcomb	GSEC
PC Week hack of 1999	Shawn Balestracci	GSEC
GIAC GCFW Assignment – Pass	Chris Talianek	GPPA
Securing an AIX 5.2 Development Server	Chris Talianek	GCUX
GIAC GCIA Assignment – Pass	Chris Talianek	GCIA
Installing and Securing an SSH Server with HP Secure OS Software for Linux and Cryptography	Kenneth Gallo	GCUX
GIAC GCIA Assignment – Pass	Michael Semling	GCIA
Information Warfare: Are You Battlefield Ready?	Phillip Conrad	GSEC
Basic Steps to Hardening a Standalone Windows 2000 Installation	Todd Anderson	GSEC
Installing and Securing a Shell Access Server Using Red Hat 6.2 Linux	Stephen Gibson	GCUX
Nessus – Get on Board	Greg Brooks	GSEC
BIND 8 Buffer Overflow in TSIG	Richard Biever	GSEC
GIAC GCIA Assignment – Pass	Chris Hayden	GCIA
NetBus	Chris Hayden	GSEC
Attacks from Within: A Look at Security Concerns for ASPs	Tyson Kopczynski	GSEC
AES: The New Key on the Block	Christopher Silveira	GSEC
Importance of a Standard Methodology in Computer Forensics	Jim McMillan	GSEC
GIAC GCIA Assignment – Pass	Donald Pitts	GCIA
SOHO OpenBSD Intranet IMAP Server	Donald Pitts	GCUX
Log Consolidation with syslog	Donald Pitts	GSEC
Protecting Your Home Computer from the Internet, Can You Keep the Heat Out?	Robert Ashworth	GSEC
GIAC GCIA Assignment – Pass	Robert Ashworth	GCIA
Securing Information on Laptop Computers	James Purcell	GSEC
Limiting the Exposure of a Netware Server in an IP World	Dana Mclaughlin	GSEC
GIAC GCFW Assignment – Pass	Dana Mclaughlin	GPPA
Scripting as a Method of Establishing a Reliable Baseline Posture	George Moncrief	GSEC
Firewall Load Balancers	Megan Restuccia	GSEC
Hacktivism – A Free Form of Expression or a Digital Vandalism	Eva Dadok	GSEC
GIAC GCFW Assignment – Pass	Graham Bennett	GPPA
GIAC GCIA Assignment – Pass	Michael Worman	GCIA
An Explanation of “TCP Wrappers” for the Security Manager	Richard Branicki	GSEC
Security Audit Report	Gary Needham	GCUX
Securing Microsoft Outlook 2000 Using the Outlook Security Update in a Microsoft Exchange Server 5.5 Environment	Brad Peer	GSEC
Creating a Certificate-Enabled Public Web Site With Windows 2000	Michael Reiter	GCWN
GIAC GCFW Assignment – Pass	Michael Reiter	GPPA
Consolidated Security Event Monitoring for Microsoft Windows NT 4.0 Server	Jeff Shawgo	GCWN
GIAC GCFW Assignment – Pass	Pat Malone	GPPA
GIAC GCFW Assignment	Patrik Sternudd	GPPA
Snort Overdrive	Patrik Sternudd	GCIA
Securing an OpenBSD 3.5 System for use with Honeyd	Nicholas Smith	GCUX
GIAC GCFW Assignment – Pass	Michael Gauthier	GPPA
Security Audit Intrusion Report	Michael Gauthier	GCIA
Security Assessment	Michael Gauthier	GCUX
Windows NT Web Server Auditing	Dean Farrington	GCWN
GIAC GCFW Assignment – Pass	Mark Evans	GPPA
GIAC GCFW Assignment – Pass	Jim O’Brien	GPPA
Security Issues in NIS	Jim O’Brien	GSEC
How Does Network Security Scanning Work Anyway?	Ronald Black	GSEC
GIAC GCIA Assignment – Pass	Rhonda Maluia	GCIA
An Elementary Introduction to Sendmail	Jay Coleson	GSEC
Critical Infrastructure Protection: Establishing an Information Sharing and Analysis Center Can Be Like Developing an Organizational Security Policy	Frances Wentworth	GSEC
Security Implications of Update Agent Software	Shaun Glaim	GSEC
Securing Windows 2000 with Security Templates	John Jenkinson	GCWN
GIAC GCFW Assignment – Pass	John Jenkinson	GPPA
AIX Version 4.3.3 on Power2 3xx Series RS/6000	John Jenkinson	GCUX
Using VAX/VMS to Augment Security of a Large UNIX Environment	John Jenkinson	GSEC
GIAC GCIA Assignment – Pass	John Jenkinson	GCIA
Build Securely a Shadow Sensor Step-by-Step Powered by Slackware Linux	Guy Bruneau	GCUX
The History and Evolution of Intrusion Detection	Guy Bruneau	GSEC
SANS GIAC Intrusion Detection Curriculum Parliament Hill 2000	Guy Bruneau	GCIA
A Risk Assessment Approach to NT Security	Glenn Davis	GCWN
GIAC GCIA Assignment – Pass	Glenn Davis	GCIA
GIAC GCIA Assignment – Pass	Curtis Blais	GCIA
GIAC GCFW Assignment – Pass	Curtis Blais	GPPA
GIAC GCFW Assignment – Pass	Jeffrey Roth	GPPA
Audit of Gauntlet 5.5 Firewall (Running on Solaris 2.6 with BIND 8.2.3-REL)	Jeff Holland	GCUX
Know Yourself: Vulnerability Assessments	Adrien de Beaupre	GSEC
Trinity v3 DDoS: Tomorrow’s Headline?	David Sheridan	GSEC
Why Your Switched Network Isn’t Secure	Steven Sipes	GSEC
Linux DNS (Domain Name Server) System Setup Checklist	Martin Tremblay	GCUX
Promoting Security from the Middle	Siegfried Hill	GSEC
The Impact of Cumulative Secure and High Secure Windows 2000 Professional Security Templates on a Workstation Running SCT Banner	Siegfried Hill	GCWN
DSL and Computer Security Issues	Joanne Ashland	GSEC
GIAC GCIA Assignment – Pass	Jasmir Beciragic	GCIA
GIAC GCFW Assignment – Pass	Jasmir Beciragic	GPPA
Cookies and Exploits	Jasmir Beciragic	GSEC
Public Domain FTP Buffer Overflow Vulnerabilities Feb. – Oct. 1999	Ralph Durkee	GSEC
GIAC GCFW Assignment – Pass	Brian Estep	GPPA
GIAC GCIA Assignment – Pass	Brian Estep	GCIA
Windows NT Security Step-by-Step	Charles John	GCWN
GIAC GCIA Assignment – Pass	Dan Chervenka	GCIA
GIAC GCIA Assignment – Pass	Joseph Rach	GCIA
Corporate LAN Intranet Server Compromise	Jason DePriest	GSEC
GIAC GCFW Assignment – Pass	Jason DePriest	GPPA
Security Audit Report	Daniel Robb	GCUX
The Evolution of Malicious Agents	Lenny Zeltser	GSEC
Consultants Report from Auditing UNIX	Lenny Zeltser	GCUX
Designing a Secure Windows 2000 Infrastructure	Lenny Zeltser	GCWN
GIAC GCIA Assignment – Pass	Donald Tomczak	GCIA
GIAC GCIA Assignment – Pass	Kevin Pietersma	GCIA
GIAC GCIA Assignment – Pass	Michael Wee	GCIA
GIAC GCIA Assignment – Pass	John Dietrich	GCIA
GIAC GCIA Assignment – Pass	David Blaine	GCIA
GIAC GCIA Assignment – Pass	Kevin Miller	GCIA
Database Encryption Things you know before you encrypt	James Summers	GSEC
GIAC GCIA Assignment – Pass	James Summers	GCIA
GIAC GCIA Assignment – Pass	JD Baldwin	GCIA
Firewalls: What I Wish I’d Known When I Was Getting Started	William Davis	GSEC
GIAC GCIA Assignment – Pass	William Davis	GCIA
GIAC GCFW Assignment – Pass	Dave Chen	GPPA
Integration Of Single Sign On Within The Framework Of An J2EE Environment In Banking Field<br>French Translation	Philippe Gros	GSEC
GIAC GCFW Assignment – Pass	Richard Hammer	GPPA
Enhancing IDS using, Tiny Honeypot	Richard Hammer	GCIA
The Inside-Out Firewall Vulnerability	Richard Hammer	GSEC
GIAC GCIA Assignment – Pass	Donna Andert	GCIA
GIAC GCIA Assignment – Pass	Javier Romero	GCIA
GIAC GCIA Assignment – Pass	Suzanne Vanpatten	GCIA
The Packet Filter: A Basic Network Security Tool	Daniel Strom	GSEC
GIAC GCIA Assignment – Pass	Daniel Strom	GCIA
GIAC GCIA Assignment – Pass	Andrew Korty	GCIA
GIAC GCIA Assignment – Pass	David Nolan	GCIA
GIAC GCIA Assignment – Pass	Bob Long	GCIA
Good News, Bad News: The Infosec Issues of Usenet	Bob Long	GSEC
GIAC GCFW Assignment – Pass	Marc Panet-Raymond	GPPA
GIAC GCIA Assignment – Pass	Shane Boothe	GCIA
GIAC GCIA Assignment – Pass	David Hesprich	GCIA
GIAC GCIA Assignment – Pass	Jim Clausing	GCIA
GIAC GCIA Assignment – Pass	Joe Dietz	GCIA
GIAC GCIA Assignment – Pass	Kirk Becker	GCIA
Windows NT and Novell Host Based Intrusion Detection Using Native Logging and 3rd Party Log Reporting Tools	Robert Grill	GSEC
GIAC GCFW Assignment – Pass	Jerry Shenk	GPPA
GIAC GCIA Assignment – Pass	Jerry Shenk	GCIA
GIAC GCIA Assignment – Pass	James Kirby	GCIA
GIAC GCIA Assignment – Pass	Martin Walker	GCIA

SANS Industrial Control Systems Resources: Summit Archives

ICS Security Summit 2015 – Orlando, Florida

• https://files.sans.org/summit/ics2015/
• • Zip file of all PDFs (updated 20150318)

• Beyond_Stuxnet_The_Next_Generation_of_Cyber_Warfare_Kim_Zetter.pdf
• ConditionBased_Kill_Chains_and_the_Maturity_of_NextGen_Attackers_Mark_Fabro_Matt_Carpenter.pdf
• Creating_Quick_Wins_by_Optimizing_Operational_Technology_and_Information_Technology_Process_Controls_KPMG_LLP_.pdf
• Cybersecuring_DoD_Industrial_Control_Systems_One_Year_Later_Michael_Chipley_PhD.pdf
• Cybersecurity_Procurement_Language_for_Energy_Delivery_Systems_REPORT.pdf
• Developing_an_Industrial_Controls_Security_Framework_Securicon_Lunch_and_Learn.pdf
• Emerging_Solutions_for_Evolving_Threats_Panel.pdf
• Fides_SCADA_Anomaly_Detection_System_Has_Your_Six_Lunch_and_Learn_Elbit_Systems.pdf
• Harmonizing_ICS_Security_and_Compliance_Panel_Discussion.pdf
• ICS_Active_Defense_Robert_M._Lee_Dragos_Security.pdf
• Live_ICS_Attack_Demo.pdf
• Managing_Risk_in_the_Supply_Chain_Panel.pdf
• Missing_the_Obvious_Network_Security_Monitoring_for_ICS_Rob_Caldwell_and_Chris_Sistrunk_Mandiant.pdf
• Play_to_Win_How_to_Build_Professional_Skills_Through_HandsOn_Challenges_Tim_Medin_Counter_Hack.pdf
• Project_SHINE_What_We_Discovered_and_Why_You_Should_Care_Bob_Radvanovsky_Infracritical.pdf
• SystemWide_Cybersecurity_Failures_Are_We_Entering_a_New_Phase_Panel.pdf
• Technical_Briefing_ICSTargeted_Threats.pdf

ICS Security Europe – Amsterdam 2014

• https://files.sans.org/summit/icsamsterdam14/
• • Zip file of all PDFs (updated 20141008)

• Justin Searle.pdf
• Klaus Kursawe.pdf
• Markus Braendle.pdf
• Ralph Langner .pdf
• Rauli Kaksonen.pdf
• Rob Caldwell .pdf
• SANS ICS Poster.pdf
• Sebastian Ranft.pdf
• Steffen Wendzel.pdf
• Steffen Wendzel.ppt
• Vyacheslav Borilin.pdf

ICS Security Summit – Orlando, Florida

• https://files.sans.org/summits/scada14/ – 2014
• • Zip file of all PDFs (updated 20140401)

• Energy Sector Control Systems Working Group Release of the Draft Cybersecurity Procurement Language for Energy Delivery Systems.pdf
• So Easy a Child Could Do It – Teaching Your Management About SCADA – Rob Lee.pdf
• NIST Cybersecurity Framework Implementation – Goff, Christopher and Bartol.pdf
• Securing DoD Industrial Control Systems – Michael Chipley, The PMC Group.pdf
• Whats All the Fuzz About – Adam Crain and Chris Sistrunk.pdf
• Just Trust Me – Internet Enabled Devices with Integrity – Stacy Cannady.pdf
• Surviving the ICS Vulnerability Avalanche – Eric Byres, Belden.pdf
• The SCADA That Didnt Cry Wolf – Kyle Wilhoit, Trend Micro.pdf
• Information and Communication Technology Supply Chain Security – Emerging Solutions – Nadya Bartol, UTC.pdf
• Bridging the Security Governance Divide in Utilities – Andy Bochman.pdf
• Building Security into SCADA and ICS Products – George Wrenn and Paul Forney, Schneider Electric.pdf
• Virtual Dispersive Networking – Michael Seymour, Pike.pdf

https://files.sans.org/summits/scada13/ – 2013

• Zip file of all PDFs (updated 20130401)

• 13 Ways Through A Firewall What you dont know will hurt you.pdf
• 13 Ways through a Firewall – Andrew Ginter, Waterfall Security Solutions.pdf
• Growing up in Operations.pdf
• Putting SCADA Security to the Test.pdf
• SANS NetWars CyberCity Overview.pdf
• SANS Security Awareness for Utilities.pdf
• SANS STH Utility Poster CIP+CSC.pdf
• Security Expansion through Risk Analysis.pdf
• Security vs Compliance and SANS Securing the Utility Training and Awareness.pdf
• Threats Defined Updates from INL – Bri Rolston.pdf
• Water – Wastewater Plant Process Protection.pdf

https://files.sans.org/summits/scada12/ – 2012

• Zip file of all PDFs (updated 20120131)

• 20 Critical Controls.pdf
• Access Control and CIP .pdf
• Building Detection Capabilities.pdf
• Electric Sector Cybersecurity Risk Management Maturity Initiative.pdf
• Halfway There – Energy Sector Roadmap Five Years In.pdf
• Implementing Application Whitelisting – A Case Study.pdf
• Incident Management Workshop.pdf
• Michael Assante Keynote.pdf
• Needle_In_Haystack.pdf
• Progress in implementing the Roadmap to Achieve Energy Delivery Systems Cybersecurity.pdf
• Real-Life Users Talk the Talk.pdf
• Red Tiger Security Hacking SCADA 2011 in Review.pdf
• SANS-SCADA-PCS-2012-Automation-Systems-Management-Practical-Applications.pdf
• Security Monitoring.pdf
• Sophia.pdf
• Working Smarter – Job Performance Metrics for the Smart Grid.pdf

https://files.sans.org/summits/scada11/ – 2011

• Zip file of all PDFs (updated 20110303)

• ABB.pdf
• Beyond Compliance – ERCOT.pdf
• Black Box Testing Methodology_SANS.ppt.pdf
• Cyber Security and Critical Infrastructure Resilience.pdf
• Cyber Security Stuff n Junk – INL.pdf
• Define & Assess Skills – Smart Grid Security Specialists – NBISE.pdf
• Electric Sector Panel – Beyond Compliance.pdf
• Enhancing ICS Security – Rockwell.pdf
• FBI and Cyber Security.pdf
• How Control System Vendors are Responding to Emerging Vulnerabilities and Threats.pdf
• ICS Research Projects.pdf
• Learning – Build processes to learn from real world incidents.pdf
• NERC Critical Infrastructure Department (CID) and CIP Compliance Update.pdf
• NYISO Beyond Compliance.pdf
• Practical Steps to Securing Process Control Systems.pdf
• RCMP Technological Crime Branch.pdf
• Smart Grid Security Efforts @ Illinois.pdf
• Stuxnet Modus Operandi.pdf
• The Most Promising New Control System Research Projects.pdf
• US Cyber Challenge Finding the people who can win in cyberspace.pdf
• Waterfall One Way, Unidirectional connectivity for securing critical networks.pdf

https://files.sans.org/summits/scada10/ – 2010

• Zip file of all PDFs (updated 20100402)

• 14Tim Roxy.pdf
• 18 Gordon Rueff.pdf
• 32 McQuiggan-Siemens.pdf
• 34 Jasvir Gill – D2.pdf
• AlertEnterprise White paper.pdf
• Assante.pdf
• Austin 03 22 10-2-1.pdf
• Clifford Glantz.pdf
• Colin Blou.pdf
• Darrin Highfill.pdf
• Dixit Kashmit.pdf
• Greg Wright.pdf
• Jeff Kimmelman.pdf
• John Duronio.pdf
• Michael McDonald.pdf
• Michael Milvich.pdf
• Mo Ramanathan (3).pdf
• Nacio-Glantz-Monday-4PM-V2 (2).pdf
• NitroSecuirty control-system-security white paper.pdf
• NitroSecurity_Securing_Smarter_Grid White Paper.pdf
• Pallard Secruity Heroes SCADA Summit 2010.pdf
• Rita Wells.pdf
• Robert Huber.pdf
• Sean MCGurk.pdf
• Shelley Cottrill.pdf
• Siemens_SANS-Final.pdf
• Tom Winterhalter.ppt.pdf
• Waterfall for NRC Compliance whitepaper.pdf
• William Hunteman.pdf

https://files.sans.org/summits/scada09/ – 2009

• Zip file of all PDFs (updated 20090217)

• 2009 SANS Operator Authentication Presentation.pdf
• ABB_SANS_SCADA.pdf
• Alan Paller- SCADA Summit – The CAG – Earthquake in Security Compliance.pdf
• AMI Joel Garmon.pdf
• Critical Vulnerabilities – Jonathan Pollet.pdf
• Hacking AMI – Matt Carpenter.pdf
• INL-Assessments_SANS.pdf
• Juan Lopez – 2009 SANS SCADA Summit.pdf
• keynote_panel_mcgrew_PDF.pdf
• Keynote Panel-PenetrationTest – Ken Rohde.pdf
• Law Enforcement Perspective – MFabro, JMorgan, DSabourin, SFerensic.pdf
• Matt Carpenter – Pen Testing.pdf
• Michael Milvich serial security.pdf
• Mike Assante – SANS SCADA Summit Cyber Standards-DT.pdf
• Most Promising Results DOE Roadmap – antfarm – Bryan Richardson.pdf
• Most Promising Results DOE Roadmap – Bandolier – Dale Peterson.pdf
• Most Promising Results DOE Roadmap – Tom Flowers.pdf
• Patch Management – Kevin Staggs.pdf
• Patch Management – Kevin Sullivan.pdf
• Procurement Document-Rita_V6.pdf
• Research-Session-2009-Alfonso Valdes.pdf
• Research-Session-2009-Bryan Richardson.pdf
• Research-Session-2009- David Nicol.pdf
• Research-Session-2009- Mauricio Papa.pdf
• Research-Session-2009-Ulf Lindqvist-Zach Tudor.pdf
• S4_SANS.pdf
• SANS 2009 – Important Things (Byres-Dupler).pdf
• SANS Summit Cyber-Standards-DT_013009 Speaking.pdf
• SANS2009SCADASummit-PenetrationTestingPanel-INL-Rev1.pdf
• SANS_SCADA_Feb2009_ContSysVulns_Pollet.pdf
• Sample IT Change Management Policies and Procedures Guide (3).pdf
• SCADA Overview – Matt Luallen.pdf
• UK Information Sharing – Sheridan.pdf
• What Works in Sec Control Sys – Joel Garmon.pdf
• WhatWorks in Sec Control Sys – Mark Heard.pdf
• What Works in Sec Control Sys – Mike Firstenberg.pdf
• WhatWorks in Sec Control Sys – Sec in a Disaster – Tom Flowers.pdf
• WhatWorks in Sec Control Sys – Troy Embree.pdf
• WhatWorks in Security Control Sys – Stacy Bresler.pdf

https://files.sans.org/summits/scada08/ – 2008

• 01_Jason_Larsen.pdf
• 03_Ken_Rohde.pdf
• 04_Jeff_Fay.pdf
• 05_Jonathan_Pollet.pdf
• 07_Paul_Dorey.pdf
• 08_Larry_Spoonemore.pdf
• 09_Patrick_Miller_v2.pdf
• 10_Rita_Wells.pdf
• 12_Ulf_Lindqvist.pdf
• 13_Sean_Kujawa.pdf
• 14_David_Nicol.pdf
• 15_Tom_Stogdale.pdf
• 16_S_Hennin-TK_Luang.pdf
• 17_Vincent_Berk.pdf
• 19_Cheri_McGuire.pdf
• 20_Hank_Kenchington.pdf
• 27_Joe_Bucciero.pdf
• 30_Sharon_Xia.pdf
• 32_Stacy_Bresler.pdf
• Stan_Johnson_NERC_Cyber_Security_Standards.pdf

ICS Security Summit – Singapore – 2013

• https://files.sans.org/summits/icsapac13/
• • Zip file of all PDFs (updated 20131205)

• 10 Steps on the Road to a Successful Cyber Security Program – Markus Braendle.pdf
• Absence of the Normal Presence of the Abnormal – Tim Harwood.pdf
• Building the perfect ICS team – Tyler Williams & Paul Piotrowski.pdf
• Codenomicon Introduction Presentation.pdf
• Compass for the Compliance World – Tim Conway.pdf
• Cyber attack video link.pdf
• Global Industrial Cyber Security Professional Certification.pdf
• ICS Attack Surfaces – Dr. Eric Cole.pdf
• ICS Security Innovation – Mike Assante.pdf
• Innovation in Industrial Perimeter Security – Lior Frenkel.pdf
• SCADA Security Assessment Methodology The Malaysia Experience – Muhammad Reza Shariff.pdf
• Strengthening Information Protection in your ICS – Charles Liang.pdf
• The Good the Bad and the Ugly – Graham Speake.pdf
• The State of Control System Security – Daisuke Noguchi.pdf
• When a SOC is more than a SOC – Christina Kubecka.pdf

ICS Security Summit – Barcelona, Spain – 2012

• https://files.sans.org/summits/euscada12/
• • Zip file of all PDFs (updated 20121217)

• Dream Team – Building the Perfect SCADA Team – Tyler Williams & Auke Huistra.pdf
• Enisas Work on ICS and Smart Grid Security – Dr. Konstantinos Moulinos.pdf
• ICS Security – Time to React – Ruben Santamarta.pdf
• Implementing SCADA Security in the Real World – Franky Thrasher.pdf
• RedTigerSecurity_SCADA_2017.pdf
• Security Expansion Through Risk Anaylsis – Robert McComber.pdf
• Step by Step – The Journey to Secure SCADA Systems – Miguel Chavero.pdf
• The SCADA Battlefield Fighting the Enemy Within – Jess Garcia.pdf
• Virtually Protected SANS – Brian Endres.pdf
• Workforce Development for ICS Security – Michael J. Assante.pdf

ICS Security Summit – Rome, Italy – 2011

• https://files.sans.org/summits/euscada11/
• • Zip file of all PDFs (updated 20111212)

• Closing Keynote- The Four Forces Shaping the Future of Cybersecutiry and How Theyll Affect Your Career-Paller-02 Dec 1600.pdf
• Expert Briefing- Managing the Security of the Grid in the Cloud- Chiesa-1 Dec 1545.pdf
• Expert Briefing- Managing the Security of the Grid in the Cloud- Dan-1 Dec 1545.pdf
• Expert Briefing- Promising Techniques for SCADA Incident Mgmt -MELE – 1 Dec – 1300.pdf
• Expert Briefing-Promising Techniques for SCADA Incident Mgmt – Tieghi- 1 Dec- 1300.pdf
• Expert Briefing-Promising Techniques for SCADA Incident Mgmt – Zapparoli – 1 Dec- 1300.pdf
• Hacking SCADA Systems- 2011 in Review- Pollet – 1 Dec 1035.pdf
• Opening Keynote Panel- Who Can you trust -1 Dec-0815-Bergknut.pdf
• Opening Keynote Panel- Who Can you trust -1 Dec-0815-Sandra C.pdf
• Panel Smart Grid Security Smart Metering, Smart Grid, Smart Thinking or Watever is Really Smart-Ricetti-01 Dec 1430.pdf
• Panel- The Vendor Roundtable on Key Initiatives in Cybersecurity – Buffey-1 Dec- 1645.pdf
• Panel- The Vendor Roundtable on Key Initiatives in Cybersecurity – de Wijs-1 Dec- 1645.pdf
• Panel- User Awareness Training for Operators (and Top Managers as well) – Moller – 2 Dec-1030.pdf
• Panel- User Awareness Training for Operators (and Top Managers as well) – Wedlin- 2 Dec-1030.pdf
• Panel – Using Log Analysis and Forensics in Control Systems – Garcia 2 Dec -0900.pdf
• Remediation- What Works, What Doesnt – Wadsworth – 2 Dec-1130 revised.pdf
• Research Presentation- Critical Control Systems Vulnerabilities – And What to Do About Them – Knapp- 2 Dec 1515.pdf
• The Latest Lessons Learned from the US Smart Grid Rollout – Kenchingtont-1 Dec 1400 Kenchington.pdf

ICS Security Summit – London, England – 2010

• https://files.sans.org/summits/euscada10/
• • Zip file of all PDFs (updated 20101019)

• 01 Blou Waterfall.pdf
• 02 Butcher presentation – Fox DataDiode for CII.pdf
• 05 Holmgren SANS EU SCADA – 2010-10-12.pdf
• 07 Nitro-what-we-learned.pdf
• 08 BrandsetterStuxnet-Communication-tb.pdf
• 10 Wells Control sys vendors.pdf
• 11 Williams WIB Evolution – Version 1 To Version 2.pptx
• 12 Kwaspen.pdf
• 14 ABB_SANS_European_Summit.pptx
• 15 Hegret Rockwell SANS.pdf
• 16 Wells test bed.pdf
• 17 Mikale Welden SCADA security lab.pdf
• 18 Gabriele Oliva.pdf
• 23 Sandra C Benefits of Sharing – an Industry View.pdf
• 25 Cowlard CNI Boundaries Presentation.pdf
• 26 Bergknut ViCiSi.pdf
• 27 Dennis Anderson.pdf
• 29 Pollet APT.pdf
• 2 CPNI EU SANS SCADA oct 10.pdf
• 36 Sandra C Benchmarking_security_.pdf
• 38 Luiijf.pdf
• Baker sansscadaconf2.pptx
• Cyber Espionage EuroScada 2010.pptx
• Fabro_APT_SANSLondon.pdf
• SANS SCADA London_COMP.ppt
• V 2 Benchmarking_security_CPNI 13_Oct_2010 .ppt
• Viking City Simulator.pdf

ICS Security Summit – Stockholm, Sweden – 2009

• https://files.sans.org/summits/euscada09/
• • Zip file of all PDFs (updated 20091112)

• ABB White Paper.pdf
• ArcSight_WhitePaper.pdf
• Erik Johansson – Virtualization in the Control Environment.pdf
• Gitte Bergknut – Control Systems at Risk – EuroSCADA 2009.pdf
• Joe Cummins – Open Sourced Intelligence and Industrial Control Systems.pdf
• Jonathan Pollet RTS_AMR_MilitaryBaseCaseStudy.pdf
• NitroSecurity White Paper.pdf
• Sandro Bologna – ENEA Protecting the Energy Infrastructure.pdf
• SANS White Paper Sponsor NitroSecurity – Sec Smrtr Grd.pdf

ICS Security Summit – Amsterdam, Netherlands – 2008

• https://files.sans.org/summits/euscada08/
• • Zip file of all PDFs (updated 20080925)

• Ake Holmgren – SANS EU SCADA – Information sharing panel.pdf
• Alan Paller – SANS Euro SCADA Summit Sept 2008.pdf
• Eric Verheul – SANS.pdf
• F Martens – SANS 2008 Presentation.pdf
• Gitte Bergknut – EU SANS SCADA Security Summit 2008 2008-09-09.pdf
• Goran_Ericsson – Govt & Indust Experts Global strategy.pdf
• Goran_Ericsson – Keynote – SANS_Amsterdam_.pdf
• Hans Honecker – 080908_SCADA_Summit_German_BSI-FINAL.pdf
• Helle Stoltz – SANS konferanse 2008.pdf
• Karl Henderson – IDProductSalesExecutive-SANS.pdf
• Mattias Ekstedt – VIKING at SANS (080908 MEk).pdf
• P. Schaeffer – SANS_SCADA_2008_-_Schaeffer_TUV.pdf
• Ragnar Schierholz – ABB_SANS_Euro_SCADA_Security_Summit.pdf
• Rita Wells – EU-SANS-Common-Vul-Sept-08-08.pdf
• Rita Wells – Proc-Spec-Aug08-V2-.pdf
• Rita Wells – Responsible-Disclosure-Sept-09-08.pdf
• Robert Malmgren – SCADA Euro Summit.pdf
• Roelof Klein SANS.pdf
• Roger – SCADA STRATEGY EURO SANS 2008 ISSUED.pdf
• Sinclair Koelemij – SANS Scada Vendor session.pdf
• SANS EU SCADA – Holmgren comments on CPNI keynote – for public distribution.pdf

from: https://ics.sans.org/resources/summit-archives

Resources: Whitepapers

• Media report of the Baku-Tbilisi-Ceyhan (BTC) pipeline Cyber Attack

• An Abbreviated History of Automation & Industrial Controls Systems and Cybersecurity

• Industrial Control Systems (ICS) Cybersecurity Response to Physical Breaches of Unmanned Critical Infrastructure Sites Whitepaper

• ICS CPPE case Study 2-German Steelworks Facility

SANS Forensics Whitepapers

White Papers are an excellent source for information gathering, problem-solving and learning. Below is a list of White Papers written by forensic practitioners seeking GCFA, GCFE, and GREM Gold. SANS attempts to ensure the accuracy of information, but papers are published “as is”.

Errors or inconsistencies may exist or may be introduced over time. If you suspect a serious error, please contact webmaster@sans.org.

SANS Forensics Whitepapers

Paper	Author	Cert
Intelligence-Driven Incident Response with YARA	Ricardo Dias	GCFA
Review of Windows 7 as a Malware Analysis Environment	Adam Kramer	GREM
Straddling the Next Frontier Part 2: How Quantum Computing has already begun impacting the Cyber Security landscape	Eric Jodoin	GCFA
Case Study: 2012 DC3 Digital Forensic Challenge Basic Malware Analysis Exercise	Kenneth Zahn	GREM
Detailed Analysis Of Sykipot (Smartcard Proxy Variant)	Rong Hwa Chong	GREM
Windows ShellBag Forensics in Depth	Vincent Lo	GCFA
A Detailed Analysis of an Advanced Persistent Threat Malware	Frankie Fu Kay Li	GREM
Forensic Images: For Your Viewing Pleasure	Sally Vandeven	GCFA
Analyzing Man-in-the-Browser (MITB) Attacks	Chris Cain	GCFA
Using IOC (Indicators of Compromise) in Malware Forensics	Hun Ya Lock	GREM
A Journey into Litecoin Forensic Artifacts	Daniel Piggott	GCFA
MalwareD: A study on network and host based defenses that prevent malware from accomplishing its goals	Dave Walters	GREM
Clash of the Titans: ZeuS v SpyEye	Harshit Nayyar	GREM
An Opportunity In Crisis	Harshit Nayyar	GREM
Comprehensive Blended Malware Threat Dissection Analyze Fake Anti-Virus Software and PDF Payloads	Anthony Cheuk Tung Lai	GREM
Creating a Baseline of Process Activity for Memory Forensics	Gordon Fraser	GCFA
Automation of Report and Timeline-file based file and URL analysis	Florian Eichelberger	GCFA
Repurposing Network Tools to Inspect File Systems	Andre Thibault	GCFA
Enhancing incident response through forensic, memory analysis and malware sandboxing techniques	Wylie Shanks	GCFA
Using Sysmon to Enrich Security Onion’s Host-Level Capabilities	Joshua Brower	GCFA
Indicators of Compromise in Memory Forensics	Chad Robertson	GCFA
Forensicator FATE – From Artisan To Engineer	Barry Anderson	GCFA
Computer Forensic Timeline Analysis with Tapestry	Derek Edwards	GCFA
Windows Logon Forensics	Sunil Gupta	GCFA
Windows Logon Forensics	Sunil Gupta	GCFA
What’s in a Name: Uncover the Meaning behind Windows Files and Processes	Larisa Long	GCFA
Analysis of a Simple HTTP Bot	Daryl Ashley	GREM
XtremeRAT – When Unicode Breaks	Harri Sylvander	GREM
Analysis of the building blocks and attack vectors associated with the Unified Extensible Firmware Interface (UEFI)	Jean Agneessens	GREM
Mobile Device Forensics	Andrew Martin	GCFA
Mac OS X Malware Analysis	Joel Yonts	GCFA
Building a Malware Zoo	Joel Yonts	GREM
Mastering the Super Timeline With log2timeline	Kristinn Gudjonsson	GCFA
A Regular Expression Search Primer for Forensic Analysts	Timothy Cook	GCFA
Identifying Malicious Code Infections Out of Network	Ken Dunham	GCFA
Live Response Using PowerShell	Sajeev Nair	GCFA
Forensic Analysis on iOS Devices	Tim Proffitt	GCFE
CC Terminals, Inc.Forensic Examination Report: Examination of a USB Hard Drive	Brent Duckworth	GCFA
Unspoken Truths – Forensic Analysis of an Unknown Binary	Louie Velocci	GCFA
Forensic Analysis of a SQL Server 2005 Database Server	Kevvie Fowler	GCFA
Taking advantage of Ext3 journaling file system in a forensic investigation	Gregorio Narvaez	GCFA
Lessons from a Linux Compromise	John Ritchie	GCFA
Forensic Analysis of a Compromised NT Server(Phishing)	Andres Velazquez	GCFA
Analysis of a serial based digital voice recorder	Craig Wright	GCFA
Analysis of an unknown USB JumpDrive image	Roger Hiew	GCFA
Forensic Investigation of USB Flashdrive Image for CC Terminals	Rhonda Diggs	GCFA
Discovering Winlogoff.exe	Jennie Callahan	GREM
GIAC GREM Assignment – Pass	Joe Fresch	GREM
Analysis of an unknown disk	Jure Simsic	GCFA
Integrating Forensic Investigation Methodology into eDiscovery	Jeff Groman	GCFA
Analysis of a Windows XP Professional compromised system	Manuel Humberto Santander Pelaez	GCFA
Analysis of a Commercial Keylogger installed on multiple systems	Merlin Namuth	GCFA
GIAC GREM Assignment – Pass	David Chance	GREM
Reverse Engineering the Microsoft exFAT File System	Robert Shullich	GCFA
How not to use a rootkit	Mike Wilson	GCFA
Forensic Analysis on a compromised Linux Web Server	Jeri Malone	GCFA
Analysis of a Red Hat Honeypot	James Shewmaker	GCFA
GIAC GREM Assignment – Pass	James Shewmaker	GREM
Forensic with Open-Source Tools and Platform: USB Flash Drive Image Forensic Analysis	Leonard Ong	GCFA
Forensic analysis of a Windows 2000 computer literacy training and software development device	Golden Richard	GCFA
GIAC GREM Assignment – Pass	James Balcik	GREM
Forensic Analysis Procedures of a Compromised system using Encase	Jeffrey McGurk	GCFA
Forensic analysis of a Compromised Windows 2000 workstation	Charles Fraser	GCFA
Forensic Analysis on a compromised Windows 2000 Honeypot	Peter Hewitt	GCFA
Evaluation of Crocwareis Mount Image Pro as a Forensic Tool	Hugh Tower-Pierce	GCFA
Forensic Tool Evaluation-MiTeC Registry File Viewer	Kevin Fiscus	GCFA
Camouflaged and Attacked?	Bertha Marasky	GCFA
Review of Foundstone Vision as a forensic tool	Bil Bingham	GCFA
Forensic Analysis of a Compromised Intranet Server	Roberto Obialero	GCFA
Analysis of an IRC-bot compromised Microsoft Windows system	Jennifer Kolde	GCFA
HONORS-Analysis of a USB Flashdrive Image	Raul Siles	GCFA
Safe at Home?	David Perez	GCFA
Evaluation of a Honeypot Windows 2000 Server with an IIS Web/FTP Server	Kenneth Pearlstein	GCFA
Forensic Analysis of a USB Flash Drive	Norrie Bennie	GCFA
Open Source Forensic Analysis – Windows 2000 Server –	Andre Arnes	GCFA
Forensic Analysis of dual bootable Operating System (OS) running a default Red Hat 6.2 Linux server installation and Windows 98	Mohd Shukri Othman	GCFA
An Examination of a Compromised Solaris Honeypot, an Unknown Binary, and the Legal Issues Surrounding Incident Investigations	Robert Mccauley	GCFA
Forensic Analysis of an EBay acquired Drive	Daniel Wesemann	GCFA
Analyze an Unknown Image and Forensic Tool Validation: Sterilize	Steven Becker	GCFA
Malware Adventure	Russell Elliott	GREM
Binary Analysis, Forensics and Legal Issues	Michael Wyman	GCFA
Analysis on a compromised Linux RedHat 8.0 Honeypot	Jeff Bryner	GCFA
Forensic analysis of a compromised RedHat Linux 7.0 system	Jake Cunningham	GCFA
Validation of Norton Ghost 2003	John Brozycki	GCFA
Forensic Analysis of Shared Workstation	Michael Kerr	GCFA
Forensic Analysis on a Windows 2000 Pro Workstation	David Cragg	GCFA
Sys Admins and Hackers/Analysis of a hacked system	Lars Fresen	GCFA
Validation of ISObuster v1.0	Steven Dietz	GCFA
GIAC GREM Assignment – Pass	Gregory Leibolt	GREM
Analysis of a Potentially Misused Windows 95 System	Gregory Leibolt	GCFA
Forensic Analysis Think pad 600 laptop running Windows 2000 server	Brad Bowers	GCFA
Validation of Restorer 2000 Pro v1.1 (Build 110621)	Denis Brooker	GCFA
Analysis of a Suspect Red Hat Linux 6.1 System	James Fung	GCFA
Dead Linux Machines Do Tell Tales	James Fung	GCFA
Analysis and Comparison of Red Hat Linux 6.2 Honeypots With & Without LIDS-enabled Kernels	Greg Owen	GCFA
Analyzing a Binary File and File Partitions for Forensic Evidence	James Butler	GCFA
Becoming a Forensic Investigator/Use of Forensic Toolkit	Mark Maher	GCFA
Discovery Of A Rootkit: A simple scan leads to a complex solution	John Melvin	GCFA
GIAC GREM Assignment – Pass	Lorna Hutcheson	GREM
Forensic Analysis of a Windows 2000 server with IIS and Oracle	Beth Binde	GCFA
Forensic Analysis of a Sun Ultra System	Tom Chmielarski	GCFA
Reverse Engineering msrll.exe	Rick Wanner	GREM
Forensic Validity of Netcat	Michael Worman	GCFA
CC Terminals Harassment Case	Dean Farrington	GCFA
Forensic analysis of a compromised Linux RedHat 7.3 system	Kevin Miller	GCFA
Validation of Process Accounting Records	Jim Clausing	GCFA
Building an Automated Behavioral Malware Analysis Environment using Open Source Software	Jim Clausing	GREM
Forensic analysis of a Windows 98 system	Jerry Shenk	GCFA
Forensic analysis of a Compromised Red Hat 7.2 Web Server	Martin Walker	GCFA

from: http://digital-forensics.sans.org/community/whitepapers

SANS Digital Forensics Community: Summit Archives

SANS has held Digital Forensics Summits over the past years. Presentations given at these Summits are available for public viewing and download here.

Interested in learning more?

Cyber Threat Intelligence Summit 2015

• A Case Study in Competing Hypotheses
  Mike Cloppert, Lockheed Martin
• Big Data Big Mess
  Sound Risk Intelligence Through Complete Context (SurfWatch Labs)
• Cyber Risk Report December 2014
  SurfWatch Labs
• Cyber Threat Intelligence SANS360
• DNS As a Control Point for Cyber Risk
  Dr Paul Vixie, Farsight Security
• From Threat Intelligence to Defense Cleverness – A Data Science Approach
  Alex Pinto, Niddel
• Maltego Kung Fu Exploiting Open Source Threat Intelligence
  Matt Kodama, Recorded Future
• Reconciling Objective Data with Analytical Uncertainty
  Ruth Cuddyer, Lockheed Martin CIRT
• Results and Analysis of the SANS 2014 Analytics and Intelligence Survey
  Mike Cloppert
• State of Cyber Threat Intelligence Address
  Rick Holland, Forrester Research
• Taming Your Indicator Consumption Pipeline
  Ryan Stillions, Vigilant LLC
• The Most Dangerous Game – Hunting Adversaries Across the Internet
  Kyle Maxwell, Verisign iDefense and Scott Roberts, GitHub
• Tumble, Twiddle, Spin and Roll the Black Hat – Incorporating CTI into Security Assessment Programs
  Michael Willburn

Digital Forensics and Incident Response Summit Prague 2014

• Collaborative Timeline Analysis in Large Incidents
  Johan Berggren
• DFIR Prague 2014 Programme Agenda
• Finding the Needle in the Haystack with FLK
  Christophe Vandeplas
• Forensic Analysis of MySql DB Systems
  Marcel Niefindt
• Give Me the Password and I’ll Rule the World
  Francesco Picasso
• One Location to Rule Them All
  Pasquale Stirparo
• Rekall Memory Forensics
  Michael Cohen
• Tor Forensics on Windows OS
  Mattia Epifani
• Windows Shellbags Forensics in Depth
  Vincent Lo

Digital Forensics and Incident Response Summit 2014

• 10 Ways to Make Your SOC More Awesome
  Shelly Giesbrecht
• Anatomy of a Breach – The Lifecycle of Cyber Crime
  Jonathan Spruill
• Automating Linux Memory Capture
  Hal Pomeranz
• Best Finds for 2014
  David Cowen and Matthew Seyer
• BlackBerry Forensic Nuggets
  Shafik Punja and Cindy Murphy
• Closing the Door on Web Shells
  Anuj Soni
• Don’t Drop That Table – A Case Study in MySQL Forensics
  Jeff Hamm
• Don’t Let Your Tools Make You Look Bad
  Troy Larson
• Forensic 4cast Awards
  Lee Whitfield
• Incident Response Patterns
  Kyle Maxwell and Kevin Thompson
• Modern Incident Response
  JJ Guy
• Peeling the Application Like An Onion
  Lee Reiber
• Pillars of Incident Response
  Brandie Anderson
• Public Research – Influencing Change in DFIR Tools
  Dan Pullega
• Reverse Engineering Mac Malware
  Sarah Edwards
• Supersize Your Internet Timeline with Google Analytic Artifacts
  Mari DeGrazia
• Targeted Campaign Analysis and Tracking
  Christopher Witter
• To Silo or Not to Silo
  Frank McClain
• USB Devices and Media Transfer Protocol
  Nicole Ibrahim
• Why Hunt When You Can Seine
  Dave Hull
• Windows 8 File History Analysis
  Kausar Khizra and Nasa Quba
• SANS 360

What Works in Cyber Threat Intelligence Summit 2014

• Agile Defensive Technologies
  Robert Johnston
• Building an Effective Corporate Cyber Threat Intelligence Practice
  Greg Rattray
• Cyber Threat Intelligence 360
• Emergent Ideas in Cyber Threat Intelligence
  Mike Cloppert
• Leveraging File Artifacts for Threat Intelligence
  David Dorsey
• Moving from SIEM to Security Analytics Evolution or Starting Over Panel
• Recent Threat Trend Analysis
  Scott Montgomery
• The Diamond Model for Intrusion Analysis A Primer
  Andy Pendergast
• The Dollars and Sense Behind Threat Intelligence Sharing
  Rich Barger
• Threat Intelligence Buyers Guide
  Rick Holland
• Threat Intelligence for Incident Response
  Kyle Maxwell

Forensics Prague 2013

• Applications Credentials Harvesting from Android Memory
  Pasquale Stirparo
• Blue Team Perspectives
  David Kovar
• Catching Bayas on the wire
  Ismael Valenzuela
• Cloud Storage Forensics
  Mattia Epifani
• EVTXtract
  Willi Ballenthin
• Exchange in the Cloud – Investigative and Forensic Aspects of Office 365
  Owen O’Connor
• Expert Witness Testimony
  Prickaerts
• Hypervisor Memory Forensics
  Mariano Graziano and David Balzarotti
• New School Forensics
  Chad Tilbury
• Open Source Tools for Mobile Forensics
  Mattia Epifani
• Proc Dot Visual Malware Analysis
  Christian Wojner
• SANS 360 ICS Forenscis
  Rob Lee
• Underwater Mobile Forensics
  Arturo Rodriguez Olmedo
• Week in the Life of a DFIR
  Elizabeth Schweinsberg
• Your Workflow is NOT my workflow
  Joachim Metz
• Acquisition and Analysis of iOS Devices
  Mattia Epifani
• Common analysis Mistakes and Pitfalls
  Christian Prickaerts

Digital Forensics and Incident Response Summit 2013

• 7 Sins of Malware Analysis
  Dominique Kilman
• A Day in the Life of a Cyber Tool Developer
  Jonathan Tomczak
• Autopsy 3 Extensible Open Source Forensics
  Brian Carrier
• Building, Maturing & Rocking a Security Operations Center
  Brandie Anderson
• Cyber Nightmares – Red October & Shamoon
  Harold Rodriguez
• Detecting Data Loss from Cloud Synchronization Applications
  Jake Williams
• Facilitating Fluffy Forensics
  Andrew Hay
• File System Journaling Forensics Theory, Procedures and Analysis Impacts
  David Cowen with Matthew Seyer
• Finding Malware Like Iron Man
  Corey Harrell
• Forensic 4Cast Awards
  Lee Whitfield
• Hunting Attackers with Network Audit Trails
  Tom Cross and Charles Herring
• ICS, SCADA and Non-Traditional Incident Response
  Kyle Wilhoit
• Johnny AppCompatCache – the Ring of Malware
  Brice Daniels and Mary Singh
• Mining for Evil
  John McLeod Mike Pilkington
• My Name is Hunter – Ponmocup Hunter
  Tom Ueltschi
• Offense Informs Defense – Or Does It
  Jeff Brown
• Open Source Threat Intelligence
  Kyle Maxwell
• Plaso – Reinventing the Super Timeline
  Kristinn Gudjonsson
• Proactive Defense
  Jason Geffner
• Volatile IOCs for Fast Incident Response
  Haruyama
• DFIR SANS360

What Works in Cyber Threat Intelligence Summit 2013

• Intelligence-Driven Security
  Adam Meyers, CrowdStrike
• Better Tools Through Intelligence, Better Intelligence through Tools
  Reid Gilman, MITRE
• Leveraging CTI to take the fight to adversary
  Rick Holland
• Non APT Trends by Vertical
  John Ramsey, SecureWorks
• SANS 360
• The Evolution of Cyber Threats and Cyber Threat Intelligence
  Greg Rattray
• Ghosh 360 video

Forensics Prague 2012

• (Everyday) Malware Gone APT
  Bojan Zdrnja
• Malware Analysis Tools
  Christian Wojner
• The WOW Effect – or how Microsoft’s WOW64 technology unintentionally fools IT Security analysts
  Christian Wojner
• Toward More Effective Incident Response
  Portable Incident Response Environment and Incident Response Management
  David Kovar
• Carve for Records Not Files
  Jeff Ham
• ACAD/Medre.A A Case Study of an Individual Attack
  Righard J. Zwienenberg
• Challenges in Physical Extraction of Modern Smartphones and Advance Methods to Overcome
  Yuval Ben-Moshe

Forensics and Incident Response Summit 2012

• Recovering Digital Evidence in a Cloud Computing Paradigm
  Jad Saliba
• Sniper Forensics v3 Hunt
  Christopher Pogue
• Why not to stay in your lane as a digital forensic examiner
  Alissa Torres
• Windows 8 Recovery Forensics – Understanding the Three R’s
  W. Kenneth Johnson
• Decade of Agression
  Christopher Witter
• Exfiltration Forensics in the Age of the Cloud
  Frank McClain
• Passwords are Everywhere!
  Hal Pomeranz
• Security Cameras – The Corporate DFIR Tool of the Future
  Michael Viscuso
• DFIR SANS360 Talks
  Andrew Case, Ken Johson, Cindy Murphy, Harlan Carvey, Hal Pomeranz, Kristinn Gudjonsson, Corey Harrell, Melia Kelley, Tim Ray, Alissa Torres, David Nides
• Practical use of cryptographic hashes in forensic investigations
  Pär Österberg Medina
• Digital Forensics for IaaS Cloud Computing
  Josiah Dykstra
• Taking Registry Analysis to the Next Level
  Elizabeth Schweinsberg
• Tales from the Crypt – TrueCrypt Analysis
  Hal Pomeranz
• Windows 7 Forensic Analysis
  H. Carvey
• Evidence is Data – Why you have the advantage
  Jon Stewart
• 6-blind-monks
  Det. Cindy Murphy, M.Sc.
• Analysis and Correlation of Macintosh Logs
  Sarah Edwards
• Android Mind Reading – Memory Acquisition and Analysis with LiME and Volatility
  Joe Sylve
• Digital Dumpster Diving an investigative analysis
• Anti-Incident Response
  Nick Harbour
• Automating File Analysis
  Pär Österberg Medina
• Building and Maintaining a Digital Forensic Lab – Panel
  Art Ehuan
• Building and Maintaining a Digital Forensic Lab – Panel
  Willy Straubhaar
• Building and Maintaining a Digital Forensics Lab – Panel
  Jeff Hamm
• Building and Maintaining a Digital Forensics Lab – Panel
  David Nides
• Carve for Record not Files
  Jeff Hamm
• Mac Memory Analysis with Volatility
  Andrew Case
• When Macs get Hacked
  Sarah Edwards

Forensics and Incident Response Summit 2011

• Bamm Visscher General Electric Company
  Bamm Visscher
• Building a team from within
  Detective Joe Garcia
• Computer Incident Response Team
  Richard Bejtlich
• Digital Forensics and Flux Capacitors
  Lee Whitfield
• EXT3 File Recovery via Indirect Blocks
  Hal Pomeranz
• EXT4 Bit by Bit
  Hal Pomeranz
• Five Point Palm Exploding Heart Technique for Forensics
  Andrew Hay
• Forensic 4cast Awards
  No Speaker
• Forensics in the New Cloud Frontier
  Andrew Hay
• Incident Response from Computer Network Defense
  Michael Cloppert
• iOS Forensics
  Sean Morrissey
• IR Process and Smart Phones
  Terrance Maguire
• log2timeline Since 2009
  Kristinn Guðjónsson
• Priorities: Personal and Professional
  Ken Dunham
• Protecting Privileged Domain Accounts during Live Response
  Mike Pilkington
• Sniper Forensics V2.0 Target Acquisition
  Christopher E. Pogue

EU Digital Forensics and Incident Response Summit 2011

• Ad-hoc File System Forensics
  Andreas Schuster
• All the Gear..and No Idea.. – Scalable, fast & forensically sound incident response using “NOOBS”
  Andrew Sheldon MSc.
• Detecting and Stopping Malware & Exploit Packages on the Wire – Case Study: SCADA Environments (Part 1)
  Righard J. Zwienenberg
• Detecting and Stopping Malware & Exploit Packages on the Wire – Case Study: SCADA Environments (Part 2)
  Righard J. Zwienenberg
• Retrieving Internet Chat History with the Same Ease as a Squirrel Cracks Nuts
  Yuri Gubanov CEO, Belkasoft
• A Hacker’s Guide To Incident Response
  David Stubley
• Memory Analysis Update Tools & Techniques 2011
  Andreas Schuster
• Rock Around the Clock
  Lee Whitfield
• Turning Android Inside Out – DFRWS 2011 Challenge
  Ivo Pooters, Fox-IT
• The Fight Against eCrime – A Small Nation’s story
  Peter Gwyn Williams
• 8 Days a Week – Verizon Data Breach Investigations Report 2011
  Jelle Niemantsverdriet

US Digital Forensic and Incident Response Summit 2010

• Answering the Call – Fighting Digital Crime
  Christopher E. Pogue & Major Carole Newell
• Sniper Forensics – “One Shot, One Kill”
  Christopher E. Pogue
• Combating Malware in the age of APT
  Jason Garman
• Registry and Timeline Analysis
  Harlan Carvey
• How to Analyze Drive-by Exploit Frameworks
  Ken Dunham
• Evolution of Binary Code Analysis
  Jason Garman
• Malware Analysis Panel
  Nick Harbour
• ExFAT (Extended FAT) File System: Revealed and Dissected
  Jonathan Ham
• Windows 7: Current Events in the World of Windows Forensics
  Troy Larson
• Network Payload Analysis for Advanced Persistent Threats
  Charles Smutz
• Next Generation Windows Forensics Panel
  Harlan Carvey
• What Windows Area Needs Additional Research and Development?
  Jesse Kornblum
• Drive Encryption
  Jason A. Lord
• Encryption V20.10
  Jason A. Lord
• Beyond Fuzzy Hashing
  Jesse Kornblum
• Bringing a Knife to a Gun Fight: The Arsenal Required for Modern Forensic Combat!
  Andrew Hay
• Sourcefire Presentation
  Matt Olney
• Network Forensics Panel
  Andrew Hay
• How has the APT changed the way we approach network forensics?
  Charles Smutz
• CIRT-Level Response to Advanced Persistent Threat
  Richard Bejtlich
• APT Panel
  Richard Bejtlich
• What can organizations do immediately to put them in a better position to investigate an APT breach?
  Shawn Carpenter
• Evolution of APT State of the ART
  Michael Cloppert
• Examples of Recent APT Persistence Mechanisms
  Christopher Glyer
• Cloppert Example Deck
  Michael Cloppert
• Intelligence-Driven Response
  Michael Cloppert
• Shadow Warriors
  Lee Whitfield & Mark McKinnon
• Vendor Solutions Panel
  David Nardoni
• SIEM @ CAP
  Nick Levay
• CIRT-Level Response to Advanced Persistent Threat
  Richard Bejtlich
• SANS Forensic Challenge: “Ann’s Aurora”
  Sherri Davidoff, Eric Fulton & Jonathan Ham
• Locating Live Kits
  Ken Dunham
• NetWitness Investigator Freeware: Network Intelligence, Threat Indicators and Session Exploitation
  Brian Girardi
• NextGen Architechture
  NetWitness

EU Digital Forensic and Incident Response Summit 2010

• Advanced File Carving
  Bas Kloet
• New Computer Forensics Techniques Panel
  Bas Kloet
• Legal and Law Enforcement Panel
  Bev Nutter
• New Computer Forensics Techniques Panel
  Dr. Katrin Franke
• Trends and Challenges in Applying Artificial Intelligence Methodologies to Digital Forensics
  Dr. Katrin Franke
• New Computer Forensics Techniques Panel
  Emma Webb Hobson
• Legal and Law Enforcement Panel
  Henrik Kaspersen
• Beyond Fuzzy Hashing
  Jesse Kornblum
• Computer Forensic Tool Panel
  Jesse Kornblum
• Computer Forensic Tool Panel
  Kristinn Gudjonsson
• Mastering the Super Timeline
  Kristinn Gudjonsson
• Verizon Data Breach
  Matt van de Wel
• Blue Screen of Death is Dead
  Matthieu Suiche
• Computer Forensics Tool Panel
  Matthieu Suiche
• Legal and Law Enforcement Panel
  Maury Shenk
• Computer Forensics Tool Panel
  Righard Zwienenberg
• Retrieving Information Then What
  Righard Zwienenberg
• User Panel
  Wayne Micklethwaite

US Digital Forensic and Incident 2009

• SANS IR and Forensics Summit Keynote
  Richard Bejtlich
• Rapid Analysis of Live Response Data
  Kris Harms
• Essential Incident Response Panel
  Ken Bradley
• Essential Incident Response
  Harlan Carvey
• Essential Incident Response Panel
  Kris Harms
• Essential Incident Response
  Dave Hull
• Essential Incident Response Panel
  Chris Pogue
• Incident Response Panel
  Ken Bradley
• Modern Enterprise Incident Response
  Dave Merkel
• Forensics Tools Panel
  Jesse Kornblum
• Forensics Tools Panel
  Troy Larson
• Forensics Tools Panel
  Mark McKinnon
• Forensics Tools Panel
  Jess Garcia
• Registry Analysis
  Harlan Carvey
• Memory Forensics Analysis Essentials
  Jamie Butler & Peter Silberman
• Registry Analysis and Memory Forensics
  Dolan Gavitt
• Solutions for Memory Forensics & Automated Malware Reversing
  Rich Cummings
• Lessons Learned from the Financial InfoSec Trenches
  Alex Cox
• Digital Evidence: A New Generation in Criminal Investigations
  Chris Kelly
• Working With Law Enforcement
  Jennifer Kolde
• Working With Law Enforcement
  Cindy Murphy
• Working With Law Enforcement
  Ken Privette
• Working With Law Enforcement
  Paul Vitchock
• Working With Law Enforcement
  Doug White
• Working With Law Enforcement
  Beth Whitney
• Forensic Challenges in the Courtroom
  Craig Ball
• Forensic Challenges in the Courtroom
  Larry Daniel
• Forensic Challenges in the Courtroom
  Stroz Friedberg
• Forensic Challenges in the Courtroom
  Gary Kessler
• Forensic Challenges in the Courtroom
  Doug White
• Mobile Forensics Behind Bars
  Sterling Bryan
• Mobile Device Forensic Essentials
  Eoghan Casey
• The Case for Network Forensics
  Joe Levy
• F-Response, 9 Months Later…
  Matthew Shannon
• User Panel
  Richard Brittson
• User Panel
  Nolan Clifford
• User Panel
  James Zinn
• Vendor Panel: Briefing on EnCase® Portable
  Jim Butterworth
• An Ocean of Data
  Ken Privette

Computer Forensic Summit 2008

• Upping the ‘Anti’: Using Memory Analysis to Fight Malware
  Aaron Walters
• Technology Pathways Product Overview
  Chris Brown
• IR/Forensics Team Strategy Panel
  Chris Novak
• IR/Forensics Team Tactics Panel
  Chris Novak
• IR/Forensics Team Tactics Panel
  Eric Gentry
• Using the Home Advantage: Combating Anti-Forensics and Linkage Blindness
  Chris Daywalt & Eoghan Casey
• Summit Table of Contents
  SANS
• Strategy Panel
  Harlan Carvey
• Tactics Panel
  Harlan Carvey
• The Secrets of Registry Analysis
  Harlan Carvey
• Strategy Panel
  Ken Bradley & Kris Harms
• Tactics Panel
  Ken Bradley & Kris Harms
• ManTech Presentation
  Henri Van Goethem
• Forensics Panel
  Mike Poor & Tom Liston
• Tactics Panel
  Mike Poor & Tom Liston
• iPhone Forensics
  Forward Discovery
• User Panel
  Lance Mueller
• Mandiant Tactical Incident Response Panel
  Ken Bradley & Kris Harms
• F-Response: Extend Your Arsenal
  Matt Shannon
• Successful Strategies in Enterprise Intrusion Investigations
  Michael Cloppert
• Castle Warrior
  Monty McDougal
• 7-Minute Presentation
  Ovie Carroll
• Forensic Trends & Future: Shifting the Forensics Paradigm
  Ovie Carroll
• Forensic Summit 2008 Keynote
  Richard Bejtlich
• Forensics and IR Counterinsurgency Field Manual
  Rob Lee
• Slaying the Red Dragon: Remediating the China Cyber Threat
  Ken Bradley & Wendi Rafferty
• Strategy Panel
  Stroz Friedberg

SANS Investigative Forensic Toolkit (SIFT) Workstation Version 3

Download SIFT Workstation VMware Appliance Now – 1.5 GB

Having trouble downloading?
If you are having trouble downloading the SIFT Kit please contact sift-support@sans.org and include the URL you were given, your IP address, browser type, and if you are using a proxy of any kind.

Having trouble with SIFT 3?
If you are experiencing errors in SIFT 3 itself, please submit errors, bugs, and recommended updates here: https://github.com/sans-dfir/sift/issues

How To:

1. Download Ubuntu 14.04 ISO file and install Ubuntu 14.04 on any system. -> http://www.ubuntu.com/download/desktop
2. Once installed, open a terminal and run “wget –quiet -O – https://raw.github.com/sans-dfir/sift-bootstrap/master/bootstrap.sh | sudo bash -s — -i -s -y”
3. Congrats — you now have a SIFT workstation!!

Page Links

• SIFT Workstation 3 Overview
• Download SIFT Workstation 3 Locations
• Manual SIFT 3 Installation
• SIFT Workstation 3 Capabilities
• SIFT Workstation 3 How-Tos
• Report Bugs
• SIFT Recommendations

---

SIFT Workstation 3 Overview

An international team of forensics experts, led by SANS Faculty Fellow Rob Lee, created the SANS Investigative Forensic Toolkit (SIFT) Workstation and made it available to the whole community as a public service. The free SIFT toolkit, that can match any modern forensic tool suite, is also featured in SANS’ Advanced Computer Forensic Analysis and Incident Response course (FOR 508). It demonstrates that advanced investigations and responding to intrusions can be accomplished using cutting-edge open-source tools that are freely available and frequently updated.

Offered free of charge, the SIFT 3 Workstation will debut during SANS’ Advanced Computer Forensic Analysis and Incident Response course (FOR508) at DFIRCON. SIFT 3 demonstrates that advanced investigations and responding to intrusions can be accomplished using cutting-edge open-source tools that are freely available and frequently updated.

“Even if SIFT were to cost tens of thousands of dollars, it would still be a very competitive product,” says, Alan Paller, director of research at SANS. “At no cost, there is no reason it should not be part of the portfolio in every organization that has skilled forensics analysts.”

Developed and continually updated by an international team of forensic experts, the SIFT is a group of free open-source forensic tools designed to perform detailed digital forensic examinations in a variety of settings. With over 100,000 downloads to date, the SIFT continues to be the most popular open-source forensic offering next to commercial source solutions.

“The SIFT Workstation has quickly become my “go to” tool when conducting an exam. The powerful open source forensic tools in the kit on top of the versatile and stable Linux operating system make for quick access to most everything I need to conduct a thorough analysis of a computer system,” said Ken Pryor, GCFA Robinson, IL Police Department

Key new features of SIFT 3 include:

• Ubuntu LTS 14.04 Base
• 64 bit base system
• Better memory utilization
• Auto-DFIR package update and customizations
• Latest forensic tools and techniques
• VMware Appliance ready to tackle forensics
• Cross compatibility between Linux and Windows
• Option to install stand-alone via (.iso) or use via VMware Player/Workstation
• Online Documentation Project at http://sift.readthedocs.org/
• Expanded Filesystem Support

Download SIFT Workstation 3 Locations

Download SIFT Workstation VMware Appliance – 1.5 GB

Note: The file is zipped using 7zip in the 7z format. We recommend 7zip to unzip it. Download 7zip.

Manual SIFT 3 Installation

Installation

We tried to make the installation (and upgrade) of the SIFT workstation as simple as possible, so we create the SIFT Bootstrap project, which is a shell script that can be downloaded and executed to convert your Ubuntu installation into a SIFT workstation.

Check the project out at https://github.com/sans-dfir/sift-bootstrap

Quickstart

Using wget to install the latest, configure SIFT, and SIFT theme

wget –quiet -O – https://raw.github.com/sans-dfir/sift-bootstrap/master/bootstrap.sh | sudo bash -s — -i -s -y

Using wget to install the latest (tools only)

wget –quiet -O – https://raw.github.com/sans-dfir/sift-bootstrap/master/bootstrap.sh | sudo bash -s — -i

SIFT Login/Password:

After downloading the toolkit, use the credentials below to gain access.

• Login “sansforensics”
• Password “forensics”
• $ sudo su –
  • Use to elevate privileges to root while mounting disk images.

SIFT Workstation 3 Capabilities

Ability to securely examine raw disks, multiple file systems, evidence formats. Places strict guidelines on how evidence is examined (read-only) verifying that the evidence has not changed

File system support

• ntfs (NTFS)
• iso9660 (ISO9660 CD)
• hfs (HFS+)
• raw (Raw Data)
• swap (Swap Space)
• memory (RAM Data)
• fat12 (FAT12)
• fat16 (FAT16)
• fat32 (FAT32)
• ext2 (EXT2)
• ext3 (EXT3)
• ext4 (EXT4)
• ufs1 (UFS1)
• ufs2 (UFS2)
• vmdk

Evidence Image Support

• raw (Single raw file (dd))
• aff (Advanced Forensic Format)
• afd (AFF Multiple File)
• afm (AFF with external metadata)
• afflib (All AFFLIB image formats (including beta ones))
• ewf (Expert Witness format (encase))
• split raw (Split raw files) via affuse
• affuse x2010 mount 001 image/split images to view single raw file and metadata
• split ewf (Split E01 files) via mount_ewf.py
• mount_ewf.py x2010 mount E01 image/split images to view single raw file and metadata
• ewfmount – mount E01 images/split images to view single rawfile and metadata

Partition Table Support

• dos (DOS Partition Table)
• mac (MAC Partition Map)
• bsd (BSD Disk Label)
• sun (Sun Volume Table of Contents (Solaris))
• gpt (GUID Partition Table (EFI))

Software Includes:

• log2timeline (Timeline Generation Tool)
• Rekall Framework (Memory Analysis)
• Volatility Framework (Memory Analysis)
• Autopsy (GUI Front-End for Sleuthkit)
• PyFLAG (GUI Log/Disk Examination)afflib
  • afflib-tools
• libbde
• libesedb
• libevt
• libevtx
• libewf
  • libewf-tools
  • libewf-python
• libfvde
• libvshadow
• log2timeline
• Plaso
• qemu
• SleuthKit
• 100s more tools -> See Detailed Package Listing

SIFT Workstation 3 How-Tos

• SANS DFIR Posters and Cheat Sheets
• SIFT Documentation Project
• How To Mount a Disk Image In Read-Only Mode
• How To Create a Filesystem and Registry Timeline
• How To Create a Super Timeline
• How to use the SIFT Workstation for Basic Memory Image Analysis

Report Bugs

As with any release, there will be bugs and requests, please report all issues and bugs to the following website and location.

https://github.com/sans-dfir/sift/issues

SIFT Recommendations

SIFT workstation is playing an important role for the Brazilian national prosecution office, especially due to Brazilian government budgetary constraints. Its forensic capabilities are bundled on a way that allows an investigation to be conducted much faster than it would take if not having the right programs grouped on such great Linux distribution. The new version, which will be bootable, will be even more helpful. I’d highly recommend SIFT for government agencies or other companies as a first alternative, for acquisition and analysis, from the pricey forensics software available on the market.

• Marcelo Caiado, M.Sc., CISSP, GCFA, EnCE

What I like the best about SIFT is that my forensic analysis is not limited because of only being ableto run a forensic tool on a specific host operating system. With the SIFT VM Appliance, I can create snapshots to avoid cross-contamination of evidence from case to case, and easily manage system and AV updates to the host OS on my forensic workstation. Not to mention, being able to mount forensic images and share them as read-only with my host OS, where I can run other forensic tools to parse data, stream-lining the forensic examination process.

Digital Forensics Cheat Sheets Collection

DFIR “Memory Forensics” Poster – Analysts armed with memory analysis skills have a better chance to detect and stop a breach before you become the next news headline. This poster shows some of the structures analyzed during memory forensic investigations. Just as those practicing disk forensics benefit from an understanding of file systems, memory forensic practitioners also benefit from an understanding of OS internal structures.
Download Here

---

DFIR “Advanced Smartphone Forensics” Poster– Forensic investigations often rely on data extracted from smartphones and tablets. Smartphones are the most personal computing device associated to any user, and can therefore provide the most relevant data per gigabyte examined. Commercial tools often miss digital evidence on smartphones and associated applications, and improper handling can render the data useless. Use this poster as a cheat-sheet to help you remember how to handle smartphones, where to obtain actionable intelligence, and how to recover and analyze data on the latest smartphones and tablets.
Download Here

---

DFIR “Evidence of…” Poster– The “Evidence of…” categories were originally created by SANS Digital Forensics ad Incidence Response faculty for the SANS course FOR408 – Windows Forensics. The categories map a specific artifact to the analysis questions that it will help to answer. Use this poster as a cheat-sheet to help you remember where you can discover key items to an activity for Microsoft Windows systems for intrusions, intellectual property theft, or common cyber crimes.
Download Here

---

DFIR “Find Evil” Poster – In an intrusion case, spotting the difference between abnormal and normal is often the difference between success and failure. Your mission is to quickly identify suspicious artifacts in order to verify potential intrusions. Use the information below as a reference for locating anomalies that could reveal the actions of an attacker.
Download Here

---

DFIR SIFT 3.0 Cheat Sheets and Brochure – Inside our DFIR course catalog you will find two critical cheat sheets. SIFT 3.0 guide and the Memory Forensics cheat sheets.
Download Here

---

SIFT Cheat Sheet – Looking to use the SIFT workstation and need to know your way around the interface? No problem, this cheat sheet will give you the basic commands to get cracking open your case using the latest cutting edge forensic tools.
Download Here

---

Evidence Collection Cheat Sheet – This sheet covers the various locations where evidence to assist in an investigation may be located.
Download Here

---

Linux Shell Survival Guide – This guide is a supplement to SANS FOR572: Advanced Network Forensics and Analysis. It covers some of what we consider the more useful Linux shell primitives and core utilities. These can be exceedingly helpful when automating analysis processes, generating output that can be copied and pasted into a report or spreadsheet document, or supporting quick-turn responses when a full tool kit is not available.
Download Here

---

Windows to Unix Cheat Sheet – It helps to know how to translate between windows and unix. This handy reference guide ties together many well known Unix commands with their Windows command line siblings. A great way to get Windows users familiar with the command line quickly.
Download Here

---

Log2timeline Cheat Sheet – Creating a timeline is easy with the essential reference guide. The step by step nature of the log2timeline cheat sheet will enable anyone not familiar with the process to step through creation of their first timeline in no time.
Download Here

---

Memory Forensics Cheat Sheet – Covering the popular memory suite Volatility, this cheat sheet will empower each investigator the key knowledge to quickly step through the 6 step memory analysis process using key commands from the plugins. This reference guide is very useful to have near you for those just starting out in memory forensics or those who are experts who need to quickly remember plugin syntax.
Download Here

---

Hex and Regex Forensics Cheat Sheet – Quickly become a master of sorting through massive amounts of data quickly using this useful guide to knowing how to use simple Regex capabilities built into the SIFT workstation.
Download Here

---

Developing Process for Mobile Device Forensics (Det. Cynthia A. Murphy)- With the growing demand for examination of cellular phones and other mobile devices, a need has also developed for the development of process guidelines for the examination of these devices. While the specific details of the examination of each device may differ, the adoption of consistent examination processes will assist the examiner in ensuring that the evidence extracted from each phone is well documented and that the results are repeatable and defensible.
Download Here

---

SANS FOR518 Reference Sheet – This cheat sheet is used to describe the core functions and details of the HFS+ Filesystem.
Download Here

Pen Testing Resources: Whitepapers

White Papers are an excellent source for information gathering, problem-solving and learning. Below is a list of White Papers written by penetration testing practitioners seeking certification. SANS attempts to ensure the accuracy of information, but papers are published “as is”.

Errors or inconsistencies may exist or may be introduced over time. If you suspect a serious error, please contact webmaster@sans.org.

Featured Papers

This featured paper includes some really useful techniques that penetration testers should master. Read it, learn it, and live it, as you extend your skills.

• Using Windows Script Host and COM to Hack Windows

Paper	Author	Certification
Practical El Jefe	Vedaa, Charles	GCIH
Correctly Implementing Forward Secrecy	Schum, Chris	GCIH
Powercat	Douglas, Mick	GPEN
Detecting Crypto Currency Mining in Corporate Environments	D’Herdt, Jan	GCIH
Penetration Testing: Alternative to Password Cracking	Catanoi, Maxim	GPEN
Automated Defense – Using Threat Intelligence to Augment	Poputa-Clean, Paul	GCIH
Cyber Breach Coaching	Hoehl, Michael	GCIH
AIX for penetration testers	Panczel, Zoltan	GPEN
Let’s face it, you are probably compromised. What next?	Thyer, Jonathan	GPEN
Secure Design with Exploit Infusion	Wen Chinn, Yew	GCIH
An Analysis of Meterpreter during Post-Exploitation	Wadner, Kiel	GCIH
Creating a Threat Profile for Your Organization	Irwin, Stephen	GCIH
Modeling Security Investments With Monte Carlo Simulations	Lyon, Dan	GWAPT
A Qradar Log Source Extension Walkthrough	Stanton, Michael	GCIH
Differences between HTML5 or AJAX web applications	Thomassin, Sven	GWAPT
Small devices needs a large Firewall	Mastad, Paul	GCIH
Are there novel ways to mitigate credential theft attacks in Windows?	Foster, James	GCIH
Digital Certificate Revocation	Vandeven, Sally	GCIH
Incident Response in a Microsoft SQL Server Environment	Walker, Juan	GCIH
Web Application Penetration Testing for PCI	Hoehl, Michael	GWAPT
Securing Aviation Avionics	Panet-Raymond, Marc	GCIH
iPwn Apps: Pentesting iOS Applications	Kliarsky, Adam	GPEN
Incident Handling Annual Testing and Training	Holland, Kurtis	GCIH
Rapid Triage: Automated System Intrusion Discovery with Python	Bond, Trenton	GCIH
Using Open Source Reconnaissance Tools for Business Partner Vulnerability Assessment	Young, Sue	GCIH
An Approach to Detect Malware Call-Home Activities	Cui, Tianqiang	GCIH
Active Security Or: How I learned to stop worrying and use IPS with Incident handling	Brown, Douglas	GCIH
War Pi	Christie, Scott	GCIH
Getting Started with the Internet Storm Center Webhoneypot	Pokladnik, Mason	GWAPT
Getting Started with the Internet Storm Center Webhoneypot	Pokladnik, Mason	GWAPT
Home Field Advantage: Employing Active Detection Techniques	Jackson, Benjamin	GCIH
Introduction to the OWASP Mutillidae II Web Pen-Test Training Environment	Druin, Jeremy	GWAPT
Talking Out Both Sides of Your Mouth: Streamlining Communication via Metaphor	More, Josh	GCIH
SMS, iMessage and FaceTime security	Khalil, George	GCIH
Using DomainKeys Identified Mail (DKIM) to Protect your Email Reputation	Murphy, Christopher	GCIH
Detecting Security Incidents Using Windows Workstation Event Logs	Anthony, Russell	GCIH
Web Application Injection Vulnerabilities: A Web App’s Security Nemesis?	Couture, Erik	GWAPT
Event Monitoring and Incident Response	Boyle, Ryan	GCIH
Website Security for Mobile	Ho, Alan	GWAPT
Web Log Analysis and Defense with Mod_Rewrite	Wanner, Rick	GCIH
How to identify malicious HTTP Requests	Sarokaari, Niklas	GWAPT
Exploiting Embedded Devices	Jones, Neil	GPEN
InfiniBand Fabric and Userland Attacks	Warren, Aron	GCIH
Incident Handling in the Healthcare Cloud: Liquid Data and the Need for Adaptive Patient Consent Management	Filkins, Barbara	GCIH
PDF Obfuscation – A Primer	Robertson, Chad	GPEN
Attributes of Malicious Files	Yonts, Joel	GCIH
Exploiting Financial Information Exchange (FIX) Protocol?	DeMarco, Darren	GCIH
Covert Channels Over Social Networks	Selvi, Jose	GCIH
Robots.txt	Lehman, Jim	GWAPT
Penetration Testing Of A Web Application Using Dangerous HTTP Methods	Kim, Issac	GWAPT
Shedding Light on Security Incidents Using Network Flows	Gennuso, Kevin	GCIH
In-house Penetration Testing for PCI DSS	Koster, Jeremy	GPEN
Remote Access Point/IDS	Kee, Jared	GCIH
Post Exploitation using Metasploit pivot & port forward	Dodd, David	GPEN
Quick and Effective Windows System Baselining and Comparative Analysis for Troubleshooting and Incident Response	Fuller, Kevin	GCIH
iPhone Backup Files. A Penetration Tester’s Treasure	Manners, Darren	GPEN
Mitigating Browser Based Exploits through Behavior Based Defenses and Hardware Virtualization	Faust, Joseph	GCIH
Securely deploying Android devices	Alonso-Parrizas, Angel	GCIH
Responding to Zero Day Threats	Kliarsky, Adam	GCIH
Practical OSSEC	Robertson, Chad	GCIH
Creating Your Own SIEM and Incident Response Toolkit Using Open Source Tools	Sweeny, Jonny	GCIH
An Overview Of The Casper RFI Bot	O’Connor, Dan	GCIH
Pass-the-hash attacks: Tools and Mitigation	Ewaida, Bashar	GCIH
Solution Architecture for Cyber Deterrence	Mowbray, Thomas	GPEN
Malicious Android Applications: Risks and Exploitation	Boutet, Joany	GPEN
Security Incident Handling in High Availability Environments	Kibirkstis, Algis	GCIH
Using Windows Script Host and COM to Hack Windows	Ginos, Alexander	GPEN
Effective Use Case Modeling for Security Information & Event Management	Frye, Daniel	GCIH
Penetration Testing in the Financial Services Industry	Olson, Christopher	GPEN
Which Disney© Princess are YOU?	Brower, Joshua	GCIH
Why Crack When You Can Pass the Hash?	Hummel, Christopher	GCIH
One Admin’s Documentation is their Hacker’s Pentest	Vandenbrink, Robert	GPEN
IOSTrojan: Who really owns your router?	Santander Pelaez, Manuel Humberto	GCIH
Visualizing the Hosting Patterns of Modern Cybercriminals	Hunt, Drew	GCIH
PCI DSS and Incident Handling: What is required before, during and after an incident	Moldes, Christian	GCIH
A Fuzzing Approach to Credentials Discovery using Burp Intruder	Dawson, Karl	GPEN
Incident Handlers Guide to SQL Injection Worms	Folkerts, Justin	GCIH
IOScat – a Port of Netcat’s TCP functions to Cisco IOS	Vandenbrink, Robert	GCIH
Bypassing Malware Defenses	Christiansen, Morton	GPEN
Investigative Tree Models	Caudle, Rodney	GCIH
A Guide to Encrypted Storage Incident Handling	Shanks, Wylie	GCIH
The SirEG Toolkit	Begin, Francois	GCIH
Incident Handling as a Service	Lundell, Michel	GCIH
Zombie profiling with SMTP greylisting	Koster, Jeremy	GCIH
Using OSSEC with NETinVM	Allen, Jon Mark	GCIH
Detecting Hydan: Statistical Methods For Classifying The Use Of Hydan Based Stegonagraphy In Executable Files	Wright, Craig	GCIH
Document Metadata, the Silent Killer…	Pesce, Larry	GCIH
Espionage – Utilizing Web 2.0, SSH Tunneling and a Trusted Insider	Abdel-Aziz, Ahmed	GCIH
Following Incidents into the Cloud	Reed, Jeffrey	GCIH
Covering the Tracks on Mac OS X Leopard	Scott, Charles	GCIH
Winquisitor: Windows Information Gathering Tool	Cardosa, Michael	GCIH
An approach to the ultimate in-depth security event management framework	Pachis, Nicolas	GCIH
Exploitation Kits Revealed – Mpack	Martin, Andrew	GCIH
Scareware Traversing the World via a Web App Exploit	Hillick, Mark	GCIH
Mining for Malware – There’s Gold in Them Thar Proxy Logs!	Griffin, Joe	GCIH
Detecting and Preventing Unauthorized Outbound Traffic	Wippich, Brian	GCIH
Virtual Rapid Response Systems	Mohan, Chris	GCIH
An Incident Handling Process for Small and Medium Businesses	Pokladnik, Mason	GCIH
Stack Based Overflows: Detect & Exploit	Christiansen, Morton	GCIH
Application Whitelisting: Panacea or Propaganda	Beechey, Jim	GCIH
Multi-Tool DVD Sets: An important addition to the Incident Handler/ Pen Tester’s toolkit	Bandukwala, Jamal	GCIH
Expanding Response: Deeper Analysis for Incident Handlers	McRee, Russ	GCIH
Pros and Cons of using Linux and Windows Live CDs in Incident Handling and Forensics	Smith, Ricky	GCIH
Inside-Out Vulnerabilities, Reverse Shells	Hammer, Richard	GCIH
DNS Sinkhole	Bruneau, Guy	GCIH
The December Storm of WMF: Preparation, Identification, and Containment of Exploits	Voorhees, James	GCIH
Cisco Security Agent and Incident Handling	Farnham, Greg	GCIH
A Practical Application of SIM/SEM/SIEM Automating Threat Identification	Swift, David	GCIH
Effectiveness of Antivirus in Detecting Metasploit Payloads	Baggett, Mark	GCIH
Network Covert Channels: Subversive Secrecy	Sbrusch, Raymond	GCIH
Utilizing “AutoRuns” To Catch Malware	McMillan, Jim	GCIH
Exploiting BlackICE When a Security Product has a Security Flaw	Gara-Tarnoczi, Peter	GCIH
Remote installation of VMware GSX and a virtual machine	Condon, Ed	GCIH
Valentine’s Surprise Firedragging in Action	de Nie, Paula	GCIH
Microsoft Windows Cursor and Icon Format Handling Vulnerability	Perkins, Matthew	GCIH
IBM AIX invscout Local Command Execution Vulnerability –HONORS	Horwath, Jim	GCIH
An Analysis of the Remote Code Execution Vulnerability as Described in Microsoft’s MS05-002 Security Bulletin	Rose, Jerome	GCIH
Identity Theft Made Easy	Huber, Eric	GCIH
0day targeted malware attack	Villatte, Nicolas	GCIH
Exploiting Microsoft Internet Explorer Cursor and Icon File Handling Vulnerability	Chen, Jerry	GCIH
Windows Internet Naming Service – An Exploit Waiting to Happen	Berger, Jeremy	GCIH
Incident Handler Case File: A New Twist to Social Engineering	Hawkins, Ray	GCIH
Exploiting Samba Buffer Overflow Vulnerability via MetaSploit Framework	Ko, James	GCIH
Local Privilege Escalation in Solaris 8 and Solaris 9 via Buffer Overflow in passwd(1)	McAdams, Shaun	GCIH
A Case Study in Solaris Sadmind Exploitation	Nathoo, Karim	GCIH
What is Santy bringing you this year? HONORS	Danhieux, Pieter	GCIH
rLogin Buffer Overflow Vulnerability – Solaris	Corredor, Juan	GCIH
Fun with Batch Files: The Muma Worm	Mackey, David	GCIH
A Picture is Worth 500 Malicious Dwords	Hall, Timothy	GCIH
Remote Exploitation of Icecast 2.0.1 Server	Pittner, Jakub	GCIH
Freezing Icecast in its Tracks	McLaren, Jared	GCIH
Microsoft Internet Explorer SP2 Fully Automated Remote Compromise	Davies, Alan	GCIH
Exploiting Internet Explorer via IFRAME	Becher, Jim	GCIH
Exploiting PHP code injection: phpMyAdmin Multiple Input Validation Vulnerabilities	Kah, Fabrice	GCIH
Ramen Worm	Ives, Millie	GCIH
Sub Seven: A Risk to Your Internet Security	Ostrowski, Paul	GCIH
Network Printers: Whose friend are they?	Hutcheson, Lorna	GCIH
WebDAV Buffer Overflow Vulnerability	Beckley, Peter	GCIH
Open Shares Vulnerability	Hill, Siegfried	GCIH
Simple Network Management Protocol: Now More than a “Default” Vulnerability	Fluharty, Daniel	GCIH
The Microsoft IIS 5.0 Internet Printing ISAPI Extension Buffer Overflow	Clemenson, Christopher	GCIH
The enemy within: Handling the Insider Threat posed by Shatter Attacks	Layton, Meg	GCIH
IP Masquerading Vulnerability for Linux 2.2.x – CVE-2000-0289	Baccam, Tanya	GCIH
IIS 5 In-Process Table Privilege Escalation Vulnerability	Fatnani, Kishin	GCIH
Hijacked Server Serves Up Foreign Bootlegged Pornography	Meyer, Russell	GCIH
Multithreaded, Dictionary-Based, Brute Force Password Attack on Linksys BEFSR41 With Remote Management Enabled Using A Modified THC-Hydra Tool	Kirch, Joel	GCIH
The fascinating tale of a lame hacker, a Linux Box, and how I received permission to deploy my IDS	Markham, George	GCIH
Sun snmpXdmi Overflow	Miller, Kevin	GCIH
0x333hate.c: Samba Remote Root Exploit	Embrich, Mark	GCIH
Stay Alert While Browsing the Internet	LaValley, Jim	GCIH
Robbing the Bank with ITS/MHTML Protocol Handler	Balcik, James	GCIH
Exploit Analysis	Jenkinson, John	GCIH
FTP Port 21 “Friend or Foe” Support for the Cyber Defense Initiative	Karrick, Stephen	GCIH
Port 1433	Georgas, Mark	GCIH
eMule Exploit	Renna, Scott	GCIH
Reverse Engineering Srvcp.exe	Zeltser, Lenny	GCIH
Widespread SNMP Vulnerabilities	Brooks, Greg	GCIH
A Weak Password And A Windows Rootkit: A Recipe For Trouble	Ives, John	GCIH
Incident Illustration – LoveLetter VBS	Gerber, John	GCIH
Phising Attack in Organizations: Incident Handlers Perspective	Ong, Leonard	GCIH
Revisiting the Code Red Worm	White, Ravila	GCIH
Linux NTPD Buffer Overflow	Stadler, Philipp	GCIH
The Blind Leading The Blind – Sadmind/IIS Worm	Barger, Richard	GCIH
Donald Dick 1.55 with Last Updated GUI Component from Version 1.53	Maglich, Ryan	GCIH
BruteSSH2 – 21st Century War Dialer	Thompson, Bill	GCIH
Exploiting Vulnerabilities in Squirrelmail	Bong, Kevin	GCIH
Port 80 (HTTP) – Apache Web Server Chunk Handling Vulnerability	Oksanen, Scott	GCIH
Breaking Windows 2000 Passwords via LDAP Password Crackers	Hamby, Charles	GCIH
Dsniff and Switched Network Switching	Bowers, Brad	GCIH
Exploiting the LSASS Buffer Overflow	Wohlberg, Jon	GCIH
Code Red and the Unix Impact	Mcguire, David	GCIH
Port 443 and Openssl-too-open	Lee, Chia-Ling	GCIH
Hacker Techniques, Exploits, and Incident Handling	Brooker, Denis	GCIH
Incident Illustration – Corporate Compromise	Hall, Russell	GCIH
phpMyAdmin 2.5.7 – Input Validation Vulnerability	Thurston, Tracy	GCIH
FTP Security and the WU-FTP File Globbing Heap Corruption Vulnerability	Webb, Warwick	GCIH
Port 1433 Vulnerability: Unchecked Buffer in Password Encryption Procedure	Bryner, Jeff	GCIH
Windows Media Services NSIISLOG.DLL Remote Buffer Overflow	Smith, Steve	GCIH
Incident Illustration – Missing Files	White, Scott	GCIH
Importance of a Minor Incident: W32/Goner@MM	Legary, Michael	GCIH
Nimda – Surviving the Hydra	Schmelzel, Paul	GCIH
GIAC Certified Incident Handling Practical	Yachera, Stanley	GCIH
Incident Illustration – Mstream	Gallo, Kenneth	GCIH
Incident Illustration – HTTP Services Vulnerabilities	Modelo Howard, Gaspar	GCIH
Buffer Overflow in /bin/login	Puusaari, Matthew	GCIH
SQL Server Resolution Service Exploit in Action	Hoover, James	GCIH
GIAC GCIH Assignment – Pass	Harrison, Daniel	GCIH
An Attacker On RPC Compromised Remote VPN Host Runs Arbitrary Code on Microsoft Exchange Server 2000	Ho, Wai-Kit	GCIH
The Search for “Kozirog”	Weaver, Greg	GCIH
How to Gain Control of a Windows 2000 Server Using the In-Process Table Privilege Escalation Exploit	Stidham, Jonathan	GCIH
SQL Slammer Worm	Hayden, Chris	GCIH
Welchia Worm vs. Policy Makers Fighting Malware with Policy, not with Fire	Corll, Benjamin	GCIH
Incident Ilustration	Chervenka, Dan	GCIH
Tracking the Back Orifice Trojan on a University Network	Knudsen, Kent	GCIH
First Response: An incident handling team learns a few lessons the hard way	Cragg, David	GCIH
Microsoft RPC-DCOM Buffer Overflow Attack using Dcom.c	Farrington, Dean	GCIH
Automated Execution of Arbitrary Code Using Forged MIME Headers in Microsoft Internet Explorer	Winters, Scott	GCIH
False Alarm…Or Was It? Lessons Learned from a Badly Handled Incident	Graesser Williams, Dana	GCIH
SQL Slammer and Other UDP Port 1434 Threats In support of the Cyber Defense Initiative	Ray, Edward	GCIH
Bad ESMTP Verb Usage Equals Bad Times for Exchange	Smith, Aaron	GCIH
Real Network’s Remote Server Remote Root Exploit	Lastor, Michael	GCIH
Wireless LAN Honeypots to Catch IEEE 802.11 Intrusions	Mitchell, Gordon	GCIH
Netscape Enterprise Server Denial of Service Exploit	Smith, Tony	GCIH
Back-Door’ed by the Slammer	Hally, John	GCIH
Eradicating the Masses & Round 1 with Phatbot?	Fulton, Lora	GCIH
FreeBSD 4.x local root vulnerability — exec() of shared signal handler	Durkee, Ralph	GCIH
Identifying and Handling a PHP Exploit	Edelson, Eve	GCIH
Exploiting Sambas SMBTrans2 Vulnerability	Darrah, Byron	GCIH
Relative Shell Path Vulnerability	Evans, Earl	GCIH
A Heap o’ Trouble: Heap-based flag insertion buffer overflow in CVS	Conrad, Eric	GCIH
Mutated Code	Kopczynski, Tyson	GCIH
Windows Shell Document Viewer shdocvw.dll Feature or Trojan Horse?	Fenwick, Wynn	GCIH
A J0k3r Takes Over	Larrieu, Heather	GCIH
Buffer overflow in BIND 8.2 via NXT records	Talianek, Chris	GCIH
Exploiting the MicrosoftWindows Task Scheduler ..job. Stack Overflow Vulnerability	Wenchel, Kevin	GCIH
Neptune.c the Birth of SYN Flood Attacks	Cardinal, Steven	GCIH
Apache Web Server Chunk Handling Vulnerability: An Exploit In Action	Walker, Martin	GCIH
My First Incident Handling Experience	Kohli, Karmendra	GCIH
ICQ URL Remote Exploitable Buffer Overflow	de Beaupre, Adrien	GCIH
Johnny and the Metasploit – “MICROSOFT LSASS MS04-011 OVERFLOW” ATTACK	Greene, Richard	GCIH
Lotus Notes Penetration	Rademacher, Karl	GCIH
System infiltration through Mercur Mail Server 4.2	Ben Alluch Ben Amar, Jamil	GCIH
Session stealing with WebMin	Murdoch, Don	GCIH
Cisco IOS Type 7 Password Vulnerability	Massey, Lee	GCIH
The Cisco IPv4 Blocked Interface Exploit	Johnson, Cortez	GCIH
Phone Phreaking and Social Engineering	Tuey, Richard	GCIH
SMTP Loop Moderate Denial of Service: InterScan VirusWall NT & Lotus Domino Environment	Roberts, Brian	GCIH
Nachi to the Rescue?	Griffith, Russ	GCIH
Testing Web Applications for Malicious Input Attack Vulnerabilities	Grill, Robert	GCIH
Incident Illustration – Firewall Attack	Reed, Bill	GCIH
Incident Handling Without Guidelines	McKellar, Neil	GCIH
Attack of Slammer worm – A practical case study	Huang, Dongmei	GCIH
Combating the Nachia Worm in Enterprise Environments	Johnson, Brad	GCIH
Anna Kournikova Worm	Ashworth, Robert	GCIH
Exploiting the SSH CRC32 Compensation Attack Detector Vulnerability	Williams, R. Michael	GCIH
Traveling Through the OpenSSL Door	Murphy, Keven	GCIH
Catch the culprit!	Perez, David	GCIH
Illustration of VS.SST@mm Virus Incident	Smith, Kevin	GCIH
In Support of the Cyber Defense Initiative	Kohlenberg, Toby	GCIH
Incident Analysis in a Mid-Sized Company	Garvin, Pete	GCIH
All Your Base Are Belong To Someone Else: An Analysis Of The Windows Messenger Service Buffer Overflow Vulnerability	Hewitt, Peter	GCIH
Incident Illustration	Black, Ronald	GCIH
BackGate Kit: The Joy of “Experts”	DePriest, Paul	GCIH
A Management Guide to Penetration Testing	Shinberg, David	GCIH
Author Intruder Alert: Why Internal Security must not take a back seat.	Hendrick, Jim	GCIH
MS IIS CGI Filename Decode Error Vulnerability	Shenk, Jerry	GCIH
The t0rn Rootkit	Craveiro, Paulo	GCIH
At hacker’s mercy while surfing the web – A cross-zone scripting exploit for Internet Explorer	Leibenzeder, Florian	GCIH
A Buffer Overflow Exploit Against the DameWare Remote Control Software	Strubinger, Ray	GCIH
Discovering a Local SUID Exploit	Pike, Jeff	GCIH
Microsoft IIS Superfluous Decoding Vulnerability	Orkin, Kevin	GCIH
A Security Analysis of the Gnutella Peer-to-Peer Protocol	Cheney, Kirk	GCIH
SMTP – Always a victim of a good time	Lock, James	GCIH
Pass – Questions	Stackhouse, Brent	GCIH
A Two Stage Attack Using One-Way Shellcode	Mathezer, Stephen	GCIH
Once Bitten Twice Sly – Common Exploits Fueled by Common Mishap	Melvin, John	GCIH
KaZaA Media Desktop Virus: W32/kwbot	Will, Rita	GCIH
Real World ARP Spoofing	Siles, Raul	GCIH
BIND 8.2 NXT Remote Buffer Overflow Exploit	Mcmahon, Robert	GCIH
Incident Report for a Rootkit attack on a Fedora workstation	Norman, Bonita	GCIH
M@STER@GENTS: Masters of “SPAM”	Ashland, Joanne	GCIH
Support for the Cyber Defense Initiative	Fresen, Lars	GCIH
Penetration Testing of a Secure Network	Pakala, Sangita	GCIH
Local Exploit: dtprintinfo for Solaris 2.6 and 7	Sipes, Steven	GCIH
PHP-Nuke: From SQL Injection to System Compromise	Paynter, Eric	GCIH
Employees Are Crackers Too	Stapleton, Curt	GCIH
Apache Web Server Chunk Handling Apache-nosejob.c	Sarrazyn, Dieter	GCIH
The Tactical Use of Rainbow Crack to Exploit Windows Authentication in a Hybrid Physical-Electronic Attack	Mahurin, Mike	GCIH
Incident Illustration – SGI Penetration	Roth, Jeffrey	GCIH
DreamFTP – The Nightmare Begins!	Sorensen, Robert Peter	GCIH
WU-FTPD Heap Corruption Vulnerability – HONORS	Allen, Jennifer	GCIH
Solaris in.lpd Remote Command Execution Vulnerability	Seah, Meng Kuang	GCIH
When Script-kiddies become the target, as well as the menace: A variant of the WU-FTPD File Globbing Heap Corruption Vulnerability	Hall, Stephen	GCIH
Deep Throat 3.1 Analysis	Prue, Patrick	GCIH
Exploiting the Microsoft Internet Explorer Malformed IFRAME Vulnerability	Tu, Alan	GCIH
What to do when you break WEP Wireless Security and the LAN	Poer, Geoffrey	GCIH
SMBdie’em All – Kill That Server	Kirby, Craig	GCIH
A Study of the o_wks.c Exploit for MS03-049	Arnoth, Eric	GCIH
Jolt2 or “IP Fragment Re-assembly	Beciragic, Jasmir	GCIH

from: http://pen-testing.sans.org/resources/whitepapers

Pen Test Hackfest Summit 2014 and 2013 Documents / PDFs

Pen Test Hackfest Summit 2014

• Crazy Sexy Hacking – Mark Baggett.pdf
• Hacking in Meatspace – Matt Linton.pdf
• Hacking to Get Caught – Raphael Mudge.pdf
• How To Give the Best Pen Test of Your Life – Ed Skoudis.pdf
• iOS Game Hacking – How I Ruled the Worl^Hd and Built Skills for AWESOME Mobile App Pen Tests – Josh Wright.pdf
• Kicking the Guard Dog of Hades – Attacking Microsoft Kerberos – Tim Medin(1).pdf
• Penetration Testing is Dead – Katie Moussouris.pdf
• Pentesting Web Frameworks – Justin Searle.pdf
• Secret Pen Testing Techniques, Part 2 – David Kennedy.pdf
• The State of the Veil Framework – Will Schroeder and Chris Truncer.pdf
• Use of Malware by Penetration Testers – Wesley McGrew.pdf
• Zip file of all PDFs (updated 20141125)

---

Pen Test HackFest Summit 2013

• Android Application Assessment – Christopher Crowley.pdf
• Anti-virus No Thanks – Mark Baggett.pdf
• Beyond Trust – Retina Network Security Scanner Data Sheet.pdf
• Getting Creative – A Story in Thinking Outside the Box – Dave Kennedy.pdf
• grok – @las of d00m.pdf
• Hacking Net Applications_PenTestSummit – James Jardine.pdf
• How Not to Suck at Penetration Testing – John Strand.pdf
• How To Build a Completely Hackable City – Ed Skoudis.pdf
• Offense in Depth – Raphael Mudge.pdf
• Pentesting with Metasploit 2013 – Josh Abraham.pdf
• Post Exploitation Operations with Cloud Synchronization Services – Jake Williams CSRgroup.pdf
• Zip file of all PDFs (updated 20131122)

SANS Software Security Resources: Summit Archives

SANS AppSec 2014

• Building a Content Security Policy (CSP) – Eric Johnson
• DevOps, CI, APIs, Oh My – Matt Tesauro
• Legends – Security Awarness Myths and Their Realities – Kevin Johnson
• REST Security by Example – Frank Kim
• What Star Trek TNG Can Teach Us About the Future of Computer Security – RSnake Hansen

SANS AppSec 2013

• A Decade of Web Application Security What have we learned – Jason Kent
• Compliance Security and Innovation Can They Co-Exist – Josh-Brown White
• Do you have a Scanner or do you have a Scanning Problem – Dan Cornell
• Mobile Security2013 Phenomenal Cosmic Power Itty Bitty Living Space – Joel Scambray
• Testing at Cloud Speed – Matt Tesauro

SANS AppSec 2012

• 7 Ways to Scale Web Security – Jeremiah Grossman
• 10,000 Apps in 18 Months – Chris Eng
• Bust a Cap in a Mobile App – Aditya K. Sood
• Bust a Cap in a Mobile App – Georgia Weidman
• Bust a Cap in a Mobile App – Subu Ramanathan
• Future of XSS Defense – Jim Manico
• Get Smart AMI Security on the Smart Grid – John Sawyer & Don Weber
• How to Build an AppSec Program without Getting Fired – Michele Guel
• How to Build an AppSec Program without Getting Fired – Monica Bush
• How to Get the Most out of your Tools – Will Bechtel
• How to get the Most out of your Tools – Jim Manico
• How to get the Most out of your Tools – Michele Guel
• Rate Limiting in Action – Nick Galbreath
• Secure Programming – A Way of Life or Death – Matt Bishop
• Security at Scale – Web Application Security in a Continuous Deployement Environment – Zane Lackey
• Taking the Modular View – Extracting Security from the Application – Chenxi Wang
• What you can learn from Small Companies about AppSec – Cameron Morris
• What you can learn from Small Companies about AppSec – Jim Bird
• What you can learn from Small Companies about AppSec – Nick Galbreath

SANS AppSec 2011

• War Made New: Changing the IT Battlefield – Mary Ann Davidson, Oracle
• How to Turn Crisis Into Opportunity – Brad Arkin, Adobe
• What is the key to successful Application Security? – Chris Peterson, Zynga
• How Real World Software Security Programs Work – Greg Ruddell, RBC
• Why is most software not designed with security in mind and never will be? – James Bach, Satisfice
• Building Bridges between Dev and AppSec – Jim Bird, BIDS Trading
• So you wanna be a botmaster? – Billy Rios, Google
• Hacking and Securing Next Generation iPhone and iPad Apps – Nitesh Dhanjani & Sean Pennline, Ernst & Young
• How Do You Achieve Developer Buy-In for Your Software Security Initiative? – Mike Hryekewicz, Standard Insurance
• How can we get business to buy into application security? – Travis Ruff, Cargill
• Paradigm Shift: The changing security ground on which we stand – Brook Schoenfield, Cisco
• Web Hacking Incidents Revealed: Trends, Stats and How to Defend – Ryan Barnett, Trustwave
• Mobile Security Application Challenges – Don Williams, Verizon Wireless
• What’s So Different about Mobile Applications? – Sam Quigley, Square
• OWASP Goes Mobile – Mike Zusman, Intrepidus Group
• What can the industry do to improve the state of mobile security? – Chris Palmer, EFF
• Building a Security Ecosystem – Robert Fly, Salesforce.com
• Which Vulnerabilities Should I Fix First? – Ryan Barnett, Trustwave
• 2011: Web Application Security Metrics Landscape: Actionable Software Security Metrics that Clarify instead of Confuse – Arian Evans, WhiteHat Security
• Calculating Security Debt: Meaningful Software Security Metrics Panel – Chris Wysopal, Veracode
• Dosh4Vulns: Google’s Vulnerability Reward Programs – Adam Mein & Chris Evans, Google
• Fraud Detection @salesforce – Robery Fly, Saleforce.com
• Application Fraud: An attacker’s introduction – Cory Scott, Matasano Security
• Intuit Fraud Management Oversight – David Hahn, Intuit
• Real-Time Hybrid Analysis – Brian Chess, HP
• Application Security Tools in 2012: We already live in the future. – Eric Heitzman, IBM
• Why are you not running a WAF? – Ivan Ristic, Qualys
• What is the Future of Automated XSS Defense Tools? – Jim Manico, Infrared Security

Vendor papers

• Moving to the Cloud? Take Your Application Security Solution with You
• A Dose of Reality on Automated Static-Dynamic Hybrid Analysis
• Seven Practical Steps to Delivering More Secure Software

from: http://software-security.sans.org/resources/summits

Book References for Software Security

19 Deadly Sins of Software Security

Michael Howard, David LeBlanc, John Viega

Building Secure Software: How to Avoid Security Problems the Right Way

John Viega, Gary McGraw

Exploiting Software: How to Break Code

Gary McGraw, Greg Hoglund

Foundations of Security: What Every Programmer Needs to Know

Neil Daswani, Christoph Kern, Anita Kesavan

Hacking Exposed: Web Applications

Scambray, Shema, Sima

Introduction to Computer Security

Matt Bishop

J2EE & Java: Developing Secure Web Applications with Java Technology (Hacking Exposed)

Art Taylor, Brian Buege, Randy Layman

Secure Coding in C and C++

Robert Seacord

Secure Coding: Principles and Practices

Ken Van Wyk, Mark Graff

Secure Programming Cookbook for C and C++

John Viega, Matt Messier

Security and Usability

Simson Garfinkel, Lori Faith Cranor

Software Security: Building Security In

Gary McGraw

The Art of Software Security Assessment: Identifying and Preventing Software Vulnerabilities

Mark Dowd, John McDonald, Justin Schuh

The Security Development Lifecycle

Michael Howard, Steve Lipner

Web Security, Privacy & Commerce, Second Edition

Simson Garfinkel, Gene Spafford

Writing Secure Code, Second Edition

Michael Howard, David C. LeBlanc

CWE/SANS TOP 25 Most Dangerous Software Errors

The Top 25 Software Errors are listed below in three categories:

• Software Error Category: Insecure Interaction Between Components (6 errors)
• Software Error Category: Risky Resource Management (8 errors)
• Software Error Category: Porous Defenses (11 errors)

The New 25 Most Dangerous Programming Errors

The Scoring System

The Risk Management System

Click on the CWE ID in any of the listings and you will be directed to the relevant spot in the MITRE CWE site where you will find the following:

• Ranking of each Top 25 entry,
• Links to the full CWE entry data,
• Data fields for weakness prevalence and consequences,
• Remediation cost,
• Ease of detection,
• Code examples,
• Detection Methods,
• Attack frequency and attacker awareness
• Related CWE entries, and
• Related patterns of attack for this weakness.

Each entry at the Top 25 Software Errors site also includes fairly extensive prevention and remediation steps that developers can take to mitigate or eliminate the weakness.

Archive

• View the Top 25 Software Errors for 2010 Here
• View the Top 25 Software Errors for 2009 Here

Insecure Interaction Between Components

These weaknesses are related to insecure ways in which data is sent and received between separate components, modules, programs, processes, threads, or systems.

CWE ID	Name
CWE-89	Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’)
CWE-78	Improper Neutralization of Special Elements used in an OS Command (‘OS Command Injection’)
CWE-79	Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)
CWE-434	Unrestricted Upload of File with Dangerous Type
CWE-352	Cross-Site Request Forgery (CSRF)
CWE-601	URL Redirection to Untrusted Site (‘Open Redirect’)

Risky Resource Management

The weaknesses in this category are related to ways in which software does not properly manage the creation, usage, transfer, or destruction of important system resources.

CWE ID	Name
CWE-120	Buffer Copy without Checking Size of Input (‘Classic Buffer Overflow’)
CWE-22	Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’)
CWE-494	Download of Code Without Integrity Check
CWE-829	Inclusion of Functionality from Untrusted Control Sphere
CWE-676	Use of Potentially Dangerous Function
CWE-131	Incorrect Calculation of Buffer Size
CWE-134	Uncontrolled Format String
CWE-190	Integer Overflow or Wraparound

Porous Defenses

The weaknesses in this category are related to defensive techniques that are often misused, abused, or just plain ignored.

CWE ID	Name
CWE-306	Missing Authentication for Critical Function
CWE-862	Missing Authorization
CWE-798	Use of Hard-coded Credentials
CWE-311	Missing Encryption of Sensitive Data
CWE-807	Reliance on Untrusted Inputs in a Security Decision
CWE-250	Execution with Unnecessary Privileges
CWE-863	Incorrect Authorization
CWE-732	Incorrect Permission Assignment for Critical Resource
CWE-327	Use of a Broken or Risky Cryptographic Algorithm
CWE-307	Improper Restriction of Excessive Authentication Attempts
CWE-759	Use of a One-Way Hash without a Salt

Resources to Help Eliminate The Top 25 Software Errors

1. The TOP 25 Errors List will be updated regularly and will be posted at both the SANS and MITRE sites
   SANS Top 25 Software Errors Site
   CWE Top 25 Software Errors Site

   MITRE maintains the CWE (Common Weakness Enumeration) web site, with the support of the US Department of Homeland Security’s National Cyber Security Division, presenting detailed descriptions of the top 25 Software errors along with authoritative guidance for mitigating and avoiding them. That site also contains data on more than 700 additional Software errors, design errors and architecture errors that can lead to exploitable vulnerabilities. CWE Web Site

   SANS maintains a series of assessments of secure coding skills in three languages along with certification exams that allow programmers to determine gaps in their knowledge of secure coding and allows buyers to ensure outsourced programmers have sufficient programming skills. Organizations with more than 500 programmers can assess the secure coding skills of up to 100 programmers at no cost.

   Email spa@sans.org for details.

2. SAFECode – The Software Assurance Forum for Excellence in Code (members include EMC, Juniper, Microsoft, Nokia, SAP and Symantec) has produced two excellent publications outlining industry best practices for software assurance and providing practical advice for implementing proven methods for secure software development.

   Fundamental Practices for Secure Software Development 2nd Edition
   http://www.safecode.org/publications/SAFECode_Dev_Practices0211.pdf

   Overview of Software Integrity Controls
   http://www.safecode.org/publications/SAFECode_Software_Integrity_Controls0610.pdf

   Framework for Software Supply Chain Integrity
   http://www.safecode.org/publications/SAFECode_Supply_Chain0709.pdf

   Fundamental Practices for Secure Software Development
   http://www.safecode.org/publications/SAFECode_Dev_Practices1108.pdf

   Software Assurance: An Overview of Current Industry Best Practices
   http://www.safecode.org/publications/SAFECode_BestPractices0208.pdf

3. Software Assurance Community Resources Site and DHS web sitesAs part of DHS risk mitigation efforts to enable greater resilience of cyber assets, the Software Assurance Program seeks to reduce software vulnerabilities, minimize exploitation, and address ways to routinely acquire, develop and deploy reliable and trustworthy software products with predictable execution, and to improve diagnostic capabilities to analyze systems for exploitable weaknesses.
4. Nearly a dozen software companies offer automated tools that test programs for these errors.
5. New York State has produced draft procurement standards to allow companies to buy software with security baked in.

   If you wish to join the working group to help improve the procurement guidelines you can go to the New York State Cyber Security and Critical Infrastructure Coordination web site.

   Draft New York State procurement language will be posted at SANS Application Security Contract.

For additional information on any of these:
SANS: Mason Brown, mbrown@sans.org
MITRE: Bob Martin, ramartin@mitre.org
MITRE: Steve Christey, coley@mitre.org

Software Security: Whitepapers

Most of these computer security white papers have been written by students seeking GIAC certification to fulfill part of their certification requirements and are provided by SANS as a resource to benefit the security community at large. SANS Software Security attempts to ensure the accuracy of information, but papers are published “as is”.

Errors or inconsistencies may exist or may be introduced over time as material becomes dated. If you suspect a serious error, please contact webmaster@sans.org.

• Application and Database Security
• Authentication
• Securing Code
• Applications and Systems Development Security

---

Application and Database Security

Web Application Firewalls	Jason Pubal	Mar 18, 2015
Protecting Access to Data and Privilege with Oracle Database Vault	Pete Finnigan	Jan 29, 2015
Data Encryption and Redaction: A Review of Oracle Advanced Security	Dave Shackleford	Nov 25, 2014
Secure Design with Exploit Infusion	Wen Chinn Yew	Nov 11, 2014
Building an Application Vulnerability Management Program	Jason Pubal	Jul 28, 2014
Incident Response in a Microsoft SQL Server Environment	Juan Walker	Jul 9, 2014
SANS Survey on Application Security Programs and Practices		Jun 17, 2014
Oracle Advanced Security	Tanya Baccam	Jun 17, 2014
Next-Generation Datacenters = Next-Generation Security	Dave Shackleford	Jun 17, 2014
SANS Institute Review: Oracle Database Vault	Tanya Baccam	Jun 17, 2014
2013 SANS Mobile Application Security Survey		Jun 17, 2014
Integrating Security into Development, No Pain Required	Dave Shackleford	Jun 17, 2014
Security of Applications: It Takes a Village	Dave Shackleford	Jun 17, 2014
Application Security: Tools for Getting Management Support and Funding	John Pescatore	Jun 17, 2014
Securing Web Applications Made Simple and Scalable	Gregory Leonard	Jun 17, 2014
Enabling Social Networking Applications for Enterprise Usage	Eric Cole, PhD	Jun 17, 2014
Oracle Database Security: What to Look for and Where to Secure	Tanya Baccam	Jun 17, 2014
Making Database Security an IT Security Priority	Tanya Baccam	Jun 17, 2014
Database Activity Monitoring and Audit: A Review of Oracle Audit Vault and Database Firewall	Tanya Baccam	Jun 17, 2014
Survey on Application Security Programs and Practices		Jun 17, 2014
How to Win Friends and Remediate Vulnerabilities	Chad Butler	Mar 27, 2014
Introduction to the OWASP Mutillidae II Web Pen-Test Training Environment	Jeremy Druin	Dec 4, 2013
Protecting applications against Clickjacking with F5 LTM	Michael Nepomnyashy	Dec 4, 2013
A Hands-on XML External Entity Vulnerability Training Module	Carrie Roberts	Dec 4, 2013
Web Application Injection Vulnerabilities: A Web App’s Security Nemesis?	Erik Couture	Jun 14, 2013
Setting Up a Database Security Logging and Monitoring Program	Jim Horwath	May 10, 2013
Endpoint Security through Application Streaming	Adam Walter	Mar 25, 2013
Auditing ASP.NET applications for PCI DSS compliance	Christian Moldes	Feb 7, 2012
Securing Blackboard Learn on Linux	David Lyon	Dec 1, 2011
Mass SQL Injection for Malware Distribution	Larry Wichman	Apr 28, 2011
Four Attacks on OAuth – How to Secure Your OAuth Implementation	Khash Kiani	Mar 24, 2011
Protecting Users: The Importance Of Defending Public Sites	Kristen Sullivan	Jan 18, 2011
Reducing Organizational Risk Through Virtual Patching	Joseph Faust	Jan 11, 2011
AppSec – Cross Site Request Forgery: What Attackers Don’t Want You to Know	Jason Lam & Johannes B. Ullrich	May 22, 2009
AppSec – Protecting Your Web Apps: Two Big Mistakes and 12 Practical Tips to Avoid Them	Ed Skoudis and Frank Kim	Mar 3, 2009
Web Based Attacks	Justin Crist	Jan 4, 2008
Analyzing Attack Surface Code Coverage	Justin Seitz	Nov 14, 2007
Forensic Analysis of a SQL Server 2005 Database Server	Kevvie Fowler	Sep 28, 2007
Automated Scanning of Oracle 10g Databases	Rory McCune	Aug 7, 2007
Using Oracle Forensics to determine vulnerability to Zero Day exploits	Paul Wright	Feb 28, 2007
Security in Sun Java System Application Server Platform Edition 8.0	Sid Ansari	Jun 29, 2005
Web Browser Insecurity	Paul Asadoorian	Jun 2, 2005
Application Firewalls: Don’t Forget About Layer 7	Russell Eubanks	May 17, 2005
Reining in the LAN client	David Monaco	Feb 25, 2005
Papers taken from SANS Reading Room.

Authentication

SSL/TLS: What’s Under the Hood	Sally Vandeven	Dec 30, 2014
Implementing a Shibboleth SSO Infrastructure	Rich Graves	Nov 17, 2014
Beyond the cookie: Using network traffic characteristics to enhance confidence in user identity	Courtney Imbert	Aug 19, 2014
SANS Institute Product Review: Demystifying External Authorization: Oracle Entitlements Server Product Review	Tanya Baccam	Jun 17, 2014
SANS Institute Product Review: Self-Service Provisioning Made Simple: A Review of Oracle Identity Manager 11g R2	Dave Shackleford	Jun 17, 2014
Adding Enterprise Access Management to Identity Management	J. Michael Butler	Jun 17, 2014
Extending Role Based Access Control	J. Michael Butler	Jun 17, 2014
Smart Strategies for Securing Extranet Access	Dave Shackleford	Jun 17, 2014
An Architecture for Implementing Enterprise Multifactor Authentication with Open Source Tools	Tom Webb	Mar 27, 2014
Implementing IEEE 802.1x for Wired Networks	Johan Loos	Mar 14, 2014
The Dangers of Weak Hashes	Kelly Brown	Dec 4, 2013
Daisy Chain Authentication	Courtney Imbert	Sep 18, 2013
Two-Factor Authentication: Can You Choose the Right One?	Emilio Valente	Oct 15, 2009
OS and Application Fingerprinting Techniques	Jon Mark Allen	Oct 22, 2008
Simple Formula for Strong Passwords (SFSP) Tutorial	Bernie Thomas	May 17, 2005
Installing a Secure Network DHCP Registration System	Pam Fournier	May 5, 2005
Secure implementation of Enterprise single sign-on product in an organization	Ravikanth Ponnapalli	Jan 18, 2005
Papers taken from SANS Reading Room.

Securing Code

Agile defensive perimiters: forming the security test regression pack	Michael Hendrik Matthee	Nov 20, 2014
Application Security: Tools for Getting Management Support and Funding	John Pescatore	Jun 17, 2014
Survey on Application Security Programs and Practices		Jun 17, 2014
PowerBroker vs. Sudo		Jun 17, 2014
Web Application Injection Vulnerabilities: A Web App’s Security Nemesis?	Erik Couture	Jun 14, 2013
Which Disney© Princess are YOU?	Joshua Brower	Mar 18, 2010
Secure Authentication on the Internet	Roger Meyer	Feb 1, 2008
Software Engineering – Security as a Process in the SDLC	Nithin Haridas	Aug 7, 2007
How to Avoid Information Disclosure when Managing Windows with WMI	Alex Timkov	Jul 17, 2007
Threat Modeling: A Process To Ensure Application Security	Steven Burns	Oct 5, 2005
Papers taken from SANS Reading Room.

Applications and Systems Development Security

Paper	Author	Date
Building Security into the System Development Life Cycle (SDLC): A Case Study	James Purcell	Aug 9, 2007
Application Security	Dan McGinn-Combs	Apr 9, 2007
Defining and Understanding Security in the Software Development Life Cycle	James Purcell	Apr 6, 2007
Outsourcing	Daniel Accioly Rosa	Mar 30, 2007
Comparing Software Development Life Cycles	Jim Hurst	Mar 23, 2007
Comparison of Java Applets and ActiveX Controls	Jim Hurst	Mar 23, 2007
Employee Management Security Controls	James E. Purcell	Mar 23, 2007
The Capability Maturity Model and Its Applications	Jim Hurst	Mar 20, 2007
Overview and Tutorial on Artificial Intelligence Systems	Jim Hurst	Mar 20, 2007
Comparison of Software Development Lifecycle Methodologies	James Purcell	Feb 12, 2007
Papers taken from the CISSP® certification prep domain.

from: http://software-security.sans.org/resources/whitepapers

Developer How To Guide

The SANS Developer How To Guide provides developers with simple code examples that quickly show how to prevent common security vulnerabilities.

How To Fix SQL Injection

• Java
  • PreparedStatement
  • CallableStatement
  • Hibernate
  • MyBatis
  • Java Persistence API (JPA)

• Database Code
  • Oracle
  • MySQL
  • SQL Server

• .Net
  • Parameterized Queries

• PHP
  • Prepared Statements

Cross-Site Scripting (XSS)

• .Net
  • Web Protection Library

Cross-Site Request Forgery (CSRF)

• .Net
  • ViewStateUserKey & Double Submit Cookie

from: http://software-security.sans.org/developer-how-to/

Securing Web Application Technologies – [SWAT] Checklist

The SWAT Checklist provides an easy to reference set of best practices that raise awareness and help development teams create more secure applications. It’s a first step toward building a base of security knowledge around web application security. Use this checklist to identify the minimum standard that is required to neutralize vulnerabilities in your critical applications.

ERROR HANDLING AND LOGGING

BEST PRACTICE		DESCRIPTION	CWE ID
	Display Generic Error Messages	Error messages should not reveal details about the internal state of the application. For example, file system path and stack information should not be exposed to the user through error messages.	CWE-209
	No Unhandled Exceptions	Given the languages and frameworks in use for web application development, never allow an unhandled exception to occur. Error handlers should be configured to handle unexpected errors and gracefully return controlled output to the user.	CWE-391
	Suppress Framework Generated Errors	Your development framework or platform may generate default error messages. These should be suppressed or replaced with customized error messages as framework generated messages may reveal sensitive information to the user.	CWE-209
	Log All Authentication Activities	Any authentication activities, whether successful or not, should be logged.	CWE-778
	Log All Privilege Changes	Any activities or occasions where the user’s privilege level changes should be logged.	CWE-778
	Log Administrative Activities	Any administrative activities on the application or any of its components should be logged.	CWE-778
	Log Access To Sensitive Data	Any access to sensitive data should be logged. This is particularly important for corporations that have to meet regulatory requirements like HIPAA, PCI, or SOX.	CWE-778
	Do Not Log Inappropriate Data	While logging errors and auditing access is important, sensitive data should never be logged in an unencrypted form. For example, under HIPAA and PCI, it would be a violation to log sensitive data into the log itself unless the log is encrypted on the disk. Additionally, it can create a serious exposure point should the web application itself become compromised.	CWE-532
	Store Logs Securely	Logs should be stored and maintained appropriately to avoid information loss or tampering by intruder. Log retention should also follow the retention policy set forth by the organization to meet regulatory requirements and provide enough information for forensic and incident response activities.	CWE-533

DATA PROTECTION

BEST PRACTICE		DESCRIPTION	CWE ID
	Use SSL Everywhere	Ideally, SSL should be used for your entire application. If you have to limit where it’s used then SSL must be applied to any authentication pages as well as all pages after the user is authenticated. If sensitive information (e.g. personal information) can be submitted before authentication those features must also be sent over SSL. EXAMPLE: Firesheep	CWE-311 CWE-319 CWE-523
	Disable HTTP Access For All SSL Enabled Resources	For all pages requiring protection by SSL, the same URL should not be accessible via the non-SSL channel.	CWE-319
	Use The Strict- Transport-Security Header	The Strict-Transport-Security header ensures that the browser does not talk to the server over non-SSL. This helps reduce the risk of SSL stripping attacks as implemented by the sslsniff tool.
	Store User Passwords Using A Strong, Iterative, Salted Hash	User passwords must be stored using secure hashing techniques with a strong algorithm like SHA-256. Simply hashing the password a single time does not sufficiently protect the password. Use iterative hashing with a random salt to make the hash strong. EXAMPLE: LinkedIn password leak	CWE-257
	Securely Exchange Encryption Keys	If encryption keys are exchanged or pre-set in your application then any key establishment or exchange must be performed over a secure channel
	Set Up Secure Key Management Processes	When keys are stored in your system they must be properly secured and only accessible to the appropriate staff on a need to know basis.	CWE-320
	Disable Weak SSL Ciphers On Servers	Weak SSL ciphers must be disabled on all servers. For example, SSL v2 has known weaknesses and is not considered to be secure. Additionally, some ciphers are cryptographically weak and should be disabled.
	Use Valid SSL Certificates From A Reputable Ca	SSL certificates should be signed by a reputable certificate authority. The name on the certificate should match the FQDN of the website. The certificate itself should be valid and not expired. EXAMPLE: CA Compromise (http://en.wikipedia.org/wiki/DigiNotar)
	Disable Data Caching Using Cache Control Headers And Autocomplete	Browser data caching should be disabled using the cache control HTTP headers or meta tags within the HTML page. Additionally, sensitive input fields, such as the login form, should have the autocomplete=off setting in the HTML form to instruct the browser not to cache the credentials.	CWE-524
	Limit The Use And Storage Of Sensitive Data	Conduct an evaluation to ensure that sensitive data is not being unnecessarily transported or stored. Where possible, use tokenization to reduce data exposure risks.

CONFIGURATION AND OPERATIONS

BEST PRACTICE		DESCRIPTION	CWE ID
	Establish A Rigorous Change Management Process	A rigorous change management process must be maintained during change management operations. For example, new releases should only be deployed after process EXAMPLE: RBS production outage (http://www.computing.co.uk/ctg/analysis/2186972/rbs-wrong-rbs-manager)	CWE-439
	Define Security Requirements	Engage the business owner to define security requirements for the application. This includes items that range from the whitelist validation rules all the way to nonfunctional requirements like the performance of the login function. Defining these requirements up front ensures that security is baked into the system.
	Conduct A Design Review	Integrating security into the design phase saves money and time. Conduct a risk review with security professionals and threat model the application to identify key risks. The helps you integrate appropriate countermeasures into the design and architecture of the application.	CWE-701 CWE-656
	Perform Code Reviews	Security focused code reviews can be one of the most effective ways to find security bugs. Regularly review your code looking for common issues like SQL Injection and Cross-Site Scripting.	CWE-702
	Perform Security Testing	Conduct security testing both during and after development to ensure the application meets security standards. Testing should also be conducted after major releases to ensure vulnerabilities did not get introduced during the update process.
	Harden The Infrastructure	All components of infrastructure that support the application should be configured according to security best practices and hardening guidelines. In a typical web application this can include routers, firewalls, network switches, operating systems, web servers, application servers, databases, and application frameworks.	CWE-15 CWE-656
	Define An Incident Handling Plan	An incident handling plan should be drafted and tested on a regular basis. The contact list of people to involve in a security incident related to the application should be well defined and kept up to date.
	Educate The Team On Security	Training helps define a common language that the team can use to improve the security of the application. Education should not be confined solely to software developers, testers, and architects. Anyone associated with the development process, such as business analysts and project managers, should all have periodic software security awareness training.

AUTHENTICATION

BEST PRACTICE		DESCRIPTION	CWE ID
	Don’t Hardcode Credentials	Never allow credentials to be stored directly within the application code. While it can be convenient to test application code with hardcoded credentials during development this significantly increases risk and should be avoided. EXAMPLE: Hard coded passwords in networking devices https://www.us-cert.gov/control_systems/pdf/ICSA-12-243-01.pdf	CWE-798
	Develop A Strong Password Reset System	Password reset systems are often the weakest link in an application. These systems are often based on the user answering personal questions to establish their identity and in turn reset the password. The system needs to be based on questions that are both hard to guess and brute force. Additionally, any password reset option must not reveal whether or not an account is valid, preventing username harvesting. EXAMPLE: Sara Palin password hack (http://en.wikipedia.org/wiki/Sarah_Palin_email_hack)	CWE-640
	Implement A Strong Password Policy	A password policy should be created and implemented so that passwords meet specific strength criteria. EXAMPLE: http://www.pcworld.com/article/128823/study_weak_passwords_really_do_help_hackers.html	CWE-521
	Implement Account Lockout Against Brute Force Attacks	Account lockout needs to be implemented to guard against brute forcing attacks against both the authentication and password reset functionality. After several tries on a specific user account, the account should be locked for a period of time or until manually unlocked. Additionally, it is best to continue the same failure message indicating that the credentials are incorrect or the account is locked to prevent an attacker from harvesting usernames.	CWE-307
	Don’t Disclose Too Much Information In Error Messages	Messages for authentication errors must be clear and, at the same time, be written so that sensitive information about the system is not disclosed. For example, error messages which reveal that the userid is valid but that the corresponding password is incorrect confirms to an attacker that the account does exist on the system.
	Store Database Credentials Securely	Modern web applications usually consist of multiple layers. The business logic tier (processing of information) often connects to the data tier (database). Connecting to the database, of course, requires authentication. The authentication credentials in the business logic tier must be stored in a centralized location that is locked down. Scattering credentials throughout the source code is not acceptable. Some development frameworks provide a centralized secure location for storing credentials to the backend database. These encrypted stores should be leveraged when possible.	CWE-257
	Applications And Middleware Should Run With Minimal Privileges	If an application becomes compromised it is important that the application itself and any middleware services be configured to run with minimal privileges. For instance, while the application layer or business layer needs the ability to read and write data to the underlying database, administrative credentials that grant access to other databases or tables should not be provided.	CWE-250

SESSION MANAGEMENT

BEST PRACTICE		DESCRIPTION	CWE ID
	Ensure That Session Identifiers Are Sufficiently Random	Session tokens must be generated by secure random functions and must be of a sufficient length so as to withstand analysis and prediction.	CWE-6
	Regenerate Session Tokens	Session tokens should be regenerated when the user authenticates to the application and when the user privilege level changes. Additionally, should the encryption status change, the session token should always be regenerated	CWE-384
	Implement An Idle Session Timeout	When a user is not active, the application should automatically log the user out. Be aware that Ajax applications may make recurring calls to the application effectively resetting the timeout counter automatically.	CWE-613
	Implement An Absolute Session Timeout	Users should be logged out after an extensive amount of time (e.g. 4-8 hours) has passed since they logged in. This helps mitigate the risk of an attacker using a hijacked session.	CWE-613
	Destroy Sessions At Any Sign Of Tampering	Unless the application requires multiple simultaneous sessions for a single user, implement features to detect session cloning attempts. Should any sign of session cloning be detected, the session should be destroyed, forcing the real user to re-authenticate.
	Invalidate The Session After Logout	When the user logs out of the application the session and corresponding data on the server must be destroyed. This ensures that the session can not be accidentally revived.	CWE-613
	Place A Logout Button On Every Page	The logout button or logout link should be easily accessible to the user on every page after they have authenticated.
	Use Secure Cookie Attributes (I.E. Httponly And Secure Flags)	The session cookie should be set with both the HttpOnly and the Secure flags. This ensures that the session id will not be accessible to client-side scripts and it will only be transmitted over SSL, respectively.	CWE-79 CWE-614
	Set The Cookie Domain And Path Correctly	The cookie domain and path scope should be set to the most restrictive settings for your application. Any wildcard domain scoped cookie must have a good justification for its existence.
	Set The Cookie Expiration Time	The session cookie should have a reasonable expiration time. Non-expiring session cookies should be avoided.

INPUT AND OUTPUT HANDLING

BEST PRACTICE		DESCRIPTION	CWE ID
	Conduct Contextual Output Encoding	All output functions must contextually encode data before sending it to the user. Depending on where the output will end up in the HTML page, the output must be encoded differently. For example, data placed in the URL context must be encoded differently than data placed in JavaScript context within the HTML page. EXAMPLE: Resource: https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet	CWE-79
	Prefer Whitelists Over Blacklists	For each user input field, there should be validation on the input content. Whitelisting input is the preferred approach. Only accept data that meets a certain criteria. For input that needs more flexibility, blacklisting can also be applied where known bad input patterns or characters are blocked.	CWE-159 CWE-144
	Use Parameterized SQL Queries	SQL queries should be crafted with user content passed into a bind variable. Queries written this way are safe against SQL injection attacks. SQL queries should not be created dynamically using string concatenation. Similarly, the SQL query string used in a bound or parameterized query should never be dynamically built from user input. EXAMPLE: Sony SQL injection Hack (http://www.infosecurity-magazine.com/view/27930/lulzsec-sony-pictures-hackers-were-school-chums)	CWE-89 CWE-564
	Use Tokens To Prevent Forged Requests	In order to prevent Cross-Site Request Forgery attacks, you must embed a random value that is not known to third parties into the HTML form. This CSRF protection token must be unique to each request. This prevents a forged CSRF request from being submitted because the attacker does not know the value of the token.	CWE-352
	Set The Encoding For Your Application	For every page in your application set the encoding using HTTP headers or meta tags within HTML. This ensures that the encoding of the page is always defined and that browser will not have to determine the encoding on its own. Setting a consistent encoding, like UTF-8, for your application reduces the overall risk of issues like Cross-Site Scripting.	CWE-172
	Validate Uploaded Files	When accepting file uploads from the user make sure to validate the size of the file, the file type, and the file contents as well as ensuring that it is not possible to override the destination path for the file.	CWE-434 CWE-616 CWE-22
	Use The Nosniff Header For Uploaded Content	When hosting user uploaded content which can be viewed by other users, use the X-Content-Type-Options: nosniff header so that browsers do not try to guess the data type. Sometimes the browser can be tricked into displaying the data type incorrectly (e.g. showing a GIF file as HTML). Always let the server or application determine the data type.	CWE-430
	Validate The Source Of Input	The source of the input must be validated. For example, if input is expected from a POST request do not accept the input variable from a GET request.	CWE-20 CWE-346
	Use The X-Frame- Options Header	Use the X-Frame-Options header to prevent content from being loaded by a foreign site in a frame. This mitigates Clickjacking attacks. For older browsers that do not support this header add framebusting Javascript code to mitigate Clickjacking (although this method is not foolproof and can be circumvented). EXAMPLE: Flash camera and mic hack (http://jeremiahgrossman.blogspot.com/2008/10/clickjacking-web-pages-can-see-and-hear.html)	CAPEC-103 CWE-693
	Use Content Security Policy (CsP) Or X-Xss- Protection Headers	Content Security Policy (CSP) and X-XSS-Protection headers help defend against many common reflected Cross-Site Scripting (XSS) attacks.	CWE-79 CWE-692

ACCESS CONTROL

BEST PRACTICE		DESCRIPTION	CWE ID
	Apply Access Controls Checks Consistently	Always apply the principle of complete mediation, forcing all requests through a common security “gate keeper.” This ensures that access control checks are triggered whether or not the user is authenticated.	CWE-284
	Apply The Principle Of Least Privilege	Make use of a Mandatory Access Control system. All access decisions will be based on the principle of least privilege. If not explicitly allowed then access should be denied. Additionally, after an account is created, rights must be specifically added to that account to grant access to resources.	CWE-272 CWE-250
	Don’t Use Direct Object References For Access Control Checks	Do not allow direct references to files or parameters that can be manipulated to grant excessive access. Access control decisions must be based on the authenticated user identity and trusted server side information.	CWE-284
	Don’t Use Unvalidated Forwards Or Redirects	An unvalidated forward can allow an attacker to access private content without authentication. Unvalidated redirects allow an attacker to lure victims into visiting malicious sites. Prevent these from occurring by conducting the appropriate access controls checks before sending the user to the given location.	CWE-601

SynAcktiv.com Digital Security Tools and Documents

TOOLS

• Cisco ACS Repo Decrypt, decrypt Cisco ACS repository passwords
• des26 SAP ITS Decrypt, decrypt des26 SAP ITS (Internet Transaction Server) passwords
• VanDyke SecureCRT Decrypt, decrypt SSH passwords stored in VanDyke SecureCRT session files
• Ethercomm, PoC to reactivate the TCP/32764 backdoor
• SAP SecStore Decrypt, SAP SecStore decryption
• Dissipe, Sage ERP X3 internal passwords decryption
• InYourFace, JSF ViewState tampering
• jimmix, remote administration tool for JBoss AS using the JMXInvoker
• passe-partout, in memory extraction of RSA/DSA keys
• rdp2tcp, TCP tunneling over RDP
• BlueBerry, BlackBerry Enterprise Server passwords decryption

PUBLICATIONS

2015

• Using reverse engineering skills during a penetration test: practical cases, MISC Magazine, Eloi Vanderbeken
• Using a password cracking tool: John the Ripper, GNU/Linux Magazine, Julien Legras

2014

• G-Jacking AppEngine-based applications, NoSuchCon, Nicolas Collignon
• Advanced password breaking (FR), JSSI Rouen conference, Julien Legras
• NoSuchCon 2014 challenge, Eloi Vanderbeken and Nicolas Collignon
• Bypassing IDS/IPS with the TCP Fast Open option – proof-of-concept, Rump session SSTIC 2014, Nicolas Collignon and Renaud Dubourguais
• G-Jacking AppEngine-based Applications, HITB Amsterdam, Nicolas Collignon and Samir Megueddem
• Writeup for dosfun4u (idc), Defcon CTF quals 2014, Eloi Vanderbeken
• Reverse engineering of the Sercomm feature to reactivate the TCP/32764 backdoor on several routers, Eloi Vanderbeken
• Tools and techniques for Red-Team penetration tests, JSSI OSSIR, Renaud Feil
• Arbitrary code execution to escape the Google App Engine Python sandbox, Nicolas Collignon
• Cross-Site Scripting in the Converse.js XMPP/Jabber client, Renaud Dubourguais
• Discovery and patching of a Remote Code Execution in the WP-Filebase plugin, Samir Megueddem
• Discovery of a backdoor on Linksys routers, Eloi Vanderbeken
• Breaking passwords, BADGE ESIEA, Renaud Feil

2013

• OWASP ESAPI library HMAC validation bypass – proof-of-concept code, Renaud Dubourguais and Renaud Feil
• JSF ViewState upside-down, Renaud Dubourguais and Nicolas Collignon
• Oracle TNS protocol hijacking, SSTIC, Nicolas Collignon
• Pentesting JBoss AS in 2013, MISC n°67 (May/June 2013), Renaud Dubourguais
• CVE-2012-5611: MySQL DBMS memory exploitation, MISC n°67 (May/June 2013), Samir Megueddem
• WAF contest – video, JSSI OSSIR, Renaud Dubourguais and Renaud Feil
• J2EE frameworks security: the birth of Expression Language injections, JSSI Rouen, Renaud Dubourguais

2012

• The DevMode flag in Struts 2, SSTIC, Renaud Dubourguais
• Hacking (and securing) JBoss AS, Security Day, Renaud Dubourguais
• Criterium attack / QR-bit flip – vidéo, SSTIC, Nicolas Collignon
• Solution for the ESET BlackHat US Challenge, Eloi Vanderbeken
• Solving the SSTIC challenge, Eloi Vanderbeken

2011

• Pentests: exposing real world attacks, Security Day, Renaud Dubourguais
• Discovery and patching of SQL injections in the WordPress wp-polls plugin, Renaud Feil
• Publication of RDP protocol vulnerabilities, Nicolas Collignon
• Unpacking tips and tricks, MISC magazine HS 7, Eloi Vanderbeken
• Control-flow flattening and symbolic execution, SSTIC conference, Eloi Vanderbeken
• Generating and using memory dumps, RSSIL conference, Eloi Vanderbeken
• Hackito Ergo Sum Crackme, Hackito Ergo Sum conference, Eloi Vanderbeken

2010

• TCP tunneling over RDP, SSTIC, Nicolas Collignon
• Exploiting and securing JBoss AS, SSTIC, Renaud Dubourguais
• Feedback on enterprise applications security, NetFocus, Nicolas Collignon
• In memory extraction of SSL keys, HSC tips, Nicolas Collignon
• Forensic and Software (Un)obfuscation, ECIW conference, Eloi Vanderbeken

2009

• Webshells: how to have your network wide open, GS-Day, Renaud Dubourguais
• Shell over DTMF, SSTIC, Nicolas Collignon

2008

• VMware and virtualization security, OSSIR, Nicolas Collignon
• Penetration testing Windows systems, Télécom Bretagne, Renaud Feil
• Penetration testing web applications, Télécom ParisTech, Renaud Feil

2007

• Evolution of Cross Site Request Forgery attacks, Journal In Computer Virology, Renaud Feil
• Discovering IPv6 networks, SSTIC, Nicolas Collignon
• Feedback on PHP code audits, Forum PHP, Nicolas Collignon
• Web 2.0: more ergonomic… and less secure?, JSSI OSSIR, Renaud Feil
• Encrypting hostile web content over HTTP, SSTIC, Renaud Feil
• Evolution of CSRF attacks, SSTIC, Renaud Feil
• Keyloggers : from XP to Vista, MISC, Renaud Feil
• Detecting compromised systems, SolutionsLinux, Nicolas Collignon

2006

• IPv6: network security threats, IPv6 Worldwide Summit, Nicolas Collignon
• Bypassing web filtering systems, MISC, Renaud Feil
• Client-side vulnerabilities, SSTIC, Renaud Feil
• Impacts and threats around the IPv6 protocol, OSSIR, Nicolas Collignon

2002

• Playing with Windows /dev/(k)mem, Phrack, Nicolas Collignon

from: http://synacktiv.com/en/resources.html

BSDnow.tv Episodes

BSD Now

• by Jupiter Broadcasting

Youtube Channel: https://www.youtube.com/playlist?list=PLUW3LUwQvegyqk2Iqi-YD7Do-AyD4W0s1

• 			The Cluster & The Cloud | BSD Now 24 by Jupiter Broadcasting			1:09:45
  			Time Signatures | BSD Now 23 by Jupiter Broadcasting			1:15:45
  			Journaled News-Updates | BSD Now 22 by Jupiter Broadcasting			1:30:13
  			Tendresse for Ten | BSD Now 21 by Jupiter Broadcasting			1:47:06
  			Bhyve Mind | BSD Now 20 by Jupiter Broadcasting			1:23:34
  			The Installfest | BSD 19 by Jupiter Broadcasting			1:21:02
  			Eclipsing Binaries | BSD Now 18 by Jupiter Broadcasting			1:10:22
  			The Gift of Giving | BSD Now 17 by Jupiter Broadcasting			18:47
  			Cryptocrystalline | BSD Now 16 by Jupiter Broadcasting			1:50:22
  			Kickin’ NAS | BSD Now 15 by Jupiter Broadcasting			1:28:04
  			Zettabytes for Days | BSD Now 14 by Jupiter Broadcasting			1:48:14
  			Bridging the Gap | BSD Now 13 by Jupiter Broadcasting			1:18:49
  			Collecting SSHells | BSD Now 12 by Jupiter Broadcasting			1:08:12
  			The Gateway Drug | BSD Now 11 by Jupiter Broadcasting			1:49:13
  			Year of the BSD Desktop | BSD Now 10 by Jupiter Broadcasting			1:32:55
  			-CURRENT Events | BSD Now 9 by Jupiter Broadcasting			1:16:13
  			A Brief Intorduction | BSD Now 8 by Jupiter Broadcasting			1:21:06
  			Go Directly to Jail(8) | BSD Now 7 by Jupiter Broadcasting			1:16:50
  			Doing It de Raadt Way | BSD Now 6 by Jupiter Broadcasting			51:43
  			Stacks of Cache | BSD Now 5 by Jupiter Broadcasting			1:03:08
  			Teskeing the Possibilities | BSD Now 4 by Jupiter Broadcasting			36:23
  			MX with TTX | BSD Now 3 by Jupiter Broadcasting			1:01:17
  			Engineering and Powder Kegs | BSD Now 2 by Jupiter Broadcasting			1:40:55
  			BGP & BSD | BSD Now 1 by Jupiter Broadcasting			1:53:52
  			A Sixth pfSense | BSD 25 by Jupiter Broadcasting			1:07:56
  			Port Authority | BSD Now 26 by Jupiter Broadcasting			1:31:06
  			BSD Now vs. BSDTalk | BSD Now 27 by Jupiter Broadcasting			1:42:41
  			Ghost of Partition | BSD 28 by Jupiter Broadcasting			33:48
  			P.E.F.S. | BSD 29 by Jupiter Broadcasting			1:54:45
  			Edgy BSD Users | BSD Now 31 by Jupiter Broadcasting			1:09:08
  			PXE Dust | BSD Now 32 by Jupiter Broadcasting			1:16:51
  			Certified Package Delivery | BSD Now 33 by Jupiter Broadcasting			1:20:20
  			It’s Gonna Get NASty | BSD Now 34 by Jupiter Broadcasting			22:40
  			Puffy Firewall | BSD Now 35 by Jupiter Broadcasting			1:19:24
  			Let’s Get RAID | BSD Now 36 by Jupiter Broadcasting			1:30:48
  			BSDCanned Goods | BSD Now 37 by Jupiter Broadcasting			2:07:57
  			A BUG’s Life | BSD Now 38 by Jupiter Broadcasting			1:28:35
  			The Friendly Sandbox | BSD Now 39 by Jupiter Broadcasting			1:02:31
  			AirPorts & Packages | BSD Now 40 by Jupiter Broadcasting			1:13:24
  			Commit This Bit | BSD Now 41 by Jupiter Broadcasting			1:07:05
  			Devious Methods | BSD Now 42 by Jupiter Broadcasting			1:24:13
  			Package Design | BSD Now 43 by Jupiter Broadcasting			1:26:40
  			ZFS War Stories | BSD Now 45 by Jupiter Broadcasting			46:29
  			Network Iodometry | BSD Now 46 by Jupiter Broadcasting			1:45:53
  			DES Challenge IV | BSD Now 47 by Jupiter Broadcasting			1:32:48
  			Liberating SSL | BSD Now 48 by Jupiter Broadcasting			59:53
  			The PC-BSD Tour | BSD Now 49 by Jupiter Broadcasting			1:22:52
  			VPN, My Dear Watson | BSD Now 50 by Jupiter Broadcasting			1:27:30
  			Engineering Nginx | BSD Now 51 by Jupiter Broadcasting			1:27:28
  			Reverse Takeover | BSD Now 52 by Jupiter Broadcasting			1:14:32
  			It’s HAMMER Time | BSD Now 53 by Jupiter Broadcasting			1:18:28
  			Luminary Environment | BSD Now 54 by Jupiter Broadcasting			1:18:40
  			The Promised WLAN | BSD Now 55 by Jupiter Broadcasting			1:19:21
  			Beastly Infrastructure | BSD Now 56 by Jupiter Broadcasting			57:06
  			The Daemon’s Apprentice | BSD Now 57 by Jupiter Broadcasting			1:30:18
  			Behind the Masq | BSD Now 58 by Jupiter Broadcasting			1:15:54
  			BSDって聞いたことある？ | BSD Now 59 by Jupiter Broadcasting			1:20:08
  			Don’t Buy a Router | BSD Now 60 by Jupiter Broadcasting			1:08:41
  			IPSECond Wind | BSD Now 61 by Jupiter Broadcasting			1:14:57
  			Gift from the Sun | BSD Now 62 by Jupiter Broadcasting			34:09
  			A Man’s man(1) | BSD Now 63 by Jupiter Broadcasting			1:37:43
  			Rump Kernels Revisited | BSD Now 64 by Jupiter Broadcasting			1:53:33
  			8,000,000 Mogofoo-ops | BSD Now 65 by Jupiter Broadcasting			1:32:25
  			Conference Connoisseur | BSD Now 66 by Jupiter Broadcasting			1:22:33
  			Must Be Rigged | BSD Now 67 by Jupiter Broadcasting			1:21:00
  			Just the Essentials | BSD Now 68 by Jupiter Broadcasting			1:26:58
  			Under the Ports Tree | BSD Now 69 by Jupiter Broadcasting			1:12:34
  			Daemons in the North | BSD Now 70 by Jupiter Broadcasting			1:24:16
  			System Disaster | BSD Now 71 by Jupiter Broadcasting			1:06:41
  			Common *Sense Approach | BSD Now 72 by Jupiter Broadcasting			1:20:05
  			Pipe Dreams | BSD Now 73 by Jupiter Broadcasting			1:31:38
  			That Sly MINIX | BSD Now 74 by Jupiter Broadcasting			1:16:08
  			From the Foundation (Part 1) | BSD Now 75 by Jupiter Broadcasting			1:25:30
  			Time for a Change | BSD Now 76 by Jupiter Broadcasting			1:29:18
  			Noah’s L2ARC | BSD Now 77 by Jupiter Broadcasting			1:26:15
  			From the Foundation (Part 2) | BSD Now 78 by Jupiter Broadcasting			1:09:39
  			Just Add QEMU | BSD Now 79 by Jupiter Broadcasting			1:24:30
  			The PC-BSD Tour II | BSD Now 80 by Jupiter Broadcasting			1:20:11
  			Puffy in a Box | BSD Now 81 by Jupiter Broadcasting			1:26:10
  			SSL in the Wild | BSD Now 82 by Jupiter Broadcasting			1:28:04
  			woN DSB | BSD Now 83 by Jupiter Broadcasting			1:04:42
  			pkg remove freebsd-update | BSD Now 84 by Jupiter Broadcasting			1:14:56