Jan works as a Team Leader of ALEFs Computer Security Incident Response Team (CSIRT). He spends most of his working hours dealing with security incidents, malware analyses and other traditional Blue Team activities, although more and more of his time is taken by penetration tests, security reviews and teaching security-related courses. In his free time, Jan likes to delve into independent security research and write articles and talk at conferences to further awareness of security issues among both IT professionals and the general public.

OSSTMM: The “Measure, Don’t Guess” Security Testing Methodology

The Open Source Security Testing Methodology Manual (OSSTMM) is – as it names suggests – a security testing methodology. Although almost anyone who deals with IT security testing has at least heard of it, not many use it in its original form. Most penetration testers, for example, usually take parts of it and incorporate them in their own methodologies. While this is not a bad approach, OSSTMM is quite powerful when used as a whole because then it allows us to test and/or audit security controls in a way which gives us a good and repeatable measure of the attack surface for any assets we are trying to protect. This gives us similar benefits for determining a size of an attack surface which CVSS gives us for measuring the severity of a specific vulnerability.

With version 4.0 of OSSTMM about to hit the metaphorical shelves, it is a good time to have a closer look at what the methodology can offer both when used as a whole and when only some parts are utilized during a security test. Which is what we’ll do in this talk.

Open Directories: Sensitive data (not) hiding in plain sight

As a part of long-term research into the security of Czech and Slovak Internet (.CZ and .SK domains and/or IP addresses geolocated within CZ or SK), ALEF CSIRT conducted an analysis of data from several thousand freely accessible open directories. Many files from these directories turned out to be quite interesting as Jan will discuss during his talk.