Team Leader ALEFs Computer Security Incident Response Team (CSIRT)
Jan works as a Team Leader of ALEFs Computer Security Incident Response Team (CSIRT). He spends most of his working hours dealing with security incidents, malware analyses and other traditional Blue Team activities, although more and more of his time is taken by penetration tests, security reviews and teaching security-related courses. In his free time, Jan likes to delve into independent security research and write articles and talk at conferences to further awareness of security issues among both IT professionals and the general public.
OSSTMM: The “Measure, Don’t Guess” Security Testing Methodology
The Open Source Security Testing Methodology Manual (OSSTMM) is – as it names suggests – a security testing methodology. Although almost anyone who deals with IT security testing has at least heard of it, not many use it in its original form. Most penetration testers, for example, usually take parts of it and incorporate them in their own methodologies. While this is not a bad approach, OSSTMM is quite powerful when used as a whole because then it allows us to test and/or audit security controls in a way which gives us a good and repeatable measure of the attack surface for any assets we are trying to protect. This gives us similar benefits for determining a size of an attack surface which CVSS gives us for measuring the severity of a specific vulnerability.
With version 4.0 of OSSTMM about to hit the metaphorical shelves, it is a good time to have a closer look at what the methodology can offer both when used as a whole and when only some parts are utilized during a security test. Which is what we’ll do in this talk.
Open Directories: Sensitive data (not) hiding in plain sight
As a part of long-term research into the security of Czech and Slovak Internet (.CZ and .SK domains and/or IP addresses geolocated within CZ or SK), ALEF CSIRT conducted an analysis of data from several thousand freely accessible open directories. Many files from these directories turned out to be quite interesting as Jan will discuss during his talk.
Are you the next cyber security superstar?
Ready for this year's presentations?
By registering you will unlock access to 60+ speakers and two full days with cyber security news & showcases from worldwide leaders.
Sponsors & Partners
They help us make this conference possible.
Orange Romania is the leader of the local telecom market and part of the Orange Group, one of the largest global telecommunications operators, connecting hundreds of millions of customers worldwide. With over 11 million customers and an annual turnover exceeding 1.5 billion euros, Orange Romania connects 1 in 2 Romanians and offers an extensive range of communication solutions to its customers, both individual users and companies, from basic services up to complete voice services, fixed and mobile data, TV services or smart home services, but also mobile financial services. Orange is also a leader in innovation investing yearly over 200 million euros in network infrastructure and R&D initiatives in Romania. In the past 3 years Orange has launched two 5G Labs in Bucharest and Iasi, that aim to support researchers, startups and companies to test their 5G solutions in advance. In addition, Orange is a long-term supporter of the startup ecosystem through the Orange Fab accelerator program designed to support entrepreneurs in the development of innovative products and their distribution locally and internationally.
Orange Services was created in 2013 and is a 100% owned subsidiary of Orange Group. As a technology services company, our DNA is in IT, but our teams also work in other domains including mobile networks and a number of commercial and business functions. Orange Services is one of the largest technology hubs in the Orange Group, working internationally for both Orange corporate functions and country operations. Through a unique combination of cutting edge know-how and expertise, our teams provide a broad range of services: development and supervision of IT services in domains such as Big Data, Cloud, M2M, IoT, TV, Connected Objects; design and development of IT infrastructure and desktop solutions; testing & planning for mobile networks; implementation of supply chain solutions and also improvement of commercial & business performance including BI, CRM, Analytics, Digital learning and Customer Care. Visit us on LinkedIn.