Team Leader ALEFs Computer Security Incident Response Team (CSIRT)
Jan works as a Team Leader of ALEFs Computer Security Incident Response Team (CSIRT). He spends most of his working hours dealing with security incidents, malware analyses and other traditional Blue Team activities, although more and more of his time is taken by penetration tests, security reviews and teaching security-related courses. In his free time, Jan likes to delve into independent security research and write articles and talk at conferences to further awareness of security issues among both IT professionals and the general public.
OSSTMM: The “Measure, Don’t Guess” Security Testing Methodology
The Open Source Security Testing Methodology Manual (OSSTMM) is – as it names suggests – a security testing methodology. Although almost anyone who deals with IT security testing has at least heard of it, not many use it in its original form. Most penetration testers, for example, usually take parts of it and incorporate them in their own methodologies. While this is not a bad approach, OSSTMM is quite powerful when used as a whole because then it allows us to test and/or audit security controls in a way which gives us a good and repeatable measure of the attack surface for any assets we are trying to protect. This gives us similar benefits for determining a size of an attack surface which CVSS gives us for measuring the severity of a specific vulnerability.
With version 4.0 of OSSTMM about to hit the metaphorical shelves, it is a good time to have a closer look at what the methodology can offer both when used as a whole and when only some parts are utilized during a security test. Which is what we’ll do in this talk.
Open Directories: Sensitive data (not) hiding in plain sight
As a part of long-term research into the security of Czech and Slovak Internet (.CZ and .SK domains and/or IP addresses geolocated within CZ or SK), ALEF CSIRT conducted an analysis of data from several thousand freely accessible open directories. Many files from these directories turned out to be quite interesting as Jan will discuss during his talk.
Are you the next cyber security superstar?
Ready for this year's presentations?
By registering you will unlock access to 60+ speakers and two full days with cyber security news & showcases from worldwide leaders.
Sponsors & Partners
They help us make this conference possible.
At Orange Business Services, we help our customers transform their industries, reimagine their services, create a positive impact and unleash the power of their data into an amazing and trusted resource.
With the dual expertise as a global operator coupled with the agility of an end-to-end integrator, Orange Business Services is a global network-native, digital services company. From connectivity, smart mobility services and the cloud to artificial intelligence (AI), analytics and cybersecurity, Orange Business Services helps businesses at every stage of their data management. Orange Business Services is represented in Romania by the business division of Orange Romania and helps large companies, SMEs and public authorities to transform their organizations through the use of technology and digital information.