Information Security Philippines

presents

The Past, Present, and Future of Risk Assessments (Webinar)

Live broadcast: June 24, 2008 @ 10 AM (PST); 1 PM (EST); 6 PM (BST)
Duration: 60 minutes

Moderator: John Sterlicchi, Infosecurity Magazine
Panelist: Michael Gregg, Villanova University
Panelist: Svetlana Hristozova, Marketing Manager, Villanova University Online

Description:
Join noted author and security expert Michael Gregg on June 24th to learn more about how risk assessments are changing to meet evolving security needs.

You’ll travel through time with Mr. Gregg to explore the progression of IS Security problems. For example, in the not too distant past, risk assessments were performed to counter attacks that were designed for glory and fame (Nimda, Code Red and SQL Slammer). These early attacks required massive amounts of time for cleanup and repair and relied on defensive technologies.

In today’s information age, attack vectors have changed. More recent incidents are financial in nature. Yesterday’s virus is today’s custom malware; while denial of service attacks have been
replaced with botnets.

Learn how this evolving threat has forced organizations to view risk assessments differently and develop new techniques. Get the essential solutions every IS and IT professional needs to counter current and future threats.

Who should attend:
Any IT or business professional interested in IS Security and assessing risk to an organization.

This Webinar will:

• Teach you more about how risk assessments are changing to meet evolving security needs. You’ll also discover the latest security solutions to safeguard your company’s ever-changing needs.
• Give you insight into the progression of IS Security issues. Plus, you’ll learn how this evolving threat has forced organizations to view risk assessments differently and develop new techniques.
• Provide you with the essential solutions every IS and IT professional needs to counter current and future threats.

This webinar is free to attend, but space is limited

Register Now

CISSPs and SSCPs can receive 1 CPE credit for attending this webinar. You can earn the credit by simply specifying your number on the registration form and correctly answering 3 multiple choice polling questions about the program at the end of the event.

presents

Network Vulnerability Assessment Workshop

March 26, 27 and 28 2008

In today’s world, it is getting more and more important for businesses to be connected and be accessible through the Internet. Businesses now put more stock into the viability of the net in increasing their profit margin and in large extent their public exposure. Thus, more financial value gets imbued into the data that goes around the wires.

That’s where the value of information security comes into play; assessing one’s readiness in defending information assets comes as a direct result of proper Vulnerability Assessment and to a larger scale of risk management. Getting one’s feet wet on VA will benefit not only the company’s security stance but also the individual’s appreciation of what could possibly lie ahead in terms of threats and risks, realization would also set on the extent of knowledge, time and investment to fully prepare one’s company in facing the growing challenges of today and tomorrow’s Internet.

Course Objectives:

At the end of the training, you should be able to:

• Determine the boundary of analysis and schedule of assessment
• Perform threat and impact analysis
• Define and verify policies of target assets for VA
• Execute active and passive information gathering techniques
• Utilize vulnerability scanning tools
• Generate technical and managerial VA reports

Who Should Attend:

• Network Managers
• System Administrators
• IT Managers
• IT Auditors
• Security Professionals

Course Outline:

 

DAY 1

 

• • Information Security Concepts
  • The Need for Information Security
  • Vulnerability Assessment Overview
  • The Security Process
  • Information Security Life Cycle
  • Threats to Computer and Network Systems
  • What is Ethical Hacking?
  • Types of Ethical Hacking
  • Responsibilities of an Ethical Hacker
  • Skills Requirements
  • Customer Expectations
  • Relevant Laws

• Introduction
  
• Foundations

DAY 2

 

• • Formal Methodologies
  • Methodology Overview
  • Open Source and Commercial Tools
  • The Live CD Approach
     

  • • Passive Information Gathering
    • Active Information Gathering
    • Social Engineering

    • Tools and Online Resources
    • Google Hacking

  • Project Start-Up
  • Information Gathering
  • Threat and Impact Analysis
  • Reconnaissance and Enumeration

• Getting Started
• Vulnerability Assessment

DAY 3

 

• • • Technical Report
    • Managerial Report

  • Vulnerability Scanning
  • Report Generation
  • Web Application Securit
     

  • Summary
  • Information Security Policies
  • Introduction to Penetration Testing

• Vulnerability Assessment
• Synopsis

Miscellaneous

Reports

Checklists

Technical Reports

Managerial Reports

Please bring your laptop.

Trainer’s Profile:

Ariel Ben T. Senga, CISSP

Ariel is the President and CEO of SeQure Technologies, which he cofounded in 2005. He is also a Certified Information Systems Security Professional. Ariel has intensive experience in various information systems management and development in IT, communications, manufacturing, government, and engineering industries. He has conducted various engagements related to IT internal control reviews, standards compliances, and internal audit reviews.

Currently, he has been managing all of SeQure Technologies’ security services such as vulnerability assessments, penetration testing, security assessments and audits, policy controls, and network infrastructure deployments.

Ariel has developed training courses in security awareness, network vulnerability assessment and penetration testing. As with course development, Ariel has presented in Universities and Colleges in the Philippines as an information security advocate.

Training Schedule: March 26, 27 and 28, 2008 (3 Days w/ Lunch + Refreshment Snacks)

Course Fee: PhP 17,500.00 (Exclusive of 12% VAT)

Includes: Student Manual, Live CD, and Certificate of Completion

Venue: CEO Suite, 37th Flr. LKG Tower 6801 Ayala Ave. 1226 Makati City

For more details, please call or text Pamela Chua at +63 922 8742757 or email pam@poshmarketingservices.com.

Cancellation of registration should be made seven working-days before the training date. Otherwise, 50% of the training fee shall be charged. No show during the training shall be charged 100% of the training fee.

presents

Malcode Analysis and Response: Proficiency vs. Complexity

by Matt Allen and Russ McRee

Thursday, March 20, 2008 at 1:00 PM EDT (1700 UTC/GMT)

The threat landscape changes constantly, driven in part by the “bot economy” and changing malcode techniques. In response, incident handler techniques must keep pace. This presentation will cover the use of RAPIER, a security tool built to facilitate first response procedures for incident handling. It is designed to acquire commonly requested information and samples during an information security event, incident, or investigation. RAPIER automates the entire process of data collection and delivers the results directly to the hands of a skilled security analyst. From detection and discovery, capture and containment, count on a useful discussion meant to further your incident response practices.

The second part of this webcast will discuss how malicious code authors are persistently introducing new hurdles to complicate reverse engineering. At Norman, we combine observations from our labs with feedback from SandBox customers to identify complexities responsible for wearing down efficient analysis of new threats. The impact of new SandBox capabilities for addressing these complexities will be introduced, followed by a short discussion of top priorities in the SandBox product roadmap.

Matt Allen: With backgrounds in computer and information sciences as well as business, Matt Allen has worked in a number of different roles at Norman over the past 5 years, varying from incident response to web and software development. Matt is currently working with the SandBox team on various projects ranging from development to marketing.

Russ McRee: Russ McRee, GCIH, GCFA, CISSP is a security analyst working in the Seattle area. He’s the author of ISSA Journal’s monthly column Toolsmith, and has written for Information Security, Linux Pro, SysAdmin and others, including an OWASP whitepaper. Prior speaking engagements include SecureWorld Expo, ISSA Northwest Regional, WSA SIG, RAID 2005, and Linuxfest Northwest. Russ has been a board member of ISSA Puget Sound, and is a member of PACCISO, InfraGard and CCSA. Russ maintains holisticinfosec.org.

Register for this free webseminar.

presents

Security Insights with Dr. Eric Cole

Wednesday, March 19, 2008 at 1:00 PM EDT (1700 UTC/GMT)

Most people think that encryption protects attackers from accessing sensitive information, but it is important to remember that encryption stops anyone from reading information. Therefore if it is not properly deployed, encryption can actually decrease security if it blinds critical security components from analyzing traffic. In addition, many companies are deploying full disk encryption but if it is not configured correctly, it might be providing a false sense of security.

Based on first-hand experience, this talk will look at areas where encryption should be used and how to avoid common mistakes. Dr. Cole will also identify areas where encryption should not be deployed. Overall, this talk will provide expert knowledge of the landscape of encryption, proper uses and common pitfalls.

Dr. Eric Cole is an industry recognized security expert, with over 15 year’s hands-on experience. Dr. Cole currently performs leading edge security consulting and works in research and development to advance the state of the art in information systems security. Dr. Cole has experience in information technology, with a focus on perimeter defense, secure network design, vulnerability discovery, penetration testing, and intrusion detection systems. Dr. Cole has a Masters in Computer Science from NYIT, and Ph.D. from Pace University with a concentration in Information Security. Dr. Cole is the author of several books to include Hackers Beware, Hiding in Plain Site, Network Security Bible and Insider Threat. He is also the inventor of over 20 patents and is a researcher, writer, and speaker. Eric is also a senior scientist with Lockheed Martin Information Technology (LMIT) and Lockheed Martin (LM) fellow. Dr. Cole is actively involved with The SANS Technology Institute (STI) and SANS actively working with students, teaching, maintaining and developing courseware.

Register now for this free webcast!

presents

What Works: PaulDotCom’s Penetration Testing Dojo: Core IMPACT Style

by Alan Paller and Paul Asadoorian

Tuesday, March 18 at 1:00 PM EDT (1700 UTC/GMT)

When beginning a security process at a consortium of non-profits, senior network security engineer, Paul Asadoorian of Pauldotcom began looking for a penetration testing tool that did network, web application and social engineering tests. The tool he purchased is low on manpower use, mostly self-maintaining and reliably proves the existence of network vulnerabilities. Please attend this webcast to find out why Paul selected CORE IMPACT and learn how it can help you safely perform network, web application and end-user penetration testing.

About the Speakers:

Alan Paller:

Alan is the Director of Research for the SANS Institute, responsible for overseeing all research projects ranging from the SANS Step-by-Step guides to the SANS digests to the Top Twenty Internet Security Threats. He the founder of the CIO Institute, and earned his degrees in Computer Science and Engineering from Cornell and MIT. Alan is the author of the EIS Book: Information Systems for Top Managers and How to Give the Best Presentation of Your Life. In 2001 the President named Alan as one of the original members of the National Infrastructure Advisory Council. The Federal CIO Council chose him as its 2005 Azimuth Award winner recognizing his vision and outstanding service to federal information technology.In 2007, CIO Decisions, eWeek , and Baseline magazines jointly selected Alan as one of the 100 most influential people in the Information technology field.

Paul Asadoorian:

Paul Asadoorian GCIA, GCIH, Founder & Chief Executive Officer Paul Asadoorian has over 5 years experience working in the information security field. His work experience covers both major corporations and academic institutions. He currently holds two GIAC (Global Information Assurance Certification) certifications in intrusion detection (GCIA, GIAC Certified Intrusion Analyst) and incident response (GCIH, GIAC Certified Incident Handler). Paul also sits on the GCIA advisory board, has spent one year as a GCIA authorized grader, and continues to stay involved in the SANS (SysAdmin, Audit, Network, Security) Institute. His research has appeared in the book Network Intrusion Detection, 3rd edition, and also in the SANS Reading Room web site. Paul has presented for numerous organizations and conferences, including MIT Security Camp, and ISACA (Information Systems Audit and Control Association). Paul graduated from Bryant College with a bachelor of science in Computer Information Systems.

Sign-up to attend the free webcast.

Anatomy of a Breach Webcast

June 13 , 2007- 12 p.m. EDT

You harbor vast amounts of confidential information ranging from credit cards to health information to corporate plans. That proprietary data is today’s “new money” and someone is willing to pay for it. Unfortunately, the miscreants who want it may know more about technology—and your IT environment—than your own staff. The stakes are enormous: for your customers, your company, and you.

In this webcast, we examine the fundamental shift of IT risk to the insider threat and the inability of legacy protection mechanisms to stop it. We itemize and quantify the impact from containment to notification. Most importantly, we discuss eradication of the breach risk. New, targeted, caustic threats require new responses that strictly secure your critical information assets, while proving it with 100 percent surety.

Who Should Watch:
Executives responsible for audits, compliance and mitigating data breach risks and security professionals responsible for protecting critical assets on their networks
About the speakers:
William Malik
Consultant, Identity and Information Security
Malik Consulting

Bill Malik has been well-known in information security since the early 1990s when he was a founding member of Gartner’s Information Security Strategies service. He began his IT career in Boston as an applications programmer with the John Hancock Insurance Company following undergraduate work at MIT. He joined IBM’s MVS team and worked in development, testing, business planning, and strategic planning for a dozen years. He moved to Gartner in 1990 and held a series of roles as an analyst and manager through 2002. As CTO of Waveset, a start-up in identity management, he helped the firm grow through its acquisition by Sun, where Bill became Director of Marketing for Security. In 2004 Bill established his independent consulting firm, where he helps clients develop their identity management and information security programs.

Robert Ciampa
Vice President, Marketing and Business Strategy
Trusted Network Technologies

Rob Ciampa has more than 20 years of experience in IT risk management, networking and security. Rob has worked with companies around the world designing and implementing secure infrastructures. An early OS engineer for HP and a former switch and router designer for 3Com, he co-founded one of world’s largest network and security integration firms. Rob then went on to Access360, where he was instrumental in its acquisition by IBM, where he subsequently ran IBM’s worldwide channel for security and identity management. In additional to television commentary on IT and computer security issues, Rob is frequently a featured speaker at major IT venues and events internationally. He has a B.S. in computer science and an M.S. in computer engineering from the University of Massachusetts, as well as an M.B.A. from Boston University. He holds two patents in information technology management. His blog is www.knowidentity.com.

Join the Anatomy of a Breach Webcast

Imagine a world without hackers.

For the past decade, corporations around the world have been hemorrhaging data to online criminal syndicates. These organized hackers no longer attack for fun, but now exploit vulnerabilities for financial gain. This Web seminar discusses 5 key gaps in cyber security that hackers are able to consistently and repeatedly exploit and shows you how to prepare your company to defend against evolving cyber threats.

Attend this Web seminar and join Tom Kellermann, former head of cyber intelligence and policy management within the World Bank Treasury Security team, as he discusses five key gaps in cyber security, how you can better manage cyber security risks and how the world has changed in the face of emerging threats.

Download the Web seminar now!

SANS information security training is making its annual trip down under! They invite you to join them on 19-24 February at the Hilton in Brisbane where four of SANS top instructors will present the following courses:

Security 401: SANS Security Essentials Bootcamp Style
Instructor: Marcus Sachs, SRI International
http://www.sans.org/info/1791

Security 504: Hacker Techniques, Exploits & Incident Handling
Instructor: Mike Poor, Intelguardians
http://www.sans.org/info/1792

Security 508: System Forensics, Investigation & Response
Instructor: Rob Lee, ManTech CFIA
http://www.sans.org/info/1793

 Security 617: Assessing and Securing Wireless Networks
Instructor: Mark Hofman, Shearwater Solutions
http://www.sans.org/info/1794

Each of the links above provides you with complete course descriptions to help you make the right choice for your training needs.  All four of these courses are hands on, meaning that you will return to work with actionable skills you can use immediately to improve the security of your networks and systems.  The $250 tuition fee discount is still available, but only through 10 January.  So get all your plans in order and register before the busy holiday season gets into full swing!

SANS Brisbane 2007 - the world’s best information security training in one of the most beautiful and relaxing cities in Australia.
(http://www.sans.org/info/1795)

5th Annual Philippine IT Security Conference
September 11- 12, 2006
Hotel Intercontinental
Makati City, Philippines 

This year’s 5th Information Systems Security conference and exhibit is dubbed: “ManilaCon 2k6:progress@risk” and is organized by the Information Systems Security Society of the Philippines (ISSSP), in cooperation with the Commission on Information and Communications Technology (CICT) and the National Security Council (NSC) towards the development and implementation of a National Cyber Security Strategy.

We need one to ensure the integration of public and private efforts to counter threats and institutionalize the protection of national and local cyber infrastructures and businesses.

We expect all security concerned CEOs, CIOs, Security Officers and Systems Administrators/Programmers to be more vigilant in securing cyberspace, not just for the protection of their respective enterprises but for the protection and security of all those existing and doing business in cyberspace.

This conference and exhibit is designed to kick-start this national effort and concern.

To join, please see below, details of the program schedule and delegate fees.

For registration or more information, please call Ellen at the ISSSP Secretariat telefax no. 750-3742 or mobile 0920-2413954. Or send email to isssphil[at]yahoo.com. You may also visit http://www.isssp.org.ph/ for other details of this conference and exhibit and/or to register online.

Signed: 

AMADO A. MALACAMAN, JR., President – ISSSP             

Angelo Timoteo M. Diaz De Rivera,  Commissioner – CICT

(more…)