June 2015 - USHE-assess - lists.utahtech.edu

worth watching
by Dustin Udy 09 Aug '15

09 Aug '15

Hey fellas – "IF" you get bored and want something fun and slightly educational over the long weekend, check out the SANS webcast about using Docker as malware analyst tool. Pretty sweet and valid for our audits. hxxps://www.sans.org/webcasts/run-linux-malware-analysis-apps-docker-contai… What you will want: A hypervisor and a Linux ISO. An hour or two for playing around and watching the video Dustin

2 1

Follow-up From CIO Meeting
by Andrew Goble 07 Jul '15

07 Jul '15

Strike Package is back online in it's new home as of about 4:30 today. SUU report materials please. I'd like to see if we can schedule a couple days to meet with as much of the team as we can get together and distribute new gear, review tactics, and re/build tools and systems. What does everybody's July look like? Week of July 6th, or week of July 13th. Could also do the last week of July if it was late in the week. Also, what does everyone's August 3 - 7 look like? We could possibly do Weber's assessment that week if we can field a team. Otherwise it will be mid-September with school starting and what not. We presented to the CIOs Friday. Notes Follow: We are set to continue. A longer time period is a go, (conditional upon institutional approval). Action Items out of the meeting: CIOs would like to designate a few system-wide standards, most of which could probably be taken straight out of SANS (e.g. system-wide password standards.) Send me any suggestions on what SANS controls should be considered system-wide mandatory standards. CIOs also want a prioritized list of tools / software that could be used across the system and requested as part of a legislative initiative this coming session. Send me any ideas you have here please. Will also consult with the ISO Committee on both these. Thanks, Andrew

6 15

SUU Phish
by Chuck Kimber 06 Jul '15

06 Jul '15

Oh... Tomorrows planned Phish begs for this! See code to make it happen at the bottom of the article. https://www.trustwave.com/Resources/SpiderLabs-Blog/Adventures-in-Social-En…

3 3

CIO update
by Andrew Goble 29 Jun '15

29 Jun '15

I'll send some notes out from the CIO meeting on Friday a bit later today when I get them done. For those of you who were on the SUU assessment, I need your report materials ASAP. Also, the strike package is going to go offline for a while today while I move it. Will let you know when its back up. Thanks, Andrew

1 0

Hacking the lanes
by Chuck Kimber 25 Jun '15

25 Jun '15

Next UVU assessment, I'm going to simulate a real world attack on this and text in the "run" lane. http://www.telegraph.co.uk/news/worldnews/northamerica/usa/11685396/Utah-un…

3 3

CIO Presentation
by Andrew Goble 25 Jun '15

25 Jun '15

Hey guys, Mark and I are presenting to the CIOs on Friday. I'll do an overview of the assessments over the past 2 years, what we've found, etc. Just wanted to some input from all of you on a few things... I can guess what a lot of these will be: From your point of view, what are the pervasively good, and pervasively bad things we've found across the institutions? (wifi evil twin, etc) What could we be spending money or effort on as a system to help fix some of these issues (system-license of Duo, Cloudpath, etc) I just want to be able to demonstrate things that the whole system does well or struggles with. I'll talk about the assessments moving forward, some of our new equipment, etc. Will also bring up the idea of increasing the time we have available to poke at stuff before we come on-site. Anything else on your wish list for me to talk to the CIOs about? Also, for those who were on the SUU assessment, if you can get me your report materials, that would be awesome. Thanks, Andrew

6 13

Assessment Timelines
by Chuck Kimber 15 Jun '15

15 Jun '15

Here's something I've been thinking about... As this next fiscal round of assessments begins, I'm wondering if we can redefine a little, when exactly an engagement begins. What I'm thinking is, what if it actually begins 30 days before we show up on site? I know we all have day jobs and probably won't get to much of it, but imagine if we are allowed to probe the outside layer a bit with nessus, phish a little, social engineer a bit, all before we get onsite for our noisy portion? It might be nice to show up and have a few credentials in hand already and a few pivots established and ready to go. It also helps add just a touch more realism to the scenario too, I think. Any thoughts? Chuck

3 2

Rootkit Mac
by Chuck Kimber 09 Jun '15

09 Jun '15

So. Are we ready to start installing rootkits on live Macs next assessment? https://reverse.put.as/2015/05/29/the-empire-strikes-back-apple-how-your-ma…

3 3