- USHE-assess - lists.utahtech.edu

Question about the keylogger use at USU
by Allen Hill 17 Aug '16

17 Aug '16

Hey Jake or anybody else that may know, One of our DBAs is going through the keylogger data from the USU assessment to make sure they clean up from any of the damage. He’s surprised that there doesn’t appear to be “that much” data in the keylogger files. I wanted to tell him to queue the “office space” soundtrack, but said I’d ask you guys instead. Do you know if the keylogger file is truncated at all, is there a limit to the amount of data it can store and if there could have been more logged than there was on both of the days it was used? In other words, do you think that logs contain the full sessions on the days they were used? Thanks, -Allen

4 4

[Fwd: Re: [Ext] [Fwd: RE: [Fwd: Re: UofU USHE Security Assessment]]]
by Goble, Andrew 15 Aug '16

15 Aug '16

Corey sent me this. For those of you who expect to come of the UofU assessment, any preference? The October week is slightly better for me, but I can do either. Thanks, Andrew -------- Forwarded Message -------- From: Corey Roach (ISO) <Corey.Roach(a)utah.edu> To: Andrew Goble <Goble(a)dixie.edu> Subject: Re: [Ext] [Fwd: RE: [Fwd: Re: UofU USHE Security Assessment]] Date: Mon, 15 Aug 2016 17:37:17 +0000 > Based on vacations, holidays, academic calendar and such, the > following two weeks would work the best: > > October 24 - 28 OK > November 14 - 18 OK > > > > > > > On Aug 11, 2016, at 8:52 AM, Goble, Andrew <Goble(a)dixie.edu> wrote: > > > > Updated info: > > > > The week of October 3 - 7 is probably out as well. Oct 31 - Nov > > 4th > > would be tricky, but doable if needed. > > > > So maybe listing what does work is better than listing what > > doesn't. > > > > I can field a team at the U these weeks: > > > > October 17 - 21 > > October 24 - 28 > > November 7 - 11 > > November 14 - 18 > > November 28 - Dec. 2 > > > > Let me know if one of those will work out. > > > > Thanks, > > Andrew > > > > > > On Thu, 2016-08-11 at 08:33 -0600, Goble, Andrew wrote: > > > > > > Hey Corey, > > > > > > Dan sent me your way to work out when to do the UofU assessment > > > this > > > fall. > > > > > > I just want to get a week on the calendar, don't need to > > > coordinate > > > much else till we are about a month out. > > > > > > I believe we can field a team most any week in October or > > > November, > > > except for: > > > > > > Oct 10 - 14 - SAINTcon > > > Nov 21 - 25 - Thanksgiving > > > > > > Is there a week that would work? > > > > > > Thanks, > > > Andrew > > > > > > > > > > > > -------- Forwarded Message -------- > > > From: Daniel Bowden <dan.bowden(a)utah.edu> > > > To: "Goble, Andrew" <Goble(a)dixie.edu> > > > Subject: RE: [Fwd: Re: UofU USHE Security Assessment] > > > Date: Tue, 9 Aug 2016 14:38:06 +0000 > > > > > > > > > > > > > > > Hi Andrew -- > > > > Yes, please work with Corey. > > > > > > > > Thanks! > > > > Dan > > > > > > > > > > > > -----Original Message----- > > > > From: Goble, Andrew [mailto:Goble@dixie.edu] > > > > Sent: Tuesday, August 9, 2016 8:06 AM > > > > To: Daniel Bowden <dan.bowden(a)utah.edu> > > > > Subject: [Ext] [Fwd: Re: UofU USHE Security Assessment] > > > > > > > > Hey Dan, > > > > > > > > Who should I coordinate with going forward? Corey? > > > > > > > > Thanks, > > > > Andrew > > > > -------- Forwarded Message -------- > > > > From: Stephen Hess (CIO) <stephen.hess(a)utah.edu> > > > > To: "Goble, Andrew" <Goble(a)dixie.edu>, Daniel Bowden <dan.bowde > > > > n@ut > > > > ah > > > > .e > > > > du> > > > > Subject: Re: UofU USHE Security Assessment > > > > Date: Tue, 9 Aug 2016 14:00:52 +0000 > > > > > > > > > > > > > > > > > > > > > > > > Andrew, > > > > > > > > > > Yes this is still feasible. Go ahead with your planned > > > > > assessment. > > > > > > > > > > Thanks, > > > > > > > > > > Steve > > > > > > > > > > On 8/8/16, 4:09 PM, "Goble, Andrew" <Goble(a)dixie.edu> wrote: > > > > > > > > > > Hi Dan, Steve, > > > > > > > > > > I wanted to reach out to you concerning the USHE > > > > > security > > > > > assessment > > > > > for the University of Utah. I spoke briefly to you both > > > > > about > > > > > it > > > > > at > > > > > the CIO retreat, but that was before Dan's departure was > > > > > announced. > > > > > > > > > > We had planned to engage the U for an assessment in the > > > > > October > > > > > - > > > > > November timeframe. Is this still feasible? > > > > > > > > > > Thanks, > > > > > Andrew > > > > > > > > > > Andrew Goble > > > > > Information Security Officer > > > > > Dixie State University > > > > > goble(a)dixie.edu > > > > > 435.652.7963 >

1 0

Security tools
by Matt Lorimer 27 Jul '16

27 Jul '16

At SAINTcon this year, I am responsible for all the villages. We plan to add a labs section with security tools to give people hands-on time with gear they have heard about but never played with (or not played enough with). Does anybody have ideas/suggestions/etc on what tools should be included in this village? So far my list is mostly focused on red team hardware, but I'd take suggestions for anything security related. Feel free to suggest classes of tools, or links to specific products. Matt -- Matt Lorimer IT - Systems Administrations Operations Utah State University 435-797-4242 Matt.Lorimer(a)usu.edu

1 0

UofU Assessment Planning
by Goble, Andrew 21 Jul '16

21 Jul '16

Hey all, For the UofU assessment: I talked to Dan at the CIO meeting yesterday. We are shooting for a fall time frame. For those of you who expect to come on the UofU assessment, whats going on this fall between mid-September and mid-November that won't work? SAINTcon is the week of Oct 11th, so that week is out. I know this is a bit early but we need to get on the calendar at the U and it takes time. Let me know what major conflicts are going on in the fall so we can work around them. Thanks, Andrew

1 0

CIO Retreat
by Goble, Andrew 19 Jul '16

19 Jul '16

Hey all, I have a few minutes with the CIOs this Wednesday, if there are any assessment related issues or thoughts you want me to bring up with them, let me know ASAP. Sorry for those of you who got cross-posted on the USHE-ISO list. Also, for any of you on the USU assessment, stop playing pokemans long enough to send me your USU report materials if you haven't already. ;) Thanks, Andrew

1 0

Pokemans
by Goble, Andrew 15 Jul '16

15 Jul '16

So Matt sent me this cool picture today: https://goo.gl/photos/qFy2XJ7onHFvTssV8 Then I been thinking about things and figured that we could take the the twins and go find the Pokeman[sic] Go pokestops to collect creds on assessments... there are hundreds of people wandering around my campus looking for pokemans. Maybe we could Jake to make a lure for us so the people and pokemans will come to us. http://starecat.com/how-to-kidnap-a-28-year-old-in-2016-rare-pokemon-in side-sprayed-written-on-a-truck-pokemon-go/ Also, if you were on the USU assessment, kindly do the needful and get me your report materials if you haven't already. Thanks, Andrew

3 2

MimiKittenz
by Jon Barclay 08 Jul '16

08 Jul '16

https://github.com/putterpanda/mimikittenz/blob/master/README.md

1 0

Windows Priv Escalation
by Jon Barclay 04 Jul '16

04 Jul '16

Check this one out, read all the way to the bottom. https://blog.ahmednabeel.com/from-zero-to-system-on-full-disk-encrypted-win…

1 0

LinkedIn Dump?
by Jon Barclay 01 Jun '16

01 Jun '16

Did anyone grab a copy of the new linked in password dump?

1 0

PCI 3.2 Released
by Jon Barclay 07 May '16

07 May '16

https://www.pcisecuritystandards.org/pdfs/PCI_DSS_3.2_Press_Release.pdf Requires two factor auth for all administrative access, not just remote access. Cashiers should be exempt, but store managers would need to use Duo. Jon

2 1