The Guerilla CISO

http://feeds.feedburner.com/TheGuerillaCiso (RSS订阅地址)

DDoS Vocabulary and Mathematics

Some language and math that come in handy when you talk about or fight Distributed Denial of Service… Distributed Denial of Service: an attack that uses a number of attacking nodes that overwhelm the target with network, web, or application traffic. DDoS implies 100 or more nodes attacking the same target, although just about everybody […] The post <a href="http://www.guerilla-ciso.com/archives/2170">DDoS Vocabulary and Mathematics</a> first appeared on <a href="http://www.guerilla-ciso.com">The Guerilla CISO</a>.

2012/10/26

DDoS and Elections

I’ve noticed a trend over the past 6 months: DDoS traffic associated with elections. A quick sampling of news will show the following: http://www.opendemocracy.net/od-russia/irina-borogan-andrei-soldatov/kremlin-and-hackers-partners-in-crime <-Russia http://www.theregister.co.uk/2012/03/26/hong_kong_vote_hack/ <-Hong Kong http://www.theregister.co.uk/2011/12/07/korean_election_ddos_row/ <-Korea http://www.cbc.ca/news/politics/story/2012/03/27/pol-ndp-voting-disruption-deliberate.html <-Canada (rybolov: yikes!) http://www.csoonline.com/article/700523/ddos-attackers-target-russian-election-webcams <-Russia again Last week it picked up again with the re-inauguration of Vladimir Putin. http://en.ria.ru/russia/20120506/173265737.html http://www.washingtonpost.com/world/europe/peaceful-protest-turns-violent-in-moscow/2012/05/06/gIQAFti35T_story.html http://english.ruvr.ru/2012_05_06/73954450/ http://www.rferl.org/content/independent_russian_daily_hit_by_dos_attack_kommersant/24571463.html And then yesterday, Ustream and their awesome response: which, […] The post <a href="http://www.guerilla-ciso.com/archives/2144">DDoS and Elections</a> first appeared on <a href="http://www.guerilla-ciso.com">The Guerilla CISO</a>.

2012/5/10

FedRAMP: It’s Here but Not Yet Here

Contrary to what you might hear this week in the trade press, FedRAMP is not fully unveiled although there was some much-awaited progress. There was a memo that came out from the administration (PDF caveat). Basically what it does is lay down the authority and responsibility for the Program Management Office and set some timelines. […] The post <a href="http://www.guerilla-ciso.com/archives/2121">FedRAMP: It’s Here but Not Yet Here</a> first appeared on <a href="http://www.guerilla-ciso.com">The Guerilla CISO</a>.

2011/12/12

The “Off The Record” Track

So while I was at some conferences over the past couple of months, I had an awesome idea while sitting in a panel about data breaches, especially notification. While streaming conferences is pretty awesome for most content, I keep thinking that we need that as an industry we need the exact opposite: a track of […] The post <a href="http://www.guerilla-ciso.com/archives/2099">The “Off The Record” Track</a> first appeared on <a href="http://www.guerilla-ciso.com">The Guerilla CISO</a>.

2011/11/21

DHS is Looking for a CISO

Job announcement is here. Share with anybody you think can do it.Similar Posts: Radio Nigel Why You Should Care About Security and the Government Help the Government, Become Literate SP 800-53A Now Finally Final Wanted: Some SCAP Wranglers The post <a href="http://www.guerilla-ciso.com/archives/2105">DHS is Looking for a CISO</a> first appeared on <a href="http://www.guerilla-ciso.com">The Guerilla CISO</a>.

2011/11/4

#RefRef the Vaporware DoS Tool

Ah yes, you now know how I spend my Saturday mornings lately. Similar Posts: DDoS Planning: Business Continuity with a Twist The Rise of the Slow Denial of Service Training the Apache Killers Oh to be a Program Manager A Little Story About a Tool Named #RefRef The post <a href="http://www.guerilla-ciso.com/archives/2089">#RefRef the Vaporware DoS Tool</a> first appeared on <a href="http://www.guerilla-ciso.com">The Guerilla CISO</a>.

2011/9/23

A Little Story About a Tool Named #RefRef

Let me tell you a little story. So September 17th was Constitution Day and was celebrated by protestors in most major cities across the US with a sizable percentage of folks on Wall Street in NYC. In conjunction with this protest, a new Denial-of-Service tool, #RefRef, was supposed to be released. It supposedly used some […] The post <a href="http://www.guerilla-ciso.com/archives/2085">A Little Story About a Tool Named #RefRef</a> first appeared on <a href="http://www.guerilla-ciso.com">The Guerilla CISO</a>.

2011/9/23

Training the Apache Killers

Here at IKANHAZFIZMA, we’re training the next generation of Apache webserver Denial-of-Service gurus. It involves punching bags, some nomz for the troops, and lots of requests for kibble. Similar Posts: The Rise of the Slow Denial of Service A Little Story About a Tool Named #RefRef DDoS and Elections DDoS Planning: Business Continuity with a […] The post <a href="http://www.guerilla-ciso.com/archives/2076">Training the Apache Killers</a> first appeared on <a href="http://www.guerilla-ciso.com">The Guerilla CISO</a>.

2011/9/2

Apache Killer Effects on Target

Oh noes, the web is broken. Again. This time it’s the Apache Killer. This inspired a little ditty from @CSOAndy based on a Talking Heads tune: I can’t seem 2 handle the ranges I’m forked & memlocked & I Can’t spawn I can’t sleep ’cause my net’s afire Don’t spawn me I’m a dead server […] The post <a href="http://www.guerilla-ciso.com/archives/2063">Apache Killer Effects on Target</a> first appeared on <a href="http://www.guerilla-ciso.com">The Guerilla CISO</a>.

2011/8/30

Noms and IKANHAZFIZMA

Kickin’ it old-school with some kitteh overflows Similar Posts: LOLCATS Take on Catalog of Controls LOLCATS and Firewalls Conflicker ala IKANHAZFIZMA IKANHAZFIZMA Tackles the Consensus Audit Guidelines Training the Apache Killers The post <a href="http://www.guerilla-ciso.com/archives/2060">Noms and IKANHAZFIZMA</a> first appeared on <a href="http://www.guerilla-ciso.com">The Guerilla CISO</a>.

2011/8/26

The Rise of the Slow Denial of Service

Usually when you think about Denial of Service attacks nowadays, most people think up images of the Anonymous kids running their copy of LOIC in a hivemind or Russian Gangsters building a botnet to run an online protection racket. Now there is a new-ish type of attack technique floating around which I believe will become […] The post <a href="http://www.guerilla-ciso.com/archives/2049">The Rise of the Slow Denial of Service</a> first appeared on <a href="http://www.guerilla-ciso.com">The Guerilla CISO</a>.

2011/8/23

DDoS Planning: Business Continuity with a Twist

So since I’ve semi-officially been granted the title of “The DDoS Kid” after some of the incident response, analysis, and talks that I’ve done, I’m starting to get asked a lot about how much the average DDoS costs the targeted organization. I have some ideas on this, but the simplest way is to recycle Business […] The post <a href="http://www.guerilla-ciso.com/archives/1961">DDoS Planning: Business Continuity with a Twist</a> first appeared on <a href="http://www.guerilla-ciso.com">The Guerilla CISO</a>.

2011/8/17

Realistic NSTIC

OK, it’s been out a couple of months now with the usual “ZOMG it’s RealID all over again” worry-mongers raising their heads. So we’re going to go through what NSTIC is and isn’t and some “colorful” (or “off-color” depending on your opinion) use cases for how I would (hypothetically, of course) use an Identity Provider […] The post <a href="http://www.guerilla-ciso.com/archives/2023">Realistic NSTIC</a> first appeared on <a href="http://www.guerilla-ciso.com">The Guerilla CISO</a>.

2011/8/10

Clouds, FISMA, and the Lawyers

Interesting blog post on Microsoft’s TechNet, but the real gem is the case filing and summary from the DoJ (usual .pdf caveat applies). Basically the Reader’s Digest Condensed Version is that the Department of Interior awarded a cloud services contract to Microsoft for email. The award was protested by Google for a wide variety of […] The post <a href="http://www.guerilla-ciso.com/archives/2013">Clouds, FISMA, and the Lawyers</a> first appeared on <a href="http://www.guerilla-ciso.com">The Guerilla CISO</a>.

2011/4/26

LOLCATS and NSTIC

Ref: NSTIC Ref: On the Internet… Similar Posts: Realistic NSTIC Et Tu, TIC? Hackers, Protesters, Iran, Twitter, and Lolcats Cyberlolcats Watch the Hackers at DefCon LOLCATS and Hackable Coffee Pots The post <a href="http://www.guerilla-ciso.com/archives/2010">LOLCATS and NSTIC</a> first appeared on <a href="http://www.guerilla-ciso.com">The Guerilla CISO</a>.

2011/4/14

Some Comments on SP 800-39

You should have seen Special Publication 800-39 (PDF file, also check out more info on Fismapedia.org) out by now. Dan Philpott and I just taught a class on understanding the document and how it affects security managers out them doing their job on a daily basis. While the information is still fresh in my head, […] The post <a href="http://www.guerilla-ciso.com/archives/1999">Some Comments on SP 800-39</a> first appeared on <a href="http://www.guerilla-ciso.com">The Guerilla CISO</a>.

2011/4/6

Micro Digital Signatures Howto

With RSA wrapping up, I figured I would do something fun with Alice, Bob, and crypto. There is a need for small digital signatures (Micro Digital Signatures/”MicroDigiSigs” if I can be as bold as to think I can start a nerdy meme) and tools to support them over small message spaces such as The Twitters, […] The post <a href="http://www.guerilla-ciso.com/archives/1988">Micro Digital Signatures Howto</a> first appeared on <a href="http://www.guerilla-ciso.com">The Guerilla CISO</a>.

2011/2/22

IKANHAZFIZMA Ponders “The Move to Cloud”

Similar Posts: IKANHAZFIZMA Does Awareness Training Conflicker ala IKANHAZFIZMA Noms and IKANHAZFIZMA FedRAMP Released “Real Soon Now”, Lolcats Happy Lolcats Coming to you from the Cloud The post <a href="http://www.guerilla-ciso.com/archives/1985">IKANHAZFIZMA Ponders “The Move to Cloud”</a> first appeared on <a href="http://www.guerilla-ciso.com">The Guerilla CISO</a>.

2011/2/17

Reinventing FedRAMP

“Cloud computing is about gracefully losing control while maintaining accountability even if the operational responsibility falls upon one or more third parties.” –CSA Security Guidance for Critical Areas of Focus in Cloud Computing V2.1 Now enter FedRAMP. FedRAMP is a way to share Assessment and Authorization information for a cloud provider with its Government tenants. […] The post <a href="http://www.guerilla-ciso.com/archives/1973">Reinventing FedRAMP</a> first appeared on <a href="http://www.guerilla-ciso.com">The Guerilla CISO</a>.

2011/2/15

Happy New Year

Believe it or not, this is a friend’s cat named Little Phat Man, and we cat-sat him over Christmas. Mrs Rybolov took the photo. I’ve been trying to get Phat into a lolcat for a long time. Similar Posts: Snowmageddon Meets the IKANHAZFIZMA Lolcats Exhaustive Security Testing is Bad For You IKANHAZFIZMA and Transparency Look […] The post <a href="http://www.guerilla-ciso.com/archives/1968">Happy New Year</a> first appeared on <a href="http://www.guerilla-ciso.com">The Guerilla CISO</a>.

2011/1/1

DojoCon DDoS Video

My DDoS presentation at DojoCon on Sunday. A big thanks to Marcus J Carey for organizing the con and Adrian Crenshaw for doing the recording. Michael Smith, @rybolov DDoS from Adrian Crenshaw on Vimeo. Similar Posts: DojoCon 2009 Presentation Barcode Hacking DDoS and Elections Massively Scaled Security Solutions for Massively Scaled IT DDoS Planning: Business […] The post <a href="http://www.guerilla-ciso.com/archives/1964">DojoCon DDoS Video</a> first appeared on <a href="http://www.guerilla-ciso.com">The Guerilla CISO</a>.

2010/12/16

no rly, iz protest

Inspired by Anonymous, Operation Payback, and the “DDoS attacks as a legitimate form of protest?” article at ZDNet Similar Posts: Conflicker ala IKANHAZFIZMA Noms and IKANHAZFIZMA IKANHAZFIZMA Finds Caution Tape Training the Apache Killers #RefRef the Vaporware DoS Tool The post <a href="http://www.guerilla-ciso.com/archives/1954">no rly, iz protest</a> first appeared on <a href="http://www.guerilla-ciso.com">The Guerilla CISO</a>.

2010/12/16

WikiLeaks: Coming to an Agency Near You

Nope, we’re not going to talk about ego trips, hidden agendas, or complete irresponsible transparency. This blog post is about some of the fallout inside the Government security teams. The powers that be would like to remind you that downloading classified documents off the Intertubez does not make them unclassified. An anonymous source that I […] The post <a href="http://www.guerilla-ciso.com/archives/1947">WikiLeaks: Coming to an Agency Near You</a> first appeared on <a href="http://www.guerilla-ciso.com">The Guerilla CISO</a>.

2010/12/9

Interviewed for the “What It’s Like” Series for CSOOnline

Joan Goodchild interviewed me about some of my experiences in the big sandbox and how I was good enough at avoiding IEDs to make it there and home again–an abstract form of risk management. Go check it out. And while you’re on the subject or for visuals to go along with the story, check out […] The post <a href="http://www.guerilla-ciso.com/archives/1936">Interviewed for the “What It’s Like” Series for CSOOnline</a> first appeared on <a href="http://www.guerilla-ciso.com">The Guerilla CISO</a>.

2010/11/23

Evolving the Physical Hacking at Security Conferences

There has been a fun evolution at hacker conference for the past couple of years: the inclusion of hackerspaces. Hackerspaces fit nicely into the hacker ethos. But I’ve also heard grumblings via the tubes about the relevance of projects that they bring to hacker conferences, something along the lines of “Why has every security conference […] The post <a href="http://www.guerilla-ciso.com/archives/1904">Evolving the Physical Hacking at Security Conferences</a> first appeared on <a href="http://www.guerilla-ciso.com">The Guerilla CISO</a>.

2010/11/22