A review of my past one-year in Information Security
Last week, I had my one-year anniversary in the Information Security industry, doing work related to the offensive aspect of security. Surprisingly, it has already been a year since I left my previous role from a local bank and pursued my interest in Information Security. Time really flies…
The purpose of this blog is to document my learning journey, but I have neglected it for a few months due to hectic workload from various sources, however, the good news is that I have decided to consciously remind myself to update it more often moving forward! Well, make it a “new year resolution”!
Now, back to the review…
Work
Being part of an awesome team at Vantage Point Security, I have been given the opportunity to perform technical security assessment on various organisations in Singapore as a qualified Security Consultant. I was privileged to perform manual security penetration testing on various types of web and mobile applications that belongs to renowned organisations, such as some of the best financial institutions and telecommunication companies in the region.
Something interesting is that I am usually a customer of my clients, which makes me really appreciate it when I see them taking security seriously and strive to improve for the better. Overall, I find it very meaningful to be part of this ecosystem in making products better and safer for people – it makes me appreciate the things I am doing and keep me going!
A special shout-out to my mentor, Paul Craig, Sven Schleier, Jin Kun and Ryan Teoh for making my past one-year such an awesome journey of learning! I have learnt so much from them. It is always great to be able to work alongside people who are motivated and passionate about security. I am looking forward to doing even greater stuff together in the year ahead!
Always ready to give a high-five to fellow security enthusiasts!
Certifications
I have managed to achieve the very first milestone of most penetration testers, Offensive Security Certified Professional (OSCP), after having completed 3-months of intensive lab hands-on practices in its recommended course, Penetration Testing with Kali (PWK). I have also written a blog post about my experience gained during the 3-months period, in hope that it will be helpful to fellow like-minded aspiring security enthusiasts. If you are interested, please check out My OSCP / PWK Course Review.
Besides OSCP, I have also gotten myself the following certifications in the past one-year:
“CREST is a not for profit organisation that serves the needs of a technical information security marketplace that requires the services of a regulated professional services industry.” ~ directly quoted from CREST
From my observations, I see that CREST has been very successful in becoming the go-to quality assurance organisations in Singapore when it comes to selecting vendors to work with, be it the government agencies, financial institutions or organisations from other industries. Something I like about them is that they are conducting proctored examinations, which can solve a lot of “problems” caused by people with no ethics value. It is a huge problem occurring around the world, which I am not going to cover in this post – maybe next time (I got to stay on track!).
To me, certification is one of the many forms of (technical) quality assurance that a consultant can provide to their clients before engaging them on any security assessment projects. While being certified is a good thing, quality is always better than quantity. It is essential to put the skills you learnt into practice, or it will be just another piece of paper.
If you don’t put your skills into practice, it will just be another piece of paper
Bug Hunting
My experiences in bug hunting have been some of the most devastating yet delightful moment of my past one-year. When I learnt about the existence of “Bug Bounty Program” (e.g. Bugcrowd and HackerOne), I was both surprised and excited, thinking how it could be fun to be able to find bugs on the internet and get rewarded for it. It sounded really enticing at first, especially with the thoughts that since I have been testing web and mobile applications to earn a living, it should be easy for me. However, it doesn’t take long for me to realise how naive I was to even think that way – we are talking about the internet, man! Any low hanging fruits would have already been discovered by someone else, there is nothing left lying around for me to “hunt”.
Well, I thought it would be easy, but…
On a positive note, this simple realisation has motivated me to keep up my pace in learning all kinds of “new stuff” that are happening in the internet, such as to research on the security mechanisms and implementation of various popular web applications, development frameworks, content management systems, penetration testing techniques such as bypassing a Web Application Firewall (WAF) etc. and many more interesting stuffs.
Nowadays, I still do bug hunting whenever I get some free time before I turn in for the night, or during some random weekends. Did you noticed that I call it “Bug Hunting” instead of “Bug Bounty”? That is because I don’t only focus on programs that give monetary rewards to security researchers. I work on any programs that I find it meaningful and reasonable to test, such as companies that I personally use their products or companies that give a clearly defined scope on their Responsible Disclosure or Bug Bounty Programs.
Just playing my part in making the world a better place
While it may sound cheesy to say that I want to make the world and the internet a safer place for everyone, sometimes people just want to do things that they themselves feel is meaningful, worthwhile, and can make themselves feel good. Personally, to find bugs, disclose them responsibly to the vendor and getting them fixed, is something that makes me feel that way.
I am still learning and trying to get better every day. I urge all aspiring bug hunters to create a Twitter account and start following fellow bug hunters and learn from one another. As mentioned earlier, I will start posting more write-ups in my next one-year, so stay tuned! Besides reading the write-ups from fellow bug hunters, I also recommend reading the publicly disclosed bugs from sources such as the HackerOne Hacktivity or other unofficial sources such as this and this. One of the best bug bounty tips that I have come across so far is to keep trying, keep learning, and never give up.
Keep learning, and never give up.
I have had my fair share of achievement over the past one-year and I feel really honored to be recognized by the 10 following organisations and have myself enlisted on their Security Researcher Hall of Fame:
While I cannot disclose the details of the vulnerabilities that I have discovered, I might write a blog post next time on some of them – with all information masked, of course.
Official recognition from Netflix
Security Research
Life is full of challenges, it is how you responded to them that makes a difference to your life ~ Source
We security folks always challenge ourselves in many things – some people challenge themselves to earn 50k in slightly over 1 month, some people challenge themselves to earn 30k in 30 days – we all like to set milestones and work towards it. For me, I am not at their level yet, but one-year ago, I told myself that I want to find a zero-day too. It seems impossible at first, but I was inspired by one of my colleague, Bernhard Mueller, during one of the project engagement that we did together and made me felt that I can do it too. The influence is real. I would download the same software or application development framework and look for zero-days; this is something that I will not do in the past. He have also written and article about why you should be looking for zero-day vulnerabilities during penetration testing. As time goes by, it has become a habit for me to look for zero-days during penetration testing engagement as well.
Recognition from TIBCO for CVE-2017-5528
Of course, it is easier said than done. Most of these commercial and/or open source software were already being thoroughly tested prior to their releases, so it is very difficult to find any legitimate bugs in them. I have gone through my fair share of hardships, gained tons of knowledge along the way as I constantly failed and was ultimately lucky to have found a few zero-day vulnerabilities on some commercial products used by large enterprises.
It is worth mentioning that TIBCO is an organisation that values security. They take security report seriously and replies promptly to security researchers. It was great communicating with them.
CVE-2017-8042 – Pivotal – Stored Cross-site scripting (XSS) vulnerability in Spring Batch Admin before 1.3.0
CVE-2017-8043 – Pivotal – Cross-site request forgery (CSRF) vulnerability in the Spring Batch Admin before 1.3.0
Both of the above issues were reported in March 2017 and has been confirmed by Pivotal that they will not be addressing them as the software is going to reach End-Of-Life (EOL) by the end of 2017. The recommendation is for users to migrate to another product, Data Flow. They have recently put up a notice too.
Currently, both CVE trackers are pending Pivotal to publish them online, they have not confirmed a date yet.
While they were not high-severity vulnerabilities that could lead to Remote Code Execution (RCE), they were good enough of a start for me. They were genuine bugs on the software, undiscovered and hence left exploitable by malicious attackers, and my research/report did helped the software company to improve their products, which are used by many enterprises all over the world.
Good enough, but try harder next time, don’t be contented. It’s only a start.
Next up is an interesting bug that I found while working on one of the private BB program. They are using the PRTG Network Monitor, which is an application that help organisations to monitor their systems, devices, traffic and applications that are using common technologies like SNMP, WMI, SSH, and many more. I shall restrain from providing too much information for now, maybe a write-up after the latest version and release notes has been officially released.
CVE-2017-????? – Paessler AG – pending security patch and release notes
Photo of myself at the Cybersecurity Camp @ Singapore 2017 – Source
Lastly, I attended the Cybersecurity Camp @ Singapore 2017 which was organised by the Singapore Cybersecurity Consortium (SGCSC) earlier this year and learnt about fuzz testing for finding vulnerabilities. Having equipped with this knowledge and its theoretical understanding for a few months, I finally put them into practice after being encouraged by Jin Kun as he shared his own success story of having discovered many zero-day vulnerabilities through fuzzing.
Being inspired and motivated to do my own fuzzing as well, I learnt many things along the way, specific to how to fuzz an application efficiently, how to fuzz an application library, how to optimize my virtual machines processes for better performances, how to fine-tune my fuzzer, how does different fuzzers mutate or identify different paths within an application flow, how to compile binaries using different compilers and buildsystem, how to analyse a crash, and many more interesting stuff that I never thought I would learn. After some time of fuzzing, I have discovered 3 CVEs on BinChunker, the issues has been fixed and changes are being pushed to various Linux distros as I am writing this blog post.
While BinChunker is not a very popular tool based on Debian popularity contest statistics and there was no RCE exploit developed for the discovered vulnerabilities, it was very satisfying. I really enjoyed the experience from discovering these vulnerabilities to reporting them and eventually getting them fixed. It’s great to see how people react and appreciate the findings you discovered and then work together to fix the problem as a team. Information Security is a super awesome community where people help one another to make things better!
The MSTG is a comprehensive manual for mobile application security testing and reverse engineering. It describes the technical processes for verifying the controls listed in the OWASP Mobile Application Verification Standard (MASVS). You can also read it on Gitbook or download it as an e-book.
Main Deliverables of the OWASP Mobile Security Testing Guide
I was fortunate to work alongside the project leaders of MSTG at work and since I know nothing about mobile application security testing back then, I was highly encouraged by Bernhard to use the MSTG as my “study material” and if I find anything missing, I can research on them separately and contribute to this community project by submitting a Pull request. Well, it makes sense – since I am going to research on those things to learn anyway, why not share the knowledge with the community and help fellow aspiring security enthusiast in their learning as well?
With consistent contribution of quality content for a few months, I am humbled to be acknowledged as one of the “Top Contributor” for the OWASP MSTG project. If you are someone whom is interested in mobile application security, I highly encourage you to read through the content and create a pull request if you find anything missing. Once you start submitting those pull requests, they can become quite addictive.
Academic
This is the last section of the review. Some of my friends know that I am currently a part-time student enrolled in Master of Computing (Infocomm Security) at National University of Singapore (NUS). My first semester was hectic, having not been studying academic syllabus since graduated in 2014, however, things went well thanks to the support of family and friends (special shout-out to Zhan Teng, Julian Tan and Jiqing for being super awesome teammates!). The second semester is coming to an end soon and of course, with tons of submission deadlines to meet in the next few weeks and a few exams to clear!
Android Booting Process
Other things worth mentioning are some of the more interesting homework that I did this semester for one of my module, CS5231 – System Security, taught by Professor Liang Zhenkai. Usually when I root an android device, I use readily available tools and does not have a clear understanding about what really happened under the belly. In order to complete one of the tasks in the homework, I was being forced to step out of my comfort zone and dive into how android really works, how the rooting of android is being performed, what are the various methods to root an android device and eventually also created my own custom Over-The-Air (OTA) package to perform code execution as root; to fire up my own daemon service that can help to spawn a root shell to my client upon request.
Conclusion / To-do for the next year
Without knowing, this blog post has turned out to be a long article. Personally, I find it worthwhile and meaningful to just sit down, think-through and review about what I have done in my past one-year in the industry of Information Security. I feel that everyone should do something similar and then think about what they want to do in the next one-year.
Think about some of the things that you want to achieve in the next one-year
The reason for me to post this article is also to put some pressure on myself and make sure that I achieve the goals which I said that I want to achieve in the next one-year. Next year, I am going to look back at this article and question myself.
In view of the OSCE certification goal, I hope to focus more on low-level stuff, such as to improve my exploitation techniques, exploit development skills, etc., which are things that I don’t have much experience with now, but are useful skills which I am very keen to pick up.
In the next one-year, I hope to continue to hunt for bugs and keep up with the learning. I also aim to post write-ups on any interesting bugs, if I am given the permission to do so.
For work, apart from Web Application and Mobile Application penetration testing, I hope that I can have opportunities to gain more exposure across the Asia region and get myself involved in different types of engagements, such as ATM Hacking, Red Teaming and Wireless Hacking. There are so many things to learn, I can’t wait anymore!
I need to be more productive…
I also aim to develop my own Burp Extender module that can help to improve my productivity. At least my first extender module should not be too complicated, I just need to get started with something, start small, gain the knowledge and momentum before targeting something more complicated. If you have any interesting ideas that are not too complicated, please share in the comments section.
Lastly, as part of my Master course requirements, I need to complete a one-semester long research project (3-months duration). I can choose between an academic project proposed by one of the NUS professor, or an industrial project proposed by a company in the industry. I have not chosen any topics yet, but I hope that I can work on something useful to my field of work, to not only clear my course requirements, but also allow me to learn practical techniques and knowledge that are relevant to my area of interest. That way, I will have enough interest to continue to work on it after the 3-months duration. If there is any potential projects related to offensive side of security and not too complicated/simple, I would love to know it.
If you have read this entire post, you deserve a medal, just like this camera man
I hope that the next one-year will be even better and full of learning opportunities for me! Till I blog again.
It have been a tough 3 months of virtual lab and hands-on training – so much learning, and I mean, intensive learning; combo with many sleepless nights and so much sweat and tears (maybe not the tears part but you get the point), I have finally passed my OSCP!
I am now officially an Offensive Security Certified Professional! Yes, I tried harder #tryharder 🙂
It have been a very tough 3 months of journey, which explains why I have not been blogging anything at all since then. I am happy to be back and blogging once again!
Okay, here comes my review about the course, specifically for any fellow aspiring ethical hacker like me, or simply anyone who have passion in the topic of computer security and wants to learn the technical side of the skill set.
A little bit about myself (for reference to the content below): I graduated from the National University of Singapore (NUS), School of Computing, Bachelor of E-Commerce, in 2014. Since then, I have been working as an IT Infrastructure Project Delivery Manager at a bank. In my role, I basically coordinates the completion of various deliverable for either the upgrading of existing systems or setting up of new systems. Up to this point, my job were not security related. To pursue my interest in information security, I left my job. I took up training courses and obtained my EC-Council Certified Ethical Hacker (CEHv9) certification during September 2016. Ever since then, I have been doing a lot of self learning on IT security stuff, especially from trying out hands on self-training by hacking the Virtual Machines downloadable from Vulnhub, you can read some of my write-ups over here.
Before you sign up for the OSCP course, it is essential to plan your time well! I made a mistake so I’d like you to learn from it. First, you have to know that to obtain the OSCP certification, you will need to register yourself for the Penetration Testing with Kali (PWK) course. The course consists of a virtual lab environment of which the credentials will be sent to you (along with training manual and videos) after you have successfully registered for the course. The mistake which I have made is to directly plan for a nice weekend (and a week with lesser work) to sign up for the course, thinking that I could get started immediately.
Listen/read: You will not start the course immediately. Courses will only start at certain days of each week, and each week can only have a limited number of students to start their PWK course, depending on the sign up rates, which will not be disclosed by Offensive Security. For my case, the earliest I could get started back then was 2 weeks after I have signed up for the course. Noticed the mistake here? I totally expected myself to be able to get started right after I signed up!
With the above mistake and poor time management at the start, I spent several days on the PDF lab manual exercises and the training videos. As reference, I started working on the lab machines 2 weeks after my PWK course commenced. Many people would recommend that you jump straight into the lab and not waste any time. I would like to disagree partially. While I believe that you could learn faster jumping into the lab straight, but there are some skill sets which you have to pick up before just jumping in straight.
Personally, I find that you should go through the lab manual on the chapter regarding various methods for file transfer. You should not miss the chapter for buffer overflow too, that is very important, as it teaches you how to craft your own simple fuzzer, shell code and modify the exploit. The fundamental enumeration techniques are very important too, specifically the chapter on using tools like nmap. Essentially, my point is — don’t just jump into the lab unless you know what you are doing. Learn the basics, and then jump in to try out the tools. When things are not right, jump out again. That is the whole point of the lab — for you to practice what you learnt and not just study the theory.
Regarding the learning curve, I must say that it really takes time to get your very first shell and it gets really addictive. Personally, it took me quite awhile to get my first shell even though it is just simply running the Metasploit tool. Don’t know about Metasploit? Fret not, it will be covered in the lab manual. Or you can complete the Metasploit Unleashed Free Ethical Hacking Course, like I did. It was good learning as well and most importantly, it is an Own Time Own Target (OTOT) kind of free online course. Be patient, shell will come, you just need to try harder, don’t give up.
Thanks to the advise and encouragement from my mentor (Paul, that’s you), I took up the challenge of hacking Pain as my 10th machine. For those who don’t know what that means — Pain is one of the “boss” machine in the OSCP lab environment, along with his buddies: Sufferance, Humble and Gh0st. Hacking Pain as my 10th machine was no easy task. But like I said, I tried harder, it took my 8 days to root it. No joke, 8 days. Along the way, I learnt a lot of stuff I never imagined myself learning and also never expected myself to be able to understand. Of course, no spoilers, but really, just keep Googling and you will find it, trust me, and trust my mentor. Also thanks to these 8 days of being stuck on a machine, I kind of got used to the suffering (you know the feeling when you have no shells for a long time) and started to really pick up my pace moving forward.
While I am not going to spoon feed anyone with any post-enumeration scripts, I must say that you can always write your own scripts, or make use of available resources, there are several very good scripts around, for you to find out. One advise though, don’t just use it blindly. My peers Jin Kun and Ryan Teoh advised me the same when I was using the downloaded scripts happily initially too. There are cases where information are not presented to you directly, or when the operation system are not identical with the scripts target. In those cases, what are you going to do? Are you going to modify your script, do it manually, or give up? We never give up, so we have to understand what the script is doing. If you don’t understand it, don’t use it. Learn. It’s the same as Metasploit exploits — you run it, get shell, yay. Next, you should first, try to understand why that happened and try to get the same result without using Metasploit. The good thing is that in each of the Metasploit modules, you can run the command ‘info’ to read its description and you can read the source code of the modules directly in the “/usr/share/metasploit-framework/modules” directory. Like many people would have also shared with you, for privilege escalation, the only reference notes which you may need are probably just these list for Windows and Linux respectively. Learn and understand them and you are good to go.
At the end of my lab time, I managed to make my way all the way into the Administrative department (as shown in the image above) and hacked some of the machines in there. During my 3 months of lab time, I managed to root 42 out of [spoiler, not going to tell you] machines. It was not that bad, it is possible, you have to believe in yourself.
Finally, it’s the exams. For those who are not familiar with the exam format, the hands-on exam duration is 23 hours and 45 minutes. There will be several machines for you to attack and get the “flags”. After your time is up, you will be cut off from the exam’s Virtual Private Network (VPN) and you will have to submit a professionally prepared lab report within the next 24 hours. This document should contain the testing process and step-by-step guides on how to replicate the vulnerability and get shell of the highest system privileges.
I was lucky because there were several components that were very similar to some of the machines which I have rooted previously in the lab. While I cannot specifically share what exactly are the components, I believe I can share that, if you keep working on getting more machines rooted and understand the vulnerabilities that you have exploited to root those machines, trust me — you will recognize it when you see it during the exams. Of course, the exam machines will not be so straight forward, but they will most likely be made up of several vulnerabilities (which you have already seen back then in the lab) being put together, where after exploiting one vulnerability, it leads to the discovery or/and exploitation of the next vulnerability. Again, time management is super important during the exams, you should not get stuck for too long and keep getting stuck in that particular spiral. Move on to the next machine and start enumerating for any attack vectors. Come back again later. Don’t give up. The only reason why the machine is there is because it is hackable, that is the only fact that you should remember during your exams!
To sum up, it was a very fruitful and enriching 3 months of lab time taking the PWK course. Definitely, if time allows, I would love to take up other courses from Offensive Security. A shout out: I am very thankful to my friends at Vantage Point Security, whom never fails to ask me about my progress on the lab machines and listen to my rants and gave me motivational speeches. Special thanks to Paul Craig, Jin Kun and Ryan Teoh, whom constantly gave me constructive advise and encouragement that keeps me going, not forgetting the many ping pong sessions whenever I am having mind blockage. Also thanks my family for supporting me! Lastly, my girlfriend is so awesome, for being so understanding and considerate towards me during my busy 3 months of journey towards getting my OSCP certification.
Good luck to anyone who wish to take up the challenge of becoming an Offensive Security Certified Professional (OSCP)!
Have you ever experienced situations when you Virtual Machines (VM) were unable to connect to the internet after you have boot it up?
Initially, you probably only have a loopback IP address like the following, well, you are not alone – it happened to me when I was setting up my new Kali Linux or Ubuntu VM as well.
You have probably restarted your networking services,
service restart networking
Or performed all kind of different steps, configuring your network, subnet, dhcp, etc information at /etc/network/interfaces but to no avail… you probably have an IP address, but you cannot connect to the internet.
ping: www.google.com: Name or service not known
Today, I am going to share a fix for this issue. It is actually very simple, but it took me a series of troubleshooting before I discover these simple steps to resolve this issue.
Step 1: Simply download the vmnetcfg.exe file, you can easily find an updated copy of the file from the internet. Don’t forget to scan it using virustotal, make it a habit.
By the way, if you are interested, vmnetcfg.exe is a tool which allow users to manage a Windows host computer’s virtual interfaces.
Step 2: Place the vmnetcfg.exe file inside your program files folder.
It is probably located at the default location of “C:\Program Files (x86)\VMware\VMware Workstation” when you installed VMware Workstation to your computer.
Step 3: Here is the most important part. Run your vmnetcfg.exe file, you will find the following window appearing on your screen.
Look for your VMnet0 or whichever port that is mapped to your machine’s network card, select the option of “Bridged (connect VMs directly to the external network)” and choose your network card in the drop down list. When you are done, click “OK” and there you go, your issue is probably fixed.
Well, I hope that this post has served you well and helped you save some time.
Last week, I attended the RSA Conference 2016 Asia Pacific & Japan which was held at Marina Bay Sands (MBS), Singapore. It was a pretty enriching experience as I get to not only hear directly from various security vendors about how their products are beneficial to the industry, but also get to attend keynote sessions with top-rated speakers in the information security industry.
There were many security vendors in the Sands Grand Ballroom level 5 with their respective booths being setup with their newest products. Each booths run their own product demonstration in every 1 or 2 hours intervals. Can see that most of the presenters are pretty enthusiastic in sharing their products’ new features.
To see the full list of exhibitors which have setup a product demonstration booth to share about their products, you can check out this link.
There were also some companies which also gotten a place to share about their products in an open area called the Demo Theatre. It is like a mini stage with a number of chairs. Unfortunately, there were not many attendees. I’m glad I attended a few sessions though and learnt quite a bit about how an enterprise can incorporate various types of products to improve on their security defenses to protect their company’s information and data.
Check out the full list of sessions at the Demo Theatre on this link.
Moving on to the best part of the event, the keynote sessions. Having attended the session on 21 July 2016, I sat in for all 4 of the keynote sessions.
First off is the “Security in the World-Sized Web” by Bruce Schneier. He came to raise the awareness to the information security experts in the industry about the uprising of IoT (Internet of Things) world-wide robots. These IoT devices are collecting information for a purpose, just like what robots are doing. These increased usage and coverage of IoT devices will not only give power to defenders, but also the attackers. He is suggesting for smart government involvement in this area, as he believe that regardless of whether we desire for it, government are going to be part of this. Therefore, the better way of involvement is to be involved “smartly”. And lastly, policy makers need to know about the technology, which is probably, not necessarily the case in today’s industry, and this have to be changed.
Next up is the “Business Defence – Managing the Insider Threat with Security Analytics” by Alex Taverner. He talks about how insider threat has always been an issue with companies, but it is remained largely neglected in the defensive security industry. He proposed a solution from his company (or any other company, if any) which could allow an enterprise to make use of various data sources to identify insider threats, such as the social media and the behavior of the employees. I feel that while this is something interesting and definitely helpful to a large company, the collection of data is something very difficult to be implemented. Even if it is implemented forcefully, it may not be enforced and thus, practical. Without accurate data, given the best formula and analytic tools, the results would not be beneficial, do you not agree?
Moving on to “Maximize the Value of Your Threat Intelligence” by Jason Rolleston. He discussed about the topic of effective protection, which is something I strongly agreed. A large company can definitely invest in all the newest technologies and software, but how well do they truly integrates? Check out the image above, this is a very true situation in many companies which I have come across either personally or understood through my contacts. Allow me to put them into text,
Emerging challenge will lead to an isolated tactical mode, where the challenge overwhelm the security teams of a large corporation. The management team will then invest in the procurement of a new technology or products without proper evaluation on how well they could integrate with the existing systems. After much struggling and a long time taken, they finally managed to complete the integration with various implementation design flaws here and there, which lead to a short-lived efficiency. After a number of such scenarios have taken place in the company, it will lead to technology sprawl where once again, the vicious cycle of security team being overwhelmed will take place again. Management need to have the far sight and try to understand the technology instead of blindly follow the trend and keep investing without planning.
Lastly, we have the “How to Build a World-Class Network Defence Organization” by Chris Coryea. This man gives an aura of confidence, the entire speech really leaves a strong impression to me. He shared a lot of real life examples on how a corporation can build a strong network defense through various key areas. The only complaint that I have is that he focuses too strongly on his company’s product, other than that, I really like his session. In fact, allow me to share one of the statements which he shared during his session, which I like the most, and fully agreed upon (with both hands),
Technology can be taught, the framework can be integrated – but focusing on the analytical mindset is the common thread for building an effective team.
In short, to build the best security defense team, you don’t necessarily need people who have “computer science” background or “master in forensics” in their CV or resume, what you need is people with a strong passion and hunger to solve tough problems.
New Blog URL: kongwenbin.com 
You must be logged in to post a comment.