This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org

OWASP AppSec DC 2012/Denial of Surface

From OWASP
Jump to: navigation, search

AppSecDC-468x60-banner-2012.jpg

Registration Now OPEN! | Hotel | Schedule | Convention Center | AppSecDC.org

The Presentation

Are industrial systems airgapped?
Some are, some aren't. Unfortunately, enough of them aren't...to suggest bigger questions. Shodan has provided us with over 10,000 proofs of ICS connectivty, and visualization is the key to this story. More importantly, this data was provided to ICS-CERT to help mitigate such exposure. That data was in turn shared globally with other CERTS and CSIRTS, and the lessons are still being learned.
It's time to re-examine the fantasy of the airgap, and think of ways to do vulnerability and exposure management in vendor and owner agnostic ways. More importantly, how do you do vulnerability management at a national or international scale?
This is not a story of 'I found a couple scary things in SHODAN'. This is a theory of the underlying cause for being able to find THOUSANDS of ICS devices and logins on the open internet. Complete with open source eye-candy!

The Speakers

Eireann Leverett

AppSecDC12-leverett.jpg
Eireann Leverett is NOT a PhD student at Cambridge, despite recent propaganda to the contrary. He did grow up in DC though, and is looking forward to coming back in style.

He started academic life studying Philosophy and Psychology, and then moved on to Artificial Intelligence and Software Engineering. His most recent project comes from his MPhil in Advanced Computer Science which apparently he survived.

He's been an OWASP, circus, and hackerspace activist for a few years, and likes security projects in the real world. His fans include his mom, her dog, the deuteragonist Jiminy Cricket, and a couple Amish mimes living in Norway.

He currently scrapes out a living inventing ridiculous bios in the third person, because he hasn't really done anything yet.


Gold Sponsors

Aspect logo owasp.jpg AppSecDC2009-Sponsor-securicon.gif AppSecDC2009-Sponsor-mandiant.gif AppSecDC2012-ISC2.gif

Silver Sponsors

SPL-LOGO-MED.png

Small Business

AppSecDC2012-Sponsor-sideas.gif BayShoreNetworks.png

Exhibitors

link=http://www.codenomicon.com/ Codenomicon WhiteHat Logo.png AppSecDC2012-HP.jpg WSI - Logo.jpg