OWASP AppSec DC 2012/AMI Security - Revision history

Mark.bristow at 00:44, 13 March 2012

2012-03-13T00:44:49Z

Mark.bristow at 00:59, 12 March 2012

2012-03-12T00:59:49Z

Mark.bristow: Created page with "{{:OWASP AppSec DC 2012 Header}} NOTOC == The Presentation == rightAdvanced Metering Infrastructure (AMI) is the mo..."

2012-03-02T20:54:04Z

Created page with "<noinclude>{{:OWASP AppSec DC 2012 Header}}</noinclude> __NOTOC__ == The Presentation == rightAdvanced Metering Infrastructure (AMI) is the mo..."

New page

<noinclude>{{:OWASP AppSec DC 2012 Header}}</noinclude>
__NOTOC__
== The Presentation ==
[[Image:Owasp_logo_normal.jpg|right]]Advanced Metering Infrastructure (AMI) is the most exposed part of the Smart Grid. Public-facing devices include smart meters on the sides of businesses and houses and aggregation points on the top of telephone poles. But the risks and vulnerabilities do not stop here. The back-end resources of an AMI implementation are still potentially vulnerable to all of the same threat vectors as everyday web-based business solutions. Cross-site scripting, cross site request forgery, insufficient network monitoring, and questionable web server and database configurations all play a part in increasing the risk to the AMI deployment and the electrical grid itself. This presentation will outline these vulnerabilities and provide recommendations that will increase the security of an AMI deployment and increase the reliability of the electrical infrastructure it supports. This presentation will cover the following topics:<br>- AMI implementation overview from Smart Meters to the back-end resources - Smart meter hacking techniques and mitigations - FHSS analysis techniques and mitigations - Network configuration and monitoring concerns and mitigations - Web application vulnerabilities and mitigations
== The Speakers ==
John Sawyer and Don Weber
<noinclude>{{:OWASP AppSec DC 2012 Footer}}</noinclude>

@@ Line 8: / Line 8: @@
 <td>
 ===John Sawyer===
-[[Image:Owasp_logo_normal.jpg|left]]Bio TBA
+[[Image:AppSecDC12-Sawyer.jpg|left]]John Sawyer is a Senior Security Analyst with InGuardians specializing in network and web application penetration testing. John's experience in enterprise IT security includes penetration testing, system and network hardening, intrusion analysis, and digital forensics.
 </td>
 </tr>
@@ Line 14: / Line 16: @@
 <td>
 ===Don Weber===
-[[Image:Owasp_logo_normal.jpg|left]]Bio TBA
+[[Image:AppSecDC12-Webber.jpg|left]]Jack of All Trades and hardware analysis expert for the InGuardians. Don specializes in physical and information technology penetration testing, web assessments, wireless assessments, architecture review, incident response/digital forensics, product research, hardware research, code review, security tool development, and the list goes on. Don is currently focusing on hardware research specifically in the technologies surrounding products comprising the SMART GRID. He has focused on implementing various communication protocols and microprocessor disassembers/emulators for research, testing, risk assessment, and anything else you can think of with these technologies.
 </td>
 </tr>
 </table>
 <noinclude>{{:OWASP AppSec DC 2012 Footer}}</noinclude>

@@ Line 2: / Line 2: @@
 __NOTOC__
 == The Presentation  ==
-[[Image:Owasp_logo_normal.jpg|right]]Advanced Metering Infrastructure (AMI) is the most exposed part of the Smart Grid. Public-facing devices include smart meters on the sides of businesses and houses and aggregation points on the top of telephone poles.  But the risks and vulnerabilities do not stop here. The back-end resources of an AMI implementation are still potentially vulnerable to all of the same threat vectors as everyday web-based business solutions. Cross-site scripting, cross site request forgery, insufficient network monitoring, and questionable web server and database configurations all play a part in increasing the risk to the AMI deployment and the electrical grid itself. This presentation will outline these vulnerabilities and provide recommendations that will increase the security of an AMI deployment and increase the reliability of the electrical infrastructure it supports. This presentation will cover the following topics:<br>- AMI implementation overview from Smart Meters to the back-end resources - Smart meter hacking techniques and mitigations - FHSS analysis techniques and mitigations - Network configuration and monitoring concerns and mitigations - Web application vulnerabilities and mitigations
+Advanced Metering Infrastructure (AMI) is the most exposed part of the Smart Grid. Public-facing devices include smart meters on the sides of businesses and houses and aggregation points on the top of telephone poles.  But the risks and vulnerabilities do not stop here. The back-end resources of an AMI implementation are still potentially vulnerable to all of the same threat vectors as everyday web-based business solutions. Cross-site scripting, cross site request forgery, insufficient network monitoring, and questionable web server and database configurations all play a part in increasing the risk to the AMI deployment and the electrical grid itself. This presentation will outline these vulnerabilities and provide recommendations that will increase the security of an AMI deployment and increase the reliability of the electrical infrastructure it supports. This presentation will cover the following topics:<br>- AMI implementation overview from Smart Meters to the back-end resources - Smart meter hacking techniques and mitigations - FHSS analysis techniques and mitigations - Network configuration and monitoring concerns and mitigations - Web application vulnerabilities and mitigations
 == The Speakers  ==
-John Sawyer and Don Weber
+<table>
 <noinclude>{{:OWASP AppSec DC 2012 Footer}}</noinclude>

OWASP AppSec DC 2012/AMI Security - Revision history

Mark.bristow at 00:44, 13 March 2012

Mark.bristow at 00:59, 12 March 2012

Mark.bristow: Created page with "{{:OWASP AppSec DC 2012 Header}} __NOTOC__ == The Presentation == rightAdvanced Metering Infrastructure (AMI) is the mo..."

Mark.bristow: Created page with "{{:OWASP AppSec DC 2012 Header}} NOTOC == The Presentation == rightAdvanced Metering Infrastructure (AMI) is the mo..."