g3k

327 reputation

bio	website	bsidesorlando.org
	location	Climing in yo windows
	age
visits	member for	9 months
	seen	6 hours ago
stats	profile views	17

Formerly worked for a security firm from home doing PCI ASV/PCI QSA work. Decided I hated working from home and that company, now I do vulnerability management for a corporate entity. I mostly still work in PCI, but I'm on the other end of the stick (the side that gets hit with the stick) Most of my time is spent spanking system owners when they don't patch properly, the rest is dedicated to reviewing and writing policy to help build up our VM program.

I used to know a whole lot of technical stuff, but then I got wrapped up for 2 years in PCI and lost all my skills by getting rusty and complacent. I spend a lot of time on /r/netsec.

I also created #DC407 and I'm an organizer of BsidesOrlando

	327 reputation	bio	website	bsidesorlando.org	visits	member for	9 months
8 badges		location	Climing in yo windows		seen	6 hours ago

summary answers questions tags badges favorites bounties reputation activity

45 Actions

suggestions reviews revisions comments badges posts accepts all

Jan 23	comment	Vulnerability scan scheduling approach on demand versus change? Sounds like this is more of a policy problem than a vulnerability management problem.
Jan 22	comment	What techniques do advanced firewalls use to protect againt DoS/DDoS? While firewalls/IPS offer good defense against DoS/DDoS based off of exploit, a powerful flood will still flood your pipe even if you have a really good robust firewall rule in place. Sadly, the only way to prevent this sort of thing from happening is to partner with a mitigation vendor. (or appliance, there is one out there that claims to stop DDoS, but I've yet to actually see it in use, just in demos) My org is in the middle of a mitigation partnership.
Jan 14	comment	How is Tor secure? Check out the latest 2600 for a way to use OpenVPN over TOR to secure both your transactions and identity. It needs some significant testing, but it's a great idea.
Jan 10	awarded	Commentator
Jan 10	comment	How is Tor secure? Oh I know, I was making a joke. I understand that OSS is better reviewed, which is why I downplayed on that. All OSS has the downfall of the source being available to review by malicious agents, but it also gets fixes a lot faster. If closing your source was the solution, we wouldn't have all these 0days popping up around us.
Jan 10	revised	How is Tor secure? ad != add
Jan 10	answered	How is Tor secure?
Jan 9	comment	Email Compromised due to Yahoo Mail Exploit While it's good that you changed your password and we all need to do that more often than we should, but the exploit isn't a Yahoo Mail systems exploit. The exploit in question is XSS that needs to be pointed at a target and the PoC is not public last I checked. That being said, knowing it's there may lead to other people to discovering the exploit.
Jan 4	comment	Macbook pro, rootkithunter Format the drive and start with a fresh installation of OSX.
Jan 3	comment	Building a Security Training Simulation environment GiT has a great lab, I remember reading a lot of articles on it when it came out: Here is a whitepaper on it (unknown date, sorry. Also, PDF Warning): csc.gatech.edu/~copeland/6612/netseclab/… csc.gatech.edu/netseclab.html Description of lab and their methodology for grading
Jan 2	comment	Cons of disabling live CD in bios On laptops, it can be easy as pie, or it could depend on the alignment of the moon with the fifth order of Mars. I've run into Lenovos that are extremely difficult to reset the bios.
Dec 18	answered	PCI-DSS - one application per server?
Dec 14	awarded	Teacher
Dec 14	awarded	Supporter
Dec 14	comment	Physical Security for USB Keys and Systems-on-a-Stick If it has any sort of lanyard attachment on it, you could always fashion it to your laptop via a vent slot or something like that with a higher tension string of some sort. edit: To the guy above, it would be much harder to take that out of a laptop from a driveby thief. Trying to scramble to get that out of a laptop quickly would be difficult to someone who is probably pumped up with adrenaline.
Dec 14	answered	Physical Security for USB Keys and Systems-on-a-Stick
Sep 24	awarded	Analytical
Sep 24	comment	Testing http authentication via netcat Well, it was a general question in case this cropped up again. Somethings pages don't load internally because of $reasons_of_not_disclosing and we have to hit it with another tool.
Sep 24	comment	Testing http authentication via netcat Awesome, that's exactly what I need. I always forget about curl...
Sep 24	comment	Testing http authentication via netcat I can verify if the service is shut off (it is), that's not my question. It's "How can I replicate what vulnerability scanners do to test for default creds on a service without a GUI"