327 reputation
110
bio website bsidesorlando.org
location Climing in yo windows
age
visits member for 2 years, 3 months
seen Sep 4 at 13:47

Formerly worked for a security firm from home doing PCI ASV/PCI QSA work. Decided I hated working from home and that company, now I do vulnerability management for a corporate entity. I mostly still work in PCI, but I'm on the other end of the stick (the side that gets hit with the stick) Most of my time is spent spanking system owners when they don't patch properly, the rest is dedicated to reviewing and writing policy to help build up our VM program.

I used to know a whole lot of technical stuff, but then I got wrapped up for 2 years in PCI and lost all my skills by getting rusty and complacent. I spend a lot of time on /r/netsec.

I also created #DC407 and I'm an organizer of BsidesOrlando


Feb
14
comment What do I need to be aware of to select a transfer method for digital forensic data?
Can you expand on why you have those 3 options? Are you imaging machines at the user's desk, or are you taking it to your forensics room so you can properly handle chain of custody? Personally, what I've done in the past is confiscate the computer (or have it already confiscated, did forensics for LEO) and bring it to the forensics lab, which was locked and I was the only one with the code so proper chain of custody can be maintained. What is the purpose of your forensics program? Pursue legal action? If so, you'll need to consider the above.
Feb
6
comment Retreive header from SMS iphone
If you could figure out the sender's information. There is something as a User Data Header that's attached to SMS (en.wikipedia.org/wiki/User_Data_Header), but the Google results for UDH SMS iPhone really only give you results for a vulnerability in iOS that was disclosed a while ago. Your carrier might be able to assist.
Feb
6
comment Retreive header from SMS iphone
I believe there are also Android apps that will SMS bomb someone for you from your phone/tablet.
Feb
6
answered Retreive header from SMS iphone
Jan
30
answered “Due diligence” in PCI requirement 12.8.3
Jan
29
comment How to satisfy requirement 10.6 of PCI DSS?
You would have a procedure document that outlines the responsibilities of the person who is reviewing the document. Call out specific systems that need to be reviewed daily. Some ways to get around this costing time, is to use a SIEM, or on the cheap, set up daily alerts for each important service.
Jan
23
comment Vulnerability scan scheduling approach on demand versus change?
Sounds like this is more of a policy problem than a vulnerability management problem.
Jan
22
comment What techniques do advanced firewalls use to protect againt DoS/DDoS?
While firewalls/IPS offer good defense against DoS/DDoS based off of exploit, a powerful flood will still flood your pipe even if you have a really good robust firewall rule in place. Sadly, the only way to prevent this sort of thing from happening is to partner with a mitigation vendor. (or appliance, there is one out there that claims to stop DDoS, but I've yet to actually see it in use, just in demos) My org is in the middle of a mitigation partnership.
Jan
14
comment How is Tor secure?
Check out the latest 2600 for a way to use OpenVPN over TOR to secure both your transactions and identity. It needs some significant testing, but it's a great idea.
Jan
10
awarded  Commentator
Jan
10
comment How is Tor secure?
Oh I know, I was making a joke. I understand that OSS is better reviewed, which is why I downplayed on that. All OSS has the downfall of the source being available to review by malicious agents, but it also gets fixes a lot faster. If closing your source was the solution, we wouldn't have all these 0days popping up around us.
Jan
10
revised How is Tor secure?
ad != add
Jan
10
answered How is Tor secure?
Jan
9
comment Email Compromised due to Yahoo Mail Exploit
While it's good that you changed your password and we all need to do that more often than we should, but the exploit isn't a Yahoo Mail systems exploit. The exploit in question is XSS that needs to be pointed at a target and the PoC is not public last I checked. That being said, knowing it's there may lead to other people to discovering the exploit.
Jan
4
comment Macbook pro, rootkithunter
Format the drive and start with a fresh installation of OSX.
Jan
3
comment Building a Security Training Simulation environment
GiT has a great lab, I remember reading a lot of articles on it when it came out: Here is a whitepaper on it (unknown date, sorry. Also, PDF Warning): csc.gatech.edu/~copeland/6612/netseclab/… csc.gatech.edu/netseclab.html Description of lab and their methodology for grading
Jan
2
comment Cons of disabling live CD in bios
On laptops, it can be easy as pie, or it could depend on the alignment of the moon with the fifth order of Mars. I've run into Lenovos that are extremely difficult to reset the bios.
Dec
18
answered PCI-DSS - one application per server?
Dec
14
awarded  Teacher
Dec
14
awarded  Supporter