How To Align Security and Development Teams.

VishwaPrabhakar Singh

Author’s Name

5 June 2018

How To Align Security and Development Teams.

Lets discuss it in brief.

While it’s key to specialise in security throughout software development, the restricted talent pool confounds the situation: There aren’t enough professionals to stay up with the growing threats. Indeed, finding and keeping smart computer code development talent is already difficult enough, coupled with retentive talent that’s security-focused.

Focus on the getting developers with huge skillsets

“A shortage of individuals with cybersecurity skills leads to direct harm to firms, as well as the loss of proprietary information and science,” says James A. Lewis of the Strategic Technologies Program at the center for Strategic and International Studies (CSIS). international intelligence agency recently partnered with Intel Security to unharness a report titled "Hacking the abilities Shortage," that outlines the talent shortage crisis impacting the cybersecurity business across each firms and nations.

Beware while hiring for Offshore Devs!

When you source software system development, confirm you hire a honorable team that produces security a priority. Avoid developers UN agency don’t take it seriously. They’re a risk you don’t want. Instead, confirm your supplier is skilled in security by discussing it too soon. raise potential outsourcing partners to supply samples of however they create security a priority.

There is no price in a very Development Operation program that doesn't increase unharness rate. A core gospel of DevOps is to appear for constraints that cause the backup of labor ongoing – security will expect to receive the spotlight as a result.

SDLC will need vital Modification for secure Dev.

Traditional waterfall-style approaches of build it, test it, hand it over to the safety team, and check it once more ar inefficient when put next to the continual integration (CI) and continuous delivery (CD) approaches of DevOps.

Many Developer initiatives have reduced delivery cycle time, however security practices and policies are getting the bottleneck to fast production delivery.

Project Testing Phase Outline

Testing custom code for vulnerabilities historically takes place once development is complete. however if thousands of checks take every week to run, you’re breaking CI/CD in DevOps. Instead, apply a small-batch testing philosophy to security testing, mistreatment the maximum amount automation of application security testing (AST) tools as attainable.

The goal ought to be to deliver safer code at the speed of business, instead of to patch or replace code reactively supported manual reviews or in response to breaches.

Collaboration in Teams 

Collaboration could be a key a part of DevOps culture. Developers and operations are closely connected, however there's area for security too. Security professionals ought to take into account providing checklists for developers as they integrate their code. offer coaching on policies to developers and operations employees, as well as explanations on why those policies are in place.

Secure it while you code it line by line.

Offer best practices to developing secure code that facilitate to stop typical attacks reminiscent of SQL injection, cross-site scripting, and buffer overflows. facilitate operations groups keep current with secure configurations for infrastructure, be it container-based, cloud, virtual or physical.

The automation designed into the DevOps platform makes code changes traceable, which may scale back the time needed to seek out the supply of a previously unknown vulnerability, thereby reducing exposure time and risk. Also, the smaller the batch size, the simpler it's to trace.

Risk Assessment Report of Bluetooth technology

1. Introduction

   1. Case Scenario

      
      
      

This report is all regarding identification and mitigation of current security threats of the Bluetooth.

Bluetooth was a technology for poor. Yea virtually it absolutely was designed specified adding to a sensible device wouldn't raise the general price quite five greenbacks. Ericsson was at forefront to create Bluetooth. several suppose that if you set the passcode or permit solely paired device to attach to your Bluetooth enabled device makes thier device safe. Well I solely enlighten them square measure YOU SURE!!!

Authentication

Authorization

Encryption

Few of the safety problems that square measure concerned in Bluetooth square measure

Short Pins square measure allowed, the cryptography key length is negotiable, master is shared, finish to finish security isn't performed to call many. (believe Pine Tree State the list goes on and on!!!)

Now I will explain few attacks on Bluetooth

1. Bluejacking:

Bluejacking is that the causing of uninvited messages over Bluetooth to Bluetooth-enabled devices like mobile phones, PDAs or portable computer computers, causing a vCard which usually contains a message within the name field (i.e. for bluedating or bluechat) to a different Bluetooth enabled device via the OBEX protocol. Bluetooth contains a terribly restricted range; typically around ten meters on mobile phones, however laptops will reach up to one hundred meters with powerful transmitters.

Bluejacking permits phone users to send business cards anonymously victimisation Bluetooth wireless technology. Bluejacking doesn't involve the removal or alteration of any information from the device. Bluejackers usually rummage around for the receiving phone to ping or the user to react. so as to hold out a bluejacking, the causing and receiving devices should be at intervals ten meters of 1 another. Phone homeowners United Nations agency receive bluejack messages ought to refuse to feature the contacts to their address book. Devices that square measure set in non-discoverable mode don't seem to be vulnerable to bluejacking.

Mobile phones are adopted as associate everyday technology, and that they square measure present in social things as users carry them around as they move through completely different physical locations throughout the day. As a communicative device, the itinerant has been bit by bit concerned in ways in which move on the far side just providing a channel for mediate speech. One such appropriation is bluejacking, the observe of causing short, uninvited messages via vCard practicality to alternative Bluetooth-enabled phones. to settle on the recipients of bluejacks, senders complete a scan victimisation their mobile phones to look for the obtainable Bluetooth- enabled devices within the immediate space. A bluejacker picks one in every of the obtainable devices, composes a message at intervals a body of the phone’s contact interface, sends the message to the recipient, and remains within the neighbourhood to watch any reactions expressed by the recipient.

The messages tend to be anonymous since the recipient has no plan United Nations agency has sent the bluejack, and therefore the recipient has no info regarding the bluejacker, aside from the name and model of the bluejacker’s itinerant. attributable to Bluetooth’s short-range networking capabilities, bluejacking will solely occur between actors United Nations agency square measure at intervals ten meters of every alternative, that makes this activity extremely location-dependent. Contrary to what the name suggests, the bluejack recipient’s phone isn't hijacked; that's, the phone is at no time below the management of the bluejacker.

We conceptualise bluejacking as a violation of possessional territory. galvanized by Goffman, we tend to propose that the itinerant could be a possessional territory as a results of the intimacy and continuing contact between itinerant users and their phones. A possessional territory, in our usage, is associate object that engenders attachment and defense by people who understand possession and may be stated as a “personal impact.” Possessional territories operate “egocentrically”; that's, they move around with their homeowners United Nations agency maintain and exert regulative management, like the definition of settings. Since we tend to characterize the itinerant as a possessional territory, we tend to adapt the class of violation, outlined as a short lived incursion wherever seizure isn't essentially the goal as a probable and acceptable class of infringement during this context.

We additionally propose that bluejackers try to modify their expertise of public area by partaking within the violation of others’ possessional territories through the act of illicit and anonymous electronic communication. guests to public areas will interact in habitual behaviors at a selected location, like choosing a favourite parking spot that one will come back to on every ordered visit, to achieve a way of familiarity to locations that square measure oft re-visited. These physical environments then hold enough significance to inspire defense among people who inhabit them and defensive behaviors, which might vary from process a private area at intervals a speech or whereas employing a work surface work-surface. Typically, associate somebody of a public place tends to modify a location if he or she feels that the social conventions of an area permit one the license to mark a territory.

2. Man in the middle attack:

This is not a attack that you simply dont grasp off. Infact I even have several friends United Nations agency in world act as man-in-the-middle either for serving to Pine Tree State or gaining info that they'll use for his or her own sensible. Buckeye State an excessive amount of critique on Pine Tree State, anyways, returning to the current quite attack, associate aggressor will hijack a already established bluetooth session to induce the info sent over bluetooth. the first objective of the aggressor is to attach the victim's portable computer to a faux Access purpose. aggressor uses the device that receives the Bluetooth packets in promiscuous mode and so sends cast ones to the mobile and portable computer of the victim.

Because Bluetooth could be a wireless communication system, there's perpetually a clear stage that its transmissions may be deliberately jam-pawncked or intercepted, or false/altered info may be passed to the piconet devices. to supply protection for the piconet, the system will establish security at many protocol levels. Bluetooth has inbuilt security measures at the link level.

Our work principally concentrates on the Man-In-The-Middle attack. By principle, with none verification of the general public keys, MITM attacks square measure usually potential against any message sent by victimisation public-key technology. the prevailing model uses the Bluetooth device that support SSP (Printer) that creates use of the simply Works, Numeric Comparison and therefore the Pass key entry association models. however it absolutely was proven that the prevailing model isn't abundantly secure. thus we tend to propose to use Out-Of-Band channeling association model to own additional security.

Out Of Band refers to communications that occur outside of a antecedently established communication ways or channel. The cryptographical systems that square measure secure against MITM attacks need a further exchange or transmission of data over some quite secure channel.

Counter Measures for This attacker

Knowing of potential issues of jacking and denial of service attacks of Bluetooth is that the initiative. Knowing that this stuff will occur could facilitate a user debate in once and wherever it's best to use their device. it'll additionally create them insure that info they are doing not would like to use over the air is insured to induce to the potential receiver.

The best resolution is to show off your Bluetooth device till you wish to speak with another user. Since we all know that code will activate and off Bluetooth a tool, disabling it and going it on isn't your best bet. If you want to keep the device on, than the concept of the E2X bag could also be your best choice explained below

Based on the Summary notes of information provided by Audit Scenario Document,

Detection and Prevention

These attacks can be detected by monitoring the bluetooth communication channels we should be caution about any unknown device in the list of known device and unknown authentication attempts or also known as pairing attempts with the target device.

There are many stuff you will do to stop folks from connecting to your Bluetooth devices. this text focuses specifically on protective your telephone, however the following pointers will apply to alternative devices furthermore.

Depending on your specific telephone, you’ll have totally different Bluetooth choices and settings offered, however identical general recommendation applies to all or any phones.

If your phone isn't paired with another Bluetooth device at any time, flip its Bluetooth capability off.

Figure#1Bluetooth menu in mac os.

-to avoid Associate in Nursing unknown device from making an attempt to attach to that. even though you're paired with a tool, you ought to still close up Bluetooth discovery (so alternative devices will’t see your phone) furthermore as machine pairing (which can enable a tool you’re not conversant in to attach to your phone while not your approval).

On most phones you'll access all of those settings from one Bluetooth menu, that is sometimes found on the most menu, or below a sub-menu known as one thing like Settings, Configuration, or Connections. If Bluetooth is presently enabled on your phone, you ought to see the small Bluetooth icon (a weird-looking white B within a blue oval) somewhere on the most screen.

Depending on your phone and also the device or devices you usually try it with, you will or might not be needed to enter a passcode to create the affiliation. If your phone needs a passcode so as for a tool to try with it and you’re ready to amendment the code, create it one thing tougher to guess than “0000” or “1234” (which square measure the default codes for several devices).

By following these easy tips, and by often glancing at your phone to visualize if it's connected to a tool or personal space network (PAN) that you’re not conversant in, you'll keep strangers from connecting to your phone and either inflicting injury or stealing information.

As Bluetooth gets additional and additional in style, additional folks can try and use it to their advantage, therefore the additional protected and knowledgeable you're, the better.

Prevention Counter Measures to Bluetooth Attacks in steps:

1.Switch off Bluetooth once not in use

2.Purchase solely devices having long PIN codes

3. Refrain from coming into PIN into Bluetooth device for pairing

4.Limit the electrical power itself to stay the vary of the network at intervals the physical space

5.Switch off all superfluous SCO/eSCO links

6.Select the correct place once 2 Bluetooth devices meet for the primary time and generate data formatting keys.

Why using pirated windows is still a bad Idea

Using pirated windows is very bad idea from a security point of view -as these pirated copies of the windows are not secure enough as they will not get patched for critical security updates from Microsoft even if force try to update them then Microsoft server will catch your system based on fake licenses number and will block you from windows updates and disable several features including server capabilities and desktop wallpaper and software updates from windows update server.

Now you might be interested to know what kind of security risk are we talking about here so let get into it.

So I analysed a pirated copy of windows using a anti malware software and at the very first scan it found 4 infections of several kind of malware and key loggers.

now you want to know what malware it "malware is harmful piece of software that can cause damage to you data and exploit you system for any personal information "

Keylogger are the special program made to monitor each key stroke on the keyboard that you make these are used to steal your banking details credit card number and debit cards online banking passwords and system passwords for files and application like Password manager the dirty hacker who planted these harmful software in the pirated copy of windows can steal your identity and cause some serious damage to your virtual, reputation and real life they can empty your bank account in seconds and make you homeless.

this scan shows the infection type found in the core windows system files.

This is example what the infected pirated windows did its malware activated as soon as you powered the system and it downloaded a fake copy of visual basic name file which is actually a key logger that will monitor and send each key you press on your keyboard to the hacker through which they know everything you are typing those malware also has capabilities to install a RAT in your system.

A RAT is Remote Administrative Tool through which they can literally they can control your computer without physically touching it and can make your life more miserable.

here is what a security expert said about this issue-

Windows, after having dropped it's embedded ad's (see: One Drive Ad, now a part of explorer) - the feature could be further exploited to plant 'malware', 'spyware' & have the explorer infected from unknown sources.
That's a big hit & a broad risk. Shouldn't be any if you go all into Linux Core, as you're in control from the very scratch. If rich, go Mac - that's pretty decent as well. - Shritam Bhowmick Application Security Expert.

I don't want to promote Microsoft windows and there product here this is not a sponsored article but its better to use either original windows or if you can't buy it then don't use windows at all use Linux distributions like Ubuntu Debian or Mint which are great for starters in Linux community.

If you can afford to spend some more money I will suggest buying a Mac which is a perfect combination of security of unix plus performance of apple brand.

Again I am here if you have any question related to any topic in this field.

Please share and comment.

What is Surveillance and What it should be!

My main motive for this article is to try to understand that what is surveillance is and what it has become. The surveillance meaning and what it is being actually implied nowadays.

Surveillance is a act of watching over a asset without there permission aiming to fetch the information in form of data. The huge majority of computer surveillance involves the monitoring of data and traffic on the Internet.

You can check the Wikipedia article surveillance for more info.

here is the link

Surveillance is very good fighting against terrorism, Cyber War, cyber terrorism etc etc... but when it comes to the right of spoof free Internet no one else is monitoring your connection then it becomes a human right. I believe every human on planet earth should have equal right of accessing Internet freely without any hesitation that his connection and his access point over the network is being monitored which later on can be aimed to any direction while any investigation done by any Federal Agencies for any other issue.

 Mass surveillance is being done all across the world is devastated it is clear now that most of the Agencies which are working on the ground are not taking user privacy seriously.

When this happened busy people coming out of their own organizations and making the confidential documents public which type thing should be know by all citizens, an act of doing so is called whistle-blowing.

Surveillance policy should be drafted in a way that every Surveillance request must be approved by some kind of jury before implementation.Surveillance without permission is like setting a wild horse free it can hurt somebody.

Example Edward Snowden one of the most famous whistle-blower he uncover the truth about the secret government mass surveillance program called prism.  and several other which were quality user privacy all across the world not only in United States.

Edward Snowden highlighted the key element facts that he disclosed and this segment of Ted Talk.


TED talk of Edward Snowden  here

Director of National Security Agency responded to the Ted Talk of Edward Snowden in this way you can see in this following video

NSA response to the TED talk with Edwards Snowden. here

We need to take back control over the Internet as we speak we cannot let anybody violate our privacy.

Here are things which we can do to fight against this kind of surveillance or Internet monitoring.

1- Every website and web service should implement SSL connection it is kind of Web encryption between the website and the user this connection is secure via public key the SSL is very very hard to break it will take millions of years for a normal computer to decode a message if he tries around 10,000 combinations of keys per second.

2- The second thing we can do we can use of VPN virtual private network for our Internet connection this is a secure tunnel for a secure channel between your computer and the  and the Internet server

This provider encrypted session between server and your system has no one can spoof hijack in between.
checkout torproject.org

3- Keep your operating system up to date for the latest security patch available.

4- Install the advanced antivirus and anti Malware softwares for example-Kaspersky, AVS.
     ( you don't need anti-virus no linux but still might need anti-malware.

5- Do not use torrent website over VPN because that disclose your real IP.

-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

Note- All the ideas and information is generally available on web, this article about is collection of my own ideas and views and thought about surveillance. I do not represent any party.
-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

How to find and fix Bash Shell-shock vulnerability CVE-2014-6271 in unix like system

In the world wide hurly-burly of personal network system and server security risk of these days due to Bash Shell-shock vulnerability CVE-2014-6271, so what should we do i suggest ...

Keep Calm And Patch

so lets begin to check if you system is vulnerability to bash shell-shock vulnerability  

type command - env x='() { :;}; echo vulnerable' bash -c 'echo hello'

in your terminal.

if your system is vulnerable then above command will return output like above

vulnerable hello

all the Debian /Ubuntu user to patch it kindly update your bash to latest version

run bash --version command to know your currently installed version
run- sudo apt-get update && sudo apt-get install –only-upgrade bash

if your system is alread updated then just simply upgrade your bash version by running this command 

sudo apt-get install --only-upgrade bash

again check your bash version after upgrading your bash version my previous version was version 3.2

----------------------------------------------------------------

update the bash using yum on all RedHat/CentOS 

run- yum update bash

On RedHat 6 (and CentOS 6), I had the following bash version before the fix:

run- # rpm -qa | grep bash

bash-3.2-33.el5_11.4

now again check your system if vulnerable or not by using this command 

run- cd /tmp; rm -f /tmp/echo; env 'x=() { (a)=>\' bash -c "echo date"; cat /tmp/echo

if you are not vulnerable then out put will be like

no content will be displayed and if it is still vulnerable then it will show content of file like 

bash: x: line 1: syntax error near unexpected token `=' 

bash: x: line 1: `' bash: error importing function definition for `x' 

Fri Sep 26 16:15:09 PDT 2014

------------------------------------------------------------------------------------------------------------------------------

if you have more than one server to update use this script to do all at once

#!/bin/bash

# This script will log into each of your servers and execute the command below

servers=(

# Put your list of servers here

111.222.333.444

123.123.123.123

10.10.10.10

15.22.22.22

)

for server in ${servers[@]}

do

# Here's the command you're going to run on each

ssh $server 'yum -y update bash'

done