why i love my job - ttu cae network...

The joys and wonders of security evaluations

Why I Love My Job

Rosie Hall

Software EngineerReleased: June 12, 2015

2© 2015 Cisco and/or its affiliates. All rights reserved. Cisco Confidential

Goals

1. Help you determine if security evaluations are the right career for you

2. Point you to some useful resources

3. Life Lessons highlighted in green


My Background


• Went to Beech High School in Hendersonville, TN

• Majored in Computer Engineering at UT

• Internship in Reliability Engineering in a Michelin tire plant in Opelika, AL• Internships are a great way to figure out your job preferences

before you invest in a job

• Internship doing research on neural-based circuits at UT on an NSF grant

• Internship at Cisco in Knoxville for 2 years

• Masters in Computer Engineering

• Hired Full Time at Cisco• Internships are also a great way to get a job!


About Cisco


Core Business is routers and switches


Data center – routing and servers, management automation, firewalls


Cloud – Infrastructure, Platform, and Software as a Service offerings


Collaboration – IP phones, WebEx, Telepresence


Security – Firewalls, IPS, Network Traffic Analytics


• Both Products and Services in these areas

• Growth through acquisitions

What Does Cisco Do?


ASIG – Advanced Security Initiatives Group


• Offices in Knoxville and Austin, plus ~10 remote workers

• Primarily perform security evaluations on Cisco products

• Security research / tool creation• Hardware & Forensics Teams

ASIG


• We are the Breakers

• We try to keep Cisco out of the news by finding vulnerabilities first

• 3 years to 2 weeks, 3 month average

• Evaluate many different products, technologies, languages• Learning never ceases

• Sometimes black box, usually white box

What are Security Evaluations?


• Major component of our evaluations• Exploit a system as far as you can, just as an attacker would

• Demonstrates the impact of vulnerabilities to management

• Often several low severity bugs can be chained together to completely compromise a system

Penetration Testing


• Research the product• Prioritize the attack surfaces

• Authentication• Authorization• Sensitive Data or Actions• Encryption, especially home-rolled

• Manual testing• Fuzzing• Source code inspection

How do we do it?


• Privilege escalations• Command Injection• Inadequate input validation

• Buffer overflows• XSS

• Logic Errors• Information exposure

What do we look for?


• BurpSuite• IDA pro• Gdb• Nessus• Metasploit• Scapy• Peach

Commonly Used Tools


• C• A scripting language (ruby or python)• Network protocols (CCNA a big plus)• Security• Encryption

Useful Skills


Perspective from a new hire.


• B.S. in Computer Science from Stony Brook University, NY

• Worked as a Java Developer for Fortune 500 company.

• Hated development. Loved breaking stuff.

• Took steps to teach myself about security.

• Got hired as a Security Engineer for Cisco

About Me


• B.S. in Computer Science from Stony Brook University, NY

• Worked as a Java Developer for Fortune 500 company.

• Hated development. Loved breaking stuff.

• Took steps to teach myself about security.

• Got hired as a Security Engineer for Cisco

About Me

What did I do to teach myself enough to get hired?


• College degree is simply not enough.

• Practice on your own time. Often!

• Find an area of study you can be passionate about.

• Get involved in the community. Contacts are valuable.

How to get an InfoSec job.

• Web Application Penetration Testing

• Malware Research / Reverse Engineering

• Network Security and Monitoring

• And much much more……..

Possible Areas of Interest


SecurityTube

• http://www.securitytube.net/

• Free training videos. Recordings from conferences.

• Paid security certifications in metasploit, aircrack, python, and more.

Courses

Coursera

• https://www.coursera.org/

• Free courses. Only pay for certificates.

• Cybersecurity specialization from Univ of Maryland.

http://www.securitytube.net/

http://www.securitytube.net/

https://www.coursera.org/

https://www.coursera.org/


DerbyCon

• September @ Louisville, KY

• $175.00 for 3 days.

• Beginner to advanced. Friendly community.

Conferences

B-Sides Knoxville

• May @ Knoxville, TN

• $10.00 for 1 day.

• Brand new. Super cheap. Local hackers.


Matasano Challenges

• Cryptopals @ https://cryptopals.com

• Microcorruption @ https://microcorruption.com

• Starfighter @ http://starfighters.io/

Training Grounds

Capture the Flags / Wargames

• CTF Time @ https://ctftime.org

• Smash The Stack @ http://io.smashthestack.org/

• Over The Wire @ http://overthewire.org/

https://cryptopals.com/

https://cryptopals.com/

https://microcorruption.com/

https://microcorruption.com/

http://starfighters.io/



https://ctftime.org/

https://ctftime.org/

http://io.smashthestack.org/

http://io.smashthestack.org/

http://overthewire.org/




Vulnerable VM’s

• PentesterLab @ https://pentesterlab.com/

• VulnHub @ https://www.vulnhub.com/

• Exploit Exercises @ https://exploit-exercises.com/

Training Grounds (cont.)

Vulnerable Web Applications

• WebGoat @ https://code.google.com/p/webgoat/

• Gruyere @ https://google-gruyere.appspot.com/

• DVWA @ http://www.dvwa.co.uk/

https://pentesterlab.com/

https://www.vulnhub.com/



https://exploit-exercises.com/



https://code.google.com/p/webgoat/





https://google-gruyere.appspot.com/



http://www.dvwa.co.uk/




Podcasts

• Risky Business

• Paul’s Security Weekly

• SecurityNow! w/ Paul Gibson

Staying Current

Reading

• Books: No Starch Press, O’Reilly

• Blogs: Krebs On Security, Project Zero

• Twitter: @SwiftOnSecurity, @thegrugq


Interested in doing security evaluations?


• Frequently have openings for full time positions• Computer Science• Computer Engineering• Electrical Engineering

• Currently interviewing for summer internships• Typically have 4 summer interns

Openings


Send your resume to [email protected]

Or check out

www.cisco.com/jobs

mailto:[email protected]

https://www.cisco.com/jobs


Questions?

why i love my job - ttu cae network...

Documents