If you're only going to spend money on one security-related effort this year, spend it on training. Your people are a human firewall for your organization, so it's absolutely critical that they understand their role in security. They also need to be trained regularly to effectively thwart social and physical engineering attempts.
I offer fun and engaging training sessions on a variety of topics, including:
This session is aimed to arm employees with a good mix of general security knowledge to help them be more secure at work and home. Topics covered include:
- Home network security - how to properly configure and secure your home wireless to keep attackers (and cheap neighbors :-) out
- Password management - tips on picking good passwords and using a password vault to properly secure and share them
- Social engineering defense - discussion on how to identify and thwart social engineering attacks, whether they be in physical or electronic form
- Safe computing practices - how to better secure your home and/or work machine, as well as your online persona, using:
- Full disk encryption
- Ad/malware-blocking browser plugins
- Local/online backup solutions
- Social media privacy best practices
Network pentesting 101
In this session, attendees will learn the fundamentals of network penetration testing, including:
- Building your own pentest lab
- Installation and configuration of Kali Linux
- Performing reconnaissance on organizations using open source intelligence (OSINT) techniques
- Scanning networks and identifying vulnerabilities with nmap
- Vulnerability scanning with OpenVAS
- Using Metasploit to exploit discovered vulnerabilities
Here's the slide deck from my presentation of this session at Secure 360 in 2017:
Web application pentesting 101
This session will cover the fundamentals of enumerating, attacking and exploiting Web applications (specifically the awesome - and free! OWASP Juice Shop) while following the OWASP methodology. Topics covered include:
- Installation and configuration of Juice Shop
- Installation and configuration of Burp Suite
- Searching, spidering and scoping your target application
- Discovering vulnerabilities such as SQL injection, cross-site scripting, and weak user credentials
protecting your network from bunnies!
In this session we will discuss the Bash Bunny, a sneaky USB-based tool that comes in extremely handy on a pentest. Topics covered include:
- Configuring the Bash Bunny for use in a penetration test
- Demonstration of common Bash Bunny attacks:
- Data exfiltration
- Wireless password capturing/cracking
- Network traffic manipulation to discover valid Active Directory accounts
- Tactics for defending against Bash Bunny capabilities
Here's the slide deck from my presentation of this session at the Secure-IT conference in 2017:
Blue Team on a Budget
In this presentation, attendees will learn how to leverage free tools to gain insight on what’s going on in their networks, increase logging and event correlation to boost network defenses, and take actions to stop threats.
Topics of discussion and demonstration include:
- Microsoft Local Administrator Password Solution (a.k.a LAPS - a free tool to randomize local admin passwords)
- Security Onion (a free IDS)
- Open Canary (a free tool to trap bad guys!)
- Real Intelligence Threat Analytics (a.k.a RITA - a free tool to find bad things on your network)
- Sysmon (Microsoft's free tool that empowers administrators to better detect signs of system compromise
Here's the slide deck from my presentation of this session at the ILTACON conference in 2017:
If you suspect a Windows system has been compromised or infected with malware, it can be extremely valuable to be able to do an initial triage of the system before calling in a forensics expert. In this session, attendees will use open source tools to:
- Triage and troubleshoot systems using Windows built-in command line tools
- Capture memory/disk images for further forensics review
- Analyze memory dumps and system artifacts for indications of compromise
Frequently asked questions:
How is training delivered?
I can provide these sessions remotely, at your office, or some combination of the two.
What if I need ongoing security awareness training needs for my employees - training they can take at their own pace?
I can also offer a variety of excellent eLearning courses through my partner InteProIQ.
Where can I see some of the past presentations you've done?
To get a feel for my speaking/training style, I welcome you to check out my YouTube videos, listen to my podcast and peruse the presentation archive on my personal site. Or, better yet, come see me in person at an event near you!