Categories
security

Hack of the Week: Episode 2: Get a Good Host

In a rare occurrence for me, I am continuing my series of watching hack logs. You can check out all the episodes here: HOTW

For this episode I am pulling out an older record because I think it was rather clever.

Categories
security

Hack of the Week: Episode 1: Reading Logs Can Be Fun

Reviewing your logs is an important part of maintaining good system security. One log I watch on a constant basis is my IDS report (mainly because it constantly emails me). This is part one in (hopefully) an ongoing series of looking into what the script kiddies are up to, and how your server might be vulnerable.

Categories
work

New job at BAO Systems: Chief Unicorn Wrangler

As some of you may have seen on LinkedIn, I am now working full-time for BAO Systems. I tried to get a silly new title, but I figured “Senior Software Architect” would be a bit more professional. This is somewhat a return to familiar ground as I will be helping move research forward for many NGOs (PEPFAR, International Rescue Committee, Doctors Without Borders, …).

The timing of this change is perfect. My previous government contract wouldn’t let me work remotely, promoted a hostile work environment, and were more concerned with appearances than national cyber security. Now I get to work remotely with an international team, promote international health and safety, and through it all, save lives. I can’t complain much about that.

I was removed from the government contract for insubordination. Someday I may write about it. If you want the details sooner we can talk over a cold bottle of root beer at php|world.

Categories
howto

Getting ReactJS to use a local external js library

My new job involves mostly frontend work with various js libraries like ReactJS. I ran into the issue of wanting to include jquery.csv.js into a project and felt that existing documentation was lacking. Most google searches returned how to use something from a CDN. Our systems need to be able to run offline in the middle of Africa. A CDN isn’t going to cut the mustard.

First, get the library:

    npm install jquery-csv --save

Now we make a reference to it in webpack.config.js

    resolve: {
        alias: {
            ....
            'jquery-csv': path.resolve('./node_modules/jquery-csv')
        }
    }

FInally we tell the application about it (in app.js if you want)

    require('jquery-csv')

Restarting the server and checking the console, I can reference $.csv to my heart’s desire.

Categories
security work

CSSLP Certified

On last official day with Redport Information Assurance, I received confirmation of my Certified Secure Software Lifecycle Professional acceptance by (ISC)2. I am very grateful that Redport repeatedly covered my training and certification process. Alas, the story of our mutual separation will be a separate blog post.

Categories
work

Back on the market

After three years working at the Department of Energy as a Senior Security Software Engineer, I am back on the job market. If you are looking for a web application developer with over 15 years experience, please send me a line. Partnering with my infosec company (Redport Information Assurance) is also cool. I have TS and DOE-Q clearance. Ideally the position would be remote.

Categories
security work

Is the CSSLP worth it?

Last week I passed the (ISC)2 Certified Secure Software Lifecycle Professional (CSSLP) exam. Here are some thoughts (not bound by the (ISC)2 NDA):

Cert Types

There are two classes of certification within the (ISC)2 family: member and associate. The only difference between the two is how many years of experience you have in the subject area. For full membership, you need to have 4 years experience in at least 1 of 8 domains. If you have been doing devops for at least 4 years you will most likely be fine. If not, then you can go for the “associate” cert with the understanding that you have 5 years to gain that experience.

Summary: If the reason you are getting this cert is to have some letters on your resume, you might want to just go for the associate level. Who knows where you will be in 5 years.

Preparation

Option 1: Experience

This cert focuses on security aspects in the full lifecycle of “enterprise” application development (read: .Net/Java). Honestly, I do not believe that my 18+ years of PHP development would have prepared me to pass this test, even though I had several years of Java dev in the midst. There were too many questions on processes, Microsoft, Java, and acronyms. My three years in the infosec arena certainly helped, but did not cover all the bases.

Option 2: Official Training  = High cost / Low risk

If you prefer live training, want to make dead sure you pass the test, and you have $2695 laying around, you can take (ISC)2’s official week-long trainings.  The also have self-study classes from $99 up to $695. If your company wants to pay for this, awesome! Good luck with that. (ISC)2 also has CSSLP Flash Cards on their website, but in my case they only represented about 60% of the concepts on the exam I took.

Option 2: Job training portals = Low cost  / Medium risk

Through my office, I was able to take the free FedVTE online CSSLP training. The 20-hour series of videos from CMU were great as an overarching review of security practices (when they say 20 hours they really mean 30+ hours). I feel that these trainings only provide a 60% solution. The information is great and highly recommended, but if your goal is passing, it won’t be enough by itself.

Looking back I also had access to the CSSLP resources on Skillport/Skillsoft. Make sure to check your company offerings.

Option 3: Read the book

There are several books out there purporting 90% passing rates. Looking at the comments on the latest official (ISC)2 offering will not give you much hope of passing. Not being too confident in scope of the FedVTE Computer Based Test (CBT) class, I purchased Conklin’s CSSLP Certification All-in-One Exam Guide. Similar to the CBT, the material covered was broad but still did not cover all the areas of the test. The Microsoft specific areas of the book were definitely helpful, coming from a Linux world.

Summary: GetConklin’s book. If you are on a budget, use the official (ISC)2 training and books as a last resort.

Exam

Time: You have 4 hours to complete 175 multiple choice questions at a Pearson Vue center. I managed to finish in under 90 minutes. ie. You have plenty of time to read each question carefully.

Content: As a CBT, each persons’ exam should be different, so YYMV. Although the practice exams got me a bit scared, I did not encounter any “Which of these 4 ISO standards is the right one?” A fair number could be solved just by process of elimination. Having the years of experience certainly helped with a number of questions that the CBT and books overlooked.

Passing: I was surprised when I first looked at this test, as you only need a 70% to pass. Part of that may be the fact that the test is “a mile wide and an inch deep“.

Completion

Unlike certifications you might be used to, (ISC)2 and some others require you to be endorsed by someone who is an active (ISC)2 member in good standing. Hopefully you already know someone who is a member and can vouch that you have the required professional experience. In a couple weeks that should be me as well.

Prospects & Alternatives

A search today on some of the more popular boards reveals job postings for CSSLP professionals.

These numbers are not all that great, especially since I did not place a geographical restriction on the search.

There are many other security related certificates out there. CASP, CISSP, GWEB, and CEH are some of the more well known.Though some colleagues believe the value has been watered down in recent years, there are over 10x more jobs requiring a CISSP certificate. In many postings where CSSLP shows up, it is paired with one of these other more well known options.

Summary: If you are getting this to find a new job, other certs have more flexibility.

Value

Cost: Certs are not cheap. The CSSLP exam costs $595, plus, to keep your cert active, you must pay $100 and receive 30 Continuing Professional Education (CPE) credits per year. Training can be expensive as well. If your company is willing to pay for it, great! Out of pocket, ouch.

Visibility: This is not a well known cert. Despite the (ISC)2 website saying “CSSLP Named #1 Tech Cert that is Paying Off by Foote Partners” (for the first half of 2014), the job market says otherwise. Granted, it is no longer 2014 so perhaps it did pay off for 6 months.

Credits: Many certs these days require you to receive CPE credits to stay “active”. I plan on using the CSSLP as 50 CPE credits to renew my Security+ cert.

Usefulness: This cert material is useful, especially if you do not have a formal CS degree, or you are moving more toward leading teams or project management. It is a SDLC focused cert after all. There was a broad mix of useful security practices, “enterprise” situations, and supply chain considerations. At the very least, government recruiters like to see tons of certs on resumes.

Conclusion

It seems that certain people (especially government related entities) think the only way a person can know material is if they have paper proof. If you are looking to switch toward the security industry but lack the experience, I would check out the Security+ exam first.  Several government agencies will accept that as proof that you know enough security to get in the door. If you already have 5+ years in infosec, go for the CASP or CISSP instead. They both have broader visibility. However, if you are a PHP developer and plan on working just for PHP companies, the ZCE is a much better place to start, with its lower upfront cost and no yearly maintenance fee.

Categories
howto security

Basic Intrusion Detection with Expose

I totally forgot to mention that I was published in the September edition of phpArchitect. Not only that, you can download my article for free. Head on over to https://www.phparch.com/magazine/2015-2/september/ to grab your copy. If you missed my php[world]15 talk, this will get you up to speed.

Categories
howto security talk

php[world] Talks: Migrating Data to D8 / Basic IDS with Expose

I had the privilege to present two talks at php[world]15 this week.

Categories
work

ZCE Complete

I finally got off my rear and took the Zend Certified PHP Engineer test. And Passed. I took the PHP 5 CE test way back in 2007, so I figured it was about time to refresh things. Right before PHP 7.