Ever feel like a deer-in-headlights? This is Preventing Deer In Headlights. (PDIH)
Commercial: New classes:
PDIH TOPIC: PKI implementations of others will cause security problems for your organization.
- Nov 29 (Thursday) 15:30 CEN.
- 25 minutes
- The link to our live meeting.
- Choose Guest & type your name
- If you would like to test your connection lin
A pair of headphones will put all of corporate PKI at risk?
In the current state of cube farms most of us must resort to earbuds or headphones. Top quality headphones like Sennheiser come with software. That’s software connection with our VOIP tools, our conferencing software, generally the headphone software is making sure that software interacts well with their headset. It intercepts some of that communication.
Do we allow users to install software?
Absolutely what’s the big deal it’s just headphones right? WRONG. The software “installed a self-signed root certificate with an easily obtainable private key. Because the key was stored in the operating system’s certificate store and the same key was used on every installation, it was easy for anyone to create their own certificate on a website to look like the original website”
You would think hacking their website wouldn’t be a big deal to us in our enterprise…
“But what made matters worse is that removing the software wouldn’t remove the certificate — leaving them still vulnerable to spoofing and impersonation attacks.”
So how to resolve this?
Solution or STEPS
- Don’t allow end-users to install software.
- If it’s too late for that, The software removal tool will work.
- You must patch the operating systems separately.
Impact on security?
For the future we must review all software for any kind of certificate interaction and test our configurations more thoroughly. Hardware companies are not going to hire security engineers like you to validate their products. They are just got to keep on shoving crap out to your corporate workstation.
This is what we will talk about on Thursday. Come be a part of cybersecurity. Don’t be a deer-in-headlights.
Can’t make it?
If you are a past student, you will have access to the recordings. Links
CPEs – Yesssss!
Most CPE requirements have both a validation step and an audit-able requirement. We do both for our past students. Free. You must login. Use this link ONLY if you are a past student who has been given audit-able access. https://www.vmlt.com/mod/url/view.php?id=14166
I hope you attend – it will be fun.
Commercial– CISSP starts this Saturday January 11, 2019 ; please tell your friends! If you buy this year we will give you a bonus class next year.
To see other start dates you can go to: http://18.207.127.234/calendar/