We are as strong as our weakest link

--Originally published at Allow Yourself to fail and learn… and hack

The Hitchhiker's Guide to information security... according to me!

Achilles, the mythical Greek hero, son of a king and a nymph, invulnerable in every part of his body except the heel… Seriously, the lamest part of the body. But Greeks have something very important to teach us and it’s that there’s always a week spot in something. Even though it may seem unbreakable, unstoppable or impenetrable we’re not looking carefully enough. And it’s when we find that weakness that we now have control. As it is, we are as strong as out weakest link. So we need to be harder, better, faster, stronger when it comes to information security and what will be a better place to start than the network of our organization.

DEFINITION I CHOOSE YOU! Network security refers to any activity that will protect the integrity, availability and consistency (CIA coff coff) of the physical and logical assets from any threats or prevent the breach from…

Ver la entrada original 456 palabras más

My mama said that it was ok

--Originally published at El Machetero Blog´s

IT it´s a common profession in companies, but are IT people aware of all the power that it´s in their hands, and as we all know

One big problem is that contrary to other branches of study in IT it´s not common to take ethical courses, some people don´t even take courses, they´re just self learning people, and there is not a certain guideline or book to know how to proceed in certain cases or if something is bad or not and as a result of this they´re more prone to do something unethical without knowing.

But what lead IT people to do bad things, well the thing is that they have access to if not all, a big part of the company and employees information, and something that may not seem bad could turn out to be so wrong or it wasn´t bad at the beggining, but little by little you start doing other things and end up falling through the slippery slope all the way down to bad things.

What would you do if you see info in an employee computer about him/he selling info about the company, stealing data?

Maybe you notice that the company is doing ilegal things, they may ask you to be quiet about certain topic, or even tell you to do something that it´s unethical. Is it wrong if you do it? Will somebody else do it if you don´t? You could lose your job if you disobey, what would you do in that situation?

The problem lies in all the power they have, with administrator access it´s possible to get into any device in the system, which lead to access to sensitive data, but everyone hopes and trust you won´t do anything stupid, so try not to disappoint them and ask for permission when you

Continue reading →

No dejes que el vecino se conecte a tu red

--Originally published at Héctor H.F. Blog

Hola a todos, he aquí una nueva publicación. Ahora escribiré sobre la seguridad en las redes inalámbricas. Creo que este tema es de interés para todos: para quien está por las calles buscando una red sin contraseña y para quien es propietario de una.

El otro día, por simple curiosidad, entré a la configuración de mi módem Telmex a ver qué encontraba. Allí pude encontrar la lista de todos los dispositivos que alguna vez se conectaron a mi red. La lista era algo larga y en ese momento me pregunté si alguien se estaba “colgando” de nuestra red. Finalmente, tras analizar todos los dispositivos, me percaté que algunos ya aparecían como inactivos, así que probablemente eran dispositivos que ya no usábamos y los que seguían activos eran las computadoras y celulares de la familia, junto con la TV y no recuerdo qué más. Pero me quedé pensando qué pasaría si viviera en una zona más poblada (actualmente en mi cuadra solo tengo tres vecinos), ¿alguien ya se hubiera conectado a mi red?

Lo más probable es que sí. Las contraseñas que vienen por defecto en los módems Telmex son muy sencillas de adivinar. El nombre por defecto del módem (INFINITUM…) y la contraseña siguen cierto patrón, que muchas aplicaciones ya han descifrado. Así que si vives en una zona poblada y jamás has cambiado ni el nombre ni la contraseña del módem, es cuestión de tiempo para que alguien entré sin permiso a tu red. ¿Qué se puede hacer ante esto? Lo de todos mis posts, cambia la contraseña y/o el nombre del módem. No te garantiza al 100% que no podrán entrar, pero al menos sí estás más seguro.

¿Qué pasa si ya hay usuarios no deseados en mi red? Primero, si no estás completamente seguro de que

Continue reading →

The thin line

--Originally published at The Hitchhiker's Guide to information security… according to me!

Allow Yourself to fail and learn... and hack

collaboration post made with the great Edy Gtz

Imagine you’re a super awesome hacker who can access any network, bank account, database and security system in the world. You have so much power in your hands and you can do anything you want with it. What would you doLets just say you’re the Robin Hood kind of guy, you take from the rich and powerful and give to the poor and weak. You take money from the bank account of celebrities and big companies and give it to poor countries or communities that have nothing to eat. You also disclose all of the secret information of all the governments to the public because transparency and freedom of information, right?

giphy

You are the savior of the people, the vox populi, the hero, the nightmare of evil… or so you thought, but the money you gave to the poor was not used…

View original post 533 more words

Safe browsing 101

--Originally published at The Hitchhiker's Guide to information security… according to me!

Allow Yourself to fail and learn... and hack

Collaboration made with edy

Through all the semester we have discussed about the risk we can find on web. The certifications, and methodologies developers can use to provide a more secure ecosystem for their users. And about the different type of hackers we can found out there. There are still so many things to learn and practice related to security on the web.

Since many of the blog posts we have participated on were focused or at least required of certain knowledge on computer security, we want to make this post a friendlier one, a post we can share with anyone, and hopefully prevent people from bad practices online.

Let’s start with the basics:

Be aware that anything shared online is prompted to be shared with anyone. So avoid personal and important information to filtrate just by not sharing it. (no passwords, no personal documents, no card numbers should ever be shared…

View original post 262 more words

Course review #TC2027

--Originally published at Héctor H.F. Blog

A punto de concluir el semestre y todavía algunos posts por publicar. Desde antes de realizar el examen final, ya puedo concluir lo siguiente sobre el curso de Seguridad informática impartido por Ken Bauer:

Me agradó mucho cómo se desarrolló la clase. Me gustó que en varias de nuestras clases hubo invitados (en persona o en línea) que nos relataron un poco sobre lo que es este curso aplicado en la vida laboral. Asímismo, también me gustó que Ken en cada clase pusiera distinto material en el proyector (artículos, videos, blog posts) y propiciara conversaciones entre nosotros sobre temas de seguridad (y algunas veces, de temas completamente ajenos al curso). Mantiene el interés de los alumnos.

También me agradó la idea de ser autodidacta, sin embargo, tras concluir con este curso, siento que varios (incluyéndome) todavía no estamos listos para esto, seguimos necesitando fechas de entrega para hacer las cosas, vamos posponiendo los blog posts porque tenemos tareas de otras clases que sí cuentan con fecha de entrega, las actividades opcionales rara vez las realizamos, los artículos solo los leemos si nos quitan 15 minutos o menos, los videos los observamos si duran menos de 5 minutos, muchos (aquí no me incluyo, pero no estoy atacando a los que lo hacen) faltan a las sesiones porque pueden sobrevivir con los puros blog posts, entre otras cosas. Es una gran idea Flipped Learning, así es el mundo laboral, pero por desgracia creo que seguiremos acostumbrados al modelo tradicional el resto de la carrera.

Y lo reconozco, me encanta este tema de seguridad, pero por algunos de los puntos anteriores, siento que no exploté al máximo las actividades que pude realizar allí.

Así que como sugerencia: mantener Flipped Learning, es una gran idea, pero sí estaría mejor que para próximos semestres de Seguridad informática,

Continue reading →

Protege tu sistema operativo

--Originally published at Héctor H.F. Blog

Hola a todos, aquí un nuevo post. Ahora les hablaré sobre cómo proteger un sistema operativo, independientemente de la marca (aunque contiene ejemplos de Windows). Para esto, copié y pegué un resumen que hice precisamente hace como dos semanas para otra clase (Sistemas operativos), que a su vez resumí de https://www.cs.columbia.edu/~smb/classes/s06-4118/l25.pdf. Algunos conceptos están algo extraños, así que si alguien no sabe a qué me refiero con algo, para eso están los comentarios.

Seguridad es mantener sin autorización entidades de hacer cosas que tú no quieres que hagan. Se puede dividir en confidencialidad, integridad y disponibilidad. Las características internas de un sistema protegen al SO de los usuarios y los permisos de archivo protegen a los usuarios de otros usuarios, pero esto no es suficiente. Los permisos de archivo están basados en la identidad del usuario (autenticación). Para autenticarse, se pueden utilizar contraseñas: es lo más común, lo más sencillo de adivinar, originalmente eran texto plano, pero ahora usualmente están hasheadas.

Las contraseñas hasheadas funcionan de la siguiente manera: guarda f(PW), donde f no es invertible, cuando el usuario ingresa PW, calcula f(PW) y compara. Para protegerse contra ataques de precomputación, asigna un salt al azar durante el cambio de contraseña y guarda (salt, f(PW, salt)). Los que atacan pueden seguir corriendo programas para adivinar contraseñas, por esto la mayoría de los SO usan control de acceso para proteger estas contraseñas hasheadas.

Otro tipo de autenticación es el challenge/response. Pregunta algo al usuario que nadie más sabe. Si el usuario tiene habilidad para el cálculo, lo hace criptográficamente. El servidor conoce PW y envía un número aleatorio N; ambos lados calculan f(PW, N), donde f es algo parecido a un algoritmo de encriptación.

Los tokens son algún tipo de dispositivo, tal vez hacen challenge/response. Los más populares

Continue reading →

Because on the network, no one can hear you scream

--Originally published at (Not so) Random talk

The network can be a Universe of its own. Vast, full of things that are or can be unknown. And just like in Sci-Fi movies, it is plagued with dangers. Hackers, malware, etc. Everything is there. As like in some movies, you need to learn to protect yourself. If not, you might be just like those victims, getting eaten by that unknown thing.

I’ve already mentioned the basics some, if not many times, in the past, but here they come again, plus some new tips in order to browse safely, dearly from me to you:

Update your browser

Everyday thing: Have an antivirus or antimalware and keep it updated too, obviously.

Basic protection: Use firewall if you are not on an expertise level please do not lower firewall. Your computer comes with firewall by default and it helps you filter bad stuff from the web (want to learn more about it read my past post).

Not everything clickable should be clicked: really, just don’t. If something popups, mostly common in not very safe sites, don’t click on it, close it immediately. Those can be gateways for the alien to filter into your spaceship.

Public doesn´t equal good: Don’t go into public open networks without some sort of security, or even better, don’t get on them at all. By doing so, you are probably literally leaving your info in the air for someone to grab it.

Buy smart, buy safe: Just do online shopping from trusted and well recognized sites, preferably using platforms like Paypal.

Free software can come with a price: not all software out there is good, that’s why you should only download / install certified software.

If your browser recommends you against it, don’t insist: Don’t play with fire. If your browser is already doubting on

Resultado de imagen para password 8 characters long meme

Continue reading →

Fix it Felix Jr.! Security network edition!

--Originally published at (Not so) Random talk

Wrecking stuff have always been Ralph’s thing. Ever since his tree stump was moved to the dumpster, he had dedicated himself to wreck the building that was built in his old place. But, whenever Wrack starts wrecking, Felix Jr. has always been there to fix things, thankfully. With his useful hammer, he always fixes the windows and reconstructs the zones Ralph has broken with his big fists. And time and time again, our hero manages to fix everything, get a golden medal, and leave the villain in the mud.

However, times change. And just when Ralph was resigning himself, some interesting trash got into the dumpster. It was lot of information about networking that the Highlanders decided wasn’t important when setting their new networks. And with it, Ralph also learned how to attack this new thing called network. Yes, Wreck it Ralph is now Wrecking the Network! Now in a hurry, Felix had to learn about security networks and dive into the practice of protecting the usability and integrity of your network and data of the Highlanders. Set into this new adventure with Felix, and fix all the things that Ralph has damaged as well as setting up the new multiple layers of defenses on the network.

The way of playing in this game is somewhat different that in the other installment. In each level, you must ensure or do activities that conform network security. Earn a certain number of points to advance to the next level. These activities are:

Wireless Security: set up the wireless security for the Highlanders network, which they used to have on default and Its probably one of the ways in which Ralph accessed the network. To do so in a basic level, change the passwords on the modems of the Highlanders.

Network isolation: divide

Continue reading →

Certifications in Computing Security

--Originally published at Mr. Robot's Imaginary Friend

Credentialing is the process of establishing the qualifications of licensed professionals, organizational members or organizations, and assessing their background and legitimacy.

In the Computer security or Information security fields, there are a number of tracks a professional can take to demonstrate qualifications. Four sources categorizing these, and many other credentials, licenses and certifications, are:

Schools and Universities
“Vendor” sponsored credentials (e.g. Microsoft, Cisco)
Association and Organization sponsored credentials
Governmental (or quasi governmental) body sponsored licenses, certifications and credentials.

Quality and acceptance vary worldwide for IT security credentials, from well-known and high quality examples like a master’s degree in the field from an accredited school, CISSP, and Microsoft certification, to a controversial list of many dozens of lesser known credentials and organizations.

In addition to certification obtained by taking courses and/or passing exams (and in the case of CCSP , demonstrating experience and/or being recommended or given a reference from an existing credential holder), award certificates also are given for winning government, university or industry sponsored competitions, including team competitions and contests.