How VA Tools Work?

Vulnerability Assessment tools assist us in finding weaknesses in a system before they can be exploited. A Vulnerability Assessment tool takes the following steps in determining vulnerabilities:

• Discovering – Sends ICMP requests and probes ports to see if the system is up and running, additionally checks if the system is behind a firewall or a filtering device
• Port Mapping – Probes UDP and TCP ports to see which ports are open and accepting connections
• OS fingerprinting – Detects what OS is running on the target system
• Service Mapping – Sends different probes to see which services are running on open ports
• Vulnerability Mapping – Based on the identified services, it tries to find out the vulnerabilities associated with them

There are many Vulnerability Assessment tools available — NeXpose, Nessus and QualysGuard being the few which scan the whole infrastructure including web applications. While, there are some dedicated tools for only web application scanning (dynamic analysis) like AppScan Standard, WebInspect, Burp Suite and Acunetix. Similarly, there are dedicated tools for automated source code review (static analysis) like AppScan Source, Fortify and Veracode.

Alongside finding weaknesses, Vulnerability Assessment tools also provide remediation techniques for eradicating or patching the weakness.

Starting Information Security Career?

A lot of people ask me every now and then on how to start a career in information security? These people range from young graduates to mid-level professionals and to even manger level professionals. So, I thought of writing a blog post that would help hundreds of these knowledge pursuers and career changers to effectively enter the rich and broad field of information security. The post has been made from the perspective of service providers (joining one is the best way to learn ins and outs of information security!).

To keep it very simple, there are two major domains in information security field:

1) Technical
2) Managerial

In technical domain of information security, as the name suggests, almost all the work is technical. You (can) work on technical solutions and services either in R&D, pre-sales, post-sales, training and or support. Each of these are explained as follows:

• R&D: You find out how different technologies work and gain expertise on them in your test environment (to start with). Or, you develop a technology solution or service or training of your own that helps protect organizations in their security goals and endeavors. 
• Pre-Sales: You face customers! You pitch them your solutions and services. The pitching can range from presentations to demos to PoCs to running pilots to drafting RFP to complying with them (the requirements) via RFP response to designing BoQ. The majority of selling happens here! 
• Post-Sales: Once the pre-sales ends successfully -- the post-sales phase kicks-in. In this phase, you implement and deploy solutions for the customer or provide services as per the defined scope and acknowledged project plan. The major component of this phase is helping customers in designing, configuring and implementing the solution or service in a way that benefits them the most.   
• Training: The trainings can be product based or product independent and focusing on developing a particular skill. Usually, once the solution or service has been successfully implemented -- the customers desire to have a hands-on training to enable their resources to ensure they are able to handle daily routine operations associated with the solution or service. That is one aspect of training. Training can also be provided independently as well to enable customer resources to perform a particular area of their job (for example, incident response, malware analysis etc.) effectively. There are a lot of training bodies as well (EC-Council, (ISC)2, ISACA, etc.) -- delivering their trainings can be quite product financially and a lot of solution / service providers do this and have dedicated training teams and departments. 
• Support: Support is an essential part of solution and service selling. Support ensures that business flow is continuous and customer retention is effectively 100%. In support phase, customers are able to get their issues fixed (via support engineers) swiftly in the solution they have deployed or the service that is being used.        

In order to be able to perform any of the above activities (or the activities associated to the phase of your interest) -- you need to have good technical research, knowledge acquiring and knowledge transferring skills. Often, technical people think -- they do not need to work on their soft-skills -- assumptions like that are very wrong. Good soft skills are a must for any information security professional and are very essential for growth!  

Now, coming to the second major domain of information security; the managerial part of information security encompasses security management practices varying from policy development, risk management, compliance assurance to process optimization, standards' implementation, suggesting controls, ensuring they are implemented and reviewing their effectiveness.

The managerial domain is more focused on people and processes and is interlinked with technical domain via use of technology. Managerial domain aligns information security with business goals of the organization and frequently takes into account ROI while reducing the risk at the same time. Different ISMS standards like ISO 2700x and BCM standards like ISO 22301 / 22313 come directly under managerial domain of information security.  

My recommendation for entering in information security has always been to start from technical domain, get a feeling of working in information security and then choose where you want to go. If you want to stay on technical side, following are some of the fields:

• Work with security related solutions like endpoint security, vulnerability assessment, security information and event management, identity and access management, data leakage prevention, two-factor authentication, database security, web application firewalls, next generation infrastructure firewalls, IPS, IDS, advanced threat detection solutions and so on. 
• Work with security related services like vulnerability / threat assessment, penetration testing, network design review, source code review, digital forensics, incident response, malware analysis / reverse engineering and so on.
• Work with security related trainings to enhance skill of knowledge-seekers. Apart from trainings or courses offered by governing bodes -- trainings can range from integrating secure software development lifecycle to performing black-box / white-box penetration tests to performing incident response or doing malware analysis and so on.   

My other recommendation particularly for young graduates is to work with IT technologies first; get a good understanding of how stuff works, go in-depth and gain expertise of implementing them. Once, that is done -- you are in very good position to be able to either circumvent or protect these technologies and information systems. Changing role from implementing a technology to protecting becomes easy, this way. For a technical information security professional, high paced research and gaining quick knowledge of technologies is key to success alongside good soft-skills. 

Working in a technical domain for starting career in information security helps a lot in understanding intrinsic technologies and how can they be vulnerable (to attacks) and putting the right controls to keep them protected effectively and efficiently. This path also helps in entering managerial domains without much effort -- all you need to do is study ISMS or BCM standards and develop an understanding of performing thorough risk management or business impact assessment. Once you have developed a good understanding of how different standards work and can be implemented -- you are ready to work as Consultant for firms that want to implement or have their ISMS reviewed. 

The key skills generally needed to become an information security professional are as follows: 

• Focused research 
• Persistence and hard work
• Communication (both oral and written)
• People skills

The top certifications to transform your career in information security are as follows: 

• CEH or CPTE (technical)
• CHFI or CDFE (technical)
• OSCP (technical)
• CISSP (managerial)
• ISO 270001 Lead Implementer / Auditor (managerial) 
• BCI certifications (mostly managerial) 

I hope the information presented in this post would assist immensely in choosing information security as your career path. In case, you want to discuss this further -- please feel free to reach out to me on wajahatrajab[@]gmail[.]com.

Growth Mindset vs. Fixed Mindset

Do you like going out of your comforts every now and then?
Do you like developing new skills and improving existing ones?
Do you like changing yourself for the better?

If yes, you have a growth mindset. If not, you have a fixed mindset. People with fixed mindset are prone to staying average -- whereas, people with growth mindset keep on pushing their average skills to grow further and further.

Following are some of the facts about people with growth mindset and people with fixed mindset:

• For a growth mindset, success is the "process" of pushing themselves to achieve goals. Whereas, for a fixed mindset, success is "proving" themselves to others. 
• People with growth mindset have the ability to stay innovative by taking constant inputs, analysis and criticism to further improve what they do. While, people with fixed mindset want to stick with what they know the best and what they are good at without giving much emphasis to good input, analysis and criticism. 
• People with growth mindset do mistakes, learn from them and improve -- while, people with fixed mindset do mistakes and quit. 
• People with growth mindset are explorers of new ventures -- whereas, people with fixed mindset are stuck in their comfort zones. 

To conclude, everything is in a constant flow -- that is how life works. Getting stuck in your brick-wall and not climbing it or pushing yourself to cross it, takes the life out of you. 

How to make SIEM PoC effective?

Here is how you can make the SIEM PoC effective: 

1) List down the existing issues that need to be resolved 
2) List down the potential issues that could happen 
3) Ask for use case implementation for #1 and #2 
4) Observe the effectiveness of the solution as per your environment 
5) Observe usability, scalability and feature-set being offered 
6) Observe the skill level of the service provider / vendor 
7) Grade based on #3, #4, #5, #6 

Additionally, you may ask the following questions to your vendor to warm them up a little: 

1) Time it would take to go from installation to actual threat or security insights? 
2) Dedicated members or consultants needed to keep the solution up and inter-operable? 
3) Does the proposed solution provide alerts and provide step-by-step remediation? 
4) What if we don't have technologies in place that are needed to feed the SIEM?

Best Data Recovery Tools

I recently faced an interesting challenge of recovering data from my 1TB portable external storage device. The device's MBR somehow malfunctioned and I was left with almost 700GB of raw data. As per Windows, the only option to access the storage device was to format it but before doing that I wanted to recover the data first!

I majorly used the following tools for recovery:

• Easeus Data Recovery
• Recuva
• TestDisk

As per my experience:

• Easeus was the fastest tool to recover data
• Recuva was the fastest tool in detecting data on the malfunctioned device
• TestDisk was the best tool in recovering data that both Easeus and Recuva tools were unable to find

Inguinal Hernia Surgery

To have surgery or not is same as to marry or not...

I am going to jot down my experience related to the recent surgery experience I had for right inguinal hernia. Interestingly, my hernia was congenital (or that is what the doctor said) and appeared quite late in life (though I am still sweet 16! *winks*).

To ensure readiness for the surgery - I had all the needed routine blood tests and even had an Ultra Sound for abdomen and lower abdomen to ensure if it really was hernia. Blood tests came back positive and Ultra Sound revealed hernia and nothing else. Yes, the medical technology helps.

So, I was okay and ready for surgery (the first-times really are memorable! No?). :)

March 22, 2014

The open surgery was scheduled for March 22, 2014 at 7 PM. I was pretty upbeat for the challenge and had only green tea and boiled egg around 10 AM and nothing else. Felt pretty hungry through-out the day but you have to follow the doctor's advice no matter what!

I reached the hospital around 3 PM and was escorted to a quiet room for (ever so needed) rest before the surgery. Blood pressure was checked -- which was below normal level (because of the lack of food in my system), but not of much concern.

Around 6 PM, a cannula was inserted into my right hand for series of injections and drips that were going to be passed onto the body. A drip was given, soon afterwards, albeit which flowed slowly but seemed to provide good deal of energy.

As soon the clock struck 7 PM, I was taken into the Operation Theater (OT sounds much better!). A spinal anesthesia was given which made my lower body senseless. The surgery began and was pretty much painless throughout, however, I did feel some pain in the left kidney while the Surgeon was doing his business. I complained a little but he assured that was normal and it would be fine in a little while (and, yes he was right -- the pain went away in couple of minutes). The drip flow was increased as soon as the surgery started and the bottle was empty within 30 minutes (I felt like superman! But without the sensation in lower body, ha!).

Because of the nature of congenital hernia (or the surgeon's expertise) - I was out of the Operation Theater in about roughly 40-45 minutes. My lower body was pretty numb and remained so for the next couple of hours.

Around 10 PM, when the anesthesia wore off, I started to feel excruciating pain and it increasingly became unbearable with each passing minute. I was given three to four injections from the cannula to calm down the pain for the night. The injections made the pain bearable and soon afterwards, I was given another drip for the night to keep the body energized. The doctor advised not to eat anything until 6 AM in the morning.

I tried to get some sleep and was quickly driven to the land of dreams.

March 23, 2014

After couple hour sleep -- I was awake again (this time to get the taste of after-shocks of surgery!). A little lower body movement resulted in increased pain even laughing (yes, when you have cousins with you, this can happen!) intensified the pain. So, I soon realized -- less talking the better (the life mantra of sages!). The pain was manageable till 1 AM and started to increase slowly but surely.

When the clock struck 3 AM, the pain became unbearable and I asked the nurse for pain relieving injections. She was only authorized to give one injection and injected it directly into the drip which had a slow flow, again. The pain did not recede and needed a doctor's intervention to calm it down.

Around 6 AM, I called for a doctor, who after assessing the situation, gave me four injections (three went in through the cannula) and one directly into the shoulder. The flow of drip was increased as well and the bottle emptied in 15 minutes. The pain decreased considerably and I was ready to have my first walk after the surgery. The getting up part from the bed, with assistance, was intense. After painful couple of minutes, I was on my legs and started to take little steps. I took this opportunity and went to the toilet as well -- all went well there.

After taking a little more slow steps, I went to bed and slept till 9 AM. When I woke up, I was feeling a lot better. The pain was there but it was manageable. The doctor came around 10 AM and advised to start taking liquid -- which I obliged by taking juice instantly. Afterwards, I slept till 1 PM. When, I woke up, I got up from the bed, this time myself, and took little steps and went to the toilet as well. I walked a little more and with little assistance sat down on a chair, took more juice and went to bed - when the pain started to hurt a little more.

At 2 PM, I was given the regular dose of injections to control the pain. Soon afterwards, I went to sleep and woke up at 4 PM. I took some green tea, which felt refreshing and stayed on the bed to keep the pain minimal. Around 9 PM, I got up from the bed, with some assistance, went to wash-room. I had first bowel movement and thankfully it was without any pain. At 10 PM, I had simple liquid soup as dinner. A routine dose of four injections were given and I slept around 11 PM.

March 24, 2014

I woke up at 3 AM, the pain was manageable, and went to toilet without any assistance, thankfully, all went fine there. Afterwards, I sat on a chair for couple of minutes and then went to bed again. The sleep was peaceful and woke up feeling more healthy around 7 AM. I took juice as breakfast and did a little walk around my room as well. Routine dose of injections was given at 10 AM and doctor was ready to have me discharged. The cannula was removed and I was advised to remain on liquid food till next routine doctor check-up scheduled for March 27, 2014 for bandage change.

I reached home around 1 PM - the day went a bit uncomfortable because of change of environment. I was given pain killers and infection related tablets to keep everything in check.

March 25, 2014

I was almost back to my normal self but with restricted movement.

March 26, 2014

I started increasing my movements -- still took anti-biotics and pain-killers to stay safe.

March 27, 2014

Doctor advised to start taking normal food. That was a new well-taken!

After taking real food -- I was almost back to normalcy. In a week time -- the bandage was removed and I re-joined office again!

To conclude, the surgery was not that bad for an experience. :) 

Plugged In, Not Charging - Solution

I have seen this error message a lot in laptops of all brands and sizes.

More than often the problem is with the battery related drivers than the hardware itself.

Here is the solution that works absolutely 100% of the times:

1. Right click on 'My Computer'
2. Go to 'Properties'
3. Click 'Device Manager'
4. Click the '+' sign on the 'Batteries'
5. Delete all instances of 'Microsoft ACPI-Compliant Control Method Battery'
6. Restart the laptop
7. Log-in
8. The status of battery now would be 'plugged in, charging'!