With the aim of shielding up your cyber security and getting to know the latest threats and how to defend against them, the USCS ISACA Students Group carried out the ICS Cyber Security Meetup and Codelab. Held on the 3rd of September 2017 at the University of Colombo School of Computing, the entire event was divided into two sessions. The first session commenced at 9AM and was open to all students interested in cybersecurity. The session was a Codelab organized by WSO2 where participants were brought up to date with the latest in cybersecurity. In addition, the participants were also given several test cases of real life scenarios to develop their own solutions.
During the afternoon, the session broke for lunch. Following that, the second half of the event took place. This was the Cybersecurity meetup. The session boasted a total of 100 participants from the University of Colombo School of Computing along with students from other state and private Universities as well. The session kicked off with the traditional lighting of the oil lamp. With that we were ready to start the proceedings of the second session.
Dr. Rasika Dayarathna of the UCSC ISACA Student Group was up on stage to deliver the welcome address. He thanked all those attending and explained about the concepts behind a meetup of this nature. Being the first of its kind, Dr. Rasika also explained that the fact that the event was held on a weekend is highly appreciative given the bus schedules of students. He also gave a brief background about the UCSC and also the ISACA.
Next up was Kumar Manthri – President of ISACA Sri Lanka Chapter. He spoke about the current threats in relation to cybersecurity and encouraged and emphasized we should never let our guard down, but rather, to be constantly vigilant about threats and take the necessary steps to protect our data. He also spoke about the steps taken by ISACA when it comes to creating trained cybersecurity professionals and also professionals related to these fields.
Following this was an address by Niroshan Balasooriya, Senior HR Manager at ISM APAC. He spoke about ISM APAC and what they do such as how to improve the business process. It is a difficult task to improve these processes as they are usually fixed. But that’s where they focus on how to get businesses to improve their process. He encouraged those attending to be a unique resource. It’s not just about the degree, it’s about having a unique vision or goal to achieve.
The Tech Talk session for the ICS Cyber Security Meetup officially began
Wasantha Perera was up first
Wasantha, the CEO and Founder of CryptoGen spoke to the audience on the evolution of cybersecurity. By the year 202, the Worldwide Cybersecurity spending would increase to $ 170 Billion. He also noted that Cybersecurity has a serious talent shortage. His examples ranged from IoT to smart toilets being hijacked and even the hacking of airplanes and Air Traffic Controllers. The next victim would be smart devices related to medical health. These are all the face of cybersecurity.
He then spoke about Ransomware, especially ones such as WannaCry and Petya. It’s not only about these, though. You can even use cyberattacks such as a ransomware to hack into buildings. As an example he spoke about a ransomware that locked guests out of their hotel room. Interestingly, insider threats are the highest rated threat to a company’s cybersecurity. He also spoke about the reasons for worker shortage by region. A serious issue here is brain drain, where these professionals migrate to other countries.
He then moved on to a case study of the Bangladesh Bank Heist in 2016. His reason for this was for the participants to find themselves a niche in cybersecurity. Throughout the case study, Wasantha spoke about topics such as Threat identification, threat intelligence, and how to inform those affected about threats. He spoke about a simple framework to follow. This includes reducing the threat surface, preventing known attacks. With his final topic revolving around the future of Cybersecurity education, Wasantha’s session came to an end.
During the refreshment break students and participants were encouraged to take part in a “selfie” contest. Here, all they had to do was to take a selfie against an artwork backdrop created especially for the event and then post the selfie on social media. The selfie with the most amount of likes and shares would win an interesting prize.
Following the break, we had Uditha Wijesundara
Uditha, the IT Director at ISM eGroup spoke to the audience on cloud computing and cloud computing security. He gave the audience an introduction to the cloud, how data centers operate and some of the key players in the cloud industry such as Microsoft, Amazon and Google.
“Why should we move to the cloud?” That was his first question. We all use the cloud. But what makes us use it? He spoke about models such as IaaS to host a service, PaaS to build a service and SaaS to consume the service. ISM primarily uses the cloud for PaaS. They have full control of the service and can dictate what gets installed. He then spoke about the responsibilities of each model, of which the key is privacy. This is where the RACL comes into play.
According to Uditha, the top cloud computing threats are divided into three categories: external, internal and technology. The reason of cybercrimes to increase is purely because of the financial market. People know that they can gain money from hacking or stealing information. They are basically indiscriminate and they are also constantly evolving. The threats you find today will evolve and take on a new form tomorrow. These threats include social engineering, phishing, pharming, password cracking, botnets, and even Zero day attacks, all of which he explained in depth and detail. The biggest concerns of customers who move to the cloud is that they lose control of who has access to their data. The next concern is the integration with existing infrastructure.
He then spoke about the top security benefits in cloud computing. For example, security is a top priority for providers. Scalability is the next practical challenge and what customers expect. It also has to be cost effective. The next benefit is timely and effective updates. Updates can be rolled out rapidly across a homogeneous platform. The next point is for Audit and evidence. In case of an investigation, there would be less downtime for forensic investigations and also you can provide forensic images of virtual machines.
He then spoke about the challenges to cloud and cloud computing. According to Uditha, the concept of BYOB or Bring Your Own Device is the biggest challenge to the cloud. This makes it quite difficult to control as you don’t exactly know where your data is. Despite there being a cost reduction in you working with your device, there is also an equally present security challenge. You can have technology adoption, but that also presents a lack of IT control. In conclusion, Uditha emphasized that we should be creative, have an open mind, and also have certifications for guidelines. He also encouraged us to check ourselves online.
The third tech talk for the evening was by Anuradha Ratnaweera
Anuradha’s topic for the evening was Network Offence and Defense. Rather than give a lengthy lecture, Anuradha’s session revolved around a number of real life experiences that he faced and how he overcame them and the principles he used to do so. His first example was the log of an Redhat server where someone tried t guess the username and password. His first solution was to ban the IP of the system that tried to login after it tried to login multiple times within a short period of time. Banning can be on a number of levels. You can choose to reject a packet, or simply drop a packet.
This also raises a number of problems. For example, if you’re the user and you can’t remember your username and/or password, you could risk getting banned yourself. This can also happen with shared IPs. But this is not an issue for us. The next solution was to use a tool called GeoIP. This tool allows you to give access to IP addresses only from certain countries and cities to connect. Anuradha then spoke about terms such as SSL ciphers, the difference between HTTP and HTTPS, and which ones you can and cannot use. He also spoke about terms such as HSTS, OSCP Stapling and forward secrecy. All of these are to show you that converting a website from HTTP to HTTPS is by no means a walk in the park.
In order to handle security, we should be prepared and ready for everything. But that’s easier said than done. Clients and developers are more sensitive to actual incidents than hypothetical future threats. This is where ethical hackers come into play. In addition, awareness and good practices is the best defense. In summary, Anuradha’s points were to pay attention to the details, and to keep up with the latest developments to stay ahead of the game.
The last tech talk was by Christopher Steward speaking on a moneymaking topic
His topic? Bitcoins and Blockchains, from a security perspective. Cryptocurrency such as Bitcoins are a paradigm shift. Rather than being just a technology, it’s a new type of currency that will change how we do business, trade and more importantly, trust. Where traditional trade requires intermediaries, Bitcoin decentralizes this. Unlike Paypal, who dictates online transactions, Bitcoins have no central control. It also allows you to have total or greater anonymity. No one knows who owns the bitcoin. Rather than saving your name, it saves your public key as a means of identification. He then spoke about the security concepts in Bitcoin such as Hash functions. Hash functions should be collision free. This means for two different inputs, it cannot have the same outputs. It should also be puzzle friendly. He then spoke on Digital signatures and public keys as identities.
Bitcoins will use digital signatures to authenticate/verify transactions. These signatures will be different per every transaction carried out. A public key would be your address. Rather than checking your balance, ownership of funds is maintained through links to previous transactions. This is where the trust element comes into play. If you want to create a smaller bitcoin, you need to first destroy the existing bitcoin to go forward. If you lose your public key, all your transactions are lost. Christopher then spoke about terms such as Distributed consensus, bitcoin mining and the privacy in bitcoins. He also spoke about the pros and cons of Bitcoins. With that, Christopher’s session came to an end.
With the award being handed out the best selfie and the vote of thanks being delivered, the first ever Cyber Security Meetup and Codelab came to an end.