 |
||
|
|
||
|
||
|
|
Website Security Webinars & PresentationsWhiteHat Webinar: Breaking Browsers: Hacking Auto-CompleteAugust 2010 Did you know a malicious website, laced with JavaScript malware, can steal passwords for other websites stored in Firefox's Password Manager using nothing but garden variety Cross-Site Scripting? How about JavaScript's ability to mine out HTML form auto-complete data in Internet Explorer 6 and 7 (about one-third of the Web)? This hack could be used to reveal a user's first name, last name, aliases, email addresses, physical address, etc. What about forcing Web browsers to evict all of their cookies—thereby automatically logging users out of all their current sessions, delete tracking cookies, and so on? Technically speaking, all of these Web hacking techniques and others are publicly documented, only just not very well-known or advertised. For whatever reason they've been ignored by the browser vendors and Web security researchers. Time to bring them up to the surface. Live demos on display! WhiteHat Webinar: 2010: A Web Hacking Odyssey – If you missed Jeremiah Grossman's presentation at RSA last week, don't miss it again...WhiteHat Security invites you to an encore presentation of "2010: A Web Hacking Odyssey - The Top Ten Hacks of the Year." Every year, powerful new Web hacking techniques are revealed, many of which are highly sophisticated and esoteric. Staying up-to-date on these threats is a full-time job. This session separates the best from the rest and selects the top ten to cover in technical detail. The session will explore how Web security is impacted, the business risks posed and which are likely to be used maliciously. WhiteHat & Aspect Webinar: A Real World Application Security Success StoryFebruary 2010
Jeremiah Grossman, Founder and CTO of WhiteHat Security and Jeff Williams, CEO of Aspect Security will review a real company with an application security crisis. This company faced serious business hurdles and needed to get the problem solved in a hurry. WhiteHat quickly identified the most critical problems needing to be fixed and got the organization focused; Aspect helped eliminate these flaws quickly and established a program for managing application security across their portfolio. The process and results were nothing short of a roadmap that other organizations may follow. Aspect Security & WhiteHat Security have joined forces to provide organizations the solution they need to build more secure Web applications and create a sound risk management program. The on-demand assessment capabilities of WhiteHat Sentinel enable Aspect Security consultants to manage vulnerability analysis across a large portfolio of Web applications while developing a custom program to eliminate flaws from being introduced early in the software development life-cycle. Join Aspect Security and WhiteHat Security in an informative webinar to learn more about this unique partnership and how it can help you and your environment. WhiteHat Webinar – 10 Steps to Prevent a SQL Injection AttackFebruary 2010 With data theft becoming so common that the price of a stolen credit card number on the black market has come down from $10 in 2006 to just a few pennies in 2009. Very recently, Verizon did a study of over 600 incidents in the past 5 years and found that the single largest attack vector responsible for data theft is a SQL injection attack. In this 30 minute presentation, Anurag Agarwal, Director of Education Services, will show you how easy it is to perform a SQL injection attack which would allow an attacker to profile your database, run an OS command or even remotely backup your entire database by exploiting certain vulnerable fields. This presentation will show you how to test whether your application is vulnerable to a SQL injection attack and how it can easily be fixed by your developers. In conclusion, Anurag will walk you through the 10 steps needed to prevent your applications from being vulnerable to SQL injection attacks. These 10 steps are not just for the developers but for database administrators as well. How to Keep Hackers on Ice While Your Code is FrozenDecember 2009 Join Jeremiah Grossman, founder and CTO of WhiteHat Security and Brian Contos, Chief Security Strategist for Imperva for an interactive presentation that leverages live audience feedback, expert insight and end-user experience to illustrate the most effective methods for combating Web application abuse and fraud. Every organization has periods of time where IT assets are frozen and modifications (i.e. patching or code changes) are restricted. In fact, with the holiday shopping season in full swing, your company may be under a code freeze right now. While the development team must remain hands-off at this time, scores of hackers and fraud-artists – both external and internal – remain hyper-active in their efforts to exploit any application security vulnerabilities. This educational webinar will explore the security risks that accompany a code freeze and will offer real world examples of organizations that have mitigated those risks through proven web application security and vulnerability assessment solutions that allow your code to remain frozen and keeps dangerous hackers on ice. Topics covered during the webinar will include:
WhiteHat Webinar – Website Statistics ReportNovember 2009 Hear WhiteHat Security Founder and CTO, Jeremiah Grossman present findings from the eighth installment of the WhiteHat Web Application Security Statistics Report on November 12th. The WhiteHat Website Security Statistics Report provides a one-of-a-kind perspective on the state of website security and the issues that organizations must address to avert attack. This report presents a statistical picture of current website vulnerabilities, accompanied by WhiteHat expert analysis and recommendations. In this webinar you will learn more about these key findings and more: * 83% of websites have had at least one serious vulnerability Web Hacking: Tricks of the Trade October, 2009 This one hour session will reveal why website vulnerabilities present such a big threat to organizations and how easy it can be to hack into a website. Anurag Agarwal, Director, Education Services, WhiteHat Security will demonstrate how a small error message can allow a hacker to control a website and steal all the credit card numbers in a matter of minutes. Anurag will also highlight real life case studies on how some of the global 500's websites were hacked. This interactive session will be an eye opener for developers and security executives building a website risk management program. In this webinar you will learn:
How to Jump-Start Your Application Security Knowledge: For the Network Security Guy Who Knows Nothing about Application Security Most security officers are not software developers, and rarely do they have control over the security associated with internally developed software systems. However, CSO's are still frequently held accountable when externally-facing software is compromised and a breach occurs. Unless security professionals radically upgrade their knowledge of software and software development techniques, they will continue to inadequately manage the risk that custom software systems represents to the enterprise. Presented by John Dickson of Denim Group and Jeremiah Grossman of WhiteHat Security, this webinar will help non-development security managers understand the salient aspects of the software development process and to upgrade their IQ on software. It will help them to identify risks with different assessment approaches, how to inject themselves into the development process at key "waypoints," and to understand ways to influence development peers to write more secure code. Security Religions and Risk Windows Information security threats are way up, fraud losses continue to rise, regulatory fines are increasingly common, and budgeted dollars to solve these myriad of problems are in short supply. Hampered by a sluggish economy, organizations simply cannot afford to hire all the talent they need, implement every best-practice, or buy every blinking light widget out there. Sacrifices are unavoidable, risk must be managed. Each organization must decide for themselves the level of risk they are willing to accept. Together WhiteHat and Imperva provide a multi-layered approach to website protection and data security featuring the industry’s leading website vulnerability management solutions and Web Application Firewall (WAF) to create a robust website risk management security strategy. Mo' Money Mo' Problems – Making A LOT More Money on the Web Hear WhiteHat Security Founder and CTO, Jeremiah Grossman, present his sequel to the much acclaimed Get Rich or Die Trying presentation. Many people still mistakenly believe profiting illicitly or causing serious damage on the Web requires elite, ninja-level hacking skills. Nothing could be further from the truth. In fact, given the ever-increasing complexity of Web technology, using sophisticated vulnerability scanners can make the monetization process more difficult, noisy, and arguably less lucrative. While scanners and code reviews can lend themselves to identifying SQL Injection and Cross-Site Scripting, which can lead to significant harm and financial loss, so too can the issues they consistently miss – business logic flaws. Business logic flaws, or an oversight in the way a system is designed to work or can be made to work, is one that typically can be gamed in low-tech ways. In the real world, these attacks have lead to between four and nine-figure paydays with nothing more than basic analytical skills required. Furthermore these are attacks that Intrusion Detection Systems (IDS) will miss, Web application firewalls can't block, and Web application vulnerability scanners fail to identify. Attacks so subtle that most organizations will not know they've been hit until a financial audit uncovers a discrepancy, they receive angry customer calls, or when they become headline news. WhiteHat/Imperva Webinar: The Web Attack Defense Playbook: The Target: Highly sensitive (and valuable) corporate and customer data accessible through a website.
Spring 2009 – 7th Edition – Website Security Statistics Report There is a difference between what is possible and what is probable, something we often lose sight of in the world of information security. For example, a vulnerability represents a possible way for an attacker to exploit an asset, but remember not all vulnerabilities are created equal. Obviously we must also keep in mind that just because a vulnerability exists does not necessarily mean it will be exploited, or indicate by whom or to what extent. Clearly, many vulnerabilities are very serious leaving the door open to compromise of sensitive information, financial loss, brand damage, violation of industry regulations, and downtime. Some vulnerabilities are more difficult to exploit than others and therefore attract different attackers. Autonomous worms & viruses may attack one type of issue, while a sentient targeted attacker may prefer another path. Better understanding of these factors enables us to make informed business decisions about website risk management and what is probable. Q1 2009 Key Findings
Fourth Quarter 2008 Website Security Statistics The WhiteHat Website Security Statistics Report provides a one-of-a-kind perspective on the state of website security and the issues that organizations must address to avert attack. WhiteHat has been publishing the report, which highlights the top ten vulnerabilities, vertical market trends and new attack vectors, since 2006. The WhiteHat report presents a statistical picture of current website vulnerabilities, accompanied by WhiteHat expert analysis and recommendations. WhiteHat’s report is the only one in the industry to focus solely on unknown vulnerabilities in custom Web applications, code unique to an organization, within real-world websites. Strategically Blocking Cross-Site Scripting & SQL Injection Attacks F5 Networks and Whitehat Security present a revolutionary new solution that closes the loop from Web application vulnerability detection to remediation – an integrated solution delivering TOTAL website security. The F5 Networks and WhiteHat Security technology partnership gives security professionals a uniquely powerful and efficient system to combat the onslaught of website attacks that place customer and corporate data at risk. The combination of WhiteHat Sentinel website vulnerability management solution and F5 BIG-IP® Application Security Manager (ASM) delivers a new level of website protection – with extreme accuracy, efficiency and control. Join Jeremiah Grossman, Founder and CTO, WhiteHat Security and Lori MacVittie, Technical Marketing Manager, F5 Networks as they offer a look at a technology breakthrough that:
Lowering WebApp Sec Total Cost of Ownership (TCO) Let's face it: Website security is critical and complex. With budgets under greater scrutiny, how do you get the most out of your security team and budget, and still have secure, functioning Web applications? Can it be done cheaply without cutting too many corners and placing your organization at risk? Tools can’t replace expertise; and the soft costs are surprisingly high. Is there a cheaper alternative to consultants without sacrificing accuracy? Learn how to take control of your website security. From a discussion of where teams lose time and waste resources, how to streamline risk measurement and management activities, as well as eliminating resource drains like one-off reports and babysitting auditors. Here's what you can expect to learn:
Afterwards, Mark Meyer, WhiteHat Security Director, will provide a review of WhiteHat Security's Sentinel Service. Developer Training - The Missing Link in the Web Application Security LifeCycle with Anna Sherony from Sammons Financial Group In this webinar, you will learn how Anna Sherony, Privacy and Information Protection Officer at Sammons Financial Group, used WhiteHat Security to successfully address her Web application security needs. She invested in her team with Web developer training from WhiteHat Security and incorporated WhiteHat Sentinel to secure her Web applications. WhiteHat Security's training helped Sammons Financial Group: 1. Train developers on the latest Web application vulnerabilities Afterwards, Anurag Anarwal, WhiteHat Security Director of Education Services, will provide a review of WhiteHat Security's education offerings. Get Rich or Die Trying - Making Money on the Web, The Black Hat Way WhiteHat Security founder and CTO, Jeremiah Grossman, will repeat his Black Hat presentation: Get Rich or Die Trying - Making Money on the Web, The Black Hat Way. Nows your chance if you missed it at the Black Hat Briefings in August or you just want to hear it again. Forget Cross-Site Scripting. Forget SQL Injection. If you want to make some serious cash on the Web silently and surreptitiously, you don’t need them. You also don’t need noisy scanners, sophisticated proxies, 0-days, or ninja level reverse engineering skills -- all you need is a Web browser, a clue on what to look for, and a few black hat tricks. Generating affiliate advertising revenue from the Website traffic of others, trade stock using corporation information passively gleaned, inhibit the online purchase of sought after items creating artificial scarcity, and so much more. Activities not technically illegal, only violating terms of service. You may have heard these referred to as business logic flaws, but that name really doesn’t do them justice. These are not the same ol’ Web hacker attack techniques everyone is familiar with, but the one staring you in the face and missed because gaming a system and making money this way couldn’t be that simple. Plus IDS can’t detect them and Web application firewalls can’t block them. In fact, these types of attacks are so hard to detect (if anyone is actually trying) we aren’t even sure how widespread their use actually is. Time to pull back the cover and expose what’s possible.
|
Power Point Presentations Available for Download Get Rich or Die Trying Top Ten Web Hacking Techniques Archived Webinars from 2008 WhiteHat Website Security Statistics Report August 2008 PCI Compliance Website Security Statistics Report SaaS as a Service Archived Webinars from 2007 Industry Roundtable Webinar Business Logic Flaws Webinar Hacking Intranet Websites from the Cross Site Request Forgery |
|
|
||
|
Website Risk Management | Sentinel Services | Support Plus | Education Services | Events & News |
Resources |
Partners |
About WhiteHat 2010 © Copyright | WhiteHat Security | 3003 Bunker Hill Lane, Santa Clara, CA 95054 | 408.343.8300 | Contact the Webmaster |
||
Organizations are desperate for effective guidance on the best ways to introduce and manage Web application security within their software development life-cycle. Success comes by learning the techniques on how to quickly and efficiently fix immediate issues and implement incremental long-term changes that are neither expensive nor disruptive to the software development process. There is no better way to learn that than through a genuine case-study walk through.