Upcoming Events
Total Page：16
File Type：pdf, Size：1020Kb
WWW.ISSA - COS.ORG VOLUME 6 NUMBER 9 SEPTEMBER 2017 Upcoming Events olleagues, It’s time to look forward now, to our The 7th Annual Cybersecurity upcoming events. Our next Chapter C Training & Technology Forum Membership meetings are on 13 (dinner) (CSTTF) was a huge success! Thank and 14 (lunch) September, at Catalyst you to everyone! Events like this require Campus. And on 16 September we’ll support from a lot of people, and I'm have our next Mini-Seminar at pleased to say we had CollegeAmerica from 9am to noon. some exceptional Remember, you can get volunteers help in many three hours of different areas. Your A Note From continuing education by help is greatly appreciat- attending one of these ed! Mini-Seminars, as well Our President as network with your We also held a peers. Watch for details “Women in Security” on these events on our networking/social event website and via emails. in the evening on 30 We’re also plan- Aug, after the first day of the CSTTF. This was an ning a Networking initial/kick-off meeting to Event, to be held at the discuss the possibility of Warehouse Restaurant, forming a group to focus By Ms. Colleen Murphy on 5 October. We’ll get and encourage women more details out on it as to pursue cybersecurity or cybersecurity- soon as possible, but please mark your related fields. We’re off to a great start, calendars now for this networking/social with numerous women signed up to par- event. Watch for more info about this ticipate. If you’d like to be added to this event on our website and via emails. group, or think you might like to join it, Thank you all for your continued please let me know. Our next meeting is engagement and support – of the 2017 tentatively planned for late October. Chapter of the Year!!! Watch for more info on it as we deter- mine date/location/time of the meeting. Colleen The ISSA Colorado Springs Newsletter incorporates open source news articles in compli- ance with USC Title 17, Section 107, Paragraph a (slightly truncated to avoid copyright in- fringement) as a training method to educate readers on security matters . The views expressed in articles obtained from public sources within this newsletter do not necessarily reflect those of ISSA, this Chapter or its leadership. P A G E 2 Watch A Homemade Robot Crack A Safe In Just 15 Minutes By Alan Greenberg, Wired, July 21, 2017 components including a coupler that attaches to LAST CHRISTMAS, NATHAN Seidle's the safe's dial, some magnets to hold it onto the wife gave him a second-hand safe she'd safe's face, and sensors that can check if the found on Craigslist. It was, at first glance, a bot has successfully turned the safe's handle, strange gift. The couple already owned the and when it passes the "zero" when turning the same model, a $120 dial. SentrySafe combination fire In the most basic sense, the resulting safe they'd bought from safecracker works by "bruteforcing" the Home Depot. But this one, SentrySafe—trying every possible combination. his wife explained, had a Like your high school locker's combination lock, particular feature: The the safe has three internal rotors that each have original owner had locked it to be set to a certain position–by dialing a and forgotten the series of three numbers–to open it. Since each combination. Her challenge of those rotors has 100 positions, to Seidle: Open it. corresponding to as many numbers on the Seidle isn't much of a safe's dial, trying all one million combinations safecracker. But as the (100 x 100 x 100) at the speed of about ten founder of the Niwot, seconds per guess would take nearly four Colorado-based company SparkFun, a DIY months. and open-source hardware supplier, he's a So Seidle started looking for shortcuts. First pretty experienced builder of homemade he found that, like many safes, his SentrySafe gadgets, tools, and robots. So over the next had some tolerance for error. If the combination four months, he and his SparkFun colleagues includes a 12, for instance, 11 or 13 would set about building a bot that could crack the work, too. That simple convenience measure safe for them. The result: A fully automated meant his bot could try every third number device, built from off-the-shelf and 3-D printed instead of every single number, immediately components, that can open his model of paring down the total test time to just over four SentrySafe in a maximum of 73 minutes, or days. Seidle also realized that the bot didn't half that time on average, with no human actually need to return the dial to its original interaction. In fact, in the demonstration position before trying every combination. By Seidle gave WIRED in the video above, the making attempts in a certain careful order, it process took just 15 minutes. could keep two of the three rotors in place, In the process of building his safecracking while trying new numbers on just the last, vastly “Could robot, which he will demonstrate live at the cutting the time to try new combinations to a Defcon cybersecurity conference next week, maximum of four seconds per try. That reduced someone Seidle discovered a series of real the maximum bruteforcing time to about one replicate it? vulnerabilities in the relatively cheap, but day and 16 hours, or under a day on average. popular, SentrySafe he tested. But the larger But Seidle found one more clever trick, this Yeah, that’s the lesson of his work goes beyond his particular time taking advantage of a design quirk in the point .” safe's security flaws. It points instead to a safe intended to prevent traditional new reality for vendors of physical security safecracking. Because the safe has a rod that equipment: If automated tools can crack your slips into slots in the three rotors when they're locks or safes, the increasing affordability of aligned to the combination's numbers, a human those tools makes you more vulnerable than safecracker can apply light pressure to the ever. "You’re going to have an army of geeks safe's handle, turn its dial, and listen or feel for like myself poking and prodding and trying to the moment when that rod slips into those slots. do things like this," says Seidle. "The nature To block that technique, the third rotor of of the toolset is getting cheaper, so more Seidle's SentrySafe is indented with twelve nerds are getting brave with their puzzling." notches that catch the rod if someone turns the To build their safecracking robot, Seidle dial while pulling the handle. and his SparkFun accomplices Rob Reynolds Read the rest here: and Joel Bartlett used about $200 in parts. Those include a $20 Arduino board, a $40 http://www.realcleardefense.com/ motor, an aluminum frame, 3-D printed articles/2017/07/31/ pentagon_would_ban_contractors_that_dont_pr otect_data_111923.html ISSA - C O S N E W S V O L U M E 6 P A G E 3 Membership Update Wow! We just closed out another successful conference at the New Members end of August with over 500 registered attendees. There were interesting presentations, great opportunities to network with peers and August vendors and a “Recognizing Women in Cyber” event in the evening. Vickie Gibbs Thanks to all the folks who volunteered to help with planning, coordination, Mike Allen and execution. Jon Cohenour Email reminders: Please take a couple of minutes to review your profile Randy Harris on your ISSA International account. Please ensure all your information is current and up to date, especially your contact information. It is critical that we have valid Brenda Hollingsworth email addresses for everyone as that is our primary method of communicating with Elaine Maresca members. We have recently been getting a lot of bounces, particularly from Jeff Bivens military email addresses ending in .mil. A lot of military firewalls have been Ramesh Adhikari updated recently to filter email, particularly from *.org addresses. Also, when people change companies, they frequently forget to update their ISSA profile. If Jackson Chaser you haven’t been receiving chapter emails, this could be the reason so please Nicholas Mazour consider updating your email address to a personal email rather than your work or Chelsey Leffler military address. Just a thought. Thanks, Leo Hergenroeder We’re at ~528 members as of the end of August. Dan Katz Finally, I would like to welcome our new members on behalf of the Chapter! Hector Cardenas When you’re participating in Chapter activities, please take a moment to introduce Patrick Parnell yourself to members of the board, me, and other members. Don’t forget to identify yourself as a new member and feel free to ask for help or information. Thanks for Fred Sayler joining the Chapter and don’t forget to look for opportunities to lend your expertise David Sorkness to improve the Chapter. We’re always open to new ideas and suggestions. Steve Swigart David Reed Becky Manka Cory Smith Membership Committee Chairman Marquel Waites [email protected] Lynnae Batts P A G E 4 With a Gentle Touch, NIST Scientists Push Us Closer to Flash Memory Successor By Staff, NIST, August 8, 2017 Sometimes a light touch is best: When you're telling a joke or hammering a tiny finishing nail into a wall, a gentle delivery often succeeds most effectively. Research at the National Institute of Standards and Technology (NIST) suggests it also may be true in the microscopic world of computer memory, where a team of scientists may have found that subtlety solves some of the issues with a novel memory switch.