5 Days Left to Save $200 on SANS Miami 2016

SANSFIRE 2014

Baltimore, MD | Sat, Jun 21 - Mon, Jun 30, 2014

Penetration Testing Corporate Mobile Applications and BYOD Environments

  • Dmitry Dessiatnikov
  • Thursday, June 26th, 7:15pm - 8:15pm

The explosion of the mobile application market coupled with acceptance of "bring your own device" (BYOD) to enterprise environments comes with its unique security risks. While driven by a rise in productivity, convenience and overall user satisfaction BYOD increases the attack surface that most businesses are not prepared for. In this presentation we will cover the reasons for penetration testing BYOD environments along with a demonstration of a remote compromise of an Android phone in a corporate environment. We will also discuss the OWASP top 10 mobile risks and demonstrate some common issues with a vulnerable iOS mobile application. A free tool will be shared with the audience that can assist with assessing their corporate BYOD environments. Finally, we will cover some mitigating controls and what can be done to address raised issues.

Bio:

Dmitry Dessiatnikov, a veteran with over fifteen years of security experience, is the president of Security Aim, information security consulting company. Prior to Security Aim, Dmitry was a managing principle consultant on the attack and penetration team of Accuvant LABS where he provided consulting services to large corporate clients. He offered ongoing thought leadership by developing methodologies and tools while serving the community as a leader of the Salt Lake City OWASP Chapter and on the Board of Directors of UtahSec. Before joining Accuvant, Dmitry was a senior security consultant in the security and technology solutions practice at Ernst and Young, LLP where he was the leading penetration-testing specialist in the West Coast region. Dmitry presented at multiple security conferences and published white papers that appeared on the SANS "Top 25 Papers Viewed of All Time" list. He holds a Master's degree in Information Systems Management and has achieved the following credentials: CISSP, GCWN, GSEC, and GWAPT.

Bonus Sessions

The following bonus sessions are open to all paid attendees at no additional cost. There are many different types of events that fall into these categories:

  • SANS@Night: Evening presentations given after day courses have ended. This category includes Keynotes.
  • Special Events: SANS-hosted events and other non-technical recreational offerings. This category includes, but is not limited to, Receptions and Information Tables.
  • Vendor: Events hosted by external vendor exhibitors.
  • Lunch & Learn: Short presentations given during the lunch break.
Monday, June 23
Session Speaker Time Type
General Session - Welcome to SANS Johannes Ullrich Monday, June 23rd, 8:15am - 8:45am Special Events
SANS Technology Institute Open House William Lockhart Monday, June 23rd, 6:00pm - 7:00pm Special Events
State of the Internet Panel Discussion Dr. Johannes Ullrich, ISC Director and Marcus Sachs, ISC Director Emeritus Monday, June 23rd, 7:15pm - 9:15pm Keynote
Tuesday, June 24
Session Speaker Time Type
Resurrection of the Data Entry Attack Aaron Higbee, Chief Technology Officer & Co-Founder, PhishMe Tuesday, June 24th, 12:30pm - 1:15pm Lunch and Learn
Using Intelligence Methods in Mobile Forensic Exams Lee Papathanasiou, Sales Engineer, Cellebrite Tuesday, June 24th, 12:30pm - 1:15pm Lunch and Learn
Continuous Monitoring & Mitigation Tim Jones, Systems Engineer, Forescout Tuesday, June 24th, 12:30pm - 1:15pm Lunch and Learn
The Power of Lossless Packet Capture (1G-100G) & Real-time Netflow Sam Cook, Senior Sales Engineer Tuesday, June 24th, 12:30pm - 1:15pm Lunch and Learn
Understanding the Threat: A Model to Enable Active Response Finn Ramsland, Solutions Architect, Federal - FireEye Tuesday, June 24th, 12:30pm - 1:15pm Lunch and Learn
Looking Beyond Layers: Why Authentication Security Matters Most Brian Kelly, Principal Product Marketing Manager at Duo Security Tuesday, June 24th, 12:30pm - 1:15pm Lunch and Learn
Online Training Reception Tuesday, June 24th, 6:00pm - 8:00pm Reception
Security Awareness Metrics: Measuring Human Behavior Lance Spitzner Tuesday, June 24th, 7:15pm - 8:15pm SANS@Night
Avoiding Cyberterrorism Threats Inside Electrical Substations Manuel Humberto Santander Peláez Tuesday, June 24th, 7:15pm - 8:15pm SANS@Night
Securing The Kids Lance Spitzner Tuesday, June 24th, 8:15pm - 9:15pm SANS@Night
C3CM Defeating the Command, Control, and Communications of Digital Assailants Russ McRee Tuesday, June 24th, 8:15pm - 9:15pm SANS@Night
Wednesday, June 25
Session Speaker Time Type
Vendor Solutions Expo Wednesday, June 25th, 12:00pm - 1:30pm Vendor Event
Vendor Solutions Expo Wednesday, June 25th, 5:00pm - 7:00pm Vendor Event
An Introduction to PowerShell for Security Assessments James Tarala Wednesday, June 25th, 7:15pm - 8:15pm SANS@Night
Setting up Splunk for Event Correlation in Your Home Lab Aron Warren - Master's Degree Candidate Wednesday, June 25th, 7:15pm - 7:55pm Special Events
Consulting from Virtual Island Rob VandenBrink Wednesday, June 25th, 8:15pm - 9:15pm SANS@Night
Thursday, June 26
Session Speaker Time Type
Vile Vulnerabilities, Rampant Rights, and Pervasive Passwords Paul Harper, Product Manager, Beyond Trust Thursday, June 26th, 12:30pm - 1:15pm Lunch and Learn
Operationalize Open Intelligence YARA + Fidelis XPS Mike Nichols, Sr. Product Manager, General Dynamics Fidelis Cybersecurity Thursday, June 26th, 12:30pm - 1:15pm Lunch and Learn
Effective Forensics Analytics for Actionable Incident Response Narayan Makaram, Sr. Product Manager, Tenable Network Security Thursday, June 26th, 12:30pm - 1:15pm Lunch and Learn
Fortinet Next Generation Firewalls Rob Frickel, Security Analyst, Infogressive Thursday, June 26th, 12:30pm - 1:15pm Lunch and Learn
Insider Threat Kill Chain: Detecting Human Indicators Of Compromise Bryce G. Schroeder, Sr. Director of Systems Engineering - Tripwire Thursday, June 26th, 12:30pm - 1:15pm Lunch and Learn
Innovations in End Point Threat Detection (EDTR), Chad Fulgham, PerCredo CEO and former FBI CIO Thursday, June 26th, 12:30pm - 1:15pm Lunch and Learn
Penetration Testing Corporate Mobile Applications and BYOD Environments Dmitry Dessiatnikov Thursday, June 26th, 7:15pm - 8:15pm SANS@Night
How to Spy on your Employees with Memory Forensics Alissa Torres Thursday, June 26th, 7:15pm - 8:15pm SANS@Night
GIAC Program Overview Jeff Frisk Thursday, June 26th, 8:15pm - 8:45pm Special Events
Bust a Cap in a Web App With ZAP Adrien de Beaupre Thursday, June 26th, 8:15pm - 9:15pm SANS@Night
Friday, June 27
Session Speaker Time Type
The "Insider Threat" Revised: Crime, Understanding, and Prediction Richard Porter Friday, June 27th, 7:15pm - 8:15pm SANS@Night
Creating a Covert Channel in Wifi Ronald Hamann Friday, June 27th, 7:15pm - 8:15pm SANS@Night