"The Evolution of Malware" @EdgeAcademy16 - first day
On my mind after first night of Netlight Edge Academy 2016 in Stockholm is – “The Evolution of Malware” presented by Hannes Sandahl @Netlight with the following agenda and discussion…
“It’s been about 30 years since the first PC virus, Brain A,
hit the net. What was once an annoyance has become an advanced tool for crime
and espionage. We will talk about how malware has evolved and the future of it.”
Ohhh, another awakening smack in the face. The evolution of
Internet of things will besides creating a very interesting digital future really
open up the malicious crime business widely. You can't easily hide behind your firewall anymore. Some of the main worries I see here are typically
- The drivers or producers of Internet Of Things often comes from a non-IT background, leaving IT security left behind.
- The typical consumer, you and me, know a computer can be affected of malicious intrusion, but don’t see the smartphone, smartwatch, smarthouse, smartshirt or smartcar as a computer, open for any malicious threat.
- The typical consumers, you and me, don’t value IT-security enough. We’re not requesting for it nor are we prepared to pay extra for a more expensive alternative including better security.
- The legal aspect, including both laws and authorities, are as always within IT (decades) of years behind, leaving very little hope for support to the end consumer.
- And then, of course, we have the issue about integrity and personal/private data.
The solution? Tricky based on the main worries above. But I
think we all understand we all need to take a little bit greater responsibility
here, as end consumer as well as developers and producers.
OWASP is always a good place to start - owasp.org (see short description of useful OWASP projects below)
* Edge Academy is the Netlight yearly internal intimate technology festival happening within all of our offices, by consultants for consultants. #edgeacademy16 is the fifth edition of Edge Academy.
Useful OWASP projects - input form my colleague Jakob Pogulis @Netlight
OWASP Cheat Sheet Project. Short document (~5 pages) summarizing what to think about during design/implementation of systems, for example Authorization. Easy for anyone to use prior to, during and post development phase. (As default this should be the bare minimum for any software development project to keep track of)
OWASP Code Review Guide. This is a longer guide about what's important to look for when reviewing various programming languages. Unfortunately not totally up to date however still always highly important.
OWASP Testing Guide. Longer guide about software testing in the area of security. Very good input for anyone with interest but quite heavy. This also works well as reference/cheat-sheet if you don't have the time to go through it all.
OWASP Software Assurance
Maturity Model. Another longer guide/checklist describing how to evaluate software projects or products from a security perspective. Similar to Common Criteria but doesn't require half-a-year of study to perform a review...
What's your thoughts about the future and malware?
Folllow me on twitter: mandus_engman
Kommentarer
Skicka en kommentar