ISECOM training: OSSTMM 101

March 28, 2011 (at 10 a.m.)

Pete Herzog

Class summary

This seminar prepares the attendees for applying the latest public version of the OSSTMM to include or increase security within their current activities and routines. This teaches the language, the concepts, and the know-how required for the employee to immediately put to practice these security techniques.

Agenda

What You Need to Know About Security
- Security, Controls, and Limitations
- Actual Security and Compliance
Setting Up a Security Test
- Defining a Security Test and Scope
- Common Test Types
- The Operational Security Testing Process
- Four Point Process and the Trifecta
- Error Handling
Working With the Methodology
- Methodology Flow
- The Test Modules
- Security Tests by Channel
How You Measure Security
- Understanding the Rav
- How to Make a Rav
- Turning Test Results into an Attack Surface Measurements
- The STAR
- SCARE and Applying the Rav to Source Code
What You Need to Know About Analyzing Security
- Critical Security Thinking
What You Need to Know About Trust Analysis
- Understanding Trust
- Applying Trust Rules to Security Testing
The Big Picture
- Building the Möbius Defense
- Next Steps

Pete Herzog

About the Trainer Pete Herzog is a security professional, neuro-hacker and managing director for the non-profit security research organization, ISECOM. He created the first social engineering methodology for quantifiable testing of human security for OSSTMM 2.1 in 2002. By 2003 he created Trust Metrics for measuring the amount of trust one can put in anything in a quantifiable manner which was added to OSSTMM 3 in 2010. In 2009 Herzog began working with brainwave scanners and tDCS to directly manipulate the brain and understand how people learn and focus attention. In 2013 he released the Security Awareness Learning Tactics (SALT) project to specifically design security awareness based on the neuro research. You can read more about Pete here: http://en.wikipedia.org/wiki/Social_engineering_%28security%29#Notable_social_engineers http://en.wikipedia.org/wiki/Pete_Herzog https://www.linkedin.com/in/isecom