January 2020 Chapter Meeting

January 22nd 2020 6pm-8pm

Agenda: 6:00pm-6:15pm Networking 6:15pm-6:30pm Chapter Business 6:30pm-8:00pm Presentations

Location: Bellevue City Hall 450 110th Ave. NE Bellevue, WA 98009

attendance qualifies for 2 CISSP credits

Speakers:

Jack (Itgel) Ganbold, Associate Cloud Penetration Tester, Rhino Security Labs Cloud Container Attack Tool (CCAT) Docker, Kubernetes and other container technologies are becoming increasingly popular and are being adopted by many companies. In recent cloud pentesting engagements, we have similarly noticed that many of our clients use container technology to run their systems. Although there has been research and tool development on containers and their security, most of those are focused on image analysis and finding known vulnerabilities. Due to this lack of tools, we decided to build one for ourselves and named it the Cloud Container Attack Tool (CCAT for short). CCAT is a modular, open-source container post-exploitation attack tool created by and used for Rhino Security Labs pentests. In this talk, I will cover how penetration testers/red teamers can use CCAT to simulate real-world attack scenarios against container environments. We will start from enumerating Docker images and creating backdoors, attacking Kubelets and compromising Kubernetes clusters, and pulling metadata and other sensitive information through Kubernetes Pod and DaemonSet and many more. CCAT released as an open-source project to encourage collaboration and discussion of different container attack techniques and methodologies with both attackers and defenders. This way, both myself and the community can contribute new modules to expand the functionality and usefulness of CCAT continuously. Bio Jack is an Associate Cloud Pentester at Rhino, with a focus on testing the security of AWS, Azure, and GCP cloud environments. He comes from a background of full-stack development on web and mobile applications. Jack also founded the first Mongolian cryptocurrency wallet and sold it to one of the biggest Mongolian Financial groups. Recently, Jack created the Cloud Container Attack Tool (CCAT) which is a tool for testing the security of container environments based on his 3+ years of experience in container technology. and Chris Longman, Privacy Program Owner, Core Services, Microsoft "Don’t party like it’s 1999: Modernizing privacy compliance" At a time when every business is becoming a software company, leaders need new ways to enable privacy compliance at scale. This session illustrates the risks of holding on to out-of-date privacy compliance frameworks and instead details a modern approach that leverages “thinking like an engineer” to solve for GDPR, CCPA and future privacy requirements. Bio: Chris Longman leads Microsoft’s privacy compliance program for Core Services, which spans nearly 2,000 individual applications and systems that power the company’s internal tools and business processes. After starting a career as a software engineer on various components of Windows, he graduated from Gonzaga Law School in 2010 and practiced as a solo attorney counseling startups in acquisition. Wanting to dig into the difficult areas where the law and technology collide, he returned to Microsoft in 2014 to define and build new approaches to regulatory compliance, relying on his combined legal and software engineering backgrounds. An Issaquah native and “dog person,” Chris currently lives in Sammamish with his wife Lindsay, her two cats, and zero dogs.

February 2020 Chapter Meeting

February 26th 2020 6pm-8pm

Agenda: 6:00pm-6:15pm Networking 6:15pm-6:30pm Chapter Business 6:30pm-8:00pm Presentations

Location: Bellevue City Hall 450 110th Ave. NE Bellevue, WA 98009

Register

attendance qualifies for 2 CISSP credits

Speaker:

Melissa Van Buhler, Cybersecurity & Data Privacy Attorney, FocalLaw, LLP Data Privacy: Who owns Your Personal Data? Data Privacy is daily news—Equifax, Capital One, etc.—but what are we actually talking about? As individuals, we have rights over our physical property but much less say over ownership of our personal information. As we consider the efforts of other countries to protect their citizens’ personal information and the efforts of some States to create private rights of action regarding personal information, we have to ask ourselves how we got here. Our government has clear rules about protecting our individual data from government interference, but few rules exist for corporations processing our personal data, both internally and externally. And with and without our consent. Rules have evolved to protect our money and health records, but not the details that define our lives, for example, our credit histories. Corporations are selling our information to one another to make money off us in ways we cannot imagine, could not foresee, and are seemingly outside of our government’s control. Moving most of our daily lives online and into the cloud has had effects we could not have predicted or imagined. Where do we go from here? Bio: Melissa is an expert on cybersecurity, privacy, and regulatory compliance whose key strength is helping organizations achieve cyber resiliency grounded in legal and regulatory compliance. Before joining Newman Du Wors in 2018, she served more than fifteen years as a Judge Advocate General officer in the United States Army where she supported top-secret operations at the National Security Agency (NSA), United States Cyber Command, and United States Army Special Operations Command. During her tenure, Melissa gained unique insights into worldwide vulnerabilities to cyberattacks and helped develop best practices to combat them. She advised on the complex data lifecycle from collection, storage, and sharing within and among intelligence agencies. Her data privacy expertise is grounded in working with all types of intelligence information, particularly signals intelligence data. Melissa earned a master of laws in Information Technology & Intellectual Property from University of Colorado, Boulder in between assignments with intelligence organizations. She is also a combat veteran of Operation Iraqi Freedom having served one year with the 4^th Infantry Division at Camp Taji, Iraq from 2005 – 2006.