Security Conferences that I find interesting - 2012

OWASP AppSec USA 2012 — LASCON Edition, TX

Austin, TX at the Hyatt Regency Hotel Downtown
Training: October 23rd-24th — Conference Sessions: October 25th-26th

OWASP AppSec conferences bring together industry, government, security researchers, and practitioners to discuss the state of the art in application security.

RSA Conference 

is helping drive the information security agenda worldwide with annual industry events in the U.S., Europe and Asia. Throughout its history, RSA Conference has consistently attracted the world's best and brightest in the field, creating opportunities for conference attendees to learn about IT security's most important issues through first-hand interactions with peers, luminaries and emerging and established companies. As the IT security field continues to grow in importance and influence, RSA Conference plays an integral role in keeping security professionals across the globe connected and educated.

RSA developed the RSA Conference in 1991 as a forum for cryptographers to gather and share the latest knowledge and advancements in the area of Internet security. Today, the RSA Conference and related, RSA Conference branded activities, are still managed by RSA, the Security Division of EMC, with the support of the industry. RSA Conference event programming is judged and developed by information security practitioners and other related professionals.

Save the date for 2013: February 25 to March 1 in San Francisco!

Refer this for 2012 Sessions

Information System Security Consortium Congress: 

https://www.isc2.org/Conferences.aspx

http://www.hackerhalted.com

Has courses for learning etc:

SN		Course Title		Before May 31		Before Aug 31		Starts Sept 1
1.		Certified Ethical Hacker (CEH) v7		$2999		$3399		$3599
2.		Certified Security Analyst / Licensed Penetration Tester (ECSA/LPT)		$2799		$3199		$3399
3.		Computer Forensics Hacking Investigator (CHFI)		$2799		$3199		$3399
4.		Certified Incident Handler (ECIH) [2 days]		$2299		$2699		$2899
5.		CAST 611 – Advanced Penetration Testing [3 days]		$2799		$3199		$3399
6.		CAST 612 – Advanced Mobile Hacking & Forensics [3 days]		$2799		$3199		$3399
7.		CAST 614 – Advanced Network Defense [3 days]		$2799		$3199		$3399
8.		Wireless & Bluetooth Hacking 101 [2 days]		$2299		$2699		$2899
9.		SAP Security In Depth [2 days]		$2299		$2699		$2899
10.		Certified Information Systems Security Professional (CISSP)		$2799		$3199		$3399
11.		Crimeware Attribution [2 days]		$2299		$2699		$2899
12.		The Web Application Hacker’s Handbook 2nd Edition Live - [3 days]		$2799		$3199		$3399
13.		PMP (Project Management Professional)		$2799		$3199		$3399

Conference Pass
SN		Category		Before May 31		Before Aug 31		Starts Sept 1
1.		EC-Council Member*		$899		$1199		$1399
2.		Public		$1299		$1599		$1799
3.		Academic Pass**		$399		$599		$699
4.		Press & Media		Please email info@hackerhalted.com for more information
5.		Group Registrations		Please email info@hackerhalted.com for more information

Blackhat

July 21-26, 2012 | Las Vegas, NV

ISACA's World Congress

   
25-27 June 2012 | San Francisco, CA, USA
A leadership forum for business and IT professionals.

BSidesDFW 2012

Event details:

When: Saturday, November 3, 2012
Where: CTREC Hilton Academy (1605 LBJ Freeway, Dallas, TX 75234)
Cost: Free (as always!) Donations are always welcome Donate Here!
Doors open at: 8:30 am - 5:30 pm

InfoSec World Conference & Expo 2013

April 15-17, 2013
Walt Disney World Swan and Dolphin
Orlando, FL

Here are resources in case you want to look at all available conferences:

• https://secore.info/

  Resource for Information Security conferences.
• http://www.allconferences.com/
• http://www.secsocial.com/blog/?page_id=478

Creating an X509v3 Certificate

There are three options to generate a certificate and some of the steps are common between the first two options.

Option1: Create a self signed certificate

We can use the keytool supplied as part of JDK to create this. For example:

• Step1: Creating a Certificate

jdk1.7.0_04\bin>keytool -genkey -keyalg RSA -alias manojdefaultcert  -keystore manojkeystore.jks

• Step 2: generating a CSR( Certificate Signing Request). 

The CSR contains the public key and the name of the server, in a format defined by the PKCS#10 standard (typically given the filename extension .p10 or .csr)

jdk1.7.0_04\bin>keytool -certreq -sigalg MD5withRSA -alias manojdefaultcert -file manojdefaultcert-csr.pem  -keystore manojkeystore.jks

• Step3: Generate certificate from above CSR.

jdk1.7.0_04\bin>keytool -gencert -infile manojdefaultcert-csr.pem -outf

ile manojdefaultcert.cert -alias manojdefaultcert -keystore manojkeystore.jks

Don't recall if I had to do anything with the certificate generated in manojdefaultcert.cert file. Probably the PrivateKey entry in the keytool becomes ready for use.

Maybe we can  use this certificate and provide it to clients that want to trust this self signed certificate.

Option2: Create a Certificate signed by a CA

Steps 1 and 2 are similar to the ones for option 1. Once we have the CSR, we can get the CSR signed by a CA. Refer the  EJB CA post to see how EJBCA was setup as a CA and how we can get the cert signed by EJBCA.

• Just to summarize, navigate to https://localhost:8443/ejbca/enrol/server.jsp  and select the CSR file and the user id to create against. 
• User id should match the subject in "CN=subject". 
• Output in pkcs#7 format.
• Note: Remember to accept the return in pkcs#7 format from the CA and then import that file into the keystore. For some reason pem format didn't work in EJBCA. maybe because it didn't have the full chain. 

• Step 3: Import the output file( CA Reply or CSR Reply) from the CA in keystore: 
• This is typically given as an X.509 Certificate file (.cer, .crt, .pem, or .der) or as a PKCS#7 file (.p7b). In our case it is .p7b.

• Each certificate in the chain must imported into the keystore(starting first with the root cert). If the CA Reply does not include the chain certificates, they must be added to the keystore manually before the CA reply. 
• In our case .p7b includes the cert chain.
• The command is:
• keytool -importcert -alias testkeytoolcert -keystore testkey.jks -file "Manoj Test-testkeytoolcert-AdminCA1.pkcs7"
• Basically we are trying to import the certificate returned from the CA using the same alias that was used to generate the PrivateKey entry. Keytool will assign the certificate chain to the PrivateKey and record the reply from the CA.

Option 3: Import an existing certificate ( in pkcs#12 format).

Basically, the certificate and keys were generated using a different tool or process or by an  internal company process. The cert and key information has to be combined into a single pkcs#12 format by using openSSL:

openssl pkcs12 -export -in cert.crt -inkey key.key -out exported.p12 -name tomcat -CAfile myCA.crt -caname root -chain

This certificate can then in imported in JKS keystore. 

Option 4: Programmatically create a Certificate signed by a CA using SCEP

This will be the subject of another blog post...
<TODO: insert link to blog post on SCEP Enrollment>

Resources

• KeyStore Explorer 

Free GUI replacement for the Java command-line utilities keytool, jarsigner and jadtool. KeyStore Explorer presents their functionality, and more, via an intuitive graphical user interface.

• Free but not open source. Cannot redistribute.
• Allows exporting of the PrivateKey.
• Refer a utility in security-utils project for importing a private key and certs.

• http://docs.oracle.com/javase/7/docs/technotes/tools/windows/keytool.html

• Useful article for commands etc for dealing with java Keystores

• Importing private keys into a Java keystore using keytool

We need to convert our existing certificate and key into a PKCS12 file, and then use the keytool functionality to merge one keystore with another one. Java 6 can treat a PKCS12 file as a keystore so putting this together we get this:

• keytool -importkeystore -deststorepass pwd -destkeypass pwd -destkeystore dest-keystore.jks -srckeystore src-certs-priv-key.p12 -srcstoretype PKCS12 -srcstorepass key-password -alias 1

The alias of 1 is required to choose the certificate in the source PKCS12 file, keytool isn't clever enough to figure out which certificate you want in a store containing one certificate.