ITWeb Security Summit 2012 Content

The slides and audio from the summit have been posted. I haven't had a chance to listen to my audio, be warned my slides probably won't be to helpful without it.

ITWeb Security Summit 2012

I'll be presenting on SAP security at the ITWeb Security Summit on the 15th of May. If you are interested in Security Engineering or SAP, come say hello.

ZaCon III Presentation

Rather late than never, I've spotted my ZaCon talk on the the DiscussIT and ZaCon Vimeo feed. The DiscussIT audio feed contains the Q&A.

Picking up stones behind broken windows

Comments welcome.

ZaCon III

I've just received confirmation that my abstract has been accepted, I'll see you at ZaCon III 

Authentication Concept Map

I've put together the following Authentication (AuthN) concept map.

Data Visualization

One of the most useful ways to communicate or understand information is to visualize the data. In security this is vital due to the sheer volumes of data you often have to contend with i.e. from the secviz community.

Splunk can enable you to quickly find and parse data, however you often need to send the data to something like graphviz so that I can see it.

I've written an app that adds a new search command to Splunk that will enable you to generate a graph from your search data.


* | viz field1=ip1 field2=ip2 label=proto flatten=true file=/tmp/network1.png

 * | viz field1=ip1 field2=ip2 label=proto flatten=true file=/tmp/network2.png rankdir=RL

One of the nice features is that you can add graphviz options directly to the command i.e. rankdir=RL

The app can be obtained via http://github.com/marinus, comments & patches are welcome.

Design Detection Heuristics

Benford's law provides a useful heuristic to detect data that has been produced by a person. This is very useful to detect fraud, tampering, vote rigging and other activities where one needs a little help. It appears thought that the application of Benford's law is more of an art than a science and rather than being the smoking gun one would like, it serves as the starting point for an investigation or a trigger for caution.

I've developed a Splunk App that adds a new command to the Splunk search language that calculates the first digit distribution, which can then be used to graph the field of interest.

* | benford field=price | table digit price benford

Other digits can be selected as follows

* | benford field=price digit=2 | table digit price benford


Here's some sample transactions I generated

The benford command will calculate the distribution of the first digit and produce a table, which can be graphed.

The following graph illustrates the digit distribution compared to the benford distribution.

The following graph was created using real transactional data.