Difference between revisions of "AFSecurity Seminar"

From mn/ifi/AFSecurity
Jump to: navigation, search
 
(88 intermediate revisions by the same user not shown)
Line 1: Line 1:
−
== Red Teaming in Cyber Exercises ==
+
== ''Confidential Computing'' ==
  
 
{| border="0" cellpadding="1" cellspacing="1" width="100%"
 
{| border="0" cellpadding="1" cellspacing="1" width="100%"
 
|-
 
|-
−
| '''DATE:'''&nbsp; 6 June 2019<br />
+
| '''TIME:'''&nbsp; Friday 1 December 2023, 14:00h<br />'''PLACE:'''&nbsp;  Auditorium Smalltalk, 1st floor, IFI, UiO, Ole Johan Dahls hus, Gaustadalleen 23b, Oslo. [https://kart.finn.no/?lng=10.71782&lat=59.94342&zoom=17&mapType=normap&markers=10.71782,59.94342,r,Gaustadall%C3%A9en+23B See map].<br />
−
'''PLACE:'''&nbsp;  Kristan Nygaards Hall (Room 5370), IFI, UiO - OJD House . <br /><br />
+
All interested are welcome. Coffee and snaks served.<br />
−
'''AGENDA:'''<br />
+
<br />'''AGENDA:'''<br />
−
15:00h Welcom at UiO<br /><br />15:15h Invited Talk:
+
14:00h Welcome to AFSecurity at UiO <br />
−
| [[File:logo-CCDCOE.jpg|300px|link=https://ccdcoe.org/]]
+
14:15h Invited talk<br />
 +
* TITLE: ''Confidential Computing'' &nbsp;
 +
* SPEAKER: Ijlal Loutfi, Canonical 
 +
| <center>[[File:photo-Ijlal-Loutfi.png|90px|link=https://www.linkedin.com/in/ijlal-loutfi-785125234/]]</center>
 +
| <center>[[File:logo-Canonical.png|320px|link=https://canonical.com/]]</center>
 
|}
 
|}
−
* '''TALK:''' &nbsp;''Frankenstack: Building a detection and feedback system for Red-Teaming exercise''<br />'''SPEAKER:''' ''Markus Kont'' (NATO CCDCOE) &nbsp; <br />'''ABSTRACT:''' Cyber Defense Exercises have received much attention in recent years. Crossed Swords is an exercise directed at training Red Team members for responsive cyber defense. However, these Red Teamers may not be aware how their actions are visible from the detection side, as they often lack expertise from defensive side. Yellow team role is to provide this feedback. However, this can be a delicate balancing act, as feedback should be given near real time without overwhelming the players who are already under intense time pressure. Furthermore, this system should not spoil the gameplay nor give unfair insights into the network topology of target systems. This presentation is about the tools and techniques used, as well as challenges encountered, while building Frankenstack, an open source toolbox for providing this feedback. Current iteration is a data pipeline and correlation stack build around Kafka message queue and SEC event correlation rules. Events were collected from network via Suricata, Zeek, Moloch and Mendel. Host logs were enhanced with Snoopy on Linux and Sysmon on Windows targets to generate a full audit trail, and collected via Syslog. A custom data normalization engine was written in Golang to enhance each message with meta information needed to correlate event fragments from multiple sources, and to anonymize targets. And to replay events post-mortem with correct temporal intervals, to enable offline correlation rule development. Correlated alerts were displayed on central screens using various custom and existing front-end dashboards.
+
* ABSTRACT:<br />Protecting data in-use has long been a challenging open problem in computer science. While being computed on in cleartext in system memory, your data stored in RAM is exposed to the millions lines of code that make up the underlying platform’s privileged system software. By design, a malicious firmware, or compromised operating system can easily leak your data, or compromise its integrity.<br /><br />Confidential computing is a privacy-enhancing system security primitive which addresses this challenge head-on, by running your security-sensitive processes in isolated execution environments whose security guarantees can be remotely attested. Its recent generations, such as Intel SGX, Intel TDX and AMD SEV SNP, make use of newer CPU hardware and architectural extensions, such as the AES-128 hardware encryption engine which encrypts RAM memory pages in real-time. Hardware with these capabilities is already available in the market, and public cloud providers have been one of its early adopters.<br /><br />In this presentation, we first visit the history of confidential computing, then study the technical system primitives which allow us to implement both isolation and attestation. We also explore the different silicon implementations of confidential computing, where they are deployed today, and for which uses cases.
  
−
16:00h Discussion<br />
+
<br />15:00h Discussion<br />
  
 +
'''BIO:''' &nbsp; Dr. Ijlal Loutfi is the product lead for Ubuntu Security at Canonical. She has a PhD in cyber security from the University of Oslo, where she worked on Trusted Execution Environments and Identity Management.
 +
 +
 
 +
<br /><br />
  
−
'''SPEAKER BIO''' <br/>
 
−
Markus Kont is a Researcher at the Technology branch of the NATO Cooperative Cyber Defence Centre of Excellence since 2015. His area of expertise is packet capture and log processing, DevOps tools and techniques, and data science. His current work involves researching stream processing techniques, and he is responsible for teaching network security monitoring tools in CCDCOE. In his prior life, he was server administrator in a hosting and software development company for over 5 years, focusing mostly on Linux systems and back-end infrastructure development. He holds a Master degree in Cyber Security from Tallinn University of Technology where he wrote a thesis on syslog and event correlation.
 
 
{| border="0" cellpadding="1" cellspacing="1" width="90%"
 
{| border="0" cellpadding="1" cellspacing="1" width="90%"
 
|-
 
|-
 
| [[File:AFSecurity-small.png|250px]]
 
| [[File:AFSecurity-small.png|250px]]
−
| AF''Security'' is organised by the UiO Research Group on [https://www.mn.uio.no/ifi/english/research/groups/sec/ Information &amp; Cyber Security]
+
| AF''Security'' is organised by UiO [https://www.mn.uio.no/ifi/forskning/grupper/sec/ Digital Security].
−
| [[File:Sec-uio-light-1000.png|250px|link=https://www.mn.uio.no/ifi/english/research/groups/sec/]]
+
| [[File:logo-uio-english-2022.png|250px|link=https://www.mn.uio.no/]]
 +
| [[File:Sec-light-360.png|150px|link=https://www.mn.uio.no/ifi/english/research/groups/sec/]]
 
|}
 
|}

Latest revision as of 15:30, 14 November 2023

Confidential Computing

TIME:  Friday 1 December 2023, 14:00h
PLACE:  Auditorium Smalltalk, 1st floor, IFI, UiO, Ole Johan Dahls hus, Gaustadalleen 23b, Oslo. See map.

All interested are welcome. Coffee and snaks served.

AGENDA:
14:00h Welcome to AFSecurity at UiO
14:15h Invited talk

  • TITLE: Confidential Computing  
  • SPEAKER: Ijlal Loutfi, Canonical
Photo-Ijlal-Loutfi.png
Logo-Canonical.png
  • ABSTRACT:
    Protecting data in-use has long been a challenging open problem in computer science. While being computed on in cleartext in system memory, your data stored in RAM is exposed to the millions lines of code that make up the underlying platform’s privileged system software. By design, a malicious firmware, or compromised operating system can easily leak your data, or compromise its integrity.

    Confidential computing is a privacy-enhancing system security primitive which addresses this challenge head-on, by running your security-sensitive processes in isolated execution environments whose security guarantees can be remotely attested. Its recent generations, such as Intel SGX, Intel TDX and AMD SEV SNP, make use of newer CPU hardware and architectural extensions, such as the AES-128 hardware encryption engine which encrypts RAM memory pages in real-time. Hardware with these capabilities is already available in the market, and public cloud providers have been one of its early adopters.

    In this presentation, we first visit the history of confidential computing, then study the technical system primitives which allow us to implement both isolation and attestation. We also explore the different silicon implementations of confidential computing, where they are deployed today, and for which uses cases.


15:00h Discussion

BIO:   Dr. Ijlal Loutfi is the product lead for Ubuntu Security at Canonical. She has a PhD in cyber security from the University of Oslo, where she worked on Trusted Execution Environments and Identity Management.




AFSecurity-small.png AFSecurity is organised by UiO Digital Security. Logo-uio-english-2022.png Sec-light-360.png
Retrieved from "https://wiki.uio.no/mn/ifi/AFSecurity/index.php?title=AFSecurity_Seminar&oldid=1805"