Black Hat USA Training 2005
Caesars Palace Las Vegas • July 23-24 & July 25-26

Course Length: 2 days

Out of the box, most operating systems are sitting ducks. Within six months of release, they tend to become rather crackable. Further, it only gets worse as the operating system ages. For instance, a default server install of Red Hat 6.2 averages a life expectancy of only 72 hours, according to the Honeynet Project. You don't have to stand for this kind of weakness, though.

This fast-paced, hands-on course, 'Securing Solaris and Locking Down Linux,' will teach you how to protect a system from compromise. You'll learn how the attacks work and how to use hard-core hardening to defeat the bulk of them. You'll learn how to take your machines to a state of minimum necessary risk.

This course teaches you how to tighten all major aspects of the operating system for security, balacing this with with the purpose of the system and the needs of your organization. You'll learn how to tune kernel and operating system parameters, deactivate components, and tighten the components that remain. You'll examine major server applications tightening, including Apache, Sendmail, WU-FTPd, vsftpd, and BIND. Along the way, you'll understand how external and internal attackers use privilege escalation and how you can lessen their odds of gaining root. You'll also learn to apply key security concepts, from defense-in-depth to least privilege to risk evaluation, to determine what actions you should take and in what order of priority.

What You Will Learn:
Students will gain a general understanding of how to harden systems to prevent or contain a system compromise. While we work on Linux and Solaris, the material does apply broadly to all Unix variants.

Students will leave this course with the ability to:

• Configure Solaris and Linux for much greater resilience to attack.
• Understand each Solaris and Linux network service and be capable of judging which can or cannot be safely restricted or deactivated.
• Understand each Solaris and Linux boot script and be capable of judging which scripts can or cannot be safely deactivated.
• Audit the Solaris and Linux file permissions and Set-UID/GID programs to combat compromise and escape privilege escalation.
• Understand and set kernel and operating system variables for best security
• Configure BIND DNS servers to greater resistance to attack.
• Configure Apache Web servers for greater resistance to attack.
• Configure Sendmail Mail servers for greater resistance to attack.
• Configure WU-FTPd FTP servers for greater resistance to attack.
• Configure vsftpd FTP servers for greater resistance to attack.
• Configure POP and IMAP servers for greater resistance to attack.
• Audit systems with free tools to find better security settings, including Bastille, Titan and the Center for Internet Security's tools
• Configure a Linux-based firewall

This course targets system or network administrators and security admins/auditors with an understanding of Unix commands and basic operating system functions. While others are welcome, complete lack of familiarity is too great a burden to overcome in a two day class.

Each student will practice the techniques learned on their own Black Hat -provided Linux system. A shared Solaris machine will also be available for Solaris practice. Students are welcome to harden their own laptop systems as well, in preparation for the hostile networks that can often be found at security conferences.

Who Should Attend:
System administrators, security administrators, security auditors. Unix box owners. Anyone who has a vested interest in keeping their systems from being compromised.

ISC² CISSP/SCCP CPE Credits
Students are eligible to receive 16 Continuing Professional Education (CPE) credits upon completion of class. Black Hat will automatically forward your information to ISC².

Jay Beale is a information security specialist, well known for his work on mitigation technology, specifically in the form of operating system and application hardening. He's written two of the most popular tools in this space: Bastille Linux, a lockdown tool that introduced a vital security-training component, and the Center for Internet Security's Unix Scoring Tool. Both are used worldwide throughout private industry and government. Through Bastille and his work with the Center, Jay has provided leadership in the Linux system hardening space, participating in efforts to set, audit, and implement standards for Linux/Unix security within industry and government. He also focuses his energies on the OVAL project, where he works with government and industry to standardize and improve the field of vulnerability assessment. Jay is also a member of the Honeynet Project, working on tool development.

Jay has served as an invited speaker at a variety of conferences worldwide as well as government symposia. He's written for Information Security Magazine, SecurityFocus, and the now-defunct SecurityPortal.com. He has worked on four books in the Information Security space. Three of these make up his Open Source Security Series, while one is a technical work of fiction entitled <http://www.oreilly.com/catalog/1931836051/index.html>"Stealing the Network: How to Own a Continent."

Jay makes his living as a security consultant with the firm Intelguardians, which he co-founded with industry leaders Ed Skoudis, Eric Cole, Mike Poor, Bob Hillery and Jim Alderson, where his work in penetration testing allows him to focus on attack as well as defense. Prior to consulting, Jay served as the Security Team Director for MandrakeSoft, helping set company strategy, design security products, and pushing security into the third largest retail Linux distribution.