Slides and Content from The Boring Security Talk at CrikeyCon VI

Droopy the CrikeyCon Mascot

Last weekend I spoke at CrikeyCon VI. I am always excited to attend and present at CrikeyCon, the attendees are fantastic and overall the organisers have created an amazing conference ❤.

This year I presented The Boring Security Talk. This session covers a variety of issues, DNS, Email, CI/CD and dependency management.

You can view the slides here. I will update this past when the video becomes available.

CrikeyCon VI - The Boring Security Talk from kieranjacobsen

I have put together a list of links and reference materials:

• Hackers exploit Jenkins servers, make $3 million by mining Monero
• DHS: Multiple US gov domains hit in serious DNS hijacking wave
• Advice on Mitigating DNS Infrastructure Tampering
• A Deep Dive on the Recent Widespread DNS Hijacking Attacks
• DNS Squatting with Azure App Services
• DNSControl
• Managing DNS with DNSControl, CloudFlare, DNSimple, GitHub, VSTS, Key Vault and Docker
• MX Toolbox
• PostMark
• Phishing Scorecard
• UK ICO, USCourts.gov... Thousands of websites hijacked by hidden crypto-mining code after popular plugin pwned
• Malicious Docker Containers Earn Cryptomining Criminals $90K
• Postmortem for Malicious Packages Published on July 12th, 2018
• Malicious remote code execution backdoor discovered in the popular bootstrap-sass Ruby gem
• Pipdig Update: Dishonest Denials, Erased Evidence and Ongoing Offences

@kjacobsen / https://t.co/i7v4e9vNdr - Back again - another #CrikeyConVI legend supporter! He’s telnet’d here from 2014 to spread good security advices!! pic.twitter.com/YnlauRlIvk

— Doc Dave (@forensicdave) April 7, 2019

Kieran @kjacobsen Jacobsen from Readify is giving “The Boring Security Talk” now at #CrikeyConVI. Try to stay awake! High risk but low cool-factor IT systems need protection too! pic.twitter.com/JtyzxgmA0a

— Christopher Biggs (@unixbigot) April 7, 2019

If you want to catch this presentation in person, you will be able to see it at the Azure Global Bootcamp in Melbourne.

Update - You can now watch the https://www.youtube.com/watch?v=5OlMEi_vcgY!

We all know that securing our applications is a necessity, but it can be incredibly boring. With time and budget constraints, we often focus on the more exciting security aspects and tools. In this talk, we'll be looking at some of the aspects to our application security that are often overlooked; the software we depend upon, CI/CD infrastructure, sending email and resolving DNS.