I have a new course available at Pluralsight. It’s an introduction to the Metasploit Framework. In it, I focus on getting started quickly with using the framework. It’s a relatively short course (for me) at approximately two hours of content, including demonstrations. The course is called Metasploit: Getting Started. (Course Overview video)
I completed and published another course with Pluralsight. This time I was asked to create an introductory course for information security. It had to be high level. It had to be accessible to beginners that have little to no background in information security.
It is the lead course in the Survey of Information Security learning path. This path also contains my second penetration testing course, Penetration Testing: The Big Picture.
The objective of this course is to assist learners in understanding the foundational principles and the key concepts in security. I describe most of the program and management approaches from an organizational perspective. I used this method specifically so that learners can apply this knowledge to their current job and their organization.
I have another Pluralsight course published. Still focusing on penetration testing, I was asked to create a high level overview course on the subject. Penetration Testing: The Big Picture was published on October 6, 2017 and looks at a wide variety of topics on penetration testing.
The focus in this course is to present information about pen testing that would be useful to those interested in learning more about it as a career option or training direction. It can also be useful for individuals and organizations interested in hiring pen testers or organizations seeking pen testing services.
I developed the Pluralsight course Introduction to Penetration Testing Using Metasploit using Kali Linux, which is a project from Offensive Security. Kali is a Linux distribution with most of the tools an information security professional would need. It is also a great platform for designing courses around because most, if not all, of the tools needed are installed by default.
The challenge is that Kali changes over time. Most of the times those changes are good and necessary to stay current and relevant. Of course, those changes often negatively impact ancillary products and information resources, including instructional courses. My Metasploit course is no exception. Revising an existing course that is already in use has its own challenges. Instead, I offer this blog post as a “living document” highlighting changes in Kali Linux that impact my Metasploit course. My hope is that if you run into issues with the course due to changes in Kali, you can find the answers here.
Joe Colantonio and I had a conversation about penetration testing and the use of Metasploit on the Test Talks Podcast. That episode is available now.
Joe is a fellow Pluralsight Author and host of the Test Talks Podcast, which is a weekly podcast all about software test automation.
We discussed concepts in penetration testing, Metasploit and its auxiliary modules and OpenVAS for vulnerability scanning, Meterpreter for post-exploitation activities, ethics in the use of tools like Metasploit, and Kali Linux.
Check out this episode and other episodes from Joe Colantonio and the Test Talks Podcast.
After many months of effort, my first Pluralsight course, Introduction to Penetration Testing Using Metasploit is now available. Here is the official course description:
Metasploit is one of the most widely used tools for penetration testing, providing powerful attack simulations, security assessment management, and more. In this course, Introduction to Penetration Testing Using Metasploit, you’ll learn to use Metasploit to enumerate available services, identify potential weaknesses, test vulnerabilities through exploitation, and gather evidence for reporting. First, you’ll see how to install and configure the Metasploit Framework and several supporting tools on Kali Linux. Next, you’ll explore how exploits and payloads work together to gain access to systems. Finally, you’ll look at how Metasploit Framework releases are made available and how to maintain the latest version of the Framework. By the end of this course, you’ll have a better understanding of how to use Metasploit to quickly assess the security posture of systems and networks to reduce risk.
I received terrific support from the Pluralsight team in creating this course. They are very active in communicating, listening, and work with their authors. They have tools and a process for getting courses out the door. I was surprised by this attention to authors and to the details most of all.
I just switched my personal web site (this one) over to HTTPS using Let’s Encrypt. My long-time hosting provider, Dreamhost, added support for it recently (January 20, 2016). Both Let’s Encrypt and Dreamhost’s support for it are still considered Beta, but no issues here so far.
I have always wanted to have encrypted transmissions for my web site but did not want to spend the money to get the certificate and and possibly pay for the static IP. Thanks to Let’s Encrypt and Dreamhost’s support for it, it’s now possible.
Network Warrior, Second Edition
Gary A. Donahue
O’Reilly Media
I am an information security guy with a computer science degree. A good portion of my knowledge lies in operating system security and the interactions between systems. In college I took a computer science course in networking in which we delved into network fundamentals (packets, headers, protocols, etc.). However, most of it was focused on building network-enabled applications at the system call library level in the C programming language. We did not get to play with routers and switches, even though we knew how they worked, at least in theory. We assumed those components were there, were properly configured, and worked perfectly.
In my information security work, I have worked with small firewalls, software VPNs, IPS/IDS devices, VLANs and switches, and some other network components. I was able to figure out and configure most of that stuff out based on my fundamental knowledge of networking. However, I still didn’t have any exposure to enterprise-level switching and routing. Now I am a security architect and that is essential knowledge.
I got a free copy of the second edition of Network Warrior by Gary A. Donahue in early January 2016 through my membership to several O’Reilly Media mailing lists. This was a great opportunity to grow my knowledge of an area that I needed. It’s just over 1000 pages and packed full of useful information. It’s mostly about Cisco gear, but there are many chapters that focus on concepts that apply no matter what the vendor.
Here is a mini-review of what I found to be most helpful from an information security perspective.
Properties are an important part of determining and setting the configuration of ZFS storage systems. They can also be used to review the performance and usage of storage resources. Properties can be set at a top-level and inherited by child components when created. Understanding how ZFS properties are utilized is important to operating an efficient storage system.
In this article, we will explore how to properties work and how to get and set properties.
This article is one of a series of articles on ZFS. You can start at the beginning by creating a ZFS playground on which you can play.
The video of my TEDx talk for TEDxLafayette 2014, “City Full of Unmanned Vehicles” is available on Youtube. Previously, I posted the text of the talk.
In this talk, I lay out my vision for the use of unmanned and autonomous vehicles and their uses within city limits. There are many potential benefits in terms of public safety, disaster response, personal transportation, delivery and logistics. However, a balance is needed between safety and the ability of system developers to experiment and advance the technology in the environments in which these systems will be used. I explore many of these ideas in this TEDx Talk.
What do you think? In light of the proposed FAA regulations regarding unmanned aerial systems (released after my talk), did I present the issue with the right balance? Are unmanned and autonomous systems just too experimental at this point to be used in our cities?
I look forward to your comments.