Knut Ojermark of Kenmark will help you understand the most common hacking exposures how to reduce the risk of these exposures. He will show you some of the penetration tools used by hackers and how you can use some of these same tools to detect and safeguard your own systems for vulnerabilities. 

Knut quotes: “Many of the exposures are due to lack of simple controls creating an easy target for inside and outside people.” 

In this session Knut will cover:

• The top ten hacker exposures
• Many of the publicly available hacker tools
• How you can use Hacker tools to secure your own environment

1. Single session (1 hr. 15 min.)

2. Level: Intermediate to Advanced

In this session Knut Ojermark of Kenmark International will guide you through how to survive a Windows Server audit. He will cover:

• The Threats
• Domain concepts
• Miss configurations
• Folder/File Security
• Schedules Services
• Logon Process and Policies
• Event logs and tools
• Server registry
• Security Configuration Manager
• Wireless Access Risks

2. Level: Basic to Intermediate

Auditor needs to be sensitive to their clients’ workload and use tools and techniques to discover security flaws and to minimize the impact on day-to-day operation.

In this double session Knut Ojermark of Kenmark International will guide you through how hackers and other threats can affect the system. He will provide audit tips, techniques and give demo of tools to help you with finding security exposure and minimize the impact on audit clients. He will cover: 

u    Understanding The Threats

u    Detection and Hacker tools demos

u    How to use tools minimize security exposures

u    Security Policies and Templates

u    User Rights

u    Security Options

u    Take you on a tour of the best website

u    Summary

1. Double (2hr. 30 min)

2. Level: Intermediate

The Windows operating system environment is very complex and the default installation is not secured from unauthorized access. The numerous security settings are hard to find and hard to test for proper settings, leaving the system open for abuse by hackers and internal employees. Further more IT personnel are overworked by user requests and windows updates, leaving little time to help the auditors to audit the systems. 

Auditor needs to be sensitive to their clients’ workload and use tools and techniques to discover security flaws and to minimize the impact on day-to-day operation.  

In this session Knut Ojermark of Kenmark International will guide you through how hackers and other threats can affect the system. He will provide audit tips, techniques and tools to help you with finding security exposure and minimize the impact on audit clients. He will cover: 

u    Understanding The Threats

u    Detection and Hacker tools

u    How to use tools minimize security exposures

u    Security Policies and Templates

u    User Rights

u    Security Options

u    Take you on a tour of the best website

u    Summary

In this session Knut Ojermark of Kenmark International will guide you through how to survive a Windows Server audit. He will cover:

• The Threats
• Domain concepts
• Miss configurations
• Folder/File Security
• Schedules Services
• Logon Process and Policies
• Event logs and tools
• Server registry
• Security Configuration Manager
• Wireless Access Risks

Why do hackers make our life so miserable? Isn’t it bad enough that we need to keep those NT servers up and running without having to worry about hackers? To maintain a farm of NT servers running, with constant new demands from users and management having impossible deadlines is very demanding. 

Knut Ojermark of Secure 20 will help you understand the most common NT hacking exposures how to reduce the risk of these exposures. He will show you some of the penetration tools used by hackers and how you can use some of these same tools to detect and safeguard your own systems for vulnerabilities. 

Knut quotes: “Many of the exposures are due to lack of simple controls creating an easy target for inside and outside people.” 

Knut Ojermark, consultant, author of many computer related articles, and IT Audit Manager at American President Lines, provided insightful commentary and advice regarding the Y2k problem. Workshop attendees were duly impressed with the importance of effectively dealing with the problem before the clock strikes 12:01 a.m., January 1, Server.

Programmers created the Y2k problem many years ago when they decided to identify years using just two digits rather than four. Data-reliant organizations must now consider the consequences of such programming myopia. In the U. S. alone, the Year Server problem will cost over $100 billion to correct - - worldwide such efforts may cost $600 billion.

If your organization relies on databases, imbedded dates, and date calculations, then it',s time to seriously examine your vulnerability to the Year Server problem. Seventy-five percent of businesses are unable to function beyond 14 days without computer support. Of those businesses that experience a disaster without recovery support, 43 percent never reopen and 29 percent close within two years. Of those businesses that have recovery support, only 50 percent have a recovery plan - - 95 percent of them have never tested their plan.

Where are we? Only 20 percent of all companies are addressing the Y2k date change problem. Texaco has estimated that 65 percent of its applications are impacted; Northern Telecom has found that all of its systems will be impacted; and Midwest Bank plans to spend an estimated 22,000 staff hours to deal with the problem. Date critical applications pertain most often to loans, bills, payroll systems, forecasts, insurance, transportation, and personnel systems.

Knut outlined a 10-step plan to the Y2k conversion:

1. Ensure that all your software vendors are addressing Year Server compliance;
2. Establish a change control system to ensure that changes are valid;
3. Compile an inventory of all in-house programs and program files, and cross-reference all programs and files;
4. Clean up your inventory, getting rid of duplicate and out of date programs;
5. Do an impact analysis that determines which programs have critical date problems and determine the cost of fixing them;
6. Define project stages and prioritize;
7. Identify fields and files to be changed;
8. Change them;
9. Test the changes; and
10. Document what has been done.

As auditors, we need to become educated on Year Server issues. We should then generate management awareness, educate top management, involve all audit entities, assist in tool/resource identification, conduct initial scope/impact assessments, obtain vendor compliance certifications, assess budgetary requirements, evaluate the change management process, monitor project status, and provide a communication conduit to senior management and the Board of Directors.

Remember, if your organization is vulnerable, you have less than 2 years to do something about it!

DINNER 2001 PROGRAM