iOS app security for incident handlers

FIRST Hands-On Classes

Thursday — January 31st, 2013 09:30

Thursday — January 31st, 2013 14:15

What should incident handlers know about iOS security? That depends on the CSIRT's mission, of course, but this class is intended to provide the incident handler with a rapid immersion into iOS app security. We look at iOS platform architectural features that support (or restrict) security, and work through common security weaknesses found in today's iOS apps.

Requirements

For this class, students will NEED to provide their own Apple OS X (either on a Mac or a virtual machine), with Apple's Xcode software development kit installed and operational. For OS X, Mountain Lion is preferred, although anything newer than Snow Leopard should be adequate. For Xcode, the latest version (4.5) is recommended, although anything in the 4.x family should be adequate.

Presenters

• Ken Van Wyk (KRvW Associates, LLC)

  Ken is a CERT® Certified Computer Security Incident Handler, as well as an internationally recognized information security expert and author of the popular O'Reilly and Associates books, Incident Response and Secure Coding: Principles and Practices, as well as a monthly columnist for Computerworld. Among his numerous professional roles, Ken is a Visiting Scientist at the Software Engineering Institute at Carnegie Mellon University, where he is a course instructor and consultant to the CERT® Coordination Center.

  Ken has previously held senior information security technologist roles at Tekmark's Technology Risk Management practice, Para-Protect Services, Inc., and Science Applications International Corporation (SAIC). Ken was also the Operations Chief for the U.S. Defense Information Systems Agency's DoD-CERT incident response team, as well as a founding employee of the CERT® Coordination Center at Carnegie Mellon University's Software Engineering Institute.

  Ken has previously served as the Chairman and as a member of the Steering Committee for the Forum of Incident Response and Security Teams (FIRST), a non-profit professional organization supporting the incident response community. He currently sits on their Steering Committee and Board of Directors. He holds a mechanical engineering degree from Lehigh University and is a frequent speaker at technical conferences, including S3, CSI, ISF, and others FIRST.