Codenomicon, the main focus of Ari's work is with security testing of various next generation communication technologies such as VoIP, WiMAX and IPTV. His latest book is focused on this topic, and is titled "Fuzzing for Software Security Testing and Quality Assurance". You can win a free copy of The Fuzzing Book from the Codenomicon web site. What is VoIP security all about? After close to ten years of hacking and bashing VoIP, Ari Takanen will finally reveal the secrets and discuss the hype around VoIP security. The discussions in this blog will draw from his book "Securing VoIP Networks: Threats, Vulnerabilities, and Countermeasures" co-authored by Peter Thermos, and published by Addison-Wesley. Ari will answer any questions and comments you might have regarding penetration testing and fuzzing of next generation communication networks such as IP telephony. Check out the sample chapter of the VoIP book here!" /> Ari Takanen | ITworld

Security: Secrets and Hype

RSS Link

The topics of this blog are in Fuzzing and VoIP security. As the CTO of Codenomicon, the main focus of Ari's work is with security testing of various next generation communication technologies such as VoIP, WiMAX and IPTV. His latest book is focused on this topic, and is titled "Fuzzing for Software Security Testing and Quality Assurance". You can win a free copy of The Fuzzing Book from the Codenomicon web site. What is VoIP security all about? After close to ten years of hacking and bashing VoIP, Ari Takanen will finally reveal the secrets and discuss the hype around VoIP security. The discussions in this blog will draw from his book "Securing VoIP Networks: Threats, Vulnerabilities, and Countermeasures" co-authored by Peter Thermos, and published by Addison-Wesley. Ari will answer any questions and comments you might have regarding penetration testing and fuzzing of next generation communication networks such as IP telephony. Check out the sample chapter of the VoIP book here!

by Ari Takanen

  • IPv6 Day: Time to think about security testing for IPv6

    Posted Jun 08, 2011 - 09:41 am

    Today, on Wednesday June 8th, we celebrate the World IPv6 Day. Although IPv6 itself is a big step towards more secure Internet, the transition from IPv4 to IPv6 is bound to also create new security, quality and interoperability challenges. IPv6 is not thoroughly tested because IPv6 has not been widely adapted. Read more to find out what you should do to prepare, or rather what you should have done already.

  • Vulnerability management: not just for scanning known vulnerabilities

    Posted Apr 08, 2011 - 03:16 pm

    Proactively searching and fixing the unknown zero-day vulnerabilities saves time and money for everyone. And it is easy! Proactive testing is the most effective form of vulnerability management, because the earlier vulnerabilities are discovered, the easier and cheaper it is to fix them. Do not wait for the hackers to find the vulnerabilities!

  • Security Testing: It Is About Coverage

    Posted Feb 01, 2010 - 07:19 pm

    It is easy to do pentetration testing. My two year daughter can do it (well at least she broke through a screen-lock). But doing it well is the challenge. That is what coverage is about. Security test coverage, like any test coverage, is measuring how much of all the possible sensible options you cover with your testing. Let's dig into this topic a bit more, and perhaps next time someone comes offering you pentesting services, you will have a few new questions to ask the auditors.

  • Vulnerability Disclosure: Is it Blackmail, Whitemail or Bluemail

    Posted Jul 23, 2009 - 04:25 pm

    Hackers (or security researchers) come with a range of rainbow colored hats. Some guys'n'gals are nice (the White Hats). They find and disclose problems in communication products using approved responsible disclosure models. Others are in the business for money, and are not satisfied by the fame they get for disclosing problems. The process can easily get close to what some would consider unethical, or even direct blackmailing.

  • What to Look in a Test Automation Product: Features or Benefits

    Posted Jul 20, 2009 - 12:10 pm

    The leap from manual tests or simple scripts into fully automated test suites makes all self-respecting test engineers just simply excited. It is difficult to see the limits to the things where test automation could be used. But hold on! Are you thinking straight? Why was it that you were looking for test automation in the first place?

  • Visualizing Security - The Challenge of 2009

    Posted May 20, 2009 - 08:53 am

    Have a look at all leading security companies today, and you see all of them launching or planning to launch solutions targeted at visualizing and collaborating over security issues. What is this about? Let's have a look at different initiatives in this area.

  • Fuzzing and Product Security

    Posted Mar 18, 2009 - 04:40 am

    Finally, some real data on the usage of fuzzing is emerging. Who is using fuzzing? How do people see fuzzing being used in the product security process? Forrester has included questions regarding use of fuzzing in to their questionnaire that they send to key industry CIOs, CSOs and CISOs. Security companies such as Cigital are publishing their findings. I have talked with these organizations and will be discussing my findings in this blog and the upcoming webinar.

  • Fuzzing Is Still Widely Unknown

    Posted Jan 19, 2009 - 10:18 am

    Based on a recent study by Gary McGraw and other well known security gurus, all major product security teams apparently use fuzzing. But most (even security specialists) still seem to misunderstand what fuzzing really is about. Enter the world of fuzzing!

  • Good VoIP Deployment Guidelines (Do Not Exist?)

    Posted Oct 23, 2008 - 08:27 am

    I get questions regarding VoIP deployment all the time. Sometimes it is someone looking for simple and cheap Enterprise VoIP, who are unsure if VoIP can be deployed securely with those two parameters in the equation. More often it is the security aware people who are willing to invest almost anything to make it work, but cannot. As always, there is no silver bullet solution for either. If you look at my past opinions, I keep changing my mind between cheap that works, and secure that doesn't. What do you think? Which way should we go in VoIP?

  • VoIP Still Not Ready For Carrier-Grade Networks

    Posted Oct 02, 2008 - 01:22 pm

    After a quick tour of some Really Talented Groups dedicated to fuzzing research, I noticed three things: 1) Most teams are focused on fuzzing VoIP 2) Most if not all VoIP devices still break with fuzzing 3) Most VoIP vendors still do not get it. The tour continues...
Join us:
Facebook

Twitter

Pinterest

Tumblr

LinkedIn

Google+

Join today!

See more content

Answers - Powered by ITworld

ITworld Answers helps you solve problems and share expertise. Ask a question or take a crack at answering the new questions below.

How to use time machine to restore a partition in OS X Mountain Lion?
0 answers
Is the Facebook phone a failure?
0 answers
How do you prevent default script attacks?
2 answers
More questions

Security: Secrets and Hype Archive

See all blogs
2011
June (1)
April (1)
2010
February (1)
2009
July (2)
May (1)
March (1)
January (1)
2008
October (2)
September (2)
August (1)
Ask a Question