Jeremy Rasmussen's guest appearances

Jeremy Rasmussen

CERIAS Weekly Security Seminar - Purdue University

Modules Unraveled Podcast

Ryan Henry

Adam Hill

Cory Doctorow

Doug Smith

Larry Ponemon

George Heron

Laura Thomas

Eli Lilly

Stephen Elliott

Tony Sager

Matt Smith

David Carroll

Jack Daniel

Joe Judge

Chris Reed

OwlTail

During the height of the pandemic, it's estimated that digital transformation advanced by as much as seven years, opening the door for hybrid and remote working solutions to thrive. But, the increase in remote work also revealed new threats to devices and applications. In this session, we will discuss:• The post-COVID world and "Zero Trust"• Trusted software becoming less trustworthy• The surprising ways ransomware launches• Identifying Web/SSL VPN vulnerabilities in firewalls• Application of AI and ML in cybersecurity• Countermeasures used to combat these issues About the speaker: Jeremy Rasmussen is a Cybersecurity Expert (Military, Defense, and Private Sector) with 24+ years of experience in developing secure communications systems and providing cybersecurity consulting services throughout the world. Jeremy graduated from college with a Bachelor of Science degree in Computer Science, and holds a Master's Degree in Engineering Management, both from the University of South Florida. Jeremy is also a certified CISSP and White-Hat Ethical Hacker.

During the height of the pandemic, it's estimated that digital transformation advanced by as much as seven years, opening the door for hybrid and remote working solutions to thrive. But, the increase in remote work also revealed new threats to devices and applications. In this session, we will discuss:• The post-COVID world and "Zero Trust"• Trusted software becoming less trustworthy• The surprising ways ransomware launches• Identifying Web/SSL VPN vulnerabilities in firewalls• Application of AI and ML in cybersecurity• Countermeasures used to combat these issues About the speaker: Jeremy Rasmussen is a Cybersecurity Expert (Military, Defense, and Private Sector) with 24+ years of experience in developing secure communications systems and providing cybersecurity consulting services throughout the world. Jeremy graduated from college with a Bachelor of Science degree in Computer Science, and holds a Master's Degree in Engineering Management, both from the University of South Florida. Jeremy is also a certified CISSP and White-Hat Ethical Hacker.

Jeremy Rasmussen, The Changing Cybersecurity Threatscape

## Project   It’s easier than you think to publish your module on Drupal.org. This is my experience going through the entire process. Sharing this experience I hope to convince you and others to do the same. Contributing back to the community that gives all of us so much, to many of us our livelihood.    * When Doug first recommended that I talk to you about this, I wasn’t really thrilled. But, I took a look at your slides, and thought that it actually looked like really good information. So, what made you decide to put together a presentation on the project application process in the first place? My “Why” Finally published a module to help solve my own problem My project that took me through this process is Display Suite Extra Layouts https://www.drupal.org/project/ds_extra_layouts Projects don’t have to be the 100% perfect solve for everyone, everywhere It’s more about: Giving back, centralizing code, helping others make great projects too.   * So what are the steps to getting a project reviewed and accepted? Where to start and basically the entire guide to submitting a module “Apply for permissions to create full projects” https://www.drupal.org/node/1011698 Some things to know One time process Reviews are primarily by your peers Learns/reiterates code standards and best practices Do your Research First Check if your idea exists already Combine efforts where you can Volunteer as a co-maintainer where needed   * Okay, let’s get down to the nitty-gritty. What are the technical steps you need to follow to get your project approved? Setup Git Access Learn some Git basics Google is your friend Github &amp; Code School’s tutorial http://try.github.io Setup your Git Access in your D.o profile Basically just need to add an SSH key Instructions here: https://www.drupal.org/node/1047190 Sandboxes With Git access setup you can now create sandboxes or “experimental” projects Instructions here: https://www.drupal.org/node/1011196 Take advantage of these, having a commit history of changes is a good thing. Use sandboxes to get your code “production ready” The Checklist (Pre-Application) Before starting the application make sure you run through the checklist Setup Readme, Git Branches, well commented, etc... Link to checklist: https://www.drupal.org/node/1587704 The process goes much much faster, many people skip it PA Review Bonus Part of the checklist asks you to run your sandbox through a bot. Catches the majority of problems. You can setup your own Review Bot  https://www.drupal.org/project/pareviewsh http://pareview.sh/ “Full Stop” - Took me a while to figure that out. You get a review bonus when everything is fixed. The Application https://www.drupal.org/project/issues/projectapplications READ THE DIRECTIONS! In the title include core version: [D7] Write a Clear Descriptions… can be the same as your project/sandbox page Clear descriptions help people understand better the purpose of your project Provide links to your Sandbox, the Git clone command, and PA Review When you are ready set the status to “Needs Review”      * I noticed when I looked through your slides that you mentioned reviewing other projects as a part of this. Why is that needed? Reviewing other projects You must review at least 3 other people’s projects Post a link to your reviews in your own project application It’s just like trying a new module. Download it, enable it, try it Report back your findings… good, bad, and suggestions I learned a lot from doing this Now you wait. Others will review your project and post feedback. be prompt to fix issues Once all is well someone should mark your project “Reviewed and Tested by the Community” Then you wait for someone with the “Power” to grant you full project status   * Once someone has approved your project, what’s involved with getting the official project page setup? Into the Wild! You can now create your project page be mindful of your project URL, you can’t change it Create a new release on your project page and in Git Creating a release: https://www.drupal.org/node/1068944 Tag Nameing Convention: https://www.drupal.org/node/1015226 FIN.   ## Questions from Twitter * [timani.co.zw](http://twitter.com/timani_net) Will this cover D.O vs github for projects? Pros &amp; cons of staying with current design vs migrating to github? * [Joshua Turton](http://twitter.com/sjinteractive) #MUP117 When are we going to see movement on the project application issue queue? * [Joshua Turton](http://twitter.com/sjinteractive) #MUP117 process seems broken - have to apply... but once past "quality control" you can release any junk u want. * [Joshua Turton](http://twitter.com/sjinteractive) #MUP117 Also: encouraged to review others to boost your app's priority, but why would we trust reviews from users who haven't passed through process? (speaking of high priority list/review bonuses)

## Project It’s easier than you think to publish your module on <a href="http://Drupal.org" rel="nofollow" target="_blank">Drupal.org</a>. This is my experience going through the entire process. Sharing this experience I hope to convince you and others to do the same. Contributing back to the community that gives all of us so much, to many of us our livelihood.  * When Doug first recommended that I talk to you about this, I wasn’t really thrilled. But, I took a look at your slides, and thought that it actually looked like really good information. So, what made you decide to put together a presentation on the project application process in the first place? My “Why” Finally published a module to help solve my own problem My project that took me through this process is Display Suite Extra Layouts <a href="https://www.drupal.org/project/ds_extra_layouts" rel="nofollow" target="_blank">https://www.drupal.org/project/ds_extra_layouts</a> Projects don’t have to be the 100% perfect solve for everyone, everywhere It’s more about: Giving back, centralizing code, helping others make great projects too. * So what are the steps to getting a project reviewed and accepted? Where to start and basically the entire guide to submitting a module “Apply for permissions to create full projects” <a href="https://www.drupal.org/node/1011698" rel="nofollow" target="_blank">https://www.drupal.org/node/1011698</a> Some things to know One time process Reviews are primarily by your peers Learns/reiterates code standards and best practices Do your Research First Check if your idea exists already Combine efforts where you can Volunteer as a co-maintainer where needed * Okay, let’s get down to the nitty-gritty. What are the technical steps you need to follow to get your project approved? Setup Git Access Learn some Git basics Google is your friend Github &amp; Code School’s tutorial <a href="http://try.github.io" rel="nofollow" target="_blank">http://try.github.io</a> Setup your Git Access in your D.o profile Basically just need to add an SSH key Instructions here: <a href="https://www.drupal.org/node/1047190" rel="nofollow" target="_blank">https://www.drupal.org/node/1047190</a> Sandboxes With Git access setup you can now create sandboxes or “experimental” projects Instructions here: <a href="https://www.drupal.org/node/1011196" rel="nofollow" target="_blank">https://www.drupal.org/node/1011196</a> Take advantage of these, having a commit history of changes is a good thing. Use sandboxes to get your code “production ready” The Checklist (Pre-Application) Before starting the application make sure you run through the checklist Setup Readme, Git Branches, well commented, etc... Link to checklist: <a href="https://www.drupal.org/node/1587704" rel="nofollow" target="_blank">https://www.drupal.org/node/1587704</a> The process goes much much faster, many people skip it PA Review Bonus Part of the checklist asks you to run your sandbox through a bot. Catches the majority of problems. You can setup your own Review Bot  <a href="https://www.drupal.org/project/pareviewsh" rel="nofollow" target="_blank">https://www.drupal.org/project/pareviewsh</a> <a href="http://pareview.sh/" rel="nofollow" target="_blank">http://pareview.sh/</a> “Full Stop” - Took me a while to figure that out. You get a review bonus when everything is fixed. The Application <a href="https://www.drupal.org/project/issues/projectapplications" rel="nofollow" target="_blank">https://www.drupal.org/project/issues/projectapplications</a> READ THE DIRECTIONS! In the title include core version: [D7] Write a Clear Descriptions… can be the same as your project/sandbox page Clear descriptions help people understand better the purpose of your project Provide links to your Sandbox, the Git clone command, and PA Review When you are ready set the status to “Needs Review” * I noticed when I looked through your slides that you mentioned reviewing other projects as a part of this. Why is that needed? Reviewing other projects You must review at least 3 other people’s projects Post a link to your reviews in your own project application It’s just like trying a new module. Download it, enable it, try it Report back your findings… good, bad, and suggestions I learned a lot from doing this Now you wait. Others will review your project and post feedback. be prompt to fix issues Once all is well someone should mark your project “Reviewed and Tested by the Community” Then you wait for someone with the “Power” to grant you full project status * Once someone has approved your project, what’s involved with getting the official project page setup? Into the Wild! You can now create your project page be mindful of your project URL, you can’t change it Create a new release on your project page and in Git Creating a release: <a href="https://www.drupal.org/node/1068944" rel="nofollow" target="_blank">https://www.drupal.org/node/1068944</a> Tag Nameing Convention: <a href="https://www.drupal.org/node/1015226" rel="nofollow" target="_blank">https://www.drupal.org/node/1015226</a> FIN. ## Questions from Twitter * [<a href="http://timani.co.zw" rel="nofollow" target="_blank">timani.co.zw</a>](<a href="http://twitter.com/timani_net" rel="nofollow" target="_blank">http://twitter.com/timani_net</a>) Will this cover D.O vs github for projects? Pros &amp; cons of staying with current design vs migrating to github? * [Joshua Turton](<a href="http://twitter.com/sjinteractive" rel="nofollow" target="_blank">http://twitter.com/sjinteractive</a>) #MUP117 When are we going to see movement on the project application issue queue? * [Joshua Turton](<a href="http://twitter.com/sjinteractive" rel="nofollow" target="_blank">http://twitter.com/sjinteractive</a>) #MUP117 process seems broken - have to apply... but once past "quality control" you can release any junk u want. * [Joshua Turton](<a href="http://twitter.com/sjinteractive" rel="nofollow" target="_blank">http://twitter.com/sjinteractive</a>) #MUP117 Also: encouraged to review others to boost your app's priority, but why would we trust reviews from users who haven't passed through process? (speaking of high priority list/review bonuses)

117 The Drupal Project Application Process with Jeremy Rasmussen - Modules Unraveled Podcast

In the course of doing security vulnerability testing for government and commercial clients over the past 10 years, our Information Security Solutions team at Sypris Electronics has seen a lot of interesting things—perhaps none more so than a recent attack witnessed on a client's network targeted by a buffer overflow on a popular application.  The attack launched a trojan horse, which then dropped in another piece of malware that stealthily connected out to several sites to receive command and control.  We will go down the rabbit hole with the attack (as much as I can publicly divulge), talk about our approach to the forensic investigation, and how the client was advised to implement countermeasures to provide an overall framework of security against future attacks.It is possible people may have known about this particular exploit for more than six months before it was publicly disclosed, and the vendor still has not published a patch for it.  Therefore, in this talk, we will also explore the concept of responsible disclosure, information sharing (minus attribution), and how all of this possibly fits into the Presidential Comprehensive National Cybersecurity Initiative (CNCI). About the speaker: Jeremy Rasmussen is manager of the Information Security Solutions (ISS) group at Sypris Electronics, LLC in Tampa Florida.  Sypris is an industry leader with more than 40 years of success in complex electronics manufacturing and engineering products and services for defense and aerospace.  Mr. Rasmussen earned a B.S. in Computer Science (1991) and M.S. in Engineering Management (1994) from the University of South Florida (USF).  He had experience as a software and systems engineer at Honeywell, Raytheon, and Sypris Electronics before founding the ISS group in 1999. The ISS group specializes in system vulnerability assessments, penetration testing, policy and procedure development, and security training. The ISS group has performed assessments on more than 200 different systems ranging from a small, tactical unit in the back of a Humvee to a 350,000-user WAN spanning 54 states and territories.  The team continues to grow in areas targeting penetration testing, automated compliance scanning tools, and products/technologies related to the Presidential Comprehensive National Cybersecurity Initiative (CNCI).Mr. Rasmussen is an adjunct professor in the Department of Computer Science and Engineering and Department of Information Technology at USF, teaching courses in cryptography and network security, digital forensics, and ethical hacking. He also serves as chairman of the CS&amp;E External Advisory Board. He founded the Whitehatters Computer Security Club at USF, and the team has done very well in organized Capture the Flag events, even reaching the 2007 finals of the Defcon CtF—considered the world championship of hacking. In his spare time, Mr. Rasmussen enjoys family activities, soccer, taekwondo, teaching Sunday School, traveling, and writing.  He has written several articles on "Password Security", including those for the Encyclopedia of the Internet and the Handbook of Information Security. Mr. Rasmussen was also a Jeopardy! champion in 2007.Email: Jeremy_dot_Rasmussen_at_Sypris_dot_com

In the course of doing security vulnerability testing for government and commercial clients over the past 10 years, our Information Security Solutions team at Sypris Electronics has seen a lot of interesting things—perhaps none more so than a recent attack witnessed on a client's network targeted by a buffer overflow on a popular application. The attack launched a trojan horse, which then dropped in another piece of malware that stealthily connected out to several sites to receive command and control. We will go down the rabbit hole with the attack (as much as I can publicly divulge), talk about our approach to the forensic investigation, and how the client was advised to implement countermeasures to provide an overall framework of security against future <a href="http://attacks.It" rel="nofollow" target="_blank">attacks.It</a> is possible people may have known about this particular exploit for more than six months before it was publicly disclosed, and the vendor still has not published a patch for it. Therefore, in this talk, we will also explore the concept of responsible disclosure, information sharing (minus attribution), and how all of this possibly fits into the Presidential Comprehensive National Cybersecurity Initiative (CNCI). About the speaker: Jeremy Rasmussen is manager of the Information Security Solutions (ISS) group at Sypris Electronics, LLC in Tampa Florida. Sypris is an industry leader with more than 40 years of success in complex electronics manufacturing and engineering products and services for defense and aerospace. Mr. Rasmussen earned a B.S. in Computer Science (1991) and M.S. in Engineering Management (1994) from the University of South Florida (USF). He had experience as a software and systems engineer at Honeywell, Raytheon, and Sypris Electronics before founding the ISS group in 1999. The ISS group specializes in system vulnerability assessments, penetration testing, policy and procedure development, and security training. The ISS group has performed assessments on more than 200 different systems ranging from a small, tactical unit in the back of a Humvee to a 350,000-user WAN spanning 54 states and territories. The team continues to grow in areas targeting penetration testing, automated compliance scanning tools, and products/technologies related to the Presidential Comprehensive National Cybersecurity Initiative (CNCI).Mr. Rasmussen is an adjunct professor in the Department of Computer Science and Engineering and Department of Information Technology at USF, teaching courses in cryptography and network security, digital forensics, and ethical hacking. He also serves as chairman of the CS&amp;E External Advisory Board. He founded the Whitehatters Computer Security Club at USF, and the team has done very well in organized Capture the Flag events, even reaching the 2007 finals of the Defcon CtF—considered the world championship of hacking. In his spare time, Mr. Rasmussen enjoys family activities, soccer, taekwondo, teaching Sunday School, traveling, and writing. He has written several articles on "Password Security", including those for the Encyclopedia of the Internet and the Handbook of Information Security. Mr. Rasmussen was also a Jeopardy! champion in 2007.Email: Jeremy_dot_Rasmussen_at_Sypris_dot_com