Marjorie Furay: Hello and welcome everyone.
Marjorie Furay: To master class tonight, on May 11th, 2023.
Marjorie Furay: We have 4 presenters this evening and looking forward to hearing.
Marjorie Furay: These topics are going to be great. I did put it in the agenda. I will fix it because we added one more Abimbola. We'll go ahead and do his two at the end, but we will start tonight with Alexander Montgomery if you're ready.
Alexander Montgomery: Awesome. Yep. Ready and willing.
Alexander Montgomery: All right. So this week, let me get this correct screen shared.
Alexander Montgomery: I'll be talking about one of my favorite agile ideologies, extreme programming and agile itself.
Alexander Montgomery: So agile programming. I sorry. Extreme programming and agile both started roughly in the late 90s and and the name is very descriptive if you think extreme at you're definitely going to think back to the 90s. The idea of extreme programming and agile was how do we remove a lot of the process and wait around software development and really focus on the core ideologies. So they ended up saying that simplicity, communication, feedback, respect and courage were really the best attributes for building the best software possible XP.
Alexander Montgomery: Is agile subset, which means it focuses on delivering a working software in short iterations and adapting to these changes requirements as quickly as possible. Working software above documentation and people above processes really agile compressed to one liner.
Alexander Montgomery: XP encourages the use of coding standards and practices, is like refactoring and code reviews and collective code ownership to really focus on code quality and reduce technical debt. Overall, the diagram on the right would be a kind of perspective flow on how you would go about prioritizing communication of working on a feature and actually talking working together.
Alexander Montgomery: So the agile methodology was developed in the early 2000s as an alternate to traditional project management and software methods development methodologies.
Alexander Montgomery: And there were earlier reports of people that had claimed to develop agile. GE was actually one of the first. That said that they developed the agile ideologies when they were contracted to build out the bullet trains for Japan. And post will work too. Their idea was remove all process, remove all documentation and really let the engineers try to build the best thing that they could build. The engineer said you can't run a train at 200 miles an hour. Why? Well, because we have to take turns. Well, we did. We tell you have to take turns.
Alexander Montgomery: And just that constant iteration to make improvements that ultimately resulted in the products being the best that it could.
Alexander Montgomery: Agile emphasizes delivering working as software and short iterations like with XP usually lasting from one to four weeks, typically refer to as a Sprint. Two seems to be the sweet spot in most organizations.
Alexander Montgomery: Adam Curtis, very close collaboration between developers, customers and stakeholders, usually through daily standup meetings and regular retrospectives. The reason they call them stand up meetings is usually at the beginning of each meeting. You will stand up. You don't want to be standing up for too long, so you keep it nice, short and sweet on a daily basis.
Alexander Montgomery: Edu you places more value to change an existing plan and encourages teams to be able to be more flexible and adaptable in the face of the changing requirement. If you have a waterfall Esque project and you try to change things in the 11th hour, it's not really going to be a good time. Agile is built with that in mind where you kind of can pivot on a dime if you're business objective no longer matches your ultimate need. I Angela uses techniques such as user stories, product backlogs and Sprint planning to help manage them, prioritize work to make sure the most valuable features are delivered first.
Alexander Montgomery: So experience program is a subset of agile, but what really is the different pieces and extreme programming is a lot more specific. It's kind of a tech conditions, agile where it's very precise and how you should go about your regular operations. While Agile itself is a much broader term, it also includes more common versions of agile, Extreme or Kanban or scrumban XP.
Alexander Montgomery: App in Energy uses a specific practices such as pair programming, TDD and continuous integration as a requirement. While Agile doesn't really specify, but really emphasizes just a set of values and principles.
Alexander Montgomery: And XP has a much stronger emphasis on technical practices such as coding standards, linting practices. And while agile, once again really just has that kind of 10,000 foot view saying you should collaborate, you should communicate, but not really strong requirements on how or why.
Alexander Montgomery: A customer of Almet is at the forefront of XP, just about as close as it is with TDD. Putting that strong focus on you, working with your customer directly on a daily basis.
Alexander Montgomery: Uh, with and then practices such as frequent releases and user acceptance testing. Well, agile doesn't really specify customer involvement precisely. It recommends you work with your customer, but any kind of hard rule does not exist. And lastly, team sizes XP is often used in smaller, tighter knit teams. The the two pizza rule, while Agile can be used in teams of various sizes. The two pizza rule for those aren't familiar is you never really have more people in a team or meeting than what you could.
Alexander Montgomery: Comfortably feed with two medium pizzas that keeps collaboration and communication at its peak, and pinnacle sounds silly, but I swear swear works.
Alexander Montgomery: Testing an XP in the emphasis so XP is really built around having the testing first, so it's one of the only methodologies that specifies rather than coding a ucode up your project, you check with the with the PO you check with a stakeholder and then eventually down the road you write some documentation and test. Rather the testing comes first, you write your test before you write your code and you use your test to validate that your code is working properly so you end up in a situation where you catch a lot more bugs and errors on the well. What they typically refer to as shifting left.
Alexander Montgomery: I getting it in the dev side or getting in the IDE or in ECI which helps improve software quality and reduce the total likely so reduce the total likelihood of a defect after the fact.
Alexander Montgomery: Continuous air feedback. So you want to have your unit test at any kind of testing quality features baked into the code. So in a compiled environment you say like C# or CC Java, you want it to fail a build if your test are not passing, you should be able to check it thoroughly and completely each and every time so that feedback helps developers make their adjustments before they actually check it in before it gets in the main before it gets in the release.
Alexander Montgomery: Uh and collaboration, XMPP sizes, collaboration, communication between developers, customers and other stakeholders. It's at the very core of its of foundational fundamentals and testing is considered that key part of collaboration by involving your customers and testing and helping.
Alexander Montgomery: You know, I cannot speak tonight. Everything every access to working software developers can get feedback and input that can help guide the development process. The goal of agile is to get code in front of them as quickly as possible. Your MVP's to help them guide the product so you don't end up in a situation where you've built something for three months. The customer finally sees it and they are not happy and you're back to square one. And then lastly, that testing emphasis has that increased confidence by testing as thoroughly as possible. Developers can have a greater confidence their code and in the final product.
Alexander Montgomery: The confidence can really help team morale and can lead to greater customer satisfaction to the product. No one wants to own the monolith that can't deploy properly or has tons of problems. It's hard to kind of be proud of that kind of a product, but if you're building something that really doesn't have a lot of defects, it it works. It works well. There's just a sense of pride there.
Alexander Montgomery: So for those that aren't familiar, on the right is the agile testing pyramid, so your unit tests are your quick, easy, dirty tests. They are the closest to the code. They can provide logic checks and they can be run extremely quickly. Above that you have your service test, so your integration or service to service test. So say your application is making a call to say the FedEx APIs. So this would be a test that starts your application, pings the FedEx API and then checks that your service.
Alexander Montgomery: A can call it successfully that office working that the payloads at match correctly and do as many checks as they can as it can there and lastly UI or E to E test or end to end. Those are your most expensive tests but they do provide probably the most value where those E to E tests would be. You have UI, you have your API, you turn everything on through the UI, it automatically will submit you know say a form or something similar and you will go through API run through all the logic flows and then you double check the output in the UI.
Alexander Montgomery: There's the most expensive because you have to turn on the most things, but they do provide the highest grade of check to make sure that everything is working efficiently by following that pyramid, you can really get to a really strong suite when you integrate it with the idea of continuous integration or CI. Ci is the first half of the common DevOps mantra, CI CD, Constant integration, constant deployment, constant integration. So you pretty much every time you're submitting code back to your repository, you're running through all three suites of those tests.
Alexander Montgomery: You first you run your unit test to figure out there's any logic bugs in your code. Second, you check your service test, make your application starts, and finally you run those Ede tests.
Alexander Montgomery: By providing and following that pier, that testing pyramid, you ultimately end up in situation to have a faster feedback loop. You have increased product quality and improved efficiency in terms of how much time you're fighting defects down the road, easier collaboration because it's easy to see whether or not a team member's code is going to work. Did it break the existing test? Is it stable, so and so forth? And lastly, greater confidence that you're always in a situation where you were sure that your code is building on a machine that is not yours.
Alexander Montgomery: And it is stable.
Alexander Montgomery: The other main core concept that I love in extreme programming is the code ownership aspect O.
Alexander Montgomery: It's kind of funny, umm, a couple of years after I joined a strong agile shop, I stopped using the term I. It was never I wrote. It was never. I worked on this. It was my team did this. It's a side effect of ultimately being full, completely, completely responsible for everything that my team did. And meanwhile they were in the same situation rather than individual responsibility. If your team had an issue, if your team software failed, it is not that person's.
Alexander Montgomery: Fault. It's not your team members fault. It is our fault and that shared responsibility ultimately kind of keeps everybody in check. It makes everyone responsible for maybe quality and maintainability of the code that goes out.
Alexander Montgomery: Uh XP also emphasizes code reviews, which, if you're familiar with Polar request, you will submit what you believe to be a change as set. You'll run all your tests. Sci will see whether or not anything was broken in that time. Does it build? Does it pass all of its individual Edu test?
Alexander Montgomery: And this assures that every time you're merging back and forth between team members.
Alexander Montgomery: You never really have to worry that you're going to be breaking something or changing something that ultimately breaks someone else. Now you've got this consistency in terms of review.
Alexander Montgomery: And then lastly, pair programming, which is one of my absolute favorite concepts of XP, is that you get together with your devs and you sit down two or three or more and you go and work together on a single problem. You bounce your ideas off of them and what ultimately comes out of that is way higher quality code and it promotes knowledge sharing and to make sure that no one gets individually siloed in a particular project as your entire team is up to date on and can work on any part of your application stack pre COVID.
Alexander Montgomery: It was one of my favorite things to do. I had two keyboards available in my desk at anytime at any given point. If someone had a problem, I would have them commit their stuff up to source control in a branch. They would come over, I'd clone it down. You'd have two keyboards and he worked it out. The ultimate rubber duck program.
Alexander Montgomery: Customer involvement nexp so XP emphasizes the importance of working directly with your customer, so rather than going through a product owner, you are working with the end client, the end user.
Alexander Montgomery: And this customer is involved in the development process from the very start. They are one of the primary stakeholders and they work closely with the development team to provide feedback on the product as it's being developed. One of my favorite things to do when I had a new new dev starting the company intern through a senior, I would have them go spend a week with the actual client team.
Alexander Montgomery: They would be trained as if they were going to be joining that group and when they came out of that, they were in such a strong position to know what the software needed to do. No amount of documentation or kind of throwing words at them would have been able to compensate for actually training them on the software itself as if they were going to be an end user.
Alexander Montgomery: User stories is one of the other ways to extreme programming can help capture requirements from the perspective of the end user. These stories are used to drive the development and or kind of written in collaboration with customer to ensure they accurately reflect the needs of the user so they would be phrased something akin to as a dev. As a product owner as a manager, as a client, and I want to see XY and Z and you would explain the reasons why I want to see XY and ZI need XY and Z to fill in these reports.
Alexander Montgomery: Uh, and that would then ultimately be able to put you in the mindset to be able to better deliver because especially within waterfall projects or large specs, it's hard to jump into the visualization of those users of what they actually need to really see why they need something, not just what they think that they need, but why they need it.
Alexander Montgomery: The planning phase, so XP uses a game to help the development team and customers work together to plan the the development iteration. This game ultimately is done on a regular period of time to prioritize the stories for each piece.
Alexander Montgomery: Am usually what we would do is we would play Tetris with each of the individual projects. So we would say OK, this has the highest weight. This kind of shape and actually kind of work our way down so that you could see how something that is high value low like low cost versus your high cost low values and you'll be able to see how much you could pack in a three month period and get the best results there.
Alexander Montgomery: Continuous feedback, so really does emphasize the importance of hearing back from the customer on a regular basis. And this can kind of manifest in a weekly review or a demo of each individual feature so that the client always is seeing that value which goes into the next piece which is incremental development. You want to take a small individual win, something that delivers back to the user where they can get some feature and deliver that as frequently as possible. Big Bang releases are awesome because you can have everything go out the same door. You can do all your quality checks.
Alexander Montgomery: But the user no longer sees that continuous value of having you on that team, O having incremental development where you're working on small pieces of the features and then innovating off of them ultimately results in a much more stable and much happier client.
Alexander Montgomery: In conclusion, agile and XP both focus on flexibility, collaboration that itera developments, continuous integration, customer focus and rapid delivery. The two together are extremely powerful and in certain circumstances and in most cases it is one of the better project management frameworks to use. There are a couple constraints in cases like government or cases where you have to have a very rigid development process that agile is not really built for, but for anything in the actual open market.
Alexander Montgomery: It is an absolute savior for software. If you were curious about it, there are two guys that I would almost hold is that idle status, Martin Fowler and Robert C Martin, both those names. If you're not familiar with them, you should definitely check them out. Martin Fowler is one of the original authors of the Agile Manifesto and has some of the better ideas. The testing pyramid actually came from a lot of his development and then Robert C Martin or Uncle Bob is a one of the pinnacles and pillars of software engineering.
Alexander Montgomery: And development he is the author of the Clean Code Series and is considered one of the more respected proponents of extreme programming.
Alexander Montgomery: Alright, alright. Thank you guys so much. Is there any questions?
Marjorie Furay: Excellent job.
Marjorie Furay: I wasn't aware of a lot of this.
Alexander Montgomery: Yeah, I've been using agile for most of my professional career, and everywhere except for the DoD. And honestly, I if you do extreme programming right, you'll never want to do anything else.
Marjorie Furay: Wow, that's interesting. See, there's always a good topic. Learn something new.
Marjorie Furay: Excellent job.
Alexander Montgomery: Alright, it doesn't sound like any questions if you guys have any follow-ups, just feel free to reach out. Thank you so much and a special thank you to Jonathan. His talk last week inspired me to go with this particular topic.
Marjorie Furay: Ah yes.
Marjorie Furay: Yep, very good.
Marjorie Furay: OK.
Marjorie Furay: We'll stay in the line of Alexander and see if Alexander Vance is ready.
Alexander Vance: Yeah. Could you guys hear me?
Marjorie Furay: Yes.
Alexander Vance: I'm going to share my screen.
Alexander Vance: Alright, so my master class is on. The man in the middle and ARP spoofing attack.
Alexander Vance: Table contacts a few things I'm gonna cover is what is a man in the middle attack? What is ARP spoofing? I'm gonna do a demo on how to execute this type of attack and then kind of talk about how to prevent a man in the middle attack.
Alexander Vance: The what is a man in the middle attack and attack in which an attacker is positioned between two communicating parties in order to intercept and or alter data traveling between them. So I believe most people think of a rogue access point or an evil twin when thinking about a man in the middle attack, a rogue access point is when an unauthorized access point is installed on an existing network. An example of this would be in if an employee or tacker connects a router to an unsecured network port and an office or cubicle.
Alexander Vance: And then uses that uh wireless access point to gain access to the company network, an evil twin is when you use the name of a existing SSID to kind of trick or social engineer a victim to connecting to that network instead of the real network. You often see this done with Wi-Fi pineapples or Wi-Fi. Coconuts for all my Silicon Valley TV show fans, there was a great episode where they used a bunch of Wi-Fi panicles to launch a man in the middle attack.
Alexander Vance: Against hundreds of people at a tech convention.
Alexander Vance: What is ARP spoofing?
Alexander Vance: I just resolution protocol spoofing or ARP poisoning is a form of a spoofing attack where hackers that hackers use to intercept data. A hacker commits an ARP spoofing attack by tricking 1 device into sending messages to the hacker instead of the intended recipient. So art shooting is just one of the types of attack you can launch after successfully executing a man in the middle attack. During my demo I'm going to use ARP spoofing to redirect traffic from the victims PC to a fake website.
Alexander Vance: Using a website template that already exists. While I will then capture their login credentials.
Alexander Vance: But this demo is not to teach you how to launch a man in middle attack, but to show you how easy it is and give recommendations on simple security measures you could take to prevent it. I used to think that someone would try to hack someone else's Wi-Fi just to get free Wi-Fi. You also hear about not using open Wi-Fi networks because you could be hacked, but who really knows how to do that? I'm not going to assume that there's a hacker that shares the same coffee shop that I do, so why should I be worried? These are the questions that I would come to mind whenever I read or heard about people.
Alexander Vance: Hacking Wi-Fi this demos to show you how easy it is to capture your information using a man in the middle and art spoofing attack from just being on the same network as an attacker, I'm going to start this demo. Please give me a thumbs up if you can hear the audio.
Alexander Vance: So for this demo I have a Cali Linux virtual machine and a Windows 10 VM that are both running in VirtualBox.
Alexander Vance: Tool within Cali, Lennox. That did you guys hear the audio?
Alexander Montgomery: Pecan.
Tiffany Davidson: Yes.
Alexander Vance: OK. Thank you.
Abimbola Ogunfuye: Yes.
Alexander Vance: It's going to help me launch a man in the middle attack and the ARP spoofing attack is called better cap, so I'm going to go ahead and run better cap as sudo user group user.
Alexander Vance: And the first command I'm going to enter is called net probe and it's going to probe the network to see all the endpoints or all the devices on that network.
Alexander Vance: So here you could start to see all the IP addresses the of the devices.
Alexander Vance: And then my next command I'm going to run a net show and it's not only going to show the IP addresses, but it's going to include the Mac address. So you could see devices like my Philips hue lights.
Alexander Vance: As well as my Windows VM which is this 192.168 dot 0.48 address.
Alexander Vance: So let's go ahead and launch that.
Alexander Vance: Man in the middle slash ARP spoofing attack. I'm gonna do this by the command set ARP spoof target and then the IP address that I mentioned previously 192.168 dot 0.48.
Alexander Vance: After I've entered this command.
Alexander Vance: I'm gonna turn the ARP spoof on by AARP dot spoof space on.
Alexander Vance: And I've now.
Alexander Vance: Have my Cali Linux VM between my windows VM.
Alexander Vance: And the gateway device.
Alexander Vance: So if I wanted to, I could sniff the network from here.
Alexander Vance: See all the traffic inbound and outbound from that Windows device.
Alexander Vance: The next tool I'm going to use is going to create a fake website.
Alexander Vance: There's a tool called social Engineering Toolkit AKA set that I'm gonna go ahead and open up.
Alexander Vance: Once running, I'm going to select option one for social engineering attack and then I'm going to select Option 2 for website attack vectors.
Alexander Vance: I'm going to be doing a credential harvesting attack, so I'll select option 3.
Alexander Vance: And then as I mentioned before, I'm going to use the premade template, so I'm going to select web templates option one.
Alexander Vance: So the IP address that I'm gonna be hosting this website from is the Kali Linux VM itself, so I'll do a quick if config to see what my IP address is. You can see right there 192.168 dot 0.251.
Alexander Vance: I'll go ahead and enter that IP address back into that social engineering toolkit application.
Alexander Vance: And it has three options for templates they've already created. I'm going to go and select option 2 for Google.
Alexander Vance: Alright, I now have this running from the Kali Linux VM. Let's go in and pull up my windows VM.
Alexander Vance: If I go to that IP address of the Kali Linux, the 192.168 dot 0.251, you'll now see it pulls up google.com or a fake page of Google. No ones actually going to type in that IP address and mistakenly go to Google. Which brings us to our last step, which is the ARP spoofing part of the domain google.com.
Alexander Vance: So I'm going to go back into the better cap tool.
Alexander Vance: I'm gonna set DNS spoof domain.
Alexander Vance: For that domain google.com.
Alexander Vance: I'm going to then turn the DNS spoof on.
Alexander Vance: I made a quick typo.
Alexander Vance: DNS dot spoofs space on. There we go.
Alexander Vance: So you can now see Googles being spoofed to that IP address of the Kali Linux machine. So if I bring back up my Windows machine.
Alexander Vance: And go to google.com and it will now go to myfakegoogle.com website.
Alexander Vance: If I enter my credentials.
Alexander Vance: Bring back up my.
Alexander Vance: Linux.
Alexander Vance: Social engineering tool and you could see here it captured that username and password that I just entered.
Alexander Vance: See if I can bring up my windows VM and the Kali Linux to kind of show both at the same time.
Alexander Vance: I'm going to type in.
Alexander Vance: E-mail address just user and password. Please don't hack me and as soon as I hit enter you can then see.
Alexander Vance: User please don't hack me.
Alexander Vance: So this is a quick easy example of how an attacker can use credential harvesting and.
Alexander Vance: Again, they can spoof more than you know, google.com. They can spoof Wells Fargo, they can spoof Bank of America, Facebook, anything that that attacker would want to gain your username and password. They can set up fake websites and then ARP spoof those domains to redirect to the sites that they created and then easily collect your username and password.
Alexander Vance: So aside from staying off public networks and using a VPN or sorry, aside from saying all public networks using a VPN would prevent any type of man in the middle attack, this demo was not meant to scare anyone to the threats that are out there, but just to rather educate you on how easy some of them are.
Alexander Vance: A real attacker would not only set up a fake website, but they would then redirect you to the real one after the first login attempt. So an example would be if you go to log in to Wells Fargo and you click log in or submit and then sends the attacker your credentials and redirects you to the real site. So when you try logging in again it is successful. This way you access the resource you need and are completely unaware that those credentials are now compromised during the cryptocurrency boom, it was really common for attackers to set up.
Alexander Vance: That fake websites for the different.
Alexander Vance: You know crypto sites to purchase and send coins because if they harvest your credentials, the attacker could send or transfer the victims crypto currency to a cold storage wallet that was practically untraceable.
Alexander Vance: My sister, about two years ago was hacked because she got a pop up on her computer telling her she had a virus and to call a number. She called the phone number and they emailed her a link that would allow them to remotely access her PC. Not knowing she granted them access and after about an hour they said the virus have been removed and she was all set.
Alexander Vance: She told me the story a day later. I wanted to cry. I felt so bad that I not informed her of these types of social nearing attack, social engineering attacks. So education is the best way to make sure you don't fall victim to an attack. And that was the purpose of this presentation.
Alexander Vance: These are a couple of references they used for my quotes.
Alexander Vance: And any questions?
Yvette Lareaux: Awesome job.
Marjorie Furay: Yes, excellent job. That was great.
Alexander Vance: Thank you.
Marjorie Furay: School. It's always good to see exactly how you can get spoofed.
Marjorie Furay: Bradley, did you have a question?
Bradley Marker: I hit the wrong button trying to give a pause.
Marjorie Furay: Ohh no problem.
Marjorie Furay: Alright, excellent job.
Marjorie Furay: OK. Nicholas, Are you ready?
Nicholas Offenberger: I guess summer is raise I'll ever be.
Marjorie Furay: Alrighty, go right ahead.
Nicholas Offenberger: 2nd.
Nicholas Offenberger: Alright and.
Nicholas Offenberger: I can see that I'm and I assume so.
Marjorie Furay: Yes.
Tiffany Davidson: Yes.
Nicholas Offenberger: So, alright, cool.
Nicholas Offenberger: Umm, so hey everybody, my presentation's going to be on Radius network authentication.
Nicholas Offenberger: Umm.
Nicholas Offenberger: To get started.
Nicholas Offenberger: What is radius, radius or remote authentication dial in user service is a network access service that requires unique user authentication. This asks access is authenticated through a radius server which you would set up in your domain which checks credentials and certificates for every user connection.
Nicholas Offenberger: This authentication is supported through all primary forms of access, which include remote access, wireless and wired connection on your server slash policy setup.
Nicholas Offenberger: Radius is considered a AAA protocol, which it means that it covers the usage of requests that involve the authentication, authorization and accounting for connection requests under the general guidelines of the AAA standard, there are two primary packet types, the access request, packet type, which covers the needs of the authentication and authorization needs, while the accounting request packet type does the same, but specifically for accounting.
Nicholas Offenberger: We'll get more into that later on.
Nicholas Offenberger: Optionally, as an inclusion to these required AAA standard sections, you can also implement additional requirements for extra information through a.
Nicholas Offenberger: A request UM with, you know, with different types of users based on policy setup. So for example you could have a more strict policy for remote access employees in comparison to on site employees. Some examples of information that you could request and a policy set up like this would be things like their current network address, phone number, etc.
Nicholas Offenberger: But why would you do radius, radius while implementation can be considered daunting, provides a considerable upgrade and authentication and access management with users as well as this radius is a strong way to centralized authentication, requiring users to follow radius policy guidelines to gain network access of any time of any kind.
Nicholas Offenberger: And with access policy requirements being adjusted as needed.
Nicholas Offenberger: The implementation of a radius server also eliminates concerns of using an SSID with shared credentials as radius requires unique credentials per every user.
Nicholas Offenberger: Radius, while being a major increase in security for network use, does come with some general negatives. The primary issues that many administrators mention is the difficult implementation of radius policies.
Nicholas Offenberger: It is normally recommended that radius be implemented by an experienced team who have used radius in the past as the process of implementation can be considerably complicated and varies from network to network. Along with this, it is considered difficult to implement with preexisting credential databases such as Active Directory as being highly recommended for implementation with new network setups over preexisting ones.
Nicholas Offenberger: Even so, while it can be difficult, it's not something impossible. It's more of something that they just recommend if you are planning on doing an implementation like this. Because first of all, it is such a significant leap and security for your network trying to get somebody with some experience and implementing something like this or maintaining is very highly recommended.
Nicholas Offenberger: But how does radius work in this example we will be following the request process for a staff member using their laptop to connect to a wireless access point to receive access.
Nicholas Offenberger: To start, the staff member would use their unique credentials to request access to the wireless network through a designated SSID. Whichever one you can technically have it set up with multiple ssids. If you have it in a specific sense, as long as you have the policy set up to connect to the radius server to request credentials.
Nicholas Offenberger: After you try to connect to the SSID and the user puts in their credentials, it will move this request to the network access server or RADIUS server which would handle the request. The request from there would take that provide credentials and compare it to the user database in a Windows environment that would be likely Active Directory, but if you were using something like a Linux environment you might have something like an open SQL database or similar to handle the same type of database rolling.
Nicholas Offenberger: Approving the connection with the match credentials that finds the next two steps generally happen about the same time. Once the credentials have been confirmed, the approval is sent back to the wireless access point and at the same time that request, while it's being approved, it is sending an account of that actually occurring. Basically an audit log to the accounting database to say hey, this person did try to connect and was successful.
Nicholas Offenberger: So that if in case of, let's say somebody potentially.
Nicholas Offenberger: To using somebody else's credentials to get in umm. And finding out that somebody's been hacked or similar, you will be able to go back and review the those contents. Finally, the requester gains access to the network completing the authentication process.
Nicholas Offenberger: Do So what would the implementation of radius generally entail?
Nicholas Offenberger: For this I'm going to use a Windows environment installation. For example umm as Microsoft provides their own first party solution for radius authentication.
Nicholas Offenberger: Umm to start off as with any service, it's important to ensure that any server system requirements are met.
Nicholas Offenberger: Umm. Thankfully with radius it is a very lightweight program and most instances that you see they usually throw it on the same server that you would normally be hosting your Active Directory suite. And it's really it's a lot more convenient to have it with that as you don't have to have it, you know, jump off to other servers to actually.
Nicholas Offenberger: You know complete requests, so normally they kind of throw it on the same server as your Active Directory, database or whatever database you actually are hosting.
Nicholas Offenberger: Your credentials in.
Nicholas Offenberger: Umm.
Nicholas Offenberger: It's uh, sorry.
Nicholas Offenberger: With Active Directory services connected umm for use with the user database, there are three primary server modules required to install and configure.
Nicholas Offenberger: These modules include Active Directory. Of course, the actual database, certificate servers, services for Active Directory and the network Policy server, which in this case the network policy server is Microsoft version of the RADIUS server. So the idea is that Active Directory is the database in this scenario.
Nicholas Offenberger: The certificates are created with Active Directory to confirm that request like. Basically when it goes to pull that.
Nicholas Offenberger: Request when somebody goes and tries to log in, it will connect using the network policy server reach out to the Active Directory certificate services to pull the credentials. Make sure that they're accurate and that they're actually active and that way it's able to confirm that this person is supposed to be on the network that they did provide proper credentials.
Nicholas Offenberger: Umm.
Nicholas Offenberger: Then after all that, you can in network policy server is kind of where you would be focusing on creating any policy additions and more.
Nicholas Offenberger: High risk businesses or ones that have, I would say government would be a good inclusion. They would probably have a lot more significant policies in place in comparison to a business due to the you know following government security standards when it comes to logging into.
Nicholas Offenberger: Hi security clearance networks.
Nicholas Offenberger: So the before and after the networks security infrastructure shifts from a very hands on shared password SSID format to a centralized user database. When completing a task like this implementation isn't as simple as just picking it up and running with it. It has to. It takes a lot of planning and it would require a great deal of, you know, testing beforehand. So my main question is, is how would policies be changed?
Nicholas Offenberger: Or implemented around an integration like this?
Nicholas Offenberger: So to start with, any significant security adjustment, it's important to review existing security policies and processes to ensure that the information contained would fit the implementation of the RADIUS server service that you have in mind. So one of the more important policies, principles that you see in businesses, the principle of least privilege, dictates that users should only be provided access to networks that resources as required by their position. It would be important to review how those network access policies may need to be adjusted.
Nicholas Offenberger: To reflect how users access the network, whether people, for example remote users or.
Nicholas Offenberger: Similar how they're actually accessing weather that connection has to have a more limited policy set up what they can actually access on the network and comparison to somebody that is actually on site. And those policies could be configured uniquely based on credentials based for specific roles. You can set up technically multiple different policy setup space for different, you know, sets of users, especially through how Active Directory works. So you kind of do some.
Nicholas Offenberger: In that and also some in the network policy server section for RADIUS.
Nicholas Offenberger: Umm, this could also be another way that you could work with network access to external vendors as monitor network access for them may be considerably easier with radius, seeing that you'd be with external vendors you would be providing them specified credentials to access your network for a short period, whether it's to implement.
Nicholas Offenberger: Umm, I know first in some cases for like my work I have vendors come in every so often they have to put in specialized like projector equipment or similar for some of our events and they have to have access to our network for a short period of time with something like this we would be able to give them access to an account that they could use to specifically connect to our network. They don't have, we don't have to give them a chance to have our special, you know, our specific shared SSID credentials. We just get them.
Nicholas Offenberger: A unique account we would already have to have done that anyways, and that way going into the, you know, going through that we would be hitting it an extra security checkpoint in comparison to having to trust that they're not going to use.
Nicholas Offenberger: This access to far more credentials, and therefore you know, maintain access in our system.
Nicholas Offenberger: Umm.
Nicholas Offenberger: So.
Nicholas Offenberger: As an example piece, let's say that we were implementing this into an environment that previously had a shared SSID. Previous policy may have included information regarding general acceptable use, stating that it cyber staff would have to be contacted to provide the password to any needed devices to ensure that misuse is mitigated, et cetera. With that in mind, that policy would need to adjust the point of contact and set up method and reference of using the centralized system, possibly with inclusions such as more frequent password changes.
Nicholas Offenberger: Along with any additional criteria that may have been added during the policy discussion phase pre implementation. Basically, if there were any specialized for people outside of the network like this, remote users or somebody, these unique setups you might have to make inclusion for any of those additional criteria whether you follow and keep up on network addresses or similar when having individuals connect.
Nicholas Offenberger: Overall final thoughts I I would recommend if it's something that it's not already been implemented at your place of work radius is a good inclusion and a significant security improvement with enough time and proper testing it would lead to a more secure and manageable access structure for core network services on your network. Does anyone have any questions?
Nicholas Offenberger: Sounds like a now.
Nicholas Offenberger: Cool.
Marjorie Furay: Very interesting again. My goodness. Excellent job.
Nicholas Offenberger: No problem. And thanks for listening. Me, everybody. Here's all my references.
Nicholas Offenberger: Alright.
Marjorie Furay: Great. Great job. Yeah.
Marjorie Furay: All right.
Marjorie Furay: OK, I've been below.
Marjorie Furay: Are you ready?
Abimbola Ogunfuye: Yes, good evening. I'm here.
Marjorie Furay: OK.
Abimbola Ogunfuye: Alright, let me share my screen.
Abimbola Ogunfuye: Alright. Can you see me please?
Marjorie Furay: Yes.
Abimbola Ogunfuye: Can you see my screen?
Marjorie Furay: Yes, I do.
Abimbola Ogunfuye: All right, great. Thank you so much. You're good evening, everybody.
Abimbola Ogunfuye: My presentation is sent to the upon.
Abimbola Ogunfuye: A very interesting topic which is actually there to me and it's titled Artificial intelligence and it's privacy concerns. I believe we all heard about the new age of technology, which is artificial intelligence and we believe in the nearest future is gonna take over some sad things. I just actually started down and.
Abimbola Ogunfuye: While we one way or the other, I've been feeling the effects of.
Abimbola Ogunfuye: Artificial intelligence, probably the negative or the positive way, so I would like to do the into this as my presentation, so any discussion on the cybersecurity is usually increased receiver of a data creation.
Abimbola Ogunfuye: And privacy. Because cybersecurity.
Abimbola Ogunfuye: Seeks to protect data systems and infrastructure by preventing manipulation from most populous and malicious actors.
Abimbola Ogunfuye: And privacy, on the other hand, I can see is the right to keep her official and passing information free for motorized access.
Abimbola Ogunfuye: Uh.
Abimbola Ogunfuye: Artificially children has become prevalent in several areas of our lives.
Abimbola Ogunfuye: Having the capacity to revolutionize the manner with which we all interact with technology and the amount of data generated through online sharing is increasing exponentially. As we all know, and so does the privacy risks. It's presence, so therefore it is necessary to delve into how.
Abimbola Ogunfuye: A impacts our privacy and personal data.
Abimbola Ogunfuye: So in this presentation, I will examine the benefits and the risk associated with a I.
Abimbola Ogunfuye: And with regards to privacy and the security steps that we can employ.
Abimbola Ogunfuye: As individuals, copied bodies and even the government to secure privacy and protect personal data in the new technology age, so I'll continue by looking into how it works.
Abimbola Ogunfuye: So yeah, it's substrate depends on machine learning algorithms and they are trained on an enormous amount of data that is big data. As we all know. So sometimes they contain biases which could lead to questionable inequalities and even discrimination against race and color. And so these tools collect analyze data.
Abimbola Ogunfuye: Which includes uh, possibly information, images and other sensitive data.
Abimbola Ogunfuye: That users enters prompts and I used to training generative AI models.
Abimbola Ogunfuye: So we have Gerri TPI tools like Chat DPT, which is the most popular and also stable definition which enables individuals to create content that mimics human produce media.
Abimbola Ogunfuye: Which are usually not transparent in the use of the actual user data.
Abimbola Ogunfuye: So to the next slide, benefits of AI. So we are all familiar with the benefits in this digital age as that has become invaluable commodity.
Abimbola Ogunfuye: So detailed my miss from variety of sources which includes our online activities as social media platforms and public records. So AI relies on this varieties of data to make tangible decisions. So online sharing of information through our social interaction.
Abimbola Ogunfuye: Trade, entertainment and even political activities as allowed. The individuals and even business as a whole to gain a better insight and the need to establish better decisions. So, however, at the numerous amounts of this data scheduling.
Abimbola Ogunfuye: Contains sensitive information.
Abimbola Ogunfuye: That's many between us. Do not want to share, which is where the aspect of privacy concern.
Abimbola Ogunfuye: So.
Abimbola Ogunfuye: I will talk a little bit about the advantages of AI.
Abimbola Ogunfuye: To big tech companies, which is at the detriments of many users, so big tech companies such as Google and Amazon, as as access to numerous amounts of data which can be can, which can give them like, say, unprecedented power to influence consumer behavior and shape the global economy. So and their involvement in policies can also ship public opinions and mold governmental policies policy. So and.
Abimbola Ogunfuye: With the developments also can leverage kind of loud. This big tech companies leverage their data and influence.
Abimbola Ogunfuye: And it can also allow them to build new ecosystems and control user experience and even monetize their platforms.
Abimbola Ogunfuye: So another great base of AI is the fight against crime and terrorism, a controversial use of AI technology has brought a significant change to law enforcement and security.
Abimbola Ogunfuye: Which helps to fight against crime and terrorism.
Abimbola Ogunfuye: And because I software used data analysis and machine learning to predict areas of crime and crisis.
Abimbola Ogunfuye: And who could be likely be responsible for a crime? So these tools get a large amount of data from cameras, social media sources to predict kind before their call. So those are the benefits we can actually derive from AI. So now talking about the main point, which is the privacy concerns in our Aage privacy with me.
Abimbola Ogunfuye: Is an exercise of control the private and valuable information. So privacy means we are also allowed to maintain our social and professional relationships without any fear of interference and surveillance.
Abimbola Ogunfuye: About also privacy with me.
Abimbola Ogunfuye: The dangers of unauthorized access.
Abimbola Ogunfuye: If that's, I get into the wrong hands. Is that other concern and which could result into theft and fraud?
Abimbola Ogunfuye: So despite the numerous previous of AI challenges with use can be damaging index if there's a forced into the wrong hands, it can be used for also for cyber bullying.
Abimbola Ogunfuye: So talk to this company. The completion engines will also be used to analyze our data.
Abimbola Ogunfuye: I use it to manipulate individuals into making certain.
Abimbola Ogunfuye: Buying decisions.
Abimbola Ogunfuye: So the advantage of AI are shifted to using.
Abimbola Ogunfuye: Complex algorithms to make decisions based on subtle patterns in the data at the are difficult for humans to design.
Abimbola Ogunfuye: I wish implies that whom I would not be aware that their personal data is used to initiate the chance that are affected.
Abimbola Ogunfuye: 2 examples of such we can see in Google location tracking practice.
Abimbola Ogunfuye: And Dean, visit nature of Google such as Google suggested engine. Sometimes when you watch a show on Apple TV for instance.
Abimbola Ogunfuye: And suddenly you see news recognitions on your iPhone that was not even used to watch the show. So those are starting kinds of the invasive nature of Google.
Abimbola Ogunfuye: So and then I'm talking about the bias concerns and discrimination that AI is post and the new technology. So I steps are typically on bias as the data trained on.
Abimbola Ogunfuye: So it becomes by us, so will be the resulting systems. So this will generate on fair and Hample outcomes on individual space or race, gender, religion, political beliefs, and even socioeconomic status. So a systems can generate systemic inequality, especially in the hiring process that's becoming more common now. For instance, if an AI system is used by a hiring company to screen job applications and the system is biased against, for instance, women or people of color.
Abimbola Ogunfuye: It's me use data about the candidates gender or race to unfairly exclude them from consideration.
Abimbola Ogunfuye: There's another popular one that's, uh, many people are experiencing now job displacement and economic disruptions. I say I I produce advancements and they are immensely capable of performing task that previously carried out by humans, which could lead to a tremendous economic disruption.
Abimbola Ogunfuye: And aggravated financial insecurity for workers.
Abimbola Ogunfuye: Which can further lead to a situation where individuals can sacrifice their privacy to earn a living in a changing conomy now, for instance, a worker who has lost their jobs to to mention.
Abimbola Ogunfuye: May be forced to disclose their job is to add even location to persuade other jobs, which could also raise some serious privacy concerns.
Abimbola Ogunfuye: As the information could be used by top parties or for target hats.
Abimbola Ogunfuye: So we all know it's no longer new that AIA gradients are also utilized by certain organizations for hiring process to screen job cabinets.
Abimbola Ogunfuye: By analyzing their online behavior and social media activities to establish just sustainability or suitability for the job roles. Sorry.
Abimbola Ogunfuye: So this mission let's sat in concerns regarding the data being used and those applications will not be aware that this has been used in a certain way.
Abimbola Ogunfuye: That's so.
Abimbola Ogunfuye: Uh.
Abimbola Ogunfuye: In terms of surveillance, uh, you see, it's, yeah, it's terms could post some certain privacy risk when it comes to surveillance, A is a welcome development we all accept, but is a good crucial to acknowledge that this systems could pose potential risk for dementia, rights and freedom. The major concern with the use of AI based supplier system is significant risk to privacy and civil liberties. By monitoring and controlling individuals, thereby making them lose freedom and their civil liberties.
Abimbola Ogunfuye: They said European Union with a view to protect individual privacy in the I age, initiated a proposal.
Abimbola Ogunfuye: To ban the use of AI surveillance in public places, except in cases where there is a specific public threat.
Abimbola Ogunfuye: As his I'd be subjects are not transparent. Individuals do not know when they are being monitored and for what purpose. So this decision can erode trust.
Abimbola Ogunfuye: In law enforcement and security agencies.
Abimbola Ogunfuye: I haven't created a sense of unease.
Abimbola Ogunfuye: In the general public, so I have some few recommendations. Week I will communications we are which I would like to.
Abimbola Ogunfuye: Uh highlight.
Abimbola Ogunfuye: It's a good idea if we could college big tech companies to be transparent about data practices.
Abimbola Ogunfuye: And also it is possible I systems to be trained.
Abimbola Ogunfuye: On diverse data and the regularly audited to prevent bias.
Abimbola Ogunfuye: And thirdly, organize shows and companies which lies in AI technology must employ.
Abimbola Ogunfuye: Proactive measures to prevent strong data security protocols.
Abimbola Ogunfuye: We just aimed at ensuring that data is only used for the intended purpose.
Abimbola Ogunfuye: They should also has.
Abimbola Ogunfuye: Uh, the devil to design AI systems. That's adhere to ethical principles.
Abimbola Ogunfuye: And I also would respect to transparency.
Abimbola Ogunfuye: Users should have control over their data by understanding its use and being able to renounce data collection.
Abimbola Ogunfuye: I'm also request to have their data deleted whenever and wherever they feel. So in view of this here technology can be used to the greater benefits of the site.
Abimbola Ogunfuye: Also, I would like to take this to our read the concern of a substance technology. Like I mentioned the other time the use of a I must have strict regulations and an establishment of an independence oversight and review mechanism can also help to ameliorate this privacy concerns.
Abimbola Ogunfuye: The museum also forget that implementation of St. Regulations and oversight mechanisms is a vital step towards creating the future.
Abimbola Ogunfuye: What? Yeah, technologies are used to the benefit of the site without compromising individual rights our freedoms.
Abimbola Ogunfuye: And ultimately in the healthcare sector.
Abimbola Ogunfuye: Yes, Sir. Michael, user privacy issues.
Abimbola Ogunfuye: So decentralize ear like blockchain can be used to securely share pictures data.
Abimbola Ogunfuye: Well, protected your privacy.
Abimbola Ogunfuye: And lastly.
Abimbola Ogunfuye: Use us generally. That is very important for everyone. Users must be aware of the dangers of sharing personally identifiable information online.
Abimbola Ogunfuye: And I did be use privacy tools to opt out of target advertising to limit data sharing, especially by third party companies.
Abimbola Ogunfuye: I have a final statement as AI continues to evolve, it is crucial that we must all be vigilant in the addressing the challenges introduced by AI to ensure that its use for the greater good rather for the previous parties that could possibly affect our rights to privacy.
Abimbola Ogunfuye: I'll end my presentation here. I don't know if anyone has questions. I have some few references here, one from Reginam Mac and the other one from Kerry Camera.
Abimbola Ogunfuye: Thank you. Any questions please.
Marjorie Furay: Very interesting. You know, AI is such a big topic these days and it's always good to know more and more information about it that we can find. So this is excellent as well. You did a great job.
Abimbola Ogunfuye: Thank you.
Marjorie Furay: Any questions for any of our speakers tonight?
Marjorie Furay: OK. Well, I thank all of our presenters presenters tonight and they're wonderful presentations, picked some great topics and excellent job, excellent work. I'm so proud of you guys and I believe your instructors will be happy about it as well, so.
Marjorie Furay: Great job and thanks for joining everybody for another wonderful master class tonight and have a great weekend.
Alexander Vance: Have a great night all.
Yvette Lareaux: Goodnight.
Alexander Vance: OK.
Tiffany Davidson: Can I?
Ashish Agarkar: Goodnight bye.
Abimbola Ogunfuye: Midnight.
Bradley Marker: Alright.