1.
Dr. Christian Folini
Medieval Castles and Modern Servers
@ChrFolini

2.
Dr. Christian Folini
 PhD in Medieval History
 Former president of the
Company of St. George,
a medieval reenactment company
2
Replace box
with photo then
send to back
@ChrFolini

3.
 Author of the ModSecurity Handbook, 2. Ed
 Co-Lead of the
OWASP ModSecurity Core Rule Set Project
 Program chair Swiss Cyber Storm Conference
 Vize-President Swiss Cyber Experts
 Over 10 years of experience in IT Security
3
Replace box
with photo then
send to back
Dr. Christian Folini
@ChrFolini

4.
 3 Problems
 3 Solutions
 3 Useful Security Practices
4
Program
@ChrFolini

5.
 One vulnerability is enough
5
Problem 1
@ChrFolini

6.
6
British Library
Royal 18 D II, f. 75r

7.
 Denial of Service
7
Problem 2
@ChrFolini

8.
8
British Library
Royal 15 E I, f. 280v

9.
 Advanced Persistent Threats
9
Problem 3
@ChrFolini

10.
10
Victoria & Albert Museum
Miskina, Akbarnama

11.
11
Victoria & Albert Museum
Miskina, Akbarnama, Detail

12.
“The nation-state attackers? There’s a
reason it’s called advanced persistent
threats.
Because we’ll poke and we’ll poke. We’ll
wait and we’ll wait and we’ll wait, right?
We’re looking for that opportunity—that
opening and that opportunity, to finish the
mission.”
12
Rob Joyce, NSA Tailored Access Operations
@ChrFolini

13.
 Flexibility
13
Solution 1
@ChrFolini

14.
German Sallet, around 1480
14

15.
German Sallet, around 1480, Company of St. George 15

16.
 Defense in Depth
Related terms:
 Multiple Lines of Defense
 Layered Defense
 Security in Layers
16
Solution 2
@ChrFolini

17.
Castle Hochosterwitz, Carinthia, Austria
South East 17

18.
Castle Hochosterwitz, Carinthia, Austria
East 18

19.
Castle Hochosterwitz, Carinthia, Austria, North 19

20.
Castle Hochosterwitz, Carinthia, Austria, South 20

21.
Castle Hallwyl, Argovia, Switzerland 21

22.
Castle Chillon, Lake Geneva, Switzerland 22

23.
 Whitelisting
Related terms:
 Positive Security
 Least Privilege Principle
 Positive Input Validation
 Reduction of Attack Surface 23
Solution 3
@ChrFolini

24.
Metnitz, Carinthia, Austria 24

25.
Metnitz, Carinthia, Austria 25

26.
Waffentor, Hochosterwitz, Carinthia, Austria 26

27.
Nauders, Tyrol, Austria 27

28.
Tower of London 28

29.
 Security Updates
29
Useful Security Practice 1
@ChrFolini

30.
Castel de Pioz, Guadalajara, Spain 30

31.
 Detailed Inventory
Related terms:
 Software Bill of Materials
 Dependency Tracking
 Detailed diagrams
31
Useful Security Practice 2
@ChrFolini

32.
Habsburger Rotulus, around 1290
Hauptstaatsarchiv Stuttgart
H 162 Nr. 1 32

33.
Cairo, Map of Piri Reis
33

34.
Cairo, Map of Piri Reis, detail
34

35.
 Bug Bounty Programs
Related term:
 Red Teaming
35
Useful Security Practice 3
@ChrFolini

36.
Bellifortis, UB Frankfurt a.M.
Ms. germ. qu. 15, fol 61r
36

37.
Bellifortis,
Det Kongelige Bibliotek
Copenhagen
MS Thott.290.2º, fol 22v
37

38.
 One weakness is enough
 Denial of Service Attacks
 Advanced Persistent Threats
 Flexibility
 Defense in Depth
 Whitelisting
 Security Updates
 Detailed Inventory
 Bug Bounty Programs
38
Summary
@ChrFolini

39.
Dr. Christian Folini
 christian.folini@netnea.com
 @ChrFolini
 https://www.christian-folini.ch
39
Replace box
with photo then
send to back
@ChrFolini