OSSTMM 3

All right, strap in everyone, let's take a deep dive into this open Source Security Testing Methodology Manual THEMM. Yeah, STMM, that's a mouthful. It is kind of like a security decoder ring, right, I mean, the thing is dense. Yeah, but don't worry. We're going to break it down. Make it makes sense. You shared some concerns about I think it was mentioned a specific detail from listener source material

Absolutely. It's put together by security testers for security testers, real world stuff, real world.

Stuff, so less theory, more like in the trenches kind of stuff.

Yeah, that's how security works in the real world.

That's good. That's good. So one of the first things that kind of jumps out at you, you know, going through the OSSTMM, is this focus on operational security op sec. Yeah, what exactly does that mean? I mean, is an all security operational? In some way?

I think the OSSTM and really draws a line.

Okay.

You know a lot of times security is presented like this wall, solid wall between your assets, your data and the bad guys. Okay, but in reality that wall is full of holes. Ah, okay, and the OSS TMN calls those holes trusts, trust and optic. It's all about, you know, looking at those trusts, figuring out how strong they are, figuring out if they're actually holding up.

So instead of just assuming things are secure, you've got to really look closer at those trusts exactly and see if they're actually doing their job.

Yeah, you're trusting something to do what it says it's going to do.

Okay, Okay, can you give me like a real world example, like what would a trust look like in the real world?

I mean, even something you mentioned in your notes, like relying on a specific piece of software for your business. Yeah, you know, that's a trust. You're trusting that software to do what it's supposed to do and to do it securely. But what if that software has vulnerabilities? Oh what if the company behind that software has you know, kind of shady security practices, that trust becomes a weak point.

Okay, Yeah, that makes sense. So opsec is really pushing you to look beyond the surface question those assumptions.

Absolutely.

So how does the OSTMM actually help you do that? Like, how do you assess these trusts and figure out where you're vulnerable?

That's where this idea of the four point process comes in. Okay, because a lot of security assessments are kind of like yelling into a cave and waiting for the echo. You're only getting this very limited perspective, right, and the OSSTMM says that's not good enough. You've got to get up close and personal with your security.

Okay, So less like superficial checks, more like a deep dive into how things are working.

Yeah, how are things actually functioning?

Okay? I like that, I like that, But how does this four point process actually work?

It breaks it down into these four stages. Okay, in quest, intervention, induction, and interaction.

Wow, okay, break those down for me.

So inquest is all about gathering information you really want to understand the system you're trying to secure. Intervention is where you actually simulate real world attacks.

Oh so you're actually like trying to break things.

You're trying to see how your security holds up under pressure.

Okay, now it's getting real.

Then you have induction, where you're analyzing all the data that you've gathered, figuring out what it means. And then finally there's interaction, which is really understanding how people and processes impact security. Like you mentioned reference a security related human element detail from the listener's source material. Right, that fits right into this interaction piece.

Okay, So this four point process is giving you this much more in depth view of your security. It's not just about finding the holes. It's about understanding.

The whole systems, understanding every dingy inside and out exactly.

Yeah. And out of that process comes something called the RAF. The RAF it's like your security scorecard.

Okay, hold on, we can't just breeze pass the RAV. You compared it to a credit score for security.

Yeah, it's a way to measure how exposed are you, how good is your security posture?

All right, but how is it actually calculated? And what does that number actually tell you?

So think of it like this. A RAVE of one hundred is perfect balance, everything is working perfectly. Oh, your controls, you know, they're aligned with your operations. Anything less than one hundred, that means you've got gaps, gaps, there are areas where you're more vulnerable.

So the lower the RAVE, the more work I need to do.

Yeah, basically I'm getting the picture.

What I find interesting is that you said this can be applied to anything, right, You know, a massive data center, a small business, even your own home. Exactly how is that possible? How can one score apply to all these different situations?

Because the RAV isn't tied to specific technology or specific systems, it's really a framework for understanding how well your security is working compared to what you need.

Okay, relative to your needs.

Yeah, so you could look at the RAV of your home network, you know, and think about how strong are your passwords? Is your Wi Fi secure? Do you leave your front door unlocked?

Okay, So it's not just about the tech, it's about the whole picture.

Yeah, every habits and all that, it all plays a part.

Okay, this is really making me rethink my own security habits, I'll be honest. Now, another big concept in the OSSTMM is trust. Right, but it's not the kind of like touchy feely trust we usually talk about.

Right, We're not talking about feelings here, Okay. This is about the OSSTMN breaks down trust into ten quantifiable properties.

Ten properties.

Yeah. It's taking something fuzzy, something subjective, ye, and turning it into something you can actually measure and analyze.

Okay, Okay, so we're taking these vague ideas and making them concrete exactly. But ten properties. That sounds a little overwhelming.

It's a lot to take in.

Can you give me an example, like, how do these properties play out in the real world.

So let's go back to that software company. Okay, you're trusting them with your data, maybe even your business operations, but how do you know if that trust is well placed?

Right?

Good point.

So one of the trust properties is transparency.

Transparency, Okay, is.

The company open about their security practices? Do they have a privacy policy that you can actually understand? Another property is competence. Competence, have they actually built secure software in the past, you know, do they have a track record of not getting breached? All of these things play into whether or not a company is trustworthy.

So you're looking at these properties, you're building a more informed picture of whether this company is actually worthy of your trust.

Absolutely, this is wow.

This is really making me rethink how I approach trust in all areas of my life.

A different way of thinking about it.

Yeah. Yeah, And we haven't even touched on the ostmm's deep dive into the five security channels five five we got human security, physical security, wireless.

Security, telecommunications again in a network security YEP, that's all five.

Okay, So we got op SEC, we got this four point process, we got RAVS. Now you're telling me there's five security channels to consider.

It's a lot, but it's all connected. We got to unpack those absolutely. Where do we even start, Well, let's start with human security h U M SEC, DOM SCC Yeah okay, since we were just talking about the human element.

Okay, Yeah, this is where it gets really interesting. Goes beyond just the technical stuff.

It's not just about bits and bytes right right, It's about psychology, social factors.

So it's understanding how people actually behave yeah, how they make decisions, and how those decisions can actually like impact security exactly. Okay.

Remember that software company we were talking about. Yeah, HTMSEC would consider things like what's their internal security culture? Like, oh, okay, do the employees actually understand security? Right?

Right?

You know, do they follow the best practices?

They care?

Do they care? Exactly?

Yeah?

Also looks at social engineering, okay, you know, are they vulnerable to phishing scams or other things that try to manipulate people?

You know, I mentioned in my notes that I was a little worried about mention a specific detail from listeners source material related to human element of security, right.

And the OSS TMM gives you a framework to think about those very concerns and actually figure out some strategies to address them.

Okay, that's reassuring.

All right, let's shift gears a little bit.

Okay, let's talk about physical security fiochy s se al.

Right. This is all about those you know, tangible.

Barriers, the stuff you can actually touch.

Yeah, the locks, the fences, the cameras, yeah, the guards, all of that.

Okay, So, like the classic security measures, how does the OSTMM approach this differently?

Well, it really makes you think like an attacker, Okay, you know, forces you to consider all the weaknesses in your physical defenses.

It's the stuff you might overloko if you're not thinking carefully.

Yeah, Because it's not just about having a lock on the door. It's about how easy would it be for someone to.

Pick that lock right, or just break the door down.

Exactly or find another way in. Yeah, you mentioned in your notes that you mentioned a specific detail from Listener's source material related to physical security. Yeah, so the Oasis TMM would say, Okay, how easy would it be for someone to like tailgate you tailgate right? Or are there any blind spots in your security camera coverage.

Okay, yeah, this is kind of making me nervous now a little bit, right, but better to know now than later, right, Oh? Absolutely, all right, So let's talk about wireless security spec SIIC spec SEC. Okay, this one seems super relevant these days. Oh yeah, everyone's on Wi Fi, right, my dog's on Wi Fi.

But spec SC isn't just about your home WiFi. Okay, we're talking about Bluetooth RFID tags, even things like microwave ovens.

Hold on microwave oven.

They EMIT signals.

So my kitchen appliances are a security risks, maybe at your microwave specifically, But the point is SPETS recognizes that wireless signals are everywhere they are, yeah.

And those signals can be vulnerable. Oh you know, someone could be eavesdropping. There could be interference.

So it's not just about having a strong Wi Fi password.

It's about the bigger picture. Okay, yeah, have broader risks of wireless technology.

I see a pattern here. The os STMM is all about thinking holistically absolutely. Okay, what about telecommunications security?

Come s e come se Okay, this one might seem a little outdated, right, yeah, but it's all about those systems we sometimes forget about, okay, phone lines, voicemail, even fax machines.

Oh right, they can still be vulnerable.

Fax machines. I totally forgot about those. We're so focused on our computers and our networks. But these other communication channels, yeah, they could be weak points too, Exactly.

You got to think about all of it, okay. And then finally there's data network security. Okay, this is probably what most people think of when they hear cybersecurity. Yeah, the main event, right, all about securing the networks, the servers, the.

Data, So firewalls, intrusion detection, encryption, all that stuff.

All that.

Yeah, okay, but what makes the ostmm's approach to this different. I mean, it seems like everyone's got a cybersecurity solution these days.

The OSSTMM doesn't just tell you what to do. It teaches you how to think about security.

Okay.

It's a methodology, a framework for actually assessing your network, got it, understanding the risks, and then figuring out what controls you need.

So it's like giving you the knowledge to be your own security expert.

Exactly. You take control, okay, instead of just blindly following someone else's checklist.

I like that taking control. That's good. This has been Wow, this has been an eye opener.

There's a lot to take in.

Yeah. I thought I was pretty good with security, you know, strong passwords, anti virus. I thought I was all set right, But there's so much more to consider.

It's a whole world out there.

Yeah. Yeah, it is, and we've only scratched the surface, just the beginning. So there are seventeen modules in the OSSTMS seventeen Yeah, okay, So that's where the rubber meets the road.

That's where it gets practical.

Okay. So you take all this information and then you actually turn it into action.

Yeah. The modules are like your toolbox Okay, for actually implementing these principles.

Gotcha. So like a mix a match.

Yeah, you can choose which modules make sense for your situation.

Customized security checkout exactly. Okay, I like that. I like that. So, for example, you mentioned the compliance verification module that helps you make sure you're meeting all the legal and industry standards and knowing the rules right right, which is a big one for me.

Yeah, you mentioned that you were concerned about reference a compliance related detail from the listener's source material.

Exactly, got to make sure I'm taking all the.

Right boxes, right. But the OSSTMM goes beyond just ticking boxes.

Okay.

Good. It's about understanding why those regulations exist and then achieving real security, not just compliance for compliance's.

Sake, right, because at the end of the day, it's about actually being secure.

Absolutely.

Okay. So another example, Let's say I'm worried about the physical security of my home office, which i am. Yeah, you mentioned that in my notes I did.

Yeah. So the OSSTMM has this module called Physical Security Verification okay, and it walks you through this process of assessing your vulnerabilities.

Like are there any easy access points?

Exact?

Could someone tamper with my equipment? Or my cameras actually pointed in the right direction?

All good questions.

Okay. So it's like having a security expert looking over your shoulder.

Yeah, pointing out the things you might miss.

Yeah. Yeah. But it's not just about finding the problems, it's about fixing them too.

Absolutely. Each module gives you recommendations best practices okay, and then it takes it even a step further with this thing called characterizing results.

Characterizing results, what's that?

So you've done your security test. You found some issues, but now you've got to figure out what did those results actually mean. It's not just oh we found a vulnerability, it's how serious is this vulnerability? How likely is it that someone's going to try to exploit it? Right?

And if they do exploit it, what's the impact going to be?

So you're putting the findings into context exactly, prioritizing the risks, got it? Not just finding every little problem but figuring out which problems are the biggest.

You got to focus on the big ones first.

Yeah, that makes sense. Yeah, this is one of the things that makes the OSSTMM so powerful.

Yeah.

It helps you make informed decisions about security based on evidence, not just fear.

You're not just guessing.

Okay, but let's be real, a lot of this sounds pretty technical.

It is. Yeah.

Is the OSSTMM really something that the average person can use or is this just for you know, the security pros.

That's one of the great things about it.

Okay.

It's designed to be accessible, Okay, no matter what your technical skill level is.

Okay.

It uses clear language, real world examples to explain these complicated concepts.

So even if I'm not a security expert. I can still use this to improve my security absolutely. Okay. That's good to hear. And in fact, one of the core principles of the OSSTMM is that security should be a collaborative effort. Okay, it's not just about one person.

Or one team, right, We're all in this together.

Everyone needs to work together, okay, to make things more secure for everyone.

That's reassuring, right, Yeah. Yeah, I gotta admit I'm still a little intimidated by all this.

I get it.

It's a lot to take it.

Yeah, it's a dense document. Yeah, there's a lot to.

Learn, but I don't need to master every detail.

You don't have to know everything, Okay, even just understanding the basic principles and applying a few the key concepts that can make a huge difference.

Okay, that's good to hear. Right, Yeah, yeah, but let's not sugarcoat it, Okay. Implementing the OSSTMM. It takes work.

It does.

Yeah, it's not just reading the manual and calling it a day. It's not magic, no, No, it takes effort, it takes commitment.

It takes a willingness to actually change how you think about security. But the rewards are worth it. The OSSTMM can help you build a more secure organization, protect your valuable assets, and it can even give you a competitive edge.

Okay, all right, I'm sold. I'm ready to dive in good But where do I even begin?

Well, the OSSTMM has this thing called a posture review. It's the first step, and that's where you gather all the information about your organization. What are your assets, what's your security environment like?

So you're taking stock of the current situation exactly.

You got to know where you're starting from before you can figure out where you're going.

Okay, I get that. What happens after the posture review? When does the actual testing start.

That's where the logistics phase comes in.

Logistics, Okay, this.

Is where you plan and prepare for the assessment. You're defining the scope, You're picking the target systems and networks. You're choosing your tools and techniques.

So it's like creating a battle plan exactly.

Okay, you've got to have a plan. Good logistics are key to making sure the assessment is done thoroughly and efficiently.

Makes sense. Okay, So we've got the posture review, We've got the logistics phase, right, what's next? In the OSSTMM methodology flow.

Next comes the active detection verification phase.

Okay, active detection.

This is where you're actually testing your security. You know, how good are you're monitoring and detecting capabilities?

So are my alarms actually working?

Yeah? And are you actually paying attention to those alarms? Right?

Right?

This involved things like testing your intrusion detection systems okay, looking at your security logs, seeing if you're analyzing them properly, even simulating incidents to see how quickly you can respond.

So it's about being proactive at testing things before an actual attack happens exactly. Okay, that makes sense. But what if we discover during this phase that our detection capabilities they're just not up to snuff. What happens?

Then that's where the OSSTMMS recommendations come in.

Okay.

It gives you guidance on how to actually improve your security.

Based on the findings.

Yeah, based on what you've learned.

Okay.

It might involve upgrading your security tools okay, refining your processes, maybe providing more training for your team.

So the OSSTMM doesn't just point out.

Problems, it helps you find solutions.

Okay, I like that it's a practical guide, not just theoretical exactly. Okay, so we've got active detection verification. What's the next step in this methodology flow.

That's where we get into channel and vector verification.

Channel invector.

Remember we talked about those security channels earlier.

Yeah, yeah, human security, physical security, all that exactly. Those were eye.

Opening, they were, right. Yeah. So in this phase, you're assessing the controls for each relevant channel and vector.

So you're making sure that you've got the right security measures for all the different ways that your assets could be attacked.

You got it. It's a comprehensive security checkup, okay, making sure you're protected from every angle like that.

So, for example, we'd be analyzing firewall rules, testing our intrusion prevention systems, evaluating access control mechanisms, making sure our wireless networks are secure, reviewing physical security measure It's a.

Lot, it's a lot, yeah, but it's important.

Okay. So it's a thorough process. But how do we even know which channels and vectors are relevant to our organization? I mean, there's so many potential attack vectors out there.

That's where that posture review comes in hand. Remember, we gathered all that information about the organization, their assets, their environment. That helps you figure out which channels and vectors you should be focusing on.

Okay, so it's all connected. The information from the early stages actually informs the later stages exactly. That's good. The OSSTMM is really systematic and methodical. It's designed to make sure that you don't miss anything important thorough Yeah. Okay, so we've got active detection verification, we've got channel in vector verification. What comes next in the OSSTM methodology flow.

Next is process verification process verification. Yeah, this is where you look at the organization's processes and procedures and you're asking are they actually effective?

So are people actually following the security policies exactly? Do they know what to do if something bad happens?

You got it? So you're reviewing those policies and procedures. You're actually watching people seeing how they work. You're interviewing them, asking them about their understanding of security.

So it's not just about having rules on paper, it's about security being part of the culture.

It's got to be ingrained.

Yeah. Yeah, But how do you assess something like organizational culture that seems kind of fuzzy?

It can be. Yeah, but the OSSTMM gives you some guidance. You look for evidence of security awareness training. Are they doing incident response drills? Is there a clear way to report security incidents?

So you're looking for concrete that they're taking security seriously.

Yeah, it's got to be more than just words.

Yeah, to be actions.

Actions speak louder than words, exactly.

Okay. So process verification it's about making sure everyone's.

On the same page, everyone working together. Yeah.

Yeah, what's next in the osstmmflow.

Next up is configuration and training.

Verification, configuration and training Okay.

This is where you look at the organization systems okay, and their training programs.

So are our systems set up properly? And do people know what they're doing exactly?

So you're reviewing system settings, you're checking password policies, ok and you're evaluating those training programs.

So it's making sure that our technical defenses and our human defenses are both up to par. Got to have both, Okay, But how do we know what a secure configuration even looks like? I mean, there are so many different settings and options and it can.

Be overwhelming, yet it can be That's where the OSTMM comes in handy again.

Okay.

He gives you specific guide good based on industry best practices and the needs of your organization.

So it's not just a generic checklist. It's about tailoring things to your specific situation.

You got it.

Okay, that makes sense, And the same goes for the training, right Exactly. The OSSTMM encourages organizations to make the training relevant engaging for the employees.

Yeah, you don't want those boring, sleep inducing training sessions, right.

Because then no one remembers anything exactly. Okay. So we've got configuration and training verification. What's next in the OSSTMM methodology.

Now we're getting into privileged escalation verification.

Privilege escalation, yep, this.

Is where uss how vulnerable you are to attacks that try to gain unauthorized privileges.

So making sure attackers can't like level up and get access to stuff they shouldn't exactly.

Okay, So you're trying to find those vulnerabilities. You're testing your access controls, you're looking at your monitoring and logging processes.

So it's about being proactive absolutely understanding how attackers might try to escalate their privileges so we can stop them exactly. Okay, but how do you even begin to identify those vulnerabilities. It seems like looking for a needle in a haystack.

It could be tough. Yeah, but the OSSTMM gives you some pointers okay. It talks about common techniques and vulnerabilities okay, and it encourages you to use tools like vulnerability scanners, right, penetration testing, So.

A combination of manual and automated techniques.

You got it. You got to use all the tools at your disposal.

Okay. And once you've found those vulnerabilities, then you.

Fix them right right, Patch your systems, tighten up those access controls.

Okay. So you're constantly finding problems and fixing them.

It's an ongoing process.

Okay. So we've got privileged escalation verification. What's next on the OSSTMM list.

Next is containment and egress verification.

Containment and egress.

This is where you assess your ability to you know, contain security incident okay, and prevent data from leaking out.

So if an attacker gets in, can we limit the damage exactly?

Can you stop them from making off with all your sensitive data?

Okay?

That's crucial it is, So you're testing your incident response plans. Okay, you're looking at your data laws prevention mechanisms, and you're checking your network segmentation strategies.

So it's about having a plan in place and making sure we can protect our valuables.

You got it. Now, what if those controls aren't good enough?

Right? Good point?

What do you do? Yeah?

What then?

The OSSTMM gives you more recommendations okay, best practices for improving those controls.

Okay.

Maybe you need to develop a more robust incident response plan okay, or implement data loss prevention solutions, or maybe you need to strengthen your network segmentation okay.

So you use the findings to drive security improvements exactly. The OSSTMM is really a cyclical process.

It is you assess, you find weakness, you make improvements, and then you assess again. You just keep going, you keep going.

Okay. So we're constantly evaluating, evolving our.

Security posture, always evolving.

Okay, what's next on the list?

All right, Now we're getting into denial of service verification.

Denial of service.

This is where you see how vulnerable you are to those denial of service attacks d dos.

Yep, those are the ones where they flood a system.

With traffic, they try to overwhelm it.

Yeah, make it unavailable to legitimate users exactly. Okay, those sound like a nightmare.

It can be really disruptive. Yeah, people can't access websites, applications, even entire networks can go down.

Okay, So what do you actually do during denial of service verification?

Well, you're trying to figure out how could someone launch a d DOS attack against you? Right, You're testing how resilient your network is, and you're seeing if you have any d DOAS mitigation strategies in place.

So you're basically trying to figure out how to survive a DDAs attack.

You got it? Okay, you want to build a network that can withstand that kind of pressure, sure.

Right, right? Okay, so we've covered denial of service verification. What's next on the OSTMM agenda.

Next up is business disruption verification Business disruption. This one's interesting because here you're looking at attacks that go beyond just technical disruptions.

Okay, So it's not just about taking down a website.

It's about disrupting the organization's ability to function. Wow, So we're talking about things like ransomware attacks that encrypt your data, d tos, attacks that cripple your online services, even physical attacks oh right, damage your facilities.

So these are attacks that really impact the bottom line exactly. Okay, what kind of tasks are involved in business disruption verification?

Well, first you got to figure out what are the organization's critical business processes? Okay, what are their most important assets. Then you think about, okay, what would happen if those were disrupted? Okay, what's the impact going to be?

Right?

And then you see do they have any plans in place to recover?

So you're thinking about business continuity, disaster recovery exactly.

You want to make sure the organization can keep running even.

If something bad happens, to be prepared. Okay, So business disruption verification it's about building resilience, being able to bounce back from those disruptions.

You got it.

Okay, what's next on the OSSTMM checklist?

All right, now we're getting into social engineering verifications engineer yep, this is where you assess how vulnerable the organization is to those sneaky attacks.

Those attacks that prey on human psychology. Exactly, the trickery, the deception, it's all.

About manipulating people, getting them to do things they shouldn't.

Give up sensitive information or.

Click on a malicious link, right right, social engineering attacks can be really effective.

Yeah, because people want to be helpful.

Exactly, a trust people and attackers exploit that.

So what do you actually do during social engineering verification?

Well, you might do some simulations see how susceptible employees are, right. You might even do some penetration testing okay. But it's also about looking at the training programs, right, are they actually teaching people about social engineering?

Okay?

And then you look for ways to improve your policies and procedures.

So it's about understanding the tactics, training people to resist them exactly, and putting safeguards in place.

I have multiple layers of defense.

Okay. So social engineering verification it's all about building a security aware culture.

You got it?

Okay, what's next on the OSDMM agenda?

Next up is physical security verification Physical security. Yeah, this is where you assess those physical controls.

So we're talking locks, fences, cameras, guards.

All that, all of that. Yeah. It's easy to overlook physical security.

These days, right, Yeah, with everyone focused on cyber but it's.

Still essential, it is. Yeah, you can have the best cybersecurity in the world. But if someone can just walk into your building and steal your servers, game over exactly.

Okay, So what kind of tasks are involved in physical security verification.

You're testing your access control systems, You're looking at your surveillance coverage, you're assessing your security personnel, and you're reviewing those environmental controls and disaster preparedness plans.

So you're making sure those physical defenses are just as strong as your digital defenses.

Got to have a balanced approach.

Okay, makes sense. So we've covered physical security verification. What's next on the OSSTMM roadmap.

Now we're moving on to wireless security verification.

Wireless security.

This is where you assess the security of all those wireless networks.

Wi Fi, Bluetooth, RFID, all that good stuff, all of it. Okay, wireless security is crucial these days, absolutely, I mean everyone's connected wirelessly, exactly.

So what do we do during wireless security verification?

What do we do?

We test those security settings. We try to break into those networks.

Right, We try to break into those networks.

Yectly, quite a reagular. We see how strong those encryption protocols are, and we check if there are any intrusion detection or prevention systems in place.

So we're basically trying to find any weaknesses in our wireless defenses.

Exactly. You got to be proactive.

Yeah, Okay, Wireless security verification, that's all about building a secure wireless environment.

Keeping your data and your devices safe.

All right. What's next on the OSSTMM agenda.

Next is telecommunications security verification.

Telecommunications security.

This is all about those traditional telecommunication.

Systems, so like phone lines, voicemail, fax machines, all that.

All of that. Yeah, those systems can.

Still be vulnerable, right, Yeah, we tend to forget about those.

We focus so much on the cyber stuff. Yeah, that we forget about the old school stuff, but it's still important absolutely. So during telecommunications security verification, you might test the security of your voicemail systems. Okay, you might try to eavesdrop on phone com wow. You might check the physical security of your equipment.

So it's about making sure our phone calls are private and our voicemail messages are secure.

Exactly. You don't want anyone snooping on your conversations, right right.

Okay, so we've covered telecommunications security verification. What's Next on the OSSTMM checklist.

All right, now we're getting to data networks security verification.

Data networks okay, that's the big one. Yeah, the heart of cybersecurity.

This is where you're assessing the security of your networks and your systems.

So protecting our computers, our servers, our data, whole nine yards.

The whole nine yards. Yeah, all right.

What kind of tasks are involved in data networks security verification.

Oh, we're talking penetration testing, okay, vulnerability scanning, configuration reviews, security log analysis.

Wow, it's a lot, it is.

Yeah, but it's all about finding those weaknesses before the.

Attackers do exactly. Okay. So data networks security verification, it's about building a really strong network infrastructure, you.

Got it, protecting your data from all those cyber threats.

Okay, so we've covered data networks security verification. What's next on the OSSTMM agenda?

All right, Next up is compliance verification.

Compliance.

This is where you make sure you're following all the rules, okay, meeting those legal and regulatory obligations.

So ticking all the right boxes. It's making sure we're not going to get in trouble with the authorities. Okay, that makes sense. But how do we even know which compliance requirements apply to us? I mean, there's so many laws and regulations and standards out there.

It can be overwhelming. Yeah, but THESTMM gives you some guidance.

Okay.

It helps you figure out which rules apply to your specific situation.

Okay, So it's about doing our research making sure we're following the right rules exactly.

Compliance is an important part of security. Okay.

So we've covered compliance verification. What's the final step in the OSSTMM methodology flow.

The final step is the survey, alert and log review.

Okay, so it's like the wrap up phase exactly.

Exactly. This is where you look at all the findings from your assessment, you analyze the results, and you come up with your recommendations for improvement.

So we're putting all the pieces together, making sense of the big picture.

Exactly. This is where you turn all that data into action.

Okay, that makes sense. But what kind of tasks are involved in this final review?

Well, you're reviewing all the findings from those different modules, right, You're looking at the security logs, the incident reports. You're trying to find any gaps or weaknesses that you might have missed, and then you come up with a list of recommendations, okay, and you prioritize those recommendations so.

If we find a lot of vulnerabilities, we don't have to try to fix them all at once.

Exactly. You focus on the most critical ones first.

Okay, that makes sense. So it's about focusing on the biggest risks and then working our way down the list.

You got it. And remember security is an ongoing process.

Yeah, it's not a one time fix.

It's a journey, right right.

We're constantly assessing, identifying weaknesses, making improvements, and then assessing again. It's a cycle, a cycle of continuous improvement.

Exactly.

This has been incredible. This deep dive into the OSSTMLS a lot to take in, yeah, it is, but it's been so insightful. It's really given me a whole new understanding of how security works. That's the goal, yeah, and a framework for actually managing security in a smart way.

It's about being strategic, right right.

And you know one thing that keeps coming back to me is this idea of the movie's.

Defense, the defense.

Yeah, you described it as a security perimeter with no inside or outside, right, which honestly, sounded kind of mind blowing at first.

It's a different way of thinking about things.

Yeah, it is. Can you break that down a bit further from me, How does that actually work in practice?

So the Movie's Defense is really about recognizing that the old way of thinking about security, Okay, with that hard perimeter right the castle walls, Yeah, it just doesn't work anymore.

Yeah, no more motes, No more motes.

We're living in a world where information is constantly flowing.

Right across boundaries exactly.

You're accessing data in the cloud, you're connecting to public Wi Fi, you're sharing information across all these different devices.

So there's no clear line to defend anymore exactly.

So the movie is Defense is about shifting from that static, perimeter based approach to something more dynamic, more fluid.

So instead of trying to build an impenetrable.

Wall, which is impossible.

Yeah, you can't keep everything, you can't.

The Movie's Defense is about defense in depth. Defense in depth oka distributing those security controls across multiple layers.

So it's about being flexible, resilient, being able to adapt.

The threat landscape is always changing, so your security.

Has to adapt to So it's not about preventing breaches altogether.

You can't prevent everything. Yeah, it's about minimizing the impact, containing the damage, recovery quickly.

Okay. So it ties back to what we were talking about earlier, understanding our trusts, managing risk, not eliminating it.

It's exactly, you got to be smart about it.

Okay. This is really making me rethink my whole approach to security.

It's a different way of thinking about things, it is.

Yeah, you know, you mentioned in my notes that I was worried about mention a specific concern from the listener's source material that relates to the Mobius.

Defense, right, and the movie's defense would say, Okay, don't try to prevent that specific threat. Okay, think about how you can build a more resilient system, Okay, a system that can.

Adapt, right, so even if that happens, we can bounce back exactly. Okay, this is giving me a lot to think about. I'm starting to see how the OSSTMM is not just a.

Set of rules. It's more than that.

Yeah, it's a way of thinking about security. It's a framework, right, a framework for developing a smarter, more nuanced approach.

You got it.

But honestly, it's a bit daunting, I get it. Where do I even begin?

Well, the good news is the OSSTMM is practical.

Okay.

It gives you a step by step process for assessing your security, finding those vulnerabilities, and fixing them. And you don't have to do it all at once. Start with the areas that are most important to you, Okay, build from there.

So take it one step at a time, exactly, prioritize the risks. Don't be afraid to ask for help.

There are resources out there.

Okay, that sounds manageable.

It is.

Yeah, But you know one thing that really sticks with me is this idea that security is a journey, not a destination.

It's an ongoing process.

Yeah, it's something we need to be thinking about all the time. How do we stay ahead of the curve when the threats are constantly changing.

That's the challenge it is, yeah, but it's also what makes it so interesting. Right. The OSSTMM is all about continuous learning, continuous improvement.

So you've got to stay informed about new threats. Yeah, new vulnerabilities.

You gotta be curious, okay, try new things, challenge your assumption.

So it's about being proactive, curious and adaptable, embracing the fact that security never stands still.

It's always evolving.

This has been a fantastic deep dive into the OSSTMM.

It has.

It's given me so much to think about and a whole new way of looking at security.

I'm glad to hear that.

Yeah, it's not about fear or paranoia. It's about understanding the risks, taking action, and working together.

We're all in this together exactly.

Thanks for guiding me through this exploration of the OSSTMM.

It's good my pleasure.

I feel like I've gained a valuable new set of tools and perspectives. Excellent, And to our listeners, we encourage you to check out the OSSTMM. Yeah, see how its principles can help you navigate this crazy world of security.

It's a great resource.

Remember, knowledge is power.

It is.

The more you understand the threats, the better decisions you can make. Absolutely, and together we can build a more secure future. That's the goal for ourselves in our communities.

I think that's a great place to wrap things up.

Yeah, I think so too.