Skip to main content

Riot Games Dublin InfoSec Meetup

On July 9th, the Riot InfoSec team will be hosting a security event in our new office, which will include:



  • talks from Rioters
  • the chance for you to see and play with some of our security tools
  • time to play some games with us!
Riot is dedicated to positively engaging with the industry and its community, and the Riot InfoSec team are psyched to further that mission in Dublin - we want to share and to learn. If you work in Riot or engage with Rioters, you may hear the term “default to trust” and this is a huge part of our culture. It’s not just “talk”, it’s something that I see on a daily basis and to me, this is very special. I've linked two posts that touch on this aspect below -




As a result, we (in Riot InfoSec) wanted to “walk the walk” also and share some of our failings and successes, and learnings while building some relationships in the community.


The event will have three security talks from David Rook, myself and Peter Tillotson. We hope that these talks will give you an insight into -


  • how we approach application security
  • what we’ve learnt from trying to hire into InfoSec
  • our security-focused big data analysis
We would also like to give you the chance to check out some of our security tools we use. We will have several demo booths setup so you can play with these tools and learn more about the unique challenges we face at Riot.


Finally, did I mention that you can hang around and play games :D

Comments

Popular posts from this blog

MongoDB Authori(s|z)ation

Introduction Having answered numerous questions on the new and old authori(s|z)ation within MongoDB, I thought I'd write a short blog post explaining how things work as there seems to be some confusion. What's New Prior to version 2.4 , there was a very basic sense of "Role Based Access Controls" (RBAC) within MongoDB as there were only two roles - read readWrite which is quite limited. For example, if the user has "readWrite", that user is essentially "root" and the user can add/remove users as well as inserting data into the database, i.e. there is no role segregation. Version 2.4 added in the following 3 core roles - userAdmin dbAdmin clusterAdmin with a notable extension such that there are now 4 roles that apply across all databases - readAnyDatabase readWriteAnyDatabase userAdminAnyDatabase dbAdminAnyDatabase This increased RBAC is a significant improvement from a security perspective in MongoDB. It is imp

Separate MongoDB Syslog by Facility

In my last post , I showed how you can set up MongoDB v2.2 to syslog its logs off to a remote syslog server. As my `tcpdump` snippets show, the syslog messages hit the syslog server tagged as "user.info", which means that they're assigned to the "user" facility with a severity level of "info". I've received a few questions regarding the possiblity of splitting out syslog messages by facility, however, as everything is currently sent to a "user.info" bucket, so-to-speak, this is not possibility. There is a current feature request for this capability and work will be done on this but if this is important for you, I'd strongly encourage you to vote for this feature. In the meantime, however, (whilst not ideal) you can still do some host filtering with rsyslog as outlined here .

What's the point of (InfoSec) Certifications?

Quite recently, my GSE was up for renewal. I'm currently in the middle of transporting my family to another continent and I've slightly more responsibilities work-wise in 2016 versus 2012. However, given the effort and study that it took to get the cert the first time (and to a lesser degree the expense), I figured it was a no-brainer to renew. For me, I've always been a huge fan of the GSE and considered it the epitome of InfoSec certifications, much like the CCIE for (Cisco) networking. Personally, I learn better by "doing" and consider it as the evidence that someone knows their stuff so the "2-day lab" element in the GSE was a both a huge goal and challenge that I was excited about. I talked about the value of "doing" when trying to learn about yourself previously here with the infamous Security Ninja and here on my own blog so there's no point in repeating myself. When I did the GSE, I absolutely loved the hands-on lab mo