good afternoon everybody hope you
enjoyed your lunch
um just a quick reminder
after the event the presentation ends
there's some beer benches to the ground
floor if you'd like to have a little uh
October Oktoberfest feeling
um so grab yourself a beer
uh in the snack bar and um Network and
exchange your ideas
um
so let's get on with the
remainder of the afternoon so let's
welcome Yosef uh AutoCheck to the
to the floor
[Applause]
oh
correct
that was unexpected
yeah
is that button over there
yep
great great thanks for the help
so how to kick start your security
program uh welcome everyone thanks for
coming here I know it's uh
it's really close to lunch so you could
be spending uh your day outside drinking
beers and I would totally understand
that so thanks for joining
so who am I I'm Joseph I'm fuzzyboxes on
Twitter Discord wherever you can find me
if you want to ask questions I'm not
sure whether we have time to answer all
your questions right now
uh about me
I've been working in Security in almost
nine years now uh 10 plus years in Tech
overall I started out as a developer I
did some penetration testing uh didn't
really enjoy that I much prefer working
with code and software overall
then then I pivoted into leading
Security Programs
especially around application security
so application security is one of my pet
peeves especially when it comes to
security tooling security Champion
programs security architecture that type
of stuff
one of my hobbies is uh Gathering
certifications so you can see that I
have oscp ccsk mapped scppt I'm an ISO
20K
27k1 lead auditor and I'm probably the
only person in Hungary who renews their
certified ethical hacker certification
so
yeah
uh one more fun fact about me I worked
for LogMeIn who is now called go to I've
worked for true motion who is now called
CMT I've worked for project Consulting
who are now called TR consulate who have
been acquired by 4ig so if you have a
startup and you want to get acquired
then you should hire me and I'll
guarantee you that you will get acquired
really soon
so I would like to warn everyone that
this is not a not a technical talk at
all which is uh kind of surprising at
activity you can expect some sarcasm
bathroom or really opinionated
exaggerations about the industry uh
I've been working for quite some time
and I have seen some really really bad
examples
uh I still have some ndas so I'm not
gonna point fingers but uh yeah I've
seen some
what I'm going to talk about is the
first 90 days of taking over a security
program
blessings learned how we usually run
Security Programs what are common
pitfalls in implementation talking to
people how to mess up some things and
hopefully
one of my major points will be how not
to be the most hated person at your job
when I started coming to activity it was
all about developers suck developers
don't know anything that type of talk I
I really try to change and devote that
type of behavior because it's really
toxic and yeah developers make really
awesome stuff that I wouldn't be able to
do if I were a developer so
yeah
why we are talking about this uh this is
uh really important so starting a
security program can be hard I know that
there are plenty of resources like uh
Frameworks
uh regulations compliance blah blah blah
but uh you don't really have like a path
that you can follow and uh at the end of
the day thank you you will be secure uh
you will know what to do just present
this to the board and you'll be happy uh
what we need to do as an industry is
come together and share more about
what's going on what usually happens is
that if you're if you have been in the
industry for some time now you will have
friends you will have friends who worked
with you you will have friends who left
the company joined other companies they
are now working there they see what they
mess up
they don't share that
unless you have like some private chat
rooms where you discuss all the breaches
and whatnot so the Lessons Learned are
usually not shared among people
and uh one more thing is that I really
see in the industry is that security
often doesn't understand business there
is like a disconnect between security
practitioners managers csos that type of
stuff so
I think we what we need to do is just
try to understand try to help the
business instead of blocking all the
time
so when it comes to security teams this
is usually how they see us we are like
uh not the most uh
most friendly people in an organization
just uh the same as lawyers same as
compliance folks
yes
and uh
we need to make sure that we are doing
the right things that people can talk to
us they can come forward approach us and
tell us what's going on uh when it comes
to the security of their products of
their infrastructure or just business
processes overall
so what we usually do as a security team
is we Monitor and protect company assets
that can be
documents that can be applications that
can be infrastructure that can be
any type of information basically
and how we view it is usually we create
security policies documentation we build
up security tooling we make sure that we
manage the technical risk
and we try to evangelize security
Downstream and Upstream so we try to
make
security
easy to achieve
kind of like not threatening uh way of
doing things so if you're constantly
harassing people to implement stuff then
you're probably your approach is wrong
uh
also we need to support sales and growth
so that's one way to change the whole
security as a cost center to security
who enables sales and makes deals happen
so that's one thing where you can really
really change the whole image of
security because uh you know sales is
celebrated all the time they close a big
deal and once they close a big deal you
want to be there you want to be the
person who sells uh shouts out that okay
security made this happen they wrote a
really cool white paper they filled out
that security questionnaire took some
time with that so you want to be there
you
you should be the person who they run to
when they have a problem and uh even if
you're super busy just make sure let
them know that what's a realistic
deadline and when they can talk to you
and prioritize sales and growth first
so why are usually security people hired
uh
so one thing is uh your predecessor left
the company this can be a good thing or
a bad thing
it's usually not a good thing otherwise
they wouldn't have left the company so
they either don't pay enough or they
chose a different path or your manager
will be a not so friendly person
company suddenly cares about your about
the security of your data
let's be honest that's not not happening
anytime soon
risk to became too big to handle without
security controls this is totally
realistic I have seen it in person where
you know just the sheer amount of data
the sensitivity of the data become too
big to handle without security Engineers
so they hire a security team
company needs compliance for business
this is also a relatively
straightforward thing for uh B2B startup
and uh the other reason is that someone
messed up big time so think about hacks
breaches internal conflicts incidents
that type of scenarios
and we have a
couple of typical companies that I would
like to introduce here
so startups you can expect to be the
first Security hire here uh
uh they go fast they break things they
spare no expense except on security
uh product Comes First Security like
whenever
Your Role will be basically just trying
not to get in the way and save
themselves from shooting themselves in
the foot uh just try to prevent
architectural mistakes things that can
become problematic later on
and your basic your job will basically
be spending catch up with devs and POS
because they will push like uh three
release every day without any kind of
security oversight your your job will be
to just try to shift left and uh try to
get as close to the source so that you
can catch the nasty things uh maybe
build some security tooling into the
pipeline so that you can catch it first
establish uh the right standards while
the company is still small and you don't
have to fight with 500 Developers
with mid-sized companies they might
already have some kind of security
control exacting po exact existing
program they have smaller budgets than
big companies but the scope can be just
as big you can expect a lot of Legacy
here uh
it can be nasty
and one thing that I would like to point
out here is that uh really a lot of
things depend on the con on the company
culture and the management support so
if you take one takeaway from this talk
is that you you should never go anywhere
where you don't have the right culture
or the right support because you will
end up quitting in
three months so
yeah just keep an eye on that
and big companies yeah they should
already have some kind of security
program but uh
you won't enjoy this uh things takes
ages to fix because of bureaucracy
there's more Legacy stuff than you could
ever imagine like uh yeah
yeah there is a lot of ktlo product that
uh companies sell and they don't really
do any kind of security there it's just
a show off
uh one problem is that responsibilities
might be quite unclear you know as the
size of the organization grows uh assets
creep up left and right I have not
worked in security well not the security
I have not worked in a company that
didn't reorganize itself every two years
so
all of these changes basically boil down
to responsibility shifts where things
disappear they don't end up on the radar
of any kind of team so you will end up
with things that don't really belong
anywhere and you have to catch up with
uh find the owner and maybe the owner
left the company three years ago or just
uh
switch roles and will ignore all of your
emails
and you will also expect to find a lot
of skeletons in the closet so
that is uh something that you should
expect
and
so let's say that you have been hired as
a security engineer or security decision
maker now you got them get delay of the
land understand how the organization
works
so one thing that you should do this
should be the first thing that you do is
uh prepare for the worst I have a friend
who didn't even finish his onboarding
and he has been pulled into a security
incident on his second week
yeah so you need to make sure that you
know who to escalate to who to turn to
if problems arises uh because you might
be pulled into a security incidence on
your first day I
I know a CIO who who ended up getting
pulled into a really severe security
incident on his first day like imagine
joining a company and then they
announced that okay we have been
breached please come into the boardroom
and let's discuss what should we do you
don't know anybody
you don't want to be in that situation
one thing that you should do when you're
there is that understand why you have
been hired because your priorities
should be aligned with business uh
this basically boils down to a single
fact that uh companies don't hire people
to build a dream security team like
that's that's our dream
uh business doesn't work that way they
they need to
uh
they need
you to provide some kind of value so and
they expect something if they don't
expect something then that's uh that's
really shady and you you should be
really careful with that I
I once tried to
join a company and they didn't tell me
what the expectations were so
at the end of the interview we decided
that this wasn't a good fit and uh I was
really anxious because they didn't say
why they needed a security engineer so
they were like yeah I don't know it's
it's we think it's the right time to
have a security engineer and then they
ended up hiring a friend of my friend so
I heard back a couple months later and
uh basically they hired like an
entry-level guy a couple of years of
experience and they expected him to roll
out a compliance program build up like a
really big security program because they
wanted to break into business to
business from business to Consumer so
you might be ready for that but you know
you should know it before you join a
company or expect that some things might
change
so one thing that you should expect is
that when you join a company and you are
the First Security hire or everyone is
just like uh less experienced than you
that you will be the smartest person in
the room when it comes to security this
might not be true so you might have a
boss that who has been a CSO for I don't
know
13 years and uh
but that's not his job so you were hired
to make security decisions you were
hired to build up a security program so
he will probably he or she will probably
not
try to push you too much if yes then you
should look for a different job because
we are honestly not hired to be
micromanaged unless that's your thing
so
the other thing is that you should
always do your homework don't accept
anything at face value I have seen a lot
of companies communicate oh we really
good at security we have a static code
analysis rolled out on all of the
products we have
100 security Champions and when you go
in look at that yeah half of them left
the company like three months ago and
the other half doesn't even belong to
that same team and yeah we have static
code analysis but no one looks at it and
uh most of the build builds just ignore
that steps and they fail so that doesn't
even matter I mean it good it looks good
on compliance but if they ask for an
Evidence then you're pretty much messed
up
and one thing that you should do is ask
for a 30 60 90 day plan so just that you
can know what they expect from you and
what are the outcomes of you being there
because uh you don't want to be fired
because of some miscommunication between
you and your manager that uh okay you
didn't provide
any of the outcomes that we expected you
to do like you didn't even give me an
expectation so what the hell
so once you're basically at the company
you should become familiar with all of
the written resources that are there so
you need to understand the organization
structure the culture the products the
services what I usually like to do is
when I join a new company is that I go
in I read all the wiki Pages all the
documentation all of the policies I dig
deep in slack I search for security
search for security incident search for
search for breach uh you know just
common type of security related keywords
and I try to read everything so and this
has
you know this has happened so many times
that uh they try to explain this
something and I already know it and I
already know that what they are trying
to explain it to me is not even going
that way because the real world is so
much different
and uh the other really awesome thing is
jira so jira has like a lot of history
you can see the history of the product
that you can see all of the security
bugs all the vulnerabilities and
people who work there they forget about
it so when you bring up some
three-year-old gr tickets that have a
critical security bug and you show it to
them like okay what's happened to this
and they're like
they don't know and uh
that's that's a really easy way to get
the lay of the land and understand
basically the threat transcript that
comes to a company
and uh a really good thing to do is to
make friends understand their pain
points like uh
some people just want to to be listened
to like they will tell you about all the
problems that they faced with security
and uh
you should understand their level of
influence so you want you want to keep
them uh so they're basically your
customers and you want to keep them
happy especially your powerful customers
because uh they can make or break your
career at that particular company so
if somebody comes to you that they need
I don't know uh resources to do X Y and
Z and uh uh
you say that okay but I don't have the
budget to do that and I know that this
is really important for you so if you
could help me out talk to finance that
you need this and just give them a
little nudge then uh that can be a
really powerful uh
uh tool in your among your assets and uh
one thing is don't be afraid of asking
questions don't join a company that
discourages asking questions questions
are good
I have seen a lot of companies where
there will
uh like you try to understand one thing
the documentation said uh something in
real life it was implemented differently
and in code it was also implemented
differently because some Upstream
dependency overrode that thing and it
didn't even work that way so
if you ask questions then you will get a
better picture of what's going on in
real life
and uh
compliance matters it's uh it's
something that we tend to ignore if
you've come from practical a practical
security background where yeah
compliance will it's just checking
actual spreadsheets and whatever but uh
those things matter uh contractual and
legal obligations can make or break a
company this is a Baseline
once Business Signs something they they
should treat it as the bare minimum and
uh
non-compliance can lead to a lot of pain
later on so it can lead to penalties
damages that you have to pay to for the
government it can lead to Lost
businesses and a lot of discomfort from
your end if you need to gather evidence
that you know doesn't exist or you only
have the
the exact opposite as an evidenced like
uh yeah we are running uh static
security testing and uh the static
security testing tool have been offline
for six months like
how can you forge that evidence that's
uh that's a question
and uh you need to do it early like uh
this is like a really powerful tool in
Your Arsenal where if you come up with a
requirement Matrix uh you document what
you need what you need to be compliant
with like okay we need to run static
security testing you need to run Dynamic
security testing we need to do software
composition analysis we have like X Y
and Z as a
as a patch management criteria then you
can Define that and just build your
policies upon that and if they ask why
did you do this because we need to be
compliant with X Y and Z so
and you signed a deal you agreed to it
so it's not like
something that's flexible we must do it
and when you start mapping out gaps so
you come to a company you understand the
compliance requirements you understand
like how the company is built up now you
want to understand what are the security
gaps because you were hired to fix them
or just
get that technical risk to an acceptable
level and there are a couple of common
methods to find uh problems uh you will
probably do a mixture of these
uh because there is
you don't you can't really at least
realistically expect to find everything
with only using one of these techniques
uh security Frameworks is one common way
to do it so just look at the iso 27k1
technical controls or the nist framework
or
just a security maturity model and a
startup map okay we are at this point
our peers are at this point so we should
probably get somewhere in the same
ballpark
and uh
if if they do any kind of like
compliance program then they should have
a risk register and it should be updated
you will find some gems there that
haven't been addressed in a really long
time and uh that's always the good idea
to take a look at that and try to build
upon that and you can say it's like a
it's a big thing that okay this has been
on the risk register for for consecutive
years and uh I fixed it during my first
three months there so that's
that's a quick win
third party audits can be expensive and
uh
uh I'm not a huge fan of them because uh
you can't realistically
expect someone to come in uh spend two
days there
uh people are gonna lie like uh that's a
really common thing that I have seen uh
is that people like to Auditors all the
time because they
kind of expect them to be lied to
threat modeling is is really good but
you need to approach it the right way
people don't like to be blamed they
don't like to be the person who
introduced that bug they don't like to
be the person who needs to fix that bug
so when I try to do threat modeling I
always try to approach it like
okay guys we are just mapping out the
security problems you don't need to fix
it if business doesn't want you to fix
it we're not going to point fingers okay
you introduce this box so you need to
fix it I I just try to gather as much uh
amount of information as I can and
basically synthesize it to some kind of
actionable plan and uh security tooling
can also be helpful here if you're
running WordPress just run a VP scan on
your corporate website and expect to
find unhappiness there and sadness
and uh this can take quite some time if
you're doing a throw a pro which like uh
you're doing a lot of these activities
then you will see that this can take
from a couple of days to couple of
months even and you will not find
anything that's for sure
and once you have that mapped out you
need to put together an action plan and
uh one thing that you will never have is
enough resources so you need to focus on
things that are either high risk they
amplify your impact or are easy or cheap
to fix so high risk means that if you
don't do this the company will get
breached in
a month a year a decade whatever it's a
high risk item critical risk item so you
need to do it right away
amplify your impact in this case means
that if you do that thing in your list
then you will have more time to do other
things so it frees up your time you can
do
more activities that are helpful in the
long-term Road and is it cheap to fix is
that those tasks that are like
relatively painless you can do it in a
couple of hours and uh
basically look good so that's like
fixing the Cypher suits and DS
configuration of your company website
one thing that basically eats up all of
your time is recurring tasks so every
security team has ktlo work and these
small things basically eat up all of
your time and limit the
amount of meaningful work that you can
put out so
you need to make sure that there isn't
too much time that you like put on your
backlog and uh otherwise you will be
doing constant firefighting and you
won't be able to do anything meaningful
that you were hired too
but a really good way for me is to
delegate things to other teams like uh
if they expect you to patch your patch
the company assets as a security team
then
I would run from that company like other
people know the infrastructure much
better that's their primary focus so
they should be patching that
uh unless uh
unless you're that type of organization
where the security Engineers are also
coders and unicorns and whatever but uh
good luck hiring people to that team
it's uh it's really hard we try that and
uh Outsourcing so if you do
vulnerability management as an
outsourced service that can also take
some pain away from your shoulders and
you can automate some of the things just
be careful that automation doesn't come
cheap so
if you try to automate something then
you need to keep that up and running so
if you build a tool that tool will have
vulnerabilities you will need to fix
those vulnerabilities the service will
go down you need to restore that service
if compliance expects you to
have evidence for monthly scans and your
service goes down regularly then
then you will quickly end up just
maintaining that for a really really
long time so
yeah rolling out and maintaining this
can be an operational Nightmare and uh
hosting your tools is just one thing
that I personally don't really prefer we
have tried it with
blender managed tools with open source
tools like uh they don't
really work unless you're that type of
team or you're
like put into a team that does this as a
living like it's your primary focus
so
when it comes to tooling my advice is
just
only implement it if it saves you time
and resources so you don't need to
implement a vulnerability scanner if it
doesn't spark Joy
you
you should only Implement something is
it improves Security in a meaningful way
or is required for sales and compliance
and but then again you should look at
tools that are
painless to keep running
and one thing that's really easy is to
repurpose and piggyback non-security
tools so if you have like a CI CD
pipeline you have linters Cloud
platforms mdms those have security tools
baked in and what you should do is just
ask
permissions to access the security part
of that tool and use it for security
it's a
it's also really good because people are
know how to use it and it's less
friction than introducing something you
like uh asking people to log into a new
service and expecting them to okay now
you have to click on that button in Octa
after every comment look at what the
outcome of that security scan is and uh
and take action based on that that
introduces friction and people don't
like friction
and uh something that you should also do
is uh reporting so reporting serves two
purposes one is to just show to
management that okay we have been uh
this secure so far and we are right here
or right here and uh what we
expect to do to improve that score uh or
say that okay we have been keeping this
and we have been decreasing the overall
risk level uh by like minus x amount of
vulnerabilities per month and if you
expect us to
to look at that other product that you
are trying to bring into the company we
need to hire I don't know another person
to do that job
you can also recognize common
outstanding issues and patterns like
if
if you see that the company really
struggles with cross-site scripting then
you should probably do a training on
cross-site scripting and make sure that
everyone attends that training it's a
this can be used to just fix like uh
patterns like toxic patterns that occur
within the company and they just show
you a really easy way to improve your
foundations
and uh I've fallen into this trap before
always try to make reports that are
useful both to you and to leadership
because otherwise you will be doing
twice as much work which uh which
basically leads to pain and friction
again
so creating an action plan so
what you need to do is understand your
assets your risk and your security
maturity and build something upon that
like a short-term action plan and why
you need to understand your assets is
that are those are the things that you
are trying to protect uh
you know the risks like what's the risk
of breaching that very important asset
in your company and you understand your
security maturity like how do we protect
that very valuable asset and uh you need
to come up with short plans like uh
okay we are we have really really crappy
firewalls on our uh I don't know
production data set data center then
your first thing would be to fix that
throw big things that like take ages to
implement on the backlog and try to
break it down to smaller pieces because
that way you can uh break it down and
make it more friendly for your
for your overall workload
and you don't get lost in the details
because you've already breaking it down
to smaller chunks and uh you should
build up the foundations before doing
any of the flashy stuff so you don't
need the blockchain you don't need the
AI you don't need all those fancy Cloud
thingies if you haven't implemented a
centralized identity the solution so if
you're if your people are still logging
in with short credentials then you
really don't need to do a lot to make
that more secure
and one more thing is that you don't
need to be afraid to revisit and change
this later it's perfectly fine to change
that action plan later on
and uh just to summarize some of this
stuff here is the 30 60 90 day example
so that if you
happen to
join a company and you don't have a 30
60 90 day then you will know like you
will have some kind of boilerplate that
you can look at
so it's just basically the same thing
that we have went through like
understanding the company uh meeting key
stakeholders and teams understanding the
Regulatory and contractual obligations
mapping at gaps uh coming up with
short-term goals and long-term
improvements
and we are almost there so keep on
so how to become that that security guy
if you have read the Phoenix project
John desiso is like really get an
example of that guy that we don't want
to become
so I have seen this Behavior a lot with
the csos so don't throw your weight
around this is really like uh this metro
Alpha toxic masculine where you
come to a company and you know like the
the the the this which need to fix that
yesterday why weren't you doing this
don't do that that's awkward and creepy
uh don't think that you're smarter than
everyone this is really really that God
complex where you think that just
because you are an expert on your field
which which is relatively uh Niche field
then you are smarter than everyone else
you're not uh other people are smarter
than you that's just a fact don't try to
change everything on your first day
that's uh that's also something that
I've seen where somebody like new CSO
comes on board and they need to revamp
everything they need to flip everything
they need to okay from tomorrow we are
using qualius instead of nests tomorrow
we are going to use I don't know and uh
just because they are familiar with that
they understand that they fear the new
things
and uh don't be a security absolute test
so please don't do that we are we are
not here to make perfect security we're
here to make good enough security that
that is appropriate to the level of risk
that we are facing
and uh don't buy that super expensive AI
blockchain crap like uh
it's like train your people up do that
instead of like wasting money on uh on a
lot of fund or
recommended materials so
here are some things that I really
enjoyed during my career the Phoenix
project that's classic agile application
security is even if you are not into
application security but if you work
with software companies this is a must
read startup secure is like a really
really high level this is not even for
security people it's for business people
but it kind of gets you at the same
mentality that others will expect you to
communicate with and uh
the defense in that slash the CSO series
podcast is another really great podcast
that uh you should listen to they just
invite csos from other big companies
like LinkedIn those type of stuff and
they talk about really interesting
security uh topics and uh if you become
a security decision maker then project
management will be a must so knowing how
to manage projects uh what are the
common pitfalls of security projects or
other projects uh the Google project
management course I found it really
really good it's a practical course
which is uh which is like mind-blowing
like uh it's kind of like the oscp for
project management
uh you will need to draft up project
management documents and this is a much
better way of learning this really
boring subject so
yeah I can recommend it a lot
and like
a really short summarization of
everything like be humble
security is only one part of the
business you need to be like in sync
with all of the other parts of the
business try to make friends instead of
enemies do a few things do them well
enough don't try to do everything
perfectly don't boil the ocean don't do
like really really flashy stuff that you
will not finish because it will bite you
in the ass later on and uh
I think we ran out of time
and uh so no questions and uh if you
have any just uh there's a Discord and
you can and just ask questions there uh
so thank you very much
[Applause]
thank you Joseph for that clear logical
presentation full of meaningful advice
thank you