NP corolla good evening everyone welcome
to the last call in track two vertices
you know you hate to dig thanks for
coming here and I go into the back panel
and picking the body swinging all over
it was tricky topic and talk is Gd
security works in the real world my name
is Jeff man i am a kitchen and it's not
current contact information which is
mostly true today hardly i affiliated
may be able do scary weekly i'm going to
have occasional and apologize for the
screen not showing everything at the top
you know you're not doing as much
possibly i wanted to start off just real
quickly which is the core audience
survey when you hear the questions is
DMV security work in the real world is
your answer yes so again i don't know
how about you're waiting you tell you
and there's let's take a look um what's
are they telling a little bit about
myself and not so much just you know
even eccentric but it's the reason i'm
talking about using security I got my
start in security in the year be more
years ago so there's a member of my
magnets here I've been in the info tech
business were going on 35 years now
started to give you some 13 years they
were primarily with the National scary
agency ask questions later can
Clark I left the agency a little over 20
years ago announces the private sector
and initially I was doing them dusting
auxiliary assessments swaying people
live in connect to the internet like
firewalls gaining some sort of basic
protection and went from there so well
on the line I got in the pc i ended up
going to die for ten years and a lot of
several years i was working as a
strategist subject matter experts for a
vulnerability management vendor who want
to mail out names as they really soon it
even figured how did you get them just
real briefly just a hacker conference
and people care about this kind of stuff
they may have heard of this book called
dark territory chin a little over a year
ago I've been cabins coupled the secret
history of cyber war in this book there
is a chapter for I believe it is it's
entitled eligible receiver with in that
chapter there's a spare rap and little
there Rhydian pants and really I've got
a red teaming located in phenix and so
on and so forth and you get down to this
part where it says red team work out the
chamber called the pic which was so
secrets at beauty for desde you come
here to tell you today i was one of the
founders of the pit and one of the
original members of the first red team
at NSA and we did operate it out of the
pit that was our office we sat in
cubicles and we're trying to run the
hacker culture so we named our offices
hot enough it this is the fact qapla
they may have been to Maryland's
lamentar out of bwi airport this is
right outside because in my airport no
ones are still there today and if it was
right there the part of that going on
stain x3 the first story for what it's
worth what policy r minute there's a
small group of aging industry
known as curmudgeons that usually get
together at RSA conference every year
and lament about the state of how very
little has changed in the industry that
will try and bakey base was one of the
members of the crutches absolute several
would co and how long she was one of my
mentors she was behind the scenes as we
were setting up red teaming at NSA and
getting started down the road pen
testing and hacking and she was she was
reasons his management and lawyers in
particular and it sort of washed it over
us and through the years she's always
kind of watch over us as we ventured out
into the private sector I just wanted to
get dedicated talking to her if you're
unfamiliar with her she's had a website
for years her company was called infidel
and you can go to the website infidel
dotnet they've kind of got it kind of
dedicated the whole tight to her we're
putting up pictures of her remembrances
a lot of people have written about her I
forget the name of the person of the
length of their society that did an
interview with some years ago
fascinating never if you're interested
in this industry behind it it's an oral
history doesn't suspect basically an
interview of her encouraging highly
highly encourage you to go I didn't
believe it so this is green Becky so I
got my start working basically out of
college my senior year I started 19 in
before and I didn't actually started
ever say I have a summer intern job and
you can see the name of the place but
this is a facility that's in Maryland it
was called the time the Naval Surface
weapon set so it was all about the Navy
and torpedoes and Desmond shifts and all
sorts of unsub and mines and hide out
the summer job was working for a
physicist was doing a submarine warfare
submarine warfare research fascinating
topic when I met him the first day he
said you know the best way to explain
what we do is this book just came out
recently Mazel just read it was done
Pratap Toby's going to have a read that
book we've seen the movie if it was at
the time pretty revolutionary because
the author i'm certain does know tom
clancy rights fictional novels that it's
based on as much truth as you can get
ahold of an open source collection what
we call those and do they but this so i
read the book fascinating book like this
is great i'm gettin paid rebook my first
week on the job cool summer sonic but
the citizens did they able to get
together some money and drop minded when
these new fangled things on a desktop
computer pretty sure that's the model
that i was using it dual booted between
Dawson CPM kick your operating system
and it had some rudimentary early
database programs that basically what he
wanted me to do was he have island
cabinet that he had been amassing
research material over the span of patch
Holly 25 30 years articles reports books
clauses up and checked out of the
Technical Library of the research
facility to my chagrin some of the
material I was looking at was actually
checked out before I was born because
kind of a cloud I don't like this
documents was sitting on this tape that
was my summer job goes where all the
materials trying to catalog agent come
up with some sort of rudimentary
database they make some use to justify
the expense of mine at TC which was
hologram five six thousand dollars worth
the time so my story begins I a lesson
that I learned at the very beginning of
my career could read it there that
basically I got in trouble with security
if I came in one morning I opened up the
safe and I found this slip of paper
inside the safe things these come to the
security office concerns out above the
safe come on I was actually talking to
the safecracking guys last night
let's say that's that was similar to the
one that I had although we zoom in it
was a much newer lot but in the old days
it was like some of the ones that he
added out there where if you don't spend
the tumblers enough you can slide it
back and it really have him set guilty
but I was young educated as a college
I'm like what's the big deal you know
I'm working at a facility that's got a
fence around it perimeter protection
it's got a gate entrance of the building
you have to get past the jury in some
sort of a checkpoint the door the office
had a lock on it and then and even him
and the security guards obviously would
walk the halls at night so what's the
big deal so I love the safe open it
isn't the whole going secure and what's
the risk the pump and bad happen so
remember that we'll come back to that
later but that was sort of my first
lesson and security was guilty I got
reprimanded I think I did it twice and
businesses under the apple cart the
second time one time you can forgive me
the second time I learned the lesson so
in trying to answer this question to Zod
level security work in the real world if
I were you I'd be asking me to define my
terms where the game EMV level security
and what does it mean the real world so
real quickly briefly the real world me I
mean the commercial world on government
sometimes it's all the private sector
sometimes it's called the public sector
the pig all these terms are
interchangeable but I think most people
i've talked to over the years about VFD
level security especially in my
consulting career they sort of had this
attitude and perception that DMV level
security was all for expensive ultra
complicated very very cumbersome and
basically it was as n degrees extra
level security with only two governments
to the port anyone I like to move it
move it
shout out loud very good when I grew up
in working in video games early in my
professional career they were made many
many aspects we made alliances cultures
to this whole thing that we called
security neither just some of some of
these are newer than others i just
googled honda journey like hit the
building slide but when i started
especially at NSA it was communication
security how the concept greater Kim
inputs that information streams and so
on op SEC is what we it's just
monitoring the behaviors of the
adversary or whoever you're interested
in physique you can learn anything about
what's going wrong base without the
behaviors so on and so which one of
discipline each one that had offices and
people that specialize in the specific
thing so there's a lot to it there's
many elements to it but it all boils
down to mobile uses of all the risk
equation and there's many worse
operations out there if you google it
you'll find all sorts of the very
complicated algorithms I'm not a
mathematician Plato wrong to be because
I'm Accord analyst but it all boils down
to its very basic elements when I try to
explain it people it's all about risk
and the risk is the risk of something
bad happened you don't want to have
happen and the likelihood that happens
at its most basic level is some
combination of the vulnerabilities that
exists within your system in addition to
the threats against your systems who
wants to do something bad to you or at
risk happen countered by what we used to
call countermeasures and these are hosts
basically defined like this and if you
have a good on the industry conference
it's more the vendor side where the
business are necessarily the hacker side
and you see companies advertising the
specialized of ulnar ability or fitness
or how to do
pataskala they were his threat ask him
to explain it would be amazed that
especially because you're usually
talking to a marketing person how they
snuggle over a basic definition of what
it is the core competency of your
business justified by I've done that is
I think he likes controllable common but
vulnerability and space development in
the weakness a pret way I learned it was
the dude it was the bad guy who's
somebody that wants to do something to
you or somebody that wants to steal your
data where it's your adversary geard
national security nothing like that's
going on this day the moma grown and the
countermeasures to be many different
things in our industry were familiar
with countermeasures being called
ability management reason autumn own
abilities plugging all the holes writing
secure code but it's also the things
that you do to protect yourself the
security solutions put it all media
tools and products that are out there to
do this happen the other print it also
may be just need detection it's anything
that you do try to compensate for the
existence of vulnerabilities and threats
to try to bring everything down to the
lower level that reduces your risk
what's important to remember about the
VFD purpose with this is when it comes
to national security and risk but you're
basically talking about in those
exceptions everything the basic rule is
you're talking about human lives you're
talking about US citizens you're talking
about us interests you're talking about
employees and State Department and VOD
intelligence agents military it always
boil down to really trying to protect
human lives and not that there's an
unlimited budget so that ever was but it
was kind of like you have to do this at
all costs security is just something you
do because the risk is the loss of human
life so keep that in mind the idea of
security is also basically focused
around data and hopefully you guys are
familiar with the confidentiality
integrity and availability CIA these are
sort of the three elements of data
security now data in the our tribe
in the internet world the digital world
we've had a few new variations that
historically the elements of security of
data all into these three categories
somebody's trying to steal the data when
he's trying to alter the data from
somebody's trying to prevent the data
relating to an extra early autism
prevalence my first tour on versus i
mated NSA was working on the defensive
side producing criticism national words
in the manual for businesses on so we
did things like produce one-time pads it
made sure that they got out securely
distributed which is kind of like key
management with one time that is
basically a key out of the consumers out
some users which is primarily the
military in a one time and they might
not know what what time it is the most
secure form of secure communication that
exists as long as you use it once and as
long as it gives random some reasonable
tax doesn't similarly at random and keep
it out of the bad guys in it's
unsolvable it's not cryptographically
breakable it's not brute force capable
you can spend the rest of your life
trying to all combinations there's no
such concept of all competitions it
can't be broken perfect security my
perspectives as I started that and
evolved into the internet requiring
cryptography and other raids your
websites passwords so and so forth
because the thought machine generated
and is on man made it was all man-made
random it's all computationally feasible
but it can be broken given enough time
given computing resources my attitude is
down bill understand so that gives you a
little bit of a picture of what I'm
talking about what I'm talking about
gives you double security the reason I
came up with this talk because probably
about eight years ago I was working with
a customer in the pti world they were a
major retailer they're one of the
retailers that actually had gone through
a pretty significant breach in the late
2000s albert gonzalez was the
perpetrator they call them that they
they like
any companies in the commercial
private-public world wherever you call
it security wasn't really a core
competency they were a retailer's a sold
merchandise and because they were trying
to figure out ways to do it more
efficiently and make more money so they
catch the internet the internet was
being used for a transaction that they
had locations all over the country and
it was computers attached to the
internet and all sorts of eminences oh
they got breach why it's scary wasn't
for competency they didn't focus on that
because they just sell women's underwear
wherever was old so I'm having a
conversation with one day and I was
trying to walk them through their
various pieces out of requirements I
think we were talking about encryption
my favorite topic and I was explaining
what the options were or protecting data
it rests the encryption is one of the
options as other things that you can do
and i was kinda kind of didn't know what
any of the terms net so I was just
walking from explaining it all smells
without this kind of wish it easy to
your data at rest and I kind of shrugged
again but we don't need deity level
security and it stuck with me and that
especially stuck with me the last couple
years when there's been you know so many
breaches but again retailers they paid
well we just saw this Security's on our
core competency and sort I need to be
adjusted was getting himself as long as
I found room but the argument they gave
me at the time no need dear d level
Sperry was just a merchant who sell
cigarettes with some gas we sell to do
whatever it was security isn't part of
their business and Evan ask people as
I've talked about giving us all a lot of
experience in my career is spurious
expensive trees hindrance what's the ROI
there is no our lives just a cost
is not something to do too often
accompanies just going to give you hair
down whatever the company's on it's not
entirely true depends on the industry
but I had yet to go to a customer few
exceptions that really embraced security
the way that I learned it has
immediately so now that to where I was
in the last couple of years with all the
major breaches that have happened with
large companies in the UCI road it
started with super 13 for tuning guitar
brief stint on bebo briefs Neiman Marcus
the list seems to be no longer owner
friends on security rarely a week goes
by where there isn't some major breach
announced and those are only the ones
that you hear about you hear about in
the media big company little company a
little guy but do security even less ye
more on the technology or a third party
that's saying here use this in your fine
they're getting popped all the more
you're ready for every merchant you hear
about this halloween two or three dozen
smaller companies that you haven't heard
out there they're going to be equal
amounts of paint on workin today they're
getting grease as well that nobody cares
them but so my pot the last couple years
cuz this guy what he said to me eight
nine years ago it's always sucking on a
grain picking you don't really lose
security here you know the superior yeah
you really do and as an example this is
a redacted network diagram as a few
years old sure they're in the cloud now
this is this one specific network
diagram of the retailer that i work good
to have a couple different basic network
layouts which apologies for Hubble
different types of stores and the stores
were taught back to some sort of data
center which was invited in furloughed
I've been on premises nowadays will be
in the cloud and ultimately is heading
back to their databases which might be
going on mainframe and it if you're not
familiar with pti I want to game for pc
eyes to reduce isolates your in your
network so only
only the system's the touch credit card
data and that's all you have to worry
about that's the bleep and so this was
an attempt to identify what they call
the card cardholder data network cee
which is where all the right circles are
clearly that's a highly isolated
segmented network was not a whole lot of
crossover it's a little bit complicated
there is no here's the PTI on the left
and here's everything else to the right
it's all intertwined and complicated and
because of this very often couples have
reached as I came out of the private
sector or one of my goals as a
consultant was trying to teach
commercial companies the wisdom of
security and how good security right
doing business they've existed for a
while now they're getting them
internetting well the technology they
need to start with the plan that you've
started a policy and understand that
security is a process that has to be
followed and the lack of that and the
line of interests or the belief that
it's too hard too complicated and I'll
have the resources you don't have the
money it basically boils down to tell me
learn more by Allah box drop it in I'll
be good I've made basically the attitude
I got time and time again and what I try
to do is get beyond that with limited
success sometimes and most of the time
as companies learn a hard lesson they
went to a breach that hey we're ready to
listen but what I want to focus on for
the next little bit is taking what I've
learned over the years of year of your
level security and see if there's some
way to apply that to where we are today
given the limitations given the lack of
awareness the lack of commitment the
lack of institutional knowledge of
security with some of the different
companies and I don't intend for this to
be necessarily I'm telling you the way
it should be I really want us to just
try to retake situation of us agree
more times is not everything's broken
especially when you give a hacker
conferences you hear over and over again
how easy it is a regular thing how often
you're breaking into a famous because of
some very basic miss configuration or
some basic password mismanagement your
lack of the password in that's the way
we were breaking them 20 25 30 years ago
I mean when it hasn't changed a whole
lot of these days you know it's very
weakly we've had that various people
come on and talk about studies exams or
pen testers and they come back look at
their customers and very often the way
they're breaking into the same way we've
always broken this in absolutes get some
passwords agentless configurations stuff
it just should have taken care of
already with organizations are engaged
in commerce dition little so i want to
throw out some ideas with the goal of
documents we can do this or not but are
there principles is there a way of
thinking about beauty level security
that has yet and can still be applied in
the martial world because i got for
25-30 years we've been roommates certain
way and doesn't seem to be getting any
better as a collector and so that's
where I'm going feel free to disagree
and hopefully a lot of time for
discussion comments feel free to push
back and ask questions throwing these
out of ideas come from coming from my
longest food and where I come from look
how I was closet the tree same I knew
where this is going sneakers and
sneakers and the message of sneakers is
all about the information quickly
comments gosh I don't remember the name
who's Cosmo nothing is lean Kingsley and
what's rather large part of racer Martin
position okay the mortgagees 12 articles
which house was saying the Marty there's
a war out there
a world war and it's not allow these
that in those bullets without you
control information what we see in here
how we work what we think it's all about
the information so I think those of us
would siliguri that's true this there's
some nuance of difference in two days
and certainly there's different ways
that the companies are disrupted these
days but historically and possibly a lot
of it has to do with data and
information and still a lot of crime is
committed the theft of a that might be
personal data on credit card data and
healthcare data whatever it is it's lo
que de so let's look at the risk-based
model again I've been out in private
industry over 20 years people talk about
risk all the time Walter abilities it's
all about vulnerabilities would have
more mobility scanners on the mobility
management pen testing a lot of emphasis
on vulnerability with the idea of
reducing its vulnerabilities you would
use your risk everybody agrees with that
you know the last couple of years has
been more emphasis on press is more
technology to come out as with your
threat detection start identification
there's great agents there's help me out
who's threatened out the wazoo
especially GA begins to tompkins of
marketing pitches again I'm so much that
I don't think they understand it's not
always that you reduce the credits who
identify the threat so we know today
there since encounter them and the
countermeasures is a whole industry is
growing up about producing
countermeasures but what's different
about the risk model in the commercial
world and this might be an unsolvable
problem is risk in the commercial world
is largely a dollar figure whereas the
government which recall is that it's
human life but in the commercial world
these are companies are sovereign
for-profit we're trying to increase
revenue and profit margins so everything
that they do to try to drive down the
vulnerabilities try down or identify
threats apply different countermeasures
they all come in a cost and they have to
make it that if they're smart about it
if they're too
if somebody is presenting a risk model
to them they're making a financial
decisions in today and something they
don't do necessarily this is a sign of
value to the data that they're trying to
protect and this is a key area that I
think is something that we can learn
from the DMV and there I'm serious
poverty and it is the govt top river
who's ever was talking a little bit of
data classification that's kind of what
I'm talking about but as an example you
probably all seen movies and you're
familiar with the idea of confidential
super top secret there's different
levels of data classification and we
sort of have that in industry in
commercial world with its usually public
and private or public and proprietary or
confidential there is a few huge amount
of difference usually there's nothing
there aren't many categories usually and
the big thing that's missing in terms of
data classification is I don't see very
often in the commercial world at any
sense of valuing the data or giving any
problems of the life expectancy the data
the best example I can give you from drv
perspective is never seen a war movie
you know Vietnam movie Korea whatever
and you've got troops on the ground or
in the middle of a firefight and they're
calling in air support for an airstrike
to take out the machine gun as the enemy
they're calling it coordinates and they
want the airstrike to come in and get
the bad guys and how to do guys so those
coordinates that's data and that's
extremely important data to protect for
maybe a half hour maybe an hour because
once the airstrikes been called in it
doesn't really matter what the
coordinates were so there's a life
expectancy when you get into Turner
getting the secret level of ossification
of data in the DMV terms and convince
how much what I learn about this as
certain current events on whole
community to build an extra crazy mix
and
but the idea top secret information or
grab the Hillary's email server top
secret information more often cannot the
reason it's top secret is not the data
itself it's how we got the data so what
we call the methods and sources it's we
are tapping or we have above in a
particular one in particular building a
particular city in particular country
and certain conversations are only
happening in that room so if the
information is leaked and the people
that were one in six people that were
having that conversations get wind of a
how did the US have had information they
might include either age somebody in the
room how shared the information is high
or maybe there's a bug in the room
methods and sources that makes the
information or valuable how that how
does that translate in terms of the
commercial world well the actual data
everybody understands you know money is
something that can be sold on CH
protected it forever in the retail space
of this financial transaction records a
lot of companies because of help me out
of the socks are it's awesome task it
canceled data a certain amount of
hundred views he's in for seven years
and I don't know what to do a bit
because they're not sure they've kept it
long enough they just keep it forever
they don't have any concept of end of
life and let's destroy a great signs of
a very information anymore and in a
hacking networking we great independence
that we really don't ever think about
generalizing I apologize not think about
your corporate networks there's better
data and there's less good data is the
boldest steal data of the goal is to get
abscess all to the data make today
they're not available because we know
how easy it is rated with the networks
as you can get anywhere in the network
more than likely pitit get wherever you
want be in the network and in the early
days it didn't matter as much because
people just break into that works just
as a today I did that
check it out nowadays people who figured
out a garage that figured out how to
monetize data so they're looking for
data they're looking for ways to get the
data out more efficiently and more
cost-effectively they've got risk model
too so the next element of govt security
that sort of plays into this area we
probably heard variations just what we
used to call security and death this is
an aerial photograph of the city at the
regalton italy and it was built in some
time in the lasers so it's isaac seven
years old you can sort of see that
there's layers there and you can imagine
that the king or the river the leader
was of this city was probably in the
innermost part they were being attacked
and the further out you go less
important people were there fighting off
the bad guys and it's combination of
modes and walls and things like that so
layered protection probably altered
variations of that a lot of people talk
about how this is the only way
especially in today's cloud-connected
world or infrastructures now out there
somewhere instead of the classic sense
of perimeter but the concept is as
applies especially to figure how what's
more important less important network I
think still applies and we would call it
segmentations in graffiti I world
separating things out and I read an
article recently that was talking about
this a little bit and there's and what's
great about the fact that the classic
version of this is to try to slow down
the adversary well that's a significant
point we used to design systems where I
used to work with this in mind where
another factor how good the security was
was make it more costly and expensive
and time-consuming then the value of the
data was worth the adversary trying to
go after obviously and we were
nation-states and that was our adversary
and we would base our calculations based
on what we used to call the gross
national product was you know how to
propose domestic product basically how
much money does that company that
country have and how much are they
willing to invest in trying to get this
bit of information given all these
layers of protection so it doesn't have
to be perfect security forever it has to
be long enough to make it nod with it a
lot the next element is I think this
probably the most important one and one
of them however the scope of you and
that is building into companies a
culturist jury what I call a cultural
security where I used to work in the DoD
the mission of the deity was security
and that was what you did and it was it
was part of the fabric it was part of
the culture and everybody knew so think
back to my earlier story of a lot of
people who walked in to recap real quick
my first job was a summer job as a
summer intern and enabled research
facility and I was going to classified
material in a cabinet and island cabinet
and I left it unlocked one night and I
got in trouble so I learned a lesson
that lesson was there was a lot of other
protections in place and why what I
learned also was where the result ease
with other layers of protection where I
thought what was the big deal is one
thing failed a lesson I learned is the
culture was there was a fence around the
building it was a perimeter fence and it
was hundreds of yards away from the
building and had barbed wire on it may
or may not have had motion sensors line
it may or may not have had cameras on
there are a lot of components and parts
and processes to have one piece and then
going inside the building and having to
get through past the front desk taps
returns miles past the security guard we
had badges actually they were initially
they were picture badges and
approximately imagine there were slight
badges but there is layers of security
with processes go around and locking
doors isolating things to different
areas and not everybody you have to go
into every office that's where that good
security in depth that segmentation
comes up changing the foundation not
displaying it not right in on the wall
beside keeping it secret and even here
the security guards it was interesting
the security guards at most of the
places I work that he saw rotated
regularly not to give them a break but
they didn't want them to become familiar
with you and you become the promoter
with them they didn't much is oh it's
jeff people human he comes in here every
day they just let me anything on my
badge and because i have hired and one
out the day before they hadn't heard
about it they follow a process they
followed rules and all the seemingly
innocuous rules for all our details and
everybody understood that it all work
together to create this environment and
his culture of security and I didn't
appreciate it at the time everybody
believed in it and looking at it anyone
was trained on it everybody is aware of
it and took it seriously it wasn't ahead
of these programs of security awareness
training of his requirement and I get
another yet another lecture about our
house which should be livid military is
computed when they took the cleaning
people various things paying a bunch of
organization I was in they were they
were put into some level we might have
sorted and usually had some sort of
level of access and security guards were
aware of what they were doing but that's
I get into a trust issue and again how
much you want to put it was your
community and I seem good that I used to
teach my first came out to the hell is
knowledge and learning to share with the
commercial world popping out was tame
impala security lifecycle and how does
other parts and those are the companies
act and we're just getting started out
and connecting to the internet they had
networks they had computers ahead of the
internet hope this big gaming / agonize
to come in so we tried to walk them
through this process is getting a handle
on where they stood getting a handle I
hope they had you know a lot of it adds
to the Condor blood it's a lot of that
is your pen testing and it was fun but
we always try to do them onto okay now
that we've found all the problems let's
systematically fix them and set you up
in a way that's continuously improving
and evolving and that's evolved a little
bit nowadays you have the cybersecurity
framework and they've also got five
steps and there are slightly different
but pretty much related but very much
technology were in it not so much
process Orion whereas we talked about
this very life slide this file security
life cycle starting with a basic
knowledge of what you're protecting
knowing what you're trying to protect if
you data it could be reputation it's in
the research data in the personnel
records a lot of companies don't know
the value of the data and what they have
their hands on and they have no clue why
anybody would once your tonalities make
money on food even customers i have with
a PCI customers and so probably knew it
was the credit card data they were
supposed to protect and they do that at
some level they didn't know where they
didn't know how many places a suit so I
didn't know how many people were
accessing that make the local copies on
their desktop or local file servers or
guess sometimes on their laptops as they
walked home with every night and so
forth we talked in coaches its journey
requires method in tension that needs to
be a systematic approach security and
especially it involves all the non sexy
stuff I do like writing things down
documentation and policies and
procedures and wrote down and and and
for each other's a long time ago for the
first off the island too many years ago
on a Marcus ran over heard of them Zen
basic goodness I salute in private
office lobby security of how policies
you don't have burano policy this
context was at Harlem Hospital David you
don't have a written plan or guidelines
you're implementing a technology
solution how do you know you're
implementing it correctly or delete the
goals that you set for yourself if
you'll have some Holdren so a private
persons together some parting thoughts
and first tough out there then maybe we
can have some questions of it some
discussion room very often this is in my
experience customers they might have
some concept of this whole security life
cycle with her okay yeah well anytime
really need to code it how many and I
can set it up and I'm done I have a
blank so unprotected unfortunately
because credit customers companies don't
have the institutional knowledge they go
out to the community and very often who
they're complicated community of headers
and very often people represent the
headers or the marketers and salespeople
how the same words that don't always
know what they're talking about and
headers lie and I discovered after
working for a vendor it's hard that
they're lying intentionally it's they
just don't know anybody there knowing
better there there is uninformed and
they don't ideas to background just like
the customers of the trauma cell number
two there's also I believe too much of
an emphasis on technology and I know
that's a risky statement at this type of
conference but if we're going to be
honest with ourselves we've been trying
all this stuff from talking about the
last couple days for 25-30 years and
there's some pretty significant problems
over and I think we could probably all
agree with vulnerabilities are here to
stay maybe just maybe we should focus
somewhere else we came back to that
restaurant maybe it's time to vote
another half sex does game to drop them
on a really component but maybe there's
more charitable and like I said people
don't know what the meanings of the
words are I hear people use risk of
threatening particulars interchangeably
like there's cinnamon singing hymns they
don't understand that one is a component
part of the other so am i know that is
it all started with that look up at the
top left forum which was called the
Warrens book which was first published
gosh it was in the early ed and it was
it was all the details you ever want to
know about how to secure of computer and
on networks and all these parts so
there's a lot of work went into that and
is very exhausted and largely everybody
agreed it was not achievable it wasn't
really useful that's what the government
gives us what some people think but
that's all there's a couple weeks ago
it's all remember so they attempted to
map out all the different things of
components and technology mostly
technology days together and it's geek
so good to know about I didn't know you
didn't hopefully she is later on the
video so that's one example resolve is
Amelia's after that sort of tried to
have a cybersecurity to me and a lot of
crap spilled out there for anybody's
trying to do stuff and you know is that
better than what the government has a
long road ahead of them but if you go
back to data security or information
security most people especially Halton
Claude that you're trying to work with
company was too different to appoint a
lot of people in this industry will talk
about its people process it will
technology people burned out the door I
am of course consultants tend to talk
about the people of process in pen
testers and hacker reason focus on the
technology as well as the hundreds of
the settlements which I submit to you
that all those are important than the
missing a key element which is having
that purpose your firm is not be the
mission of the
reviewers is protect against nations and
human lives every company every
organization out there has a purpose you
should understand that based on that
purpose you should understand to what
degree and what level you need to
protect your data was a lot of it has to
do with and then you start to make some
importance and hopefully intelligent
well reasoned decisions unless you
invested in terms of people processes so
just enough I firmly believe technology
time the solution for the problem near
as I can tell after on a 35 years
knowledge and awareness we gotta make
people smarter than work toward
positions about how they deliver to the
machine that is their companies whether
you and don't do how that impacts will
security in becoming securities i like
to say the students verb something that
you do and notice I've never mentioned
that word once this entire presentation
basically I'm same as being sponsored
here it's been hi Gary their opens was
online I key technical and Haggard
security training courses client for
ian's thousands of hours of courses you
can take no necessarily a dissertation
on but three lot of all of these that
they have is a brief history the company
they've got a minor in two thousand
subscribers new confidence put up 24
hours like forty fifty thousand people
have watched it they time you stopped up
as much as they can and they're
committed to keeping an open source of
free and it's kind of fits in with what
I'm saying about we need to lead to
spread the knowledge in the learning
will get it out there so again questions
and comments no idea how much time with
up but there's not an ambulance until I
yeah a 10 minutes one vehicle 10 minutes
any questions comments disagreements
that's it I just checked the title
because I want to make sure i didn't
miss understand but
was does it work and I guess I maybe
just playing words you know and it
needed yes does it work I'm on the fence
for various reasons because people you
detailed a lot of them you know people
say too expensive we don't need that
yeah that's that's where I you know have
some trouble and answering that question
place it's a comment list yeah more time
unless a question oh yeah yeah I'm
assuming this to be a discussion starter
I think we need to try something
different what we've been doing the last
25 years while it makes the difference
technology's advancing technologies come
out it might call one problem they
generally introduced to agreements and
if you think about it vulnerabilities
the way we think of those attackers and
pen testers are really features chillin
outland or i could say hackers i asked
me to define what a hacker was couple
months ago well basically somebody
notice how your technology works better
believe it and yet we continue to roll
it out and and companies legitimately
have because of legitimate need for
companies I think they're justified
insane I don't use some obscure I
shouldn't have to know all this stuff
but yes so the purpose of on technology
we built over the 19 pocket out the
purpose of it not to be secure the
perfect routine at she's some result
right like I don't know what is the
purpose of all the time o Muslims I know
if you're building now we don't build it
too what is the purpose of Pokemon go
right buddy in the military get off my
lawn I'm sorry good in the military to
effect some you know damage or in the
commercial space you know tesla car pick
the technology ahead well some purposes
a lot of it right who that time period
i'd say on the whole why don't disagree
that info SEC has basically repeated the
same problems I day the success of
the technology or that time period and
the benefits that people have seen have
far outpaced the negatives from the
breaches and the problems which is why
people have just continued to tolerate
the infosec problems now I have a
question or a discussion point though so
the DoD it seems like has mitigated a
lot of they've embraced on new
technologies obviously gets more weapons
you've got you know advancing
technologies but they do one thing very
very differently which is their networks
are not connected to other countries and
an untrusted actors if you're going to
have a weapon well maybe the guided
bombs are now an hour talking amazon now
but I'm husband what little I punch on
the beret okay with that gun provider
the first thing they do is if you're
going to deploy ok so I was involved an
unclassified project with Android
devices in Afghanistan and the first
thing they did was drilled the radio out
and the only way to get online was
connected to the steer laptop is only
connected to the other number basically
the network is the security in the DoD
whatever are you all and out in the
commercial stage we're all trying to
deal with the internet and the problem I
like we're facing now is and it's
exploding the IOC is everything being
connected and with no crust or real
security of the protocol and I think
ultimately you're going to have the
commercial space embrace more layering
and more segmenting in networking and
there's let me down side skirt / hackers
and creative an information but i think
you know in the corporate space you can
start to see more of that that's us work
for the view of you so desire verse on
them together with your question and
last common another way of expressing
what you expressed initially in terms of
great successes is could be defined as
a lot of money off the technology and
the risk model commercial rose infobase
and that is outweighed the losses it's
another way of looking right and so your
question about the security of the view
is that it's a separate network well
start talking about the insider threat
and working we have many years of the
providers of the clothes and network but
also the cloud providers of the Internet
swara now that they were separate I
worked for a telco for a while and it
had me the security architectural review
of another project that they are working
on which had to do with replacing the
air product control systems which is
radar their kind of economy produces the
GPS data systems they have cranked
honors and every grain of all sorts an
antenna throughout the country that they
are boards and what are the requirements
about systems is closed have a
completely isolated from the internet
ranbir wasn't the DMV probably agree a
highly sensitive system that needs to be
nearly honors is unavailable because the
one of the other reminds one of our
engineers of a subcontractor does we
would welcome pushed a software updates
on the routers switches and all these
different locations over a weekend and
jump the system how does David wooden
clogs no no I don't think so this is a
number 18 hours i was talking to them
about it ins Tommy now to close and to
do some availability and what I did was
I was a home and I push those update on
like this down here at home so how did
you do missed completely isolated
network will i give him into my account
cellco and I hopped over this one
however is like but she did from home
and he didn't understand what I was
getting it really believed it was
separate networks
we're home island your love life sorry
you're a connected to your Wi-Fi purple
is P and you were manipulating the
system and disposal e under the Sun
isolated the internet he didn't get and
I'm like why we have accommodations damn
i'm sure the d it is completely sup i
know the questions or comments just like
a long time and group as meetings trying
to look at the curious on your evening
so that's carrot top here is probably
different doesn't it in my class work i
had criminal justice training and let me
talk about security it was much more
okay you have some sort of our ability
you have it these poor thing you can go
through instead of order are you going
to eliminate the risk are you going to
reduce this how you're going to
transportation accepted and i feel like
we don't talk about that now are you
going to pass her you're not going to
pacha directing and padded in line with
that because of what we've done around
the security I had another professor who
worked for hospital for physical Spears
not for a percent that didn't even like
to use security cultivating lachlan la
prévention human-like love mentioned
data loss prevention working time so
have you seen like being able reap great
things to be able to kind of be in line
with the way that operates retailer did
that loss prevention oh yeah I mean I've
spent a lot of years as it can call them
trying to find ways to say things
differently to get the point across like
I I do another talk called the art of
the Jedi mind trick which is trying to
convey some of the techniques that I've
learned over the years
I mean the first thing you said about
the binary absolutely that's that's a
way to sum up I was saying we we kind of
think all things are equal to secure or
you're not secure we all agreed you're
on secure the second thing disciple
proposed would be changing the words and
making something different other than
emphasize that's a saying that values
the data effectively yeah frontline
approach and using all the terminology
and buzzwords that we're familiar well
isn't working and Holly won't work it's
absolutely essential to try to come up
with a way to make people understand can
security at some level it's just common
sense Trudy when you can explain it
effectively the people with detectable
or not they get it oh we're trying to
prevent this from being so oh this is
how you want to protect it break it down
to its essential elements are now
getting mixed up in all their policy as
a session it helps if it's a perfect
know that it certainly goes better than
put lastima with a lot of terminology of
is increasing we have it questions yes
so and I realized I had been forgetting
to repeat the questions it's going to be
a boring to watch the question is how
does the likelihood actor in the risk
occurs we did a lot of work with wrist
abrasions background zippy at NSA and we
used to go down to threads one was
likely if somebody tried to use attack
urgent is exploited it would be
successful it was like how bad is the
whole how bad is the vulnerability and
that sort of Rufford translates to
called ability scanners lips pull the
pull the bottom button robot no push it
in for about five seconds like that you
might be just dead I can talk loudly
okay there's a lot of our ability
rankings are basically the likelihood of
success if this is try the other one was
the likely that somebody would actually
attempt to do this but we're in a
different way of looking handsome yeah
likelihood is something that's important
factor that's not all he's taken into
account a lot of risk of later but
there's a thousand variations of
holistic we should take one come with
any other questions about you mop up
sweep airlock comments parting thoughts