[Music]
thank you
[Music]
all right
foreign
Warfare for the blue team so to start
off how many of you have unlimited
budget and all the Staffing you need for
your security program
yeah there's always like one I had a
drink last night oh okay I just want to
make sure yeah and that is kind of the
point of this so neither did Al-Qaeda
neither did Dash neither did the Cubans
the Irish or our American forefathers
American revolutionaries same thing
underfunded understaffed we're still
able to create effects on Target and
that's what we're going to talk about
today
foreign
[Music]
something nobody understands what's
going on can't get the support you need
we're gonna talk about Communications
how to push out your i o campaign things
like that and there's a lot of memes so
if nothing else it'll be fun
um
one of the things though that uh
there's a challenge with this talk is
making sure that we say I try to say
vacantly accurate but I'm going to be
talking about Che Guevara I don't say
Tong all sorts of people some of these
are more Infamous they're not
necessarily All Good People however they
were able to create effects we're going
to talk about their tactics and
techniques not their uh politics if that
makes sense I want to get canceled
all right so what's my background why am
I to qualify to talk to you so
I was an infantry officer in the Marine
Corps
um so I did unilateral counterinsurgency
operations as an occupying power in Iraq
um I also live with the Iraqi Army for a
year uh as a host nation advisor and
that was uh incredible incredible
experience because I was able to see the
effects of people in process when they
didn't have the technology they didn't
have the American Muscle and they were
very very effective in dealing with
their own problems and they had good
messaging and they
um
did it with way less and that was very
impressive to me so I want to talk about
that and then obviously corporate
background so I've uh sat on the blue
team who's the head of security a couple
places now I uh help people do uh what I
call the Arts and Crafts cyber security
equipment and Security Programs ISO
stuff like that
um
yeah it's gonna be fun
all right
so what this talk is not about this is
not a talk about overthrowing your boss
all right
[Music]
changes in leadership will produce
undesired results
also if you take anything back from this
don't go back to your company and talk
about you're going to launch an
Insurgency campaign or you might wind up
starting your own company ask me how I
know
yeah
yeah uh
yeah all right so let's talk about a
background so how many people here are
veterans
okay a few people so for those of you
with the non-military background we do a
little bit of a primer on what Warfare
is so we kind of get a little bit of a
background it'll be great so first gen
Warfare right that's basically people
online with bows and arrows up the
muskets thing Revolutionary War the
British side second generation Warfare
same thing they're still online to fight
each other but now we've got uh rifles
right so World War One how the European
spot uh your third generation Warfare
think of that as like uh World War II
big maneuver elements things like that
it's also similar to probably your
networks in a pre-covered world where
you had your network you had big
firewalls in your safe space there was a
there was a perimeter you know but now
in a post-covered world we're now in
fourth generation Warfare which is
decentralized right
[Music]
um
yeah so we're talking decentralized
we're talking ideologically driven
that's what that's what fourth
generation Warfare is in the real world
but at the same time like there's no
safe space anymore everyone's working
all over the place and it's it's the
same kind of concept and then your fifth
generation Warfare which is still
debatable is essentially uh non-physical
more for uh less ideologically driven or
generally more of like a ransomware
stuff like that where you're just more
pirate pirate side of uh Warfare Google
all right
next thing three block war so this is
the term uh coined by General krulak so
the concept is essentially in three
contiguous city blocks you could be
handing out candy taking care of people
you move to your second block you're
doing patrols governance things like
that and then your third block could be
in kinetic action
it's not that different than a day of a
security person where you wake up in the
morning give some training to people
help them out you know working through
different problems doing a change
management meeting governance and then
you activate your incident response plan
at 4 pm on Friday because nobody ever
hacks you on Tuesday 9 A.M when you've
had your first cup of coffee like is my
experience
um but what's important about that is it
requires a different mindset right so
the way you act during those different
blocks is critically important to a good
Insurgency campaign you know so when
you're handing out candy you're being
patient with people like we used to hand
out etcha sketches when they got
infected so they had a tablet they were
secure for a minute you know like solve
a problem instead of like my analysts
screaming at them because like they let
their kids do homework on their laptop
and now we have ROBLOX
um yeah I'm not the only one that's had
that problem huh
you know so we want to make sure that we
have those Rules of Engagement as our
mindset right like how do we handle how
do we operate in those different
environments is a key piece to an
Insurgent campaign
um because essentially like if you
create
if it goes bad you start yelling at
people people stop talking to you right
um
yeah the best part does me are and
instant response that's when you can
tell people to shut up and color like
we've got stuff to do right
yeah
all right hybrid Warfare this is
essentially yeah you like I told you got
good names nothing else
um think of that as uh when Russia
invaded the Crimea in 2014 uh they were
sending out text messages to their to
the local population
um to to help with their effects that's
using technology and so the virtual and
the physical to create an effect same
thing as somebody sending in a Dell
laptop to your company or a Macbook
whatever it is they know that's what you
use it gets shipped in gets into your
inventory next thing you know you've
already created a
[Music]
we put a laptop on your environment you
have no idea what's your commanding
control issues and that's where things
like you look at hybrid warfare that's
where things like uh some of these
Frameworks ISO stock too those things
help because essentially if you're
looking at physical and virtual uh
issues and you're not just focused on
one thing
so the other thing about hybrid Warfare
uh that I look at is you know you can
push out all the fishing terrain you
want but like I would at least in a
pre-copic world I'd put posters up
rotate them around uh has anyone ever
thought about inviting their executive
team or some of their Business Leaders
to one of these hacker conferences you
ever thought about that yeah we bring
them here because then essentially like
they're starting to get the
understanding of what's going on for you
that's right it's putting in Beyond blue
team sucks like right you're underfunded
it's not sexy nobody's like yeah I want
to be a blue team when I grow up like no
like that's not a thing right so
bringing them there so they they can
kind of they get that understanding they
go oh crap right
and then of course you've got your trip
wires you know tracking dock flow honey
nuts honey traps things like that
all right any questions on background
all right
prerequisites so what do we got to have
to launch a good Insurgency campaign you
got to have an attractive cause so with
the sunnis uh in 2000 and
2007 we had what was called the Sunni
Awakening in Iraq where
we got the sunnis who were
disenfranchised we were able to work
with them created a cause where they
were able to take control of their own
areas and essentially have their patrols
they certain neighborhood watches things
like that they got control they were
disenfranchised they're already dealing
with a lot of Blue on Blue but with
fighting their own people things like
that so you want to have a cause that's
going to get people to care so what does
that mean for the corporate world right
well for running around going the
hackers are coming that's not going to
get any no one cares right so if your
cause is something about what the
business does what do other people care
about in the company it's not about you
it's about them right how do we protect
people's paychecks because like at the
end of the day you can buy your
employees LifeLock you can't buy them
new jobs
so what do we want to
um what's going to matter right and also
you want to cause this kind of generate
outside support that's another big piece
is you know what do your customers care
about they care about these things
leveraging that never let a good crisis
go to waste right uh your investors
things like that making sure you have a
cause that has internal support and
external support so you know if your
cause is to help protect this line of
business which also ensures that this
executive gets this bonus that's a good
cause right it's not about the money
it's all about the money so help them
you know that's what you got to think
about your mindset how you're talking to
people does it cause resonate with them
do they care about what you're talking
about
and Doctrine and mine said Can anyone
here tell me whose code of arms that is
or who said this quote
are you
excuse me uh anybody else all right so
that's Che Guevara all right so again
what you take from this talk is
important one thing that you don't want
to take is do not call your fellow
employees peasants
okay I won't go over a while
um but the point is is pretty valid
right so you want to work with your
employees right screaming at them
because they did something stupid they
clicked on something it's not going to
be a very effective process they're
going to stop talking to you they won't
tell you what's going on and the next
thing you know it could be worse right
so having that good communication with
your with your people taking care of
them helping them understand it like we
all clicked on stuff you know except for
this guy right here but the rest of us
you know uh We've clicked on stuff so
the thing about those Rules of
Engagement how do you how do you engage
with people you know one of the things
that we did is we put in a warrant
system so that I if the manager came to
me so I think my employees on Facebook
all day I don't care it's a management
problem unless there's a security issue
it's not my problem so it keeps my team
which is you know I got a small
Insurgency right or a small team
what are we focused on what matters
right and that way it stopped them it
stopped us from being big brother so
other employees were more interested in
working with us because they knew that
like hey we aren't just snooping around
on people's stuff but we don't care
unless there's a reason
who has time
um
yeah
all right
plan
communication playing matters
all right does anyone know these people
nice
impressive all right
um so
the difference between these two guys is
one of them had good Communications and
one of them is no longer in power so the
guy on the left Hussein Mubarak was a
prime minister of Egypt or president of
Egypt whatever it was
um he lost control of this
Communications through groups of
activists things like that they were
able to get Torah in there and they were
able to get their message out doing and
during the air spring of 2007 200 10. I
think
um in Tahir Square
right got their messages out and they
created an outside support for their
cause which put eyes on what was going
on in Cairo which stopped movard from
potentially doing waste you know using
options that would have shut down that
uh
uh protest in a way that would not be uh
optically pleasing if you will but
erdogan this guy shut down a coup with
FaceTime
right and the point is like having good
cons he created a cause that resonated
he created almost a modern day Tiananmen
Square he had tanks he there were the
coup that had tanks on the a major
bridge and on Bosphorus in Istanbul
and they had people on the bridge facing
it down he got his support out there out
into this out into the streets to stop
the coup
like that's
a cause that resonated right
um so the point is like having good
comps right
you know think about your IR response to
social media you know when you guys do
tabletop exercises or instant response
training how often do you bring
marketing into your IR training making
sure that they're part of it because
there are some of us who are not
qualified to talk to the public
blessed are I'm not I have somebody that
would handle that for me it's like
there's no way
um but that's an important thing right
is who's going to hand what's your
what's your communication going to be
like how do we handle that like I love
how United like you complain about
United
10 seconds later hey DM me let's take
this offline let's have a conversation
what's going on like that's exactly what
you know how do you how are you going to
engage with somebody in social media
and also like when you're talking to Dev
all right talk to them about their code
secure code they want to talk about that
because it resonates they do not want to
hear about you taking away their
MacBooks it's their precious
move on we have jamf now for that it'll
be fine
so gotta have a plan right
you know making sure you have economic
growth
cause it resonates using that
intelligence right so you know I used to
put people I would try to find
you know either people that like
security or just want that were friendly
in different lines of business in a
company and get them to help be part of
the solution giving us that Intel of
like hey this is what the organization's
doing or this is we're looking to get
into this new third parties whatever
we're doing so we can be part of the
solution but getting that intelligence
of what's going on inside the company
you know insurgents are going to put
people in all these different Villages
you can do the same thing there's
nothing to stop you right from
understanding that
[Music]
um
you know and also you think about like
uh
Your your long game right using your
resources strategically shutting off
Facebook on day one
probably not going to win a lot of
hearts and Minds
shutting off Myspace that'd be
interesting to see who complains like
that one I might do you know
like just to be like oh okay you're we
know who that is that might be a way to
get us to mental right
um and the other thing is asymmetric
communication so one of the things that
marketing people did in the 1950s is
they realized they needed to start doing
these like uh working groups where they
would basically get start Gathering more
and more information from people right
well
that's asymmetry would pull tons of
information from people how they think
what they like what they want to do and
then they turn around using eight so
straight quick zono asymmetric
communication means
okay good are you ready man are you
drinking water sorry uh so symmetric hi
Hi how are you I'm good
asymmetric
right now this is asymmetric I'm talking
to you
and we're talking to you
there you go so
and then they turn around and get them
to make those decisions same kind of
thing so when you're doing your training
having those discussions with people
like not maybe having Dev as a separate
security training so you're talking
about what death cares about you can
have a better conversation you're
Gathering that Intel on how they operate
what they care about so that you can
turn around and use your i o campaign to
create the effects that you desire
sorry I get upset
all right you know look at your
ecosystem right
what's your core business what are the
things that can affect those internal
and external threats how you look at
things
all right remember the cyber world
Warfare it's going to be limited right
you only have so many resources you need
to create those effects dominance is
difficult to achieve so you need to
think about where you're like what is
what does that ecosystem look like where
are you going to be most successful
why are you not
all right and then threat Intel
so one of the things I tell everybody is
draw two or there's always two org
charts in an organization there's the
official one and then there's the
unofficial one there's the The
Unofficial one is the one that tells you
hey this guy is friends he's been
friends with this guy for for life he
goes he goes to the CEO's birthday
parties but he's just a PM but he's
really not just PM because he's an
influencer or this VP brought in this
guy and these guys are boys from back in
the day over here that stuff happens
right every organization you've been to
or anytime the m a stuff happens we all
know how that goes right new leadership
all of a sudden extra people show up
um
and you need to because the other piece
is For Thread Intel like there's plenty
of companies here that'll sell you lots
of cool things
I'll be honest with you like uh you know
you can get a poor man threat fee with a
tweak deck and a uh I have a component
account let's start right just subscribe
to a few things you get some news you
can get some Intel that way but the
other thing to think about is when
you're trying to build that threat Intel
is the cost to uh for effects right so
if you know if you don't know the
identity of who's going to come after
you and you don't know what the risk is
you're going to spend a lot of money
cyber security industrial complex is
good I thought they will happily sell
you lots of things to do that
um but you spend a lot of money with a
fairly limited effect but if you know
the identity but it's not known risk
you're getting closer no one identity
known risk now you can definitely go
against it so building that intelligence
is an important piece and that can be
you know inside your organization too
right like who's against you who doesn't
want
biggest afraid of Big Brother watching
things like that what are the risks what
can they do how can they affect you
if you do nothing else I would copy this
down something I highly
hi everybody we built your intelligence
building out your key performance
indicators right so how are you going to
attractive see your processes are
working how do you gain that
intelligence that people are doing what
you think they are how do you measure
that and what are you going to do about
it
obviously Burt Reynolds rest in peace
it's not a security engineer anymore but
uh
that's one thing that I found pretty
useful here uh
[Music]
all right we're talking about four
minutes recipe again you know cheap way
there's all such good stuff out there
but that's a start
all right
let's talk about our assets right we
want to embed to people right
decentralized Workforce Social Security
got to decentralize it
get involvement understand their
processes training training is huge I
feel like I've got no before which I've
got a whole comment on that but uh
no more Force fishing training are you
going to train people on actually how to
follow your process
how how to get how to get software
approved how to do those things what
matters what do you care about things
like that
you know
um it's an important piece I think
misses out people just say they read the
policies but that's not
they read the politics making sure that
they can actually they know how to
follow the policies and they understand
what's going on they also can you know
look at the third parties if you say
like hey if you're handling this type of
data I'm looking for vendors that have
ISO stock 2 or something like that
if you're not handling this kind of data
I don't care it's marketing whatever
like username and passwords finally
giving them helping them understand one
they don't want to necessarily handle
all the cool data because if they do the
rules suck right
all right and remember one of the things
that's important is
uh support is conditional right so as
you're building your Insurgency you're
trying to get your populations on your
side for a while but if you spend four
weeks to approve notepad plus plus or
Adam for some developers they're going
to revolt you have lost their support
okay so you got to think about taking
care of the little things and that we're
going to talk a little bit more but
where can you start where can you
actually be effective not trying to boil
the ocean not trying to do all the
things like let's try to win where we
can you have limited resources
use them effectively
i o
start early Dev is more paranoid than we
are
they will create the fear of the unknown
they will create like they will think
that the acceptable use policy is you
know stop them from working they're not
going to do their job it's gonna be
terrible
and it turns out if you can be compliant
and do a thousand pushes a day in devops
it's totally doable but you have you
know you can't use ITIL change
management
fun fact change management doesn't mean
change meaning just
you know anytime you go back to your
shots there
um but you got to make sure that you're
using that propaganda because propaganda
is propaganda pushing it out to inform
people okay you can't use propaganda to
fool people that's what the bad guys can
do unfortunately you're the blue team so
you can't fool but you need to push that
stuff out now I've been guilty of
putting threatbud up when they we
thought there was a DDOS attack and I
thought that she reboot the firewall
told him hey I'm monitoring the heck out
of this right now like one of those
attack Maps it's funny
um but you gotta be vigilant against
misinformation right it's a critical
piece of your i o campaign
you know interpretation security
policies security policies is it's it's
phenomenal what you think you said or
wrote down and what was interpreted
so making sure you're Vigilant against
that I mean I had a guy the other day
he's like well I think you know if I put
on encryption my macbook's gonna slow
down I was like I'll hold your MacBook
he's like oh you're old it's like that
shit's already turned on bud
yeah so but you gotta you gotta make
sure you're you're ahead of that stuff
because that's how people think people
still think encryption is going to slow
them down they have chips way better now
um the other part is you know we think
about IO in the real world like remember
when Snowden came out first it was Booz
Allen Hamilton
a week later government contractor
government contractor wasn't Bruce
allenham was just government contractor
all of a sudden they were able to push
the message of just government
contractor it's not associated with a
specific company things like that think
about like when Airbus and uh when
Boeing has a problem Airbus has a
problem the other one's silent they
never sit there and go oh that's
terrible because that will affect uh
their uh
when something goes wrong with them
turn around's fair play also it could
create uh fear in the in the uh in the
public of
should we fly on planes are they safe
things like that like that's not a
productive discussion so like when
somebody gets hacked stuff happens well
it would never happen to me you know
yeah huh right well you know but for the
rest of us
um
you know do you have your own i o ready
for for instant response you know that's
why I always make sure like I have
marketing there like pre-canned scripts
like making sure employees are trained
this is how we answer the question when
customers call in hey it's under
investigation we'll let you know or if
they have something to say because if
you don't give them something to say
they will say stuff
they'll start offering their opinions
and you know you have some people in
your companies that would love to just
offer their opinion right
let's take truth power all day
all right
let's talk about execution
all right
so
where do we start first
for those of you who are too young this
is a copy of the office in the TV show
um yeah so like I said Isis the Marine
Corps we use you know disenfranchised
sunnis that was the place to start
um so where can you build those those
bases where can you get work done where
can you be effective you know not trying
to do everything at first right
um
but remember using a mutual cause lines
this can change just find something that
like everybody wants to win on you know
I was working with a customer and it was
a quite an adventure with them and
we start we start with a single sign-on
because they're ongoing onboarding
process was terrible they had tons of
user account issues so hey let's do
single sign on no new passwords and make
it everyone's a win-win right having
figuring out what you can start with is
going to be effective as opposed to hey
we're going to go roll out MDM and shut
off half the company's phones for three
days like that's probably not where I
want to start you know
because also like
stuff happens right
all right
drawn out execution
so
you're trying to build your program or
run your program continue to improve it
there's there's the uh Mal is all about
like the long walk right
um so one of some of the issues like
it's good to go slow sometimes right you
want to move at a medium pace but if you
go too slow you lose loss of will people
don't care
missed opportunities you know I never
really get crisis go to waste one-time
marketing tagged instead of taking you
to the article it took you to uh some
news feed sites third-part news feed
site it got corrupted took you to porn
so customer click on your website I took
them to porn marketing became in scope
of my security program
same day it's great
um also you get a call from Brian Krebs
I'm sure he's a great person I don't
want to get a call from you
like for those who don't know it's dying
story of infosec like you don't want to
talk to that guy it's not good
um
yeah so you're moving at a medium pace
right you know Confucius Gotta Have
Confucius quote it doesn't matter how
slow you go as long as you don't stop
right making those continual
improvements is a key piece and that's
one of the big things that I've seen in
Security Programs is like I feel like
moving slowly if you can make one
percent ten percent improvements every
week
boom you within you know a few months
all of a sudden you made 100 change in
your security program you're not going
to get it all done at once
I mean there's products out here that
I'm sure will tell you that they can but
you know
it's life right
like if you write a newsletter
don't do what I did and have your
monthly newsletter come out once every
six months maybe have like four
newsletters ready to go
so you can keep up with that
shortcut method so this is what Isis did
in Iraq
right so
uh after we after the military left Iraq
big boom it went it went hardcore into
Alabama right as soon as we're
disenfranchised same thing
well that's kind of like what you do
right before your audit trying to get
something done or after a brief those
are probably the only two times where it
works really well or you can get away
with it because like you break stuff but
it happens uh people will be more they
might work through it with you as
opposed to other times but otherwise
just trying to go all in can be quite a
challenge like rolling out your policies
things like that giving something to
them all at once they're not going to
absorb it all
it's all or nothing right
all right movement
so
we're back I love that one uh we're
moving out again we've got our campaign
going
moving through starting to be effective
now we gotta change our tactics
techniques and procedures we've got to
continue to change things up and
continue to think through how we're
going to solve the next problem not
relying on ourselves not relying on what
we already did but what what else can we
do you know what the Iraqis use or the
the insurgents in Iraq they used to put
out uh
garage door openers and you drove across
it IED would blow up blow up your
vehicle with the Marine Corps do I'm
sure the Army did too but I'm a marine
so we were there
um yeah uh they put a six foot metal arm
in front of the vehicle that was heated
up by spark plugs that would basically
set it off so the IED would go into the
engine block what are the insurgents do
okay they've got around that we're going
to use cell phones what do we do we
start jamming Communications I mean
everybody's Communications even ours but
they couldn't go off right that was you
know continue to shift stuff around
because like
the business that can continue to change
so will you right you need to make sure
you don't rest on your laurels continue
to evolve what made sense before it may
not make sense again your risk treatment
plan you got a big thing hey we're
putting in I don't know an email
security Gateway we need this and turns
out like that's not the biggest problem
we have now we need to do something else
you know ransomware is a bigger problem
or whatever it is
um
yeah
you know I like to change my pen testers
stuff like that looking at different
types of automation like continuous red
team and stuff like uh
this company called randori they do uh
continuous stretching so they actually
exploit they they take the
vulnerabilities and show what can
actually be exploited as opposed to just
getting you a CVSs score that's like
heavily weighted on availability which
may not be the big thing if you're not a
day trading platform or something like
that like so making sure you actually
know like what things are actually what
actually matters and sometimes these
vulnerabilities it's critical
vulnerability but it's so far into your
environment that
if they got to that they've already got
command and control like doesn't matter
right so making sure you're thinking
through those things
cessation
you know when you win
let's say you win something somebody has
to you know they tap down like okay fine
you can encrypt my laptop whatever it is
um
make peace right so if you look at what
was going on with the Taliban right
after we left Afghanistan they were
pushing out their their i o campaign was
hey we're not going to stop women from
going to school we're going to do these
we're gonna do stuff right that's what
they were saying I was saying that's
what they did that's what they were
saying they were doing that to want to
keep the US from coming back in because
we were at that precipice where we could
hop right back in
well and they also want to they don't
want to create a new Insurgency with
people they just disenfranchise that are
no longer in power right so it's in
their best interest to make sure that
the population that they just became in
charge of doesn't turn on that
all right
I will buy anybody here steak dinner
tonight and all your drinks
if you can name
five out of these six people
any takers
well four out of five for free drinks
okay
I'll buy everybody around tonight if you
can if you guys can get all six
so I'm a military guy so what military
presentation would be complete without
a specific Prussian
Nicholas depression
car
Carl Von kashwoods
no it's okay you know all the
Kardashians though
okay
because if you did you should be
embarrassed if any of you all the
Kardashians but don't know these people
just saying
um
[Music]
okay so the guy on the top left Carl
Carlos right
um so car so Carl I'm gonna call him
Carl uh
sorry that's okay what was that good
friend of yours yeah my boy Carl so Carl
was all about
um
you know a limit he talked about a
limited War so achieving rapid effects
in a limited War right so focusing on
one thing knocking it out right not
trying to do everything
that's one of the things he talked about
he also talked about updating your plan
as you come to terms of the future so
understand future changes change your
plans if you look at how the Marines
came into World War one and why World
War One change when the Marine Corps got
there I'm sure there were other people
but it's because we started doing
maneuver Warfare while everyone else was
stolen trenches they tried to put us in
trenches and we said no
[Music]
um next guy Mount got that one all right
Mosaic War so a bunch of little
different things going on talked about
that each battle may be different so
understand what you do it's Gonna Change
okay you got the beret
not Jay the other one that's uh Roger
trancier
okay uh French dude fought in Algeria
there's a movie about stuff he was all
big into uh his idea of uh interrogation
was he was fine with slapping people
around they gave him the information to
give him a cigarette say okay have a
good day
um I don't recommend that controversial
guy however he was very effective and
one of the things he talked about was
making sure that uh and you complain
about the French army they were
preparing for World War II while they
were losing in Indochina and losing in
Algeria because they were still trying
to fight a World War II Type battle in a
different place that's why like when I
see these big firewalls and all this
stuff that's great but hey perimeters
dead on with the new perimeter all right
all right so we got tranquier
[Music]
uh he says avoid a single long operation
right so play the long game but fight
confusion plan for loss of command and
control so when you're instant response
stuff kill internet or kill kill email
kill single sign-on turns out L that's
single sign that's great except for hey
we can't get to the HR stuff so we can't
contact our employees but we can't log
in
oh crap maybe single sign is not great
for everything
um
but you know make sure you you plan for
that what you're out of band comes you
know but fighting that confusion he was
big on that
Che we already talked about Shay earlier
but uh
one of the things he talked about was
that every Every Act you know every uh
everything you do should be followed
along with the propaganda campaign so
when you're rolling stuff out you need
to roll stuff out with the
communications around it hey we're
making you do multi-factor
authentication here's why
not just shut up and color here's why
like I'm married to a physician she's a
wonderful woman but she was very pissed
off the other day because they're like
well now I can't log into Citrix on my
personal computer I can only do it on
this other computer you know smart
person but she's
she's a user right what is your
propaganda campaign it's the part we
spend the least amount of time on that's
why security is such a bad name because
like they sit there and think they're
gonna lock you down and nobody knows why
even these things are getting put in
place they're just being told to do it
and we gotta gotta push that propaganda
campaign out there and I said to inform
not to fool them to inform
and then uh
I'll see here oops
sorry about trying he also wants
population on your side is important and
then margella so sorry about Che so the
other guy is margellus Brazilian counter
insurgents are uh actually not counter
Insurgency uh girl Warfare guy
fascinating dude
um he was all about uh essentially a
girl Warfare used to be a renaissance
man so if you're familiar with
Machiavelli he wants to be able to have
a sword fight and sing a song at the
same time like you need to be able to do
a lot of different things
same kind of thing that's what a
renaissance man is that's the same thing
as what Margaret wants a security person
to be I'll be honest I know enough about
a cryptography to call somebody better
at cryptography than me but uh same time
making sure we know enough about what's
going on right and if you're from the
90s and you don't understand you know
the ephemeral and kubernetes and
containers and you're trying to put AV
on uh you know micro service or
something that doesn't make any damn
sense like
update yourself right
all right
current events
let's talk about Russia
all right let's worry about this talk is
that every six months I can get this
talk every six months and there's some
new stuff right
so let's talk about information right
how the i o campaign is working so
Russia they banned all the media sign a
message
but that message only and their message
only generates internal support it's not
really creating support on the outside
world ukrainians they did nationalize
their media so fun fact however they
still allowed you know all the uh other
reporters still inside the country right
that generates external support I mean
look at their i o campaign I mean the
president spoke at the Oscars
like since when have we had you didn't
even know where Ukraine was after doing
this room probably wouldn't until
recently I was there in November by the
way
um a Marriott guy but Hilton it came
with a gas mask next to the minibar
like Mary I really missed up their game
just throwing that out there
um
all right what questions we got
nothing
all right well here's some references
you guys want any of those things what I
looked up
take a picture
all right
and the other thing uh we're starting is
the blue team Warrior podcast trying to
get people to join give us your stories
eight minutes 15 minutes to tell us tell
us stuff you tried to fight through the
problems we've had so if you're ever
interested in sign up for that it'd be
awesome it's a
blue team warrior.com it'd be cool if
you're trying to get because like at the
end of the day of the blue team
like no one sent you an email saying
thanks for email working right like
[Music]
you know hey my mission my laptop we're
great today no that's not gonna happen I
only call you when McAfee like ate them
whatever
all right that's all I've got thank you
foreign