[Music]
okay
oh
hello everyone
i'm kyle hinterberg
today i'm going to be talking about
hacking the compliance kernel
and this isn't really what you know most
of us probably think about when we think
about cyphercon and hacking but
it is something that might save us some
some headaches and some stress
so right up front the tldr
you know the problems with the
compliance is we fail because we avoid
the annoying aspects of compliance and
what we need to do instead is understand
our compliance obligations
automate all the things
minimize the residual annoyance and
focus on the more fulfilling aspects of
the job
so how do i want to talk through that
you know first a little bit of who i am
and why you care
then some um kind of the idea of the
compliance kernel what it is and why i
should hack it some tangible methods for
hacking compliance you know really my my
goal is twofold one is to have
potentially some tangible methods some
things you can take away but also just
to get you thinking you know i know i
myself have worked in compliance and the
problem i find a lot of times is that we
all think we're doing what we need to do
because it's what we've always done
and we need to get away from that and
figure out what we need to do because we
need to do it
so
again i'm kyle right now i'm a manager
at lbmc but the interesting thing about
anyone isn't you know where they are but
how they got there i started as a
systems administrator and a small team
kind of doing everything from end users
of support to vulnerability management
you know dealing with compliance in
general
want to be a compliance analyst had to
work on you know pci hipaa socks all the
different things kind of internally then
i moved to the other side of the table
became a compliance consultant you know
kind of doing all those same things
and the reason i tell you all that is i
feel completely qualified to tell you
compliance sucks and that's just that
the nature of compliance it sucks and
you know hopefully you know i can help
talk through a few ways we can make it
suck a little less
um and the things i'm going to be
talking through aren't even really like
problems with budget it's to me a bigger
problem with mindset you know i think
about when i go to the grocery store if
i take time before i go to write out a
list i go to the store i walk through
all the aisles i get everything i need
and go home and i got food for my family
if i go there i'm hungry and i didn't
bother to make a list i'd leave with a
bucket of popcorn chicken so
that's why we need to you know get the
right mindset and think about compliance
ahead of time rather than you know kind
of chasing it and just as a note you
know when i'm talking about some of the
compliance examples i'm going to be
using pci and that's just because that's
where my experience is i've worked a lot
in pci if you haven't worked in it
you're lucky but what it is it's the
payment card industry the dss at the
data security standard and it's just
around protecting credit card
information
so you know the idea of the compliance
kernel
obviously we all know the idea of a
computer currently you know a core
component of an operating system that
serves as the main interface between the
computer's physical hardware and the
process is running on it
to me i see compliance as being very
similar in a way
you know you have a security program and
the security program is really what's
important that's what's you know making
everything secure but you can't see a
security program or at least not easily
and so the compliance kernel to me is a
way to kind of abstract that you know
compliance is a core component of a
security program and it serves as the
main interface between security
configurations and the entities who need
to validate those security
configurations you know you look at
vulnerability scans you can absolutely
have a secure system and never run a
vulnerability scan on it but you can't
demonstrate that you can't validate that
system secure you know you can do
changes in a completely you know
consistent and secure way but you can't
prove that if you don't have change
tickets you know even policies and
procedures you can think that you're
being secure you can assume that you're
doing the right thing but if you don't
have a policy and procedure you don't
even know what your organization thinks
security means and so that's where you
know like especially me you know as a
consultant coming into an organization i
see compliance as really being that that
abstraction layer lets me understand
what's going on in the security program
so you know one thing too i think that's
worth covering a little bit is what is
hacking because obviously when we're
here at cyphercon you know
hacking has you know one idea of it and
this again doesn't exactly fall into
that you know and some people think
hackie means you know the malicious
attackers what you hear on the you know
news and whatnot and then you know some
people it's more of the programming
experts and to some people it's the life
hackers that tell you how to save five
minutes in the morning by putting
toothpaste in your coffee but to me
what makes a hacker is someone who
performs tasks using creative and effort
reducing methods you know that's really
the core of it someone you know like i
really feel hackers are different and
what it is is the way they approach
problems you know i don't consider
myself a hacker in the hoodie sense of
the word but i do feel i'm a hacker in
the way i approach and solve problems
[Music]
so
why is this all important why is it
important to hack compliance you know
the the problem is that even minor
compliance misses can lead to major
problems you know again i work in pci
and there's one requirement that is to
do quarterly vulnerability scans and
those scans have to be passing which
gets a little bit into the weeds but one
part of it is just you need to do
quarterly scan so you have to run a scan
every 90 days which seems pretty easy on
its base but that's you know actually
the biggest problem i run into with
clients you know in pci there's a lot of
very technical controls around how you
handle encryption how you're handling
authorization those are usually the
things that they're getting right
because they're a little bit more
interesting but it's the boring things
like running a scan every 90 days you
know in doing that manually that's where
clients fall down and you can have an
organization that's had you know passing
all you know hundreds and hundreds
literally of requirements for pci and
they're just missing you know a few
scans and they're not compliant and then
you know they have to deal with the
problems that come along with that
and even if you are doing everything you
need to manually maintaining compliance
sucks you know if you're running those
scans every quarter and you know doing
that on a manual basis and doing all
those very you know kind of menial
processes it sucks and that's where you
get burnout and that's where you know i
come to an organization it's like oh
yeah sally she's the one that does the
scans but she got burned out she quit no
one realized she's the only one that
knows how to do a scan
and now we don't have any vulnerability
scans and that's that's literally you
know a scenario i run into
on a routine basis
and so we all need to you know focus
again on the filling aspects of our job
to avoid burnout you know one thing i
hear a lot of talk about is the idea of
you know you don't want to automate
yourself out of a job but in my opinion
the thing we need to do is automate
ourselves into jobs we actually want
so
now into you know some of the actual you
know again tangible ways that in my
opinion we can do a little better
hacking compliance you know the top
thing is this rtfn you have to actually
read the manual figure out what's going
on again as a consultant all the time
i'm coming into organizations they've
never even read the standards they need
to adhere to and they're really putting
themselves in my hands i can tell them
like oh you don't know you know i can
tell you this is the way it applies to
you this is what you need to do and they
just you know generally believe me which
is hopefully good but they again are
just leaving themselves open to someone
misinterpreting requirements or telling
them they need to do things that they
don't need to do
and the same thing goes for scoping they
actually understand you know a
compliance obligation in which part of
your environment does it adhere to you
know you need to worry about it
everywhere only in a small place
again with pci um it revolves around
credit card data so a lot of times
organizations will think well we just
have these few servers over here they
process our credit card data that's all
we have to worry about nothing else you
know we're good
i come in you know start talking to
people you know the accounting
department has reports they have credit
card numbers in them or they don't have
network segmentation and pretty soon
everything's in scope and you know
they're falling down because of missing
those compliance
obligations and you know the same goes
for requirement relevancy
you know hitting on pci again obviously
with credit card information if you're
storing credit card information you need
to follow a whole bunch of credit card
requirements for storing that those
numbers if you don't store them you
don't need to do all that that's not
relevant to you you don't need to worry
about something you're not doing but
i have 100 seen organizations that are
adhering to requirements that mean
nothing to them and i've seen assessors
and auditors who are trying to hold
those organizations to do these things
that mean nothing to them and that's
where we really need to understand our
own environments we need to understand
their own compliance obligations so that
way we can understand and fight you know
with an auditor who's telling us to do
something that's kind of nonsense
um and you know once we get through that
we understand what we need to do and
have it you know really under control
the first thing that i kind of consider
more on the hack side of it is
consolidating controls and this is a
problem i see with a lot of
organizations they maybe have you know
pci they have hipaa they have high trust
they have you know these different um
you know kind of a slew of different um
obligations they need to be adhering to
and they consider them all different
they have you know this audit and this
set of controls and this audit and the
set of controls in this environment over
here that follows this set of controls
and they get stolen the weeds trying to
figure out what's going on where that
they you know things fall down again and
so that's where we need to work to
really consolidate those controls if
you're doing something for pci odds are
it's probably you know more or less what
need to be doing for high trust or a
sock audit a lot of the um compliance
requirements out there you know they're
a lot more the same than they are
different and even if you don't want to
take the time to do that yourself you
can go out online you know one of the um
a good resources though the unified
controls framework they make what they
refer to as their common controls hub
it's literally a list of you know
basically every control you could ever
imagine mapped out to every standard and
regulation you could ever imagine so you
can take that you know plug in what you
need to worry about it'll tell you the
controls you need to adhere to
so again rather than doing three
controls for three different audits you
figure out one control that it fits all
of them you do one control it meets them
all and you're good to go
even you know again pci just this year
they released the new version pci dss
4.0 and in there they have a new concept
of the customized control and that's
entirely for this point of trying to be
able to consolidate controls now with um
the customized control if you're doing
something really good you know for high
trust and then you come to pci it's like
oh here's this requirement it's very
similar to what i need to do over there
it has its standard control but they
also have the option of the customized
control and so you can take your control
that you already have in place if you
have a mature system and just slot it
right in for pci you don't even need to
worry about their standard controls
anymore and you can just move on again
with a smaller amount of consolidated
controls
then again you know the next thing we
need to automate everything you know
like i was saying earlier scans are the
big one i i honestly can't tell you why
people don't automate scans but a lot of
people don't they run them manually and
that's just the easy example you know
kind of low hanging fruit automate
everything you can do like that if you
have scans you need to run on a regular
basis automate them and if you need to
do quarterly vulnerability scans run
them weekly or run a monthly have it
happen more often so if one does fall
down one does get missed you have
something to back it up with
and even other things like you know
policy updates you know i write a lot of
policies i hate writing policies i'm not
going to go search out my policies to go
update them again but if you take the
time like oh i need to update this in a
year set a reminder so that way your
calendar pings you and says hey you need
to do this or even schedule yourself
some time in a year so you know when it
comes around you have a half hour to
actually read through that policy
updated as needed and it's good to go
instead of just dusting it off when the
auditors come around
and even evidence requests you know a
lot of times you know you have the same
evidence you're requesting every year if
you're working with you know different
teams you know for instance if you know
you need to ask
the network security team for a firewall
config or something of that just
schedule some of that stuff set it all
up so it just you know happens for you
and you don't need to remember
you know and um
another thing i find a lot of times you
know i think this is true just for it in
general is i feel like a lot of us are
you know kind of the green crayon people
we buy a box of crayons you pull up the
green crayon you only use that crayon
that's all you ever use you put the
other ones away
when it comes to you know like
vulnerability scans a great example is
if you're using nessus and jira you know
two very common solutions a lot of
people using ssn jira and you run your
scans and you go manually create all
your tickets but they have back end
integrations you can entirely make it so
you run a scan in ss it populates over
to jira makes all your change tickets
for you when you close out those tickets
it'll run rescans and nessus and tie it
all back you know and it's you know
entirely possible and that's just one
example there's you know other
integrations that you can do the same
thing just to take that headache off of
yourself so your stuff is doing your
work for you
and then we need to really minimize the
residual annoyance you know because at
the end of the day we can't automate
everything
you know we need to do things like
create enduring policies and dynamic
procedures this is kind of a pet peeve
of mine but i hate it when i see a
policy that has people's names in it or
you know that they're using cisco
firewalls those are things that you just
can't do you have to have a policy
that's you know can last for years it
should really be minimal to update a
policy and then you have a procedure
that's dynamic and that you can change
on an ongoing basis whenever you need to
every you know day if it needs to and
that's you know kind of just your living
document
and another thing we need to do is find
time to document you know that's a again
a thing i don't do that well but you
know if you're going through a process
just grab a few screenshots as you're
going through it and then when you're
done you have a procedure you know and
even as a consultant when i'm coming in
to do an audit you know if someone just
has five screenshots in word doc it's
not the best thing in the world but it's
better than nothing at least there is a
policy or a procedure in that case there
is something telling them what they
should be doing something i can kind of
follow along with and um understand
their system and how it's configured you
know and that's just you know where
something is almost always better than
nothing
and we also need to make sure that we're
making the rules easier to follow than
it is to avoid them
my favorite example kind of for this is
more on the entertainment industry you
know you look at back you know 10 15 20
years ago a lot of people were pirating
movies and that was just kind of the way
that a lot of people got their media was
through pirated movies
but more recently that's really you know
kind of trailed off because it's so much
easier just to pay netflix or pay disney
plus and to get all the access to all
the media you could ever need so just by
doing that you know you're easily
gaining access to it for a few dollars a
month and you're good to go
it just in making that easier you know
it's cut off on the pirating side and so
that's what we need to do too think
about the policies and the procedures
that you're making people adhere to you
know like password resets let them reset
their own password some of those little
things if you let users do themselves
and do it in an easy way they're not
going to try to go around you and
circumvent you to get to you know the
process themselves and it's one of those
areas where you know a lot of times you
get pushed back where it's like well we
can't do that because it's going to be
less secure
but is it less secure if you let someone
do something and they actually do it
versus you know making the process so
onerous that they don't do it at all and
they just you know round robin around
you
you know and even back to the whole idea
just on the automating too
one thing i like to think about is i
don't know if it's i'm the same as you
but i i don't know anyone's birthday i
couldn't tell you like when i last
changed my oil when i um how to even you
know get here all of those things i rely
on my technology to do for me you know i
have a phone that tells me it vibrates
oh it's you know 10 minutes to this
meeting or you know it's been a year
since you changed your oil those are the
types of things we need to be thinking
about in our job as well and just
letting our technology you know take
over for us
so you know again the last bullet at the
the front there that focus on the more
more fulfilling aspects of our job this
is really to me the whole point of this
is that i personally as a you know a
consultant again i see a lot of the
individuals i work with burn out you
know it's just kind of a draining job to
work in compliance and it's kind of
doing the same repetitive tasks over and
over and over and you know you got to
really think about why you're doing what
you do and is it just to kind of meet
your basic needs you're just making your
paycheck and that's it because it's such
a you know killing job
you know and if that's true that sucks
for you and it sucks for your
organization because you're going to
burn out again you're going to be sally
who leaves and the scans don't get done
so you got to figure out the way to you
know have your job meet more of those
psychological and self-fulfillment needs
you know like i've worked in compliance
now for over 10 years and i'll you know
again the first one to tell you
compliance sucks writing policy sucks
all that kind of stuff sucks but i like
building relationships with my clients i
like you know working with my co-workers
things like that is where i look to to
find those self-fulfillment needs and
make sure that i'm you know doing
something that i actually feel
productive in my job and i'm just not
making my paycheck
so um again
the tldr you know we fail because we
avoid the annoying aspects of compliance
what we need to do instead is understand
our compliance obligations automate all
the things minimize the residual
annoyance and focus on the more
fulfilling aspects of our jobs
there's my contact info i'll be around
here too and if anyone has any questions
i probably talked a little fast so we
have some extra time
thank you
[Music]
what's your opinion on
this csu
i like it
generally i would say that's a you know
a good framework
you know solid i like to use that and so
it's using that as kind of an overall
framework and then having other things
kind of you know piggyback off of that
in a sense i would agree with that kind
of approach
and then for risk
how do you tie your skin
as far as what he means
yeah doing
i know like pci that's one of the places
where my opinion falls down a little bit
it wants you to do you know the if you
if you have to deal with pci the risk
assessment on an annual basis which
that's you know
gets you passing there but in my opinion
handling risk on a more ongoing basis is
my general recommendation so you know to
really take a look at your risk and then
use some type of a tracker check in on
you know more of a quarterly basis would
be my general recommendation and update
stuff um on that type of a basis that
way you can actually track kind of your
poems what you're working on and you
know make progress on it beyond just
checking in once every 12 months
so dci core seems to have significant
changes from version three both in
requirements and
verbiage yes um
what do you think is gonna be the
biggest pitfalls for companies trying to
become compliant with britain
waiting until
version 321 expires and then looking at
four
that's i think they're going to be the
biggest problem i feel like there's
going to be a lot of companies that just
don't even look at 4 until it's too late
for the the most part for if you're
compliant with 321 you are going to be
mostly compliant with four there's only
really a few spots like a good for
instance is
potentially if you have car data and
you're transferring it internally in
your network that's something where now
that is going to have to be
encrypted so if you're doing those
internal you know car data transfers you
need to encrypt it inside the network
not just when it's going over the
internet some of those items might be um
a little bit more nitpicky of figuring
out how to redo internal network
infrastructure potentially where i could
see people you know having some problems
another one is around payment pages
there's a lot of
new requirements around making sure that
you know all the scripts and other
software on your payment page is known
to you and not able to change it you
know it kind of stopped like the mage
card style attacks and so some of those
are also going to be difficult um
overall i wouldn't say there's anything
that's you know
too too bad but um definitely going to
be things that are going to take you
know six months to you know a year to
get implemented i would say
but
the customized control i think is going
to help and another interesting spot for
that is um they also now have the
i think they changed the verbiage but
basically in place qualified is um an
item
it's not that's what they refer to in
one of the rfps but basically if you do
have a minor miss you can still consider
it in place as long as you've kind of
discussed it with your qsa
so you're not entirely you know sol in a
sense just for you know in this case
missing one scan
[Music]
any other questions thoughts
cool oh thank you all very much
[Music]
you