[Music]
thank you
[Music]
all right
foreign
welcome everybody my name is Dan Creed I
work in the infrastructure security
curve in product security assessment
analysis for a
very large social media and metaverse
company that shall remain nameless
thanks to our attorneys
now we'll Dive Right In here so
a conversation today and this is a
conversation yeah
not a talk so feel free to ask questions
afterwards and uh
keep in mind some questions if you have
them but the graphs that I have on the
screen here show the cost relative to
fixing bugs all vulnerabilities at the
heart of it are bugs
um in a shift left mentality so starting
at the coding or design phase when
you're Gathering requirements for the
product You're Building
up until after release if you follow the
Curve
on both graphs you'll see that you know
at a minimum on some estimates once you
get live in production and a bug is
found it costs roughly 150
to
640 times
as much to fix the bug after a product
has gone live as opposed to fixing it
during the design or even early on in
the implementation phase you know
particular company I work for we have a
pretty mature ecosystem
we estimate that we've probably driven
that down that cost Factor down to about
30 times
so what does it take to get there and
build infrastructure at scale
Security in this way
it starts really with good security life
cycle and vulnerability management life
cycle and starting to operate into a
shift left security mindset for those of
you that are new to shift left security
uh
you're moving where you're finding the
vulnerability where you know typically
after a product is live you read about
it in the Wall Street Journal that's
your exploited vulnerability to prevent
it and down that likes life cycle where
prevented is at the other end of the
spectrum
in that you're actually finding the bug
during the design phase before a single
line of code is written or a system is
deployed then you have autofond human
found and externally found sitting in
the middle of that
so let's start with prevented what do we
do to prevent bugs like this from
getting in there first we'll talk about
scale
so the scale that I'm talking about we
have approximately 8 million servers
our average Network egress traffic
hovers around 200 terabits per second
pumping a 28 000 gigabytes per second of
data
to between two and three billion users
so we start with a Security review
program that looks at things
comprehensively
starts at the design phase
typically with a threat model for those
of you who are new to threat modeling
threat model is the concept of before a
line of code has been written or a
system deployed going through and
identifying the risks the trust
boundaries and then potential
mitigations to that threat
this is where you get your biggest cost
savings from if you can find them at
this phase
I mean it's typically a null gain cost
or you know at most 1X because you're
literally designing a more secure
product that this bug is never going to
exist which ironically enough also makes
it the hardest to quantify because how
do you quantify nothing and something
that that never exists
and the other key component of that
would be having Baseline security
standards this is one area that in the
industry we're seeing a lot of movement
if you look at all the different nist
Frameworks and different Frameworks in
general that are coming into it and
Security in general
this is driven by the fact that security
really has been treated as a second
class
Citizen and not really an engineering
disciple
you'll still find many computer science
programs referring to
coding as software development and I'm
going to encourage everyone here it's
that software development it's software
engineering needs to be treated as an
engineering discipline you'll notice
when companies like Ford or Airbus build
a plane or a car that they have
standards that guide their Safety and
Security practices to ensure that they
have a baseline level of security
and software now would you put your wife
and children in a car or a plane that
was designed by a group of Engineers
like us who never thought about Safety
and Security
of course you wouldn't so like as
pervasive as software has come becoming
Our Lives why do we continue to build
software like this and this is largely a
problem that starts in our schooling
system as well very few schooling
systems teach threat modeling and
security fundamentals to the point that
you know if you're a computer science
major
or in school and learning programming if
you write code with a bug in it your
instructor should fail that assignment
and have you try again
um security is everybody's
responsibility
the security team that I work on we have
one of the most distributed models and
it also allows one of the important
things is like how do you scale your
program
we have
almost 80 000 employees of which
over forty thousand of that are software
developers if we didn't pass that
ownership and make
software engineering and security and
safety a part of that discipline we
would not be able to scale
especially given the talent shortage
today
so next on that scale you move to Auto
phone this is another up-and-coming area
that companies are getting better at
you're starting to see a little bit of
an emergence of AI in
um
within our company at every single diff
that is submitted we do lending we do
static and dynamic analysis tool we have
the capabilities of fussing and unit
testing at every div as well as a manual
review process that comes later in the
pipe that we'll talk about but
you would be surprised at the
effectiveness of this program we
originally set out with a goal of being
able to automatically find or during the
design phase 50 of the vulnerabilities
now we have approximately on average a
hundred and fourteen thousand
commits every single month
to our code base
of that we are now at the point where
we're actually changing our metrics
around a bit because we're finally to
the point where we're exceeding on a
regular basis that 50 Mark to put this
in perspective
in the last half of 2021 we found
approximately 10 000 bugs of which uh
6880 were automatically found by our
linking and fussing with the remaining
being found during our human and very
small amount of fun that actually made
it through that process
our
static and dynamic analysis tools we
built from the ground up their purpose
built for our social networking company
and recently Pisa
which is the static analysis tool that
we use for
python static analysis actually won an
award from the IEEE
next as we progress down the stack we
move into different views and code
reviews at the human found phase like
now this is where it starts to get
expensive once you get into the human
phone I mean in an average company
you're looking at a 30 to 40 times
increase in the cost to repair that bug
because at this point code has been
written systems have been deployed and
for all intents and purposes the bug
exists and it will either end up being
found by a human it'll be unfound which
is on the rise or it will be exploited
later in life at which point the cost
really explodes
um as part of our diff review process
after all of the automation goes on
every diff is then sent into a queue
then as I said we have over 40 000
developers that a second set of eyes
must review that dish and improve that
that this has been reviewed and cleared
the land at which point then it's sent
to the central repository and
distributed to our Fleet of servers
externally found now we're getting into
really dangerous territory because now
the product is actually accessible to
the world
in this we have a private bug Bounty
program
again I would encourage companies to do
there are a couple of vendors here as
well that offer this kind of service in
which
with your private bug Bounty you're
essentially paying a select group of
people to
basically operate as a hacker from an
outside similar to a public bug Bounty
but this one private and our red team as
well red teaming if you don't know the
difference between a red team and a pen
Test please come see me after the
session and let's have a talk
there are two very different things and
it's one of those
all Bourbons are whiskey but not all
whiskeys are Bourbons kind of thing
um and our red team focuses on
everything we're in the unique position
that we manufacture a lot of our own
Hardware in the data center
as well as the operating system in which
our switches and our core infrastructure
Network gear runs on
so we have to have a very comprehensive
red team that can cover both most
recently we had one person that was
desoldering the chip off of a
programmable logic controller in one of
the HVAC units in a Data Center and
intercepting the firmware and decrypting
it and
supplanting it with a malicious firmware
to on the appsec side of things having
people who are well deeply encode
including where we have a particularly
steep learning curve because a lot of
our stuff was bespoke and written before
things like kubernetes existed
so our containerization is all custom
unfound
unfound it's interesting to look at the
increase in the number of unfound bugs
especially at the hardware layer which
is really tricky that it popped up I'm
sure many of you have heard of things
like specter and a large number of CPU
vulnerabilities have been found
including ones that existed in CPUs for
I think five ten years
you know
generally unfound you know are those
ones that you hope won't bite you but
you never know and you know I use
Specter and meltdown as as Prime
examples of how these can bite you in
the past and like
amen General like I said with hard work
it's really tricky because it could be
anything from you know where hopefully
you have a program of a logic controller
Asic that makes things easy but that's
not always the case and sometimes it's
baked into the rust silicon
so to combat some of the unfound I found
it effective to set up code walking
programs in which you set up small
rewards
for your
software Engineers you know to take a
certain amount of time and allow for a
certain amount of time a week to go
through randomly and walk through
various pieces of code as well as
setting up specific targets of some and
prioritizing like your top
risky things in small bite-sized chunks
and asking people you know kind of
having a Target Hit List to do code
walking through
exploited these are the ones that make
the
times in the Wall Street Journal and
these are the ones who do not want to
see yourself on CNN for
so another big area which many companies
put a whole lot of focus into
the more
traditional response of let's put up
more firewalls let's put up a laugh and
then they tend to substitute on incident
response
and detection which is surprising given
that
you know detection times still are
measured oftentimes within our industry
in weeks months even sometimes years
whenever you give a hacker More Time On
Target the more damage they're going to
do which is really surprising giving
ransomware
in the increase in the ramps ransomware
and what it can do
weren't aware of this fact you should be
but most ransomware attacks
live in the life cycle of take weeks to
months to actually set up so when you're
reading about those ransomware attacks
on the news it's generally not somebody
who got in and did something in a couple
days
it actually started probably weeks to
months ago in which a lot of lateral
movement points were established and
they worked their way into a larger part
of the Enterprise which in some ways
ties back a little bit with your ranking
and
now if your red team is not
objective-based they should be typical
tactic for our red team would be to set
them up with a specific goal in mind of
okay so our goal for this operation is
to get domain admin or root uh you know
depending on your segmentation it could
be scoped to the whole organization on
down to a specific critical group of
servers depending on your industry and
vertical
another big thing in the meantime to
detection where a lot of people fail is
not taking advantage of low-cost
human nature deception systems a lot of
people look at this as dirty play I can
assure you it's not hackers do this all
this all the time in social engineering
and it costs nothing
if your password policy is 12 characters
create an account with 11.
with the sole purpose of monitoring that
because if somebody's running a password
crack against you guess which account is
the first one that gets hit
yeah then do things that play on risk
versus reward
and you know depending what vertical
you're in set up a fake account for you
know
Mark Zuckerberg or Jeff Bezos or
somebody who when a hacker hits that
system
the risk versus the reward is just too
great that you know that they're going
to hit it that all it's doing at that
point then is super low cost and it's
serving as a you know virtual tripwire
or a land mine that goes boom hey
somebody's looking around at things they
shouldn't
then moving on to you know mean time to
response again response is measured it's
often really slow
do tabletop exercises drill your team
you know the military has a mantra in
which in
they train like they fight
so that when they fight it's automatic
and they don't have to think about it
and uh
you know you want to make it painful you
want to make it real I love getting in
conversations with Executives and stuff
on you know
well should I allow this pen test or
this red team engagement on my
production systems or you know during
the middle of the night or during the
business day you know when business
critical stuff is going on and having
that conversation with your executive
that's often talked you really think
that the hackers sit and ask me what
time it's okay to attack my systems
course they don't you know you have to
operate on the same
rules and parameters that they do or
you're setting yourself up for failure
so focus on responsible the last thing I
wanted to cover
as far as exploited bugs we also operate
a program called defense through offense
is geared specifically towards red team
and our Mark Junior security Engineers
to give them the opportunity to work
with the red team and actually learn
techniques tactics and procedures
um
splitting the team in half where
basically half will go and work with the
offensive side half we'll work with the
incident response team
and you'll do an objective-based
scenario that could start at a table
time tabletop exercise to a live fire
drill
that then runs them through and
practices from start to end an event of
matches the red team but coordinating
with that with a more realistic scenario
from rad team to incident recovery
so key points One Security is a life
cycle you know early Discovery does
lower the cost to remediation and it
reduces technical debt which is really
important when you think about it I'm
not sure how many software developer
types we have in here but like
show of hands who likes to work on Old
broken Legacy code
okay we got one weirdo in the back
you know well yeah it turns right out or
is right you know as opposed to you know
you get new students and like
we do a lot of hiring and like we see
this even in our recruiting cycles and
hiring like nobody wants to work on the
infrastructure nobody wants to work on
the Legacy systems they want to work on
the cool new metaverse they want to work
on the cool stuff that you know oh this
is going to be in front of my friends
and family and you know 2 million users
um early discovery of this and like
threat modeling and getting this stuff
out and getting it right in the design
phase
you know not only is it going to give
you a more secure product but you're
going to have less Tech debt
because you thought about it in advance
another topic I didn't cover about that
like there are common
factors and myths that have been
associated with threat modeling that
like I want to dispel right now one
you do not have to be a security expert
to threat model we want security you
know we want software Engineers people
who aren't traditional security to do
this and that's often the first thing
well I have a security department you
know that's their job you know I don't
need to know how to how to secure my
systems
every animal on this planet threat
models whether you realize it or not
every single one of you when you got
behind the wheel of a car when you lock
your doors at night you did a threat
model threat model is simply the process
of identifying a risk identifying a
trust boundary and coming up with a
mitigation to it
so you know
you lock your doors at night why do you
lock your doors at night because you've
evaluated the risk of getting robbed
which
you know okay I'm gonna get robbed how
can I prevent that what's the trust
boundary the trust boundary is door and
there are people on the other side of
the door who are nefarious and might
want to rob me because I've got valuable
stuff here
so what's your mitigation lock the door
you know and then this kind of exercise
threat modeling doesn't have to be heavy
weight and complex
these Frameworks like stride and active
and pasta
it's similar to Agile where if anybody
here has experienced like implementing a
packagitized
agile framework for their company like
ca safe or whatever you know like
it becomes heavyweight and bulky fast
because like that's like read the agile
Manifesto that's not what agile is agile
isn't something you put in a box and a
product and like neither is threat
modeling if you read the threat modeling
Manifesto threat modeling should be
designed to work with your development
teams and their development life cycle
how they develop
so like don't buy into this whole notion
that it has to be heavyweight like we
have plenty of threat modeling going on
in our very large organization that has
done via quit and Google doc
um
you know we're trying to get away from
that because it's hard to get metrics
out of that but it's done and it works
and it works for those development teams
it's up to us to provide them with
better tooling than that enables that
same piece of workflow
um a holistic security program doesn't
blindly rely on annual penetration tests
another fun show like hand questions how
many people out here have worked with a
company who solely rely on their annual
pen tests as being their Bellwether of
whether or not they're perimeters
appeared on
you know a pen test just it's good for
identifying deficiencies in your
perimeter but it's not how the real
world operates
you know
a hacker is not constrained by time a
pen test generally is
um you know pen tens are pen tests tend
to go wide and scan for a variety of
things
a real hacker doesn't you know they have
an objective in mind and generally that
objective is get into your business move
around your systems laterally and how do
I monetize this
yeah
so
you know having a whole life cycle and a
secure development life cycle like this
also helps reduce security
from being seen as an obstacle but
rather as a business enabler how is it a
business enabler what company doesn't
want to end up you know on CNN or in the
paper what company doesn't want to build
more secure products
you know Executives you see more and
more csos are getting a seat at the
board and at the executive level
because companies are sick of seeing
their products be poorly designed and
breached because someone never bothered
to stop and think about how could this
be broken and adapting more of an
adversarial mindset when designing it
this is probably the most important one
to me is build security into your
engineering culture I can't say it
enough it starts with our education
system
you know
I'm 48 years old when I was a kid you
know computers were still relatively new
what my kids can do now computers are a
mainstream part of their life
security needs to get the same way it
should be taught in school when you're
in college you should be able to you
know specialize in it in in building a
product
just like any other engineering
discipline and there should be standards
developed for what is good software look
like from a Safety and Security
standpoint
lastly you know finding a vulnerability
for your development team fixes the
product today
teaching them to find vulnerability
fixes the products of today tomorrow in
the future
yeah
so why does this matter again our scale
is 8 million servers Network egress 222
terabits
28 000 gigabytes per second three
billion users 114
000 commits a month 847 million lines of
code
and almost 10 000 bugs in the second
half of 2021.
so imagine now trying to scale a
security program for this where you have
40 000 Developers
without having that Automation and that
design engineering culture in place just
think of how many security Engineers we
would have to hire
and then think of the
the sheer shortage of talent in even
finding that let alone funding that
so I'll pull up too I put in my notes
Here on a poem and I actually did a
little
math
behind this as well
so
let's plan a little scenario with me
say a vulnerability caught during the
design phase cost roughly 500 in
developer and security time
so from the graphs we showed earlier
you know the average fine finding and
remediating of that is variable
estimated between we'll say 1 and 40 if
it's copper I ever launched as much as
640 percent caught after the launch
so for us what this would have equated
to in the second half of 2021 is we know
that we found
6880 bugs automatically
that would have cost 3.4 million dollars
to fix
now if you figure that those uh went
through and made it to the manual phase
let's figure a conservative 20 times the
cost now you're looking at 60 69 million
dollars to fix
but now let's say that those bugs
weren't found until the launch of the
product and let's again be real
conservative and say a hundred time cost
now you're looking at 344 billion
dollars to fix those bugs
it changes the cost multiple of that
original 500 cost of finding it during
the design phase is now fifty thousand
dollars a book
so
that's the importance of
you know shifting left and
how we approach it in building an
infrastructure security program at scale
any questions
we do have some PCI requirements with
our Global footprint we have gdpr
we also have an FDC order that we have
to comply with
and uh with our F2 which is our
Facebook financials or Novi offerings
now we're starting to get more into the
financial realm we'll have more
financial compliance issues in the
future are you making that into your
pipeline
we're banking it into the pipeline where
we can but the compliance piece of that
is tough so some of that's still in work
and some of it's still new I mean people
are well aware that we did attempt to
start some crypto offering and it was uh
not greeted well
especially by the government and media
so
our financial
[Music]
peace still tends to be small on the
regulation side but given the growth of
the metaverse and you know that's really
going to be funded and fueled largely by
microtransactions
and more of a storefront approach I
would anticipate that they're probably
going to be more regulation around that
and I mean the whole metaverse and
business model is a whole nother
interesting conversation and like what
that looks like financially
now you had mentioned that all of your
code was built GameHouse before a lot of
extraordinating stuff are you guys
starting to switch to kubernetes or are
you still going to make change we we are
not our Legacy code is just so coupled
tightly to what we build and so
performant for what we need at the scale
that we're at
um our containerization orchestration
and automation uses a system called
Tupperware
like I said it was built before
kubernetes existed um but it's all
highly containerized so like a developer
in our environment can spin up a
container with a full copy of the repo
and about 45 seconds to a minute
and have full access to the repos that
they need to develop on and all
container and based on a timed life
cycle of orchestration so like
that Dev container will last for a
finite period of time that they specify
when they check it out or if there's no
use on it for 30 days it's automatically
destroyed so each of these developers
come to each of the foreign
the first six to eight weeks for all
engineers and it doesn't matter if
you're Zuck or if you're a new college
graduate and go through an engineering
boot camp
or they learn our course systems like if
you have the foundations of like modern
cloud architectures and Technologies
it's not too steeple learning curve it's
more of just learning the nuances
resistance is future
well that would help Drive the culture
that you guys are trying to drive in
order to enabled right it does it does
very much and like our training is very
robust I mean we have different within
different tracks different
functionalities of internal academies
that you can take to focus on specific
areas within the engineering boot camp
depending on what your job role and
interest is you can focus on a specific
track and
I mean that six to eight week training
of course and boot camp is pretty
intensive
so maybe that's a key Point too like the
training that you guys offer helps
building culture that you need
it
does it does most definitely I mean the
three things that drive our culture
really is
I mean
the training is the training the tooling
and the process
I mean that's enabled that is what has
enabled us to scale to the sites that we
have without that we fall flat I work
for a bank and trying to be unable to
it would be enough
resistance is everything
yeah
financial and the more regulation you
get the more difficult yeah
but I mean some of it like I said is
engineering discipline like overall I'd
like to see the industry kind of adapt
a building code
where there's a National Building Code
for software to at least Define what
good looks like and then you know
companies could take the pieces that are
good and apply to them out of that and
then
you know have a variance process by
which they come up with their own code
and you know own sections that would
apply to their unique business unit or
products as well
I think there's far too little good
guidance out there for everyone to build
throughout this book and their own code
blueprint content
they do
they tend to focus on different things
and different aspects of their wants and
needs like anybody who I'm sure most of
you have read through at least one this
standard or another I mean
the whole military guidance and Mission
Readiness and like it's you can see like
the really good stuff in it but it's
also very geared towards a specific
audience in a specific critical
you know these are hard problems to
solve
D sure
I will so in general penetration testing
when you do your average penetration
test and like not all of them are equal
some are good some aren't bad but like
over the years I've done
I don't even want to guess but it's well
under the thousands of penetration tests
probably tens of thousands
over the years as well as many many many
red Communications so I know the
difference well we're you know with a
typical penetration test you're running
a lot of scanning of the perimeter and a
lot of web
stuff that's Broad and wide of where
like I'm going to run burp Suite um
and Nikita I might focus on one or two
areas and like my goal is to really scan
a list of targets or a list of
environments and provide you with okay
these are the vulnerabilities that I see
this is how I would get in versus
a red team is very much objective based
and focused and you know a good example
is we just did it around team engagement
where that was the target okay imagine
I'm an Insider you know I'm a contingent
worker I have a laptop
from the company and my objective is to
obtain domain admin
um the two approaches the way that you
handle those are very different
correcting engagement because it's with
a specific objective in mind is very
more laser focused
and less
on hey let's scan the whole perimeter
you know let's provide a wider report of
specific targets it's my target is to
get domain admin and it doesn't matter
how I do it
so you know you can craft up Rules of
Engagement on it but generally I
discourage companies from doing that
because nor do the hackers like I work
in an industry and for a size company
that like to think that we don't have
state leveled
sponsored people that have been hired by
the company in our organization would be
extremely naive I guarantee you we do
Google those Amazon does yeah
um you know anything should be fair game
and like
people in our industry tend to think of
Technology first because at heart we're
all technologists and Geeks and they
don't think about the psychological
aspects which I have an interesting
conversation at launched were they up
and coming college student
about the fact that I asked him Point
Blank so you know in the last couple of
years you've seen this huge
proliferation increase in ransomware and
fishing attacks
okay I asked him more in depth
generically but I'm going to see who
knows the answer to this really here at
least in my opinion one word what's the
cause of that
it's a Bitcoin
the ability to anonymize and monetize
anonymize your monetization of that
attack Factor has now made it from a
risk versus reward when you think of the
psychological effect of it of now I can
exploit a company I can blackmail them
and I don't have to worry about the
money being traced back to me and being
easy to intersect like physical currency
is that's really what is driven in large
the huge increase attack in ransomware
and you're seeing this not just in
ransomware but in anything that can be
monetized through an extortion type
attack Factor we've seen the distributed
denial of service attacks of you know
hey give us x amount of Bitcoin or we're
going to hit you with a DDOS attack and
bring you down to your knees to
ransomware to fishing adding and all
these prey on the whole psychological
aspect that we tend not to think about
it and give you another example here
I was working for a company and Buddy
calls me up and like he was in the
operation side of things like dude like
you've been doing like eunuchs a long
time and Linux and stuff right like
you've got this Linux server that's just
like pounded on our database I'm like
nobody can figure out what it is can you
help me track it down
so like immediately
they get a team together and this team
like immediately like let's get on the
switch let's find out the MAC address
let's trace the cable you know the
physical server and I'm like whoa guys
hold on a second like what's the name of
this server oh well it's like LGC Linux
dot I'm going to anonymize this company
name.com
um I'm like okay so like what do you
know from that piece of information well
we know the server name okay well like
what's your naming standard oh well we
use error part codes okay well what
airport code is LGC oh well that's weird
we don't have any location near LGC
okay
don't you think that's odd well yeah
they're like what do you think it means
okay I want you to think real long and
hard about this when when you write code
when you annotated
do you type out your full name well now
what use my initials
ah do you think that three-letter code
might be somebody's initials why don't
you check with your developers and see
if they have any individually initials
oh no we don't have any developers that
have those initials did you check with
the red team
no
hey you guys got anybody there with the
initials LGC
yeah Landon's initials are like LGC
five minutes problem solved again where
they wanted to dive in and like getting
the MAC address tracing the cable
probably would have taken them about two
hours of time that I solved the problem
for them in five minutes just by
thinking about the psychology about it
you know same thing like when you're
evaluating because it's not a matter of
if your system gets breached it's when
which is why I put a big focus on
detection
you know the people that you really need
to be scared about if you get some dude
in your system like hacker comes in and
sets up you know an access point and
like sets up a user account like Han
Solo or some you know sci-fi thing that
dude is in there for fun he's in there
to explore he's in there Kitty scripting
yes he can do some damage don't
underestimate that but his motivations
in general aren't particularly serious
now you have some dude who goes in there
and you know you have a bunch of servers
named
oh it's three oh now there's an old four
on here that's the do
because he's put the thought in it to
how am I going to normalize my traffic
how am I going to hide this how am I
going to be the wolf in sheep's clothing
as much as he possibly can he's thinking
about the psychology and like dude some
of the things are just scary so like the
social media company I work for and
stuff like gets a total bad rep about
this and again like people don't think
about this like this this blows people's
mind in my own family like oh my God you
worked for them I heard about them on
the news how can you work for that place
okay dude like Mom
where did you hear that information
oh I heard it on TV on the news
okay so you heard it on the news how
does that news station
you know it's owned by a television
station how do they generate their
Avenue
well commercials well it's advertising
right well yeah well who's the biggest
competitor
oh
[Music]
so you don't think that they have any
bias to throw us under the bus every
chance that they get of course they do
it helps their bottom line
you know
there's so much psychology and risk
versus reward for this that people don't
think about in our industry that like
to make all the difference in the world
and how you just view and approach
problem is
um you know and really the nastiest
nastiest case I've ever seen of like how
people switch to tactics and use
psychology
there was a hospital system in Detroit
that a group of hackers got in there
compromised the electronic health record
system
and so like you know I mentioned you
earlier you know the really dangerous
hackers are the ones who might want to
monetize this
you know and like it's a good use case
of like oh my god when we designed this
system we never
thought of how this would be abused
against us
they took the electronic medical records
identified terminal patients
got them hooked on drugs
agreed to continue supplying with them
drugs provided they would sign over a
life insurance policy with them as the
beneficiary
wow
people are always the weakest link you
know people ask me why don't you solve
the cyber security problem yeah well
it's the same reason you still had
police the same reason there's a war
going on in Ukraine right now people do
stupid unexpected mean things like you
know there's there's always bad apples
in every bushel you know it's just the
way life Works in society if we ever fix
that problem sure then it'll be fixed
until then we all have job security
um
I mean it's just crazy stuff going on in
the world and in cyber security
I'm curious who else has a crazy
security story that's the craziest thing
you've ever seen yeah
oh that's
getting into the industrial military
complex the better ones than that
okay thanks everybody for your time and
thanks for coming to cyphercon
[Applause]
right here
[Music]