[Music]
all right we're good to go um so thank
you all for coming to the 101 area just
really quick out a curiosity how many
people have been doing infosec
professionally for more than 5 years all
right so we got some hands here so like
look around if you're somebody that
doesn't have your hand raised feel free
to ask questions to those that did um
the whole goal for this track is to
start introducing people to information
security I wish I could have had access
to all the talks that are going on uh
this you know today in this room um I
looked you know through the list and
there's some amazing one we've got we've
got a lot that are around uh career path
we've got Ben Jacobs is up next talking
about the life of a penetration tester
uh quite an exciting life I got a
preview of some of these stories earlier
in the week and later day we've got Le
Lofton talking about things not to do in
consulting which is a pretty exciting
talk title I'm excited to see that one
there's probably some fun stories there
but there's a Consulting side we've got
some talks around the Frameworks that
you're going to see in infosec um so
there is Ben Opel is getting to talk
about miter attack I'm a huge miter
attack Fanboy it's an awesome awesome
framework to use um and so we've got
also Kyle um hinterberg talking about
PCI DSS 4.0 so if You' any uh Financial
audit work you'll have almost certainly
run into PCI DSS 4.0 is coming out in a
couple years and so it's going to be a
great talk on wonder how to get ready
for that um if you're just starting
infos sec I'm sure that's the one that
you're going to become very familiar
with uh first as everybody's moving to
that and we have to talk about ethics so
um Jesse M who goes by uh ghost Exodus
is going be talking about ethics and
principles in the context of activism
which is a really intriguing talk idea I
think um so some really really really
good content
um one of the things that I wanted to do
with the track more broadly was to um
lean into this idea about embracing
failure and getting used to it um it's a
quote by Mark Rober if you want to learn
failure isn't something to be endured
it's something that should be embraced
and I love that in the in the quote like
he had this on Tik Tok and in the quote
he actually like misspelled it he didn't
have B in the quote I don't know if
that's on purpose or not um but I
thought that was pretty cool I'm going
to come back this in a minute I'm going
to ask people that have had their hands
raised for I've been here for more than
5 years to maybe share some personal
failure stories so as I'm kind of going
over the next couple of steps keep that
in mind um this is going to move to open
mic because we don't have I did a lot of
the earlier content during the kickoff
um the the big announcement this year um
is the hungry hungry ha hackers
competition so hungry hungry hackers.com
has a ctfd instance that you can sign up
for um and it will have all of the
challenges for today
um for those that are new to information
security and haven't done ctfs before um
this is probably a great one to start
because it is simple we're going to be
hanging out in the 101 area next door
and help get you started if you don't
know where to start um but in general
the idea is that there are a bunch of
challenges that you have to try to hack
into or solve one way or the other and
then once you've hacked into those boxes
there is a flag that you can capture and
put into the scoreboard for points um
and so so the goal for this one is to
see how fast you can do it not just if
you can do it but if you can't do it
right away it takes all day to solve One
Challenge that's that's awesome lean
into it embrace it don't be afraid to
start I think a lot of people just don't
do ctfs because they don't even know
where to begin uh but the first thing
you can do is just go sign up take a
look at the challenges and see how far
you can get if you have questions let us
know um one of the things that uh I love
about this conference is Michael's
always really good about letting us try
new things um I used to play a lot of
CTF and one of the things I realized is
that uh we spend the entire conference
looking at a laptop screen not
interacting with other people uh I'm
kind of an introvert so that's sort of
kind of nice um but I wanted to do
something that actually gave people time
to go and socialize so today's CTF is
limited and then tomorrow's will
actually be scheduled so in this room
tomorrow we're going to have people at
at two different tables going Head to
Head competing and you can actually see
their screens live on the uh the the
monitor here as they hack um so come
hang out we're going to have some music
on the lights it'll be DM it'll be
hopefully a fun environment um you can
learn from them by seeing how they
approach the problem
um I've done this with smaller circles
before and what's really interesting to
watch is you can have the exact same
problem and if four different people
approach it they almost always will go
at it in an entirely different way um so
there is no one right way to hack into
allot of these services or Solutions
it's really about uh process and
approach and creativity um so so come
check that out um and the cool thing
about that again is it's not it's
because it's uh it's time blocked
hopefully everybody will have a chance
to enjoy the conference Beyond just uh
heads down down on the laptop um so the
other thing that we're doing I mentioned
earlier is the open mic event um so this
is the first time that we've done this I
don't know of many other conferences
that do this uh especially this big um
but we wanted to make sure that we had a
form that was available and accessible
to people that wanted to present on
whatever they wanted to um I know
Michael's really good about doing
everything possible to make the whole
speaker submission process as Fair as
they can U but this is one way for us to
just go above and beyond by trying to
have a fair board and actually give
people an opportunity to say like I
didn't get selected but I've got another
chance to present um so uh if you'd like
to present um we will have a a hat up
here tomorrow morning you can take a
piece of paper write your name on it uh
and then we'll call it out after every
session so um show up if you've got
something you want to present great if
not we'll just hang out here and do
music um so um with all of the logistics
out of the way um I wanted to come back
to this this whole idea of embracing
failure I've been doing infosec for oh
man probably 12 13 years now and uh it
is a it is a constant um constant
failure in is the way that you approach
a lot of these uh Security Solutions um
especially as a hacker you have to go up
against a company that has paid millions
of dollars to protect their environment
and of course they're going to say
there's no way that you can break in and
you have to have the mindset that says
like I'm willing to go and try even
though everybody tells me that I'm going
to fail because often times more than
not you'll find a way to succeed um but
you have to be willing to jump in and
approach things from a failure
perspective first um so we've got I I
went through that really really fast um
I knew that we were running a little bit
late with the other stuff and I didn't
expect to present this early in the
keynote so um what I'd like to do uh for
the next few minutes is do a little bit
of an open mic session here so if
anybody has any stories of failure as a
as a pin tester as a security person
obviously like hide the uh details of
the guilty I'm going to anonymize it but
I I want to start with the the idea that
um even those that have been doing this
forever and that have a lot of
experience regularly run up to failure
so I guess with that do anybody want to
uh yeah come on
up all right so for everybody else uh
state your
name uh my name is uh Michael uh I go by
the handle Vega I actually have the uh
pleasure of working with Trenton um I'm
on the adversary group uh for secure
Works uh I'm a principal consultant
currently um things that I do in my
day-to- day again like as far as the
offensive security
practices uh start at the top adversary
simulations web apps mobile uh social
engineering physical
devices um more web apps uh but uh with
more again a finite Focus also on
medical devices now as Trenton mentioned
again um like I've been in this industry
think since I believe 2012 um towards
the blue team side and then moving over
to the red team about uh
2017 um but as he mentioned again it's
not a straight linear path uh towards um
compromise and or towards uh
infrastructure or getting those gains
that you want on a test um you want to
talk about failures there's a massive
amount of them that I could even go over
I mean uh let's see uh scaling back just
last week I was on a physical device
test you know you tried to break into
the device and you know try to do the
most dangerous things you can in that
scope of that ecosystem um again it
being a device with a lot of heavy
lockdowns and um I guess the company
really taking my uh recommendations from
the prior test uh seriously again it was
heavily locked down to the point where I
almost thought that obviously you know
what am I doing here I'm like you know
they paid for me to basically stand in
front of a system and you know laughing
myself um and it was day after day after
day after day after day after failure
and the worst part was again physically
I'm on site in a different country so
this there's a lot of things going uh
against me but as again Tren mentioned
it's all towards working towards that
one thing that kind of works and in this
case it worked and it worked brilliantly
and then again able to bypass all the
protections get onto the system and
basically have the way with everything
that I needed to start reverse
engineering binary and then basically
the whole thing just fell apart like a
deck of cards um but again uh focusing
on the failure part again you want to
make sure that you're not taking that
failure as a ding on your your yourself
me I get very personal in my work so
when I fail I feel that I'm failing
personally um but again you have to look
past that and realize this is all the
scope of what you're doing it's I mean
nobody has created something in one fou
swoop at all you have to fail
iteratively and build on those failures
to be able to get to your goal and find
out how you can achieve that goal and
then once you find that small slice of
Entry pry It Wide Open send in your
friends make it the worst thing possible
that can happen to the client and then
really expand that wound into a gabing
hole and make them bleed out real bad
but again that's when you find that
small glimmer of hope in all of your
attacks and attempts you know that when
you do find that thing make it the worst
thing
possible so again keep trying uh that
you know they have the offset saying try
harder
um I just say be persistent again don't
take failure as a loss take it as a win
you tried it you walked up to it you
ponied up and you definitely tried it
but you tried it and you learned
something from it again it's input
output it's how you take that output and
build it into something that's going to
be workable and actually from that
failure and all that iterative testing I
now have a submission to msrc so we'll
see how that goes uh but again it's
always uh fail fail fail fail fail fail
fail and then win so keep
trying I love I love the analogy of like
m m a bleed like I've seen some of his
Ownage before and one of his favorite
things to do to medical devices is play
Doom on them um so can you imagine being
like in a hospital bed and seeing Doom
pop up on like your H monitor or
something the frame rates are fantastic
yeah that's awesome does anybody else
have any stories of of examples of where
they've struggled to get through a
challenge in security
or
anybody
awesome this whole thing itself is an
experiment I'm glad that you guys are
jumping up and talking because I was
going to be a failure here if nobody
actually decided to to talk awesome hey
uh I'm Aaron Gomez I work for a small
Financial firm in St Louis Missouri and
we run a cyber range and my first I I
took over a people leader job as as uh I
came into it from a from a lead digital
forensics in response role and uh we had
done tons of ctfs and and the
organization was hosting a cyber defense
exercise which is more force on Force
Red on Blue we bring our our entire
technical stack we set it in the middle
over room like this and everybody plays
on it as you know if you've ever oped in
your life um it's very very difficult
and things can go wrong very very
quickly um but all the invitees that we
had to it were rather larger Financial
firms so uh we had a ton of leadership
in there we had um you know some of the
best red red and blue teamers from the
organizations came to show up and play
and everything went sou and this is like
my second month in this this role right
so not only do I know not know what I'm
doing from a management standpoint and
how how am I communicating this to to
the people that are like our people are
just sitting here not doing anything um
we're trying to fix the stack at the
same time because we've got a small team
so um a lot of a lot of long hours I
think we pulled 30 hours uh off time um
about $1,000 in red poll
expense just just in order to get the
systems back up and Wars up and and so
the first day was kind of a wash our
starduck didn't quite happen on time we
kind of got bit some pieces of it
together but uh uh we ended up working
all throughout the night so then on day
two stardex actually happen on time uh
we red the exercise for about 8 hours
and then turn it off and then um went
and crawl in a hole and just like you
know really open myself up to the the
challenges and the learnings uh that
came from it which is you know one you
got to be prepared um even when you come
into a role without that show a time
frame you know you always especially
facts like that you got to check
everything off you got to make sure
especially if you're dependent on
something if if your dependency is a
scoreboard and you don't know anything
about it there's a problem right and you
you need to figure out what that is and
how you're going to fix it um the the
other thing is learning how to uh
communicate with the Business Leaders
and the the cisos that have volunteer
their people time to be there for that
exercise and then how do you make that
still engaging enough how do you how do
you how do you assure them that you know
time's not going to be wasted we're
we're still going to get something out
of this exercise so um being able to ACC
figes and being able to translate what's
going on in that stack to something that
they can understand as well right being
that that translator uh so you can give
good updates and you can provide um good
things to them to you know kind of make
a little bit more confident about
Pi after to talk about red team events
that
we go so
um know how much I've got to do before
tomorrow's part of the interactive CTF
like I'm setting this up for a reason
like if things go really badly I can say
it's just a failure like we planed it um
but so so events like that are there's a
lot of movie pieces and a lot can go
wrong but when it was done because you
took the risk of having something that
big and that complex was there a moment
toward the end of it where you realize
that it was like all worth it like what
was the moment like when when towards
the end you saw people playing the game
that was just like this this risk uh was
was worth
it yes so absolutely um two instances
one was immediate and the other one
didn't happen until just a couple months
ago so uh the immediate one was I was on
the plane back and
uh one of the players was sitting right
behind me and he's like hey you guys
were off in the event right I was like
yeah I was like sorry about everything
and and you know me a and all that and
he's like no he's like I have a really
good time
Lang um he's like our Pock boxes I was
all over their the other guys Network
and we were just like crashing things
about these like rain shells he like we
had so much fun I was like okay like you
know that that was like a real good
confidence booster and then then the the
second one was taking all the lessons
that i' learned from that event and then
we hosted another one in Dallas and uh
this one's actually public AER Journal
did article on it ACC did article on it
and uh we we did a tri sector with at
Morgan Stanley Len Southern California
Southern Southern Southern Company and
wean the the exact same exercise we
added a couple technology pieces to it
but it went on for without in 20 it was
100% availability um everybody had a
badass time um it was uh it was thinking
about the things that we missed doing
your Retros going back through that data
making sure that you know you're
addressing the things that you want to
get better and then
going awesome thank
you we got time for a couple more does
anybody else have any stor they want to
share of they had to jump up and try
something at the risk of failure and
either did or didn't
succeed a couple seconds awkward silence
up
anybody all right cool well we going to
meet back here then in about 13 minutes
at 3:30 bins up to talk about the life
in the week of a pin tester um I I have
had a sneak peek of some of those
stories so I think that be really will
to talk um so make sure you're back here
for that one um otherwise please think
about what you might be willing to talk
about tomorrow um for the open mic um
don't be afraid to jump up and try I
know a lot of people are afraid of
public speaking I is an introvert like
it's not my favorite thing in the world
to do um but this is a safe place to
jump up and try right this is a great
group of people to be with and to talk
talk about what you're working on so um
you know take advantage of the
conference while you're here um thank
you all for coming and hang out for the
opening uh for this track and I'll see
you all around the rest of the Contin
[Applause]
you