welcome to the cyphercon podcast dan
thanks for joining me
thanks my pleasure um i thought you know
we were talking a little bit
uh before we started here and uh i
thought it'd be interesting if you could
talk about
your journey to you know coming from
studying music
to becoming the uh global director
um at uh trans usu transunion
and just talk about how you you know
what were what was your journey like
because
we talked about some really interesting
um
interesting paths that you took and i
was wondering if uh
you could talk a little bit about that
for the audience because it sounds
pretty you've done a lot of interesting
things
sure uh i mean to start off my journey
first off i gotta admit
like i'm a big geek uh i mean i started
in computers in high school
um in the early 90s late 80s
my first girlfriend i actually met over
a dial-up modem
on a galacticon multi-line bbs so that
gives you an idea of how much of a geek
i am but
but my passion in high school you know
my two passions were music and computers
and
originally started off uh as a music
major at the university of
wisconsin-milwaukee
okay and what did you did you play any
certain instrument or
uh all of them i i can play
any brass instruments um primarily i
would play
euphonium tuba and trombone okay so low
brass
um all right yeah i spent a year there
and uh oh and not even a year there my
first semester there and i
i kind of got burned out had some bad
experiences i actually had a
had a friend dying of cancer and had an
opportunity to go see him one last time
and like
my music professor just tore me a new
one because i missed a concert to do it
so i was kind of burned out and to pay
for school
i was working at a small computer shop
in brookfield wisconsin doing break and
fix work
of just building computers and like
really learning the basics this is back
in 92
and uh a vp at a consulting firm had
bought his computer from there and i
ended up doing some break and fix
work which then led to me doing some
networking work for him
and he really kind of uh
found that i had a knack and skills for
technology
and we got into discussing security and
stuff and he
was a vp at a boutique
consulting firm called cpu in milwaukee
and he kind of took me under his wing
gave me a job
taught me the ropes and i started my
career in there and then six months
after working for mac
um cpu got bought out by copywear
which you know back in the uh
early to mid 90s compuware was one of
the largest consulting firms on the
planet
so i spent a couple years there you know
really kind of digging into
learning the ropes first-hand hands-on
basis of information security and
uh at that time young ambitious no kids
no family no commitments
dot com boom kind of saw the writing on
the wall of it coming
so i decided to fork out on my own and
start my own business and just travel
all over the world
just looking for the coolest most
challenging
infosec gigs you know that i could find
which
you know i spent 10 years of my life
traveling basically 100
of the time all over the world doing all
sorts of cool stuff made a lot of
government friends got a lot of
government contracts
did a lot of social engineering and pen
testing breaking into banks
breaking into dod facilities you know we
were talking earlier i wrote one of the
first manuals for department of justice
back in the mid 90s on how to seize
electronic evidence because
you'd give law enforcement a warrant
that had servers and computers on it
back then and be like a deer in
headlights
i know how to seize drugs or a bad guy
how do i seize a computer
so you know found myself doing that for
a decade and
then decided uh after i got shot which
is a long story in and of itself
um tell me about that how did you get
shot
well when i wrote the manual for doj
actually my buddy ernie and i did
and uh we had just finished the final
draft of it
and doj had gotten a call from the dea
of hey we have this bank
that the dea is working with the
peruvian government
on uh investigating for drug laundering
because we're pretty sure that they're
laundering drugs for a colombian cartel
it's an international bank they have
branches in both the us
and all through atlanta and
you know they worked with the peruvian
government they have these warrants and
they have computers and stuff on them
we don't know what to do oh we got just
the guys we'll send them down to oversee
collection of evidence
so they sent ernie and i down there and
then yep we were in lima and
i mean we didn't really we were young
and
naive and didn't have any idea what
we're getting into but you know
should have been a clue when we walk in
and you know all these d
agents are you know putting on kevlar
and
you know there's working with the
peruvian military in full gear
oh wow and you know it's one of these
okay well you guys wait outside here
you know we're gonna go in and we'll
clear the bank and after everything is
all clear and stuff we'll bring you guys
in to oversee collection of evidence
so they went in and they cleared
everything out and they they
brought us and oversee collection of
evidence and i guess they felt that the
president of the bank
you know who was like all in a really
nice suit
and and all professional wasn't that big
a threat
you know they patted them down on that
but apparently somehow they had missed
that i guess somewhere in his suit coat
he had a little
38 snub nose revolver like sewn into it
and the next thing you know i hear gun
bang and
and i got clipped where it hit me
in the top of my right calf and came out
the bottom of my right calf
oh man and the next thing you know
there's a
a d asian and a peruvian corpsman like
running up to me
and like while i'm standing there the
guy
pulls out a med kit um is trying to
convince me to lay down but i'm kind of
in shock and don't know what's going on
pulls out a scalpel and slices my calf
open to clamp off the artery because
then clipped the femoral artery and i
guess it was like squirting
oh wow which point i pass out cold
and i wake up on a helicopter that's we
as well didn't know
was flying us to a carrier sitting in
the gulf where special forces were
waiting
in case something went wrong oh my gosh
so it was like funny or something
oh it is and i this was actually right
before
my 21st birthday and i
uh you're only 20 when this happened
yeah
actually it might it was one of my
birthdays i got to think about that 96.
actually i was older than 21. it's still
early 20s
and uh i missed my birthday and i'm an
identical twin
so i was supposed to go out for dinner
with my mom
my dad my sisters and my brother
for our birthday and i actually missed
it while i was laying in bethesda naval
hospital recovering
and i could not tell my own family about
that that was classified up until
probably about 15 years ago
oh wow and up until that point i
couldn't even tell my own family why i
missed my own birthday and my mom's an
er nurse and i'm trying to
you know at that point stitches and now
the scar
that's on the front and the back of my
leg
so yeah i have had some crazy fun you
know
some of the dod stuff i've done uh
one of the dod contractors i've done
work for
raytheon and a couple other companies
but one of them did
work on space equipment like the hubble
and
and you know the optics on the hubble in
particular and
optics that shall we say point in the
other direction
um you know where it's freaky because
now my father-in-law
um actually he's working up for nasa on
the sls project
on the navigation ring but him and i
have worked in some of the same circles
and you get you know
a small group of cyber security
professionals who haven't experienced
this everyone else is like oh you're
philippines man no way that actually
happened
and we've worked in facilities where i
mean you go and
upgrade say the memory on a secure
router you know especially back in the
mid 90s
you know early 90s cold war era stuff
and you lift the cover off and i kid you
not there's a trip wire with a grenade
that you have to snip before you take
the cover off
wow you know it's just some
crazy wild stuff so how did you how did
you find how did you go about
finding these you said that you were
always seeking out the coolest
things that you could do in the world
how did you go about finding these when
you were
you know when you were starting out yeah
i mean the internet
the internet was starting to take off
and i had made a lot of contacts on the
government side
um and just started branching out
globally and i mean
i originally when mac found me and
noticed my talent
i may have been involved in a few gray
area things
you know as as we all are sometimes yeah
you know this was when i was young and a
kid and didn't know any better and made
made a lot of contacts and just i'm very
social to begin with and i network a lot
so so it was kind of getting that
experience getting that network and then
leveraging your network to find the cool
jobs that you can get
yeah well and it's easy to build a name
for yourself because like during the
dot-com boom you know i'm sure every
security professional who was around
that knows you know
you had this whole growth period where
the idea of
a pen test for like a lot of firms took
advantage of this
of you know i'll run a nessus or like an
iss scan against you i'll weed out the
false positives and i'll give you a
report and there you're pen tested
well i'd go in behind those guys
especially to like banks
and i'd be like okay dude so like i know
who did your last pen test i tell you
what
here's my fee you put it into an account
and if i get it out of the account i get
paid you get your report if i don't
i'll still give you your report and
there's times i'd go in behind firms
like that and i just specially exploit
some of the psychological and social
aspects
and uh let's just say i had a very
successful success rate
interesting wow think about it
okay you know even today you go in and
it's the simple psychological things
the first thing i would do for any pen
test find out what their logo is
and go and get a polo shirt print it up
with their logo on it
and you know bank branch i have walked
into bank branches
with their logo clothing on cold
never been in there before and i will
walk right behind
the tellers workstations and start
plugging in keystroke loggers
holy cow wow you know
and i'll have bank manager walk up to me
you know hey
i haven't seen you before what are you
doing here oh i t sent me over from
corporate there's a problem with you
know
some of your equipment and stuff can you
let me into the wiring closet
oh sure here you go boom right in
you know wow
so is it easier then then i mean it's
not i mean
do you still see some of that today or
is it
oh yeah it's buttoned down more than it
used to be
and i mean as society as a whole has
become more aware as this happens more
on it's gotten better but it's still
i mean i mean if anybody
doesn't believe me get get a shirt print
it up with a logo on it
go by their loading dock and you know at
a prime time people are going in
and hold a you know stack of empty boxes
even
and walk behind somebody and see who
holds the door open for you
you know wow it's human nature
people want to be helpful you know just
like your hackers too when you look at
risk versus reward they want to follow
the path of least resistance
you know i actually published
an article on linkedin about this you
know that's part of what's driving
a big debate in the industry about
network visibility and
being able to decrypt all your traffic
and stuff and the
the battle over you know should the
government allow
secret you know backdoors and decryption
and shouldn't they and what's the value
of decryption today
so when you get in with tls 1.3
elliptical curve ciphers
pfs you know it's gotten harder and
harder as encryption gets better to
break into the pipes
so you know we're not seeing very many
man in the middle
or interception attacks these days
they've moved on and your biggest
attacks are ransomware
they're on phishing attacks they're on
you know ddos for ransom attacks
because to quote jesse james one that's
where the money is
just like why they used to rob banks and
two
they follow the path of least resistance
if you see a car with an alarm and one
without
which one are you gonna hit you're gonna
hit the one without the alarm
well it's not to say that they don't
have alarms but
breaking encryption with pfs and tls 1.3
and stronger encryption keys is a harder
target
when your endpoint controls suck and you
can just you know
pop up a web server that's processing
200 000 credit cards an hour and sit on
there and just sniff them
one after another you know but companies
are still
tending to invest millions of dollars
because you know the other side of that
coin is as decryption
and encryption gets better it gets
harder to decrypt it gets more expensive
to decrypt
you know especially as bandwidth
increases
so you have to find a happy balance
between both of them and
you know i butt heads regularly
you know with other professionals in the
industry that you know oh my gosh you
have to have
every packet and ideally in an ideal
world if i had a blank checkbook
you bet i sure as heck would but
businesses still have to
generate a profit and generate revenue
and you got to find a happy balance
between what you really need to see
and where the value and that is versus
investing some of that money and better
endpoint controls
yeah yeah and i think you know you hit
it on the head when you're talking about
phishing attacks too because you know
the weakest link in any system is the
people right
so it's about you know how how can i
figure out how to get uh somebody's
credentials so that i can get into the
system and then figure out how i can get
in from you know
further uh further through the network
once i
get one piece of it right yep i mean
some of the psychological stuff and you
know you can come up with some really
creative
low-cost controls that that cost
so little but play on the psychology
that are so effective it's crazy
i was working on a campus environment
that had
a requirement everybody has to wear
their security badge you know
people walking around you were supposed
to question you know where's your badge
and when i started there they probably
had about
50 to 75 percent compliance with that
policy
so you know i spent 800 bucks a year
four times a year i'd bring in literally
somebody off the street who clearly
didn't belong there
i'd give him 200 bucks and i'd say here
you wander around campus
the first person that stops you you hand
them a 100 bill
and you can keep the second one and i
mean within
24 hours we would go from
you know a 50 to 75 compliance rate to
over 99
compliance rate wow a detection time of
somebody not wearing a badge i mean
people were
actively looking for it you know it it
all
plays on psychology yeah aligning those
incentives if
if i can get 100 bucks for uh reporting
someone
uh yeah i'll be are asking him right
like
i'll do that yep and and it's risk
versus reward you know it's the other
thing i harp on and i don't get why more
companies don't do this
every application every database you
know
you should be thinking about you know
how to detect malicious activity using
low-cost psychology put into in your
application put in a user account of
jbezos
you know with a password that's just
weak enough that it's going to be one of
the first ones popped
what hacker do you think in your right
mind
like especially if you're a retail
company i mean target was breached for
months gap was breached for
months before they detected it if you
put an account in there with
the initials j visas boom
you are going to know immediately if if
the goal of that account is just
this is just a tripwire because there's
no hacker in their right mind that is
going to see that
and see the possible reward
outweighing the risk that that thing
isn't going to get popped like that
that's funny i wonder how many uh jay
bezos uh
honeypots are out there there's probably
a few of them
there's probably a few but but if you in
like within the corporate infrastructure
of a fortune 500 and stuff
i bet you there's very few relatively
speaking
and you know again how much does that
cost
you know i'm sorry everybody should be
approaching their ciso
and their board you know you got to let
me do this
i mean detection times are still in our
industry
measured in often times in months
and the more time on target an attacker
has the more damage they do
you know it's a reality in our industry
it's not a matter of
you know if i get hit it's when i get
hit right
and detection time is key in reducing
the amount of damage that they do
yeah and that seems like a pretty simple
proactive way
to you know you you you know when
someone
someone hits that that you know that's a
nefarious actor they're they're after
yeah information you know whatever
whatever and can you talk a little bit
more to that about you know the the
psychology of a cyber criminal like what
are they looking for and it might be
different like whether they're a state
actor
or someone looking for money are there
like different um
i guess archetypes of of these cyber
criminals
oh there are um when i was at the
university we actually had a project
going on when i was at the mortgage
institute to uh to classify and identify
hackers
as part of the compute cluster that we
built there
scanning code looking specifically for
vulnerabilities
um i mean you could clearly tell the
difference between
a state-sponsored military-trained
chinese hacker
because their methodology and techniques
were so regimented and trained that it
was
obvious versus you know a kitty script
or
you could kind of follow through their
path through the system
looking at the particular techniques
that they use the style of their typing
um you know and it's almost like the
signature of a bomb maker
and that you know every hacker
you know unless you get into those
state-sponsored sites where it's a
regimented trained program has their own
unique style
and profile um
[Music]
i mean it it it really is a lot about
psychology we had one
instant recently where you know buddy
called mine up and was wondering you
know well
we got this server and nobody knows what
it is but it's
you know pounding on our database
servers you know you got any ideas
is it one of yours do you know who i can
call
and you know i didn't have any clue of
whose it was
so they immediately start going to
technology well let's track down the
server what port is it plugged on the
switch let's look at the mac table
you know which would have taken them
probably at least half an hour and i
went wait a minute what's the name of
the server
and the server was something something
something dash linux
dot domain name dot com
well okay took me a whole 30 seconds to
go wait a minute
okay so dash dash dash doesn't tie to
like our normal naming standard or any
of our locations
where do you typically see dash dash
dash well don't you normally see that
when developers annotate their code they
use their initials
did anybody check if a developer's got a
server out there or if maybe
somebody's doing some pen testing or the
red team's
you know probing you guys and and maybe
that's the initials
of a user and sure enough it turns out
i made some inquiries into you know
the red team that operated for that
company and asked them hey
do you guys happen to have somebody with
the initials blah blah blah
oh why yes we do it's this person oh
well i think i just busted one of their
servers that just caused an outage
from the pen test they were doing you
know where it would have literally taken
them at least half an hour and an hour
and it was middle of the night of waking
people
up you know to track down
[Music]
what this was rather than just thinking
again about the psychology of okay does
this follow the naming standard
no it doesn't what could these three
digits be well somebody's initials
that's interesting yeah and and yeah
it's uh
yeah it's a matter of i guess
recognizing
you you recognize that the pattern it
didn't fit the pattern but like okay
what
pattern does that fit and and figuring
out what are the habits of
you know uh some of the pen testers or
developers or whatever like what
what like what could this be and i think
that's that's an interesting way of of
looking at things because i think a lot
of times we
we we kind of like look past like the
obvious thing right
it's oh yeah i mean as geeks too we tend
to
immediately go to how can i
technologically fix this yeah
how can i get my geek on rather than
thinking about the
why and the potential different avenues
of
motive and that the human brain
you know plays into what's happening
around you technologically
yeah um well let's uh switch gears a
little bit and talk
um talk a little bit about you know
everyone working from home and what this
has done i guess for
companies from a cyber security
standpoint and maybe you could talk a
little bit about
the zero trust model that a lot of
companies are
getting on board with and and you know i
guess
what what that means for companies
today and in general with covet i mean
obviously you know unless you're living
under a rock on an island without any
kind of media access anywhere
you know there's a large swath of people
compared to
you know six eight months ago that are
working from home
based on the fact that they're working
from home
your network border and perimeter is
is exceptionally porous and mobile
compared to what it used to be
i mean we've always been heading that
way
you know especially with the
proliferation of mobile devices but now
it's accelerated that tenfold and as
such you see a lot of companies rushing
to get to the whole concept of
zero trust private access um you know
security
access edge whatever you want to call it
of where you know your data center is
basically treated as a hardened entity
and even your own people are treated
just like any joe schmo out on the
internet of we don't trust you
any more than than i trust kevin mitnick
sitting outside my
you know sitting parked outside my uh
building or at a coffee shop at
starbucks
you know um
you know we're certainly is an
organization moving that way
in that direction you know as are many
companies because of it
and you know it's gotten a lot of
industries traction and it probably
should
you know why should you treat your users
special
as as opposed to an average internet
user
an untrusted user it's it's spurring on
a whole new slew of technologies
um you know as well as tightening down
the perimeter
perimeter like we're trying to get to
the point as as there are many companies
where the only
access in and out of your company is
basically 443 traffic
you know so everything's going to be
encrypted and you're reducing your
attack surface
where especially with porous borders
that uh
we have as people on vpn and through
remote access
it's like critical what do you mean by
porous but what does porous mean
i mean the ports and services people
want to get to byod
they have devices you're connecting with
cloud services the number of ports and
services that are being opened up into
networks
that aren't adopting a zero trust model
um
you know especially when you get into
companies that
for whatever reason think it's a good
idea to lift and shift
their legacy stuff into the cloud um
in particular you know with all the
openings that you're pouring into there
then that's now sitting in someone
else's network
it's you know you just have to take
advantage of a whole different mindset
um in a whole different approach
to security where in the past firewalls
where your your gateway is
sure you know where now your firewall is
just
a couple of ports you know
but that's another area really companies
don't do the best
you know and and zero trust is really
pushing them on this and some too
is a lot of companies have very poor
emissions control on the con
concept of mcom especially when it comes
to egress you know which is another huge
detective control of
if you don't know what's going out of
your network
for one you know there's far too many
companies that still
their outbound firewall policy is allow
any any because you know hey they're
inside the network we trust them
it allows them if you are breached you
know i have
free and easy access to establish a
backdoor
to bring in other tools to pivot to
other places
you know which on top of the zero trust
is driving towards
micro segmentation and in network
segmentation in general which
typically has been very poor throughout
the industry so
i mean it's a learned battle and learned
technologies but you know ironically
some of these concepts and stuff are
stuff that we probably
should have thought about a long time
ago now that's interesting because i
mean
you think about yeah a lot of companies
are moving to
you know a lot of cloud services whether
it's aws azure
like you know and
and from you know what i'm hearing from
you is is
is now you also have people from the
company that
are
they're getting onto those servers
outside of the company right
and so now you know if they are doing it
uh and an unsecured network or something
like that and someone's able to
i don't know capture their like there's
more risk right and so
so that's that's the thing that
that companies so what how do you how
what is the solution to that
i mean the solution to that you know
really is having good
policy and procedure but as well having
a good caspian in place
i mean companies that are doing cloud
just because of the exfiltration
i mean the migration to cloud really has
moved security from more of a
technological
controls to somewhat technological
controls but those controls are driven
around identity
and access management configuration
management and drift control
because the biggest challenge in the
cloud is if you really want to take
advantage of it
you know you're using servers whose
lifetime is you know
hours days minutes in some cases
that you have to know first off when
that system is built
that it was built on a secure code base
that doesn't have any holes
that you know while it does live nothing
changed to open up a vulnerability
and that it existed at all you know
which is probably the biggest challenge
of especially for companies that have
poor cmdb and asset management programs
um
yeah i mean it changes the whole
paradigm of things and you know you
you asked how we're tackling that like i
said in particular
we're implementing caspi so that you
know users
should only be allowed to go to
approve tenants for the organization
because i think that's probably one of
the biggest fears is like you know i
have my own
m365 tenant that hosts my domain
yeah you know i could get on the if i
was nefarious i could get onto
you know my corporate one and i could
exfiltrate data right out to my own
domain
yeah but i think some of that goes to
psychology again too and knowing who
your
attacker is everybody has different
factors you know a construction company
is going to be targeted by a very
different hacker than as opposed to
somebody who's hitting
you know a large retailer or a bank
so you you got to know what your real
risk is and
who is likely to target you you know and
what their motivation to target you
would be
yeah interesting interesting and it was
i mean i guess like aside from money
like what are the
uh what are the other motivations well
some of it
you know are just for fun kids
are kids that's true you know and people
are people
some do it for fun some do it to
embarrass
you know and money can take different
forms you know if you're going for
identity theft you're going to want to
hit a big
company like transunion you know we have
a ton of identity information
if you're going to go after money you're
probably going to hit a big retailer or
somebody with lots of credit card
information
um if if you're going after intellectual
property
usually you're either going to be
somebody who's paid by another company
or you're gonna be a state sponsored
level uh
attacker trying to get intellectual
property like a good example is with
covet i mean
all of the major pharmaceutical
companies that are doing any research on
coven vaccines
are just being hammered on now by uh
state level
programs from from various nefarious
countries
huh i wouldn't i wouldn't have thought
of that but i guess yeah that makes
sense
huh oh yeah i mean when one of the dod
contractors i was working for
good example of this was uh developed a
landing gear on
you remember years back there was a
reconnaissance plane that
had a mechanical problem and had to make
an emergency landing in uh
china i don't think i remember that one
particularly
well there was one and the defense
contractor that i was working for it
actually designed the landing gear on
the plane
okay so i mean completely obscure part
of the plane that has nothing to do with
any of the surveillance gear and stuff
on it
but the number of attacks coming into us
from china went up by about a thousand
percent
wow while that was going on
huh interesting wow
wow uh yeah i learned a lot here dan i
appreciate you uh telling teaching me a
a lot about
your path and learning things that that
you learned along the way
and learning about these uh the
psychology i guess
both from like you know a pen testing
side and then from the cyber
security the cyber criminal side it's
been it's been interesting to
to talk to you um do you have any
uh plugs that you
or anything you want to share with
anyone any advice anything like that
i mean one i'm gonna say you know if
you're interested and want to learn more
about me
just go to my linkedin page and start up
a conversation
you know i'm always i'm very passionate
about this industry you know
and like i said i'm a big geek you know
right now i manage teams all over the
place and
my meeting schedule is just crazy but at
the same time
i love technology so much to the point i
have a 42u rack in my house
running a small openstack cloud with
various linux versions i have an oculus
rift
i mean i love technology always will and
i'm always
you know even as i focus more on
management
aspects of cyber security i'm always
gonna love the technology
and be involved in it you know i teach
high school robotics kids
to high school students as part of the
us first program
you know there's a huge talent shortage
right now if your kids are not
you know focusing on some of the stem
stuff and
and don't have an interest in technology
and
cyber security and stuff a lot of
potential you know
parents think about your kids you know
getting a career in cyber security
because there's a huge shortage right
now
there's a big talent gap you know get
them started early get them started
often
and you know they'll they'll have a good
career
um you know and and if it's something
that they enjoy which
many kids do today yeah it's a very
rewarding career
so yeah absolutely solve solving
problems i think that's uh
i don't know i know that like while i'm
trying to solve the problem like
beating my head against the wall once
once i got it i'm like all right
i did that one that one felt good right
so
cool well um thank you so much for the
time and
you said they can find you on linkedin
is it daniel creeda
in in linkedin yeah okay daniel creed
usually pretty easy to find on there
cool
well thank you so much for the time dan
and
uh yeah have a wonderful rest of your
day
my pleasure thanks a lot