all right this is my third time back and
I really do appreciate the opportunity
to come back here because this is
actually one of my favorite conferences
Bar None and yes i actually run a couple
on the side but yet no i really do enjoy
coming here I am back this year to talk
about zero trust and trying to just get
this spell a lot of the confusion around
it by adding more confusion no doubt now
so for those of you who may not know me
my name is Dave Lewis I am Canadian and
I have been doing security now for the
better part of twenty five years in one
form or another and it has been quite a
ride I've had all sorts of different
positions and along the way I've done
everything from being a firewall augment
right through to being a CSO for a power
company and it has been amazing when I
have conversations with folks as I go
around the world they asked me well how
do you identify yourself and I said well
I identify myself as a hacker but if you
have look around be if people don't like
us too much so I think it's really
incumbent upon us to actually manage
that narrative yes as I said I am
Canadian and so much so that I actually
had to go get this done
now this has happened since the last
time I was here I got this tattoo on my
arm if you'll notice there's a Canadian
maple leaf in there and the reason this
happened was about two years ago I was
in a hotel lobby in India and this
well-dressed woman walked up to me she
goes excuse me are you an American I
said well no one from Canada why just
good
that was the most disturbing moment of
my life and I went okay I've been really
big into talking about zero trust even
before I ever joined duo security and I
thought you know what I want to have
that extra authentication so Canadians
really easy to identify in our natural
habitat
we're dress like homicidal maniacs going
across a sheet of ice sorry about your
game last night with Finland but we'll
go on with that I do a security at work
is a global security adviser which means
I get to go around talk to wonderful
people like you and then back in October
this happened
Cisco bought us at first I'll be honest
I had fear and trepidation I had been
through many many acquisitions but I was
always part of the company that was
doing the acquiring and it was very
jarring being in a role where I went
okay am I gonna have a job tomorrow it
has turned out to actually be an
incredibly good experience which was
amazing so much so that we're even now
on their own website but that's as
vendor as I'm gonna get right now the
one thing that we did miss is an
opportunity with the acquisition was
when you had duo you had Cisco you could
have been disco but that's another thing
mad props to Wendy neither my boss who
came up with that one so our mission is
really simple to protect your mission so
what is zero trust what is the idea
honestly when we go back to it we look
at the roots of this have been around
for 25 30 years network zone
segmentation user assets user management
or other asset databases all of these
different components have been here all
along just somewhere along the line we
sort of got away from that to chase that
move shiny and this is a real problem
because we have gotten away from dealing
with core fundamentals and honestly zero
Trust is a wrapper for a lot of these
core fundamentals about how we should
have been doing security all along I
prefer to use the term trusted access
and I'll talk about that a little bit
more later but it just seems to be more
of a positive and this was I gave the
today's 72 hours ago I gave a talk in
Las Vegas and people said well zero
Trust has got such a negative
connotation I said yes but people are
paying attention so there is a positive
aspect to it so then we'll take that
zero trust and become trusted
so if I ask everybody in this room what
is love
I can guarantee you I'm going to get a
different answer from every single one
of you and this is very much where the
conversation around zero trust has
gotten us to and so when people ask me
what is Euro trust and the root of it is
really simple everything is on fire you
have to consider the things on the
inside of your network is on the outside
of your network as being a problem
because the problems will happen when
you least expect it
now as security practitioners we often
feel like this guy at least I have for
the last 25 years and he's just in a
non-stop painful pain point so back in
2000 it's actually closer to 2003 I'm
still trying to nail down the date but a
group called the Jericho forum came out
with a paper on deeper memorization
which was basically a precursor to zero
trust and this was the whole idea of
exactly that looking at network zone
segmentation all the rest of it locking
it right down making sure you had acid
inventories and all the rest of it and
then in 2010 John kinder bog who was a
analyst at Forrester at the time came up
with the term and you know what that was
great because people started paying
attention and then 2014 Google came out
with their own paper where they
discussed their implementation called
beyond Corp and honestly that was pretty
cool what's even cooler is in about 2017
they came out with a report card but
I'll talk about that a little bit more
in a bit and this is amazing so let's
just before you wonder about zero trust
in your own environment
realize it's an incremental discussion
right you have to go a little bit at a
time because it took Google seven years
to roll out their implementation so
don't feel bad if it's taking you a
while if you want to know more about it
after this talk there's a great book
here called zero trust networks the
really interesting thing about this is I
know none of the authors and I have no
play on this but this is actually an
excellent resource to get into so the IT
landscape is changing in many ways we
have gone from being a perimeter with a
castle wall and everything on the inside
to cloud implementations everywhere SAS
based offerings all the rest of it are
please or mobile I live on the road I
couldn't even imagine having to go back
in the office to get my email because
it's like downloading 25,000 emails it
would be really frustrating you need to
be able to work anywhere we've gone to
multiple cloud access platforms wherever
it happens to be is your company using
outlook spot or the office 365 are you
using Gmail whatever it happens to be is
are your companies using BYOD and the
thing is you want to prevent breaches
it's all about reducing the risk in your
environment so beyond Corp was their own
implementation at Google so as I was
going through right through to 2017 they
came out with a report card and how they
were doing and they were rather
transparent with it which was really
amazing because I look at this as an
excellent way for people to learn how
things went for them because we've gone
from a traditional approach of having
that you know network access controls
and firewalls and that was it right
through to where the access decisions
are being made so the perimeter used to
be the wall you this is your firewall
that was it everything's fine on the
inside which never was but now it's the
perimeter is really any tire and access
decision that's being made now we all
love our triads so this is a really
simple way to look at it you have your
apps your devices and you have your
users when you're looking to do a zero
trust type of implementation I'm not
sure if you're taking a picture there or
not okay as we're going through it the
easiest way to start is you know well
even below this is having an asset
inventory of the devices in your
organization but you want to confirm you
user identities let's see if my laser
works today yay gain access visibility
so you want to see what your users are
trying to do you want to insure device
security so you want to make sure you're
having the same type of security
configuration across all your devices
you want to be able to enforce
contextual policies so that you don't
have HR being able to access production
and dev systems that they don't need to
get to and be able to secure access to
all the applications that you use in
your environment and over the years one
of the things that I've really got every
go talk about this day one of the things
I look back is that I learned a valuable
lesson a long time ago is
hasil simply don't scale when I worked
at a power company back in mid 2000s I
had the CIO look at me and say this we
trust everything inside our firewall
because we trust everyone who works here
this is such a fractured notion just
because something is he on the inside of
your network doesn't mean you should
trust it now we all like to think of
ourselves as being environmentally
conscious environmentally friendly but
please do not recycle passwords we have
this really bad habit as humans that we
will use the same username and password
you know password one password to
whatever happens to be on multiple sites
so if you're using it for your internet
banking and your email and your Amazon
account or whatever it happens to be and
one of those gets compromised what the
attackers like to do is take those
credentials and then use them against
other sites to see what else they can
gain access to typically refer to as
credential stuffing don't make their job
easier if you have to use a static
password use a different one use a
password manager there are multiple
types of password managers out there and
if you have relatives that are doing
this whether you know they're using the
same username password convince them to
use a password manager there's multiple
choices out there that you can pick from
my folks are in their 70s I got them to
use a password manager if I can do it
but the thing is with the password
that's really a deprecated notion that's
something that isn't as effective as
some might think so if you come forward
and you say you know here's my password
that does nothing to confirm who you are
now ultimately as a defender you want to
say nope go away this isn't gonna happen
but the reality here is you want to have
something better than that
security paradigms have to shift to a
positive state I just noticed this up
here and that is really cool
yes I'm easily distracted so before I
ever got into computer security at all I
was doing a degree in classical studies
in archeology long story on how I got
here but this is one of the really
interesting lessons that I've taken from
that training was the fall of Rome in
410 AD now the Visigoths showed up they
set up shop and locked down access to
the city nothing in or out
within a period of time the Romans ran
out of food they ran out of supplies and
they threw open the door to said we give
up the attackers were used they able to
use their own security paradigm against
them a perimeter base-model
the old way of having the firewall and
the perimeter was demonstrably proven as
a broken security defense in 410 AD and
yet we still see that in a lot of
networks today now being Canadian we
have a lot of bears so one of the
analogies we like to use is you always
want to be faster than the hiker that's
right behind you not that I have any
experience on that
black bears apparently can't run that
fast thankfully sorry Bob
but this is the same thing applies with
security you want to make sure you're
doing a better job and as you're going
through and doing a better job you have
to realize that what was once a case of
you just had to keep it away from the
one threat there are now many more
threats to deal with the really funny
thing about this particular slide is
when I was giving this talk in Bogota
Colombia there was the military attache
from the Russian embassy sitting up in
the front and he didn't quite like that
sorry so the whole idea when you're
looking at it from a trusted access
approach and reduce is reducing the risk
you want to make sure you are reducing
the risk you're never going to be to a
hundred percent so just weighed yourself
with that notion right now but you can
get to a much better place from a
security impact and the thing is if the
attackers are stymied by the controls
that you put in place they'll go on to
try and attack somebody else so you've
done your job to protect your enterprise
now we want to make sure that we don't
turn into this guy this guy is actually
analogous to someone I worked with many
many years ago and I refer to him as the
flaming sword of justice his entire
mantra was how do we get to know anytime
there was any sort of indiscretion on
the network he wanted to have the power
to fire that individual it was insane at
one point I had a early iteration of
Twitter open on my desktop and the web
browser was refreshing in the background
and well apparently that was the denial
of service attack in his
let that sink in for a second this is
the way old school security really was
done in many organizations this whole
flaming sword of justice getting to know
is not an effective way for us as
security practitioners to do our job
we're there to enable the business but
to do it in a safe and secure fashion
because this is going to keep happening
data' breech after data breach how many
people here by a show of hands are
familiar with Amazon s3 buckets or AWS
s3 buckets gyro that's the best response
I've had yet awesome so the problem here
with s3 buckets is by default I'll say
that again by default these are not set
to public access unfortunately a lot of
the data breaches we've seen in the last
year have actually had their buckets set
to public access there are multiple
scanners that you can find on github
that will allow you iterate through
these and looking for resources like
this that are freely available and for
those of you don't know an s3 bucket is
a data repository where you can put
image files data files whatever it
happens to be and if you make them
freely available bad things are going to
happen now these are not s3 related but
Marriott kora Cedric these are examples
that this can happen to anyone and it is
not to throw any aspersions towards
these companies but it just shows that
anybody is susceptible to a data breach
now with the DB our report that came out
two weeks ago now one of the things that
went through it 81% of the credentials
that revolved native breaches we're
using weak credentials we love to blame
the user we need to stop doing that
because if the user is using a password
of one two three four or QWERTY or
whatever it happens to be that's because
we haven't either trained them properly
on how we expect them to do security or
we haven't given them the tools to do a
better job multi-factor authentication
biometrics whatever happens to be
something better than the static
password the perimeters that we have to
deal with
our poorest to say the very least we
have all sorts of traffic traversing our
enterprise however it is structured
hybrid cloud on-premise beat and we have
to evolve our thinking as to what that
perimeter is now this is a quote
directly from my boss yes hello
the perimeters anywhere is an access
decision was being made I used to think
that the data was the perimeter but
honestly I like this a whole lot better
because is really more apt and our
perimeter has changed we have all sorts
of different access coming into our
networks remote employees whatever it
happens to be now one of my favorite
ones with remote employees I worked for
one power company years ago where we had
developers in India that we're doing
code development for us and they were
doing a fine job and everything but one
day we decided to do an audit of access
to the network in the space of about
less than an illicit less than three
hours or something like that we had nine
different people log in from different
places around India and they were all
using the same key fob so they were
calling in to get the number somebody to
read it to them over the phone and then
they would enter it and off they went
obviously this was a problem and it was
not so much a problem with we they were
doing things his problem was we hadn't
told them what we expected there was no
security requirements baked into the
contract at no point did we say this is
good this is bad so they were just
operating in a way that was effective
you know what skunkworks happened
because something is missing with the
zero trust model you want to look at
dealing with access how are you managing
your users in your environment that is
one of the key pieces the devices that
you're using in your environment are you
having corporate assets are you allowing
external assets how are you handling
those and the applications that they're
using a couple of marketing looking
slides but they're not the whole idea
here is you want to be able to give
folks the same access that they're using
at a coffee shop as they would see in
the office as they would see at home
you want to make that uniform across the
board because if we don't do a better
job of managing how people are accessing
things stuff like this is going to keep
happening
now my own website I started tracking
data breaches back in 2012 because
apparently I need a hobby but here a
third row down LinkedIn six and a half
million records at the time that was
huge news
but these days we're dealing with record
breaches in the order of magnitude of a
billion records
this is absolutely maddening so why do
we keep getting worse and it's painful
too I know how painful it is because
I've lived through it this here is an
actual screen grab from a company I was
working at where the website was one of
the websites that we had was actually
compromised this was one of those
unnerving moments where I came into work
sat down had my coffee on my desk and
looking there was a stack of notes there
from CBC and all has other publications
they want to talk to us about a data
breach that we had and I was like what
look at my phone multiple missed calls
oops this was a case of we had
identified an asset that had to be
retired because it was using an
applicative version of WordPress and we
said look you need to take that offline
they said sure no problem
they didn't take it off lion I didn't
blame them I blame myself that was
something where I could have gone and
followed up to make sure they had taken
that down I could have gotten them to
commit to a timeline when they took it
down but I didn't but I learned from
that thankfully it was only reputational
risk in that particular instance but
still painful nonetheless so I always
loved pulling out these slides this is
from a site information in beautiful net
this is a couple years ago this is a
graphical representation of various data
breaches this is a little bit more
recently in two years that's how bad
it's gotten and then we jump to now
where they have actually taken in Rio
architect of how they present the data
because it wouldn't fit anymore we can
do better than this we are better than
this which leads me to the question
what's open in Sweden so I went looking
around on you know everybody's favorite
Google for hackers showdown this is how
many ports were currently available
listening in Sweden at the time that I
checked now that doesn't mean that
they're all bad by any stretch of the
imagination but a lot of averages some
of them will be
even right down to Gothenburg we have
this many ports that we're currently
listening it's really amazing what
people will allow unfettered access to
somebody's garage somebody's backyard
I'm not really sure what that is but
somebody had that online and I don't
know if that's a pigpen or what that is
but all of these are from Sweden
none of these required me to log into
the site I didn't have to hack anything
it was just hanging out there in the
breeze when people are providing access
to something as simple as that
and then you extrapolate out as to what
other problems could be lying out there
we can do better so you want to make
sure that you're making it harder for
the attacker you want to devalue stolen
credentials so if a psychic compromising
usernames and passwords are dumped out
you don't want it to be easy for the
attacker to do their job you want to
make sure the low-hanging fruit go away
you don't want to have things like those
various cameras up there we're like this
is a simple example but it's just one to
illustrate how easy it is for people to
get this sort of information back in
2003 2002 ish I had a conversation
within our own organization that I was
working at and I said you know what
would be a great idea if we lock down
all the laptops and desktops and servers
and make it a mall Bastion hosts and
then we don't have to worry about you
know when they ended up in the wrong
Network and things like that and I
escaped that meeting with my life which
was fantastic because the support team
that would have had to deal with it was
there they weren't very happy with me
oddly enough but here we are 2019 and
now we're having a really good
productive conversation about it because
the way we used to do things and a lot
of the organizations was that he would
lock down everything in the DMZ they
would make sure everything
internet-facing was secure
but systems on the inside were
imminently vulnerable in one company I
worked at they had installed entire
microsoft office suites on all of the
production windows servers why well we
have a license for it so they thought it
was a good idea to put this on
production servers but you know what
okay so as we're going through and we're
talking about how do we gonna get to the
zero trust how are we going to start
locking things down you want to make
sure that you're setting your
expectations within
our own organization don't say all I
want to get zero trust certified doesn't
exist it is an iterative process it is
something to aspire to and you want to
make sure that every time you're doing
something that you're trying to get to a
better place than you were before
because a lot of these that goes back to
dealing with core fundamentals even
something as simple as looking at your
log files not many companies do that
which is really jarring when you think
about it it is a game of increments
where every little bit is a win and you
have to celebrate those wins but before
you get and celebrating the wins you
want to determine what those priorities
are within your organization what is it
you're trying to achieve before you ever
talk to any vendor out there you want to
make sure you do your homework bless you
you want to make sure that you
understand what it is you need for your
environment because it's gonna be
misspoke it is not going to be a one
size fits all for every company like a
vulnerability scanner come a company
comes in says oh your ratings are high
medium and low that means nothing to you
and your particular organization you
need to tailor it accordingly you want
to be able to deal with attacks in a way
that you understand how to beat them so
if a credential dump happens and you
don't know about it for several weeks
and the attackers are using these
credentials to get into your company how
do you know it looks like legitimate
traffic so if you're using multi-factor
authentication as an example the
attacker won't be able to use those
credential dumps because they only have
part of the equation they only have the
username the password they don't have
the third factor they don't have the
device that is in your inventory that is
registered you want to make sure that
you verify your users in your
environment verify your devices and
protect every application that you're
using you don't want to have somebody
that is sitting in a coffee shop in
London accessing your resources on your
email accounts when they're not one of
your company staff you don't want some
pesky Canadian coming in and causing
trouble it's really simple you take the
user you go against your source of truth
say Active Directory is an example check
in the device inventory yep that's great
then ignore
these vendor e stuff verify all of that
and then you can get access to
everything here it's really simple it
all of these controls are all parts of
elements that have always existed you
want to make sure you're going through
and looking at the trusted users in your
environment who are they
if one company that I worked at we did
an audit of all of our users and we
found that there were about 10 to 20
users that had super user privileges or
better not better but super user
privileges
okay a plus plus but of them 10 of them
no longer worked at the company one of
them had passed away five years previous
and that at person's account had been
accessed three years previous or two
years previous so somehow a deceased
individual was accessing the network the
only reason we knew is because we had
gone back and done an audit there should
have been removed there should have been
mad at a better access controls better
staff had removed processes and
processes are really a great thing that
you guys can do in your own environment
that'll help you a great deal when the
attackers get that information they have
to have all of these individual
components in order to break into your
network if you have trusted devices you
already have that asset inventory you
know what you are expecting to try to
come knocking into your company if you
were you know one of the Jason Bourne's
colleagues trying to break into a system
system with something that was left
behind on a job at least you have that
in your asset inventory as marked as
destroyed but there it is something's
very wrong and when you're traveling
this is one of those things that really
can really bite you in my case in
particular so if you're doing a proper
type of type of implementation you're
looking at it you're making sure that
all the devices they're trying to access
your network are patched to current or n
minus one
you can now enforce that using these
sort of technologies this has bitten me
because I was on the road at one point
and I try to log in said ant your
browser is out of date you got updated
before you jump in and they're like oh
great fantastic hoisted on my own petard
but this is really a good way to help
interacting with the user helping and
forcing a good security idea with your
users to make sure that they
that as well because if they are
educated they will help as part of the
greater scheme you want to make sure
those devices are up-to-date every
application that you're using in your
environment whether it's Salesforce
whether it's a third party email
whatever it happens to be you want to be
able to marshal access to those things
and you want to have the ability to get
granular to allow access depending on
what it is you need to do so I actually
rolled out a multi-factor authentication
on my own website liquid matrix org for
our users there's about ten of us and
there's one user that I like to mess
with because you know you end up in
certain countries on travel and I will
disable this access just because I'm a
jerk but that's just it you can get
super granular as to what they can and
can't do or allow his browser to access
but he can't do certain things because
well apparently I have nothing better to
do beyond Corp is a great example here
the Google implementation the whole idea
here is you're leveraging stuff you
already have in your environment you
already have Network zones you already
have VPNs you already have asset
inventories or at least I really hope
you do I've been in organizations that
had none that was fun you want to look
at it as years of shopping list the
simplest way to get started dealing zero
trust is build your asset inventory in
whatever way works best for you you want
to look at your user management you want
to manage your devices now this year
like I mentioned with earlier with
processes a defined repeatable process
is something that can absolutely help
you and it's something you can do
yourselves I worked at a power company
years ago where the CIO decided this
year there's going to be no net new
projects everything is just gonna be
maintained that's it and we rolled out
ITIL in that year as painful as that
sounds it actually worked out really
well in our first year our rate of
incidence drop 72% because we were using
defined repeatable processes
and once you have all of these pieces in
place you can start watching for user
behavior and analytics to see what is
actually going on and you can analyze
that data and pulling it into whatever
sim solution you happen to be using and
this here is my favorite of all time
network zone segmentation I worked at
one financial institution years ago
where I was able to sit at my desktop in
Toronto and query the mainframe and do
all sorts of things and then I felt
guilty I know what the telev about it I
said look I'm sorry I was trying to gain
access to the mainframe because I
thought it was a good idea I didn't ask
permission first they went oh we didn't
know they had no logging there was no
connection between the back office and
the mainframe that would have stopped me
or no control or other this is not the
way to do things so once you have
started locking down your users once you
have started controlling the assets and
the applications are accessing these
hackers are going to get frustrated and
they're going to start going after api's
you start to have to have focusing on
that to make sure that things are going
according to plan
Twitter back in the day when they had
first rolled out their API it was really
interesting the a friend of my Robert
Hanssen he started going through and
adding all sorts of people on Twitter
and all of a sudden we were all
following him and were like wait how did
this happen we didn't even know so he
found undocumented features in the API
where he was able to arbitrarily and add
anybody he wanted and it was really
amazing that still that sort of thing
can happen with your API today if you
have undocumented features somebody
smarter than me is going to find them
and when we're dealing with that then we
have to extrapolate out and look at the
supply chain issues this is just one
example here this is a submarine cable
map for internet connections around the
world then you extrapolate out from
there all the different software
packages that you're using to build your
applications to build your
infrastructure each piece along the way
somebody has access to
how are you vetting the security of all
of those individual components how are
you making sure who has access to what
and the attackers are always looking for
new ways to get in because back in the
day they would just go after and attack
the site and my last job I was asked how
would i hack the company and I said
this was during my interview process and
I said simple I would take the CEOs exam
in out for lunch they said what would
that accomplish and I said well they
either talked her into giving my
password or I'd use a brick to her
fingers dark but this is how the
attackers think they're not going to
come at you with a frontal assault
anymore they're going to look for
another way around and the easier way to
get their job done I had a pen test done
years ago
not too many years ago actually oh my
god 11 years ago Wow
and I again this was one of those
moments where I came in the morning sat
down with my coffee and the phone rang
and they said we're ready to start
there's 9 a.m. it's like sure go for it
9-14 the phone rang I just stared at the
phone because I knew in my heart what
that was I didn't want to answer it but
I did and sure enough the pen test team
had gained access to every switch every
router the entire active directory they
had everything in 14 minutes
why because one of our third-party
connections coming into our network one
of our vendors that we worked with had
used default credentials on their access
point this was one of those things where
I didn't say the pen test you can only
attack between five and six on this day
and only these two servers I said no no
anything's fair game and I paid for that
or other dearly but I'm glad they did it
and not somebody else the best part was
they went through and they checked all
the logs and access files for everything
they had done and they could actually
find no evidence anybody else coming in
so that was a nice little moment no
assuming that the logs were in intact so
as we go through and we look back at all
the ports that were open in Sweden as an
example one of the things that I went
through and I went looked at was SSH so
this is just one sample that I went
through and I looked I said okay well
what kind of things is this particular
that's the safe daemon vulnerable to
this is one I just picked at random
that's a lot of vulnerabilities for one
Damon so somebody can gain access to
this system then pivot to other systems
is a pain can just go from there that's
a lot of SSH SSH Damon's that are
running out there in Sweden you want to
make sure that you're encrypting
everything in your network when you're
looking at this you want to look at
network traffic in-flight you want to
look at data at rest you want to make
sure that you're securing this I've seen
too many implementations and
organizations over the years where they
weren't encrypting the data one company
in particular was doing financial
transaction data like not actual a bank
but it was a company that was supplying
all sorts of date very cool that was a
new one and they were providing
financial data to us and they said oh
it's ok everything's over port 4 4 3 and
I looked I said but there's no
certificate I said oh no but the
requirements are were supposed to use
for 4 3 anything none of the data that
they were going across was actually in
fact encrypted but they were using the
port there's a better way to do things
we can move away from doing the static
usernames and passwords and this is a
great way for us to get there how many
people here by your show of hands have
heard of web authentic spected thank you
this is an open standard that was
recently ratified by w3c please go and
read this if you take nothing else away
from my talk today read this this is an
open standard this is not some vendor
saying buy our stuff this is an open
standard that will help you get to
password list authentication this is the
new hotness and I would really really
enjoy it if we can do better than the
static usernames and passwords that we
have done for far too long so let's do a
little wrap-up you want to assume that
your network is hostile everything on
your network is of some negative been if
you start there as your basis then
you've got a good place to go you want
to establish a trust engine you want to
make sure that you have your source of
truth for your users your devices
and the applications you're using and
write down do you want to keep it simple
I'm a big fan of repetition build your
asset inventory have solid grasp on your
user management you want to know what is
on your network defined repeatable
processes will help you in ways you
can't imagine concentrate on those
that's not something you have to buy
from anybody this is something you can
do yourselves and network zone
segmentation please please please do
this I worked in one organization which
I may have mentioned before where I was
in Toronto and I was able to query
offices in Southeast Asia and there was
no way for anything to be a problem no
no interactions that would stop me from
that it was a flat network global flat
network this is not something that needs
to be there so how did we get stuck with
passwords nears we configure back in
1962 MIT came out with passwords for a
system called CTS s now this was a time
management system to handle people's
access for supercomputing time each
student was allowed 4 hours per week
computing time in order to do their
projects but people figured out how they
could steal time from other students and
so they went okay a reactionary measure
was to put in passwords think about that
for a second 1962 a reactionary measure
was to put passwords and here we are
today
suffering data breaches of orders of
magnitude of billions of records because
of a reactionary knee-jerk response we
can do better than this
the old way of doing security is fading
away we need to be there to enable the
business an able our organizations and
naval our governments to do security in
a better way the old way is fading and
this is a good thing because we need to
improve how we do security we don't need
to be lobbing the Holy Hand Grenade of
Antioch every time something goes wrong
we don't need to be the group that is
saying how do we get to know
we're better than this thank you very
much for your time today
thank you very much the security fest
for having you back again I really
really do appreciate it and that is it
for me if you have any questions I'm at
your mercy thank you
thank you very much Dave that was
amazing as always thank you we gonna
have yes but run around and see if we
have any questions in the audience so
please put your hands up if you do okay
I gotta ask I have a question yeah
what's that guy doing he's taking
amazing videos oh cool
you'll see them on Twitter oh thank you
this is in the cloud environment with a
container technology like kubernetes hmm
Jesper here has had a really good talk
with the difficulties with all the
applications that are involved and then
inherited vulnerabilities well yeah so
inherited vulnerabilities that is a
different animal so there you're looking
at dealing with the access control so
you're dealing with the users and the
access to the applications and I don't
want to get too much into specifics
because then it sounds like I'm ven
during at you and I don't want to be
doing that but I'm more than willing to
have that conversation with you once I'm
off the stage because I don't want to
seem like that guy cool
anyone else of course there is - all the
way in the back is that the Spaniard hey
Aria
first of all thank for a really nice
talk thank you and I want to ask you if
I mean you have been coming up with a
lot of things that can be done for
example setting up web of n as a way to
use biometrics and so and they have
different Network segmentation and the
question I have is suppose you just
start at a new world new company you
suddenly get into the role of size and
you have to first one only one single
thing if you could only give one advice
because you only had one minute hmm
which thing would you start focusing on
for the first day for a Caesar
yes wear Kevlar realistically I would
say work with a start with an asset
inventory if you don't know what's on
your network how can you protect it I've
been in far too many organizations over
the years where we didn't have a firm
understanding as to what the asset
inventory was in one company we were
rolling out a new version of antivirus
across the board and they said ok we
here's the inventory of everything we
currently have once we started doing
scans of the networked and checking all
the assets to see what in fact was
installed versus what we were told it
wasn't so on the two did not even
remotely lined up so it's one of those
things if you have a solid core asset
inventory from there then you start
building out incremental wins you don't
want to try to do everything at once you
can't boil the ocean ok anyone else it's
early but hey you should get the
question out there and I'm around for
the rest of the day and also if you want
even feel free to drop me an email too
if you have a question you don't want to
ask him sweet cool thank you very much
thank you
[Applause]