thanks so much Adam and thank you all so
much for being here what an honor to be
here for the 10th anniversary panel
moderating the uh fearsome forsome I
don't know think think of good names for
them so excited to get things kicked off
here we'll kick off with some
introductions right excited to introduce
Blake Brad Jen and Eric so I'll ask
Easter of them just to give you
background of when were they at miter
what they do and then uh what have they
done since um that I mentioned I was on
the miter attack team a couple years ago
as it MIT from 2015 to 2020 I did have
to look that up on LinkedIn because time
flies um so I had kind of the honor uh I
still remember when Blake emailed me and
was like hey do you want to like map
some groups to this attack thing and I
was like I don't know what it is but I'm
in so with that Blake you want to kick
us off yeah so I joined merer in 2013
and left in 2020 right before covid I
really kicked off um in my time there I
started attack uh I led the team that
created did Caldera the open source
project for adory emulation uh helped
start the attack evaluations uh program
um and then when I left I went to
Microsoft and since then I've been
leading the Microsoft 365 Defender uh
research teams both for research and
data science where we're doing some
pretty cool stuff like uh the automated
attack disruption that Microsoft uh
recently
announc yeah so I was at miter 2010 to 2
15 I also had to look it up um and I
spent most of my time uh with the NSA
red team uh as my sponsor so I did a lot
of offensive work uh there when I left
merer um I went over to Sony and led
their Global red team uh for another
five years and most recently the last
couple years I moved over to try the
startup World which has been an
interesting ride uh so I'm at phum uh
which is a software supply chain
security company trying to handle
defensive problems around open source
software packages it's kind of been the
last few years for me and I'm Jen um I
was at miter I did not look this up but
I think it was 2014
2017 um I was kind of the weird one
where I actually had a cyber threat
intelligence background and I was also a
Chinese Mandarin linguist so I was
working on um some data that ended up
being used for attack that was actually
real world attack data that we had all
of the logs and sensors and things for
and my job was to basically take the
technical logs and turn them into
something written that people could read
and understand and when I was doing that
I there were a number of times where
even though I'd been in the space for a
while I'd have to go to one of the other
technical people that wasn't in Intel
but did some was a little more on the
technical side and I had to say so when
this happens what does it look like
actually on the system like from we
putting AAC together from their
perspective it was like what are you
actually typing and then when I'm going
through logs when I was doing that then
I was marrying it back to what is this
actually look like and what I can see in
a log and trying to figure that out um
and I loved it and that was so much fun
I actually only left because I uh was
selected to be hired I was the first
person that was hired for unit 42 when
that was getting started at Palo Alto
networks and that just sounded
fascinating it was going to the private
sector and totally leaving the
government space but it was doing
something that I love to do and I had
experience doing the government space
which was building thread intelligence
teams so I was like great I can you know
kind of make that leap and I never
really looked back I was there for nine
years and then I was laid off like so
many people have been lately in this uh
field unfortunately and then I recently
was picked picked up by net witness and
I am there to basically do what I did at
unit 42 with their team so I am really
excited and looking forward to it and
Eric Eric um was with miter from 2001 to
2014 beginning of
2014 um also on NSA red team for the
majority of my time which is where a lot
of the information from the framework
came from you know Brad and I sort of
putting things together initially and
tapping into Jen's knowledge and and
others
um after that I moved on to Sony as a
security engineering uh component and
now serve as the head Global Security
architect for Sony um Jamie mentioned uh
family and people mentioning that nobody
else has mentioned that so I'll bring it
up you know I have two twin 13 year old
boys uh they don't know much about
attack they hear me talking about it
they tell me it sounds violent and I
shouldn't deal with it very often but um
yeah and the name is your fault and the
name is my
fault awesome well good to hear about
all the backgrounds and I as a thread
int person myself I love the thread in
tail plus red team power and along those
lines um for those who don't know let's
talk about the attack origin story like
it came from somewhere probably deep in
your brain so um want to pass it over to
Blake tell everyone about how how did
Attack start how did it how did it begin
yeah so this will take us back to uh
about 2013 so um I just worked at the
NSA uh NSA threat Operation Center for
three years as a government civilian and
uh knew Adam from some of the work that
he did there and it was like really cool
so I was like okay I'm ready to move on
to something else and miter sounds
really cool I want to go join Adam with
his work and so uh Dr Todd witold was
the department head of the time I
interviewed with him um and he thought
my background in like cyber defense and
in thread intel was really good for this
project that they had called the fort
meat experiment where they were
basically instrumenting the fort me live
uh production network uh with new
instrumentation and analytics to find
attacker behavior and you thought it
would be a great fit for the white team
lead position where I'm sort of like
liaison uh between the red team and and
blue team and helping the red team sort
of craft their what we're calling cyber
games which is like the redon blue
actions to prove that the detections in
analytics the the botin was was writing
were actually effective so my first sort
of like task on the the project was to
take the results from the first cyber
game that happened like the week before
I joined and sort to make sense of it
and so I had to dig into the the Splunk
analytics the data what the red team did
and try to make sense of this and so you
can sort of see the the seeds getting
planted for what eventually became um a
tack and so after the first cyber game I
wrote this report and tried to make
things make sense between the teams and
then to a higher level audience to show
that they were actually making progress
and so when we were planning the the
second uh cyber game um was really going
back to like hey like the red teams
activities well some of it was very
similar to adversary behavior that I
knew about um there was some very like
red team isms in there like leaving like
flag. text to say like oh I was here
which isn't really like something that
an AP would do so I I reached back to
Adam and he sort of like pulled from his
knowledge on some of the work that he
was doing of like the top 10 uh ttps
that adversaries were were doing so like
things like Discovery commands and all
these and certain types of of lateral
movement and stuff and so uh it sort of
like started the the idea is like how do
we look at uh threat Behavior a
different way instead of like looking at
just the AP1 report and saying like Okay
this actor did these things but how many
other actors also do those things and so
we had this idea where we would take you
know red team act actions try to drill
down into the lowest level and then
compare it with with thread Intel so we
took this idea to our leadership said
hey that's great gave us some funding
under the fmx project and that's when I
created the first
spreadsheet what does everyone else
recall did Blake tell it right what did
you miss yeah no I mean I think those
are the the bones of it and then in
terms of creating it I think one thing
that's important to note and he kind of
just tees that a little bit with the
funding and the the project but we all
had other jobs right we had our sponsor
work that we were really doing with most
of our time so this was kind of I think
another important note for the origin
story is this was kind of born out of uh
sidew work I mean this really was just
okay can we find the time to sit in a
conference room all together and build
the spreadsheet you know the Excel tool
as the best tool we have for attacking
right uh you use uh that spreadsheet
technology to kind of build this out and
I think that was another key element was
Finding the time to all get together and
talk through all that and start to throw
it down and then of course the logistics
of how do we organize this thing as we
still struggle with today right trying
to fit everything in and decide where it
all belongs uh so that that was one of
my Recollections of how it all kind of
came together as well yeah it was it was
a lot of fun honestly it was and but I
was you're actually talking about this
the other day I think it was the one of
the first times in my life where I was
actually in a a room and this is most my
favorite office of all time because it
had a lock on the door and the lock had
a special code and you we required
special access to get the code to get
into our office so we couldn't you
couldn't just like wander in there
randomly which was amazing highly
recommend introvert night yeah and but
it was the first time I'd ever had a
chance to just sit with people that
worked on a red team and blue team
people and things like that and we all
just sat in a room and we're like all
right let's figure this out what do we
need to know to be able to have one
language between all of us and what
we're seeing the adversaries doing so we
can finally actually answer the question
if I had been my my organization had
been faced with fill inth blank attack
that had been in the news or
xap how would I know like truly know if
I would have been protected against it
how could I figure that out and the we
came up with attack which was using
actual real world adversary data from a
project Adam was running and marrying
that together with red team and blue
team skills and creating a way to
communicate all that and then even more
than that going further with SS and taxy
coming up with a machine readable
version of that so taking long form
intelligence that even if no matter how
well we write it for people there's
always a challenge because it is
technical by Nature um and this took
having to have that that component out
of the out of the question you could
actually just get these feeds that were
highly vetted and verified and just
import them and use them and know that
that that you could actually answer that
question and that was it was just so
much
fun so I'm sure it was fun but probably
some challenges Eric I'd be curious you
know your perspectives especially any
challenges in the early days yeah I mean
I think you know some of the challeng
just were convincing uh convincing
myself at least that this was going to
be something that could be broadly
useful and I think we we always sort of
thought red teams could use it blue
teams could use it um certainly never
thought it would get the community
adoption it did um and then of course
one of the other challenges was was
naming it right we you know as hard as
it was to dump that knowledge into a
spreadsheet you know we sat in the room
for for hours trying to figure out the
name we couldn't come up with something
and uh just you know sort of had the
Epiphany on on the driveing one day
coming across theer American Legion
Bridge distinctly remember thinking
attack and I laid out the the the
acronym and you know normally you'd
expect the sun to come shining through
the clouds it didn't traffic cleared a
little bit so I took that as a good time
but um yeah it was a fun time yeah that
was a challenge um I was actually it
didn't get wildly widely adopted and
people laugh about it now all the time
but my initial way of trying to describe
it to people was it's basically a Mr Po
Potato Head doll
and you can it's just a bunch of
different pieces and you can combine
them however you want to do the finished
product so it it's flexible and we tried
to use that for a while and um yeah that
only made sense to me oh no it sense to
me too so I use that in the slide deck
to describe attack many times and I
remember like asking Adam to go fill in
for a presentation a couple of times and
he got to the slide and just like froze
because he didn't know how to describe
it yeah so it's only us two but I think
understood what that
reference and so what about what about
the Amper sand right Eric was it was the
Amper sand did that did that come to you
in traffic now there's a giant aand
that's the one thing I I really disliked
I'll admit it there was an a there
beforehand but the AER sand popped up
later but yeah we can blame Myer lawyers
for that yeah but it's really easy to
find it in a Google search it's good
little infringement so the hashtag
breaks on Twitter SLX but we have uh
ersan pretel so the silver Lin yeah um
so I have to imagine the early days Eric
you mentioned you know convincing
yourself this could be useful um what do
you think were some of the early
decisions you made that have led attack
to be so successful bringing us all here
today what what do you think has led to
its kind of longevity and
usefulness like yeah I think one of the
things is that we keep contributing to
it like there is a noticeable presence
that the attack team has had since day
one in social media on Twitter uh
constant updates that I think the
community saw and was waiting a little
bit to see like is this something that
miter is going to create and then drop
or create and then maybe they updated
every once in a while but I think it was
Myer's persistence in making sure that
it's maintained over time that really
solds I think the community that we were
here for the long
term Jen from a threat Intel perspective
like again a little bit biased here but
I'm curious how do you think that
Relentless perspective of focusing on
the adversary has really helped the
tech I think it was actually the
critical piece that we'd been missing in
thread intelligence and it's still the
most challenging part to get today is
actual true accurate logs of real the
adversaries actually believe you're
compromised whether you actually are or
not data logging data sensor data
everything and it was in an environment
that we controlled so it was we could
literally sit there like watch them like
real time and we would and just Giggle
and like do stuff on purpose to mess
with them and oh that was seriously
entertaining um but I that was the first
time in my entire career I had access to
that level of data and the time to
devote to it to actually figure out like
I was I was literally paid to do nothing
but parse through logs and write out
like a description explanation for other
people so yeah and once we had that it
was why don't we use
this yeah I I do think tying in the
thread Intel the red teaming and other
things and sort of meshing that is one
of the the the reasons it succeeded the
way it did and and it was you know both
enlightening for me coming from Red
teaming and not seeing that thread Intel
but but I think it played out where we
were able to tell a better story you
know we had we each have different
perspectives and um I think that we were
able to build something that was was
usable more broadly yeah we had a lot of
but everybody knows that why would we
bother to write it down and then we're
like oh like the two people or like the
people had that particular skill set in
background they all knew it the other
people in the room had related
backgrounds nope knew to us yeah even
amongst the team you know that was true
right we found that we would assume that
each other knew something and so Eric
and I would be like ah let's not put
that in that just everybody knows that
we don't need to write that down and
then we'd talk about it a little bit and
they'd be like oh yeah that is kind of
interesting or it's very red teamy right
I don't know if I've seen an adversary
do that I wonder what that would look
like um and and so we constantly having
those conversation and there were still
things that didn't make the cut right
left on the floor um I think you know
Adams kind of mentioned that there's
still kind of a barrier of what we need
to um decide what should really be in
there and what is that kind of real
adversary tactic versus kind of just
wild theories and things that that you
may never actually see in the wild and
we do need to make sure it doesn't blow
up into some massive thing so those
discussions uh happening as well I think
uh kind of made it something that people
could still get their arms it's big but
people can still get their arms around
and consume it from many different um
kind of work roles and I think that's
that has added value to a lot of people
and kind of kept its legs and then I I
have to mention one more Katie I think
the community involvement yeah is a key
thing and you know this is something you
guys may not know but it was designed
that way from the beginning Eric and I
knew there's no way we're going to
capture everything right of all these
attack Tech and things that people could
do um and we wanted that from the very
beginning we wanted it to be
crowdsourced we wanted to kind of jump
start it but we absolutely knew the
community had to be a part of it and I
think um you know to Blake's Point miter
continued to facilitate that in a in a
really strong way not just kind of every
now and then let me jump in really kind
of facilitating that but then the
community involvement I think is the
only reason that it continues to be
successful and will continue to be
successful we saw that I think on the
slide while was like four fourpoint font
um and I think it's it's an interesting
dichotomy right like all these
contributions I know when I was on the
team it was it was a challenge and it
was wonderful to get the contributions
but then I think what I'm hearing is the
importance of saying no sometimes hey
this isn't something a red team is or an
adversary is doing and right that
protection is is an important role not
an easy one yeah I think one of the
first contributions we got was
exfiltration of her power lens which was
yeah not not quite interesting I'll be
looking if anyone has an ad an example
of adversaries doing that uh you can
talk to Blake
after um so I think what one of the
things so interesting about having you
all here is that right you started this
wonderful attack thing and then you've
since departed miter and I'm curious um
if anything has changed your views on
attack or how have your perspectives
changed since leaving merer like start
with you uh I would say I feel a lot
more appreciation uh for it and the work
that we put into it seeing it from the
outside and seeing like how much a big
organization like Microsoft has actually
adopted it internally like it was quite
impressive to
see specifically at for my time at Sony
I think is the same thing a real
appreciation I had some ideas of how to
use it with my sponsors and things at
miter doing some mapping and overlaying
and that type of thing but I think uh
for me going in and doing a red team
report and being able to uh well use it
in a couple of ways use it to design a
red team assessment I think was one you
know picking some techniques ahead of
time and trying to emulate specific
adversaries and things like that but
then on the back side um you know again
going back to that you kind of assume
sometimes that people know everything
but then we talk to the sock and they
had never seen that particular technique
before or the sock analyst that got you
know happened to pick up the tickets
that were around your work had seen um
you know one or two privilege
escalations but they'd never seen that
particular one so being able to have a
framework that you could communicate
really easily set it down and um not not
train necessarily but but just
communicate very well between those
analysts and then up kind of up the
chain as well uh I found it very
powerful to have that uh framework for
that and so I think that was pretty big
for me yeah I love the learning aspect
right when I'm teaching for Sans I'll be
like hey if you don't know what a
scheduled task is right the internet is
a vast thing but go to attack right read
about it look at the examples so maybe
that wasn't the original intent but I
think that's a great kind of byproduct
bringing new people in I will say uh you
know plus one for that we we did that
for operators coming in that on the
offensive side even that hadn't seen all
these techniques it was kind of a a way
to set up a training plan for them as
well and say well you know are all these
familiar to you if they're not pick one
or two go study them come back to me and
tell tell me what you learned about them
and if you think we should work them
into any assessments or anything um so
yeah absolutely think there is and can
be a training element that that can be
built off of this as well love the
democratization of the knowledge right
absolutely yeah um it's honestly
surreal what happened with it I don't
think we could have done this at a
different organization miter is a unique
entity and I I really don't think any
other organization we would have it
would have survived or it would have
been adopted as especially as wildly and
as W widely as it has been by the
community and then the quality control
yeah that we made a conscious choice to
enforce make gives it that that more
authorative air if that makes sense
because it's not anyone that spends time
doing this and reading blogs or white
papers or things like that knows you
have a mental ranking of the sourcing of
those based on the quality of the
research when you read it and you kind
of rack and stack mentally the ones that
you prioritize and you believe and the
ones that you just basically throw out
and if you bother to read you kind of
giggle and you're like oh boy that was
awful or you read it and you see and you
can pick out some errors you're like I
see where they were going with that but
there's a bunch of just issues this like
logical errors fallacies and some of the
logic that was drawn so then and when
when you see that when it's made it
through the QC process then you also
know okay there's problems at that
organization right now with within
somewhere within their resarch
organization or QC process so you
discount those or you don't actually use
them until you verify them yourself or
someone else that you trust has verified
them and not having to do that is makes
life so much easier just you can take
them you're like all right you're
excited for them at that point um at
least I am because all right I'm going
to learn something now this is something
that I is going to teach me something
and I want to read it and then I want to
take that information and go play with
it in the sources that I have um so
that's been fun and honestly at this
point I've kind of gotten used to it but
for a while I was kind of weirded out
when I'd go to do some sort of
presentation or speak some sort of event
and there'd be people there that are
like oh wow I learned about that in X
class and at this point I think the the
lowest I've heard is high school but
they're like oh it's such an honor to
meet you and I'm
like who me like no no no no no no like
this is
strange but yeah because it's people
like it that much and I don't think I
think it's you're really lucky if you
have any time in your life where you
work on something something where it
makes people feel lucky to have met you
it's it's it's a weird feeling it's a
great feeling but it's really
strange yeah that hits me too it's it's
it's a good feeling to create something
that's useful to people yeah like what a
rewarding thing in life yeah that's hard
to follow But Eric how have your views
kind of shifted since leaving miter yeah
I mean I I think I'll I'll sort of
second Jen's comment around miter and my
appreciation for them continuing to sort
of carry this on you know it's a it's a
heavy you know a large undertaking to be
able to keep something like this in a
format that's usable by the community
it' be very easy to watch it just you
know expand and and end up being
something just too confusing to ever
really tap into um and I also think just
generally it's great to be able to as
you're dealing with a a security
Community have a Common Language so you
know seeing that continue on and be so
widely adopted again is has been really
helpful in in so many aspects of the of
the job yeah thinking about the adoption
I'd love to hear from you all a little
bit about use cases maybe that you've
had in your uh your recent roles or that
you've seen and you know we can also
include maybe some not so great use
cases um there are a ton of good ones
maybe some less than ideal ones as well
so anyone anyone have a use case they
want to kick off with I I'll jump in go
so you know I think the framework's
great to be able to take a security
program get some idea of coverage say
you know are we doing okay what do we
have to worry about are there's certain
threats that we we really lack coverage
entirely um you know how do we tackle
that you have vendors out there telling
you that they have coverage for some of
these things 100% um you know the the I
guess on the negative side I've also
heard of other
organizations solely measuring their
their security U Effectiveness by the
framework and I think that's a real risk
right you know being able to say hey we
have full coverage of the attack
framework that that's really a fallacy
at the end of the day right sub
techniques you can't get deep enough
into this to say that you have full
coverage of any one of these techniques
um you can say you have you know pretty
good feeling around it and that you
think you can cover it but bad guys are
always going to invent new ways to do
some of these things so um you know
relying solely on this is your maturity
I think is a danger but I think it's a
great starting point yeah Fair points
other use cases totally agree about the
it's kind of gone off the rails with its
use cases and it's now being used for
ways at for things that we definitely
never intended it be used for and it's
it's not an it's not an accurate use
case it's to Eric's point it's a good
thing to use educational tool and to
figure out how if you have problems and
to focus on them but just as we all know
and is something that has frustrated
people in the community it's a living
entity it it changes all the time
because software changes adversaries
change and that means it's not a static
document there is no time ever where you
can use it and say oh that's good we are
100% covered because we can do this
based on this no that means that you're
like to Eric's Point you're in a good
spot probably depending honestly on how
you interpret it when you decide to
apply it
incorrectly but you're setting yourself
up for fail by doing it that way the
people that are using it as an
educational tool and to inform them and
then kind of going along and
understanding
that you never stop investing in cyber
security I know this is a challenge for
a lot of people that aren't Technical
and for boards because I've also had to
argue for funding for things um but you
never stop you spent five million two
years ago great you're spending 10 this
year next year you might spend 20
because something really large changed
it's not something you ever get to get
to and be like all right we're done we
can get rid of those people we can
invest our money somewhere else no this
stays a sunk cost forever and I think a
lot of organizations they haven't
figured that out yet yeah and I think
that's the positive right um Jared
talked about the updates right I know my
team when there updates we go in what's
changing right so remember you can't
just stop like we we've solved the
attack coverage like cool always Chang
so Blake Brad other use cases you've
seen or you you've applied
yourself um so I'll talk about not
necessarily use case for attack but the
uh process of building attack and sort
of like the the foundations of the
framework I thought was really cool uh
was Amit that was presented a few years
ago where it was they applied the attack
sort of like methodology to
misinformation and disinformation I
thought that was actually a really cool
use case of attack Concepts but not
necessarily the attack
so yeah expanding it to different
domains really cool use case I agree I
was mention Amit yeah as long as people
don't like go off and you know build
attack for washing machines
like hey if adversaries are hacking iot
washing machines yeah right Never Say
Never in the next 10y year panel maybe
maybe we'll come back to that comment Y
prove me wrong yeah I think for me I
kind of already mentioned it I think the
training aspect um was really uh eye
opening to see the value that it could
have both on the offensive side and the
defensive side being able to train the
offensive operators and giving them
ideas uh I found myself even just
reminding myself of things because
there's so much information and you kind
of maybe you're stuck somewhere and
you're like what's another way I could
do this and then you're like oh yeah
that's right uh because you you forget
some of the techniques you you know but
you know it just reminds you that's
right I could do that for C2 or
something that'd be let let me try that
here or whatever so I think um even as a
seasoned operator it's still a tool just
to jog your memory on some things that
you know you have very deep down but you
just need that little reminder so I
think as as a training tool and just as
a reference um on either side still very
powerful so none of you have every
technique memorized no nope working on
it though they'll be quiz we started
with 64 so back in the day it's grown a
little bit when we started I was pretty
good with all of them but no I've got no
I've no chance now yeah remember I used
to talk to some people and they would
like spit technique IDs at me like I'd
memorize them like no talk technique
names yeah we do not have any of the IDS
memorized if you try and speak that we
were doing that Ross started doing that
as a joke last night and um yeah we
don't know yeah IDs are for machines y
technique names are for
humans um so reflecting back 10 years
later curious if there's anything that
looking back you would do differently
you'd be like hey 10 year ago ER Blake
Jen Brad maybe do something different
anything that comes to mind Blake uh sub
techniques that should have come a lot
sooner and like I'll point out Ross back
there but there was a uh a project that
we called a attack stack you remember
that uh sounds like a burger yeah it was
sort of like a burger yeah but it was
like the foundations of the ideas that
led to sub techniques but yeah it was
like it started and then it sort of like
couldn't get off the ground a little bit
and then a couple years later we came
back and and did sub techniques but yeah
that should have happened a lot sooner
were there any cautions on sub
techniques anyone who felt like when you
heard about that like I don't know yeah
I mean I'll admit I wasn't keen on it
because I I I was worried about the
bloat Factor right you know you think
sub techniques I'm thinking many
thousands of techniques coming out and
and it was a risk but I think it's
worked out so so the the teams credit
both you know Blake and and Adam and
others it's a it's been an effective
tool I wasn't even responsible for it I
was gone at that that point but I was
feeling the stress of having to
logistically organize that so I think
they did a good job but I was like what
is that even going to look like you know
it turns into this like linear equation
you know 3D Matrix type uh you know
linear algebra type problem and I
couldn't see it visually so uh yeah it
was interesting to see how they were
able to do that and now they got three
little blue eyes face it' be hard to go
on a spreadsheet with the I know a
spreadsheet just doesn't work
yeah I it was fun I got to be part of
like the initial discussions right of
miter like oh should we do this and I
was like definitely makes sense and then
I left and went to Red Canary and uh was
released and they're like hey Katie you
came from the attack team do you want to
like lead the uh sub technique remapping
and yeah there there were definitely
some days I think I kind of swore at us
but he past you uh make the best
decision we can at the time and it was a
lot but I don't know I feel even though
it was painful I think it was the right
choice so yeah I know I had to fight
through a lot of like dissenting
opinions on if it was worthwhile to do
that but I think it was so you come to a
consensus that's how you make things
better disagree and then uh figure it
out move
forward um so one interesting thing you
know Jen kind of talked about it a
little bit with some being someone being
like it's an honor to meet you um
something that I feel like we don't talk
about enough is how has attack affected
each of you personally um I can say
right from my perspective right I was
working in government socks I'm like
thanks for emailing me Blake really
appreciate that um and I was like oh you
know get my feet wet like the trajectory
of my entire career and my entire life
changed because of this framework right
like I think I'd probably still be
hiding in government socks never would
have done a talk never would teach for
Sans never would have met you all right
and so I'm just curious to hear any your
Reflections on you know how how has
attack affected you personally yeah
definitely the career trajectory
definitely felt that um but I I've said
this to a couple of people privately but
I'll say it to everyone here like attack
is the best and worst thing that ever
happened to me and I'll explain why uh
so throughout like my childhood career
I've had to deal with anxiety and I
didn't realize it was a problem and
attack was really sort of the Catalyst
that forced me to deal with this um and
throughout like a couple of years I was
doing presentations like three four
times a week uh for months on end and it
was torture it was absolute torture and
it actually wasn't until the first uh
attack on where Jen was sort of openly
describing some of her experiences with
anxiety that actually kicked me to
actually get some help about it and you
know like a lot of us are introverts a
lot of us have to deal with the stress
of of public speaking and and things
like that but it was like affecting my
life uh pretty significantly and so I'm
super glad that you were open to help me
about that and I'm sharing my
experiences with it in case it helps
anyone out else out there yeah I think
for me I got a a real appreciation for
Frameworks like this uh as you know I've
kind of moved around through my career
and I'm kind of on the defensive side
now uh and I find myself looking for
Frameworks that fit the work I'm doing
even if it's not strictly attack if that
doesn't always make sense for what I'm
doing I find myself looking for
something to lean on that's similar
because I see the value of that
communicate the ability to communicate
through that and kind of normalize
around that um so I think that's been
one thing I've really noticed is uh
seeing the power of having that type of
tool and then and then leveraging that
in anything I'm working on looking for
that or if it's not there thinking about
how would we create it who would be the
right person to create maintain it so
realize the challenges of that um and
and trying to partner on those types of
things so I think I think that's
probably not exactly quite the answer uh
maybe we would think to get here but for
me that's one thing that settled on on
my mind mind about this experience and
seeing the value of it within the
community love that look for
opportunities for Frameworks in your
life good good takeway yeah I'm um kind
of similar to Blake actually in the in
the best and worst scenario because it
definitely so I went when I went from
here to unit 42 at at
poo um as that grew a big component was
actually education and that involved
speaking to customers going to
conferences and speaking to people and I
had done that literally since before I
could drink alcohol because I joined the
military young um and I had severe
basically anxiety the entire
time I would turn 12 different colors
and I'm I'm pale right so I turn colors
easily anyway
um and I'd turn red and I get really
blotchy and my voice would shake and
it didn't matter how confident I
actually felt I would just that would
always happen and then the more that
happens the worse it is because to
Blake's Point like as an introvert who
had that having to stand up in front of
people was like the ninth layer of hell
for me um and here you are I know it's
so weirdest thing now people like you're
an introvert you're you're so
extroverted no no I'm not I have done so
much therapy and I take medication for
it I actually am currently I have a
assistance dog that's being trained to
be a service dog and I've actually been
here and I didn't bring him because this
would have been like he would have had a
great time but this would not have been
a positive training experience for him
because he right now he'd be giggling
and like oh all the people um but I
being here I recognized oh I wish he was
ready like further along because there
are times being here um especially
postco so covid as an introvert was like
the best time ever I was like I don't
have to leave the house and no one's
going to try and actually force me to
leave the house or think there's
something wrong with me or be like think
it was weird I was just like all right
this is gonna be fun I can literally not
leave the house for like month a month
at a time or longer and I am perfectly
happy fine delivery is
great and that actually made it worse
than coming back to it I remember I was
at RSA the first time I did like a
massive in-person conference event and I
went to one event afterwards and I was
there for about an hour and then it kept
getting increasingly more people were
there and I finally got to being packed
like typical usual like total Crush
standy remoy everyone's on top of each
other like you have to fight your way
through we're all standing like this
with our drink like please no one spill
it on me and I could feel a panic attack
coming up I was like I can't there's too
many people they're too close everyone's
here and I had to like get out and leave
and I was fine
but I was just like oh I need like the
introvert reintroduction to society like
10 step plan yeah because I got so back
in my comfort zone and so used to it and
even doing things on video yeah not at
all the same so much easier and doing go
being in person and just having people
be that close I couldn't I just couldn't
yeah and it was it was weird like I'm
kind of back to my normal self now yeah
but yeah and the attack component almost
yeah forced me to do it but it wasn't
until I was comfortable talking about it
and that's why I talk about it because
so many of us face it yeah and I didn't
do anything about it for so long because
you always feel like there's something
wrong with you there's nothing wrong
with you and thank you so much both of
you for sharing that mental health is
Health glad glad we have that
conversation and yeah thinking about how
attack has impacted people's lives like
improving mental health like what a
great impact right like Eric love to
hear from you how has attack shaped your
mental health your framework perspective
anything yeah so I I guess I I left
before it became public so the you know
from the Stress and Anxiety side I I
left out maybe from that perspective I
definitely feel some of the anxiety
pains but didn't didn't have to suffer
that um I guess you know from the the
the other side of it though you know I I
think it really opened my eyes to the
ability of a community or a group to be
able to come together and and come up
with different ideas right you know
coming from that red team background we
we always sort of made assumptions like
we were saying earlier and then you know
being able to include Blake and Jen and
sort of come up with different ideas and
see different approaches to things was
really you know eye openening um you
know 13 years of red teaming you sort of
get stuck in way yeah um and and I think
it's been really useful to continue that
forward now where you know that
collaboration is so important so on that
note we'll do one rapid fire and then
I'll ask you all take a question or two
from the audience so 10 years from now
we all come back on this stage a little
grayer our backs hurt a little more but
what's your hope for the next 10 years
of attack just briefly Go Right Down the
Line in the flake uh I hope that it
continues um like when Todd Whit bols
you know early on in the days of an
attack he said this is going to be the
thing that merer has known for for a
long time I didn't believe him then but
I I think he was right continuing goad
I'm goingon to go continuing as well
Community contribution I know I
mentioned that earlier but uh continuing
um I really hope Miner continues to pour
into it but then also the that the
community continues to grow it um I
didn't get a chance to to mention it but
I I think the growth into adding things
for like Linux and Mac uh industrial
Control Systems mobile um you know those
types of areas I think we need to
continue to grow that we need to
continue to get um the experiences that
people are seeing out there because
everyone has a different lens in their
work role uh and get those captured so
we can talk about those and communicate
that so um continuing but specifically
with a strong Community involvement uh
continue would be my hope for yeah the
same I hope and actually hope more
people adopt it and start sharing and it
in some ways forces their quality
control to match what might are enforces
I think that'll be good yeah I can't
really add too much to that right just
seeing it continue on be adopted by more
of the community um and and keeping it
controlled such that it's still usable
10 years from now
it's all we can hope for awesome well
with two minutes left I'll do a single
question who's got one I got a brave
hand I'll repeat it Gentlemen The Beard
um so one of the you
guys talkinging frame to educate other
analysts um one of the things that it
sounds like you said was picking a
couple of started learning how to
protect it but one of the things I'm
most terrified about is mid incident I
don't know what I don't know
what is a good way to leverage the
framework with the information I have in
front of me figure out what it is
interesting so repeating the question
talking about attack as an educational
tool what's a good way you know it's
kind of intimidating to kind of use
attack right uh you know in an
educational way diving into it any
thoughts on that one yeah I mean for me
I think that's where we kind of saw that
angle was when we were having those
conversations either mid incident
hopefully red team not actual incident
but you know you can't control that part
of it uh but mid incident I think you
probably have maybe some senior analysts
that have more experience on some of
them so partnering senior analysts or
maybe if you don't using that attack
framework to look at what were other
attacks that have happened you know
using the threat intelligence data which
is which is why it was so key to add
that element in reviewing that threat
intelligence data looking at those
reports seeing how it played out what
happened where did they go from there
and then trying to understand all you
know how that attack happens in all the
reference data there there was some
mention Adam mentioned um you know
needing to maybe refresh in but the
Cyber an uh the yeah car the analytics
uh repository stuff as well um and and
trying to find out you know jump
starting how you can use a tooling you
have to uh hunt those types of things
down uh there were some great talks
already about you know which things are
really detectable and which aren't so I
think you know kind of harnessing those
elements uh so even if you can't solve
it in that moment getting better and
preparing for it um for the next time
around uh and showing that growth out of
the incident and having some positive
out of the incident I think would be a
good way yeah I think red teaming and an
atomic red team and other things like
that even trying to emulate some of the
threats to see what they look like is a
good way to train yourself as well to
yeah I think understanding like how an
attacker would chain the techniques
together into a sequence because you
might miss one part of it because maybe
there's a new technique or something but
you'll find something else and you can
relate it to whatever you're missing
through like the same process or the
same user account that was compromised
and you can look at the activity that
way to to figure out what was missing
absolutely and collaborate find some
other people that have a different
Viewpoint or skill set than yours or if
you can find someone elsewhere in the
community and reach out and just ask
that's honestly how we did it ask learn
collaborate right great note to end on
so with that please join me in thanking
our panelists Eric Jen Brad and
[Applause]
Blake