welcome everyone
appreciate you staying late on a
Thursday this far into the con great to
see familiar faces out there just a
little bit about me so my name is Ryan
Burnett I'm the director sack ops over
at Pluralsight I've been at Pluralsight
a couple years now a little bit about my
experience I did seven years as a DoD
contractor doing an IT networking
security for the Air Force and then
spent five years redeeming myself after
working for a company that kills people
working in healthcare for five years and
then the past seven years I've been
working here in Utah around silicon
slopes building security programs a lot
of startups and companies here so this
isn't my first rodeo I've done this
security thing quite a few times so
that's a little bit about me some of my
hobbies are my family I guess that's a
hobby my kids keep me busy I like to
listen to and make music I like to sing
play instruments I like to watch Netflix
and chill like really watch Netflix and
chill I like to watch documentaries on
Netflix and other streaming services and
then I like to read when I can and then
I really like video games I'm an
old-time gamer starting out with command
& Conquer moved up to some other
first-person shooters and realized that
I suck really bad and went back to RTS
and strategy games and then in my spare
time when I when I can I like to
macGruber some bash scripts together
I like bash because it's already on the
machines you don't have to install stuff
to get it work and it just it works so
bash is my scripting language of choice
first of all I want to start give some
credit
I attended a blackhat training this year
first time ever going to blackhat the
training I attended was an active
defense training given by Black Hills
Information Security John strand
excellent instructor I can't recommend
it highly enough but I learned a lot of
these concepts and things I'll be
talking about today added a little flare
of my own to it with my own experience
but definitely want to give a shout out
to them and these awesome people that
put this together so those that know me
will know that sometimes I don't have a
filter and sometimes some some swear
words might come into my talk so these
are the Utah County swear words that
might slip in to my talk today so I
apologize ahead ahead of time I was told
I have to actually say these like a yute
on so if I say fat you're fetching or
fetcher or flip or flipping freak or
Frick crap she is just ola shut the
front door and then what the farm farm
that's one of my favorites to say and
chappy it basically means bozo right
means bozo to me nobody else okay
so I've heard dark mode is all the rage
right now so let's go ahead and flip
over to dark mode so this is what you're
all here to see if you can't tell I've
got some Harry Potter theme going on
here with the Defense Against the Dark
Arts I like Harry Potter I'm not a huge
fan but I like it enough to glean some
security information from watching the
movies I don't know if you've ever
watched the movies and put a security
lens on it but you can learn a lot from
Harry in the game but let's dive into
I'm gonna be talking a lot about blue
team's what we have to do is a blue team
is a defender a lot of our struggles
that we deal with and then yeah let's
have fun
so being on a blue team as a defender
hopefully you got some blue teamers here
do you ever feel this way do you ever
feel like you're picked on like please
don't hurt me you get an Assessor a red
team that comes in and just hones your
shoes they just come in and own
everything you're just like guys come on
please don't hurt me or maybe as a blue
team or you're just panicking inside all
the time you've got that inner voice
that just or sticking with a Harry
Potter theme as a blue team er I feel
like we do need to practice the dark
arts we need to understand them now we
can't use them that's illegal
but we need to understand their tactics
but sometimes maybe as a blue team ring
you may think that the job is jinxed a
little bit that you can't really win
sometimes like this guy ended up with
his memory wiped this guy's dead this
guy's dead he resigned and then later
died and then he's dead and she's in
prison so as I was watching the movies
and I'm looking at these Defense Against
the Dark Arts teachers I'm like man
that's a bad rap that stinks maybe as a
blue teamers sometimes you're just
totally terrified to where you can't
even move you're scared stiff Petrificus
Totalus
but there are all kinds of courage it
takes a great deal of bravery to stand
up to our enemies but just as much to
stand up to our friends do you remember
Neville's standing up to Harry Hermione
and Ron and they they politely freeze
him he's wearing blue pajamas by the way
blue team he's trying to defend but
sometimes as a blue team er we have to
stand up to our friends that could be
the IT team that could be our executives
our users and we have to stand up and be
like no that's not what we need you to
be doing
so speaking of Neville this is Neville
now he's looking great right way to go
Neville right so we need to get some of
that Neville confidence
okay he's looking good so let's let's be
like Neville Longbottom let's have some
bravery some confidence
let's make blue team's great again okay
I can't do a can't do a good impression
but this isn't a political talk it's not
but I just love this picture of Trump he
really took the time to put a mini gun
in his hand and amigo let's make blue
team's great again let's get some
confidence behind us one problem that
we're seeing is what I like to call
Siegel security like you give an
assessment an auditor or a red team and
they come in just like a seagull and
they swoop in
they come in they make a lot of noise
they shizz all over everything
and then they fly away and they don't
have to deal with the aftermath of the
assessment or trying to fix it or take
you the next 12 months
two years trying to put a program in
place it'll address all the things that
they found right pretty sweet gig if you
ask me so I love our teams we need red
teams I have a lot of red team friends
but this style of coming in as a red
team it's just it's not helpful right we
we need a better way so what can we do
when we face off against our enemy what
can we do when it's either a real
attacker or red team or an Assessor
coming in first of all let's make their
jobs harder let's not make it easy on
them okay they come in they break stuff
they fly away well let's make it hard
let's make them cry tears of frustration
when they stumble on our networks okay
so I don't know if any of you guys have
ever jumped hurdles let's put a lot of
hurdles in for them to jump over there's
a reason there's not a 1600 meter hurdle
in track and field
because hurdles suck and they're really
hard and he get tired real quick and
that's what we want we want these red
teamers these Assessors these attackers
to get tired and move on to the next guy
that's the whole point in this talk
there's not one thing in here that is a
silver bullet that's gonna protect you
you have to do all these things that
we're just trying to wear them down okay
so whenever we talk about do an active
defense it always comes up the hacking
back right now currently hacking back is
illegal there's actually a law being
pushed through the house right now a
bill that's been there a couple years or
trying to push it through well it would
allow people to hack back if they're
under attack okay but currently right
now in our political landscape it is
illegal to hack back so don't I'm not
gonna talk about it too much but that is
an option but believe it or not
criminals they have rights too you're
not allowed to hack back and remember it
could be it could be grandma Ellen's
computer that the attackers use them to
hit you so you're really just hurting
grandma Ellen okay
back in the old days with prospectors
they would put in the 1840s and Gold
Rush
they put shotguns in sheds and someone
came into the shed open still their gold
and kill them or maim them right that's
illegal you can't do that you can't put
shotguns behind doors and it's it's
indiscriminate
is the problem there anybody that opens
that door and if it's a fireman and the
sheds on fire and they come in to put it
out they get shot in the face with
buckshot that's not okay so that kind of
stuff that mentality of well they did it
to me I'm gonna do to them that's not
okay all right
so legal legal things aside let's talk
about where is the line so things are
illegal and things are legal to do what
can we do so we're gonna draw the line
or in the middle here of running
commands on the attackers machine if
you're running commands on their machine
you're pretty much over the line you're
on that illegal side I'm not gonna say
you're all the way to the red but you're
pushing it so let's stay a little bit
off of that line and let's do things
that are being used right now by
marketing departments
they do things like use trackers and
they put pixels on things and they track
and get geolocation and they have all
these data elements and points about you
and they know exactly who you are so
let's start using those tactics and find
out who's attacking us let's get a
little bit of attribution it's really
hard to get like definite attribution
but if we know who is attacking us then
we can prepare our defenses accordingly
okay so first thing let's get our
shields up remember they put that shield
around Hogwarts let's get our shields up
there's some things that we have to do
that are prerequisite number one thing
that I want to talk about is just taking
back the desktop you got to know what's
on your network you got to know what
devices are there what software is
running you you have to have a hardware
and software inventory if you look at
the CIS controls the first 20 questions
are about inventory okay so know what's
on your network know where your critical
data is on your network okay if I came
to you and said where's your critical
data you might be able to point me a few
servers but what about your corporate
data your each our data your legal data
all your customer data you've got to
know where that is also you got to
control your endpoints there's a reason
that users are call users and not called
admins admins have been rights users
have used your rights
I don't give your users admin rights if
you can help it now I know there's gonna
be exceptions there's times you got to
and they got to install the thing and do
the other thing and also it's the
culture and nobody wants to upset people
but let the users run at a user level
and then elevate when they need to
install stuff or change things or
configuration or you're devs need to do
stuff like let them elevate up there and
then go back down so day to day they're
running as user ok that's huge
I've been seeing a lot of trends where
we just hand a laptop to people and say
good luck
call me if it breaks
and that doesn't work out too well also
we need to turn on monitoring and do a
central law collection how many of you
actually collect logs on your in points
a few good for you how do you do it with
your remote employees a little harder
right there on the internet the road
warriors how do you get those logs those
security logs that we care about that we
can tell somebody's on their box how do
we get those back in or sim warning
banners Terms of Use policies you have
to have policy if you don't have
policies you have no teeth like people
are just not gonna listen to you and
when they break the policy that's not
written down you have nothing to do you
you have no recourse okay
so you have to have policies you got to
get your house in order you got to patch
your systems this seems basic but it's
not happening and we're we're not doing
it soon enough a lot of these
vulnerabilities that we're seeing are
because of people not patching their
systems we see these giant breaches
because people aren't patching are you
scanning your web apps are you scanning
your os's
on your network all of them endpoint
servers are you doing authenticated
scans probably not maybe are you
scanning for third-party applications
office adobe flash that shouldn't be out
there other things but you got to know
where your data is got to be able to
protect they also treat your internal
network as hostile there's this concept
of zero trust your users if you hand
them a laptop and they're using it for
Minecraft and World of Warcraft and who
knows what or their kids are using here
their husband's using it or their wife
we don't know what they're putting on
there so we got to treat them as hostile
segmentation some people think the
segmentation means oh ten dot X is over
here and the ten dot Y is over here
that's not segmentation that's
subnetting segmentation is ackles
actually having blocks so the computer
at one end of your company can't talk to
a computer the other end of the company
or one end of the stay the other end of
the state actually having things in the
middle the
bakit a lot of people have flat networks
I've seen him there flat as can be and
they're like we have submitting we're
good
no ackles firewalls VLANs
also this helps if you do get attacked
or when you do get breached it protects
you and it makes the blast radius the
cleanup and containment and all that
much smaller okay so when people argue
about against segmentation say it's
going to help us when we get breached
the blast radius okay and then lastly
like just expect to be breached
anything less nowadays is just denial
it's happening left and right just with
all of the we could have supply chain
vectors people putting chips on things
that we didn't know we were there you
just just expect it right all right
let's talk for a minute about a little
formula that I learned so this formula
is the detection time plus the reaction
time must be less than the attackers
time to their goal for you to win okay
if it's less if it's greater than if it
takes you longer to detect or to react
to that attacker you're gonna fail so
we're all about making them take longer
with active defense where we're trying
to make them take longer to reach their
goal that's the whole point we probably
won't stop them if they're motivated or
a nation-state but most people we can
stop them and make it take longer right
don't make it easy on them so son two
philosophers said that all boy warfare
or cyber warfare is based on deception
hence when we are unable to attack we
must seem unable when we using our
forces we must appear inactive when
we're near we must make the enemy
believe we are far away and one far away
with make them believe that we are near
ok these tactics ease warfare tactics
they apply to what we're seeing today in
our war our battle so if you cannot
detect an insider on your network your
network is not so
the days of having a great perimeter and
that's all you need those days are gone
because they hop on a VPN and they're
writing your network or they get
credentials and they're right into the
cloud where all your data is ok so
having a perimeter just doesn't cut it
anymore
we still need a perimeter don't get rid
of your brood still need them but we got
to be able to tech insiders most
attackers do not practice any kind of
defense they're the they're the predator
you're word of the prey ok so they are
coming after us and they're gonna use
the same tools that we use on our
network because they want to get to the
things on our network they're gonna use
Windows or they're gonna use ActiveX or
JavaScript or whatever our site is that
they're trying to exploit they need to
run those ok so they have to turn turn
off antivirus they have to get rid of
tools also Security's hard they're lazy
they don't want to deal with that so
just know that a lot of these attackers
that are hitting us they don't have any
security ok all right
there's a concept inactive vents of
poison versus venom so poison is
something that has to be ingested it has
to be it's something that you can like
sit on the shelf it's passive it can be
deadly or have nasty consequences when
you ingest poison but they have to take
it and ingest it ok think of like the
Mandrake poison potion or the drought of
living death from Harry Potter
then on the venom side these are the 3
of 4 Google unforgivable curses that
they talk about in order for these
curses to work you had to have malice
otherwise you just kind of screwed
people up but so they're active you're
attacking they're deadly right there's
malice buying it like they did it to me
I'm gonna do it I'm attacked back that's
not what we're talking about we're not
talking about venom we're gonna talk
about poison ok so what are some things
that we can do to poison our network
against attackers we want them to take
their ball and go home we want hurdles
ok so let's take some concepts from the
military and warfare
and things like deception subterfuge
misinformation how do we make it
confusing when they get on our network
okay how do we set up traps decoys how
do we use camouflage or smoke screens to
our advantage
maybe mines our claymores guy be careful
I want to blow your own fingers off
those so maybe we set up on our network
we put pointers directing them where to
go breadcrumbs a little trail of files
or accounts or things that maybe we even
open doors for them as they come in
they'll just naturally go this way
they're gonna follow these signposts hey
but what if we could actually make them
move to where we wanted to go what if we
could be like these staircases in Harry
Potter where oh you thought you're going
over there but now you're going over
here you start scanning my box now I'm
gonna move you to this subnet and you're
locked in over here and you have access
to hardly anything right start thinking
about these kind of concepts also traps
if you were gonna walk through a
minefield how differently would you
behave as an attacker if you need to get
to that target you got to go through a
minefield you're gonna be a lot more
deliberate a lot more careful you're
slow them down okay
it's that detection time and the that we
got to get to the our goal before they
get to theirs
okay so smoke screens maybe a little
more effective than that but the
military uses smoke when they want to
move when they want to move they use it
offensively and defensively
it could also be used to signal for
exfiltration or a target they throw
smoke out there so we need to use smoke
to kind of hide what we're really doing
what if you're slack or your email is
part of the compromised and the
attackers are watching everything you're
saying about the incident in your slack
your email right do you have an
out-of-band method to communicate think
about how we can hide what we're trying
to do from the attackers
and segmentation works great for this
kind of stuff also security through
obscurity this one this one I used to
look at this and be like yeah secure you
through obscurity that's stupid that
doesn't work actually it's very
effective it's slowing them down
think about Where's Waldo okay if you
had to pick a server out of the hundred
servers that look like garbage it's
gonna be a lot harder to do security
through obscurity can work to slow them
down it cannot be the only thing you do
you got to do all the other things okay
but it can be effective if you're a red
teamer and you come into a network that
it just looks like garbage you're gonna
cry you're gonna you're gonna cry lots
of tears and those tears from red
teamers make the finest wine okay that's
a quote directly from John strand so so
if we can use subterfuge and
misinformation what if we put things
like when you're doing OSINT when you're
doing recon on a company one of the
first places you do is you go to google
type of the company do who is doing
LinkedIn start looking LinkedIn is rife
with information like we got people to
put hey I'm a sysadmin over at such a
such company and I know Active Directory
and I know exchange and I know oh 365
and and now you know all the technology
that they use at that company so if you
ever thought about putting some fake
profiles out on LinkedIn first this
admin or an intern that doesn't know
better put some fake information
misinformation out there
fake DNS entries to interesting servers
put those on your network try to get
people to go off down a rabbit hole and
waste their time okay don't make it easy
so if I give you a list of servers can
you find which ones are critical just by
looking at the names and I've seen these
in my career people name their servers
UT fen serve zero one
Jenkins 5 - when I can learn a lot just
by looking at the hosts
of a box right first ones a finance
server in Utah one of many it's a one
that must have a no to right app servers
running 2016 are two web server running
Debian Marketing tableau oh four it's a
cluster right Utah firewall of one main
firewall they probably have more than
one a pack VPN oh three asia-pacific see
how much information you can get just
from the name and where your targets are
so why do we do this why do we name our
things why don't we use things like use
planets name your server Centauri your
use Bill and Ted references call it
Rufus as your file server or Snoopy or
red five I don't know pick some sci-fi
thing that all the geeks know and they
know which server it is they log into
Snoopy every day right but let's not
make it easy on attackers okay a couple
of things there's a product I'm gonna
get into a few little tools here they
use sis Mon this is by sysinternals and
sysinternals gobble up by Microsoft and
everybody thought they were gonna go the
way the dodo but they left him alone for
the most part sysinternals has been a
great batch of tools there's one called
system on if you're not using this on
your windows service please go check it
out but it lets you do all sorts of
monitoring of network connections
processes kick it out to logs and then
snarf those up in your sim another tool
it's called app Locker
it's crazy effective it comes as part of
Windows and basically it's a GPO that
you turn on and you can do it by file
path you can do it by a program name you
can do it by md5 hash to whitelist or
blacklist applications from earning on
on your servers a couple of things in
your laughs why don't you create a rule
that just automatically brought blocks
nikto or a kinetics or burp why why do
you need to allow those things to come
in through your laughs just block them
and watch them cry and cry
about why they can't connect you're like
they don't think about this stuff they
don't think to change the agents train
they just use the defaults and they go
right through here's a little script
written in bash of course where
basically I call scan to ban but if you
run the script in a screen it will sit
there and listen on your network
connection and anything sent to port you
make it whatever anything sent to port
because I'm likely added to a block list
n IP tables you want to watch a red tree
the red team cry themselves to sleep at
night start blocking them whenever they
scan you just turn this on okay now take
this script use it if you want to make
it cool like add some logic in there to
say okay well I don't just want one port
let's say if they hit ten port sort of
50 ports or whatever then Adam or let's
only run it at a certain time or just go
crazy add it is a as a cron job or a
screen maybe even go in and make it so
your necess canner doesn't trigger this
you don't want to lock yourself out but
think about the things that we can do to
make their lives miserable
okay also honey pots there's some good
ones out there kippo is now called
calorie or car I heard it pronounced
both ways but this is a really good
honey pot you can run it in a docker you
can get people to connect in the smart
ones will learn pretty quick that
they're in a honey pot but now by now
they've very triggered right you're you
should be monitoring your honey pots
don't just set them out there like
actually have them send logs and alerts
back to your sim if you don't have a sim
use email something one cool thing is
that they stay logged in they have even
after they think they've left on some of
these script kiddies that don't know
better they think they've logged out but
they're not really logged out you can
sit there and watch them try and connect
other servers and now you can see what
what else might be compromised on your
network they're trying to get to right
it's really good
honey tokens there's an open
source tool called open canary this is
exactly the same as the thing store
thinkest canary that you can buy for
lots of money but they have an
open-source version just doesn't have a
GUI but it has all the infrastructure in
sprinkle canary tokens throughout your
network set these up these things will
Beacon Hill tell you when things it's
it's also great for DLP and attribution
at least tell you that something's gone
it's a little alarm bell that goes off
okay honey accounts this one's free and
easy and cheap go into active directory
create some accounts to have access to
zip to nada
even go in and turn their logon hours to
nothing never and leave them there and
then go into your Sam and say if fred
flintstone ever gets logged in to send
me an alert an even an attempted login
all right this is easy cheap it might be
the warning that you need that someone's
on your network and trying to do a spray
and pray password spraying across the
network also honey records you could put
these in a database set up alerting on
them you can even set up a stored
procedure that alerts when an record
gets accessed another tool i want to
mention is called honey badger so a few
years ago google gotten a lot of hot
water because they were running around
with her google vans or street view and
they were snarf enough SSIDs
and everybody was freaking out okay
so google said okay fine we'll stop we
won't do it anymore well guess what they
don't need vans anymore because
everybody carries one of these in their
pocket and these things when you turn on
device location and tracking they phone
home tell google where you're at and
here are the SS ids all around me okay
so as we're sitting here in this
conference your phones are pinging back
to google saying there's a saint con
network and they know the geolocation of
where that saint con network is don't
use a Google phone it does it on Apple -
it's not just Google it's everybody
everybody's doing this marketers love
this stuff they want to know where
everybody is at all times and who you
are
what age and demographic everything
about you so they can market you okay
they're using these technologies to
market well let's use these technologies
to track people and get attribution so
the honey badger is really cool because
if you have a Google API you can just go
sign up on Google and get access to the
API and it will give you within a three
meter radius of where someone is okay
especially if you've got tokens hooked
up as well this one's kind of fun so in
Microsoft world you can create
directories that link to themselves so
if you want to really mess with der
Buster there's some of these other tools
that are crawlers through an OS just
make a directory that recursively points
back to itself then another one that
points to that and they will just get in
a loop and a lot of times these guys
just they just run a little tool and
they they're like yeah it's gonna take
eight hours I'm gonna hit the hay and
they come back and they're just sitting
there in a loop and they haven't even
noticed anything okay
be careful with this it could break your
AV but one thing I would love Dustin to
know about ransomware I'm assuming when
you get ransomware on your machine it
either starts at the beginning their end
of the drive and it starts encrypting if
it hits this directory and tries to
encrypt it might stop it right someone
test that for me so um we had a website
pop up that somebody basically went out
to our website scraped the whole thing
and stood up a new domain and through
our website up there and it looked just
like ours I had the logo had everything
they even hotlinked the images from our
server for theirs so they don't have to
host them right so what you could do
with this is you could make an image or
even a pixel and hide it that's on your
box and somebody copies your site puts
it up over here you get a little alert
hey that's not coming from your dome
somebody just cloned your site and maybe
you've got an active spearfishing
campaign going against you now a little
bit Intel
so speaking of threat Intel um a lot of
people want to sell you threat Intel and
they'll charge you oh man I've heard up
in the hundreds of thousands of dollars
for their threat feeds and IP reputation
and theirs is the best and they got all
these sensors around the world well
that's all fun and good but that's not
directed at you
those aren't direct threats at you so
the best thing to do is get your own
threat Intel okay a lot of these lists
they're stale they've been out there for
years they don't keep it up-to-date they
don't share because they want to sell it
for lots of lots of money so if you're
getting if you set up an infrastructure
where you are getting your own threat
Intel out from the wild wild west called
dub-dub-dub
you can now use that information of
people actually attacking you and you
can block real threats against your
environment what if you set up a threat
Intel environment like this where your
public out on the Internet is your dev
and that's where people are attacking
you're getting all this information and
this threat Intel and you pipe that over
and feed it into your actual prod threat
Intel system okay use the internet as
like your testing ground and then go put
that data to use and make sure that
there's nothing calling out those IPS
from your own infrastructure okay so
let's talk a little bit about some of
the blue team pain points that we have
so visibility and transparency so a lot
of times blue teams are info SEC teams
they'll get buried in an organization it
can be really hard when you don't have
that transparency at the board level or
the exact level but Information Security
is a boardroom discussion if it's not
happening at the board level you're not
going to get the resources that you need
okay so where the info SEC org sits in
an organization can make a huge
difference if you're buried under some
some department that is responsible for
implementing all the controls that
you're trying to do and you're sitting
under your peers with the IT team or
with the ops team and you're trying to
get them to do things it's really easy
for that manager to be like yeah you
know what we got infrastructure to deal
with we got features to release we got
to do lights on like yeah we're on time
for this security stuff now if you're in
another department and then it trickles
up to that board level exact level then
they can start having discussions at
that level about what they need to do
it's too easy for one person one leader
to just stifle that message that it
doesn't trickle up you need that
transparency so I've seen InfoSec about
50% of InfoSec departments report to the
CIO that's industry standard about 35%
report to the CEO and then 15% about
report to other another could be a CEO
or general counsel but take a hard look
at where InfoSec sits in your org and
whether it's working it might it might
work for you and that may depend on the
personalities of the people involved on
the teams the leaders but if you're not
getting anywhere take a hard look at
where you sit and made me make a play to
move to another org
also to help you get resources a lot of
times if you report up through a CIO
through a CFO well guess what the CFO he
cares about money and he's gonna say
well that costs too much and he's just
gonna axe it right right from the get-go
you don't even get to have the
discussions and then also security is
everyone's responsibility so naturally
everybody has an opinion about security
and when you have an opinion verse in an
opinion whoever's the stronger
personality is gonna win if you take
data with your opinion you will win okay
so make sure we have that data so how do
I get budget how do I get my execs
attention and the way we should we
report so first of all avoid FUD a good
good amount of FUD can be helpful but
avoid like being Chicken Little all the
time
and InfoSec it can it can backfire and
then they start to just view use the
crazy man that always paranoid about
everything plan ahead if you're not able
to get the resources right now if you're
not able to get the money and the people
make a plan so when a crisis happens or
a breach or an incident and they're like
oh man what should we do about that you
could say actually in my back pocket
right here I've got a whole plan on how
we can implement XYZ okay so you got to
be prepared because those opportunities
will come be ready jump on it actually
shows a lot of professional
professionalism if you're ready to do
that and then also with the with the
risk with the opinion versus data
there's something that we implemented
called risk scores so executives they
know the language of business they know
the language of risk they don't know
InfoSec language they don't know IT
language so we need to learn their
language they're not gonna learn ours we
need to learn there's and then also we
need to train to not train them up so on
the risk score front one thing we did
was we boiled it down to three bubbles
that they could wrap their head around
and we went from one to a hundred and
said hey this is our business risk this
is our product risk and this is our
privacy risk and your your bubbles might
might be different but give them a score
that they can look at and it's a little
bit more complicated than a stoplight
chart but give them something to look at
to say oh that numbers going up but that
numbers going down right give them
something that'll help them because they
understand risk they deal with it all
the time business risk okay so use
something like that to talk to them also
another thing that worked really well
for us was we do Incident Response
training for the executives if you have
an IR plan or an IR procedure you should
be practicing that at least a couple
times a year I'd say quarterly if you
can get in with your execs and play
Dungeons & Dragons okay and take in a
20-sided
and some little figurines and nerd out
with them for a little bit and put up a
scenario walk them through it you're the
dungeon master they're rolling the dice
they can have fun and they can learn and
you know practice your IR all at the
same time it's really cool one thing we
did is we said okay if you roll one
through ten you failed if you roll
eleven through twenty you succeeded on
that action whatever that was
now if someone's been dot if it's been
documented somewhere in a policy or a
procedure here plus five automatically
boom if somebody's been trained on it
plus three boom so they could get a plus
eight on every roll now every so often
because I'm the dungeon master I can say
when I'm minus nine okay because there's
some things you want to move the
scenario along you don't want them to
just win every time okay another another
thing about that we've tried for
educating our execs and our users is
internal bug bounties maybe create some
for like OPSEC create one for product
bugs or privacy actually maybe give him
cash
give him a gift card if they come back
with a bug or an issue get your users
that are typing admin admin into
everything say if you type at me an
admin and a website let us know and
we'll give you twenty bucks right and
then we can go fix it put your users to
work okay
see I got a few minutes left so having a
roadmap really helps with your
executives they want to know that you've
got this they want to know they want to
be confident in you and your team and
your abilities so having a roadmap
really helps there's one thing we
developed and feel free to take pictures
if you want it's out on the internet as
well but executives love this kind of
stuff so if you're going to talk to your
exactly is you got to make pretty slides
okay
you have to otherwise they'll just
ignore it so if you take this called
spider chart and it might be hard to see
but we've got different legs and knee
joints on this spider chart and we took
things like privacy compliant
governance defense assessment awareness
monitoring product and as you mature
your program you're gonna start out
cutting that middle section there and
you're gonna map and say okay well I
have policies and I have a DPA for all
my customers so let me move my that leg
out to there and then what you do is you
just kind of draw lines between those
knee joints and now you see what you
have coverage then you can see where you
have gaps and then we kind of put
different levels in here so if you're a
level one organization maybe you're
doing these things level two you're
doing a little bit more take this modify
it use it for your own orgs show it to
your exec so drool all over it having a
roadmap is key forgetting that buy-in so
real quick there was a documentary in
1990 it was pretty awesome about a
brazen attack on this soft target okay
that have one defender that's it the
defender was able to use all the tactics
that we talked about to thwart these
attackers so this documentary probably a
lot of you have seen it it was Kevin
McCallister in home alone he used all
these tactics that we talked about to
thwart the Wet Bandits that were trying
to rob his home so this is our house
just like Kevin we need to know how to
defend it
so he used smoke screens
he used some tactics right in the face
with an iron blowtorch that might be I
don't know that might be like a shotgun
I don't know firewall there you go
same with the doorknob and if you
remember he poured water on those front
steps that froze right because he didn't
want them to come in the front door he
wanted to come around the back door we
had more defenses in place like lead
your target where you want them to go
and then yeah paint can to the face so
just kind of wrap up first get your
house in order do
the things there there are things that
we got to do we all know it
defense-in-depth we've been talking
about less preaching about it for years
remember poison versus venom venom is
illegal don't do it but poison we can
definitely do and if they come in and
they drink that poison that is on them
and put up the warning banners and say
hey we have poison on our network right
also use these two techniques these
defense techniques we talked about and
then build prepare and if you're able to
build a robust InfoSec program so now go
forth and conquer remember our goal is
to not make it easy on them we want them
to turn away go through all the hurdles
that is not worth the effort or that we
can catch them because that we may can
take too long to get to their target so
remember let's make blue teams great
again and go forth and spread the gospel
of the blue team and that is my
presentation
[Applause]