wanted to take a few moments and
introduce ray Davidson I once again I've
known ray forever another person who's
number one goal in security for a long
long long time has been just basically
trying to get the information out and
trying to share education with as many
people as possible and ray it's hard for
me I think ray I've known you probably
for the better part of a decade now at
Sands conferences and working with sands
and in your new position just fantastic
it was a little bit weird because when
he got his PhD he insisted on all of us
calling him dr. ray Davidson that was a
bit awkward other weird things about Ray
all right so ray and I years ago we were
talking about its Digital Millennium
Copyright Act and ways to get around the
Digital Millennium Copyright Act and
whether or not if Ray gave me his music
if it was a violation of the Digital
Millennium Copyright Act if I kept his
music for exclusive exclusive backup
purposes and with good backup strategies
and backup thing and then you can test
it regularly so I got this hard drive of
Ray's just amazing music collection and
I still have the backups ray I haven't
charged you for the backups of your
music collection nor well I but I
periodically test it for integrity that
was that was a little through nighters
had totally forgotten that done yeah I
still have the hard drive around here
somewhere dude I absolutely do just one
of the funnest people to hang out with I
haven't seen him in a while at Sands
conferences and stuff but and then even
at like our conferences when he shows up
I'm so busy he's so busy I kind of miss
you know like eight years ago we just go
out for sushi and go out for dinner in
Vegas but we'll get back to that as soon
as possible I supposed to have dinner
with you this week yes I know for us so
without further ado ray is gonna talk
about doing justice and leaving cyber
skills groups make the world a better
place so take it away
hi folks I and let me say also that
that's a complete lie about the the
doctor thing it really kind of bugs me
when people call me doc there are other
people that would be that I know that's
why I said that yes your John is trying
to embarrass me and but it's not working
so I hope you can see my main screen and
not my notes because then you'll all
laugh at my jokes before I tell them and
and I won't even know I do have discord
running but it's on a different screen
so if you have questions and things put
them in there you might put my name with
the question and I will answer them I
need to start with a disclaimer that
this is the Michigan cyber civilian core
it's an official arm of the state of
Michigan but I am NOT an official of the
government of the state of Michigan all
the information about the mi c3 which is
what we call the Michigan cyber civility
core is is true to the best of my
knowledge but there's some personal
stuff in here that I hope it wouldn't
embarrass my boss but it's it's not
relevant for the cyber civilian core
because it took me a while to get
through where I am the Michigan cyber
civilian core is a great outlet for
somebody with some cyber skills and a
hankering to serve the public I was just
listening to Johnny long his talk so
it's a it sort of along the same lines
people that want to do good you can see
in my in discord I'm the old hippie
do-gooder so this is my thing we are the
only state sponsor group of civilian
incident responders in the country I'll
tell you about that but it's worth
giving some context we are not a bunch
of super elite hacks or like the other
people that are on the stage and in fact
I'm a little bit overwhelmed at the
company I'm joining you don't have to be
a rockstar like John or Mike or or J
Hamm or at scooters or Larry Pesci or
any of these German Junkin all those
people that I left out make a difference
there is just a whole lot of work to do
the bar is low or helping people out and
I thin again that was one of the things
that Johnny was talking about so with
the Michigan cyber civility core I'm a
member and I thought it would be useful
to give you a sample history of one of
the members in my own history is the one
that I know the best I have been been
around or over a decade in various roles
around the
sans peripheral community or I know
they're people that knew that our
InfoSec I've seen in the new attendees a
bunch of students which i think is
awesome I used to be a professor and
sometimes I get asked how to get into
InfoSec so I wanted to give an example
of maybe not what you wanted to do but I
did have a very very good plan first of
all though since I did a lot of inside
baseball in my abstract if anybody
actually read my my Abstract this is it
and I realized
Elda asked me if I would if I would
speak and I just I was so excited I just
flipped us off and neglected to think
about that people might not know what I
was talking about so the first about net
Catskills and Swiss Army knife there
used to be a thing where the the
challenge at the bar was to be able to
describe netcat without using a phrase
with army knife and I suppose if you
could do it you'd get a drink or
something like that but my skill my
netcat skills are closer to the butter
knife and Swiss Army knife or not it's
kotas and you know consuming that cat
without
the second one is Mike war always says
see the packet yield a packet be the
packet and part of being the packet is
knowing about it masking and it's a
requirement that you hydrate before
asking and I'm not going to tell that
story of Mike's but I always remember it
whenever I do any bit masking I take a
sip of water and CTS I am totally
horrible at capture the flags I love
doing them because I get through maybe
the five the first five questions or
maybe the first level because I've
always got to figure out what all wrong
it and I'm sure some of you who are
analysts have gotten over that
because it's it's endless disease you
know want to know every possible wrong
answer in addition to the right ones so
I was I I tried for a long time - well
no I didn't even really try be like
super good but it was a little
depressing for a while to know that I
was never gonna be Larry or adder or any
of those guys but the thing that I'm
doing now is is a pretty cool thing like
it says there I seriously I have the
coolest job in the world and not the
first time I've been able to do stuff
like this
this is my 50-year plan into InfoSec and
it literally took me about that long
that tells you my age I have not
actually listened to the webcasts that
are here but if you don't like the
50-year plan I can refer you to a couple
of five public webcast about five-year
plans and so really this is the negative
example of go listen to John's for the
positive example
it's not like I've got things that are
kind of gonna come up here InfoSec is an
applied subject oh I mean I love doing
the package and things like that but
it's it's something that applies to
people and without reference to a
population at least now that we're up
above level 2 and level 3
vulnerabilities no more packaging stuff
it's about people and if you want to be
effective at security you have to meet
you have to understand how technology is
used in the population one of the things
that I often say is that if secure if
the security department is the
department of no you become the
department of don't know because people
go around you but if you want to
actually accomplish security in a
population you have to know how people
behave
when I was growing up there was not a
lot of today's technology around and
there was no real InfoSec as we know
there were not even really computers I
don't think I was gonna look up when
NASA was started but I don't think there
were even the female computers at NASA
when I was coming up so when I wanted to
first get her job it was tough you had
to have a work permit if you wanted to
do anything interesting and I was in
school I was 14 when I got my first jobs
the first thing I did was to get paper
route
and for anybody that has had an old
paper route you this was not papyrus now
it was newsprint every customer on the
rat one of the things you have to do is
to do record-keeping right and every
customer on the route was represented or
their account was represented by a
single piece of paper where you would
note down when you collected money from
and all these pieces of paper were
collected and a spring-loaded binder was
called the wrapper
and so I went down to the paper company
and I applied for a paper route they
said okay you can have this route I
forget what the number was but there was
it came free because somebody was giving
up their route so the old paperboy gave
me his route look look over I wasn't
really sure exactly why it was bunch of
paper but he told me to bring it the
next day and he would show me the ropes
when the doing the route
so I took the route home and I looked at
it and there were there were pieces of
paper that was different colors for the
subscriptions like if it was seven days
a week that would be one color and if it
was two days a week you know weekends
only there was another color and that
sort of thing so I looked at the bend at
the bottom it had the name and address
of the subscriber
and I looked at those and I looked
through this book and I just could not
see any order at all to it it looked
like the guy had every time you got a
new subscriber he just added the paper
at the end of the book but I thought oh
this is really terrible but I'm really
smart and so I'm gonna fix this
so I took it home and I don't remember
exactly how I organized it I used
whatever was my my organizational
paradigm that I had and it was either I
don't think it was alphabetically
because that would have been too much
but I think probably I took it like
by-street maybe I did the streets
alphabetical and then the address is
numerical right so so I showed up the
next day with my cleaned up version of
the route book thinking they were going
to think this was this was awesome and
they there it was him and his mom and
their jaws dropped like what the my
goodness did you do
and they really quick grabbed it and
reorganized it back into some rent this
random way that had been organized
turned out that the pages were ordered
in the order that you come to them on
the route so sometimes the odd you'd
have all of the odd numbers in a row
because that's the side of the street
we're walking down I wrote a bicycle had
those bicycles and then you cross over
you do the other side of the street and
it was it was like hardly bear see
because they looked at me like I I was
an idiot and but you know there's my
paper route so and then we're gonna go
away anybody that I'd never see them
again
so so I got over it so the lesson here
is to learn that technology is used for
people and it's often set up to serve
the user
as though my first introduction to the
concept of databases or Kevin Johnson I
know that likes to tried to start a
trend of calling databases cylinders
because that's how they're represented
on the Visio diagram databases you know
have methods for putting stuff in and
getting stuff out and I was thinking in
terms of the reporting because I got a
paper out to make money so I wanted to
be able to read my accounts that's sort
of thing so that's what I was thinking
of now I I knew differently once I would
get my own job without a work permit I
went to work for the phone company and
not the standard entry job for phone
company was a linesman and I was it I
was like 16 years old but they did have
information operator openings so I was
an information operator for a while we
went through a change while I was there
that we didn't say information it was
directory assistance and when I was
there they changed to start saying for
your records
the name is the number is blah blah blah
and people some people got a little
annoyed at that like they were gonna
have to write stuff down so so that was
interesting I was the only male in that
group I also managed to change the dress
code at my high school we had a I went
to Catholic High School and they had a
hair like hood and it won't surprise you
to know that I tested the limits of that
more than once I guess it's fitted four
times my senior year my dad was not
happy but because I had this paper route
and had a little money the last time I
got suspended
I went there's a wig store in the local
shopping center so I got him just fit me
a wig and I went back to school of the
short hair wig which was cool except
that I had to wear the short hair wig
for the rest of the year and it was hot
and that that is my senior picture I
tried to find a copy of it and I
couldn't but you know it's the dorky
high school picture I'm not sure you
hotel so again
it's dealing with people right so I went
to college and there was no computer
science that even at Georgia Tech there
was no computer science when I started
it they started up a school of computer
science and by the time I think it was
probably a sophomore or junior we took
Fortran and it was the old thing that
old people talk about where you draw the
line across the cards and you have to be
careful not to drop your box of cards as
you take computer center because they
fall you know you do a forty thousand
card pickup you drop them on the floor
did work have some interesting
experiences I ran the backstage at the
fabulous Fox Theater if you've ever been
to Atlanta's cool place and I did a
bunch of other stuff that I'm not gonna
record but I when I got my degree I
really didn't want to go to work and
there's some people that will tell you
that that hasn't changed very much so I
got into graduate school at Purdue and
again I learned a lot of interesting
stuff
some of it was Chemical Engineering I
took a couple of years worth of French
and Philosophy and I had a mentor who
was like a real-life theologian who had
studied in Europe and seeing the Dead
Sea Scrolls and written a whole bunch of
stuff so I learned a bunch of theology
and and that was cool I worked on for
work I worked on an artificial kidney
we studied blood clotting on artificial
surfaces which is a which is a problem
if you don't want it to happen I mean
it's really good thing for blood to clot
but if you're putting it through like a
an artificial kidney dialysis machine
heart-lung machine or anything you built
blood clotting is a bad thing
1982 Purdue got connected to the
Internet the back when Al Gore invented
the internet you know and we didn't
graduate schools graduate students
didn't get training we just saw these
3270 terminals show up around the campus
and we had the summer to play with them
before the undergraduates got back but
the undergraduates got training they had
classes so I read I must have read
thousands of pages of man pages and
probably killed several forests burning
them out to read them but I thought this
would be a cool thing because I had
gotten my master's thesis type that was
the deal you had to have it typed on
like 100% cotton paper or something like
that it costs me like between 150 and
200 dollars and that was like bill money
back then before the turn of the century
and with the advent of the computer
system I could like type that myself so
I learned an Roffe and tear off and soon
some equation setting and I'm probably
saying it wrong to somebody I'm sure
older than I am and correcting me but I
but I did type up my my thesis and I
learned the UNIX shell there was no bash
back then there wasn't even CSH it was
all Sh so about that and again you'll
notice the years there I was at Purdue
for seven years and again so I caused a
policy change there's now a limit of how
long you can be in graduate school
are graduated and this was a this was a
15 year detour it was not really helpful
for my or my information security career
so if you're looking at this to make
your own plan you might be able to cut
it down to 35 years from 50 here but I
did have
interesting experiences I first started
at a company called syntax in Palo Alto
syntax was one of the first companies it
was the first company to invent the oral
contraceptive so they have the
distinction of inventing or being part
of inventing the sexual revolution so
you can love me or hate me for that I
did not work on that project I worked on
cardiovascular and you aurillac
which is one of the drugs that is
related to opioids we were doing
transdermal delivery
it was a cool place to be Xerox PARC the
a lotto Research Center where a lot of
windows and mouse stuff was invented
they were just across the street and
Steve Jobs had started next computer
next computer was just like two miles
down the road around the corner and
that's not a city block where this is
it's just gorgeous countryside oh I miss
being out there except for the cost of
living it was terrible
I wouldn't have been able to buy a house
and have few kids by then so I moved to
the Midwest and now I live in Kalamazoo
Michigan they lived here ever since 1989
and it's been awesome except for or it's
you know it's not quite as exciting as
living in Silicon Valley but I work for
the Upjohn company which doesn't exist
anymore he got merged with Swiss Italian
company Co pharmacia and then we got
bought out by Pfizer but during this
period of time there was any anybody
works in a large organization knows the
routine of the pendulum that swings from
shadow I teach a corporate IT and I
spent a lot of time in the lab and the
thing about pharmaceutical research is
that if you have a product it has to be
stable for two years on the shelf
because no telling how long it's going
to be from the time you manufacture it
you ship it across the country it may or
may not be under control temperature
conditions and you want people to be
able to buy it and have it on their
shelf for a certain period of time in
the and the standard is two years so the
way you determine if the compound is
stable for two years as you stick it up
on the shelf in USA that every once in a
while over a course of two years well
that's that's not very exciting and it
certainly wasn't exciting for me but the
pendulum swang and we had a new CIO who
consolidated all the shadow IT into
corporate IT and I applied for the job
of being on the interface between R&D
and IT I could spell them both when I
figured I got something to offer both
ways and it was not too long before the
y2k Romanian remediation project so I
got put in charge of that fortunately
for me there were people that knew what
they were doing and they kind of held my
told me to write this here and go tell
the boss that so they won't bother us
and I was a good manager and did what I
was told
worked well enough and we there were
some other changes within the
organization and then I got this bigger
project - it was involved with
increasing control of the environment
after the mergers one of the big four
consulting companies had come to Advisor
and said what you have too much lack of
yet you got too many sites everybody has
different privileges but you need to get
more control of your IT environment and
you can reduce IT support costs if you
will standardize the desktop environment
and too many people have admin
privileges but like because 100 people
hundred percent of people had admin
privilege they didn't even think of
taking them away back then I know this
is causing some of you to be apoplectic
but that's that's the way it was me
welcoming myself to the webinar we had
they had this project they convinced
people that in this managers that if
they removed admin privileges from 50%
of the population then they could even
though it might cause more desktop
support all's you could you could have a
remote access this is not a remote
access trojan this was a good remote
access application you could you
wouldn't have to essentially roll a
truck or it sends somebody out in person
so you could reduce costs so they
started this project friend of mine was
running it and he got promoted and he
asked a different friend of ours if that
friend would do it net friend said no
way I'm not touching this with a and
foot Paul erased it but he'll do it and
so they came to me and they said will
you take this and I said I I liked the
idea because by this time I've gotten
some exposure to the security also it
wasn't just about losing cost but think
about this now if you're gonna
you have a population of people and
you're gonna take 50% take privileges
away from 50% of them who's gonna be
happy they're like nobody is the people
that the people that still have
privileges are gonna be hiding them or
they're gonna try and help their friends
everybody's gonna know somebody that has
that and privileges and so they're gonna
think that other guy he's for girl did
you know they're no better than I am I
should have that privilege to why this
is unfair so I might counter often for
taking the project was I'll do it but
we're going to reduce admin privilege
it's the minimum possible and we we
negotiated down to 10% because that was
probably the number of developer people
that needed development privileges in in
global R&D and I also got them to say
look we need to we need to monitor this
because it's a negative making away
admin privileges is a negative for
people and so they have they may get
pissed off and we need to know if that's
happening this was before I was in any
way exposed to sans but I was already on
the evaluation bandwagon so we said the
customer satisfaction had to be no less
than 85% and I got them to agree that
essentially doesn't suck is the positive
so and we did make that it took about a
year and a half we replaced did a
forklift upgrade of all the machines
took them away at night repopulated them
with their applications overnight
delivered in the next morning and I had
everybody fill out an eval and we did in
fact at 85 percent customer satisfaction
85 percent of people said it wasn't
worse than they expected and went
forward so that was really when I
started feeling like I got it about
something people listen to me because I
had under some understanding about how
people behave
there was one drawback the standard
desktop it was all Microsoft so it was
office 2000 I think and
build included an mp3 player I forget
Microsoft Media Player Windows Media
Player or something like that but iTunes
was was coming out everybody thought
iTunes was the hot new thing there was
an iTunes version for Windows but
the project leader I'm thinking we have
that capability you play mp3s with
Windows Media Player so unless somebody
tells me we need iTunes we have the
capability right business requirement is
met don't give me the technical
specifications that's not your job
well finally there was this VP who
decided that he really wanted iTunes and
he called me in his office and closed
the door and he said that iTunes was
going to be part of the standard SI bill
he wasn't going to sign anything to
explain why was an exception it was just
going to happen and I said okay and so
iTunes became part of that standard
desktop but you know that was the only
drawback I also had during that period
of time I was introduced to sands I took
what was then track 1 it's the precursor
to 401 when you took that it was in out
in San Francisco and it was from Bob
Hillary and it was I had a study to to
learn about networking and network
addressing and things like that before I
took the class but it was the beginning
of my love affair with packets not to
mention like war so of course that was
when I lost my job I got a reasonable
severance which was nice of spectrum
companies did severance I had worked for
18 years for the company I got about a
year salary to help with retraining and
reemployment but I was at this point I
was 50 years old I was an unemployed
middle-aged man with four kids high
school and college age and no real
skills I couldn't go back and do
Chemical Engineering again I did briefly
contemplate becoming a project manager
because I've done some things like that
but I also saw the project managers that
we had around Pfizer and they got
parachuted into the middle of a mess and
everybody hated them and I just couldn't
even even though they made really good
money that wasn't for me so I took my
severance and I looked around for ways
to get back to that that magic I had
taken for the 401 us and I decided I
wanted more of that I found out about
work-study which some of you have seen
in the disc or chat if you want to do
sans courses at less than $7000
work-study is the way to do it it was
only $500 at the time I did my first one
in Chicago in 2007 with Jonathan Hannah
who also spoke yesterday it was
4:14 which he mentioned in his talk
it is solo crushing as he said it's a
really long day there's no labs and at
that time I already had my see houses P
but I was really interested in getting
involved with sand so so I did it all
told I probably did 18 or 20 conferences
and I got about a dozen certs but I can
say for certain that just like a PhD
asking a certain does not mean you're
competent or confident sit down and
start doing that for her career so after
about a year and a half my severance
money was running out I had a bunch of
certs no real experience and no
connections and InfoSec be on sans
really I was hanging out with people
like John and Mike and Ed but they you
know they weren't giving me a paycheck
and Sam's wasn't giving me a paycheck
either I was paying to do stuff but then
one of those things that makes you
realize that you're not really in
control of your life it was a guy named
Sam Stan wiles who had seen my Twitter
beat and knew that I knew something
about network security and from my
trainee and you know this is academic so
I didn't actually have to perform right
I could teach
it purdue's Hammond campus this was the
Calumet campus they were trying to get
accredited and they needed PhDs on their
on their faculty and he reached out to
me to see if I'd be interested this is
like two hours away it was not a picnic
by any means I did this for two years I
would drive over on Sunday afternoon and
be back on Thursday evening after class
and I would stay at the Red Roof Inn
during the week and that was before I
had my dog so it was I was all all alone
and it just it's not a bad it's not a
great thing for your mental health but I
learned a lot I certainly learned the
stuff that I was teaching learned a lot
about networking and low-level packets
and and signaling
students that stay in touch in fact I
have one student who was going to show
up in San Diego in person he was the guy
who saved his summer internship money
into the OS CP it had to take it twice
take the test twice but he got it over
the summer I'm so incredibly proud of
him but I don't even have the USC and
he's not working for Verizon those are
the those are the things that are great
but as I say it was bad for my mental
health finally had an epiphany that I
won't talk too much about here but let
me just say that if you have to ask
yourself if you ever wonder if you have
a problem with alcohol you've already
answered your question so I went through
some recovery there I learned a little
bit about well basically you know when
when people can't follow a policy you
need to install a physical or technical
control and if you go and try to find
out how to put a what they call a blow
and go or an ignition interlock in your
car to keep you from contravening policy
it's not trivial to do I figure out how
to do that and I I got introduced to a
section of town that I was not
previously aware of but where real men
work on real transmissions and they Rev
they're real modified engines but but I
I went through that I got a really good
attorney I learned a lot about the legal
process we actually changed some some
things together he used me as an example
so long story not going to go more into
that but I'm happy to talk about it if
anybody cares but it was around this
time in another unexpected development I
got a phone call from a guy named Steven
Northcutt Steven some of you know he's
the president of sands he had always
wanted to do something academic with
Sanz and he had gotten the go-ahead to
build a master's program
and he knew I had some academic
experience and again that's letter Sania
at the end of my name we're gonna be
useful for accreditation and that sort
of stuff he was really looking for a
right-hand person to help with that and
my gosh you know Stephen North got calls
you he you just you go we created the
master's program
it got accredited and this knows people
in the audience or probably in the
audience who have benefitted from that
which I'm really happy about it turned
out that as the after accreditation
happened that we were hands and I were
not really on the same page about the
vision or it which is fine i well i
really want one of John's t-shirts
Bradley sucking you capitalism that
tells you anything so we parted ways
amicably
so again I was unemployed this is a bit
like a 10-year period of underemployment
and our limited employment so I was on
unemployment for a little bit and I
heard of this this group called the
Michigan cyber civilian Corps and just
like when I was looking around for ways
to get exposed to InfoSec this seemed
like a way I could kind of keep my hand
in so I signed up to be a volunteer but
what is this Michigan cyber civilian
Corps it is and was then the only state
sponder state-sponsored all-volunteer
force of cyber defenders other states
that are interested in I'm on the phone
every week or two with somebody who's
calling trying to find out how would you
what we do and what what we've done to
get here currently we have about a
hundred information security
professionals who volunteered all across
the state of Michigan and if you go look
at the map of Michigan there's an
interstate that runs between roughly
between Detroit and Chicago
it's a high concentration of people
along that east-west corridor you've got
a built-in map of Michigan and there's
an Upper Peninsula I think we have three
people in the Upper Peninsula and I'm
trying to expand membership North but
it's hard to find members outside of the
population centers the original design
was that we would respond in the event
of a governor declared cyber emergency
talk about that in a minute but we that
that's a pretty high bar and there's a
lot of reasons why that's not practical
in terms of keeping an organization
going so we worked with the legislature
and got a law passed public Act 132 of
2017 which is the Michigan cyber
civilian Act which provides some put
some boundaries around what we can do
and rights oversight to the legislative
committee and fortunately for me I don't
have to do that I'm really lucky that
the chief security officer in the state
of Michigan came to us I think a year
and a half ago from he was at Ford but
before that he was part of the Obama
White House so he has experience with
the federal government he was just
weeks ago is talking to the Senate
Homeland Security and government affairs
committee about the needs of states for
cybersecurity sitting right beside Chris
crabs so we have some credibility there
and I don't have to do anything like
that but for everybody involved I always
put this slide up because I'm really
proud of the fact that we are at
partnership Michigan is fortunate to
have both air and Army National Guard in
the state work very closely with the
Michigan State Police we're all
civilians in the initial stages of
thinking about doing this it was thought
of having a part of the National Guard
and other states are starting with that
I happen to think that's not great idea
because there's restrictions and you
start as part of the National Guard
people are thinking they're going to be
part of the part of the Guard rather
than the a bunch of volunteers and it's
just a different kind of cachet a
different attraction to it we end up
working very closely with with all of
these folks so in the our operational
procedure if there is a declared cyber
emergency then we partner with our
partners that I just mentioned and we
work under the authority of the State
Emergency Operations Coordinator which
is activated for more than just cyber
emergencies it's activated now actually
because we have coronavirus in the state
the the difficulty that I had with this
and a number of us had is that the
governor only declares a cyber emergency
if things are like really bad and the
standard scenario is when a nation-state
takes out a couple of power plants in
the Upper Peninsula during the winter
which means people are in danger of
freezing to death if you think about
that again just like I was talking about
if you have 50 percent of people who
don't have it we have admin privileges
if you think about this from a practical
standpoint if that is your mission to to
respond to a cyber event that takes out
a power plant there's not a lot of way
you can train for that and you can can
do ICS ot cons of training but
we amateurs are not going to be in going
in to look at network traffic we're
happy to hand out water and do stuff
like that but we there's going to be
professionals that can do that so the
challenge for the cyber sitting core is
exactly as I list hello how do you
recruit people for that mission it
sounds cool and if you can get uniforms
and equipment no people will sign up but
we don't how do you keep people engaged
and keep people from drifting off to do
something more exciting and at the time
the goal was just to get members there
wasn't a lot else going on that wasn't
in training
so and then the question is how do you
train for that mission and how do you
evaluate whether people gotten their
training for less serious incidents now
that we have the Michigan and cyber
civilian Act this is how things things
happen and that clear red is the cyber
incident something happens and people if
there is a cyber incident that they call
the Michigan cyber command center that's
part of the State Police MSP this
michigan state police personnel process
the complaint they determine if there's
any criminal component to it if there is
they go out and take take a get an image
of the disc they grab memory they do
whatever they need to do their employ
forensics and then they offer to the
affected entity which is usually a local
or regional government or agency they
say we have these people that can help
you because the State Police is only
interested in gathering evidence they
don't they don't do any looking to see
what happened or how you can keep it
from happening again it's only about law
enforcement so we can go in and do that
so we can send will scramble a team of
two or three people send them out to
basically create a relationship with the
affected entity and try and figure out
what's going on and do whatever we can
do to help them get a little bit more
secure we're not gonna I always say if
you if you've ever had sans security 504
the prevent identify contain eliminate
remediate and lessons learned we're
really about identify contain and
eliminate we don't for the most part do
remediation we're not going to reimage
drives and we're not going to write
policies but we can certainly give them
a lot of input to that
EMI c3 is not a resource for individual
citizens and their own networks we are
response team dedicated to assist small
and medium-sized businesses and
organizations and really non-commercial
ones we have had a lot of discussions
about the proper role of government and
you all know that security is a cost of
doing business
we're government we're all going to
suffer if the government goes down so we
can we can help there and this is the
state sponsored activity people ask what
kind of what kind of things we respond
to and I am not at liberty to talk about
any of the details but I have clearance
to use this as an example imagine a
local government with say 250 to 300
endpoints maybe a dozen servers three of
them are locked up because of ransomware
say and those servers provide something
like licensing or tax documents or maybe
they have the connection to child
support payments so people are people in
the local community are are Satar are
inconvenienced perhaps significantly by
the lack of this this capability we
don't we've been involved in ransomware
situations and we don't negotiate with
ransomware people but I know that there
are people that do and sometimes the
local government will have an
arrangement with a third party that we
and try and coordinate with but that's
the that's the general I saying nothing
local governments are so under-resourced
that there's nothing complicated that
happens at least that we have seen this
is not the GRU our activities this is
our 2020 activities we had quarterly we
have try to have a face-to-face meeting
monthly we have telecon so to keep
people involved we also have a slack
channel that people participate in and
we've built a community where members
can trade information and somebody will
be installing or contemplating using a
new identity and access management
solution and they've got friends now
that they can ask have you done this
people do exercises and go to cons
together that sort of thing we have
planned twenty20 events I have an update
this April 17th we are tentatively
planning a day-long exercise to play
back doors and breeches because I saw a
lot of us saw the webcast that John al
did about competitive Becker's and
breeches we thought that was cool I
don't know if we're gonna run that now
because the corona but we we do want to
do that maybe we'll move that to the
fall we try to do something every
quarter I said the face-to-face meeting
our plans summer event is train training
is security 504 which is a science class
we have been fortunate to be able to
provide Sands training who qualified
members this will be our fifth year we
did actually we've done saying this
would be the fourth year we've done
Sands we did five oh four or five years
ago we're doing it again because we're
going to require the gch exam
certification after we did five before
we did five I think it's five eleven the
continuous monitoring thinking that we
knew five before gave us the incident
response process and then five eleven
gave us the ability to or the knowledge
of how to monitor assistance that you
could tell if anything Bad's happen then
we did forensics 572 which is Network
forensics because we don't do endpoints
forensics the State Police does that and
and it's Phil Hagen will tell you you
can solve solve a case using network
forensics by the time the endpoint
imaging is done so we did that in the
last year we did security onion training
along with I gotta give a shout-out to
Chris Sanders Chris Sanders is like the
wisest guy and the information security
these days you should totally check out
chris sanders org or applied network
defense not just the technical stuff but
he is a thinker and he's got a great
course on investigation theory if you
have technical debt in your in your
organization because you've bought
equipment and not done the training
take that course and you'll make back
10% of your of your technical deck debt
across the board and if you don't come
talk to me I think it's an amazing
course so this is what the mi c3 does
other than responding to incidents
membership requirements we asked for at
least two years of InfoSec I are digital
or network forensics experience one
foundational security certification it
used to be security security plus the EH
some GX cert we are proposing because we
have a law now we have some oversight
and we want to kind of crank up the the
requirements proposing requiring the G
CI h which is the certification along
with sand security 504 it is a DoD 8570
IAT level 3 certification you can look
that up it just seems like exactly the
right point for us and if anybody has a
nonsense course or nonsense search that
I would be that I should be looking at
please send it along I'd love to get
away from a single vendor but that's
that's the way it goes
look for employer support for 10 days of
participation and we asked for a signed
letter of agreement but that's not a
legally binding thing especially for
people that work at a large organisation
like Ford or GM it would take forever to
get a legal signature and we don't
really have any holdover people if they
don't show up to respond we can pick
them off the core if they're inactive
but we don't really have we don't want
to do that so the employer agreement is
really a convenience by courtesy for for
us to get members so they can go into
their manager and say hey I wanna do
this this is what it looks like and that
ten days is five or six days for
training one or two exercises that would
be our face-to-face meetings community
volunteering that sort of thing that's
not necessarily including incident spots
process is I hope pretty simple you go
to mi cyber Korg and please don't but
you feel free to go there look at the
page if you want to look at some of the
stuff okay it's not hugely professional
so I'm sure that any hacker could
probably kill it so please don't the
apply give us your name address credit
card number blood type and all of those
fecal sample of all of those things and
we send you a link to the first test you
take tests these are basic security
beginning and advanced incident response
basically you pass the basic security
class you get a link to the basic ir and
basic forensics tests if you pass the
basic one of those you get a link to the
advanced test and i i'm hoping that
we're going to move away from the test
that we currently have looking into
somebody that can write some tests and
look at our skill set help us devise a
better test better entry exams that's
where we are now if you or anybody that
asks is four out of the five tests they
get a congratulations you may be a
wiener and send us a whole bunch of
documentation that would be the resume
the volunteer agreement which includes a
nondisclosure agreement
or your agreement which i've talked
about and once we get that documentation
we do a criminal background check the
criminal background check is required by
the michigan cyber civilian act and it
does uncover stuff that people thought
wouldn't be uncovered so we have having
to deal with that and we now have
because legislators wanted legislate
they came to my boss and said hey what
what do you need and so we're trying to
get
stations so that we can either have an
appeal process for somebody might have
done something when they're 12 years old
and it's supposed to be expunged or just
provide some kind of appeal process we
don't have to avoid
having people on the core but you can
understand that in the law we want to
make sure that we're not sending
convicted felons out to do it
after you get the background check
complete we provide our michigan.gov
email address and add them to the active
roster by meetings that sort of thing
our benefits
I really believe we it's a win-win-win
we've got benefits for the public with
the state of Michigan the employer and
the participant we get training
opportunities for the individual member
and the ability to collaborate with
people you wouldn't ordinarily get to
collaborate with we've done exercises
along with the National Guard and I may
be going to a major exercise here in a
month if they don't cancel that and
professional development standpoint you
all know that more networking is great
that's why you come to meetings like
this and just collaboration across lots
of different businesses within Michigan
we have you know General Motors Ford we
have two utility companies just a lot of
stuff that you can collaborate on and
lastly you know it's just fun we provide
members of a platform to do what they
love and at the same time help out the
state now what how can you do better
than that you sort of like get to do
what you find engaging and accidentally
people get have a benefit well this is a
picture of some of our members just to
show that we are real we have we have a
few emails as the diversity is not what
I would like and we even have some
partners there they turned off the you
know Fox News Home Shopping Network from
all the screens this is in our State
Emergency Operations Center we've gotten
some awards and recognition most
these are from 2017-18 that was back
when we were getting the legislation
done it's been kind of quiet in terms of
actual official Awards now because we're
actually doing work but I would point
you to the the law fair blog article
down there at the bottom is written by
from the a new friend of mine
Monica Ruiz works for the Hewlett
Foundation Monica has been a huge
supporter because she spent a year in
Estonia and knows about the Estonian
Civil Defence League or they actually
get uniforms and there are a lot more
people if you don't know Estonia is
history with cyber cyber attacks from
Russia you can only find that in
Wikipedia they are a very well developed
organization and I'm hoping one of these
days I'm going to get over there and
spend some time with them and learn what
they're doing
in turn we are getting calls I worked
with a group at Columbia University's
School of International and public
affairs who is trying to spin up a
similar effort or the New York cyber
command center Ohio has one we did get
the visitors from Hawaii and I'm hoping
we can do a return visit and help them
out because sure they need us to come
out to Hawaii I think we've heard from
the Colorado I've been to Washington I
was going to be speaking with the former
CEO of California if I had been in San
Diego but I'm not
so it's getting some some press the the
NGA is the National Governors
Association the NGA has a packet of
information on how how a state can spin
up something like this and everybody's
got our phone number so the question is
all right this is reactive and there's a
lot of people that have problems and one
of the things we're learning is the
extent of problem there's so many local
and regional governments that have only
a single IT person and that person where
it's about 8 hats and the one that they
feel the most heaviest on their head is
getting password changed making things
easier for people opening up remote
access so people can work from home that
sort of thing in the security as you all
know is last on the list so as we are
doing reactive stuff we're getting some
press and other organizations are saying
hey I don't actually want to call you I
want to be protected from this how can
we how can we prevent that
Michigan a couple of years ago we had a
pilot program called sea so as a service
where the state would provide a what
where the state provided a rental
CSO and organizations for localities
could buy into that service that was
only a year-long pilot we're working on
a project to provide guidance because
local and regional governments do get
audited by a number of entities and so
we're putting together a standard set of
guidance that people so people going to
be ready or that combination of audits
and guidance is based on the sea is
critical controls and beyond that we
have something called the cyber partners
initiative which is essentially a club
or local and regional IT people just to
be together meet once a month here from
the state sock about the kinds of
attacks they're seeing how to prevent it
we had one of the MRC 3 members gave a
presentation on how to use Showdown to
to assess your external footprint this
was in the past couple of months that
was in response to an incident we
responded to where if you use Showdown
this organization was like way open so
we're trying to move this to proactive
this is my ending slide this is mr.
Rogers has been sort of the hero of mine
for since before he got popular I know
that's the thing to say I was raised in
the Presbyterian Church and I am in fact
a Presbyterian elder Fred Rogers is a
Presbyterian minister this is a famous
quote of his I'd look for the helpers
NYC 3 helps the helpers the people in
uniform and the you know adults depend
on helpers too or child support
licensing and all that sort of thing the
other reason that I would like Fred
Rogers is because frankly he was a
badass he figured out that there was in
the Presbyterian Church the way the
policy works you have to get approval
from the height of the grand that's
called the General Assembly so a local
group of people will say hey we need a
minister send us one of the General
Assembly sends and these are
well-defined groups of people
congregations they're called red rogers
figured out that there was a
congregation that could not call in
those kids they had no capability for
asking but they needed him so he
petitioned the General Assembly and said
hey I need to do this and he made enough
of a case that they changed things they
made an exception for him and to me
that's that's pretty badass
so you want more information that's my
email address that's my work email
address my personal one is available if
you look for it the Twitter is me and I
tweet about dogs and son rarely InfoSec
and sometimes political stuff not trying
to stay away from it
you can follow me if you want you can
find me on LinkedIn and on Google at
least I don't have the John strand
problem you can look at our website that
will redirect you just be aware that my
site record will redirect you to some
complicated content management page but
if you remember in my cyber Korg you'll
get it you've got to get any questions
my apologies if you mentioned this
already but does all of your funding
come from the state and what's the
approximate budget for the org we get a
sans we'll give you a discount if you
allow them to battlecast from your
location of your guarantee we guarantee
65 seats well that this is you should
talk to a sans salesperson
but what we have seen is that they give
a price break at 65 guaranteed seats and
we can usually get 65 people so we get a
very substantial discount less than 50%
we have to allow them to simulcast from
our site so they can advertise it like
when they run things at Virginia Tech
with Randi they'll broadcast from there
and they let people sign up to take like
an on-demand or V life force or manatee
from a Randy site so I have no idea who
else it's in now you can totally say the
deal that Ray got was and that'll
that'll help you with your negotiations
with sand and then they're gonna say it
was that football backing and I get
phone calls somebody asked about
InfraGard we are many of our members are
part of InfraGard but InfraGard here
doesn't do all that much they have
meetings how they send out
communications so we use them but in
terms of actually having activities not
a lot to do funding comes from the state
yes and the budget of the organization
is
much training I don't remember it's less
than a half a million
I don't think it's less than a quarter
million I don't know how public that is
but it's I I mean it's like the
legislature has to approve it I just
don't know if it's a separate line item
the I'm the only employee I work
three-quarter time
well do you know of any other states
that have done something there is a no
there is one in Ohio there are other
states they're spinning stuff I think
Ohio is OHC Ohio's III or LHC 3 again
it's part of their National Guard
structure
and so I don't know how far along they
are because every time they when they
want to do anything they have to
remember about the chain of command we
have been sort of ignored or
benevolently ignored or a while so
that's how we've gotten to where we are
I don't even know there was somebody
that I don't know that realized we
needed to get a law passed and they
Legislative Analyst's took it
they found a legislature and said hey
you should sponsor this happened to be a
guy you know in a nearby community so I
thought you know he was the Republican
the guy in my community was a Democrat
they collaborated on it it's like you
know again I'm the I'm the CTO guy that
comes up with an idea but can't do the
administrative stuff I need the was the
Pepsi guy that came and saved tried to
save Steve Jobs I'm know Steve Jobs
Christina is my seesaw he's awesome
alright man well as always thank you so
much I'm sorry we didn't get a chance to
get together for dinner but next time
you come out to Deadwood dinners on me