[Music]
it's out
[Applause]
[Music]
all right
microphone checking yeah that'll work
yeah check mic one two one two good stop
all right I think it's time to start so
thank you for coming
and also being here today this talk is
called behavioral security and offensive
psychology if you're expecting Wims talk
you're in the wrong spot he very nicely
gave up the slot for us today how's the
audio out there can you hear us so yeah
in the back
back's a little fine okay wait is that a
bad thing okay so even though it's not
that kind of con we have not a drinking
game for you this you probably don't
have drinks in your hand but we wanted
to have something interactive and we
don't want to promote the crippling
alcoholism that affects us all in our
daily lives because of the jobs that we
have to do darkest timeline a little bit
so what we're gonna do is we have a
number of words we're likely to say a
whole bunch during this one is security
engagement you're gonna hear that a lot
and there's a noise you're gonna make
and don't worry if this doesn't make
sense we have an educational video for
you but the noise are gonna expand if
you hear Red Team yeah you want to
practice that yeah y'all got that you
hear it red team the noises if you hear
fishing I want to hear like that airhorn
ah
and then there's one word so secret so
impactful to our industry that when we
say it I want to see you go crazy just
go ham slob kabob and if you don't know
outgoing slob kabob is don't worry we're
gonna we got an educational video for
you but I just want to hear like massive
here so let us show you this video let's
oh man we're gonna have to do a this is
an instructional video it's required for
maximum learning it's probably not gonna
play here because I don't have any Wi-Fi
but don't worry
I know how to come with a backup
but
yeah you yeah yourself there love kebab
she like looks like a slob kabob kebabs
love kebab she like looks like a slob
kabob
[Music]
a year a year what everything you're
having I this is what we call micro
learning so pay attention and thanks for
being thank you hearted B where did that
name come from you want to know
something you want to know something she
like looks like a slob
so did everyone learn something good
well that's the end of the talk so thank
you so if you want to play along make it
a little interactive that'd be fine it
will probably mess up and that might be
funny for you probably mess us up but
those are the rules
security engagement Red Team phishing
synergy will help you along the way
so my name is Josh Schwartz I am the
director of offensive security at
Verizon media where we call our security
team the paranoids and with me we have
the fabulous birthday princess it is it
is actually her birthday today I mean
thank you for throwing a conference to
celebrate my birthday it is very nice of
them and thank you when for swapping
spots with us because it's my birthday I
also lead the security engagement and
red team at lyft
so I know you're all here for us to
perhaps give you some information but
maybe you're just here because you
thought it was wins talk or maybe you're
here because you came to just heckle or
maybe you're here because you feel
obligated because you work with me or
something like that
front row yeah but because this is an
opportunity for us to share and exchange
information we'd like to do a little bit
of a poll and I'd like to know who we'd
like to know who we're talking to today
so folks in the room who here is on an
internal security team you Wow okay so
who's not on an internal security -
you're like a vendor or a consul Wow
internal security growing it's good good
stuff so who here is on a security
engagement security awareness team okay
a couple people how many of your
companies have a security engagement
security awareness team okay
we're hands and another one nice so
let's think about it for red team yeah
he's on it I don't know I think so folks
who call themselves red team in the
house we are we are the red team we've
got a few how many folks have a red team
inside their company yeah Wow secured
even meeting being written all that
how many folks front row notwithstanding
have this dreamy thing where you have
both of them you have security
engagement and regime and not only that
but they work together and they're part
of the same thing would you say that
they have synergy let's hear it for
synergy because that is what this talk
is about it's about synergy it's about
how these two things can perhaps be
better together and by combining them
you can get a lot more and what we would
like you to leave here today with is
perhaps a few tips maybe some ammunition
if you're ever looking to build a
program like this or if you ever find
yourself where you want to be able to
make the argument to have these types of
things in your organization and you want
to know how to figure out building them
and maybe not get clobbered by it
because it's a dangerous world out there
so if you ever find yourself needing
these hopefully you can get it done
however it's hard because it's a lot
easier said than done much like a 2020
Kayne presidency and there's a number of
reasons for that
first of which both of these things are
very much a luxury item it's things that
they're it's expensive a to pay us to do
this kind of stuff especially when it's
not just directly going out there and
fixing bugs it's expensive to hire
people to just go around and point out
flaws and we all work in security so we
already know how many laws there are
everywhere everything's broken and why
would we want someone to come tell us
about things being more broken like we
already know we just need more people to
help us fix it and it's also pretty bad
for our friends in security engagement
right why would you want someone just to
focus on making people care about
security more just to focus on trying to
change behavior trying to focus on that
human element when there's so many
technical vulnerabilities around us
but if we get lucky enough where someone
decides they want to buy that luxury
item and they sign up to have one of
these things
nobody knows where to put us and what
often happens is we end up in this place
where you're just kind of at the whim of
whoever decided they needed you for red
team sometimes it's the legal team yeah
[Music]
sometimes the legal team sometimes it's
product security and then if you're a
red team on product security what do you
do you do prod set so I've even seen it
where red teams exist and they're a
function of the blue team's the worst
because then they call themselves purple
team and they think they're really
forward-thinking but really they're just
doing a fraction of the job that they
could be doing sorry and we've got the
same problem over on security engagement
I think we have a little bit worse have
you as a red team ever ended up in
compliance well no I had self-respect
due to PCI HIPAA sarbanes-oxley
compliance is a popular place for a
security engagement security or an
esteem to land but when this happens you
end up doing run-of-the-mill check the
block's security awareness videos or
sometimes you get a bit luckier you end
up in engineering which is not a bad
place to land but because of human
nature and people wanting to just focus
on their own kind you end up really just
focusing on security development life
cycle at the absence of looking at the
rest of the organization even though we
all know that risks exists in all areas
of the business or you end up with the
opposite problem you're allowed to
educate everyone except engineers
because you're not technical enough to
speak to an engineer next you have
above-average social skills in high EQ
which makes everyone think that you are
the team event planner or just because
you can write everything from
company-wide
emails to blog posts of course material
doesn't mean that this team is your tech
writer everyone wants this mythical
creature with all of you skillsets but
no one wants to pay for
it or consider the incredible rarity of
a unicorn enter the cycle of security
culture doom often do despite in a
career focused deep in tech or
engineering there's this misconception
I'm sorry oh here I am talking about
speaking skills misconception of the
resources required to build this program
videos don't grow on trees
gamification sounds cool innovate
innovative in fact for the platform
required to track all these actions and
the points cost money
the rewards also associated with these
programs cost money even more so if your
program is successful because then you
have a lot of rewards to give out
expectations for this role then border
on unrealistic you have to be good at
presenting writing have arguably the
widest breadth of security and privacy
knowledge in the field data science to
track the efficacy of your program
learning theory to get these knowledge
bits to stick behavioral science because
you know you're trying to actually
change some behavior design video and
photo editing skills to make your
content look good and event planning to
get people excited about the stuff that
you're doing and on top of all of this
you have to be able to think like an
attacker to simulate attacks looking at
you fishing at this stage of the
program's either with inadequate funding
these unicorn stables cost a lot of
money or you were never able to find
your unicorn to begin with your program
fails to be you the Prancing success
that you once envisioned it to be and
then because these programs are often
set up for failure our industry views
them as run by soft soft incompetence
and not a success me I'm gonna let you
finish here but there's a bigger problem
than this it goes deeper it's part of
all of us the things that we do and
that's the fact that we disagree
constantly the first time that I had the
responsibility of the fishing program I
talked to Sam about and I'm like I think
we could do this like could make a good
improvement
she was like why would you strive for
mediocrity I said do you even know why
indeed and because we're constantly
disagreeing about it and I know I'm the
biggest hypocrite ever because here we
are disagreeing about what it should be
like but because we constantly do this
we constantly argue about what is a good
red team what is a good secure engaging
program what we end up with is a lack of
definition and because we can't define
ourselves because we can't communicate
to other people what our value is nobody
understands our value and we sit there
like a sad little Kanye so I present to
you this new and innovative thing the
conjoined squares of a allistic success
synergy I know right I'm excited too
because these two things we have a lot
of common right we both have this lack
of definition we both fail to define
ourselves really well and we both exist
in this state where we've got a lot of
vendors who think they can do it too and
the marketplace is saturated and because
of that there's a lot of external people
selling the bare minimum that is
supposed to do what we're trying to
build but we know we could probably do
it better internally because we can
customize things to our internal needs
the internal culture of our companies
and we actually care and we don't just
drop in a product and walk away and
sorry for all the vendors who think
they're really great but there's more to
that though I mean we have some failures
that are very complementary like sorry
security engagement but yeah suck it
real phishing making it realistic
because you've probably never been
behind the keyboard typing that email
actually trying to get a shell
right but red team is really good at one
done fishing engagements whenever you're
done it for a large group of people
consistently
okay yeah you're right you know we
normally you just kind of get shell once
and we don't really test the entire
population but it works right I guess we
don't really care about making change or
I guess we really don't care about
working with partners because let's face
it red team we're really not people
people it's a lot easier to whisper to
those ones and zeros and make the door
open up than it is to have a meeting
with some other people to actually make
something useful
I guess but then because security
engagement often doesn't come from a
heavy engineering or technology
background your escena is just not quite
neat enough to get a seat at the table
there's usually an annual pull post on
Twitter by someone who I will not
mention at this time asking if you can
really be in security if you're not
really good at coding yeah so on behalf
of red team sorry for that sorry for all
that wheat wheat shaming as it were so
present to you an obvious alliance of
these two things if you didn't see this
coming right
security engagement and red team can
work together and try and address some
of the real problems and make a bigger
impact right because red team can lend
that credibility right that leanness
that we already have that we care about
so much and security engagement can
focus on actually changing behavior
focusing on actually getting that
message out in an impactful way so
advertising media that's how we
organized our program we call it
propaganda machine except no one would
actually let me call it that so I only
named our slack channel that but we call
it proactive engagements the idea is
that all of these programs come together
under one umbrella to kind of feed each
other and it's like that at a formal
level in the organization structure and
it's a core pillar of our security
program we've got the red team we've got
phishing we've got security engagement
got security education all aligned
behind this one goal of changing
behaviors actually making a difference
right
yeah but aren't you trying to change
behaviors yeah are you trying to
engineer behaviors nice so why wouldn't
you just call it behavioral engineering
if I didn't think of that yeah I think
security engagement security awareness
propaganda machine West propaganda
machine proactive engagement out
behavioral engineering in but you know
how can you computer easy program in a
human is hard you need some good
foundations with your behavioral
engineering first is design the hardest
thing is just reducing choice and
ability to make bad decisions but that
will make your program the most
impactful you know if you make simple
changes like in your email client
notifying users when emails come in from
someone outside of your organization or
making a password manager really easy to
implement it's this design concept that
someone in Japan his name's CheY Ghosh
and ago something like that worked for
Toyota at one point he came up with this
thing called okay okay which sounds like
the newest Pokemon but it's not it's the
idea that if you design things in a way
that makes it hard to make the mistake
or impossible it is a better design
think about when you go to plug
something in the outlet one size is
different in America because we didn't
really didn't like try very hard at this
but in other countries like it can only
be plugged in one way it prevents you
from making the bad choice so rather
than like all the plug manufacturer is
saying hey please plug the plugs in the
right way we say okay you're gonna make
mistakes let's make it impossible for
you to make that mistake or even better
like a better explanation of this or a
better example of this is the USB see
right now it's impossible to plug it in
the wrong way it's just fine no matter
how you do it
sorry I got really excited about pokey
if it actually used to be called baka
yogi which was which was idiot proof or
fool true but then I think they wanted
to market it a little bit better so they
made it a little lighter clip so perhaps
we in security you can do some baka okay
don't you mean okay okay
next one of your greatest threat actors
is the customer the user that simply
doesn't know the security or privacy
mind thing to do and the simple tool for
that is educating them giving them the
content and knowledge that they need to
make the better choice the harder
adversary that you have is the user that
knows better but doesn't care about
doing the right thing and for them you
need to build a positive sentiment with
your security and privacy teams give
them the motivation to do the right
thing generally through gamification or
some other motivation techniques and
then practicing good bedside manner
within your team and then last measure
ability to ensure that you can prove
efficacy over time
[Music]
so behavioral change campaigns is kind
of the idea that we're presenting here
and like any campaign you need to have a
clear goal you have to clearly define
what behavior it is that you want to
change before you start then you have to
measure if something changed and then
you actually have to follow up and
communicate it out you can't just do
something in a little bubble and expect
other people to understand that you've
done something now
we're not kind of like the first people
to ever think of this there's actually a
group of people who really care about
changing human behavior and they do so
so all of us dum-dums don't kill
ourselves with disease and such and they
are called the World Health Organization
and they already document what a
behavioral change campaign can be and
they have this definition a health
campaign something that follows a
specific sequence that moves the target
audience from awareness of an issue
towards a behavior resulting in a
specific health outcome what if we
replace health with security here and we
thought about behavioral change change
campaigns in the context of security and
we think a security behavioral change
campaign follows a specific sequence
that moves our target audience from
awareness of an issue kind of knowing
that security is important towards the
behavior and it results in a specific
security outcome okay they do the thing
we want them to do they have some other
advice too that is really useful for us
but involve partners early in the
campaign campaign can benefit if we find
the people who are already caring about
that stuff and using trusted messengers
this idea is quite devious actually find
people who are trusted right perhaps
people who already prolific in your
organization they have power to speak
out and get them to deliver the message
of security or health or whatever it
might be and then this last thing they
said is something we often ignore
ensure the availability of community
resources health change campaigns they
don't try and make people like all use
condoms or not inject themselves needles
or
do any of these bad behaviors if they
don't have an available alternative you
don't have the resources to actually do
that other thing you can't tell
everybody to use a condom
there's no condoms available and
therefore in security we can take a good
lesson from this we shouldn't try and
make people do the secure thing if we
don't make that available to them so
what do we do if we've got nothing
you've got no resources no one's behind
you on this idea well you be the change
you want to see in the world most red
team's most engagement programs they
start with this very simple idea go do
something go demonstrate go hack
something that will create momentum for
you and then once you have that momentum
you can build a program from it but the
idea there is don't fuck it up too bad
and in order to not bug it up too bad
you need something called executive
buy-in I know this seems boring but I
bet we all say this all the time but we
don't realize what it really means most
people may think that executive buy-in
is this idea that someone who has power
may be an executive has said yes you can
do this but that's not executive I
that's permission from somebody
executive buy-in the real executive buy
it is that anybody who might have an
interest in D railing or anyone whose
toes you might step on they all already
agree with you that means you can go
accomplish the thing you want because
everybody's already on your side there's
a lot of people you might need to make
friends with to accomplish anything in
security starting with your target
especially for a red team yeah go get
cozy with them no one likes to be told
that their baby is ugly so you gotta do
a lot of pre-work to make them feel
comfortable with the fact that you're
about to go poke them pretty badly
that's what she said
yeah and you also need to probably if
you wanna like message out something you
probably want to go talk to the people
and there's gonna be a recurring theme
here whose job it already is to do that
thing there's someone's it's their job
to communicate to the company don't
start communicating to the whole company
without talking to them first
if they even let you it's often a a
gating function where someone can't
email the whole thing if they're good at
their job you actually can't do that but
you know sometimes we have the access we
need to do things like that
and there's other right the learning
team the people who teach people you
can't run around saying you want to
teach people something if you don't talk
to the people whose job it already is or
onboarding making sure that you can
drive home this message that security is
part of your company culture because
like any good campaign in this world
it's good to get them when they're young
right yeah and that includes at the
company that first day man it's powerful
it's not something that we should ignore
and of course you also need to go talk
to designs to make things pretty talk to
the event planners talk to procurement
you need a lot of friends to succeed
executive buy-in is largely a social
engineering operation you have to figure
out and enumerate all of these different
people so that you can then go exploit
them and it might not sound sexy but
going and having a meeting with the
right people and getting them to buy
into your idea is a real exploit and
it's a powerful one because you might
actually accomplish something if you do
this enough and then of course there's
that last part escalation right popping
one box isn't enough you need everybody
so you take one person buying into your
idea and you pivot off of it and you go
to other people and you get more people
to buy into it
so what does this actually look like in
practice what if you wanted security
integrated directly into your core
central employee content platform this
was the experience that I had the first
time combining Red Team and security
engagement efforts I think thank you
David MVP up in the front row here thank
you uh sorry sorry got so distracted by
dual core need to compose myself so our
red team at the time had a goal of
writing this engagement using certain
exploit that they had found out I also
had a different operation at the time
trying to gain access to a core central
communications platform for the company
that I worked at but we didn't want to
just you know do any old red team
campaign and I needed evidence to prove
that I needed access to this tool so we
sat down to make this phishing risk
model so we looked at all the assets
this is not a you know all-inclusive
list of any assets that a company might
care about but mere just some examples
and we picked the one that we knew would
be most impactful for our organization
next we looked at all the tools within
our environment and which tools would
give us access to that asset and whether
or not they were protected by MFA or 2fa
next when crafting our social
engineering and phishing campaign we
looked at the you know exact action that
would give us access to that tool and
made sure that it was matched up really
well and then last made sure that our
target was you know the user group that
would use that tool and grant us access
and there's you know general
susceptibility to phishing and social
engineering another way of looking at
this let's say I wanted details of a
pending acquisition for my company I
might send a targeted phishing campaign
to get chrome plug-in permissions to
grant desktop capture to the legal teams
browser probably have a light high
likelihood of success with this campaign
what I don't do is fish to capture
credentials why because their gmail is
protected by two-factor authentication I
have a low likelihood of success running
that campaign so what did we end up
doing a little bit of oauth fishing
before it was cool at that time we had
the ability to customize our roth page
to make it look like it was coming from
within our organization we did the
responsible thing over recording into
Google after this time but we got some
pretty gnarly permissions in addition to
the Red Team campaign that we had going
at this time I had my own operation in
play for entire six months when I joined
the company and learned that it wasn't
going to be so easy to gain access this
tool that I viewed as critical for
security engagement even David it's okay
it's okay I started my own executive
buying campaign starting with the
highest ranking member of the company
that I had access to selling them on my
vision and getting the meeting with the
next biggest person within the company
so on and so forth and so until I got
blocked and then I did a little bit of
digging a little bit of reconnaissance
and learned that one of the executives
who had a hard time getting on their
calendar usually had their morning
meetings available and a penchant for a
specific breakfast sandwich entered the
best social engineering - of all time
the Egg McMuffin got that meeting with
them got their buy-in and then made some
other friends along the way
the design team procurement internal
comms because I learned they were also
blocked from using this tool so my
success was going to be their success
until I felt like I had met with every
single person in the company except for
the CEO and I leveraged the results from
the red team campaign to get that
meeting and when I did I you know
presented the problem and then the
immediate solution which was giving me
access to that tool and they agreed
immediately my bounty propagating and
security content on our core platform I
celebrated as one does with some
champagne popping on the roof but then
also got to do some really you know fun
creative innovative micro learning on
our core platform how does this all sum
up you know keeping our hat back to the
boat World Health Organization we have a
behavioral change campaign a clear goal
reducing employee susceptibility to
OAuth phishing attacks
gaining access to the best communication
tool to change behaviors and having one
to remeasure Ville simulation impact
what we're doing measuring behavior
looking at how many employees gave us a
xoauth grants you know gaining access
support and funding for using this
internal tool and then reducing overall
susceptibility to OAuth and other social
engineering attacks and then for doing
and communicating we had a really great
Red Team read out targeted training
company-wide marketing of our attack and
our remediation efforts and then
continuous retesting to measure our
change and our end results when that
really noisy OAuth attack went out
around the world
our employees caught it in ten seconds
we were the first company to report it
to Google 70% of our reported fishes end
up being real fishes that means that our
employees were so good at spotting real
phishing attacks our company and when we
did a campaign with a binary execution
100% of the people that we targeted
reported it to our team this is actually
a pretty great success story and it
comes down to a really core idea and the
goal here was to use the V app and we're
not naming the company but like it's the
app that is the company if you can ever
do that if you can ever figure out like
how to place security how to place
things that you want people to know
about
security education messaging whatever it
is into the most central integrated
thing that the company has right if
you're Facebook you poke you get it
integrated into the internal Facebook
thing if you're snapchat you get it
integrate it into snapchat itself if
you're Pandora you play songs about
security
I don't know but using whatever that
place that people already go to as your
messaging platform is going to be the
most powerful thing and we as security
practitioners should maybe stop trying
to reinvent the wheel everywhere this
idea already exists and we talk about it
all the time when we talk about
offensive operations this idea of living
off the land which if you're unfamiliar
it means don't drop a bunch of exploit
toolkit on a system when you get access
to it because that's gonna get detected
but instead use the things that are
already existing in the environment to
move laterally to move your privileges
up it's important for us to think about
how we approach putting security in
other places and one idea that we might
want to be aware of is the
dunning-kruger effect and this is a
psychological principle in which we're
when we try something new we go from not
being skilled at all to being a little
bit skilled and we suddenly think we're
the freakin best at it but man I got all
these new skills and actually over time
maybe you experienced this in your
career as a security professional but we
definitely I know we're all really
really smart right security people so
smarmy not on computers but we're not
that great at everything else and unless
we really put that time into learning
that we're probably not going to be and
the thing that will give us the biggest
advantage is diversifying the types of
people we allow into security
diversifying the skillsets that we use
an approach rather than thinking that we
as an industry can do everything all on
our own leveraging design leveraging
behavioral psychology
leveraging marketing sales people who
have skill sets that are different than
ours because we will never get security
into the places it needs to be and
people will never care about it if we
stay in this little camp that's just us
and then that's the end of the
presentation and if you have any
questions we'll try and answer them so
ask them or don't
then don't I guess alright that's the
end pot thank you bye
[Applause]
Oh