good afternoon everyone welcome to NOLA
con and Mike thank you for coming for my
talk I appreciate know Lacan for having
me down here to speak let me jump right
in want to start with giving a survey
I know it's first first talk we're just
getting started but I want some audience
participation here because the intention
of this talk is really to start a
conversation so when you hear the
question does DoD security work in the
real world how many people say yes one
to look you how many people say no good
bring a couple brave souls
I like discussion and lively debate how
many people just want to wait and hear
what I have to say about and how many of
us just want to be somewhere else right
now all right
the reason this question came about let
me start with that for about 10 years I
was in the PTI world as AK USA and I had
a customer probably it's probably been
almost late where should I not be that's
good okay I am now limited to where I
can play hey no I think I should be up
this one is that the other room all
right yeah
i'ma stand right here I had a customer
probably been almost 10 years ago we
were having a discussion one afternoon
about encryption the requirement in the
PCI data security standard that says if
you have data at rest you need to
protect it in some way and this was a
major retailer you've heard of them he's
probably shopped there they actually
were one of the companies that had been
a victim of a major breach back in the
late 2000s and being a retailer and
being only recently connected to the
Internet relatively recently they didn't
have a whole lot of security expertise
as you might imagine they didn't have a
lot of institutional knowledge so we
spent the better part of an afternoon
just kind of going through this
requirement and I was kind of explaining
to him what it all meant and you know
what it meant to do encryption and all
the other different options and at some
point in the discussion the person that
I was speaking to said to me yeah but we
don't need DoD level security because we
just sell women's clothing whatever it
was and that really has stuck with me
for most of the last 10 years because it
always kind of bothered me that this
person just kind of casually cast off
all this useful institutional knowledge
that I had about cryptography and
encryption and just kind of dismissed it
as yeah but we don't need DoD level
security anyway my name is Jeff man I'm
a co-host on security weekly if I look
familiar to some of you if any of you
watch security weekly I have done a few
things in my life I am considered a
curmudgeon at this point I've been doing
this for about 35 years I got my start
at NSA quite well you're about to learn
I didn't get my start at NSA but the
bulk of my DoD career was at NSA while I
was there I was a cryptologist which is
why I had fun spending an afternoon
talking about encryption and got out
about 20 years ago and I've been
consultant in the private sector ever
since started out as a pen tester doing
red teaming moved into a few other
things ended up doing TCI I called PCI
purgatory for about 10 years and the
last couple of years I was working for a
software vendor they brought me on as a
subject matter expert and they say go
out and start speaking accomplices you
know you're an old guy you knew a lot to
start teaching people and talking people
which is largely why I'm here
just a little you know 15 minutes of
fame thing has anybody heard of this
book it came out last year called dark
territory it's not it's available on
Amazon you can look it up and download
it now in this book that in the fourth
chapter which is titled eligible
receivers anybody know what eligible
receiver is or was you should go read
the book we'll find out
but in that chapter titled eligible
receiver there's a paragraph that says
the NSA had a similar group called the
red team it was part of the information
assurance Directorate blah
it was the defensive side of NSA it was
stationed at panics up near Friendship
Airport which for modern-day people was
BWI during its most sensitive drills the
red team worked out of a chamber called
the pit which was so secret I have to do
this dramatically that few people at NSA
knew it even existed and even they
couldn't enter without first passing
through to combination lock doors not
one that to you well I'm here to tell
you I was actually a member of the pit
the original first red team at NSA and
the pit was our all's it did have a door
that we had cubicles and desks and it
was just a government office but somehow
we've morphed into this legendary thing
called the pit so for what it's worth
you now can say you've met somebody from
the pit this is actual aerial footage
outside of friendship Airport otherwise
known as BWI and that building right
there that corner that's where our
office was that's where the pit was it
was really did exist it was an office
cubicle I shattered to death anyway I
share that a little bit to give you a
little bit of my background but also I
do want to say one of my early mentors
at NSA was this woman named Becky bass
if you've never heard of her
I encourage you to look her up she
actually just passed away back in March
rather suddenly her website infidel net
if you look that up it sort of become a
tribute site or the
people are putting up remembrances of
her there's actually a link I think
that's going there to an oral history
that was done
somebody interviewed her if you want to
get a really good glimpse of info Sikh
history am i blocking you completely
what I was seeing here sorry
I'll try to give you glimpses agree on
one really good history of InfoSec over
the last 25 30 years a lot of
involvement she was a mentor to many out
in the private sector especially
bringing women into InfoSec into the
technology community so probably for the
next year or so or at least the rest of
this year my talks are dedicated to her
we called her mom or info mom and she's
a one of the unsung nothing that's not
necessarily well known outside of the DC
Maryland area heroes of the impetus so
this is this talks for you Becky so my
career really started back in 1984 and
it didn't start at NSA I actually got a
job as a summer intern at a research
facility that at the time was called the
Naval Surface weapons center and this
was in white oak Maryland so I'm from
Maryland and my job was for the summer I
was hired by this guy that was a
physicist that did any submarine warfare
research and he had gotten ahold of some
money and was able to buy this kind of
newfangled thing called a desktop
computer and he bought some early
database software I want to say it was
debased too if any old-timers out there
remembered eBay's - and my job was
basically to go through this filing
cabinet that he had been collecting
research material probably over the span
of about 25 years most of his career
that he had just piled into this safe
this locking cabinet and he wanted me to
build a relational database where he
could start to capture some of the you
know the details that are in all the
different
girls he had and put it in a searchable
database I got the you know sort of my
first exposure to a personal computer
first exposure to database funny story
my first week on the job he was trying
to explain to me what an e submarine
warfare was so he handed me this book
and said you know this this book just
came out recently and it kind of
explains what we do as well as I could
so read it so I was just you know
college students summer intern working
for the government and the first week I
got to read a book I thought that was
really cool so unless you guys can see
it I might have to read it to you for so
where this story starts is one morning
my first exposure to security really is
I walked in I opened up this cabinet and
inside the drawer there was this pink
slip that said please come to the
Security office so I went to the
Security office and it turns out that I
had actually accidentally left the safe
unlocked the night before and I was
called I was busted and yeah I was a
young college kid and I thought well
what's the big deal you know we're you
know this is the 80s we're not at war
you know we're not actively fighting any
submarine warfare anywhere and you know
I'm at this facility that's got a fence
around it so nobody can just walk into
the campus there's there's a control at
the front desk where you have to go past
turnstiles you have to go through
security to get into the building I'm in
an office that's locked it's locked
overnight and there's guards to patrol
the the facility so what's the big deal
you know so I left the safe unlocked
that was my attitude then and just keep
that in the back your mind will bring
that up again
in a little while so a little bit of
background a little bit of a preamble to
what I want to try to convey today in
terms of just DoD security work in the
real world and again I intend this to be
a discussion starter I'm not here trying
to say I have the absolute and final
appeal
in on all things related to InfoSec but
if you're like me and you look at the
what's going on in the world today in
terms of security simply depress does it
seem like we're losing I get depressed a
lot
I'm not clinically depressed but I get
irritated that I've got 35 years of
experience and I try to teach people
about security and we somehow as a
community and as an industry don't seem
to be advancing things sometimes we
don't seem to be helping sometimes
because time and time again companies
are being confronted with issues and
breaches and problems so what I wanted
to do was and so having this no we don't
need DoD level security in the back of
my mind from this person that told me
this eight or nine years ago I wanted to
put together some thoughts and share it
with you guys again as a discussion
starter my first thought is in my
experience when I start talking to
people about DoD level security I think
a lot of people have the opinion
especially if you haven't worked for the
DoD but it's some ultra high super
secret super secure lots of Technology
lots of costs and expense it's this nth
degree of security I also like to throw
in movies slides to my talk so they may
know what that movie is from very good
in my experience when I was with the DoD
there were many facets to security there
were many different sub disciplines if
you will to security and I just tried to
capture a few and I tried to add a few I
googled I saw what new ones are out
there so I don't even know if I could
tell you what all of those things are
but and the government likes to
abbreviate abbreviate everything with
one syllable or two syllable words so
COMSEC is communication security that's
what it was called when I started NSA
the later became information security or
InfoSec OPSEC is operational security
emsac is a mission security you get the
Sigyn signals intelligence satellite
intelligence communications intelligence
and on and on and on and on
a lot of different disciplines a lot of
different things go into DoD security
but the way I was taught the way I was
classically trained was we learned this
risk equation and you know this is not
new I'm sure most of you have at least
heard of the risk equation if not you
know have worked with it or somewhat
familiar with it and you can see some of
the words in it that certainly is what
drives our security industry we're all
about vulnerabilities we're a little bit
about threats we're talking about risks
all the time but the basic risk equation
is you have this concept of if you're an
organization if you're an entity if
you're a country if you're the DoD the
military you're you have something that
is at risk there is some sort of risk to
you and that risk can be measured and
there's a thousand different algorithms
and calculations you can do none of them
are perfect so I just try to simplify it
but risk is some sort of combination of
the vulnerabilities that are present
within your environment the threats the
that are coming against your
organization and this is and this
combination is hopefully reduced by
whatever you do in terms of security
what we used to call countermeasures so
you know very simplistic algorithm very
simplistic equation but the idea is
you're trying to reduce risk lower risk
and you have three options you either
reduce vulnerabilities you reduce the
threat or you apply more countermeasures
makes sense right
as I was putting this together it
occurred to me the risk equation is it
applies to the DoD risk is almost often
in reference to human life whether it's
a branch of the military and you're
trying to determine what the risk of
deploying forces are if you know in
terms of national security it might be a
risk to citizens it might be a risk to
diplomats and
citizens that are deployed abroad so
essentially and I'm probably over
generalizing a little bit but
essentially risk in the sense of the DoD
in the sense of national security in the
sense of defense of our country can be
thought of mostly in terms of human life
and because of that the approach that I
learned to security in the DoD was not
not so much at all you know no costs you
know there was no limitation to budget
but it was sort of like that you know it
didn't matter what the cost was
associated with it didn't matter what
the budgets were we had to do security a
certain way we had to do security right
we had to do a security to a certain
degree and all those elements that I
showed you and more were involved in the
way I was taught the equation loner
abilities I asked I go to conferences
and trade shows all the time and
especially when I see vendors splashing
the big screens banners saying they do
vulnerability or they do threat I'll go
up and ask them what is the
vulnerability try it yourself sometimes
see what kind of different answers you
get or even better
what's a threat I was trained that
vulnerability is a weakness period leave
it at that don't get into details it's a
weakness threat the way I was trained is
the who that is trying to do something
bad to you but you go out and ask people
and maybe even some of you have you know
similar ideas but threat I think is most
often described in our industry is more
of what I used to or I was taught was a
threat agent its what the threat the who
is doing to you or how they're doing it
it's the thing that's happening which
I'm not trying to be picky uni I'm not
trying to nitpick but again the way I
was classically trained the threats or
the to it's not the weather the hell and
then finally the countermeasures are all
the things that you do to try to protect
yourself whether that's driving down
vulnerabilities or driving down threats
or other active corrective actions
whether it's monitoring whether it's
logging whether it's increased perimeter
security and again that's not not even
necessarily in the context of networks
but even in the context of physical
security applying more guards building a
bigger wall building a bigger sense
putting concertina wire on the top of
the fence and so on and so forth these
are all the things that are done to
protect against the threat and hopefully
reduce not necessarily who's doing it
Eve but their ability to do something -
and hopefully this is familiar to you as
well security often had to do with data
security communications in the specific
instance of NSA and we were classically
trained that but we you know what could
go wrong what you're trying to do with
protecting data boils down to three
different things confidentiality and
integrity and availability so you know
those should all these familiar concepts
these are not new things the the
internet and technology computer world
is is introduced a few more nuances to
these three but these are still the
three basic things most of what we do in
this industry drives back to one of
these three things with a few exceptions
my first office at NSA I was in the I
was on the defensive side and I was in
the office I was in the office that
produced one-time pads yes we were using
them in the 80s in fact I think we're
still using them somewhere today but I
don't quote me because I haven't worked
for the government in many years but if
you're not familiar with the one-time
pad the one-time pad is perfect
encryption so long as it's used properly
which is one time it is not
cryptographically solvable most of the
other cryptography that is involved
these days especially in our machine
computer networking world our machine
generated are computationally formulated
or algorithmically based which means
that although the numbers might be large
there is a cryptographic solution it can
be broken it can be solved given enough
time not so with the one-time pad
so my simplistic attitude having started
in that office is it's all been downhill
ever since we decided not to use a
one-time pad perfect encryption perfect
security we've given that up for speed
and convenience and the ability to
stream video and stuff like that so then
downhill from that so again getting back
to this concept we don't need DoD level
security some of the reasons that I've
seen why do D level security doesn't
seem to be sticking there doesn't seem
to be much interest in it are some of
these ideas and I think most importantly
is it it may very well be very expensive
it may just be simply a perception that
it's more expensive but certainly there
is a monetary cost to doing more than
than what you're doing in the near term
there's a lot of companies out there a
lot of organizations that I've worked
with over the years but just simply
didn't think they needed it you know we
sell shoes we sell underwears when Home
Depot was hacked a couple years ago the
CEO was literally on record as saying we
don't care about security we sell
cameras yeah so it's real there's a lot
of attitudes out there like why do we
need to bother with all this security a
lot of these companies until they got on
the Internet they really didn't have to
worry about security in the sense of
networking security internet security
all this stuff that we're doing these
days and that's legitimate to some point
they didn't need to but they're they're
in a connected world and I've always
argued with my customers that you know
there's a price to all that convenience
that you're getting especially in the
credit card world how many people are
old enough to remember using a credit
card back in the days when the clerk
that was accepting your card would pull
out a little brochure or magazine and
flip through it to look up and see if
your card was listed say maybe remember
that year old year old hero
more recently it would be you submit
your credit card that bring out the cash
register they turn around pick up the
telephone dial an 800 number and wait
for an operator and they would read off
the transaction information you know the
amount the credit card number they wait
for the authorization anybody remember
that yeah how long did that typically
take 3 minutes 5 minutes 8 minutes 10
minutes whereas nowadays you walked up
well chip chip and signature
notwithstanding because that thing's a
bear but you swipe your card a few
seconds later you've got the
authorization and you're out so now
we've regressed in using the chips which
I don't understand but that another
story for another day the point I try to
make to these companies over the years
is you know how many how many people are
you moving through the line how more
quickly how many more transactions how
much more revenue are you earning
because you're not doing that you know 3
to 5 to 8 to 10 minute process you've
turned it into a 15-second 30-second
process they get that they understand
the dollars and cents and then I say
okay well that comes at a cost and one
of the cost is you need to do security
sometimes it works sometimes it doesn't
the point is they don't have it as a
background so part of sort of winning
this this this thing that we're in of
trying to make companies more secure is
trying to help them understand the
impact of security there's a need to do
security and it generally boils down to
especially in the commercial world of
financial discussion if you haven't
guessed already you know my response to
just you you know we really don't need
do any level security and I'm like yeah
you really do I even updated it up to
the minute and I'm not even sure what to
tell people that are dealing with
malware but hopefully we can discuss
that but and in fact
I may know what the wireless password is
for this hotel it's up there on the
screen but I'm at that hotel I mean not
to use my credit card here anywhere
especially down at the bar cache home
anyway lots of companies continue to be
getting breached companies that you
wouldn't expect you know government
private sector or whatever even security
companies it just seems to be going on
and on and on target was interesting
because in the PCI world the last PCI
organization I was working for we were
actually negotiating to be the Assessors
for target and they actually had a
really good reputation for having a
security staff a rather large security
staff they has invested in the
technology they were doing all the right
things or taking security and standards
seriously and they got popped in an
egregious way and it turns out that they
were missing a few things and I think
some of the things that they were
missing goes back to the point that I'm
hoping to make is there's something
missing when you don't sort of have this
mindset this attitude about security so
let's move on
why I think networks are insecure why I
think organizations continue to lose
continue to be breached is because
essentially too often especially in the
commercial world companies want to fast
forward to the bottom line just tell me
what do I have to buy where do I need to
put it how much is it going to cost and
then they make their decision they kind
of skip over the classical things that I
and others that have come from the
military
the DoD have tried to teach over the
years and some degree are our industry
has tried to teach is that you know you
need to put processes in place you need
to have some sort of policy or program
you need to have some organization and
sense of what you're trying to
accomplish and they're like a yeah yeah
yeah that's boring tell me what I need
to buy you tell me where I need to put
it so lots of different reasons and but
they boil up I think to a couple
different categories
and if we're honest with ourselves in
our industry I don't think we've helped
a whole lot and I'm not saying us
individually but you know it's a whole
lot easier if you're in sales and
marketing for a security vendor to just
you know write up the sale how many of
you need I think you need six this is
how much you know it'll cost how many
can I put you down for rather than walk
through that complicated discussion or I
was a consultant for many years it's a
whole lot easier to buy a product than
it is to buy a consulting engagement
where you end up with a written report
where in theory some of the people that
are your customer already knew what
you're going to tell them in fact very
often as a as a consultant I would go in
and say to certain people even in even
in the PCI times what are you telling
your management that they're not hearing
because especially with PCI is that I've
got this cool tape that I where it says
PCI and your management will listen
because if it gets labeled PCI they're
going to do it they're going to write
the check just to make it go away that
was one of the ways I was able to win
win friends with IT and information
security people but but it's not about
the customers it's about us
again using PCI as an example roughly
99% of the companies in the world that
have to do PCI don't talk to a qsa and
yet the whole piece of PCI ecosystem is
hinged on the security expert being the
qsa and if you have a question ask York
USA if you're not sure of something if
you need an interpretation if you need a
risk-based conclusion drawn ask you qsa
that's great if you're engaged with the
qsa but literally 99% of the companies
out there don't talk to a qsa who are
they left to talk to vendors vendors in
case you haven't figured it out yet lie
vendors and I used to say that all the
time and I've learned having worked for
a vendor that they're not always
shamelessly lying sometimes they're just
ignorant and unaware and they don't know
anything more than the customer so
they're just spouting off the buzzwords
the marketing pitches and fire personas
in the use cases there's this collective
lack of understanding and knowledge in
what why are we doing this what's this
all about
and that's I guess what I'm trying to
hammer home more than anything so just a
few lessons of what I think we can do in
terms of looking at DoD level security
there's probably more and again feel
free to disagree with me but these are
some areas that I've thought about that
I think we've sort of skipped or omitted
or not emphasized enough as we try to do
this thing we call InfoSec in today's
world movie very good and there's the
proof they're actually sitting on a
crazy supercomputer which the one I used
to use at NSA is now in the NSA
Cryptologic Museum
so that's ancient technology that it
used to rock because it was so fast that
anyway the point of the movie sneakers
the the point of this conversation that
the protagonist and the antagonist are
having is that the the world is at war
paraphrasing and the war is not being
fought with bullets it's being fought
with data it's all about the information
and I think that's true today as it's
been for for decades the battles that
were fighting the war that we're
fighting it's all about the information
and yet too often especially in the
commercial world we're not focused on
the very thing that we're trying to
protect we focus on the technology that
we think is being used to how store
transmit the data that we're trying to
protect
and that's nuance and it might be
nitpicky but I think it's significant
gap when the focus is so often on the
technology and not on what's on the
technology that we might be interested
in so disagree or agree with me but that
is that that's what I'm putting forth to
you guys
so in terms of the risk equation when I
think of the risk equation in the
commercial world what immediately gets
added to this equation is money risk as
I said in the dod in terms of national
security can be expressed in human life
the risk in the in the real world is
really dollars and cents it really boils
down to money how much money you're
standing to lose how much money do you
you know are you comfortable with being
find what are the liabilities if you do
or don't do certain things and then of
course to try to reduce your
vulnerabilities costs money to try to do
something about your threats costs money
all the countermeasures that we do
counts money but because it's all about
data what I'm proposing is you need to
understand the value of the data that
you're trying to protect in the DoD in
the military and the government there's
this concept of data classification not
a new concept a lot of companies
understand this and they know that they
have to do it because of whatever
regulatory standard but in the DoD there
is a big difference between secret top
secret confidential these are these were
very distinct classifications that had
very distinct differences in terms of
data handling data storage data
retention that aren't in my experience
matched in the commercial world more
often than not when I've been out at a
customer site and they are required to
do data classification it's sort of
binary it's company confidential or
unclassified we don't care about it and
so they could have lots of different
types of data that they care about but
they just kind of lump it into one
category in the government the best way
that I can give you an analogy I'm just
going to talk about it because I don't
have the picture is in the way that it
was explained to me and especially in
terms of sort of the life expected
the value of data in terms of how long
it's it's valuable data was top-secret
information that has to be protected
forever most often what is secret about
this and gosh this might have been in
the news in the last couple days or
weeks so think about this as you as you
listen to media reports top-secret
information very often is classified at
that level not because of the data
itself but because of how that data was
obtained what we call methods and
sources it's who knows that data how
many people in the world know that data
and and or how was that data conveyed in
what circumstance you know sometimes it
might be a conversation between two or
three people inside a conference room in
a certain building in a certain
nation-state that is in ours and if it
was revealed that that information was
known by us you would make the logical
conclusion of one or two things either
the room was bugged or somebody in that
room as an agent is a spy so in the old
days very often if that information was
discovered and they didn't find bugs
people ended up missing so again it was
a human life thing so the top-secret
concept is again more often the methods
and sources how the information is a
tape now another example might be secret
information again the analogy that I was
given when I was learning this was think
of a battlefield and and you've got a
unit that's being pinned down by enemy
gunfire there's a machine-gun nest
there's mortar fire and so they want to
call in an airstrike it's critical when
they're calling in that airstrike to
give the right coordinates and back in
those days it was latitude and longitude
nowadays I'm sure they use GPS and we
got the drones and everything but you
know think Korea think Vietnam thank you
early early things in the desert you
call in an airstrike it's really really
important that you get the coordinates
right so the bombs are dropping on the
bag
or the drones hitting the bad guy but 30
minutes later once the airstrike has
come in the fact that you were standing
out there is a coordinates it's not
really that important so the life
expectancy is very short and that drives
down the classification my point of all
that is we don't really in the
commercial world spend a whole lot of
time distinguishing data and figuring
out what the value is what the value is
in terms of confidentiality integrity
and availability we tend to just blanket
everything we've got to protect the
whole network but we got to protect
everything at the same degree at the to
whatever degree we think is appropriate
we got to eliminate all the
vulnerabilities without understanding
that this server over here of course
it's now in the cloud has vital research
and development data that's under
government contract and it's vital to
national security interests versus
payroll pirard for our employees versus
customer information that were
collecting different types of data
different types of sensitivities
criticality different types of values
and yet we don't in the commercial world
seem to quote seem to divide and conquer
and understand what it is we're
protecting we just do this blanket the
network needs to be secure and it's not
it's bad gluten do another concept is
what used to be called security and
depth we would call it more likely
segmentation or isolation in today's
networking world but this is an aerial
photograph of a city that was
constructed in the 1500s you know so the
idea of layered protection is not new
this goes back 500 years but I mean if
you think about when were the first
castles with moats built the idea of you
know layers of protection is thousands
of years old and it's really a military
construct it's a military strategy for
warfare that we've applied to the
network is that good or bad
I don't know but
this is a typical Network at least a
couple years ago for one of my PCI
customers that we're trying to go
through the idea of segmentation because
they knew if they could isolate the
systems that had the credit card data
they'd only have to follow the security
rules for those systems and not worry
about everything else which I personally
think some bad idea but you know so this
was the typical you know back-end data
center operations office environment a
couple versions of their retail location
and the red circles were the the systems
that were deemed to be housing or
storing or processing credit card
information that doesn't look a whole
lot like that to me and that these days
are now a lot of those environments are
virtualized a lot of those environments
are cloud-based a lot of the
infrastructure is going to the cloud so
this whole idea of layered protection I
think it's maybe gone it's certainly
hard to figure it out but I do agree
that there's this idea of adding layers
of security to your most sensitive data
the way we were taught was for the
security of some systems or some data it
wasn't so much as the layers of
protection so a bad guy could never get
to it it was make it more trouble than
it's worth
you know make it more expensive for the
bad guy and for us the bad guy was other
nation states to to to bother was trying
to get at this particular set of data
this particular set of information we
actually used to evaluate systems so
they worked on the defensive side we
would evaluate the security of systems
based on the projected cost of what it
would take to break the system because
it's machine made so it's
computationally feasible we would
calculate the cost and compare that to
the what used to be the GNP which is now
usually the GDP which is how you measure
the economic wealth of a country which
again is another discussion used to be
GNP we would calculate it as against a
certain nation-states G
NP and say are they going to spend that
money much money to try to get to this
data yes or no if the answer was no we
were done move on was a necessarily
perfect security it was more expensive
than what it was worth and that was
sometimes applying layers of security
the biggest thing though is the upon
reflection back to my beginning days of
being involved in the government was as
I looked back I realized when I went to
work for this this research facility
back in the 80s that there was this
culture of security and while there was
perimeter fences there was also other
processes and things associated with the
perimeter fencing you know like barbed
wire like cameras like a roving guard
the the front desk it seemed kind of
silly at times but at various times over
the years if there was a guard at the
desk they were supposed to be looking at
your picture badge and you know we would
you know various facilities I work for
we would occasionally try to get by with
each other's badge to see if the guard
was paying attention and sometimes it
works and sometimes it didn't and more
often it works so various times you have
heightened security DEFCON three or four
or five the guards were required to
touch the badge to make sure that they
were really touching it in hopes that
they were looking at it more carefully
but then the guards would get the I
think they would rip them off a radio
these telescoping antenna things wands
pointers so they could reach out and
touch the badge because they didn't want
to move from their spot but there was
also strategies employed where the
guards were rotated all the time because
they wanted to prevent somebody saying
hey Joe come on in I've seen you every
day for the last you know 16 years
come on in not knowing you'd been fired
the day before there were layers that
our strategies there was processes with
each step along the way you know
changing the locks on the doors
periodically making it a longer
combination that type of thing having
the guards roaming the halls everything
was a culture of security but more
important than all the processes
imperson
everybody understood the mission because
the mission of the organization in and
of itself was security which I grant you
doesn't exist often in the commercial
world but I think and I'm hopeful that
it's something that can be taught and
something that can be trained to more
companies is to have this attitude this
mindset of you know we're in business
yes we sell women's clothing but we're
selling women's clothing in a connected
world and we deal in certain type of
information between our company and our
customers that has value and we need to
understand that value and understand it
needs to be protected and protected in a
in a manner that's appropriate for
whatever risk we want to take given the
liabilities given the limitations given
our you know our bottom line or budgets
and so forth but you know more than just
you know taking the 30 minute security
awareness training course once a year
and snickering at the stupid video that
you watched as somebody you know went
out and bought some new and then anybody
produces these things I apologize I've
had to I've had to evaluate a lot of
these security awareness training
courses over the year and I take them as
often as possible and you know they just
seem to be people that are like you know
they're very much focused on the
creativity this time we're going to do a
video this time we're going to do
pictures of Papa this time we're going
to slide from the right and fly from the
left rather than providing any type of
meaningful content yes
no actually we'll get to that we'll get
to that hold up up building a culture of
security having everybody in the company
understand that security is important
and what they do and what they don't do
has something to do with security
understanding the security is a life
cycle it's something that you do it's
not just a set and forget it's not plug
in a box and puts particular settings on
it and walk away and think you're done
this is a slide that I used 20 years ago
when I came out of the DoD trying to
teach companies in the commercial world
that there's this thing called security
and it's a life cycle and
processes involved and we used to talk
about these processes of course we were
trying to sell a pen test so we started
with the assessing where are you you've
just plugged into the internet that you
have this existing network let's find
all your holes let's figure out it was
really a vulnerability assessment and we
will talk about once we've discovered it
how do you fix it how do you close your
holes how do you implement programs and
policies and procedures so it all works
and you architect and implement these
solutions you put in firewalls and IDs
and whatever and then at some point
you've got to measure it and see how
well you're doing and then it's you know
lather rinse and repeat we used to talk
about this cycle in terms of like a
three to five year process this process
still exists every company is in the
midst of this process but the process
these days I think it's sometimes months
if not weeks if not days you know I
think of the next o day that comes out
and and how fast you need to be able to
respond to it and adapt to it
but companies for the most part in the
commercial world aren't cycled so thank
security there cycle to think money
revenue bottom line it's not part of the
culture it's not built into the fabric
of the company you know there's been
attempts by the government to put out
you know frameworks and various
standards the new cybersecurity
framework being one of the recent ones
notice that there's at least I see
there's a lot of similarities between
what they're putting out in terms of
sort of the major steps the major
processes and what we were talking about
20-25 years ago variations on a theme
but there's a process involved and
that's what is largely trying to be
taught you need to know where you are
you need to have policies and strategies
you need to have this culture of
security built in the companies and we
as practitioners it's not for our own
company if we're in a in a role where we
talk to other companies as customers we
need to teach this we need to we need to
hammer this home we need to build this
in because I think this is more than any
technical solution any strategy any any
new box or widget or blinky thing that
you put out there is what's really going
to make a diff
ultimately and I'm a dying breed and you
can disagree with me but that's sort of
my last my last stance the DoD and they
know what this is it's called the
rainbow Siri a very comprehensive series
of guides that were put out the first
one was the orange book which I think
was published in 83 which was how to
secure a computer on a network and very
detailed very granular every aspect
every pop thing you could possibly think
of everybody that used to have to deal
with it last because it was very
comprehensive but everybody conceded
nobody's ever going to be able to do
this because there's just too much here
and that's when it was just four or five
of them I don't even know what all of
those are but as new technologies
emerged another guide was produced so
the DoD gave us that but and I apologize
you can't see this I saw this on
LinkedIn
probably two months ago somebody mapped
it out you can find it if you google see
so mind map these are all the
disciplines sort of the major areas and
all the detailed things that a fifo is
supposed to know in order to be able to
do his job in today's modern
organization and I would submit to you
that all that fine print you can't
really read but if you google it later
you'll be able to find the details
probably 95% of those are tied to a
specific technology product which again
I think is missing the point when all
you do is know how to throw different
technology at this problem this is
another example that I saw somebody
attempted to come up with all the
different domains that there are and our
business and they try to group them and
organize them so you know the message
here is there's a lot to learn there's a
lot to know there's a lot of stuff going
on and yet if my belief is if you're
taking a completely technology centric
approach to all this and you're not
stepping into it with some sort of
overarching understanding of what you're
trying to do what you're trying to
accomplish you ultimately will lose
because I think we can agree we're never
going to protect there
we think I think we can agree we're
never going to drive the vulnerability
count down to zero there's always going
to be vulnerabilities out there so maybe
just maybe we should stop focusing on
the vulnerability it's not saying do
away with them not saying stop
addressing them as we find them out but
maybe we need to focus elsewhere too
like on the countermeasures you've
probably heard of this mantra in our
industry that security is really about
people processes and Technology is a
three-pronged approach I submit to you
that in terms of understanding the
culture that there's this idea of
purpose you know for the DoD it was the
mission to do security and while that's
not the mission of most companies in the
commercial world it needs to be a part
of the mission it needs to be understood
that the security is part of we sell
shoes it's security is a part of we sell
hammers inappropriate part not overboard
not overdone but there is an appropriate
way to approach that so keep in mind
it's all about the information is all
about the data with few exceptions
that's still true today it always will
be technology I don't believe is the
solution
I think technology's really the problem
I think we're losing ground frankly the
way technology is advanced and the more
we don't have the foundational
principles and processes built in the
the further behind we get whether we're
organizations whether we're
practitioners remember security is not
some place that you get to it's a
lifestyle
I say it's a verb it's something you do
and I think you can hold me to it but I
didn't say that word once did I in this
presentation knowledge and awareness is
key so to answer your question just a
quick word about the company that's
sponsoring the company called cyber arey
they've been around for about a year and
a half now they are dedicated to
providing open source learning and
training in the area of information
security you can sign up for free you
can take hours and hours of free
training there's lots of
pre-certification things you can do they
have things that you do pay for like
various
and detailed stuff that I think for at a
personal level it's like maybe nine
dollars a month you know something
something around $100 a year you can get
lots and lots of training they have they
just celebrated last week hitting the
million subscriber mark so they've got a
million people that are signed up taking
pre training you know going all the way
back to the beginning you know when I
said this talk was dedicated to my
mentor Becky dates those of us that are
commands we sort of agreed that you know
trying to back fill the void that is
left with the passing and Becky base
it's very difficult but all of us need
to do our part so you know we that are
sort of the old-timers and the
gatekeepers of all this institutional
knowledge we're committed to sharing
that knowledge with the community as
much as possible it's one of the reasons
why I come out and speak I've got a head
full of sometimes my wife thinks useless
knowledge but I want to share it with
you because security is this this huge
nebulous thing that needs to be
understood beyond all the fun technology
things that we do and all the fun
hacking things we do and I'm convinced
more than anything at the end of the
week at the end of the day at the end of
our existence knowledge is the only way
that we're ever going to really advance
this thing forward so to answer your
question has I seen great training good
training hmm look there you might find
something that's pretty decent in fact
I've got a course up there that was put
up there I teach a course at cyber a on
effective communication skill because
I've heard a lot of people at these cons
over the years talking about knowing all
the answers and I keep thinking if you
know the answer and you're working for a
company that's got an issue and you're
not getting the point across to them
maybe you're the problem and maybe the
problem is you're not communicating it
well so I took my 20 years of consulting
knowledge and wrapped it into a course
that's hopefully a little bit humorous I
got to wear my Jedi Master costume for
the whole thing they thought it was cool
I didn't think I'd get away with it but
they let me do it
so if nothing else go check out my
course
I have no idea what we're doing on time
but is there time for questions or
comments as I see people walking in
comments questions pushback yes yes I
can try you want the first one or the
second one good it's very good great
question a layer that I didn't add for
simplicity's sake but yeah basically
when I was taught risk equation in the
DoD it was there was always two versions
considered one was the likelihood that
something was going to be attacked so
the likelihood of compromise and the
second was the likelihood of success if
somebody were to try to you know do
something to this what would what what's
the likelihood that they would succeed
so you know when we were trying to map
this out and you know I could I could
geek out and probably do it maybe I will
do a talk on the risk equation someday
but we kind of mapped it out in a
Foursquare which I kind of refused to do
because there's a certain company that I
don't like the misuses for squares we
won't get into that so yeah it risk risk
can be very complicated and it's very
nebulous but when you're talking to
c-level people with an organization and
you start talking dollars and cents
that's usually when they can start
paying attention so I just you know one
of my Jedi mind trick is to just
simplify you know break it down because
a lot of people get caught up in the
minutiae in details and most people
don't understand don't care just what's
the bottom line any other questions or
comments
so the question for the recording is you
know there's something in the news this
week with NATO talking about
anti-submarine warfare that that's back
in the news again
submarines carry nukes so that's I'm not
familiar with the details but my guess
is it's because some submarines carrying
nukes that they're in the news again
with the people in the room I'm thinking
my time is up so thank you everyone and
enjoy your conference as long as well
and I've got stickers if you want them
I've got some strawberry stickers and
some security weekly hack naked stickers
up here