one again one so well they're just left
I was gonna start by just saying that we
make thank you to the organising
committee and all the volunteers for for
setting this up I'll be looking at the
schedule and I'm blown away I don't know
what tractor sitting I'm gonna probably
be running between them much like I
imagine quite a few of you as well so
yeah I think thanks that and I think
maybe we can speak so this is the first
time I'm doing this particular talk so
it completely interesting to see laughs
so how many people have actually heard a
synopsis
oh that's impressive Oh excellent
so about three years ago we were at
thinking it was InfoSec in London and
people literally have no idea why
synopsis there who are you what are you
doing here thank you and actually
historically synopsis we're a hardware
company so what does that mean well if
you have my phone and iPad or any other
kind of electronic device and it has
like Bluetooth or USB or anything like
that chances are that the that the
vendor the creator of this device has
either used snotter's tooling or
software to create the designs and
schematics no thing or they've even used
some IP we have a bunch of patterns in
hardware design and implementation and
so that's where most of synopsis
actually says there's about 10,000
people of them on the company and we've
got the fourth has a lot of people in
the software and technical group now
synopsis other down this software take a
group a few years back essentially
through about acquiring companies so
it's not off with the medical Coverity
many people have clarity people make
sense of staff analysis tool when you
C++ and then we wonder for your
company's code nomicon fantastic bunch
of guys finish setting up an older in
northern Finland which pretty sure is
about minus 20 degrees at the moment
[Music]
they came up with a while they label
tool which is now called the fence X
today was called something else at the
time that they were once 2008 in TMS
Stan n three years ago they're quite a
complicated tool which is where I'm from
as well as a few people come see us
office we basically a suitable that
benign for our twenty five years doing
purely software security consulting so
we are consultants we do lots of
software's Qt stuff we don't have any
products present but all the other bits
they've got acquired what products as
well and then my book which some of you
might have heard of it's basically a
tool that you points that source code
where you pointed at a binary and it can
tell you what open-source components are
in there
and so you know are you in trouble
licensing wise or rather there are using
our to make versions than that and stuff
so from a consulting point of view we do
more security activities we don't just
be contestant and a bit about that in a
second we are down in the Gold Sponsor
area do come check us out speak to us
all very nice people all most of us want
to be there coffee this mean victory
marketing slight worry elimination
flowers specifically because you asked
me to mention flowers because it is your
favorite part about product platform so
yet we have women do products as I said
Coverity blacktop defense and so on I'm
actually that were building a platform
at them so we're putting more together
as one unified thing on that we have a
lot of services so you'll see we've got
a bunch of sort of testing security
testing services that we do which is
what in my team do behind
we have to do something what kind of
strategic proactive software security
things if you haven't heard of Beeson go
to be simcom it's a it's a science
experiment that would have been crazy we
we lost over 200 companies what they
actually do as per the software skills
program and we've built a kind of
statistical model out of what we heard
so anyway enough of the marketing oh my
that's a really big version of my face
so so I'm the head of the software
security consulting the organization for
the Nordics and Benelux in other words I
focus on Scandinavia Belgium Netherlands
Luxembourg that Canaria why do I have
that region well I grew up in Norway in
Bergen
so I can speak Norwegian in theory at
least that's that's you know that's one
of those things you never currently when
you see me that you're not willing to
back up well yeah when we got a quiet
way synopsis that they have a sales team
already in the Nordics who were doing
really well they got lots of customers
and they got me the assessment services
you know we would win an entirely
different kind of thing to the portfolio
so they were like Nick you speak the
leeches yes okay you have to go with us
to these meetings okay cool so I flew
over to Norway and certainly much of
customer meetings and the first customer
meeting that I was in where they decided
we have to do this in the region itself
kind of early enteral spiel and then
said Nick is gonna talk about Sean was
guilty net of you and that's the point I
remembered that I hadn't spoken in the
region on a day-to-day basis for 19
years
and also how do you say static analysis
security testing in The Witcher so that
was fun meeting
I've lived in Seattle in the US for a
while I got a high my company almost
straight out of university actually a
chemical found stone which got acquired
by McAfee which got acquired by Intel
and I did a bunch of assessing for them
it's over five years when I met my
lovely wife and I went monden so yeah
I've been a consultant for about 14
years I started off in penetration
testing all of it has so much fun broken
country stuff learnt a lot and then
having done that for a few years moved
back to London still is about McAfee to
help them build that consulting business
in New York and I sort of got dragged
into incident respond so much so he had
a lot of customers in McAfee customers
who kept getting hacked that's not a
comment on the product it's just you
know people get act and so we would sort
of parachuted in and I was just meant to
be a project manager and all of a sudden
that was on a plane you know ten hours
notice two women from countries in the
Middle East saying hi honey
yeah I'm off to a country in the Middle
East yeah don't actually know how I'm
coming back
four weeks later it was my record so
wasn't my favorite activity but it was
really exciting really interesting
another plot how much training and then
when I got on bisexual about five years
ago I got really into software security
and that's where sort of love being here
since go a bachelor's in computer
science from Exeter University
I've got master's in information
security from Huawei anyone heard of
that program and one big to that program
oh okay one thing one thing they don't
have is this which is fantastic you know
if they could organize a conference than
the body they couldn't do this off so
kudos to us yeah there's my email
address if you wanna follow me on
Twitter and I usually just remount about
cycling so but sometimes I post about
security
okay so let's first talking about
history so I'm going to sort of talking
about software development and security
and how for a very long time now they've
sort of not been very good friends they
haven't played well together and so I'm
gonna talk a bit about what's happened
what's happening and what compare what
I'm sort of seeing what we're seeing
kind of happening with a lot of
customers and sort of I've got some I
call them career suggestions but in
other word they were like humble
requests to come join us in in helping
companies develop our software so in the
beginning this is kind of how software
that what happens it's a really boring
slide it's meant to be you know
whichever kind of development process
you you follow this usually these kind
of find five steps may be complex or
depending so you've got unit
requirements analysis you build a big
list of everything you want the software
to do and then once you've got that you
go into design mode we design the
software to figure out okay plaid to to
make it do all those things needed to
look like this then you write the code
and then you test the code and then you
know in theory everything works we ship
it now what I've just described is
essentially the old classic waterfall
it's very linear you do all your
requirements analysis you draw a line
under it
there you go quite an hour working in
design and you can't change the
requirements in theory but you have to
and then you fight their families a
design you draw a line under it and then
you start implementing and you can't
change the design in theory but you have
to because you're about halfway through
writing the software and you realize oh
we forgot about the requirement about
usually security or something so now
we're going to go back to a cornice
analysis well how do we do that in a
linear process it's really expensive
it's really hard and so what of all
wasn't the best kind of model for this
at least one skill point of view so
there are more modern ways of
approaching this
that pretty much nobody uses pure
waterfall these days when they do
software buttons usually some agile and
scrum some CI city some demos and
wonderful things so they basically all
have the same components but they happen
in a different way so you let the scrum
also a sprint is usually a two-week
sprinter or something like that and so
you can't do all this you can't build an
entire per 2 weeks way to fly but when
you do is you pick a few the clients of
you user stories you try to limit that
as you're weeks and then the next two
weeks you repeat twice knowledge because
there's different ways of doing it each
rating these things but fundamentally
you're dealing with the same kind of
activities so yeah fixing problems
coming expensive still is so something
happened with the line that sees
everyone you know smashing a stack for
fun and profit
yeah excellent okay if you had already
got rid of it it is from 96
I think remember it's just been outdated
but the concepts are really well
explained really straightforward they're
talking by this guy called a loved one
or a Eli Levy and basically he's
describing you know in a seed program
you've got memory space and the
development is expected to only put
stuff into the memory space it's kind of
fitting well what if I put more in what
if I try pill more into that memory
space then the developer expected to
well things happen fun things happen so
the developers have had this inherent
assumption that people and systems etc
will use my software on my system the
way I intended to be used it turns out
you had hackers crackers fakers the RAND
Corporation military they all thought a
little bit differently they thought no
what can I make the software do on the
system do that it wasn't intended to do
how can I break it well how can I make
it
other things than what the girl expected
now this didn't come up in the nineties
like hacking penetration testing actual
penetration testing started its life in
the like the 1960s but something else
changed in the nineties so you know
stuff like frack got published and also
the internet happened so 395 issue not
all people on the internet you know
polish on the dial up modem this is a
see some way here in the audience you
you had the dial-up modems so a few
things happen you know the incident
became a really democratizing force not
just for your consumers but also clear
hackers and people who want to kind of
mess with systems so you have more
people messing with more systems so you
have more attackers even more tax
happening and you had a bigger attack
surface a lot of systems that were never
designed to speak to the outside world
speaking to the outside world by the
internet and yes but there was a lot of
kind of new new challenges for
developers the problems from developers
was they ten people you have less money
they were more shorter timelines and two
certainly something like in key skills
as well especially the security so
you've got the you've got this dichotomy
of lots more people looking at your
systems and you've got less time to
secure so you got this race between the
makers and the workers the developers
they're trying to cope with a scary new
world and you go ahead from that hackers
penetration testers etc you know
developing new capabilities new tools
new attack methodologies or methods new
pen testing methodologies we even have
delicious now we have that people have
to take it seriously and ID security
traditionally many network by the
infrastructure oriented
their response was very much along the
lines of it's okay we've got fire it's
fine
nothing bad will happen so a good
example of that was yeah well back when
I was doing instant response I got
dragged into one case where a company
clearly bleeding they've got but people
on the inside of the network and so the
first thing we did was we stopped the
bleeding we figured out okay have plug
the holes okay what happened let's look
at your a firewall Odyssey intrusion
detection logs and so on oh yeah
actually intrusion detection labs
they've got this alert this thing keeps
yelling at us about this thing but it
must be a false positive it can't
possibly be so why kind of be real well
because in with the the signatures in
the intrusion detection system you know
that the rules they were written at some
point in the rule will be time stamped
when it was written and this particular
rule that was in their system was within
ten years ago so can't possibly reveal
because they are me up today all the
windows patches so you know really old
rule triggering it must be a false
positive as I look at which rule is this
it's called a sequel injection right
okay so someone's been hammering your
front and website with sequel injection
that your intrusion detection system is
being young at you but you thought it
was a false positive
yeah okay turns out it wasn't a false
positive and what the family clean up
now these guys were really good at their
jobs they would have an Operations
Center people they were very good at
maintaining a secure Network and
patching systems but they didn't really
know much about application security so
they didn't know what sequel injection
was so you know it's fine we have a
firewall they it's not fine
meanwhile they've barely to thousands a
few things happened around what kind of
software security the kind of thing so
Bill Gates and Microsoft puts out a memo
I think every year
used to put out in that way every year
in one year that means met the tidal
wave I think was called then one year in
2002 it was trustworthy computing not
totally they hear very much these days
at the time who's the new thing from
exomes and they'll spit out this thing
called the secure about the lifecycle
they published a book and it's basically
how Microsoft wanted to do software
development with security baked in and
to some extent they did that for some
things and lots of other companies about
the book thought all this is brilliant
there are so many good ideas in here
let's use it at the same time or some
some clever guys there's a company
called suit all published a book called
software security and then there we
about the authors Gary Micco sending
Biggers and John Stevens and a few
others how did you yeah Pat go pack up
with some content in this as well if he
if you hadn't met Paco Paco used to be
as digital have a chat with him at some
point he left us the traitor he's now at
AWS but he's doing fantastic work there
well anyway so we put into the console
movies touch points you know in Salford
well that you have these activities well
for each of these kind of stages no
qualms analysis design etc there's
things you've the security things we can
do for each of them so that's that's
come up these touch points where we talk
about reaching these stages well to do
almost kind of thing around about them
as well and has now attended to it won't
be nearby fantastic organization with a
lot company a lot some really good
material you know if you're into you
know they're not just web start now and
they've got they've got mobile stuff etc
and I content for both you know if you
doing security testing how to do it
really good if you're a developer also
what's the problem with it sequel
injection cross-site scripting and so on
they got some really good video in there
as well okay so
so we had some few different ideas about
how to introduce security into software
development what did that look like well
everyone started with penetration
testing because everyone knew what it
was it was a it was a pretty cool effect
so we've got a bunch of applications
there how to live in the in the great
big world what can we do to them well we
can do a penetration test okay let's go
can test our systems or applications wow
that is a lot of bugs well I guess we
add those to the backlog so we had a
pile of security issues that we ended up
with but the problem is that these
applications were already like they're
already in production that's a bad date
we know that the holes and so how do we
fix them so okay how can we make sure
that we find these bugs before it goes
into production well let's let's do
let's do penetration testing before it
goes into production in a lot of
organizations what ended up happening
was you did penetration testing about
two weeks before you meant to go into
production thing is the penetration test
takes a week or two weeks all depending
you find some problems and then the
developer fixes them magically overnight
by just before at least that's yeah that
didn't really happen so what you ended
up with was we ended up with more a
bigger bug pile you need to have had but
it was still another production because
you have to mr. sesame oh well we can't
stop the release so big a pile still
doing pen testing okay well how can we
do things earlier let's do code than you
so let's look at the actual source code
and see if we can identify as security
bugs cool this is really boring to do
manually so the people invented tools
one of the first tools there for
security was called 80s for which was
development
one guy's assistants a while back it's
kind of a concept and if I know my
history correctly basically it's kind of
the case so well we're not going to do
much with it but it's a really cool
concept let's give it some venture
capitalists and they'll turn it into
something and they turn it into this
thing called fortify which became quite
big and I'm sure someone in our company
was kicking themselves a bit for you
know letting someone else one with it
because we probably could have you know
made it kind of a success as well but
yeah lots of tools out there looking for
bugs in your source code so we're adding
into the bug bottle we're still not
addressing okay well when are we gonna
fix it and how it must stop increasing
the book part so this is kind of what
maybe some organizations would consider
so they a secure software lifecycle
you're doing a bunch of different things
throughout the lifecycle so when you're
doing the climate analysis you make sure
that you come up with your securing
comments you come up with abuse cases or
tax stories or whatever you want to call
them and you do some sort of risk
analysis we know okay well these you
know in this application I'm going to
talk to the internet and it's gonna be
handling credit card data
okay well that in bolsillo risks so
let's let's address those early so let's
come up with some Aquinas to try and
mitigate those risks then when we're
doing architecture design we if ever
blame any people different mine okay
fantastic
so you'd essentially you look at the
design the application and you say great
now as an attacker I want to get to the
crown jewels within the system how can I
get to them
perspective are there other security
controls are missing or are there
security controls that aren't up to
scratch can I get around them somehow
and then we do risk analysis on what we
find as we make sure we prioritize what
we need to implement early and talk
about code review again we would
penetration testing that's kind of just
a given and then once again production
will have some sort of security
operations center making sure that the
application states you know what his
knees on their tablets and then the bug
bounties fit in somewhere here that's
that's an entirely different talk
although I do feel like I should mention
one thing so we organized a conference
over here for all the companies applying
Beeson leveling security in maturity
model that I mentioned earlier and we
had met some come and give a talk one
year about bug bounties and it was
really interested in seeing basically
half the room for bug bounties were the
coolest thing ever and the other part of
the room thought is the dumbest idea
ever and the truth is problem solving
riddles
okay so hacking is fun penetration
testing is really good fun breaking
stuff is fun I I certainly enjoy doing
it
there were one of my earliest pen
testers I actually I just covered the
banner cookie and there seemed to be
something encrypted data in the cookie
and I ended up like because I was fairly
fresh out of my master's course I was
like I'm gonna crypto harm Isis so it's
something you know statistical else
aside some differential analysis on it
and I figured out aha
it's that's super crypto algorithm cold
Caesar shift with some bells and
whistles going on to it and so amazing a
sample of the pen paper
cracked this encryption code
flower I loved it it was so much fun
especially like explaining it to the
developers you know this is why they
don't like that they just blown away by
how could you do that it's rewarding as
well I mean anyone who do internal
network pen testing yeah first time I've
got two main happen that was such an
adrenaline rush it was so fun it was my
first ever internal pen test it was
really embarrassing because in found
stone we basically had to come an
unofficial leader board with regards to
how quickly from plugging in to getting
to main admin can you guess and I think
the record at the time was my boss
character Lee I think eaten in something
like 18 minutes like plug in when Ivan
and then what do you do the rest of the
week so you know who's first internal
men's s only plugged in mark I need to
get to make that I need to get to main
happen and it took me slightly
embarrassing a long time to do it had my
boss or like Skype messaging me like
over 20 misspoke dude I'm gonna go to
Manhattan yet so I finally got it felt
so good but we need so they were
personally rewarded about their fort at
making stuff is useful as well I mean it
with was shining a light on on the
issues where the developers had never
expected us to try and do this to their
system and you know how else were they
going to find it
slight problem breaking stuff does not
magically fix the stuff we still
something we have to do so and this this
can cause some animosity so if you're
the if you're the security guy and we're
talking to the developers and you're
breaking their stuff sometimes this will
come across as you walk into and
developers your baby is ugly and then
walk away
so something its independently
organization this isn't gonna go well
sometimes in fact one company I was at a
first day on site doing a weather pen
test I had to go outside to do it
security guy takes me down the hallway
walks me into this room full of
developers in fact the developers for
the system and they say and he says hey
guys this is me he's a ranger stuff how
much help did I get for those developers
that week so yeah actual quotes we we
can talk a bit amount as most of you
talk about penetration testing kind of
being a badass auditor in a sense it
easily useful but let's say you have a
pen tester go in and spend five days and
he comes back and gives you a report
saying I found these four problems what
do we know about the application base
tested but yeah I was gonna say more
politely but yes we know there are at
least four issues what if the pen tester
comes back and says I didn't find
anything
he's in a secure system look we don't
know essentially so yes you know we
don't know and we know we have some
problems so extra back in the sixties
you said this about testing software
testing we we can use testing to show
the presence of bugs but we can't prove
the absence of them I thought I'd talk a
bit about DevOps because it's the new
sexy thing what actually is last year's
thing is now at this point also big
shout out to the marketing department a
synopsis I gave them a really like bland
set of slides and they just like they
went
Shutterstock there's a really cool stuff
in it
I sound like tone it down slightly it's
yeah so okay so tell us what is it well
let's talk a bit about terminology now
people have different definitions of
other stuff so these are our kind of
definitions your mileage may vary but
essentially agile it's all about
processes so agile processes are common
in relatively four different kind of
development processes typically you're
focusing on on changing while making
changes to the functionality of the
application and so on and here we're
trying to optimize delivery so you're
trying to figure out how can we in an
agile manner make a change for software
quickly and then we have this thing
called continuous integration or
continues to live we call continuous
deployment CICE now that's more what
kind of tool focused it's basically how
can we define software drama life cycles
using software so we have a soft a
defined lifecycle essentially things
like bamboo so CI jenkins these kind of
tools fit in the other the ideas if
there's a task let's say compiling the
app that we can do with that having to
manually type something out let's find a
way of doing it automatically and that's
what build pipelines are etcetera
if we can test the app in some automated
fashion let's do that as part of our
Jenkins pipeline as well
and so yeah the focuses on automation
and then this DevOps been so DevOps
development and operations historically
development to over there operations
were over there
and security was done with the back
yelling just inane things and none of
them are talked together so if I was a
developer I was not allowed to touch
anything in operational interaction if I
wanted to make a change deduction I to
go to an Operations team and probably
open a ticket
and beg them pretty please coming here
can you make this change of me as the
vaults were very split off the idea
point DevOps is your one team where
development operations everything is in
one and so you're just redefining the
balls you need to find in the culture in
the organization and making more
responses so you've got one team those
responsible for the software all the
ways food development and in corruption
so you know the code I push out in
production is these microvilli
responsible for what happens when it
goes into production I have to respond
what we as if you have to respond so
this is what software levels are doing
you know they kind of gone than the
devil's food some of them some of them
very come to me in the cutting edge of
space
some of them March find their well some
of them have gone full DevOps a lot of
people like summer in the middle and
security kind of sitting on that going
once taps especially more security more
traditional security teams so you know
if you think back to like the more
formal approach that the linear approach
was really comfortable for security
because you know requirements analysis
and then security can come and go you're
gonna have a couple of security
requirements and cool we've signed up on
the crime so then the same thing happens
to design so you know the developers and
the architects they draw a nice design
and say this is what does not look like
you guys come in and go yeah okay we we
anoint this we accept it and so on and
all these activities were taking weeks
so a code review will take a couple of
weeks a pen test would take a couple
weeks it's up and so on spec model we
take a couple weeks
can't we do that in an environment where
your sprint is two weeks in that two
weeks we need to figure out which
features didn't how to change month and
for some point actually the
the do testing of it Spanish it we don't
have time to spend two weeks on
requirements analysis two weeks on that
only two weeks and code reviews etc so
security teams have to kind of refocus
and think about okay what do we trying
to accomplish not how can we speed up
the same old activities because you know
the wheels won't come off
yeah so developers use things like
Jenkins we could use things like Jenkins
in fact we have stuffing using things
like Jenkins this is just an example
that pipeline I'd built it myself thank
you the trick is to make all your
Jenkins stages empty
so nothing happens and that way you get
a green check mark for things it
succeeded so this is running on my home
Jenkins server doing nothing just it's
just they're making a speech oh so this
is an example kind of or what we might
do for some of our company for most of
our customers will go in and go what
security tools do you have what are you
trying to achieve what does your build
pipeline look like okay well I see if we
can insert some security stuff in there
so in this case we put in some static
analysis for security we put in some
dynamic testing and so on
so from us if it's feeling point of view
it's great that we're breaking stuff but
the developers aren't gonna love us for
making their stuff they're gonna love us
for telling them and helping them fix
the stuff and prevent it from happening
in the future
so they from that perspective if we're
not if we're not speaking the language
of development if you're not using the
same tools the same processes
with their current worldview we're not
really doing software security so winces
like me I wasn't sure how to title the
slide I start off with some career
advice but that sounded a bit arrogant
so I've done with career suggestions
they also considers to be some humble
requests from someone who is constantly
from the higher people who know the self
as purity if you don't know how to
program to learn it you don't have to be
like fantastically talented software
developer but you don't have to know
every language is you're not that you'd
have to know a specific language you
pick something up you know uh I think we
probably in our office in London on a
semi weekly basis we have like a
religious war brewing because Matthew is
very much the Python guy
I'm inverse banished the JavaScript guy
and then someone will run into the room
and go go lie and one that chaos ensues
so yeah it doesn't have to be specific
like the lines of the content compare
their concepts you know like functional
programming lambda functions
object-oriented stuff this is very
useful when you're talking to developers
so when you've sort of given them your
pen test report and says yeah baby I'm
not gonna call it ugly but it's got some
issues then you're gonna have a much
more fruitful and can start a
conversation with the developers if you
can speak the language if you can relate
to them in the concept of okay more
frameworks say using more than that
framework if you use this function it's
better than if you use this function for
example and in one way you might do this
is find a pet project you know I've
always wanted to do you know a bit of
PHP programming you know okay write
several web
to something or or or invitin I'm sorry
Matthew sorry
so yeah you can blog about it you know
fill it up get to put on bitbucket or
whatever or you know if you don't know
saw something Scratchy
there's a plenty of open source projects
out there that especially in the
security space that could do with some
help so you know stop contributing I
don't know why I keep using the clicker
external networks another thing is
learning architecture our Software
Architect training why so learn things
like you're one of those frameworks do
you know one Java spring day wasn't
fails do and so on and how can they help
the developers as I save you a lot of
time when we're having conversations
with developers about I found some
problems then a lot of times it can come
down to look if you use the framework
like this you're going to avoid these
problems so if you if you learn how they
work you can be helpful become fluent in
things like entir application
architecture and other fun phrases which
architects will use to to bamboozle you
I had one conversation once where it was
an architect way we came up with we said
look we don't have any requirements for
the software we have principles
[Music]
so we talked a bit about it and it turns
out they were requirements they just
didn't want to call them requirements
website yeah this becomes super helpful
when you're starting from language you
need to be able to understand design
language design throw up diagrams
anything be able to even troll them as
well Visio will become your friend sort
of and also not every security issue is
a buck something that design flaws
so what I mean by that well okay the way
we talk about bugs and forces bugs are
mistakes that you make in the code so
you forget assembly color wall or you
invent your placement wrong or so some
nothing so my biggest problem with my or
you know you you meant to take one
barrel and add it to another big
actually subtract or something like you
know you your your intention was correct
but you that fingered something that's a
book a designer floor is where when you
design the application
you forgot about something or didn't
quite design it right so maybe you
forgot to put in an authentication
that's a pretty big forgetting something
it does happen or you think you've
designed like an authorization scheme
that will protect all the crown jewels
but actually you left a great big gaping
hole over here on the left or something
and so here's an example of where that
Nova design for this is my cat Alex if
alex is a big
he's not really he's just really
affectionate and when he doesn't get
affection from me or my wife he turns to
his friend the Rumba now the way I
discovered this was basically and I come
home from work and there's a rumba in
the corner with a dead battery and he
kept happening and then one day I was
working from home I Alex's asleep on the
beds in the bedroom and I hear the rumor
go do do it's gonna start as thing and
how to get off the bed at once
downstairs what is happening
Alex has figured out that to get
affection teaches us wait for the uber
to wake up and it gets passed so this is
what I call and design for because the
makers or uber have done lots of many
clever things but one thing they've
never planned for was what I call the
attention-seeking cat abuse case so he
has finally stopped doing this but they
know we had better buy a new battery for
the robot okay who could does come it
prefers hard if it gives me a headache
but it is worth knowing a bit about it
getting familiar with it some a history
of it you don't have to become a math
whiz but knowing why it's hard to get
bites is really happy because that's
when there's some classic mistakes that
have been made I've had a lead of
Schroder
I picked the video example I want to
thank professor County pastor in a hot
way for this wonder if he made us all
this as part of our network security
mask so neither interpreter clever
people they came up with two
authentication protocols back in 1978
one with secret key base one was public
key based and they only took about three
years for someone to break the secret
key base one and in fact there's a
replay attack but the public key
actually was fine for another well for
about 17 years until someone figured out
last year there's a man in middle of
attack innocent
so really smart people coming up with
what looks like a really clever idea
and it seems to be clever and then 17
years later someone goes actually has a
really simple way of attacking it so
it's really hard to get bite and the
similar story for things like our c4 and
b5 and quite a few other algorithms and
protocols out there so it's I'm not
looking for anyone to start inventing
crypto I'm looking forward sort of you
know if people can get their heads
around why why smart people do dumb
things I Spit my heart opening it but
you know why these things can happen
okay you don't need a bigger box which I
think this goes without saying
especially given they are looking at the
schedule over the part of the next day
you know it's not just about web apps
although I think we probably spend but
we in a half the testing work that we do
if not more is web apps
we don't know mobile testing as well but
of a half of all the work that we do is
probably web apps but we we do love an
interesting work in things like Internet
of Things automotive medical devices
that kind of stuff mainly and it's sort
of in which pickings in the sense that a
lot of these technologies are being
built without necessarily co2 being a
main player in the beginning so
miscounting a repeat other mistakes made
in previous generations of technology
and this is where you can bring a lot of
value by both demonstrating in the
issues with the technology but if you
can speak your thoughts totally
how to avoid the issues and how to fix
the issues that's that will be you'll
become someone's best friend embrace
everything as code you I feel like I
should mention AWS at this point you
know aw surviving gotten to pet that
much come down the road of everything is
code you know why infrastructure is code
our network is code our policy is cold
you know who's gonna be the one document
nobody who's going to make their their
code passed a bunch of security
requirements are built into the build
process everyone because they don't want
to have to deal with the friction build
pipelines that will come now Jenkins etc
security sensors we can write them as
code now so if it's you know if it's
champions pipeline you have a Metasploit
script or anything it's all code and
these will end up speaking stuff and
getting that so I'm sure there are other
examples I've forgotten here consider
being a security champion within the
organization where you work or at
someone will work if you're studying so
as I said you know you've got these caps
you've got security you've got a lot of
printing operations and so on one thing
that we found is it's a tends to be a
lot easier to teach a developer about
security than they is to try and teach
combat or traditional IT security person
about how to speak to developers is it
just seems to work better the other way
right so in other organizations where we
work the sophists unit group is able to
be relatively small because they've got
these champions in the engineering and
calamities who they're developers so
they're architects and so on but they
have a passion for security they they
know about security and they become some
of the focal point within their team for
security so this office view does not
yell at everyone there's people actually
embedded in the organization so they
come in a sweet spot and don't forget
about culture so different organizations
have different cultures so you've got
kind of the developers and security that
kind of an awesome band all
organizations and depending on the
corporate culture that can be really
brutal awesome then in other
organizations a little bit more
collaborative so if you're if you're a
consultant on sides of the organization
where they've got a very sort of us
versus them culture you're gonna have to
work harder to win over the developers
and so be conscious or be conscious of
that so holiday and technologies keep
changing but you know the people where
we can we all kind of stay the same and
since that all of our hang-ups and we'll
have our cultural kind of parents so so
in summary finding security issues is
the easy part doesn't mean it's easy I
mean it's it's really hard it's really
challenging and I've spent like how long
staring at one particular system where
I'm cleaning I'm sure there's a whole
think I can get through it I just wasted
five days trying to figure that it can
be really hard to really challenging but
relatively speaking it's the easy part
because once I found an issue the
developers then have to go fix it they
have to figure out the payroll how can I
fix this in such a way that nobody can
do that particular attack and anything
that looks a bit like it has anyone got
a pen test where they found a cross-site
scripting issue and then the report they
say okay steps to reproduce go to this
page put in this into the input field
this particular value into the input
field and click go and voila you have a
I scripting attack and then the
developers fix it by blacklisting just
that example happens one so the valves
aren't used to this kind of approach
they're not thinking about how or do I
need to escape values and you know trees
it's a trust boundaries and how do i do
encoding etc they're thinking that is an
attack I need to start with that so it's
it's hard to get get things right and
then ultimately implementing these
issues from happening in the first place
that's the biggest challenge of all and
where where organisations will spend
literally millions trying to trying to
solve this problem
so be conscious of that magnitude by the
way we're hiring so yeah love we've got
someone back we'll be at at this panel
all day as well I so please become at
the chat if he leaves in working with us
we have consulting positions open with
interns this summer as well so if I have
to admit I'm trying to think of a
berkeley alumni do we have in the office
right now sonic physics and quite a few
of them came through coming into our
program so we we brought them in over
the summer between the second or third
year how lots of fun and then we ended
up hiring so please do come talk to us
if you're interested you'll find you'll
find some friendly habit a alumni and
then you'll find some other people we
try to be nice as well with that thank
you very much