let's meet assembly of Sam's pH recently
if you took notes it's a warning some
people referred Mary tab every verses to
take unfortunate what is known as
musician you have chosen to learn how to
make Moosic yourself with this we're
going to teach you how to play that's
how the cowbell is a rewarding
instrument to mask his wonderful
percussive instrument has many
traditions but you'll find decision to
vote the first time you learn the proper
way to plan travel to start with here
are two examples of how you not so hold
out your hand is shown here nothing too
clogged your hand like so think of an
eagle's claw
that's it doesn't reinsert the showering
of Aqaba into position and squeaks to
the funeral taps to make sure the table
was secure
are you still holding the table you've
done it you cannot properly hold it out
there are a number of positions you can
regulate this is called
seated position popular because it
provides adequate spinal support a
cardinal player some players the first
standing position prone position is a
somewhat unorthodox way that favoured by
Germans
this position which is very popular
these days the one was Bruce Dickinson
this position by the position that both
comfortable for you and will begin first
he must find ignored with a compass
modern science has proven that a cowbell
found its best when facing position or
if you're facing another direction the
mainland was a significant drop off the
body of a table outside the drums would
usually the native wood is used to
strengthen ever be happiness for one day
America we however recommend starting
with a normal dose let's begin play
we'll start out with our very record
piece of news know where the player
chooses to add to town yeah see how
fitting the cowbell can be it adds that
little extra bit of magic to in use this
time modern news here's the song without
the presence of happened with the Kappa
be sure to play along at home
[Music]
excellent now you're on your way to
playing acaba remember practice makes
birth
it said if you've learned a lot about
someone by walking a mile in his shoes
the same is true for acaba accepted cabo
has no shoes or Phoenix
so simply learn by walking a mile and
playing your how about senior found that
you too can master that how will hon you
want to hear - Pablo more and more okay
good morning and be joyful jus soli
[Music]
with us well we are 60% of their farmers
we had talked about organizations that
take your security seriously or actually
Democrats a little bit account so
anybody under the age of 18 in the room
show of hands or you said okay now we
carry the parental advisory in this sir
we've taken every consideration here we
included the energies of the majors for
activations the Bible is wearing in here
we need to say this because I'm the
girl's mother professionals mara will
serve things we've got some contentious
perhaps controversial subjects to talk
about my language will be stripping
contest sorry that yeah so okay so thank
you
I might upset local Twitter muted by
many I lead a team of reinforced at
professionals at work for an ISP South
Florida
sure I'm sure
so I believe secured engineer and a
security company
I was the curly D or Scotland chapter
many deal with applications journey and
you know a spirit fatherhood false or
pentas partners we hacked love stuff
[Music]
do you carry baseball bat but watch out
for that and yet I also run definitely a
school so that's how we can defy school
it's in Glasgow it said that I started
bungee we have said very sick or sixty
percent of a harness there are two of
the Memphis you don't have been after is
in Belgium so he's busy doing that where
we go hello yeah he joins the blades we
were five pieces that police athletes
genuine Annie informed from show hands
and we know that guys follow a dog he's
no relation to Donald we did once try
and tell me he was a cousin but I think
that was trying to get something and
he's really prison in Dublin so watch it
we can't be can't join us that's a joke
he's on business it doubly rum-running
don't know you can follow us on Twitter
individually you can follow the bear
files on Twitter
we're pretty busy shitposting most the
time for
hidden amongst all the share posting
will I think there are some valuable
nuggets of information we do get
involved into quite serious topics so
that's what we're gonna talk about today
okay
we brought some swag with us we brought
some critics that know specially
laser-etched with our name and our motto
as their farmers here Pheebs we've got
some cowbells because we're all out
cowbells we've got stickers
productive but they're cool how much
here and we also got some some fridge
magnets which yeah cool now we're not
sure how to distribute this swag when
we're sure how we're not going to do it
which is how we get leads which was to
throw around it wasn't great yeah so
we'll probably sling it all here and at
the end you can come and help yourselves
it's limited supply but first compass
because I'm not going to try it's gonna
kill somebody we don't we don't have
enough money for anything okay
who's that guy also known as grass so
anybody alive when code jumpers on TV
show has five days dead I feel that this
stuff looks fairly dead he was a famous
American TV show detective and he had a
saying his catchphrase was who loves you
baby and so who takes of security
seriously whether it will be a example
right okay I was surprised who wasn't in
a yahoo day of reach show answer yeah so
yeah not simply I was Yahoo a lost quite
all the data since 2012 possibly
beforehand but you look at the numbers
of that we're talking 450,000 that's a
high number twenty-two million five
hundred five hundred million
now 500 million will just pick on that
2014 the Russian FSB Ballmer known as
the KGB hire the Canadian figures
Estonian guy eliminated drill to capture
some high-value targets like five
high-value targets that were American
politicians that we usually Yahoo so you
send and receive comprehensive
government plus the skimming and so
rather than take the trouble to try and
access these five individual accounts
the hacker concerned just took
everybody's account put in mind that
first of that time now published number
was 500 million records the actual
number that the industry thinks is 1.5
billion records which is why that's
clever Greenhills was involved in that
bridge Thomson get access to find
mailboxes a lot of data so it's not
really I think expire safe that yahoo
has failed they're busily say that you
stewart seriously and even though this
guy's so I lifted that line from that
website they have top rate secure images
back raid military-grade grade
and ways to help protect you and you may
or you use Facebook that's actually a
crow on that on their primitive page on
the website I'm not entirely sure they
do you know okay
so there's a defender booking Mark
Zuckerberg in from the Congress at the
back end last year talking really
not give it much away in terms of what
they were doing to protect you security
or your privacy and the numbers kind of
stuck out there we're about six million
records in 2013 15 million records there
anybody recognizing that number will
recognize it from being the can merge a
política 30 breach which was more than a
bridge she was complete scandal of
collusion between Facebook a private
organization with political bias that
was using your neck of anatomists from
an app that many users of innocently
installed in Facebook to understand what
your political persuasions were going to
be you know answer sorry you with
marketing flattering to particular or
all organizations and that was used
allegedly in the pro leave campaign
around brexit it was also used Headley
to influence American voting again
allegedly in the USA it's part of the
trope that just have an interest not an
interest useful it has the Facebook yet
a few show of hands
it's about somebody threatened
exactly but lots and lots of numbers
again in Atlanta called a desert that
will take people's privacy seriously
that's just absolute
there's no evidence to support that they
do that because the data the leaking
supports it the number of times and look
about ill people in the Congress
apologize for something diamonds is
about that actually institutionally
Facebook is failing to take your
security seriously but here are another
couple of things about Facebook they've
been to be quite cool with hate speech
you know you turn Facebook on and you'll
see somebody that's retweeted something
that's quite disgusting yeah
not retweeted it spits we three bulls
we've faced I'm sorry my apologies share
some things that would arts warehouse
right if politically subversive activity
so we're seeing that so we see we see
Bachman has been creating across all
social media that constantly posting
stuff there's flattering to political
organizations and again the Cambridge
gentleman athletic your example
demonstrates that right so much has
anybody reported somebody on Facebook or
something they're not quick to react
today that they're very slow I was
receiving personal abuse from somebody
actual real person a long time ago
I only evidence had all nephews except
your simple although at Facebook and
that person's still operating on flights
it I think it wasn't until several other
people would report the Facebook quietly
deserved account it's not not but
ultimately and now he's got a little
quip about this you know there won't
happen if they're carrying a security
above them on happy to monetize and
presence on that platform you have a
problem I know yeah
yeah yeah we're perhaps this hey if the
platform is free you are the product
it's the same for all social medias a
4-lane tendencies import where's the
same for Facebook is same for amigo
easily yes free you can you get you take
it so this is a sacrum videos also it is
healthy as well did not think of the
videos so yeah ii think that's me I
was fine as well within that right
wait yeah oh yeah okay we're coming up
with you so last video but they know for
the border before we play anyway we're
all Scottish music ocean sounds - I'm
not from Dundee I'm Cosby G I'm from
Edinburgh so I'm from Scotland now sure
stones got it no I know but wait till we
do let it roll I don't know Sheila and
you live south of Edinburgh Dona so what
well scoffs right I just talked to a
piece victims just I sell shoes and
dances and stuff and get some light up
some energy because and then all
computer on and then before I get in top
dispensable and thanks and Hartman
didn't touch it pop use use from all my
diocese will t be honest I think I'm PC
Alan see pastor soldier the bothers me
for aperitif at home all this is just go
up here at home I like likes cats like
that this you need monkeys hardened
accordions and you know I don't know why
I'm getting ahead of us will be deleted
my fault and many people who are
stealing all the intelligence well their
other sees nothing mean everything my
back I just I just like very good not
and now rusev and I guess your fault
some of the individual topics and
and everybody Bonnie basta and rooibos
so make cement to be your whole just
Hwang kyo-ahn
[Music]
whole tree was at me said on this big
contribution slide that but only
countries not like that it works so well
so here we have a current situation
where this is why I'm store Facebook
that image was supposed to buy an eye on
Facebook thank you a so use case I found
it so there you go
but you know what this is kind of what
people are thinking
so Facebook it is evil look by an evil
guy with evil intent evil organization
it just wakes likes that's our we cast
three cats we not got monkeys playing
audience and there is no there is zero
that the trustee the organ in the
organization the platforming the
technology anybody think it needs
regulating I properly regulating social
media generally okay
Enoch Shores and then going back for
short spike for a few minutes ago
who on the back room who was previously
at the Facebook users on the back of the
scandal and date leaks and a lot deleted
in probably sure half the people that
not too many how much there has a place
where we can go out that's when
beginning a lot of people still early
Egypt but unless you think maybe a bit
like idea that you he was set for your
own threat on right and if you step on
those that you share pics to members of
the family in Australia then you can
share yeah that's my so Twitter are much
better okay we spend a lot of time on
Twitter again you probably mute as not
blockers if not why not
you probably will be
as we speak right now yes there are very
little data breach you know 250,000
Beckles 2013 and $330 million 330
million record you know it's what makes
us pretty recently pretty recently need
330 million records that's nearly the
population of the USA for 65 million
people in the USA for people to look up
the records breach and you know
similarly to Facebook that man can I
don't know write a lot about what we
gather about racism about sensitive
about transphobia etc etc you kind of go
to where they are well now is freedom of
speech and also the classic American
it's not terrible laughing with
politically motivated worthiness the
smile again to remove bad actors
well no you see Freddie Mercury last
night
yeah kiss it's a different makes at West
and again they're all that make you so I
lived through this off off Google Google
last year actually
so the recommend is at least three
records of leaked data per human on the
planet
so roughly seven billion humans exist on
the earth therefore you've got the 21
billion that's really from information
around known breaches speeding that that
made their way into the news made the
way into allowed impound of similar
services like that but it's got to be
significantly not just the collection
records the kibo the equation records
the cubicle
Oh anyone anyone here that the question
right is that the one one terabyte of
personal details yet I may or may not
have acquired that information is a
hundred billion unique user names and
passwords so that's like five things
that's what 15 for every person on the
planet it's quite quite a bit more so
yeah it's pretty scary and weak so
happen all the time
breaches will happen every day here of
new things we've got a slightly or no
but I think we've got some bit on for
all the different pieces and things but
it's quite good and all these companies
are just boarding your data and some of
them are less secure than others you do
have some that have things that bug by
the program so we should properly or
under to try and secure them people
aren't having continued security so the
keynote topic you have the security belt
life cycle of stuff so or doesn't really
but anyway how's the kid TLD art that
was the synopsis of the top that's begun
and what we will talk about a little bit
it's an attribution I think there's a
lack of an appetite for people to care
about daily unless we can attribute
attribute it back to you an organization
with the collection one rule of bridges
there wasn't any attribution it was just
day at a mass historical breaches okay
this is deliberate it's not an accident
so remembers being significant you know
it nearly who remembers be a British
Airways losing a load of card data
around the length of time last year
okay so they fell prey to a out classic
as a reasonably sophisticated attack as
in some South was put into it to make it
happen the server was South in Eastern
Europe an HTTP has been HTTP certificate
was ordered and acquired and the man was
registered that looks a bit like DA's
website and then they drop the magic our
JavaScript into some Java in javascript
in the website and their pen
and it took your payment card data and
sending off the Romania whenever you
made a purchase would be a so it's kind
of cool classic supply chain poisoning
attack so this is something that we're
talking about again at the end of the
presentation and the supply chain
poisoning bees on the other okay it's
something that we are my organization
develops a lot of software and I'm
particularly concerned by in this
example three hundred and eighty
thousand cards were was stolen so that's
a big deal it's the person big GD P R X
breach since the GDP are can you see
existence in the UK last May so it'll be
interesting to see how the ICO handles
this given that it's a very large
British institution let's drop the ball
I see yesterday so not gdpr into the FCA
in the US is there a head of the tech
top yeah as you see on youtube I think
having a five five million dollars
yesterday by FC eight for using personal
data so it's happening all the long but
like GDP is a big like our GDP I
almost thought about it but it's like
I'm not I'm not expend this was like ten
percent or like five percent of Europe
your garage tunnel where you get fined
so do or find other people get faded as
well if they make that right your are
yes oh the for the seven or twenty
million euro of your annual revenue
surpassed whichever is higher
shown you you
Josef he was about GDP up you've got
music yeah so when GDP Rama came out I
have high hopes for it I was hoping that
companies would actually viewed and
start taking a seriously
specially you're talking about four
percent global turnover that can be
quite significant man up really quickly
unfortunately I haven't quite seen that
take on maybe it's too soon to tell but
we constantly seen almost on a daily
basis this Beach has happened as
breaches happen the speeches happen and
just the other day on Twitter someone
was going on about and hackable the
bassinet and they were telling about how
DDP
is only focused on gaining consent and
they're missing the point of the old the
other part of GDP are which are you have
to allow for a removal of data
someone can request what data you're
holding so it's quite apparent that
people store missing the point of GDP
are and I told we start seeing real fans
issued and hampering companies and
actually providing a incentive to follow
and do the correct things I don't think
it's going to have much teeth which will
see it we'll see okay
there's particular cases of cost of PCI
DSS concern anyone familiar with the PCI
DSS paper card industry data security
standard since we like what came before
anybody cared about GDP up specifically
around carpeted a service of cards debit
cards that kind of stuff MasterCard etc
I think because he's a per count of
finite in some lost card the PCI DSS
will will find the organization I think
that they're gonna get bubbly later yes
but time will tell okay so we said we'd
freshened up the talk from the one that
we did at least so we have done
collection one has been a thing since or
at least around the same sort of time
so in collection one there were seven
hundred and seventy three million unique
records and it was all them fighting on
Twitter about some people we have
regular contact with works going up
other people that we have regular
contact with about well it's just
data so who cares because we can't
tribute it back to any organization or
any single late box who cares
that it's attributable
my dad is in that solve them are so so
by looking through the Fiat on some of
them are truth or will do sites like
there's like five different quite adopts
their various sizes but the first one is
and in public its callback public and
it's to be able to various what I'm
calling off websites and Bitcoin
exchanges so we're just well yeah
Oh oh there but the new they are and
things were really too bloody Yahoo
peaches other this is the collection to
equation 2 equation for a definite they
are so whoever uploaded and all the data
with makes a minute so the segment
though the different categories you've
got a title day you've got a card you
could user names and passwords of your
forums you've got things like e-commerce
sites lots of things book notes but they
it's not faceless de-ice is quite a lot
of data so the the the question was 770
million bit absolute overalls for 100
unique billion so I had 100 billion
unique sense of credentials which is
quite a big one post
so it's haven't done the sort and unique
in the actual password last year but I
reckon is probably about 50 or 60
billion unique passwords in there we're
talking like password one spot lowercase
uppercase that's like a definite
possible for this there's going to be a
lot of work but cover that said it may
be the new rock you there produces for
pen test it may end up in that so anyway
that's my two cents but never was
it's an astonishing number and again go
back to the idea that 21 million records
is now easily exceeding 100 billion our
cousin again a hundred billion a
thoughts well in how many years time
will be superseded by trillions you know
yeah and again not really is stores come
to the service which is hence the
analogous iceberg so we only really
seeing what we're seeing
yeah okay and it goes drive on the point
that there is all the data out there
basically I just so I think a large
country reading faculty a lot of those
data is the change in databases so
you're going back in the past you see
have your database stored somewhere in
some back network if you have some
service configuration it's not such a
major issue I mean yes it's not great
but it's not like anyone can send you
get it now
when AWS s3 buckets and sunny some
farmers configuration and the entire
wall can get it and you constantly seen
the steam come to over and again I think
it was what was the Reuters or something
this week or the downtrend I can't
remember but again they had a database
open on the internet found that was easy
accessible identification two weeks ago
a little bit longer than that they're
Swedish medical company all core records
wide open on the internet and
authentication needed so constant theme
happened in the game again so if you're
going to put something on your database
on the Internet
make sure it's thoroughly tested
reviewed and they have the correct
configuration for it or just gulp it up
or that pedestal yeah quick charms again
anybody seen this graphic before all
this is this website okay this
information is beautiful and they do a
really beautiful visual representation
of the data breaches I think that see
around 22,000 or thereabouts and I find
it particularly impactful at work when
I'm doing presentations in certainly
because everybody in the room is in one
of these or what a lot of these plots
and a lot presentation it was with us
who was staying at the Marriott at that
particular time and so we took the piss
out him a little bit because he was
stopped them at the Marriott and I just
lost a paltry three hundred and eighty
three million records the problem is
almost unimaginable I get a little bit
concerned and increasingly concerned
that we're caring less about it because
is that the frequency which is happening
and I think that these sensitization is
a real a real worry premieres and
information security professional the
unless the number is in the Brazilian
it's not even news worth it nobody seems
to wanna get too excited about it or if
I said no would say yeah or even so yeah
lost another 500 really well yahoo has
met but i used to working well authority
in education for a fairly large
authority and we got really upset one
record was breached particularly if it
was a child a child or a child with
special educational need anything like
that that's water so I can't be upset by
war record going out so much you know
outside get Wendy's 500 really
rage and but yet so whether it's one
whether it's a million records it's a
record
it could impact something in adverse or
negative way we should give a yeah
who's that no one knows it's died of
adding the former CEO talk talk
so how much never how's this time out
who remembers the 2015 told to hack so
it's bad enough when you get attacked in
this bug knife wound healing
you lose day and but what really
compounds a situation makes it worse is
how you handle the situation after
during her after the event so it's a
story born under quite some pressure die
hard II was the sole representative for
the organization that was she'll dying
from the news to talk the world through
what was happening because it was a live
event when she was on TV talking about
it and she was fairly well off le
ill-equipped should I say to actually
tell anybody what was happening because
she didn't know what's happening so the
first message that died out put out was
that they were nothing happening yeah
they were an act some sort of technical
issue that was what was it play at the
time to begin with but the security
industry were not stupid we're pretty
smart
and we caught really really quickly
actually told that we were getting
happening hats so she had to go on and
tell him go Harold in hats but you have
an answer if you have tribution
straight away so it was rough you based
islamic jihaddists that was a
diversionary tactic I just
get the media and go off and look at
what that wise and if it isn't
anything right so they take a lot of
googling to come to a conclusion that
there aren't any such things it's just
buzzword playing field we're just paying
a few words from the news and go it
that's what we use correct and that's
what happened so while the media were
busy doing that they were preparing the
next information package which was vibe
by which count they'd realize that
they'd lost data but that no personal
David being breached and I was like okay
that's cool talk talk customers calm
down it's good they lost through the
serial numbers it's fine no problem or
just IP addresses yeah that's personal
some personal men may have been breached
well I entirely feel but so does God
we'll keep you posted and then
ultimately and I'll let you to read this
and emails suggested people that is
glaring at the law so we've got a
disclaimer at the top Justin
nobody strike soon as yet but as I have
said many times you can't you can't sake
anything away from nothing
that's true so hey it wasn't handled
very well okay the incident response
here was terrible but that happens
that's the only students but the they
put the head of the organization out
home they're out to dry
also like I should pull myself out to
dry by taking your to what the
responsible ultimate responsibility for
guaranteeing and talking nonsense
repeatedly this is what the truth of the
story was it was a fifteen-year-old kid
from Northern Ireland there's a hacker
Tom Anthony is actually a picture one
hundred and fifty seven thousand records
so not not many I love to get really too
upset about right yeah
but including customary but included
back data as well and it'll took or a
house inside 40 hours for scammers to
start ringing talks or customers
consenting to be the organizer
I'm getting them to do things unwanted
actions via social engineering but it
wasn't a Russia base Islamic jihadist is
a kiss but now it's a post talk talk
Korea picture of data Harding ago no
it's the nap in there
I guess it's battleship I don't know
what you haven't looked too flustered by
it she was made of Baroness as a
consequence of that and off she
which for anybody that doesn't know
who's heard of general if she's clever
social engineer she doesn't tell him
work as well on the haunted she killed
neutral issues conference by tell him
and Ashley killed with them well he's
sitting shoes right she got away with it
moved on and talk talk we've done no
matter the point that sure made earlier
because it was pre GDP are it was damn
potentially ear if eyes so the the
Information Commissioner's Office fine
talk talk four hundred thousand pounds
for that breach in 2015 all the GDP half
go back to the idea of four percent of
global revenue or twenty million euro
whichever is higher
fine could have been a size seventy two
million pounds which is a big difference
that's you it's a few quid now it's also
going to absorb that because their
revenue 2015 was 1.8 billion pounds okay
but then it will set a few share all
that's right living on the dividends
although seemingly companies recover
from that payout on their Facebook is
still so just to have something to you
the whole fiasco is and we see this
often on Twitter we get someone going
ads on behalf of the company not giving
them the tractor bus especially under
pressure so one thing I can't just need
to do is make sure
have some sort of strategy Wendy on
social media as well the media itself
especially in terms of incident response
pack make sure that you have all the
facts in the units on hand beforehand
before you give any official
correspondence to media doing so means
you're going to have the right
information you can give the right
details and you don't end up with the
scenario where it's information going
back and forth yep absolutely
and we'll talk about a bit more of the
anatomy of amulet avarage a little bit
so what we don't want to do is paint a
picture of organizations that everybody
out there is out there not caring about
security because a lot of organizations
are the vast majority of organizations
thing and they are doing something about
it
of course it seems that the lives of the
organization the less they care that's a
perception I'll let you draw your own
conclusions with that one thing that is
in fact is the large of the
organization's the large and the data
would often have different worry and
what firms are doing things like
adopting robust security controls they
are doing security rather than doing
compliance and then open up a little
security the other way around we are
seeing an emergence to responsible
disclosure you made a thing anybody that
knows Victor givers knows that he's
about to be involved in that community
for a number of years and 5,000
responsibilities learners who's a demon
eye and he's leading the way he's a
pioneer in that space around working
with organizations when the bad things
happen to make to handle them smooth but
to do the right thing after you fail
when it's the best way to describe it
and bug bounty schemes we've got a slide
on that and it's quite actually involved
in that enough space because you both
got seeing the East you know that's not
minor chords and three exchange we'll
touch on that and breach handling we're
going to talk about that in detail and
then multi-factor authentication
something when it's
so some work so anything we in couldn't
be with us but there is a picture in
here not very clear but laughing before
I started shaving who uses my phone I'm
gonna do much Sean here uses mfx
that's had a few showdown so one of the
things that MFA help preventing instance
things like credential stuffing so those
who don't know credential stuff he knows
we take Noreen password from a most
likely line reach and you try them on
different accounts and since people
really use passwords hope I owe you
something but access MF air will then
prevent that standing and another later
some companies are doing a really great
job in terms of encouraging MFO so
MailChimp is one where they give you I
think a 10% discount if you have a phone
booth on your account fortnight so a lot
of people this from lawyer with will pay
for it not they encourage MFA by doing
giving away the free patents in the
fortnight so yeah the general point is
ease summer soon anything is better than
that so we can involve the arguments a
lot don't we do not against each other
we wait or these try to set the hand an
argumentative bastards well the same
page about British everything how he
keeps quiet cause you're always be you
well things like password managers you
may have seen if you follow me on
Twitter got a lot of poll should he use
them or should you avoid them knows only
three questions and I got four thousand
to
negative votes on Twitter on that
particular poll 89 17 favorite using a
password mind you that was on the battle
an article that went out about two or
three days before that SD magazine for
security magazine but others posted by
Kubrick on IRC that said that using the
password manager was no better than
using a text file which okay I don't
know shelf good awesome Shiva
it was my is you said that your are
missus edit info so yeah so I just
wanted to set the record straight and
yes I think the debate around to NFA is
how good is good MFA versus weaker to FA
so there is an argument that SMS based
to FA is being adequate for my home it's
adequate right because nobody's really
going to go after my mom to get their
credentials what's breaking order
accounts he's not high-value target so
the vast majority of people SMS based to
FA is probably an equal to even though
it's not ideal but it's better than not
having anything and then responsible
disclosure so who works for
organizations that run responsible
disclosure not so you know shop at that
oh yeah yeah who's aware of what they
are okay so now everybody so that's the
idea that you give I and a security
researcher or a hacker to notify you of
a security vulnerability that they may
have found on here winner or a PII or
whatever and you give them a channel in
which are they can tell you in a
responsible way and they're very very
supposed to do anything put a page on
your website you can deploy a security
dot txt file which hasn't started and
they can go look for it behind it is an
email address simply chosen the wrong
ability and will do something about it
key thing is that you do something about
it if they care enough to tell you that
you've got a problem and not happy then
you've got a bit of an obligation to get
back and patent for it and fix the
you have you have some people who do
this
on the step so you have like birdies but
you have some use ransom bonus so
they'll email a company saying oh I
found the best you in your product pay
me some money I'll tell you about it
which is not the right way to do it and
so that's not to respond and that is not
a responsible disclosure that's just
being a dead irresponsible is
irresponsible
okay I'm not really mr. this disease is
baby but it's a whole different scale
affected dickish Ness
so this is the concept here is elastic
scoring an organization based on how
well or badly they react to a public
public announcement target well I never
walk so people from network for PGP we
reported actually to quite a bit harder
by faster Priya then' occasional excuse
me reported recently and the company
came back to us and said yeah the
product end-of-life so we went back to
the website with all the people that
were selling it on beyond it's still
being after we saw we're about to it
yeah but you actually selling like on a
couple of a million different sites
there
oh no we only tell our customers at end
of life of the ask wait that's not
flexing the issue so we've gone back
through one of them bigger partners and
said look this this is the response of
the vendor and the partners that come
back because they'd be sale quite quite
a lot of the the equipment and they're
like well we're going to like cut a
contract with it don't fix it so it's
impactful but yeah that's that's
probably a 35 points possible and lose
your Fingal yes okay so that's the PC
stuff and we're going to speed up a
little bit because we're we're not we're
not not regular time left
but yeah pentest notice in technology
software obviously now word on this year
of research of fantastic people okay so
people are most likely attack surface in
an organization whether that's by
they clicking a link again social
engineer just all the way that's what's
good holding a door open for someone
yeah absolutely so fantastic building
yeah yeah I'll just run you're also a
fantastic night responding
vulnerabilities it's also testing your
procedures of standards of processes and
making sure that those are working again
though we bring an independent audience
against them their career novelty
company it's a really valuable thing
don't be afraid of it don't be afraid of
a company coming in and telling you
even when you pay to do it because then
they're not your homework you can do all
your own testing for all your viewpoints
but your baseline is your own
understanding of your company get
someone else to come and do it as well
because you can learn some really more
things about your company that you were
blissfully oh well really good said get
involved in improving programs engage
management engage people around the
organization big security ends will be
designed to thing building a software
application building a network get your
security considerations in at the
beginning and then bake them in okay
patch stuff the entirely different
subject to talk about yourself right but
don't be afraid of patching I hear it
actually is hard I understand it's hard
but it's because it's work just get on
with it do it because consequences of
not patching I could be far more severe
than the work and effort time and money
to party still what I would think that
if you're part some things in a
production environment do justify past
equation is something will fall
over some patch and development they
push the production when you know what
I've seen companies patch things in in
production and then all those systems
that don't assault doesn't why so tense
the test patch test patch test practice
yeah so on so forth definitely have a
matching program don't just do as a lot
operation make sure that you really are
regularly doing and don't just pass
before the pen testers cover that cuz
it's not how it works
no keep eyes on supply chains who saw
apps for British Airways there were the
upside-down jumbo jet I'm getting
involved in awareness campaigns in you
they talk about people I hate to turn
the people of the weakest link in
security else just okay okay
people are the likely it's at service
but that's the real education it's your
responsibility to what your modernity
have you been pawned yes you haven't we
well we well established that I drop
this slide in because it's useful in the
organization just to get something the
audience to voluntary and I dress
dropping into this service guarantee
will be every time it's quite powerful
okay you count me down we've been doing
yeah okay pretty well so how many is a
proper fact more secure can wait of
security program bug pony doesn't
replace pen testing pen testing this
book can run if you listen parallel
essentially you open your product for
your company up to external parties to
cover in hockey the difference between
bug burgers and pen testing and at the
top he says these that outlines it
entirely but essentially you have in
maybe hundreds maybe even thousands of
hackers look at your products and tell
you in chefs broken and return and you
should pay them some money
some companies give you internet points
internet going to pay the bills so so
I'm give me a t-shirts some someone give
me a t-shirt I mean there was a guy who
found your friends bug and Sony quite
quite sees what could it look cool
execution bug and they gave my t-shirt
whereas there's another company that
some of someone found a messin header so
there's like extreme options in the yen
100 params of voters so yeah there's
that's that's the difference between
signature you can have bugs and get
paid lots and good box and get page pop
out so there's good there's also a lot
of cool air learning opportunities for
security researchers people who are just
students and stuff it's easy money like
and I've made quite a few quid on my
pennies so me about had a part huh
they're quite big company if you haven't
don't google it
by phone quite a lot holes in the
website and some more security all those
words so much they're getting better
they start about medical program like
three years ago and they've know a lot
of holes but last of them are security
so okay thanks changes to set the policy
mounted institution by banks where they
suffer the same risks all use similar
software platforms that are all for its
fifty years of age they share a lot of
data about threat intelligence
throughout common attacks that they see
something the silicate involved it okay
five minutes left quick Whizzer do this
soon as the Anil exceed before breach
the point is it will happen to get ready
for it because that's what it's going to
feel like to begin with okay now we all
mess up but how we react to respond is
how we're defined and how early so when
it happens just admit it's happened
don't spend the first three days in
denial get on with it move into your
incision response don't blame somebody
else don't blame the Russian base
jihadist so I'm your hottest because
it's not likely to be then probably to
your faults seek support if you're gonna
look a local cert team like we've run
the UK the SSC don't be afraid they've
got 12 people and that will come in and
help you out okay you've got to notify
the authorities and doing not doing he's
gonna really hurt you get here
information package together and you've
got Leslie response provider
you've got 72 hours your concert buyer
you've got 24 hours not a lot of time
find out what happened and learn from it
that's really important and improve take
it on the chin you'll feel a lot better
for it so your customers yeah quick just
a great program yeah I've heard about
the Beechworth discuss a while that
nobody he heard the beach will a
crevasse the difference between
to discuss handled correctly Equifax
didn't and that kind of proves the point
deal with read correctly you'll come up
for them then how was in the title
bridge and that at that occasion was
temporary alum detailed email but it was
yeah we didn't we up but here's
what happened
his little bit is make sure never
happens again gonna leave Mendes out can
involve in the community guys that's
what it's all about and our medium is no
Armenian is presenting using a medium is
music causes yeah but we are active on
Twitter we write with blog a lot of time
so just just a quick annoying list quick
pitch I wrote a book
I've got a few physical copies with me
is what the initial spike words you want
to borrow I need to also did use officer
Cassidy by lottery okay so that's it
we're in a bad man as thank you very
much