stop yep mayhap thank you very much
this is weaponizing late and in the next
45 minutes to an hour I'd like to talk
to you about what layer eight actually
means and why we should talk about that
so for those of you not really familiar
with layer
eight layer eight is a term that we in
the InfoSec industry or ite generally
have used to describe users the stupid
people using our systems and we also
have called them other names like PAP
kak which is short for people exists
between keyboard and chair our idiots
basically and this was some kind of
negative thinking I think that some
people in the industry still have when
we call our colleagues people that use
our systems the weakest link we are not
really doing them justice I think and
this talk is relevant because as we
proof day by day we in the industry are
known I'm really managing in we are not
really capable to solve our problems in
the industry and we won't be able to
solve them without the people using our
systems so the problem is to get them on
board
the other alternative that every vendor
at our say for example that is running
now will tell you is just buy a box and
put the Box in the network probably
leave it unconsidered and it will solve
your security problems little spoiler it
probably won't what the boxin will do is
they will create a lot of screens and a
lot of information and a lot of
dashboards for your secure operation
center and it will be just wasted
information because at the end of the
day you will have not secured some of
your humans and my phone conviction is
that humans matter the original version
of this talk was created together with
Brian fight and some of the things you
seen the talk are attributed to him this
humans matter
is from his own conference as well so
before we get into how we can actually
weaponize our alkyl leaks I would like
to talk to you about how I think cyber
actually impacts the physical domain
let's start with something funny
I've brought and I've said that I've
brought a lot of gummy bears and when I
did that I realized that I wouldn't be
able to throw them at anyone because hey
I suck at throwing and be you're quite
far away so I'll just leave them there
if you fancy that stuff then just
perhaps and after my talk still I
wouldn't mind you participating in show
of hands if you want to who a few has
heard of the great German pizza was five
six years ago so for all of you who
haven't five or six years ago we have
two main portals selling fast food so
you locked on you fancied a pizza or
your pansies burger and you put your
order in and the pond would just send
the nearest delivery service to your
home so basically the same lie traffic
deliver ruin others what you have in
your country but the funny thing about
the two major place in Germany was they
started ddosing each other on Saturday
nights so basically the idea was if the
other guy couldn't get the order then
I'm getting the order but if both are
ddosing then the other one then nobody's
getting the order so people went unfed a
little bit more serious is of course I
wanna cry so people who are not really
computer savvy or aren't online at all
we're impacted by stuff that happens in
the online world because hospitals
couldn't do with a job because their
systems were just blocked by ransomware
and the last example where I learned the
interesting term of swatting hope you
knows what's what heinous basically yeah
that's very good but how do we know it
because they're idiots calling the
police on somebody else because that is
what swatting means special weapons an
assault team and if you bear a grudge
against somebody and maybe you're a
teenager then you just call the police
and tell them there's something horrible
going on at that house and probably you
should go and have a look so when I was
a teenager we didn't have the internet
yet because gray hair stuff so I do
remember a friend calling a few services
to his neighbor because he hated him and
we found the funny at the time but it
wasn't the police it was just the people
you could call like a I don't know
hospitals the police we didn't call or
he didn't call so we thought that was
funny
in retrospect it was as dumb as this
but the one thing that happened
over the one example that I'm having is
when two people had an online fight
about one dollar and fifty in the game
of Call of Duty 3 I think it was where
the people let's call them a and B I do
have the names but they are really not
that important a thought that P should
give him the $1 and 50 for an online
nature they had and P didn't feel like
it so a threatened to SWAT him and B
said go ahead this is my address but he
didn't give the right address so he gave
an address where he used to live years
and years ago and what happened this a
asked his pal C just want this guy so C
was known and very notorious for calling
the police on other people he described
a violent crime going on
he said the son already has murdered his
father and he has cornered the rest of
the family in the bathroom and please
couldn't the police come and have a word
with him so the police went to the
address that they had and they knocked
so
person D opened the door and for some
reason we will never know
he am he got nervous because he looked
into the guns of a few people of the
police people and he reached for his
waistband maybe to scratch his ass but
the police took that for he was to draw
a weapon because they thought a Weiland
crime is going on and they shot him and
they killed him for one dollar and fifty
which basically means that guy who
wasn't in one line who wasn't even
playing games got shot because of
something that went on in the cyber
domain so it isn't a question whether so
I have impacts the physical domain I
think that is pretty much improving it
does and it doesn't even have the need
of you to be online or in any way
interested in cyber so how could we
empower people how can we get our
colleagues to be better at security
because we tried for years or we as the
industry to just tell them they should
be more secure and somehow that didn't
work so we came up with a few
interesting examples I hope they are
interesting to you as well so who of you
has heard of the old TRO of the pen
tester that just leaves a few USB drives
at the parking lot at at some point they
have network access because people are
going to plug them in I've heard the
story and actually it has been validated
by by by by by the University of
Illinois I was looking for that and they
handed up about 300 USB drives and about
half of them got plugged a so how do you
counter that because the thing is most
of us are still really helpful or we
want to help if you were working at a
company you found a USB Drive at the
parking lot and it had a set of keys
with it and maybe a little toy figure
wouldn't you want to plug it in and
what's on it just to find out who the
person was to return it or if you're
really person wouldn't you like to plug
it in if it was labeled Bitcoin wallet
or maybe finances 2019 so as an attacker
I have a lot of social engineering
vectors to make it more interesting and
to get people to really plug it in and
basically I'm talking to a roomful of
security researchers or people
interested in the topic so who if you
wouldn't plug it it of course we would
plug it in but of course we think we
would do it in a secure environment and
we would be very wary of the device but
we build something that we call over the
wireless detention station the way that
works is you need to authenticate with
your company card and then you plug in a
USB Drive and you get all the files on
the drive you select those that you want
at your office PC and you click send and
once you're back at your office PC you
will have a link to network drive and
you can download them pretty easy why
did we build that we didn't have in mind
that people should be able to plug in
USB drives they found at the parking lot
I would like to acquaint you with
something that it is a story directly
from big companies if you're working for
a small company that's cool if you're
working for a big company that might be
cool as well
but both have their own dangerous let's
say and big companies like my company we
do have some processes that are really
really stupid if you have a closer look
at it so assuming I wanted to have a
presentation and I had to give it next
day and I worked on it yesterday and I
wanted to bring it to the office I
wasn't allowed to do that because the
USB drive would have to have put in an
envelope that envelope gets sent to a
different building in the same city
somewhere there's some kind of magic
would happen and they were labeled they
were
seal it and they would put it in an
envelope and the internal Postal Service
would bring it back to my desk and this
would take about how long what you think
three days if you were really really
lucky more often four or five days so if
you really have something important
going on then it wouldn't work again
assuming you have a presentation that
you have to give the next day what are
you going to do are you going to follow
proper process no you won't so people
would just pluck the USB drives into
their office PCs and just keeping
fingers crossed that everything is okay
but with building that virus detention
station basically what we did it is we
gave them the the option to have it
sooner and now you can plug in any kind
of your speed drive that you find well
this company policy again what do you
think happens according to the written
down company policy if somebody finds a
USB Drive lying at the parking lot they
should hand it over to building security
so far so good
what is building security going to do
with the USB Drive so the written
procedure is they hand it to the
communal lost-and-found which is three
kilometres away and the USB Drive gets
lost basically because you could throw
it away I still want to go there and say
you know I've lost the USB Drive it's
black about that size do you have one
and see see what happens that would be
interesting so we're still working on
that part the people responsible for
that said why this process is working
why should we change anything that's the
fun when you're working in a big company
but basically now people can use thumb
drives the way thumb drives are meant to
be used the next thing I would like to
talk about is fishing and of course
fishing is still also something that is
very effective if you want to get into
networks if you want to get people to
click on links and shop
into the audience which of these things
is malicious and of course it is
terribly difficult to spot that without
any kind of research link shorteners
like but we and Google and whatnot are
making it nearly impossible to see
whether this link is malicious or it is
you have to follow it and you have to
have a look and then you can maybe tell
if it's malicious I'm assuming with an O
with a zero as I know this is actually a
link that gets back to Amazon because
they have that Amin and this is the IP
address of our our own website so it's
and the last thing actually the first
thing goes to Securitate and the last
link goes to the slides so they should
be up tomorrow evening I think but my
point is we try to get users to read
male headers we try to get users to read
links and to interpret whether a male
was malicious or not and it's been a
long time since I've read male had us to
find out whether man is malicious or not
and Brian came up with the term we
should look for indicators of
because that is much more easy much
easier and I'm going to enter the
indicators and I hope you will you will
agree that if there's one or more of
these indicators in an e-mail you can
safely throw it away in a business
context because this is not going to be
anything you want to deal with first
thing as always is money because at the
end of the day people want to make money
and the scammers want to get your money
or this is the end goal so whenever
someone in a male wants money from you
then just get very suspicious because
why and it doesn't matter what the
context this just get very suspicious
and that's also for for private emails
as well Mario this goes together with
threats
so the threat is you could buy a you
could get an email saying we noticed
that you downloaded this software the
software is our intellectual property so
you need to buy you need to pay us 200
euros and we will let it slip but if you
don't we're just actually we are going
to sue you and probably will end up
paying 5,000 euros so this is a threat
another threat is just implying that
somebody has done something illegal
because this is a motivator as well most
of us do not want to do something
illegal and if you get a mail saying we
noticed that you did that that that is
illegal and just to clean the slate to
to make your name good again you have to
pay this fair amount it's something for
most of us where we would react and say
ok are out of fear maybe I'm going to do
that even if I am not sure I get that
but the risk is too high
another good indicator of is
romance and I'm using the term very
loosely so whenever you get a mail from
a nice Russian lady who really has
developed an interest in you and you
alone then just think about the context
and think about what where she got your
name one of the spam emails I got years
ago that I still very very much cherish
in my heart started with them we found
your name in the database of real
reliable persons in Germany be cool but
flattering of course enrollments and
things like that and are good indicators
as well and one indicator that nearly
every time plays some kind of role as
well is urgency as for my example
earlier on you pay 80 euros now and
you're okay or 5,000 euros late
because we need to sue you there's
always a time limit like you have to do
it within the next 24 hours or 48 hours
but very often this is a very short time
living limit and that is a quite nifty
psychological trick because as soon as
you put somebody to a decision and give
them only a small amount of time the
brain works differently as if you don't
have a time limit because you you just
don't really think thoroughly about it
you think about the consequences what
happens and if the time limit is already
ticking then you are probably paying
it's some of them ransomware does that
as well
like just pay us within the next six six
hours or the price will triple so you're
not thinking well and all of these
indicators actually are for business
emails as well as private emails and the
next thing that's also a little bit
psychological and I still need to do a
few tests on that but when we read
emails or when people really mails they
want to do something with it
so either you want to answer or you want
to tick that box that you've dealt with
that email just putting it to trash
doesn't really satisfy that need to do
something with the email so in your
business context if you can put in a
button that says forward this email to
your security team whether your security
team is might be a secure operation
center or your main security team
whatever then somebody who got a fish or
spam I can click that button the mail
gets forwarded to the relevant people
and I feel good about it because it has
been dealt with and every social
awareness platform that does phishing
campaigns that I have looked at just
that kind of thing they implement a
button where you can just deal with the
email because then it's out of your mind
and it's actually a very good thing not
for the secure operation center because
those guys very often complain that they
get such a lot of spam it's not best BAM
it's the spammers it's going to just be
sent to them but on the other hand this
these are always fishes and emails that
pass all of your controls that means the
domains are not blacklisted yet whatever
the attachment is is not recognized yet
so it's a valuable source of Intel
actually to treat your filters so it
benefits it's beneficial to all our
sites and now comes one of the things I
really love to talk about that is
reverse social engineering and I've got
an example for you who of you has heard
about CEO fraud
so CEO fraud basically has nothing to do
at all with computers it's just a plain
old scan and to put it well it's it's
it's very simplifying but basically
someone claiming to be the CEO of a
company sends a mail to somebody within
the company and says you know I'm in
country X we really need to acquire a
company set can we make a transfer of
300 huh 300 thousand euros today so of
course the person that is targeted will
be in finances and they will have the
ability to do that hopefully but very
often there is again written procedures
that do not allow the person to do that
but what do you do if you get a mail
from the CEO you might act upon that and
if that goes on then basically that pupi
a person at the company will end up
transferring money to a scammer
because they've been socially engineered
the fake CEO said this had to be done
and they followed with it this is
something that sounds very silly if I
simplified and if I just say basically
somebody from the outset says give me
money and people in the company do that
but please bear in mind that Google and
Facebook helped for that for one hundred
million dollars combined and there are
many companies who fall for that in the
millions this is not a scam that brings
in a few thousand euros
you really if you do that and if you
pull that off you get millions because
you target companies that are picking up
one of the companies at the places where
I live that is Nuremberg in Germany fell
for that scam and they shelled out 40
million euros oh the good thing was it
didn't really break the whole company
but it put a dent into it into the cash
flow positive so what could we actually
do to make that better and another
company in Nuremberg came up with a
hilarious idea so they've got so many
emails with CEO fraud that they got
bored with it they really got annoyed
and what they did was they told every
employee you know if you get an email
just forwarded to the sock and the sub
would then go and change the email
address slightly so that is not noticed
and start communicating with the scammer
I would say no see oh very nice to hear
from you and you know I am not allowed
to transfer such large large sums of
money but probably you have forgotten
that we have this this very new
brand-new payment portal payment portal
yeah we do have the payment portal and
you can do all of your transverse
yourself have you forgotten your login
details and as a scam of course I've
opened my login details because I've
never had them in the first place
so they asked for user ID and password
they're getting it they are moving on
they are ticking a box saying yeah yeah
I've read terms and conditions and
everything's okay and they are presented
with a portal where you can enter who
should receive the money which account
and how much so basically is this camera
that's the check mode right because if I
can transfer the money to myself and I
don't need anybody else then that is
very good except of course um
it does not happen what happens is that
at the moment where the scammer presses
send or transfer the I then so the long
number describing the account and the
account name and it's getting
blacklisted and it's a lot more
difficult to get a new bank account then
it is to get a new email address I guess
this is something that most of you will
are creating so this company is building
up a list with blocked eivin's because
they are used for fraudulent purposes
and at the moment we are trying to build
a database on that and we're trying to
share the information but the fun thing
is if you're one of the good guys
trying to stick to GDP PR and you're not
really allowed to do that because you
haven't asked the scammer whether he's
okay with you using their personal data
yeah exactly and so at the moment we've
we still try to figure out a way how we
can share the data and make it
accessible for all the people who would
have an interest in that but again human
rights and other things come into play
the very good thing is at the end of the
day this camera won't have the money and
they will have been tricked into giving
out valuable information without having
anything in return
I'd also like to talk a little bit about
passwords I know this is one of the
topics that is controversial and that is
still something that we need at the
moment but still I think there's so many
things that need to be said about
passwords especially with this
discussion about passwords saves during
last one or two weeks I mean a strong
password is always better than something
that you can come up with but a non
security person can come up with if it
comes from a password safe or if it is
generated if it's generated and if it's
really really good then the chances are
that you won't be able to actually keep
it in mind especially if you have
passwords that are different for the
hundreds of websites and logins that
you're using so the left one would be a
very good password but do you know why
it isn't sorry no not because of the
remembering but it's on a slide that is
being recorded but this is something
that most of my passwords look because I
can't remember them I've got them in my
password safe and I've got a possible
that I hopefully can remember to access
my past would say and even if somebody
is holding a gun at my temple in telling
me I should tell them my passwords I
can't because again old and I'm going to
forget them anyway so why do you have to
say remembering them so I think we can
agree on that what we probably can't
agree upon at least a few people can't
is when you when you're talking about
khalif's or empowering layer 8 or other
people who are not as tech savvy then
I'd like to take into account also you
Nam for example or your your friends
that are not online and all the people
who a little bit online every now and
then have a Facebook account or any
other account where they do a little bit
of stuff and very often if you can get
them to use a password safe that's great
then they should use a password safe
nothing wrong with that on the other
hand if they don't want to do that then
let them write the passwords down in a
little notebook the thing is we as an
industry are very very keen or some of
us are very keen to say this is not
secure and well if you have a look at
everyone and try to find something one
size fits all for everyone everyone then
you might be right but if there's a
burglar standing in your grandmother's
flat next to the computer flipping
through a password book this burglar
doesn't exist
because if the burglar is in that flat
he's looking for valuables he's looking
for money he's little jewelry he's
looking for other stuff and even if he's
flipping through the freakin password
book then you just changed your
passwords afterwards because you know
he's been there but there's no harm in
letting them write down the passwords
and if they can write down their
passwords then they are going to be
better than password 1 or 1 2 3 4 5 6
and all the other stuff that we see year
by year as the top 10 passwords in the
world so this is something to think
about if they want to use to FA or MFA
then let them this is always great but I
think we need to have a little bit of a
change of thinking and think about that
10% of security is better than 0% and we
can't get everybody to a hundred percent
or 99 percent of 98 so everything we can
implement we should do but if people are
not really interested in it we can't
force them to do it so let's find a way
how we can make it reasonably safe
doesn't have to be completely safe and
if you think that this is a bad approach
then please also think about that guy
who ignores the smartphone's security
and his role in the world and whether he
or whether your nan needs a better
security than the President of the
United States of America it's just
something to think about one thing I
haven't seen in the wild and there are
reasons for that is kind of a male
forward as a service again to protect
the people at your company you could
have you could register a domain that
has nothing to do with your company and
offer everyone forwarding email address
so the reason for that is your email
address if you only have one I'm
assuming most of you in the room have
way more than one but most people who
are online just have one email address
and that is the most critical asset
because if is an attacker control
email address I control all their
accounts because what happens if I reset
the password it gets sent to the email
address for that account and if I can
read that I can get into any account for
that email address if you forward that
if I register at the platforms with a
forwarded email address then you even if
that platform gets breached they do know
my forwarded email address they still do
not know my real email address and it's
harder to attack on the other hand there
are many problems with what if the
person leaves the company and so on and
so forth this is why we haven't
implemented it yet but I think this
would be a good idea even if you can get
people to have forwarded email address
just a real email address that is just
one more layer of abstraction that makes
it harder to attack them and one thing I
also want to have probably most of you
won't be giving awareness trainings I'm
assuming but if you are working at a
company that most of you will probably
receive awareness trainings which can or
cannot be something that is really
really bad we do have something called
virtual training company and it's like a
flash game from the 90s where you have
to walk through a virtual company and
you see that bill is on fire what do I
do
well I go for a coffee I'll grab a fire
extinguisher
I call security so it's it's bloody
stupid and it's actually I think some of
the questions are just insulting because
yeah of course it's you don't go for a
coffee if there's a burning rubbish bin
but on the other hand I'm working in
various companies since 1990 I've never
really encountered a burning rubbish bin
so it's it's not a use case that has to
be dealt with daily and another thing is
fear uncertainty doubt are enemies of
security in my eyes because they always
tend to
fear tends to be something that is
really powerful if you want to get
somebody to modify their behavior fears
something that will help you in the
short run until that person realized
realizes they've been tricked and then
they will show the opposite of the
behavior that you wanted to have
uncertainty is always bad and doubt
because you should make very clear what
you up to what people have to do or
should do and have to do again is a is
bad worrying because you need to get
them on board you shouldn't talk down to
them but I'm getting to that later if
you're doing awareness trainings don't
do multiple-choice click this because
it's always see right
somebody tried various multiple-choice
forms and the solutions and they always
take see and they never got a passing
grade but see is very open the option
that you have to take if there's only
one choice and nobody really likes to do
that so there was the human hacker Jenny
Radcliffe there was one of her podcast
with Tyra where they were discussing
that they would laugh if people were the
watercooler being excited about the next
security awareness training but nobody
is it's like yes the platy training
again today crap so maybe we can do
something to make that better what we
did and this is very sneaky I know we
didn't call it security awareness
training it's just different formats one
thing is called long night of the
sciences this is open to the public this
is every two years all kinds of
companies just open their doors and show
show up what they're doing and we
educated people that we didn't know
about password security and other stuff
just by talking about it trying to make
it interesting trying to engage them and
I recently learned that one girl now is
having an apprenticeship starting this
year because she saw us
doing that there so you're reaching
people you just don't know whether
you've reached them or not and you
should have open formats I think so
unlike here I mean please don't but you
are free to leave if you wanted here but
this is still a closed room if you have
some kind of open office space we're
just talking about security and chatting
not just one person just always talking
on the cells but having some kind of
discussion and you can come and go as
you please then people feel more
comfortable because if they get or they
can just leave and nobody bats an eye
and using multiple channels really works
well as well because we all take in
information differently so we are
writing blocks we are doing those kind
of moments where you can come and go
where we do discussions we do talks
internally and it's all different
formats the only thing is if you do it
after hours then just please don't be a
dick just be as nice and provide drinks
as at least and a few crisps because
people will stay if they have free beer
or got me bears maybe hopefully one more
thing that a lot of companies do but
only to a certain extent is stopping
themselves so very often you have some
kind of Ultima some kind of mechanism
that will scan your company from the
outside but very often that is just port
scanning right you check whether there
are new ports open or whether the old
ones are still working and that is
farewell map sometimes you even hire
somebody to do that but very often what
you're doing is not seeing the complete
picture what do I mean by that if you
are only looking at the network level of
your company then you will miss out on
the whole social media thing and you
will miss out on your users and what
they are doing on the respective
networks Twitter LinkedIn saying what
have you
so what you can do I mean you can't
really marry often you can't just
monitor everyone in the company we've
got way more than 7,000 employees and
I'm not really interested what all of
them are doing on Facebook or Twitter or
whatever I would want to sleep very
quickly but if you educate them
especially with the top portals like
LinkedIn then you can have a really good
result what we had we about half a year
ago there was a person acting or having
a profile saying they belong to our
company and they were making friends
with our clients and they are making
friends with people working at our
company really working at our company
and so because nobody really knew them
our users who were everywhere
very good told us that there's something
fishy going on
so we were able to shut down that
profile very quickly within a day we
still think this is not an attack that
was targeting us but we think this
person wanted to look as if they were
coming from us and targeting a third
party which is in our case we've got a
really strange business but I'm coming
to that at the end if you're still
interested this is not unusual for us
that we are not the target but our
clients are and playing into this is
also cyber risk management so you're all
familiar with threat intelligence all
right presume so threat intelligence is
something that tells you interesting
data indicators of compromised about
attacks that are happening now or that
happened recently you will find out
about IP addresses that might have
attacked somebody or certain exploits
that are just running right now maybe
not probably not against you but against
that person and they are sharing the
data with you risk is a little bit
farther away from in
the terms of the timeline because a risk
is something that might evolve into a
threat but it isn't a threat really just
right now one example is if you know
that some of your users emails and
passwords have been breached on a
different site then you will know that
this is a risk and somebody will try
credential stuffing against your site
with the same kind of credentials that
have been lost on let's say yeah because
everybody was on Yahoo and this again is
something where you need to have time
where you need to have access to various
data sources like the dark web and
others and where you have to research
it's nothing it's not a solution out of
the box where just snip your things and
you've got the information it needs
dedicated people trying to come up with
the risks that your company is facing
but if you can identify those then you
can prepare accordingly and that will be
very valuable where the attack comes and
then finding the right language is very
important and it's short information yet
I already use cyber a lot and I've also
got a new teacher cyber mic and I know a
lot of the people in our industry do not
like cyber I'm sorry if you have to
suffer through that but as dr. Jessica
Parker said all of our clients are going
to refer to us with the term cyber and
if you don't go where our clients are
then we are leaving our clients in the
dark and this talk is about getting in
touch with our clients so I'm going to
use cyber because they are using it so
finding the right language this is an
example from last year's Def Con and the
person writing that got evicted from the
hotel very soon but after talking to the
DEF CON organizes the hotel staff was
there they let him in again reluctantly
but they did but if you only read that
tweet without being in the security
industry then this might be scary
because just a few months before the
treat shooter killed 58 people from his
hotel room so attacking people in Vegas
is a little bit of a touchy subject if
you just put that treat out then without
context that's bad and context is
something you need to give your users as
well not talking down to them of course
is the next thing because everybody
likes to be patronized right so we don't
like it why should we do it with our
police and there are ways of finding
something and finding how we can talk to
people this is another example where I
blanked out the uses in most cases when
it is something where I'm not sure that
it's still online and that was somebody
saying come on we as an industry are not
that bad right and somebody who is
developing apps and software said
personal opinion yes you are and
obviously outside of our little bubble
people really don't like us that much
but this is due to us in the industry
most of the people I'm talking down to
users for 20 years and it is changing
I'm happy it's changing but just let's
carry on searching for dialogue with
people instead of just you know telling
them what to do and what not another
thing that you can avoid is ritual for
rituals sake whenever you identify a
process in your company or something
that doesn't make sense and people just
do it because we've always done it that
way then just try to come up with
something that I'll say we don't need
that this is one of the examples I found
and I think it illustrates why it is
very important to understand the
security measures and where they are
implemented and whether they make
whether it makes sense to transfer them
to other processes in that case of
course it doesn't another thing that
might be more important than it looks
like at the first glance is locking your
screens so very often for a lot of the
companies I worked for they had this
very good company culture saying you
know all the attackers are on the
outside we don't have anyone on the
inside who would be a bad guy or girl
which might be right on the other hand
if you consider that I don't have
numbers from last year but usually a lot
of the attacks come from the inside as
soon as you don't call them it attacks
but also for a better world or
people just clicking stuff without
knowing what they are doing they are not
an attacker in the traditional sense but
their actions result in a compromised
Network so that makes them attackers and
very often if your company is speaking
up and if your company has interesting
stuff or interesting data then the
chances that you have somebody that
would steal the data if they are being
offered 500k or maybe even 5000 K 5000 K
yeah 5000 euros or quid then they would
do it
so mocking your screen and not giving
other people access to your mail to
everything that is open on your laptop
it's really important basically what we
are doing is amateur hour I get to the
pro version but if I see an unlocked
screen of one of my teammates I'm going
to send an email to the team saying
tomorrow there's free cake I'm going to
provide free cake or maybe a beer after
work something small something that
doesn't
costs too much because people then
follow up on it you know if you return
to your desk and you find out that you
promised Kate for 10 people the next day
then most people are not enough of a
dick to not follow up on that and they
will bring cake but they will also lock
their screen the next day or at least
after two or three times and when I say
this is the amateur version after giving
that talk at another conference somebody
came up to me and said you know what we
do we've got mattress rolled out wide
group policy so I only have to press
this and that key combination and that
my mail goes out automatically yeah
that's one way to do it we are not that
professional in that respect and
something that you have to bear in mind
is it's no use to have one dedicated
security person within a team and teach
them and give them all the advice and
they have to be the multiplicator and
get it into the team things like that
because it doesn't work you have to
educate every individual the way that
works works very well for us is when
we're doing trainings or giving security
awareness advice we are rarely talking
about the office we are very often
talking about how people can protect
themselves at home because people are
more interested in that and very often
they have the feeling that if they are
at their office PC they are protected
anyway because we've got lots of people
doing security and they have the feeling
they are protected anyway it doesn't
really help when they click phishing
links but for the personal life and they
are more appreciative of what they hear
and so the whole education really works
well if you educate everyone and I know
I still have some minutes but I thought
originally I was too quick so I I went
through something a little bit faster
I'm nearly at the end we were
talking about stop focus at the
beginning and I also have a lot of
stockholders this is my favorite stock
photo somebody used it like I've got
rude yeah
but what I want to say is we should also
eat our own dog food there's nothing
worse than the security team not
actually doing what they tell other
people to do and I've had that at my
company as well we had a security team
and if you wanted to do a proof of
concept with any kind of appliance new
software whatever you would get some
network share at the end of the universe
so to speak with no connection to
anything and you had to be confined to
that and be happy you couldn't access it
really you couldn't test it really but
everything else was too scary so imagine
my surprise when I was invited to be
part of a proof-of-concept for software
that they evaluated and it was just in
the office Network you know no firewalls
no borders because that's how it works
and it's much easier and stuff like that
really makes me angry because if you
have security guidelines everybody
should stick to them especially the
people writing the damn guidelines
because if you can't follow the
guidelines who else should you know
makes it senseless so basically I hope I
get across the point that it doesn't
really make a difference if you own for
some reason this just went out but
you're not really missing out on a lot
but if somebody from the technical point
of view could actually have a look I
wouldn't mind because I can hold that up
but it's no use but this light says
conclusion in cooperation at the moment
my conclusion my cooperation is please
think about hiring more people and
getting more security awareness out
there in a meaningful way instead of
instead of anything don't know doesn't
matter there really I promise you the
slides that come now are really boring
no more funny memes well
the very last slide is very funny but I
think but on the other hand we can show
you you doesn't matter so instead of
investing into new appliances that just
give more work to your sock or more data
that is not relevant just please try to
invest it in your people and also know
your threats especially know your
threats when it comes to social and when
it comes to other things that are user
related and not tech related I've put in
some links you can take a photo of that
slide in just now but they will be bare
with me my website is called cyber stuff
Todd oh yeah right thank you very much
and I will put the slides online as I
said probably tomorrow evening and you
will have the links there that's just a
little bit about the stuff that we we
have been talking about I also am a
regular on send security podcast in
English which is probably more valuable
to you because I also do with the German
send security podcast you're happy to
listen to it but if you don't understand
German it might be even more confusing
and thank you very much for listening my
name is Stephan Hagar my handle is at K
if you want to follow me on Twitter I
appreciate that you can have gummy bears
for that and that is a very cheap way to
persuade you I work for a company called
dot F in Germany and what we are doing
is we are writing software for tax
accountants and tax consultants and this
sounds for everybody outside of Germany
like something that is pretty boring
probably is but it is a big market in
Germany so we have 7,000 people and we
are I think amongst the five largest
software producers in Germany it's just
behind Microsoft OSAP so it's a really
big market in Germany but they say that
70% of wealth literature on tax is
written in German so they might be right
as for the last and hopefully it's
slightly hung it's like okay any
questions
yeah
so the question is what we were thinking
about Mach phishing attempts and social
awareness campaigns I think it depends
on the company culture and it depends on
what you're doing the uses and what
happens if somebody accidentally clicked
clicks a fish if you're in the kind of
company where that is very hierarchical
and where any kind of mistake will give
you the slip then this is a really bad
idea if you have a rather good aware
user base and they know that this is
happening and you can gamee find it
to a point where you can actually have a
list where you see you're better than
marketing or your department is so never
go down to the individual just make it
teams it can be a good idea if you
repeat it say three times a year maybe
four times a year not more often because
that becomes annoying on the other hand
I think and I'm a firm believer that I
don't know how I can get there but I
think a user at the office PC should be
able to click anything they see without
any kind of fear because it's the job of
the security team to make sure that they
can click anything without anything
happening at the moment we have that no
company because our office network is
not connected to the internet so yeah
click on the fish and that is why all
the social media we have social
awareness campaign people trying to get
us to try the product and whenever we
said you know we have that we have
separated our network from the internet
and B no we won't whitelist your fake
domains because that is not the test
we won't watch this the domains for any
scanner so please try it in the
environments with these constraints
because this is how a criminal would
have track nobody took up the chance to
improve under any other Christians and I
can throw gummy bears but i'm reaiiy
really suck at that
so if I wanted to throw them to you I'm
sorry in advance yeah see questions
sorry no more Christmas I'm the one
standing between you and break so I
won't do that any longer
thank you very much