for sale for $15 it's a lockpick village
we're gonna have lunch after this at
noon we're gonna be selling old besides
shirts for $5 minimum donation and that
money's gonna go to the rural tech fund
and the mental health hackers so all the
money's gonna go back to the charities
if we ask for a $5 minimum donation
those should go on sale roughly about
one o'clock
next up or first up for today down here
is judo threat intelligence by Frank and
Joe Lilly Lilly okay I'm sorry but
should the poor man's name everybody how
you doing today my name is Frankie and
Joey I know it's a little hard I've got
all the vowels
I've got like all of them you don't want
to play we all fortunate with me it's
gonna be like end an L there's five else
now so so the holy wow that's not my
last name as you but don't think I
haven't thought about changing it
because I definitely yeah one of my
daughters actually has a you and her
first name so she's pretty much all
covered so today I'm gonna talk to you
about judo threat intelligence and
despite this incredible physique I don't
actually do judo I used to do karate
many years ago but this is far more
about walking through a thought process
that I've implemented at a lot of
organizations it's a philosophy that
deals with a lot of the challenges that
we have in the industry and I think has
provided some pretty good results I hope
you get something out of it next slide
please
the deal is doing a great job backing me
up on the slide so thanks very much so
it's a little bit of background on me so
I've run a number of different security
operations centers throughout the
country a lot of New York financials a
lot of government organizations and as I
said what I'm going to talk to you about
today is a philosophy that I've
implemented it each of those
organizations and its really kind of
helped there's a lot of information that
comes out on the web there's a lot of
things that call for our attention okay
but like what's the most important thing
what's the most important thing that
we're supposed to do yo don't worry
about it cuz you'll see that in a
cybersecurity news article right oh so
wait a second so the next slide please
so when we think about intelligence I
always think about the difference
between information
and intelligence right so there are
definitely things that gives us a lot of
information but when we distill that and
digest that down into work
what the heck should I do now so one of
the things I like to say is that the
most important decision is what you
choose not to focus on right because
there's a thousand things calling for
your attention so what is that and the
difference between internal intelligence
and external intelligence so yeah
there's a lot of providers out there
that are giving you an external
intelligent you know cozy fuzzy happy
bear you know versus whatever panda
right we get those reports and they're
good they're valuable but what's inside
of our organization what can we use in
our and that's primarily what this is
going to focus on and then obviously
being actionable and scalable at some
level right brute force is not the
solution next slide please
so in order to understand what are we
dealing with in the Security Operations
threat intelligence incident response
type world I want to measure this from a
couple of different angles so the chart
that you're looking at is a program that
I wrote that's downloaded every single
cyber security security news article
that's been published from 16 different
sources every day since April of 2019
I've done world word clouds on this I've
done classifiers on it you see how many
of them are malware versus
vulnerabilities and the meta of this is
there's between thirty and fifty eight
articles being published every day all
right so wait a second that's a lot of
articles and how many how much
information is in each one of those
articles about 400 words so let's do
some math and that's approximating half
a novel a day okay that's pretty cool
but what am I supposed to do with that
okay I can't even read like a novel over
like five weeks like for free how about
I have a novel a day right and then
underneath you'll see there's some some
studies there at the bottom talking
about noise in the sim world we all kind
of kind of know that that's out there
all right so setting the stage here this
is kind of the volume of stuff that's
being thrown at us on a regular basis
right there's more to it but this and
then this next slide please and that's
kind of clear and so as I started
building out you know larger Security
Operations Center I wanted to search for
a strategy
I really wanted something who's dealt
with this before because somebody
somewhere is dealt with this before I
can't be the first one and so I looked
at some military strategies that are out
there who's dealt with this some
historical context right a good example
of this is the Vikings and England right
when the Vikings invaded England they
could attack any single point on the
whole coast of England at any point in
time but England had to defend every
single inch of coastline for years and
they pretty much failed at it
that's the kind of idea and so a guy by
name of raki introduced me to cost
woodsy in theory which is very
interesting it's like how do you defend
that can karate we have like the iron
law it's like how do you defend against
this type of stuff and there are
similarities to personal combat tactics
right so I mean if you've ever walked
down the street and come up against a
aggressive person who's much larger than
you like that's definitely never
happened to me right I'm not the biggest
guy in the world you can kind of feel
where we may stand as defenders our
adversaries are very well-funded or
they're they just spend their time
developing tools and can attack us at
any point and so he came upon the story
of a guy and I'm going to share this
story with you next slide please who
dealt with something very very similar
to this enter dr. Joe Goro Cano so what
I really liked about the stories that I
read about him is that he was small in
stature to give you an idea don't quote
me on this but he was roughly about 5
foot 2 and 95 pounds and he was very
well-educated and he he wrestled a lot
of jujitsu this is way back in the day
and he lost he won quite a few battles
but when he came up against the top
school and the bigger guys he kept
losing and so what he decided to do was
to study the attacker so as I'm reading
through his journal I came upon these
quotes they basically say usually it had
been him that threw me and all of a
sudden I started throwing him with
increasing regularity said really delve
deep into that right it sounds like
something really worthy and he says it's
because of the results of my study on
how to break their posture he's a guy
this has got to be this has got to be
worth something right how did he do that
what was that about and so what he
basically figured is that if he applied
all of his
physical strength and his small stature
before he broke the opponent's posture
what he was doing was just wasting his
energy and so I see similarities across
the cybersecurity world where you know
we're experiencing fatigue and burnout
the number of hours that people are
working and just the sheer volume of
things that we have to approach it's
like that brute force that Zhu Goro is
applying prior to breaking their posture
and so what I've developed out of this
is how we could adopt some of those judo
principles into what we do and so I'm
going to go through some pragmatic
examples of what that actually looks
like and then I'm going to step through
some of the methodology that hopefully
you can take away from this and find
valuable next slide please so let's get
to an approximation of their posture
this isn't going to be perfect right but
I think it's a pretty good approximation
like attacking the profit Center
defending a cost center it's cool every
time we go to the budget guy they're
like well there isn't budget for that
well okay but we're still under attack
why because it's a profit Center next
click next please just once yeah
anonymity is their armor they can come
from any IP address anywhere in the
world with any type of attack at any
point in time and all they need is that
one vulnerability that feels kind of
painful next slide please
thank you right and they always have the
initiative so if you've ever stood up a
web server in the cloud and turned it on
and then looked at the logs like within
about two hours you're getting attacked
all right thanks so thought a little bit
more about this and I think that this
models a fair percentage of what I think
is going on from a super super high
level which is that defenders we take
money who we convert that into time so
it could be a tool it could be a
capability it could be labor it could be
contractors in order to effect some sort
of an action but attackers do something
different the they invest their time in
a way that lets them produce some sort
of an action in order to get money there
are different scenarios for my summer
ideologically driven I get that some are
compromised driven I get that but for
the vast majority of it think about bug
bounty the way bug bounty works anybody
in
you bug bounty yeah okay so you spend
time in the hopes of getting an action
which will produce you money so that
kind of helps us understand I think
their posture and where hopefully we can
gain an upper hand in this next slide
please
so again focusing on that it's like in
that time aspect if they invest time
they want to get action and lots of
money so I want to step through some
some pragmatic examples of this where I
think that this works we see this in
deception technology but blue team
defenders can actually do this next
slide please so before I begin this the
three principles are use the attackers
energy against them right that's how
judo works let's a lot of you know
certain martial arts work is let's use
their energy against them somebody's
running headlong at you you don't
necessarily run right at them sometimes
just kind of step to the side if you're
lucky you put your foot out you know and
then you smile it's like a Bugs Bunny
kind of thing right use their action
against them right maximum effect with
minimum effort that brute force I've
seen that brute force apply to a lot of
security operation centers where people
are coming home at 9 o'clock at night I
don't know if that's the right approach
you might have to do it for a short time
but you got to get ahead of it and then
break their posture before you execute
the throw so again it's like you can
apply all your force but until you
understand where their balance is and
how to break it that's when you want to
apply your energy so let's do this
because this is fun we'll get into the
more of the technical stuff so let's
apply this to an exploit kit next slide
please all right so it's believed Oh
exploit kit this one came out around
March was published very interesting
let's look at the data let's look at the
data elements so first on the left we
see an IP address how many bad IP
addresses are there out in the web come
on it's like billions right they could
stand up anyone anytime they want
anywhere they want so wait a second that
feels like we're there strong let's look
at domain names so these are subdomains
but I spent about 8 months studying
every newly registered domain name and
that I could get my hands on every day
and there's about 80 to 100
that come out everyday what am I gonna
do with that and the second they turn on
the exploit kit is when it gets
weaponized so they have the initiative
but let's focus now on the URL so if you
look really closely there is a weakness
and exploit kits and the weakness is in
order for the adversary to make use of
it that servers got to understand the
traffic so there's something there the
client or the victim whatever it is you
want to describe it has to send a
request and that server has to interpret
it if it has to interpret it it means
it's got to be interpretive all it's
repeatable they're all constructed based
off of a similar pattern and so the the
whole reason why it's called a kit is
because they take this and they copy it
hundreds and hundreds and hundreds of
domains so they wrote it once they read
it many click next once please however
if we write a regex that matches that
exact pattern which this regex does and
you test that through your environment
the only thing you have are true
positives you just broke the exploit kit
that's exactly what this is about if a
get request or a post request goes
through your proxy servers or your URL
traffic that matches this regex pattern
it's only the exploit kit so if they
take that exploit kit and they copy it
to a hundred thousand IP addresses
doesn't matter and they could register a
hundred thousand diamonds it doesn't
matter the code running on the server
produces this URL pattern and if you
block that
you've destroyed the exploit kit at that
point in time all that the money and
time and investment that they spent to
create that exploit kit you just wrecked
it so I've done this a black hole 2.0
2.1 nuclear Scavo several others you
know you can check them out I wrote the
signatures from years ago this works
and so if how many exploit kits are
there anybody want to take a guess
couple dozen ten who knows how many
exploit kits are there not that many
there certainly aren't hundreds of
thousands and there's definitely not
billions so if you can reverse them you
can block them you've just taken a whole
class in Category out of your way now
you'll notice in this discussion I
haven't mentioned one thing I haven't
mentioned what malware was being
delivered why because if you can block
the get request for the binary I don't
really care what the malware is because
you're not gonna get it yes you now a
research is really important
yes doing that kind of stuff is really
important than staying ahead of it's
really important but you can't deliver a
malware binary if you're using this next
slide please so here's a demonstration
now from a couple of days later another
domain came up with this exploit kit to
poit you'll see the domain name has
changed but the pattern still matches
right
so that's how you can break a hole
exploit kit next slide please
it's way easier than going after the
domains and so the whole concept is like
what you exactly want to do is to
destroy their developer's value you
develop an exploit kit you deploy it out
we block it they can't copy it anywhere
else they can't sell it anywhere else
I'm gonna sell you the spec Havel
exploit kit well dude I don't want that
man that's already been broken and then
you break their money kind of the
concept of where this is going and I've
applied this at a couple orgs so let's
keep going
so it's apply this to web traffic all
right going through web traffic you can
find anomalies bumps you don't have to
use machine learning for this it does
help it's nice if you got it but if you
don't have it you could do a lot of
other stuff you do statistical analysis
I did a talk called wrexham noise it's
got some good information on how to do
that if you don't have these tools and
you'll see here there's a big old spike
in the traffic this is traffic over time
I'm sorry it's cutting off a little on
the screen guys but you'll see a spike
in the traffic here so let's dig into
that spike let's find out what's going
on next slide please
so what's really interesting about all
that's really hard to read is that hard
to read oh man okay all right so I'll
describe it to you and it'll be just as
good I promise
so what you're looking at is an
aggregation of the user agents during
that time frame
yeah no idea if it was user agents I
just picked a field let's look at the
URLs let's look at the user agents I
know that sounds pretty good right right
in the middle of all of this is Firefox
version 1.5 so yeah okay I'm getting
some laughs yeah absolutely
so like up here is like good Firefox
versions at normal and then all of a
sudden firefox one there is no reason on
planet earth firefox 1.5 should be
touching my infrastructure oh yeah dude
Adrian you're the best man
thank you very much appreciate it so
what you can see here now you can
actually see it is these are Firefox
versions and there's 1.5 in there this
is a reason why it's firefox 1.5 because
this is a tool and that tool was written
by folks around the time of firefox 1.5
and people just copied in it and
downloaded it and deployed it to
hundreds of thousands of IPs and just
started hitting our infrastructure BAM I
can see them next slide please
so let me give you another good example
of this this is the black spider tool
okay you see this with Olli txt if
you're dealing with needs alerts on your
web infrastructure you may have seen
this one and so there's a really good
snort signature out there I think it's
very valuable it's very important it
alarms you when there's a get request
for Olli txt basically this is an
attempted exploit and if the exploits
successful Ali dot txt gets uploaded to
your servers if you look at your web
traffic you'll probably see this
downloading all the traffic that these
guys were doing Holly dot txt was the
last request all right so let's think
about this in the time sequence one of
the other after the other after the
other we're getting a needs alert on the
last request of the tool okay so what's
the first request of the tool what does
it start with when we mapped it out it
turned out that every single one of them
sent the same sequence of events and
precisely the same order because it's a
tool somebody wrote a tool and the first
request is head admin f-ck editor
it's an exploit request right so when
that request comes in we banned the tool
so let's think about that from a
sequence perspective so we get all the
way to the top the first request comes
in we banned the IP address and the rest
of the tool I don't really care at that
moment what's in it because it all fails
it's all gone and so doing this at some
of the organizations that I've worked
with
we've Auto been 800 IP addresses a day
like just automatically banned them like
the second you touch us anywhere in a
no-no spot like you're out of there like
you
and so to give you an idea the
effectiveness and that the of that the
pen test team called us up in my sock
and they said can you please whitelist
our RP our IP addresses
why I think I was like well we keep
trying to start up the thing and we keep
getting banned hey wait a second no no
bro you got to give him I like you
giving my infrastructure with all this
defenses then you've really done a pen
test right next slide please
so all right so this one this is a
little bit more intricate but it's a
really interesting scenario so that
you'll see there's these explode
explosions of data points coming out of
a central point looks almost like orbit
it's three dimensions at the center of
those are source IPs and exploding out
from them or all the URL get requests or
head or you know what I want a reverb
pick your verb here okay
and so it looks like it's in three
dimensions around the tool and there's
only two source IPS here what's super
interesting about this is that the ones
that are marked in red are overlaps
meaning these two different tools which
are designed to attack web
infrastructure make overlapping requests
so if I can find one of those and ban
that infrastructure coming in towards me
that IP address that whatever it is I've
lately like just by accident like
because of coolness
I've been to tools so there's a snowball
effect here as you do this and you start
knocking down infrastructure where
you're going to start to overlap tools
and see patterns that that occur within
them and I'll show you precisely how to
start with this inside of your logs if
you've got access to them from any
direction right next slide please
all right let's talk about the
methodology and approach here like how
can you actually do this inside your
enterprise next slide so one of the
biggest things that I see happening in
security operation centers is that we
have to start with the basics right
crawl walk run there's a lot of
organizations out there that are
attempting to buy tools that are going
to get them to the top and the most and
the the most advanced capability
immediately I haven't yet seen a lot of
scenarios where that's been super
successful and part of the reason why is
we have to build from transparency so
you start by seeing what's happening I
couldn't analyze those web logs if I
didn't have the f5 load balancers coming
in or I didn't have access to those web
logs on those servers in order to be
able to conduct the analysis I couldn't
tell you what was going on in our
infrastructure unless I could see it the
second one is in signal-to-noise what's
the difference between an alert that I
do care about an alert I don't I'll give
you a one example of this we recently
did a threat hunt in an organization
that had uh needy arm not going to say
which one and they had 550 alerts all
right so like all sorts of things are
happening but 550 things came out and
said this is an attack of 'el that 550
only one needed action and it was if I
remember it it was a really nasty piece
of malware and so what is that signal
that signals like 0.2% or something
right don't don't ask me to do math that
fast I can't do that right
it's like point two percent so you gotta
figure out what the signal is to the
noise but once you get to that you get
to actionable alarms so some of the
objectives I set in security operations
are I want signal to noise 35 to 85%
meaning if an alarm goes off it's got to
be 35 to 85% accurate something like
that that's the target goal anyway
because then when you're looking at
alerts you're looking at things that are
actionable and the patterns begin to
materialize
so I worked with a couple data
scientists throughout the years and one
of them basically told me is like
patterns do materialize it's it's like a
creative approach to data like as you do
it the patterns will materialize oh hey
it's a phishing attack ell we've gotten
a bunch of those those are you know
those are business email compromise hey
look we've gathered all the URLs eight
look the URLs are all structured the
same way that's a pattern can we do
something about it won't you do that you
start identifying their tools and then
you could start building towards the
automation yes can some tools get you to
automation quickly they can but I have
seen this exact pattern happen almost
every sock I've worked in and built out
and consulted in so I hope that this
kind of helps set the stage of where we
can begin good at least as far as I
could tell okay so so let's really do
this pardon me mmm this week my immune
system is like the Grinch it's two sizes
too small you know that's just I'm
fighting off a cold let's apologize
so grab a threat IP address that fired
something good jumping-off point you
gotta have something to start with
you'll find all the signatures that that
fired so if we're gonna be like you know
mids or whatever whatever it is that
you're looking at could be a wife you
got tuned into your own infrastructure
that's why I'm not up here standing here
telling you how I did this with X tool
right once you do that go look at all
this signature fires for those
signatures go regression test them
through the past how many times have
those signatures fired a lot a little
what were they associated with and which
will start to get to is a hundred
percent true positive signatures like
this starts to actually happen when once
you do that find all the IPS that fired
those signatures and collect all that
metadata and what you end up with is a
good pool user agents bad ip's web
requests layer seven data you can use
that excite please
[Music]
so as you do that you can start building
custom arms custom alerts that are built
on that information and you'll see
things that are attacks that aren't
firing it signatures you can start
building custom rules for those right
there because they're really useful
they're very helpful
then you regression test those turn them
on and as they go to num and now you're
starting to get closer you find all the
100% true positives start tuning on
those signatures and you start building
a life cycle where you iteratively go
down it's almost like a Fibonacci
sequence the first time you do it is
gonna be a whole bunch of data and
you're gonna be like oh my gosh I mean
the second time you do it'll be a whole
lot less and then you know within a time
period it depends on your organization
it'll start to get really surgical and
you can say I know exactly what that is
so we just did this with a health care
too we help them tune up their sim and
now they are literally firing on every
single needs alarm that fires except a
couple of IPS which we know are super
noisy in their infrastructure and a
couple of signatures that we know are
not valuable outside of that if it fires
a signature we're gonna see it and we
know it's bad because we know it doesn't
happen okay and you kind of keep this
lifecycle going as you work in your sock
and and you'll build new content that's
valuable next slide please
cuz you do that you could start taking
tactical actions I talked about
quarantine the IP addresses it's a good
example one example was you know if you
have a windward spawning CMD or power
shell or vbscript you have a vbscript
that's launching downloading an
executable and writing it to your temp
folder
what's the malware well in that scenario
I don't know but it's Bower and if I can
stop that vbscript from running and
writing it to the temp folder it's
blocked malware and that's kind of
pretty good right just love to see these
patterns come out and you'll figure out
inside your enterprise how what tool can
I use how can I use it and ban it so
some other statistics that can give you
about what this has produced one
organization reduce their malware
infection by
seventy-five percent who was absolutely
dramatic it rolled off a cliff and that
was like four or five rules one
organization we I dropped their meantime
to contain by eighty percent in three
months
it was just wham you know so you can
actually do this it's not necessarily
the easiest thing the first time but as
you dig through it with a methodology
it's cool alright and okay so one other
story to tell you
one organization that I worked in we
mapped out a bot and that bot was
scraping our externally facing web
infrastructure yeah there was some data
on there that could give you too much
detail but there was some data that was
on there and they started seeing
increases in volume over time and we dug
into that increase in what we found was
a bot that was 500 IP addresses large
that was scraping data from their
external infrastructure to download it
not a single one of those IP addresses
was on any threat intelligence list
none of that traffic fired in the alert
but it was a business risk it actually
threatened their business they're trying
to repeat and copy all the data and so
like once we knocked those guys down the
time that it took for them to stand back
up their infrastructure come back and
try it again with a different technique
was two weeks it was about fourteen days
was the average he said they were
determined we knew who they were
we knew what their objective was we'd
keep our eye on the ball to try to
protect them when we advised the
business how to fix that but that's what
I mean when I say internal intelligence
like it's not going to fire any types of
alerts next slide please
so how am i doing on time I've no idea I
do okay
so overall the concept here is applying
all of our energy and brute force before
we understand the posture what's
actually attacking us it may hurt us in
our energy and you know we see a lot of
conversations I particularly pay a lot
of attention to what's going on with
burnout there's going to be a good talk
I really want to see it today on burnout
and and how are we going to deal with
that as an industry because we can't
hire as many people as we think we need
and we can't address every single
possible scenario that's out there in
order to attack so where do we put our
energy excuse me and I think that this
among other techniques this will help
apply and focus where that energy should
be it's getting 5,000 alarms in your sim
a day really isn't going to help you all
right okay so question thoughts any
comments yes
[Music]
absolutely so in that scenario so the
question was along the lines of okay
using a regex for a URL request works
but not if it's TLS encrypted and you
can't actually see the traffic that's
100% accurate and so then the question
becomes alright is this a super
difficult is this a super prevalent
threat vector in our enterprise right
that's the first question should I spend
time on figuring it out is what I'm
trying to get to second one is where do
I have visibility do I have an EDR
that's going to show me what happens on
the back end of that I have a bad you I
have a bad domain and you can see the
domains even if it's TLS encrypted I
have a bad domain okay let me pivot to
the endpoint let me go look at what file
activity registry activity Services said
or what happened on the EDR what
happened on the endpoint during that
time frame and what that will begin to
do is then draw correlations between the
two and that will give you what the
command structure looks like on the box
which exploits being delivered how that
materializes it's a word I use is how it
behaves on the endpoint when it gets
that you know does it write an
executable file to you know app date a
local temp right and then when that
happens what does it do and can you
introduce truck sure from that side
because you don't have the capability
that I described here but you probably
have other capabilities now if you don't
have any of those capabilities you find
there's malware in your enterprise it's
probably a pretty good idea to
investigate what's the easiest way you
can start to figure that out and I use
the word Start specifically a lot of
folks try to go from zero to a hundred
percent perfect it's like well we can do
some crawl walk run here right do some
collecting of logs OS query you can use
OS sec there's a whole bunch of
different things that will in tune up
your visibility and then help you move
along that path till you get there for
your enterprise does that help answer
the question okay absolutely
everybody else yeah
[Music]
exactly the same to me I mean I don't
buy this
so mysterious
to see the thing
hmm okay so the question was around
artificial intelligence and machine
learning as a proposed solution to all
of these issues and why folks in the
industry feel like they're not actually
delivering on what they say
okay so here's I'll say about that so
the first the first issue that I've seen
is a lot of folks are looking for
univariate solutions to problems what's
wrong I don't know I can't figure out
what's in my logs what's the solution
machine learning it feels like in a
univariate but the truth of the matter
is that's absolutely not how it happens
so when you go back to that user agent
string for firefox 1.5 the way this
looks if you map it out if you aggregate
the data is it looks like an exponential
decay curve okay and the without going
to math II like because I'm totally like
a math Iggy can that's bad right it
depends on the steepness of that curve
to interpret it but it's right in the
middle so when you run a machine
learning algorithm and say show me
everything that's inside of this thing
that's anomalous you're not going to get
that user-agent string because it's
right in the middle of the traffic
you're gonna get the really weird one so
that's like one good example of this
we're in the midst of your distribution
curve you're gonna have the badness and
the only people that can really identify
that so an unsupervised machine learning
model where basically you plug it in
turn it on and it pops out and goes
here's the bad guy right totally
unsupervised you're not doing anything
that will show you some stuff but a
supervised learning model will really
work in order to do that it has to be
driven by subject matter experts and
that connection hasn't been made yet in
my opinion at the level that a lot of
these products are saying it has okay
and then the last reason is you're also
talking about string data this is a she
text and in order to do really good
machine learning you want to convert
that into numbers how do you actually do
that effectively it's weird because your
log is going to parse differently the my
log and then his log and something else
so there's it's kind of like a way of
saying oh it's like super complicated
not that's the reason why and so they're
coming to every
they're saying I've solved this problem
but we've also heard that before I mean
people have said well you get a sim and
it'll solve your problem we have
out-of-the-box rules you turn them on
and you get bombarded with noise and
then you cry like that's but like tell
me that doesn't really happen like
that's kind of really how it happens
they're like well you just all you have
to do is turn it on and everything's
solved the the salespeople that have
told me something different than that
those are the ones I work with because
they really get into the meat of it I
think that eventually there are some
machine learning algorithms and like our
artificial intelligence I define as
something that can interact like we are
right here so you know this Josh always
last names going to escape me from MIT
has talked about where AI is from a
brain perspective and the last I checked
on it was like a six month old child so
I wouldn't put my six month old child on
a sim though I am trying to train my
kids how to be a security at elastic it
assure you yes you know is interesting
somebody shipped us a package and in it
was shredded paper and I wanted to
demonstrate to my kids what privacy is
like if we sat at the dining room table
and tried to reconstruct parts of the
shredded paper it was really interesting
it was there another question yes
[Music]
I'm sorry I'm having trouble hearing you
[Music]
yeah 100% corrected so just so everybody
can hear like what this gentleman is
saying I definitely agree with
wholeheartedly it's like if you don't
have your own tools you can rely on
other people's tools to give you that
jumping-off point or you can rely on the
tools that you've got so ultimately at
the end of the day that's what Zhu Goro
Kanto story was so powerful it's like he
has 95 pounds of 5 foot 2 or whatever
size he is he's really small but he's
got what he's got and so he used what he
had as best as he possibly could and
that's the reason why I'm not up here
standing and saying implement the same
and your problems will solving this the
technology to do it
it's like in your enterprise it's going
to look different if you're looking for
things that are affecting only you in
the way they affect you it behaves
different ways cool
any other questions thoughts comments
yeah god
[Music]
August Spence
is that something
yeah so the question was have ever
implemented black lists based on user
agents like we saw the anomaly and is it
actually worth doing so let me tackle
first piece and then second so first
piece yes absolutely you can do a black
list you can also do an alarm list it
depends on whether you want to see it or
whether you want to block it these these
attackers are human beings and so if we
were so we asked the question anybody in
here spell a word wrong but they spell
it wrong the same way every time anybody
oh yeah there's hands going up okay do
not ask me to spell the word definitely
you're going to get red squiggly lines
on the bottom attackers suffer from the
same thing that technique by the way I
used in counterfeit enterprises going
after them
fraudulent Facebook advertisements they
make this mistake all the time they'll
misspell something and they'll misspell
it the same way every time and then they
copy it a hundred thousand times the keV
you ever tried to convince IT to rewrite
an old tool for some reason that's in
the enterprise they're like I'm not
doing that
that was the worst week of my life the
hackers are going through the same thing
they're like well I can't kind of
rewrite that tool because it's two point
five hundred thousand places so yeah it
can be very valuable and then and then
the second part of the question is now
escaping me I got too far down that path
can you repeat it
oh is it worth doing yeah so um in terms
of enforcement the reason why I think
this stuff is incredibly value is if you
look at how I think it was Rudy Giuliani
approached law enforcement in New York
City now I don't remember if it was
broken glass or broken window that's one
of those things my brain just can't
click properly on but he enforced the
basic laws which ultimately demonstrated
to the community as well as the real
criminals that they were enforcing the
law
this happens believe me when I tell you
it happens you start enforcing broken
glass or broken window in your
enterprise and you will start making
other people go away a very wise man by
the name of Bill I worked with told me
you don't have to be the fastest gazelle
and I heard you just don't want to be
the slowest and so when when you're
banning hundreds of IP addresses and
blocking people and knocking down
malware and it's really hard to get in
folks what's happening is some guy is
sitting behind a terminal and I I just
say guy right could be a gal sitting
behind some terminal and their boss is
coming over them going did you hack into
that enterprise yet the guy's like I
don't know what's going on it's like
every time I learn a scarran I'd burn my
period dress I can't figure out what's
happening because you better get on it
you know it's frustrating for them and
jagira even says that in his logs he
says that when I started beating the
guys that were bigger than me they were
inordinately frustrated and what you
want to do is frustrate them so you will
ultimately build a reputation right
across other peoples industries it's
like well that's out such as such an
organization oh man
you have no idea how many headaches I
had try to get into those guys it was
painful like this
there's humans just like us so yeah I
think it's really valuable
anybody else questions thoughts comment
show hands everybody find this useful
yes I really appreciate the opportunity
to present it to you thank you so much