# Media

url: https://www.youtube.com/watch?v=piW-nUKIqkE
title: DEF CON 32 - An adversarial approach to Airline Revenue Management Proving Ground - Craig Lester
type: video
author: DEFCONConference
ingestion_date: 2024-11-09
transcription_model: large-v2
chunking_status: completed
content:
{
  "webpage_url": "https://www.youtube.com/watch?v=piW-nUKIqkE",
  "title": "DEF CON 32 - An adversarial approach to Airline Revenue Management Proving Ground - Craig Lester",
  "description": "Richard Branson is oft quoted with the quip that the quickest way to become a millionaire in the Airline Industry is to start as a billionaire. An Industry constrained by high fixed capital costs, bi-lateral capacity treaties, airport slots and curfews, labour etc; Airlines use the practice of revenue management to fill planes, maximise earnings and keep competitors at bay. But you\u2019re not interested in an economics talk \u2013 this is a hacker con. I\u2019m here to provide a birds-eye view and introduction into how fares and ticketing work, debunking some myths while outlining system constraints and limitations that introduce vulnerabilities. As an outcome, attendees should gain an introductory understanding of airline industry pricing, published fares and terminology. With most blogged 'deals' patched quicker than RCEs, the deeper understanding of not what but how, facilitates a progression for those interested to interact on more specialised discussion forums.",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 2556,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241016"
}

0.14s - 7.84s | This text was transcribed using whisper model: large-v2

 Good morning. Ah, there we go. Good morning everyone. I am a Lillian Ashbaker. I represent the aerospace village
7.84s - 15.78s |  I do the speaker CFP process the aerospace village is in conjunction with the creator stage team is pleased to introduce Craig
16.06s - 23.10s |  He is presenting on an adversarial approach to airline revenue management. So please welcome Craig to the stage
30.14s - 32.14s |  Well, hey everyone
37.50s - 39.98s |  I'm Craig a little about me. I
42.38s - 45.54s |  First moved interstate for work about 15 years ago and
46.34s - 48.34s |  started flying a lot since then
48.50s - 53.28s |  by trade, I'm I work with Splunk and Simtools now, but my
54.06s - 57.18s |  Background was Cisco and carrier sort of networking stuff
57.94s - 59.94s |  But yeah
60.02s - 63.86s |  So firstly what what's this talk not about so it's I'm not all about
65.74s - 72.50s |  These big clickbait, you know sort of travel articles where when really when you break them down at the end of the day
72.66s - 75.80s |  It's like sign up for this credit card get a sign on bonus
76.90s - 80.86s |  and you know pick the most expensive fare out there to
81.98s - 83.82s |  To advertise it through
83.82s - 85.82s |  So with that just a little disclaimer
86.82s - 89.74s |  That already intended audience, so
96.61s - 99.41s |  Okay, it's just a little disclaimer I guess
99.93s - 103.25s |  The intended audience for this talk is supposed to be I guess people that
103.77s - 106.77s |  Airlines or whatever so they can defend their systems better, right? It's ethically
108.45s - 111.45s |  But yeah, and with that just caveats
113.29s - 117.05s |  Look I'm just a dude. This is an interest topic to me. I haven't been trained
117.05s - 122.29s |  I just sort of you know black box as it got along and learn stuff. So I'm sharing that with you
122.69s - 126.77s |  There's a lot of information to cover. So I've got it probably will be a bit high-level
127.81s - 130.97s |  Come see me later. I'll get us copy the slides if you like, but
133.29s - 135.29s |  Yeah
135.89s - 139.65s |  So firstly why is the airline and travel industry the way it is
140.53s - 143.13s |  It's high fixed costs. It's very regulated
143.85s - 147.77s |  You know not only do airlines have to get approval from you know
147.77s - 150.65s |  Both governments to operate fair flights between two countries
150.69s - 155.49s |  They actually have to you know apply for slots and so these slots sometimes like, you know
155.49s - 161.29s |  I'd be for addresses where it's pretty congested at some of the airports like London and JFK and whatnot
161.37s - 163.33s |  so in fact, in fact
163.33s - 169.85s |  you see things like a big Malaysian is flying almost empty planes to London just to keep their slots because if they don't use them they
170.57s - 172.57s |  They lose them right and that
172.73s - 178.97s |  They do your trades and it you know, it's a 75 billion once for one of the slots recently sold for so with that
178.97s - 181.57s |  There's also these concept of fortress hubs
181.69s - 186.29s |  Which are like the big hubs of certain airlines that they have such a dominant hold on the market
189.21s - 195.61s |  So with that, what does the revenue management team do and what they do is basically try and maximize the return they can get on
196.21s - 199.05s |  By filling an aircraft and what they're concerned about is either
199.97s - 202.09s |  If we if you boil it down, so this is a
202.85s - 206.09s |  Bit of an academic science. This is quite a good is a few general art
206.09s - 208.09s |  There's quite a lot of general articles and research on this
208.13s - 213.53s |  but for our purposes if you boil it down really what they're trying to look out for is
214.45s - 219.17s |  Making sure the sit they get the highest price for every seat not letting it go empty or selling it out too cheap
220.33s - 222.53s |  So thinking about that, how can they?
223.41s - 227.57s |  How can they be disrupted? We're not going to really talk about any of these today
228.09s - 229.89s |  But
229.89s - 233.49s |  Just wanted to just wanted to highlight the fact that it ranges straight from
234.01s - 241.13s |  I guess using a same-day flight change or some of your actual benefits that they offer in some ways can you know produce the
241.77s - 246.61s |  Return they would get but you know and other things actually become more related
246.61s - 251.73s |  You know like fraud where it's credit card abuse and that sort of stuff or by cashing out things for gift cards
251.73s - 258.17s |  So with that how do fares exist in the world like so when you when you go to an airline website or
258.17s - 262.01s |  You know your Expedia or whatever. What do you actually see? Why why does it come up that way?
263.13s - 267.09s |  I've often overheard people go all the price went up because of my cookies or whatever
267.09s - 271.81s |  But generally you find there are things like there are things called rules attached to them. There might be
272.37s - 278.53s |  Days of the week or where the publish it there is published and the other the other concern is the dynamic inventory that's involved
278.65s - 283.61s |  It's extremely it's extremely complex computationally and there is
287.53s - 289.53s |  Written a very great
291.17s - 295.65s |  Very great presentation on the computer complexity of actually calculating these things because
296.53s - 299.13s |  Most international trips or where there's multiple connections
299.81s - 304.53s |  Actually, it can be tens of millions of possible connections of fares in the world
304.73s - 310.31s |  Actually, it can be tens of millions of possible connections of fares and flights and whatnot
310.57s - 316.69s |  So that's why sometimes when you go to book it might say this price is expired because actually you've sort of looking at case
317.09s - 319.09s |  availability
319.37s - 321.01s |  So what affairs look like
321.01s - 327.49s |  this is the example from probably one of the tools that you can sort of buy closer access to these the actual
327.89s - 330.65s |  Like border travel agent would say it's not the same system
330.65s - 334.01s |  But it's like a it's like a read-only one that consumers can subscribe to
334.89s - 338.11s |  but this is what you this is sort of what they look like so they all have like a
340.17s - 343.69s |  Basis or an identifier code and now this code is a bunch of numbers
343.69s - 345.05s |  But I mean so a bunch of letters
345.05s - 352.29s |  but usually these letters indicate the first one is the inventory code and the others depending on the airline might indicate the seasonality or other
352.29s - 357.97s |  Sorts of you know restrictions for a family affairs. So this is some here. It's just example for
358.45s - 364.61s |  London to New York, you can see the round-trip that those prices are actually the base fare before you add taxes and surcharges
365.25s - 369.75s |  And you can also see there things like the minimum maximum stay that they have
369.75s - 374.05s |  So the SU is a Sunday stay and it's an old sort of traditional
374.37s - 378.65s |  concept that they used to catch business travelers with because if you forced a
379.05s - 384.61s |  You know leisure travelers are more likely to stay over a weekend. Whereas business travelers, you don't want to go home on Friday or whatever
384.89s - 389.49s |  So as we as I talked about that they're published on two sort of basis's generally the
390.37s - 394.53s |  the routing spaces where it's explicitly show you which which which
395.13s - 398.97s |  transit points and you can book with that particular fare and
399.49s - 401.49s |  The other way is the the mileage
402.13s - 404.13s |  Or an NPM basis now
404.53s - 409.41s |  I've got a little calculation there if you can see on the screen of how an NPM sort of works, but essentially
409.73s - 412.49s |  It's using the great circle distance the
413.17s - 416.33s |  That you it's something you may have seen with like impossible travel and whatnot
417.41s - 419.89s |  alerts and your seems and then
422.13s - 427.01s |  So they can make it work through their particular hubs often you they have a concept of a ticketed point deduction
427.25s - 430.73s |  where basically you can get extra miles to finish the trip because they
432.37s - 435.73s |  Because say for instance this one they allow you to fly through the city
436.65s - 439.97s |  Because say for instance this one they allow you to fly through Chicago
441.05s - 443.05s |  So just a brief thing
443.05s - 445.45s |  When you combining these fares and looking at stuff
445.45s - 448.97s |  There's quite a number of rules that are involved and we just sort of looked at the routing
448.97s - 455.25s |  But as you can see there did speak about that Sunday stay, but yeah, there's there's all these other things to take into account
457.17s - 460.53s |  So behind the scenes when you actually buy a ticket it kind of looks like this
460.65s - 464.53s |  So how did I did have a picture earlier of a Qatar ticket on there?
464.85s - 469.81s |  But this just shows a more complex sort of ticket where all these leases my understanding anyway
470.49s - 475.01s |  But the important thing to know is that when you get your reservation your P&R
475.01s - 480.09s |  Yes, you know your six-letter identifier just because it says confirmed or on request or whatever in there
480.09s - 484.89s |  It doesn't actually mean you can board the flight. You need a you actually need that valid e-ticket
485.53s - 487.29s |  in there and
487.29s - 491.33s |  Then when you check in that's what actually marks the basically coupon
491.33s - 492.89s |  It's similar to the old paper tickets
492.89s - 498.17s |  But marks that is used and these have to be used in order or basically your rest of your flights are cancelled
499.37s - 500.97s |  Just going back to that last one
500.97s - 506.57s |  we can sort of see there an example of where there is an issue with the e-ticket even though you have a valid reservation and
506.57s - 508.57s |  You can't can't check in on that one yet
509.85s - 511.85s |  so moving across to the
513.05s - 519.45s |  The dynamic how they manage dynamic inventory you might have seen things like five seats less or whatnot
519.93s - 522.49s |  But essentially they use what they use is
523.37s - 526.25s |  his buckets which are given letters and they
526.77s - 531.81s |  And the different fans will attach to different buckets and that that's how they sort of manage the pricing
533.05s - 535.05s |  So if you look in if you look at that
535.09s - 539.85s |  Here's an example of a is example in what would it what a travel agent would see in what they call as G
540.25s - 546.05s |  Distribution systems that shows the availability for a particular flight. This is a flight from Dubai to London
546.89s - 548.69s |  And what you can actually see on this one
548.69s - 554.01s |  That's quite interesting is that because the the why is the highest price or fully flex economy
554.01s - 556.93s |  It's the highest I have and also the generic term for that class
557.17s - 561.61s |  but what you can see because it's zero it means is it's like completely no seats to sail and
563.21s - 565.13s |  Generally, we know that they
565.13s - 570.13s |  Oversell by about 10 or 20 percent most flights if they can so with it being zero and closed
570.13s - 571.85s |  They weren't not taking any more bookings
571.85s - 578.29s |  But the other interesting thing is we're seeing nine which is the maximum for any one time that if there are any single digits
579.21s - 583.09s |  So the actual business and first cabin on this particular flight is quite empty
583.09s - 588.85s |  So there's probably a chance that people will get there be a bit of a cabin roll and to feel to sell more seats and
588.85s - 590.85s |  to fill it up the some of the
590.93s - 594.93s |  More frequent flyers or people traveling alone might actually get or you know
595.29s - 598.17s |  When they go to the gate might be given a new seat upgraded
600.42s - 602.42s |  So
602.62s - 605.74s |  Moving on how do we handle connections now with connections?
605.78s - 607.10s |  It's the same sort of thing
607.10s - 613.58s |  But what you need to keep in mind is your fare class or your availability needs to match for all segments
613.58s - 616.54s |  And not only that you also need it for every person
616.54s - 623.22s |  So if you search for one person on this you would get you you would see the cheaper like our fare for business
623.38s - 629.14s |  But if you had two people if you going it it would show a higher price when you actually search
629.14s - 631.02s |  That's not like a cookie because you already search
631.02s - 635.74s |  It's because it's because this second connecting flight only has one seat available in that our class
636.14s - 638.14s |  So learning some of this can help you
639.02s - 643.82s |  Piece together and understand like I found a good fare. I want to book this which days can actually go
644.46s - 646.46s |  And net really narrow it down
648.30s - 650.38s |  So following the money where it all goes
651.94s - 657.30s |  Basically, there's a thing called a valid validating carrier and that's the one that issues the ticket and that's the e-ticket database
657.30s - 663.38s |  They use interesting factors American Airlines has all their serial numbers start with double zero one
663.38s - 666.78s |  But every because they were the first computerized airline
666.78s - 674.02s |  But all of all of the airlines basically have one of these three digit identifiers that for identifying which stock that is
675.06s - 677.70s |  You also have a concept of a marketing carrier now
677.70s - 682.62s |  that's the flight number you buy and so you might if you've heard of a code share before or ever booked a flight like that
682.62s - 684.10s |  where you're like
684.10s - 687.62s |  Maybe you've booked fit air, but it's actually like a American or British flight
687.66s - 691.66s |  That's what a code share is an operating carrier. Obviously the metal that you're on
692.66s - 698.00s |  so just an example like to tie some of these concepts together this is a little bit of an unusual boarding pass because it's
698.00s - 703.74s |  Printed by air lingus and then on and it's a it's an it's an American flight that was sold as British Airways
703.74s - 707.46s |  And but you can also see there with this electronic. There's the longer
707.98s - 713.86s |  There's the longer marking there with starting in 125 and that's the e-ticket. That's the e-ticket serial number number, right?
714.82s - 716.82s |  the the 25
717.10s - 723.90s |  Below there is also like a sequence number of how which you know the check-in or when they were at that
724.94s - 730.85s |  At the outstation when you sort of checked in online and when it went on the manifest
732.53s - 736.97s |  So having having regard to those sort of concepts, I'll talk about some of the weaknesses so
738.41s - 743.97s |  Why you sometimes see those flat fares now for getting so low like $1 or $15 as we saw before
744.09s - 751.41s |  Is that a lot of the components now come up as you know carrier surcharges under this fuel surcharge that started in 2004?
752.69s - 753.89s |  so
753.89s - 757.97s |  Yeah, initially, they're only like 20 bucks or something because the oil price is fluctuating
758.01s - 762.57s |  But then what happened was I guess the airlines realized they weren't didn't have to pay at that time
762.57s - 765.53s |  They thought they didn't have to pay commissions and other things on these
766.37s - 772.61s |  Amounts so so from my perspective they kind of seem a bit like junk fees like resort fees and stuff that you might pay at hotels
773.97s - 774.97s |  the
774.97s - 776.97s |  interesting fact is that
777.37s - 780.89s |  Because the way they're levied. It's actually it actually has become more complicated
781.41s - 786.33s |  The calculations have become more complicated and one thing that's that's interesting to note. Is that
787.13s - 792.37s |  The way and the way they're published the validating carrier decides whether to apply it or not
792.37s - 794.37s |  It's not necessarily the airline that you're flying on
794.89s - 800.87s |  So this presented some opportunities to that that could force the errors could creep in
801.27s - 804.51s |  So as I say here that is the s1 record is like a
805.19s - 807.19s |  it's just a database record that has
807.79s - 812.47s |  you know the criteria for applying the surcharge and how much it is, but
814.51s - 819.87s |  You know when all the things that matches so we'll go and the fact that it has like sequence numbers
819.87s - 821.87s |  It's sort of works a bit like a firewall world
823.27s - 828.71s |  So when we talk about exploits for this the the good old days what people were doing for a while
829.39s - 833.83s |  Was was that they were actually just going over to another airlines desk and getting them to book flights
833.83s - 838.59s |  You know like a ticketing desk and getting them to book the flights for the other airline and have them issued by
840.15s - 845.15s |  One that didn't levy the surcharge, but there was an IATA resolution and that's kind of gone away
847.15s - 850.33s |  But the more I guess the more interesting ones and the more technical ones for us
851.23s - 856.75s |  and for defenders is is the way that those s1 records work and
856.91s - 860.19s |  And they apply it so you I've got a bit of an example here from one of the the
860.75s - 863.99s |  From the apps code the fair publishing manual there, right?
864.79s - 867.51s |  So some of you may also be able to see why?
868.59s - 873.59s |  How these can sort of break or be pushed at the end of that sequence can be skipped. So for instance like
874.95s - 879.27s |  And and it might depend on whether the fair actually has is compatible with other fares
879.31s - 885.01s |  But if it is for instance, if all the last one has if all ticketed points are wholly within the u.s
885.29s - 890.69s |  Well, what happens if you have a you know domestic segment in Canada or Mexico or whatever for instance, right?
891.37s - 893.37s |  It wouldn't apply it, right? So
893.93s - 897.33s |  Just a demo of this I can show you this is this is quite an old one
897.93s - 901.73s |  People in that sort of travel community don't really like this stuff shared
902.53s - 907.25s |  But this is an old one. I found it interesting to try and even just get this to work stuff to work
907.25s - 909.05s |  It's a bit like pen testing
909.05s - 910.45s |  but
910.45s - 913.19s |  This is one here where it's a it's a fair for
914.01s - 918.81s |  $727 a normal return what we and with the surcharge of you know close to 60%
920.21s - 926.41s |  So what happens is if we actually add a another segment that's compatible there and and and break that
927.21s - 928.45s |  application
928.45s - 930.45s |  it will
930.81s - 936.77s |  You know what you're doing is you're actually adding, you know another fare on there and it's pushing the base price up
936.77s - 939.93s |  But because the surcharge was so low. It's actually dropped your price down
940.45s - 941.61s |  You know
941.61s - 944.61s |  You've added a hundred pounds in this instance, but you've lost
945.25s - 948.51s |  It's you know miscalculated the price by 260
949.89s - 952.05s |  Another thing that's this sort of interesting is the way
952.85s - 958.29s |  Because of the competitive nature of markets how there is sometimes arbitrage opportunities
958.29s - 960.45s |  But this can be a bit of effort like you you know
960.45s - 962.01s |  You might have to see if to start your ticket there
962.01s - 965.37s |  So like but sometimes it could be worth it like for instance if you're in Hong Kong
965.37s - 969.55s |  You want you know, you start your journey in Japan or you're in the US and you start it in Canada
969.55s - 971.55s |  But these things fluctuate and change
972.51s - 976.11s |  Another thing to look for is some of these countries with unstable currencies
977.35s - 981.51s |  Some ticket, you know, sometimes they or fixed exchange rates for instance Egypt
981.91s - 987.23s |  Changed their official exchange rate by 50% and there was some you know, good deals that came out of that
987.91s - 993.63s |  For a period but a lot of the other countries actually publish in euros or US dollars that have unstable currency
993.63s - 995.63s |  So it's not a doesn't happen all the time
996.63s - 1002.67s |  Another one that's I guess a bit more another vulnerability that's been a bit more popularized and talked about
1003.83s - 1009.95s |  Over the last 10 years is the is hidden city ticketing. This is a you know, a very well-known practice
1009.95s - 1015.47s |  That's you know that all airlines sort of hate, you know bash up agents if they try and do it, right?
1015.55s - 1021.03s |  But essentially you can see here if you're comparing this this is a Delta flight
1021.71s - 1025.99s |  You're trying to go to Atlanta, right, but if you look directly it's gonna be close to $200
1026.03s - 1029.19s |  But but when when a Nashville flight is tacked on to the end of it
1029.19s - 1032.19s |  It actually, you know, it's less than half
1032.39s - 1038.99s |  now the reason for that is I guess business customers want to fly direct generally people pay more for a direct and whatever competitions in
1038.99s - 1042.61s |  The different markets so they want to fill those seats, but not do it
1043.87s - 1048.97s |  The issues with these kind of things is that it is generally against the terms of conditions of carriage
1049.29s - 1053.93s |  And what they also do is if people are checking bags, they don't they don't short check it to you destination
1054.01s - 1056.85s |  That is of course unless you have an overnight or longer layover
1056.89s - 1062.17s |  so if the fare is actually flexible what and you're you could be totally within the rules by
1062.65s - 1065.89s |  Booking one of these and say well, I'll go to Nashville for a weekend
1065.89s - 1069.49s |  You know three weeks, you know in three weeks because you live in Atlanta for instance
1069.49s - 1074.31s |  So sometimes you can make these things work without without actually, you know breaking the rules
1076.01s - 1078.01s |  Another thing I'll talk about is
1078.29s - 1082.37s |  Mistake fares. So sometimes you see things in the press. There's been a few good ones where
1083.85s - 1085.85s |  You know that they will
1086.61s - 1089.91s |  in a first class of 500 bucks return from Asia or whatever because
1090.25s - 1095.05s |  someone's either the often to see that the route they allowed routing has been there's a mistake or
1095.29s - 1100.81s |  The base fare has been uploaded incorrectly because it's still I believe it's still kind of manual in a lot of ways
1100.81s - 1106.13s |  There's still a lot of spreadsheets that are used. So in the past the USD OT used to be very
1106.93s - 1110.77s |  Aggressive in enforcing this legislation on post purchasing price increase
1111.01s - 1116.49s |  But in 2015 what happened was there was a very large issue with United if you Google you
1116.73s - 1118.53s |  You might be able to find some more information
1118.53s - 1122.69s |  But essentially this issue was they published in Danish Corona?
1122.69s - 1126.45s |  They made a mistake where it was a divide by 1,000 issue on the base fare
1126.57s - 1131.93s |  now this is because Dana in the Danish Corona uses the comma as a decimal point rather than a
1132.85s - 1137.41s |  Period right. So the key thing to know out of this now is that
1138.61s - 1145.25s |  that they're they're allowing airlines to eat more easily get out of these these fares if they demonstrate it was a
1145.57s - 1148.09s |  Mistaken fare now one of the ways they would do that
1148.09s - 1152.41s |  I guess is there's a lot of blogs and stuff that sort of try to profit off this and
1153.61s - 1155.61s |  Yeah, so I mean it
1155.89s - 1158.77s |  As roaring kitty would say as to me. I like the fair
1158.77s - 1162.81s |  It's just a good fair because sometimes you don't understand. It's hard to understand I guess
1163.49s - 1170.69s |  When they you often see them publishing base fares of $1 for transatlantic flights like hat. How do you know necessarily?
1172.01s - 1178.69s |  So if you're an airline, what could you do? Right? So they have a thing called an agency debit debit memo. Now, that's a
1179.41s - 1181.97s |  You can find those policies online as well
1181.97s - 1187.25s |  most airlines publish them and that also will show you sort of conditions of what they're actually looking for and how they go after travel
1187.25s - 1193.49s |  Agents that maliciously do stuff the example of what a travel agent might do is hold stuff on a fictitious name
1193.49s - 1197.09s |  So like, you know, wait, you know like how you can do free holds for instance
1197.09s - 1201.81s |  They're basically holding the seats and then they without and then they cancel it and rehold it, you know
1202.17s - 1206.57s |  So they think they do chargebacks for that and there's like it's like a credit cards chargeback
1206.57s - 1211.99s |  There's like a processing fee attached to that. But I guess my other point is that they could kind of think like us
1212.87s - 1219.43s |  You know, I think fraud teams and other teams could learn a lot from how what we the advanced detections and things we run in socks
1220.23s - 1224.47s |  because in a lot of ways a lot of the detection stuff is similar and we're just used to
1225.79s - 1227.99s |  hackers and impossible travel and things like that and
1229.15s - 1230.95s |  sort of finally
1230.95s - 1233.55s |  If this if you'd be interested by this you want to know a bit more
1235.19s - 1236.63s |  It's great to be out of those
1236.63s - 1241.47s |  It's sometimes hard to get the same visibility into all these things that they look like a travel agent would get
1241.99s - 1245.67s |  But with the with those tools like expert flyer that I showed before
1246.11s - 1250.15s |  KBS tool they like subscription ones where you can actually get sort of read-only access
1250.31s - 1255.87s |  But it's it's not a hundred percent what you can do and they don't actually can't support pricing
1256.39s - 1260.79s |  But another one that's great. It's really really good is the ITX matrix
1261.25s - 1267.27s |  So that that will actually give you sort of a full pricing engine that you can it was basically the back end for Google was
1267.27s - 1273.03s |  The back end for Google flights at one stage and what I like about that is that you can put really advanced pairing specs in
1273.03s - 1275.03s |  There so you can say only show me
1275.51s - 1282.71s |  Only use like for the calculation only use fares or any show me stuff that's compatible with this particular fair basis code
1284.35s - 1289.13s |  Lock it down to all that sort of stuff and the even better thing is that you can actually turn off the availability checks
1290.87s - 1294.39s |  Because to get more better CPU use of your CPU time
1294.67s - 1296.67s |  So with that I
1297.99s - 1302.47s |  Guess to say thanks for everyone. I've got a few more things here if people are interested
1303.19s - 1310.31s |  Particularly recommend that the MIT. I guess it was for a computing course, but that MIT's computational complexity of air travel planning
1310.83s - 1312.83s |  Really really good. I
1312.83s - 1314.83s |  wouldn't like to talk about that, but I
1315.35s - 1317.35s |  hope that's a bird's-eye
1317.39s - 1318.91s |  overview and
1318.91s - 1322.17s |  If you have any questions come see me at the bar or something good
1323.13s - 1327.89s |  Now conscious of time let's crack on I want to talk today about electronic flight bags
1328.41s - 1333.49s |  But before we go there a little bit about me. I am a pilot. I'm a really bad pilot
1333.49s - 1336.81s |  I've landed at the wrong runway before so never fly with me
1336.81s - 1341.13s |  But I also am part of a company called pen test partners where we do a lot of red teaming
1341.13s - 1345.17s |  But also a lot of embedded system work. We've got multiple pilots on the team
1345.17s - 1349.01s |  So we do quite a bit with airplanes and over the last few years
1349.01s - 1351.53s |  We've learned how to hack or not hack airplanes
1353.13s - 1359.01s |  Before we start though, it's really really important that we disclose vulnerabilities in aviation
1359.97s - 1361.21s |  responsibly
1361.21s - 1365.45s |  There's something about hacking planes that drives the media into a frenzy
1365.45s - 1371.01s |  You say plane hacking they go crazy and a result it damages industry and I think it makes us less safe
1371.69s - 1377.27s |  My wife is a lousy flyer. So the last thing I want to do is make her more scared of flying
1379.01s - 1381.61s |  It does take a long time to fix bugs in aviation
1381.61s - 1386.93s |  I'll explain why in a bit but the most important thing you cannot do you cannot hack an airplane
1387.13s - 1391.45s |  Sat in your seat in coach. It doesn't work like that
1392.33s - 1398.13s |  There have been some issues over the years with the media going crazy with stories about hacking airplanes. I'm not gonna dwell on those
1399.05s - 1403.97s |  But before we start, how do you connect to an airplane? Well, there are lots of different interfaces
1403.97s - 1407.89s |  We all want in-flight Wi-Fi nowadays, but pilots have had that for years
1408.09s - 1414.03s |  You've got maintenance access. You've got quick access recorders that now spin up over Wi-Fi
1414.17s - 1417.85s |  But just to prove that point you cannot hack an airplane from the cabin
1417.85s - 1424.37s |  And the reason for that is we have really good network segregation in the bit in the back the bit that we sit in
1424.77s - 1429.17s |  That's called the passenger information entertainment services domain and we consider it to be dirty
1429.69s - 1434.45s |  Up front. We have the aircraft control domain, which is really sick. It sounds secure
1434.61s - 1438.33s |  Really well segregated and completely isolated from the other networks
1438.33s - 1441.77s |  But the one I want to look at at the moment is the electronic flight bag
1441.77s - 1448.57s |  Which was one of the systems the pilots use and connect to with connectivity. So what is an EFB? Well
1449.41s - 1453.13s |  Last time you boarded an airplane and you look left into the cockpit as you walked in
1453.13s - 1458.89s |  Did you see the pilots had a tablet? Maybe it was a little computer. Maybe it was an iPad or maybe a an Android tab
1458.97s - 1464.93s |  It's essentially a device that they use to make their operations safer and more efficient
1465.21s - 1467.67s |  So there's lots of different things that an EFB does
1468.25s - 1472.25s |  It's for example, it has your roster your passenger list
1473.09s - 1480.13s |  It has your weight and balance so you can make sure the airplane is properly balanced and within its performance envelope, but most importantly
1481.13s - 1483.13s |  We're still there. I just lost audio
1483.81s - 1487.22s |  Can we have a there we go? We're back again
1487.38s - 1493.86s |  Most importantly it also is used to calculate your calculate engine performance or Perth
1494.30s - 1496.02s |  now performance
1496.02s - 1502.26s |  You might not appreciate this. It's very rare that we use full power when we take off really rare
1502.26s - 1508.30s |  and the reason we don't is we don't want to burn lots of fuel because it's expensive and bad for the environment and we also
1508.54s - 1513.62s |  Don't want to wear the engines much. So if you use less power if we've got lots of runway
1514.10s - 1520.84s |  We're not very heavily loaded we use a D rate or a what's called a flex temp in Airbus or a D rate with Boeing planes
1521.90s - 1526.34s |  and we calculate that using lots and lots of different data sources like the wind the weight the
1526.78s - 1531.26s |  Pressure altitude of the runway all sorts of things that tell us how much power to use on departure
1531.86s - 1535.98s |  But before we go there, I want to look at some of the bugs things that have gone wrong not hacks
1535.98s - 1537.82s |  Just things that have gone wrong
1537.82s - 1542.10s |  There's all sorts of examples of things that have just gone wrong. For example Raven air
1542.10s - 1548.58s |  They used a digital maintenance system and they got ransomed and their backup got ransomed as a result of that
1548.58s - 1551.60s |  They couldn't prove the airplanes were airworthy. So they didn't fly
1553.10s - 1560.26s |  American had a lockup on their electronic flight bags. There was a duplication in one of the Jefferson databases
1560.26s - 1564.30s |  I think they duplicated the chart. So the map of the runways
1564.98s - 1569.86s |  Reagan National and it caused the entire application to lock up and a lot of airplanes didn't move that day
1570.58s - 1574.18s |  Southwest had a bug a few years ago. They lost their their weather feed now
1575.10s - 1577.82s |  Pilots, you can't just look out the window. See what the weather's doing
1577.82s - 1581.82s |  You need to know what it's doing up there and also where you're going and you need that weather feed no weather
1581.82s - 1583.82s |  No flying. They've a lot of flights didn't go
1584.90s - 1589.26s |  Mistakes happen with weight and balance as well. This is a really interesting instant. It's published
1589.26s - 1595.54s |  You can go and read it yourself and the airplane type was changed at the very last minute from a Airbus a320 to an Airbus
1595.54s - 1597.18s |  a321
1597.18s - 1603.74s |  primary difference is it's longer but the load sheet wasn't changed to all the passengers from the shorter plane were loaded at the front and
1604.14s - 1606.14s |  The airplane ended up out of balance
1606.46s - 1612.22s |  Pilot goes down the runway tries to rotate on the stick and nothing happened. There's not very much runway left
1612.22s - 1614.22s |  What do you do? You've passed v1
1614.50s - 1618.02s |  You've got to VR. You're not a v2. So you can't really fly away yet
1618.62s - 1625.54s |  So the pilot very sensible individual gave it full power toga and the airplane took off
1626.50s - 1633.06s |  Primarily to do with the increased rotation moment because the engines dangle off the wings so they got away
1633.58s - 1634.98s |  Because they gave it full power
1634.98s - 1640.46s |  But yeah, that was a really very nearly very nearly serious instant another one to do with performance
1640.46s - 1643.78s |  This was a confusing instant that happened at Lisbon Airport
1644.58s - 1647.34s |  Now there was some runway intersection markers
1647.42s - 1652.06s |  So quite often on the short-haul flights, you might see they don't line up for the whole runway
1652.06s - 1654.06s |  They go from a displaced threshold, right?
1654.06s - 1658.62s |  They they run maybe halfway along the runway sometimes and they don't need the whole runway. So it's quicker
1659.62s - 1662.06s |  But the intersection markings were a bit confusing
1662.06s - 1667.38s |  They've been renamed they were given temporary names and when pilots were putting them into their flight bag to do their performance
1667.78s - 1673.82s |  Calculations from the engines the calculator thought there was more runway than they actually had. So I said, hey we need less power
1673.82s - 1677.70s |  We've got more runway and over a period of a couple of weeks eight flights
1678.38s - 1681.86s |  Very nearly didn't make it out of Lisbon. Now that was all fixed, which is great
1682.66s - 1684.66s |  We lost that audio again
1686.90s - 1688.90s |  Audio yeah, there we go. We're back good
1689.50s - 1694.26s |  Very interesting incident happened earlier this year. This was Alaska. They had two tail strikes
1694.26s - 1698.26s |  So they hit the back of the airplane when they were trying to take off on January 26th
1699.02s - 1703.90s |  Amazing response. So within the matter of minutes they realized there was an issue had a ground stop
1704.22s - 1709.30s |  Awesome awesome response from the airline and what had gone wrong. There was a software bug in one of their flight bag
1709.90s - 1714.14s |  Applications there was miscalculating their load. Therefore not enough power was going on
1714.26s - 1716.82s |  There was another one that happened on April 17th
1716.82s - 1723.46s |  They had a related application issue with weight and balance, but actually I was really impressed just how quickly they responded to this
1724.38s - 1726.06s |  But things do go wrong sometimes
1726.06s - 1730.82s |  so this is an airplane that had a really nasty tail strike tore the backside out of the plane and
1731.46s - 1737.98s |  yeah, they didn't realize they'd had that tail strike until they tried to pressurize the aircraft and it wouldn't pressurize and
1738.30s - 1740.58s |  They have very sadly been deaths
1741.46s - 1747.60s |  The picture on the right is from an incident report a crash that happened in Canada a very tired
1747.98s - 1749.62s |  747 freight crew
1749.62s - 1751.62s |  miscalculated the amount of weight they had on board and
1751.70s - 1758.66s |  Very sadly the airplane never made it airborne went straight through the instrument landing system and sadly burst into flames a very very sad incident
1759.10s - 1764.86s |  It also happens on landing as well when we land in commercial airliners. We don't want to use too much break
1765.46s - 1769.74s |  Because brake pads are expensive that carbon fiber. We don't want to use too much
1770.30s - 1776.82s |  so we'll typically use an auto brake setting that's related to our weight the length of the runway the amount of headwind we got all
1776.82s - 1778.42s |  sorts of cool things and
1778.42s - 1781.78s |  this is Quito Airport very difficult approach surrounded by hills and
1782.74s - 1787.50s |  Overstressed pilots used the wrong auto brake setting from their calculations and over around the end of the runway
1787.50s - 1792.06s |  They chose auto land. So auto brake 2 and they should have been using auto brake 4
1792.94s - 1794.98s |  So where I'm getting to with all of this is
1796.26s - 1803.58s |  Could you cause an incident like that as a result of a hack and we found some bugs that we think could in
1804.30s - 1805.90s |  certain scenarios
1805.90s - 1808.14s |  So the first major problem you need to know about those
1808.78s - 1814.82s |  Computers those tablets that the pilots are using you might be really surprised to know about the quality of the lockdown on those devices
1815.54s - 1817.06s |  Sometimes we'll find
1817.06s - 1819.06s |  EFBs with no pin or
1819.98s - 1821.98s |  The pilots birthdates or
1822.82s - 1825.30s |  On smaller operators you find no MDM
1825.30s - 1832.38s |  No real lockdown even some small operators have sent their pilots off to Best Buy to buy the tablet for themselves Wow
1833.14s - 1835.06s |  But also there's a lack of
1835.06s - 1842.58s |  Proper understanding on the ground cyber security experts in the air pilots. Sometimes those interactions don't go so well and good examples of that
1842.58s - 1848.86s |  Hey, let's use face ID. Let's use face ID to make my EFB nice and secure
1848.86s - 1855.26s |  So it's really easy great. Unfortunately pilots have a habit of wearing mirrored sunglasses, which does not work
1855.26s - 1862.74s |  Well with face ID, I promise you and the one time you probably need your electronic flight bag more than anything is when shit goes down
1863.10s - 1865.26s |  Maybe you have a depressurization events
1866.10s - 1870.78s |  You go to your electronic quick reference handbook, which is of course on your iPad
1870.78s - 1875.46s |  But you're wearing an oxygen mask because the oxygen is just flown out of the door plug
1876.46s - 1879.94s |  Not a good day, right so we really need to think carefully about how we unlock things
1880.18s - 1882.78s |  so first of all, we've got problems with local lockdowns and
1883.62s - 1884.58s |  with
1884.58s - 1887.14s |  Physical access to an EFB for a short period of time
1887.14s - 1891.34s |  We found some interesting bugs and I'm going to walk you through one of the very first we found was in Boeing
1891.50s - 1896.62s |  OPT on board performance tool and this is the tool that's used to calculate performance
1896.62s - 1900.70s |  So you'll spit in a bunch of data and it'll give you your V speeds
1900.70s - 1904.38s |  So V one the point at which you can break and stop without going off the end
1905.30s - 1906.34s |  VR
1906.34s - 1913.34s |  Rotation v2 the point at which you can climb away safely with any one engine that spot between V 1 and V 2 is kind
1913.34s - 1915.34s |  Of squeaky bum time if it all goes wrong
1915.38s - 1918.34s |  Now that's actually a photograph of one of Boeing's tools
1918.34s - 1920.14s |  They brought it along to RSA a couple of years ago
1920.14s - 1925.34s |  Really really cool thing to do and we discovered that the database had no integrity text
1925.34s - 1928.26s |  So with a few moments physical access you could change the data
1928.50s - 1932.38s |  You could make the runway look longer than it actually was and therefore it spit out the wrong data
1932.74s - 1938.70s |  You could extend the runway and then the V speeds went wrong and the pilots would use the wrong amount of power for departure
1939.46s - 1940.94s |  Good news
1940.94s - 1945.66s |  Boeing handle it brilliantly. I could not have asked for a better response to this vulnerability
1945.66s - 1948.86s |  It's kind of good news for buying which I think they kind of need at the moment. I don't know
1949.54s - 1951.54s |  It was a really good experience. They
1952.34s - 1954.50s |  Responded to us really quickly. They acknowledged it
1954.50s - 1957.68s |  They gave us a call every month to say this is how we're doing it and said by the way
1958.36s - 1965.12s |  It's gonna take two years to fix it like what you know, Google project zero that's 90 days, right and you drop it like it's hot
1966.16s - 1974.36s |  Aviation is different. It took him a couple of weeks to fix the bug. It took him a couple of years to recertify the code
1975.24s - 1978.36s |  Because you can't just go and update aviation systems
1978.36s - 1981.72s |  You need to recertify them to make sure they are safe in
1982.00s - 1987.04s |  Absolutely every possible scenario and that was fine and they published it and it was all good. They got it sorted
1987.68s - 1989.68s |  Another bug. This is a
1990.48s - 1991.92s |  semi-installed
1991.92s - 1998.72s |  BFB it was a kiosk and a 747 we looked at and it was unbelievably poorly secure so you could break out
1999.12s - 2003.92s |  Password was password great and there were two of them for redundancy purposes
2004.32s - 2009.68s |  But they were networked together and it was easy to compromise one from the other so that removed the value of having
2009.96s - 2013.56s |  Redundancy and a cross-check because you could hack them both to spit out the same wrong data
2014.88s - 2016.88s |  This was funny
2017.68s - 2021.96s |  Had a USB port on it and a sticker saying not to use it. Okay
2024.00s - 2030.08s |  Now this vendor never ever engaged properly actually Boeing even gave him better kick on our behalf
2030.08s - 2034.44s |  They intervene to try and help it along still nothing and actually after 18 months
2034.44s - 2038.36s |  We agreed with the aviation ISAC, which is the industry's cyber security and sharing body
2038.92s - 2044.84s |  That actually it was reasonable to disclose in public once we told the airlines about it first and they helped us do that
2044.84s - 2046.36s |  That was really cool
2046.36s - 2048.64s |  What about some new things so we've done Boeing
2049.32s - 2055.48s |  Let's talk about Airbus. So this is Airbus nav blue fly smart LPG
2055.88s - 2060.00s |  LPC NG there are more TLA's in aviation than there are in cyber security
2060.48s - 2067.76s |  LPC less paper cockpit NG next generation nav blue is a company that's been acquired by Airbus and we found a bug
2068.24s - 2074.84s |  Almost exactly the same as Boeing OPT so you can tamper with the runway databases and make pilots use the wrong amount of power
2075.00s - 2078.10s |  So it's spit out the wrong information pilots do the wrong thing
2078.32s - 2084.20s |  So we started vulnerability disclosure and you're probably looking at going that's 2021 Ken. Yes, it is
2084.84s - 2088.56s |  So we sent it to Airbus. They've got a great piece of team. We sent it to them
2088.56s - 2093.60s |  They came back to us quickly. They replied to us after a month and said yeah, it's the operators problem
2093.60s - 2100.28s |  I'm summarizing about four pages of email here. But yeah, that's that's not a problem. That's that's for the airlines
2101.28s - 2103.28s |  Okay, that's a novel discussion
2103.44s - 2107.32s |  So we started going into some of the regulations and I'm not going to talk about
2107.60s - 2110.76s |  EFB regs because they're really complicated but they are different around the world
2111.28s - 2115.56s |  IASA European Aviation Safety Agency has is actually fairly
2116.16s - 2120.08s |  Robust on EFB regs FAA slightly different installed
2120.56s - 2126.76s |  EFBs completely different set of regulations to a portable EFB and the Civil Aviation Authority in my home country
2127.04s - 2129.04s |  Also has a different set of regs as well
2129.60s - 2136.36s |  So we look at looked at the regs and found AMC 2025 at AMC additional means of compliance
2136.36s - 2140.32s |  so this is basically the regulation that you're supposed to follow when you're keeping your
2141.28s - 2148.36s |  EFB software up-to-date and actually said you're supposed to do an integrity check and that's the one thing we thought was missing great
2149.20s - 2154.68s |  so we had another call with Airbus and said hey, we think you're not following the regs and
2155.44s - 2162.08s |  This is a really weird conversation where they said we're not going to fix it because we've analyzed your vulnerability and decided that fixing it
2162.08s - 2164.08s |  Would be a product improvement
2164.20s - 2168.84s |  I've got that in writing long version. Basically. We had a near argument with their
2169.72s - 2170.92s |  engineering team and
2170.92s - 2176.56s |  They told us that it didn't matter because you'd have to hack both EFBs at once because pilots cross-check on both
2176.56s - 2181.08s |  Well, they don't actually they use one typically one pilot will do the entry of the data
2181.52s - 2187.04s |  Passed to the co-pilot and they will verify the data entry then make the calculation and to prove that most
2188.76s - 2194.00s |  Planes now have a minimum equipment list that only requires one EFB. So that was a shame. So
2195.44s - 2198.12s |  we pushed over the period of a year and
2198.92s - 2205.32s |  They came back and said yeah, it's we've evaluated it. We consider it as a product improvement. So we're not going to fix it. Okay
2206.44s - 2208.44s |  And then one of our friendly
2208.92s - 2212.56s |  Airline clients said you know what you could do you could have a chat with the regulator
2212.56s - 2216.16s |  I'm like, why didn't we think of this before have a chat with the regulator?
2216.72s - 2219.96s |  so we spoke to EASA who are lovely by the way, and
2220.56s - 2224.92s |  We said we've got this vulnerability and Airbus have said they won't fix it. I'm like
2225.72s - 2231.56s |  What do you think and they said hmm? I think we agree and then miraculously on 10th of April. It's been fixed
2231.76s - 2236.12s |  It's amazing what happens when you get the regulator involved, isn't it? So it has been fixed, which is great
2236.12s - 2237.64s |  Which is why we're talking about it now
2237.64s - 2242.20s |  But why was it so hard? I think some of it is around
2243.12s - 2245.12s |  some of the struggles between
2245.56s - 2247.56s |  flight safety and
2248.52s - 2254.56s |  Engineering and cybersecurity because some of those are competing interests. It's so critically important same problem. We see an OT
2255.52s - 2257.52s |  cultural separations between
2258.48s - 2260.48s |  cybersecurity and safety engineering I
2261.08s - 2263.80s |  Think there was also a bit of a reluctance to acknowledge it
2263.80s - 2267.32s |  I've spoken to Airbus a few times about this and they've never publicly acknowledged
2267.68s - 2272.68s |  The detail of this vulnerability and what's really weird is actually Airbus have got a really good reputation
2273.40s - 2279.72s |  With their customers for being really engaging with them on cybersecurity. They've got test rigs all sorts of stuff
2279.72s - 2283.00s |  It's actually they do some really cool things. So we don't understand
2283.64s - 2288.76s |  Why we had to involve the regulator here. There's another bug we found this was well handled by them
2288.84s - 2291.32s |  This is a slightly different set of the package
2291.32s - 2297.54s |  It's called fly smart plus and the updater for the iOS app had intentionally had ATS disabled
2297.54s - 2301.06s |  So application transport security, they turned it off which meant weirdly
2301.94s - 2304.78s |  You could man the middle over Wi-Fi and tamper with the updates
2305.74s - 2310.62s |  Unlike attacks over Wi-Fi really, but actually there's one odd thing about pilots
2310.62s - 2313.38s |  Does he always stay in the same damn layover hotels every night?
2313.54s - 2318.34s |  You can guarantee that layover hotel is gonna have a pilot from their airline in so actually, you know
2318.34s - 2321.14s |  Where they're going to be so maybe a Wi-Fi attack is a bit more plausible
2322.14s - 2324.22s |  Another one so a Lufthansa
2324.42s - 2330.62s |  This is actually the Lufthansa systems part of the business that produce a really good charting application called eRoute manual
2330.86s - 2332.86s |  used by loads and loads of
2333.10s - 2339.10s |  Airlines, and we had a very similar issue whilst they did have a an integrity check
2340.06s - 2344.74s |  Unfortunately, the key for that integrity check was one two, three, four five six seven eight
2345.86s - 2350.10s |  Nine ten twice and so we flagged this to them. They said yeah, that's great
2350.10s - 2352.38s |  We got we agree with you. We disclosed it to them
2352.42s - 2357.02s |  What it meant was you could tamper with for example approach plates so you could tamper with
2358.42s - 2361.66s |  I'll walk you through this. So this is a how you approach
2362.42s - 2368.50s |  To an airport so you're supposed to arrive at 5,000 feet at DME 14 to the BRA VOR
2368.50s - 2371.18s |  That's your initial fix your safety heights now
2371.78s - 2375.34s |  4,600 feet till you get the top of descent D at DME 12.4
2375.54s - 2380.34s |  You then descend on 170 degree heading to a safe point at your final fix at
2380.98s - 2386.70s |  3,900 and then you can go down to your minimum descent altitude to the point of getting to the middle marker at DME 4
2386.70s - 2390.38s |  So four miles from the airport at which point you either go around or you land
2390.46s - 2396.62s |  We discovered you could tamper with all those so you could convince the pilots to go lower and potentially have a control flight into the
2396.62s - 2398.62s |  Ground. I hope that doesn't happen
2398.74s - 2400.34s |  They were awesome
2400.34s - 2405.46s |  It took him two years, but they were really good really engaging and have since asked us out to give some talks to them
2406.82s - 2408.74s |  Yeah
2408.74s - 2413.06s |  So that is me and EFBs. I want to give a very quick rattle around airports next
2414.14s - 2416.14s |  the other side of things
2416.38s - 2420.46s |  Airports are incredibly complicated places with lots of really interesting things going on
2421.10s - 2427.46s |  We were asked by one aviation one Airport. Sorry to look at their departure boards. We said, yeah, we've got bugs in those
2427.46s - 2433.14s |  We think we can inject our own flights and completely tamper with everything. They said what a cool organization said go on then
2434.06s - 2436.30s |  Put a flight on our boards. So we did
2437.26s - 2441.70s |  But of course that was just proving the point we could have trashed that system and then there would have been chaos at the airport
2443.02s - 2444.74s |  Runway lighting is also a major issue
2444.74s - 2451.14s |  We know of one airport where their runway lighting controllers were airside and then they expanded the parking lots and they ended up
2451.30s - 2456.74s |  Landside and then someone came along and stole all the controllers and the runway light stopped working. Oops
2457.50s - 2458.42s |  These are really good fun
2458.42s - 2461.58s |  If you ever fly into Heathrow's Terminal 5 they use robot pushback tugs
2462.02s - 2465.34s |  Never got to have a go at them haven't managed to pen test them yet
2465.34s - 2470.02s |  But I'm really pushing BA and IAG to see if we can have a pop really interesting devices
2470.74s - 2476.86s |  Fueling is also a major problem. There's two primary providers. It's all API based all done through tablets
2476.86s - 2481.96s |  I think there's a really interesting set of research to be done there and ground power is a major problem as well
2483.22s - 2485.42s |  I'm not going to talk about spoofing ADS-B
2485.42s - 2486.90s |  I'm not going to talk about that either
2486.90s - 2493.30s |  But what I really wanted to get to here is if you're doing research in aviation, please make sure you disclose it responsibly
2493.54s - 2500.02s |  Don't drop it like it's hot in the public. It's not going to be possible to fix that bug and publish it 90 days data
2500.02s - 2503.54s |  It's gonna take a while if you're struggling to get
2504.10s - 2505.82s |  airlines or
2505.82s - 2508.78s |  Manufacturers to listen to you. There's a couple of really awesome routes
2508.78s - 2512.30s |  You can go so the Aviation ISAC will help broker vulnerability disclosure for you
2512.34s - 2517.98s |  If you're struggling to the DEFCON aerospace village wherever there we help found it we will help you as well
2517.98s - 2522.94s |  There's lots of really cool organizations that can help you disclose vulnerabilities to airline and get things
2524.30s - 2525.74s |  fixed
2525.74s - 2527.50s |  Planes are very complicated
2527.50s - 2533.90s |  They're really really important safety engineering in there. So it does take a while to get the bugs fixed. So just bear with
2534.90s - 2536.90s |  whilst they fixed it safely and
2537.62s - 2544.66s |  Responsibly it would be lovely just to push an update wouldn't it but the chance of blue screening a plane. Should we just not go there?
2545.22s - 2549.58s |  Anyway, that is me. Hope you found it interesting. That's my email. That's the firm I work for
2549.58s - 2552.06s |  We're over in the aerospace village. If you want to come and have a chat
2552.06s - 2554.62s |  We've got a flight simulator to play with but thank you so much


url: https://www.youtube.com/watch?v=bLgQNSQANx0
title: DEF CON 32 - Navigating the Turbulent Skies of Aviation Cyber Regulation - M. Weigand, S. Wagner
type: video
author: DEFCONConference
ingestion_date: 2024-11-09
transcription_model: large-v2
chunking_status: completed
content:
{
  "webpage_url": "https://www.youtube.com/watch?v=bLgQNSQANx0",
  "title": "DEF CON 32 - Navigating the Turbulent Skies of Aviation Cyber Regulation - M. Weigand, S. Wagner",
  "description": "This combination presentation and panel discussion will surface the policy and technical challenges associated with securing civil aviation, bringing together perspectives from government, industry, and aviation cybersecurity companies.\n\nGiven the continued growth in civil aviation and impending regulation in the United States of America and Europe, this talk will describe the key technical challenges and the resulting policy challenges that should be addressed to keep civil aviation secure.",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 3285,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241016"
}

0.00s - 2.44s | This text was transcribed using whisper model: large-v2

 Hey everybody, thank you so much for coming.
2.44s - 6.08s |  Welcome to Flying Blind, where we're gonna talk about
6.08s - 8.76s |  aviation policy, we're gonna share some lessons learned
8.76s - 11.64s |  from our experience in the Air Force
11.64s - 15.00s |  and in civil aviation, everything from Capitol Hill
15.00s - 18.72s |  to actually hacking some fighter jets today.
18.72s - 20.68s |  So thank you, my name's Michael Wiggins
20.68s - 22.08s |  and I'm joined today by.
22.08s - 24.12s |  Hey, I'm Stuart Wagner.
24.12s - 26.46s |  Just a little bit of background on ourselves.
26.46s - 28.94s |  I am a reformed Army officer
29.00s - 30.72s |  and recovering entrepreneur.
30.72s - 34.00s |  I served in the Army as one of the first cyber officers
34.00s - 36.24s |  and then I decided I wanted to start a company
36.24s - 38.96s |  so that we could bring hardware and software solutions
38.96s - 41.84s |  to the market to help protect aircraft
41.84s - 44.04s |  because they don't have antivirus and stuff on it.
44.04s - 45.64s |  It seemed like a good idea at the time
45.64s - 48.04s |  and we grew it pretty tremendously,
48.04s - 50.80s |  but along the way I realized that there was
50.80s - 52.74s |  a lot of policy and law that needed to change
52.74s - 54.64s |  to make the market possible and so real excited
54.64s - 56.96s |  to share with you what I've learned.
56.96s - 58.22s |  Stuart?
58.24s - 60.08s |  Sure, so I'm Stuart.
60.08s - 63.24s |  I was a software developer at Microsoft
63.24s - 67.46s |  focused on data engineering, like telemetry systems,
67.46s - 70.88s |  so data off of operating systems,
70.88s - 72.72s |  data off of cloud services,
72.72s - 76.00s |  then came over to the DOD and eventually ending up
76.00s - 79.44s |  in the Air Force as the Chief Digital Transformation Officer
79.44s - 82.36s |  where we basically tried to learn and adapt
82.36s - 84.64s |  from data off of weapon systems.
84.64s - 87.36s |  So Mike asked me to kind of share
87.36s - 88.46s |  some of the things we've learned
88.46s - 90.42s |  and how that might apply to cybersecurity.
90.42s - 91.94s |  So really excited to give this talk
91.94s - 97.13s |  and hopefully jump into some questions.
97.13s - 99.29s |  All right, so today we're just gonna
99.29s - 101.53s |  give a really quick overview of at least
101.53s - 103.45s |  my personal thoughts on the state of affairs
103.45s - 106.69s |  of cybersecurity and civil aviation
106.69s - 108.81s |  and we'll touch a little bit on where we are
108.81s - 110.11s |  like securing weapon systems,
110.11s - 113.01s |  which is important for their deterrence mission.
113.01s - 116.73s |  Talk about some of the recent developments in regulations.
116.75s - 119.99s |  We just got the FAA Reauthorization Act,
119.99s - 121.43s |  which is passed every four years
121.43s - 122.79s |  that just got signed into law.
122.79s - 125.59s |  So we'll touch on some of the exciting developments
125.59s - 128.51s |  in that law that hopefully is gonna help advance safety
128.51s - 130.31s |  and security interests.
130.31s - 132.79s |  Stuart's gonna share some lessons from the Air Force
132.79s - 135.87s |  where he actually led a series of hackathons
135.87s - 137.27s |  against fighter jets.
137.27s - 139.71s |  And then we're gonna talk about how data
139.71s - 143.97s |  and instrumentation from those defense experiments,
144.11s - 149.11s |  what lessons there may exist for civil aviation.
149.87s - 153.11s |  Then we'll have an open discussion about policy next steps.
153.11s - 154.55s |  And I'm gonna try and convince you
154.55s - 157.07s |  that everybody in this room can actually
157.07s - 159.39s |  have a voice in that conversation.
162.26s - 165.70s |  So without further ado, really kind of excited
165.70s - 168.06s |  to share that this year, every four years,
168.06s - 169.72s |  the FAA gets reauthorized.
169.72s - 171.50s |  So we don't have air traffic controllers
171.50s - 174.14s |  without actually Congress passing a law
174.16s - 177.24s |  to pay these people to help us make sure
177.24s - 179.38s |  that we can all fly home safely.
179.38s - 180.92s |  That's a good thing.
180.92s - 183.60s |  It's also a chance for us to kind of update the way
183.60s - 187.08s |  that the entire aviation industry does business.
187.08s - 189.68s |  And there's all kinds of important
189.68s - 191.60s |  and sometimes special interest components
191.60s - 193.86s |  that get into that legislation.
193.86s - 198.86s |  There's a subsection in it in section 360 something
199.10s - 201.78s |  that talks about cybersecurity.
201.78s - 204.88s |  And the crazy thing about where we are today
204.88s - 207.24s |  is that most aircraft continue
207.24s - 209.68s |  to be increasingly interconnected,
209.68s - 212.88s |  increasingly fly-by-wire, computer and software dependent,
212.88s - 215.44s |  but there is no flying commercial aircraft today
215.44s - 218.52s |  with a running antivirus intrusion detection
218.52s - 220.32s |  or intrusion prevention system.
220.32s - 223.00s |  In fact, do we have any pilots in the room?
223.00s - 224.96s |  Just by show of hands, we have a handful.
224.96s - 227.18s |  I'm a pilot too, I'm a private pilot.
227.18s - 229.62s |  There's no such thing as a crew indication,
229.62s - 232.92s |  any type of warning, caution or advisory light to the crew
232.92s - 234.64s |  to let them know that like,
234.64s - 236.44s |  hey, something really fishy is going on
236.44s - 238.36s |  and maybe don't take off.
238.36s - 240.76s |  Maybe you have like, you know,
240.76s - 243.88s |  an indication of malicious messages on the data bus
243.88s - 247.76s |  or your firmware or software is like bad.
247.76s - 250.40s |  And unfortunately we use in industry
250.40s - 253.44s |  really solid flight worthy technology,
253.44s - 255.64s |  which means it's often really old.
255.64s - 258.52s |  And because of that conveniences
258.74s - 261.02s |  that we all take for granted or security technologies
261.02s - 263.14s |  that we take for granted with like our mobile devices
263.14s - 265.18s |  where all of the software delivery
265.18s - 266.86s |  is cryptographically signed
266.86s - 269.58s |  and there's some pretty good supply chain
270.54s - 274.80s |  and delivery processes, a lot of that doesn't exist.
274.80s - 276.38s |  And the first rule of, you know,
276.38s - 278.66s |  one of the principal rules of cybersecurity obviously
278.66s - 281.50s |  is if you have physical access to an aircraft,
281.50s - 284.02s |  you can compromise or to a computer, you can compromise it.
284.02s - 286.42s |  Well, a lot of our commercial jets,
286.42s - 288.26s |  they fly all over the planet
289.00s - 291.40s |  and there's a variety of people that have physical access
291.40s - 292.80s |  even to the avionics.
292.80s - 295.88s |  So all of these things kind of taken for granted,
295.88s - 298.92s |  I like make me a little bit uncomfortable.
298.92s - 301.84s |  Unfortunately, we don't have a really good example
301.84s - 303.96s |  of a plane being hacked out of the sky, thank God.
303.96s - 306.24s |  But the idea obviously is to stay ahead of that.
306.24s - 308.92s |  We don't want to react to safety events.
308.92s - 311.52s |  And unfortunately, I will make an aggressive statement
311.52s - 315.16s |  and say that many significant evolutions
315.18s - 316.90s |  in aviation and safety policy
316.90s - 318.94s |  have been driven by fatalities.
318.94s - 322.42s |  And so, you know, part of our mission in life, if you will,
322.42s - 325.56s |  has been to try and flip that paradigm.
325.56s - 327.78s |  And I really appreciate everybody being here today
327.78s - 331.16s |  because I know that that resonates with folks at DEF CON.
331.16s - 334.58s |  So in the FAA Reauthorization Act this year,
334.58s - 338.06s |  I got most excited about the fact that
338.06s - 341.10s |  Congress directed the administrator
341.10s - 342.10s |  and therefore the FAA
342.10s - 344.58s |  to change the type certification process
344.64s - 346.76s |  and make sure that cybersecurity
346.76s - 349.42s |  and continuous monitoring of avionics
349.42s - 352.32s |  is now a requirement for any new aircraft design
352.32s - 353.96s |  that gets approved.
353.96s - 356.10s |  Previously, it was like a suggestion,
356.10s - 357.58s |  but this time around,
357.58s - 359.68s |  it was a requirement that they must do it.
360.56s - 362.52s |  There are a whole bunch of other problems though
362.52s - 363.92s |  that have to be solved.
363.92s - 368.12s |  And they also provided a little bit through like study,
368.12s - 371.12s |  we're gonna help identify and make the case that
371.12s - 374.48s |  you need better people through a GAO report and study.
375.38s - 376.22s |  Do you have the right people?
376.22s - 377.04s |  Do you have the right funding?
377.04s - 377.98s |  Do you have the right structures?
377.98s - 379.78s |  Is there the right kind of committee
379.78s - 381.86s |  to make sure that voices from industry,
381.86s - 386.10s |  the OEMs, the airlines, operators, unions,
386.10s - 388.66s |  technologists are all heard as the rules
388.66s - 392.50s |  on how all of this gets implemented actually happen.
392.50s - 394.66s |  So all of that was in the legislation this year.
394.66s - 396.04s |  And over the next couple of years,
396.04s - 397.22s |  we're gonna see that implemented.
397.22s - 400.30s |  And hopefully by the end of this decade,
400.30s - 402.62s |  we will actually see airliners come out
402.64s - 406.08s |  with real onboard continuous monitoring of their avionics,
406.08s - 408.72s |  which sounds like a good idea to me.
408.72s - 410.88s |  So just as a state of affairs,
410.88s - 412.96s |  the situation if I were to put it really bluntly
412.96s - 416.84s |  is it's kind of not great as it is today,
416.84s - 417.80s |  but it's gonna get better.
417.80s - 419.92s |  And unfortunately, the legislation
419.92s - 423.04s |  is coming along quite quickly.
423.04s - 425.88s |  Actually hats off to our European colleagues.
425.88s - 428.62s |  If we have anybody that flew across the pond,
428.62s - 431.04s |  YASA has been moving exceptionally fast
431.06s - 433.62s |  in actually implementing regulations.
433.62s - 436.74s |  And so this is great that kind of the two major
436.74s - 439.54s |  aviation regulators that set the standard
439.54s - 443.26s |  for what rules look like in building
443.26s - 446.58s |  and flying and maintaining aircraft and airlines
446.58s - 448.30s |  are largely getting on the same page
448.30s - 451.18s |  and moving quickly to adapt all of this.
451.18s - 454.06s |  So those are some of those recent developments
454.06s - 458.10s |  and state of affairs, but I wanna turn over to Stewart
458.10s - 460.02s |  because he has a really interesting perspective
460.04s - 461.92s |  from industry and then within the Air Force
461.92s - 466.51s |  that I think informs the policy discussion.
466.51s - 468.19s |  Thanks, Mike, appreciate it.
468.19s - 469.95s |  Okay, so number one, first of all,
469.95s - 472.23s |  these slides that I'm gonna show you now,
473.23s - 474.91s |  I created them while I was in the Air Force,
474.91s - 478.71s |  so I need to cite myself and release them publicly.
478.71s - 481.35s |  And so I can show you these today, which is cool.
482.31s - 487.31s |  All right, so basically when I got to the Air Force,
487.47s - 489.83s |  what we were trying to do in terms of,
489.83s - 491.23s |  they call it digital transformation.
491.73s - 492.57s |  I don't know if it means anything,
492.57s - 494.45s |  but basically what we were trying to do,
494.45s - 497.57s |  I took it to mean learning from data
497.57s - 500.73s |  off of operational systems like telemetry data.
500.73s - 505.17s |  And this is kind of what I used to try to make the case
505.17s - 507.41s |  to like generals and senior leaders,
507.41s - 510.85s |  senior civilians in the DoD to learn and adapt
510.85s - 513.29s |  from data off of operational systems.
513.29s - 517.29s |  And in the Air Force, this is like bits off jets,
517.29s - 520.61s |  bits off munitions, bits off any type
520.95s - 524.91s |  of operational system, but a lot of bits off of jets.
524.91s - 528.39s |  But in the DoD, this could be bits off of really ships,
528.39s - 530.07s |  submarines, et cetera.
530.07s - 532.39s |  And so we were trying to figure out how do we like
532.39s - 535.09s |  encourage and demonstrate the potential of this data,
535.09s - 536.95s |  which could be used for cyber stuff.
536.95s - 539.15s |  A lot of times hackathons are confused for cyber.
539.15s - 542.47s |  They can be cyber, but they also can do other things too.
542.47s - 545.55s |  I come from more of a capability development side.
545.55s - 548.03s |  So what we were trying to do is basically emphasize
548.21s - 550.65s |  and demonstrate the potential of this.
550.65s - 552.77s |  It starts with kind of this story here,
552.77s - 555.41s |  which my background coming from Microsoft,
555.41s - 557.17s |  we did this, I worked on health of systems
557.17s - 558.73s |  or reliability data.
558.73s - 561.19s |  Every time there's a crash on a Windows device,
561.19s - 562.25s |  log data is produced.
562.25s - 565.77s |  That log data in many cases is actually sent back
565.77s - 568.25s |  to kind of home station to be analyzed,
568.25s - 570.01s |  to understand like the health of the system, right?
570.01s - 572.13s |  And I can, we can talk about that more
572.13s - 573.37s |  if people have specific questions,
573.91s - 578.19s |  but basically you can learn from various beta builds
578.19s - 581.07s |  that are released and you can learn basically
581.07s - 583.71s |  what you want to fix and what will basically solve
583.71s - 584.55s |  the biggest problem.
584.55s - 586.15s |  And that was what we kind of focused on.
586.15s - 588.19s |  But like, there's all these other cases
588.19s - 592.11s |  where big tech, my argument here is basically
592.11s - 594.23s |  every big tech company in the world
594.23s - 597.47s |  undergirds with automatically collected data.
597.47s - 599.27s |  You call it telemetry, you can call it whatever you want,
599.27s - 601.59s |  but it's automatically collected data for their systems.
601.59s - 602.47s |  And there's all these examples.
602.47s - 604.45s |  I won't go through each one.
604.45s - 608.09s |  Tesla, of course, is AI automation,
608.09s - 610.53s |  is what you see SpaceX, electronic resilience,
610.53s - 612.45s |  so the Starlink example.
612.45s - 613.81s |  A lot of people like to focus on the fact
613.81s - 615.57s |  that there was a software patch pushed
615.57s - 618.49s |  to mitigate basically jamming.
618.49s - 620.49s |  But the thing that's kind of underrepresented
620.49s - 622.61s |  is like how did they know what to fix?
622.61s - 624.05s |  How did they know what was being jammed
624.05s - 625.09s |  and how to fix it, right?
625.09s - 627.85s |  And the automatic collection of data is critical for that.
627.85s - 628.97s |  And et cetera, et cetera.
628.97s - 631.97s |  I'll key in on Google as well.
632.31s - 633.99s |  A lot of people think of the search engine
633.99s - 635.71s |  and PageRank and other AI algorithms
635.71s - 636.83s |  which automatically collect data.
636.83s - 639.47s |  But what I actually am really fascinated by
639.47s - 642.95s |  is their unplanned, basically crowdsourced learning
642.95s - 646.35s |  with flu data, so Google Trends actually,
646.35s - 648.67s |  if you're familiar, was able to actually out-predict
648.67s - 650.53s |  the CDC for the spread of flu
650.53s - 652.31s |  basically by the use of search terms.
652.31s - 654.49s |  So there's all this richness in data
654.49s - 656.39s |  when automatically collected that's really valuable
656.39s - 658.47s |  and we were trying to emphasize that
658.47s - 661.87s |  to the DOD and to the Air Force.
662.57s - 663.41s |  There's basically like four ways
663.41s - 665.73s |  we think about learning from data
666.63s - 668.77s |  that's collected off of operational systems
668.77s - 670.69s |  and I'll just point to that green box
670.69s - 672.09s |  that's most relevant to this talk
672.09s - 675.07s |  which is basically you can adapt the system itself.
675.07s - 677.13s |  So adapt like the operational system.
677.13s - 680.49s |  You can also adapt the tactics, techniques, and procedures.
680.49s - 682.37s |  So how you use the system.
682.37s - 683.85s |  You can adapt kind of strategy
683.85s - 685.97s |  which probably is less critical.
685.97s - 688.45s |  It could be useful with the FAA, I would think.
688.45s - 690.25s |  And then actually you can adapt the way
690.27s - 692.43s |  you actually exercise and train with data.
692.43s - 693.79s |  All right, okay.
693.79s - 698.39s |  And so how did we go about basically learning
698.39s - 700.71s |  and adapting from data in the Air Force?
700.71s - 704.71s |  And so I'll give you kind of a hypothetical example
704.71s - 706.31s |  that I've illustrated here and then I'm gonna kind of
706.31s - 709.43s |  generalize it to the DOD and it may also generalize now
709.43s - 711.83s |  to the FAA and commercial flight.
711.83s - 716.07s |  So the basic idea is like in the examples I gave
716.07s - 718.07s |  with big tech, you basically have data,
718.07s - 719.75s |  you collect, you do something with it,
720.25s - 721.81s |  and then you ultimately find a way to like put it
721.81s - 725.65s |  into a production-like environment or a test environment
725.65s - 728.17s |  and trial effects with it of some kind
728.17s - 730.45s |  and then ultimately collect on that to improve it.
730.45s - 733.01s |  And that's your kind of typical iteration pipeline.
733.01s - 735.13s |  They call that like DevOps, right?
735.13s - 737.65s |  In the Air Force, it's a little bit harder
737.65s - 740.09s |  because we have to deal with things like classification.
740.09s - 742.05s |  We may have like degraded comms.
742.05s - 743.55s |  It's not as simple as just sending bits
743.55s - 745.01s |  over an internet connection.
745.01s - 748.07s |  And so it starts with, and this is example again,
748.09s - 750.33s |  I would use this to pitch to senior leaders.
750.33s - 753.43s |  The idea is basically a mission captures some information
753.43s - 756.29s |  so we fly some sort of jet that may or may not
756.29s - 759.09s |  collect on a neutral or adversarial
759.09s - 761.85s |  or friendly system of some kind
761.85s - 764.13s |  and you produce bits during that process.
764.13s - 766.37s |  That sensor data needs to get like shared
766.37s - 769.01s |  to some human or machine that can do something with it
769.01s - 771.69s |  so you gotta get it off the operational system, right?
771.69s - 774.01s |  And then you need to, this is like a critical difference
774.01s - 776.33s |  in the DOD is like you need to classify the data
776.35s - 778.51s |  so you need to know like what is the classification
778.51s - 779.33s |  of the data?
779.33s - 780.31s |  It could be secret, it could be top secret,
780.31s - 782.71s |  it could be unclassified, it could be lots of things.
782.71s - 784.87s |  There's a lot we can go into on that too,
784.87s - 786.19s |  especially when you combine data.
786.19s - 789.59s |  Sometimes it's up classes, which is complicated.
789.59s - 792.39s |  So if you wanna learn, sometimes you have to learn
792.39s - 793.99s |  at higher classifications.
793.99s - 797.65s |  And then basically you need to get that to like doers
797.65s - 799.85s |  or machines that can learn from that data.
799.85s - 801.55s |  So that could be analytics, that fourth box
801.55s - 804.67s |  with too many words in it is doers doing stuff with data
804.67s - 805.99s |  and it could be machines or humans trying
806.65s - 808.81s |  to build stuff in a permissive environment
808.81s - 810.53s |  where you can basically do stuff, right?
810.53s - 814.21s |  And then you wanna field those solutions in some way
814.21s - 816.89s |  or employ them in some way that produce new data
816.89s - 818.97s |  that allows you to restart this process, right?
818.97s - 821.97s |  And so what we kind of call this in the DOD
821.97s - 823.33s |  is like we call this bits to effect.
823.33s - 825.29s |  They're focused on effects, but you could think of those
825.29s - 827.37s |  as just being changes to a system.
827.37s - 829.61s |  And so the idea, and this is how it generalizes.
829.61s - 832.61s |  So basically, fundamentally those steps generalize
832.61s - 833.59s |  in this format.
833.59s - 835.95s |  Number one, you need to instrument and collect data.
836.77s - 837.97s |  If you have no instrumentation off the system,
837.97s - 841.09s |  you do not produce a change or effect based on data
841.09s - 843.33s |  because the data never existed in the first place.
843.33s - 845.57s |  There were no bits to collect.
846.81s - 849.65s |  Once you have collection of those bits on the system,
849.65s - 851.37s |  you need to get them off the system.
851.37s - 853.97s |  If you're going to try to generalize learning
853.97s - 857.97s |  across a system and not just to that specific device, right?
857.97s - 860.01s |  And so piping and data engineering,
861.33s - 864.17s |  that's important I think in operational systems
864.17s - 867.29s |  that are disconnected, such as like aircraft.
868.27s - 870.29s |  The next is probably less relevant,
870.29s - 872.59s |  but potentially relevant is like data classification
872.59s - 873.43s |  and access.
873.43s - 876.31s |  So certain data is gonna be like restricted or protected.
876.31s - 880.43s |  You need to figure out like what is that restricted portion
880.43s - 884.73s |  and what to do with it.
884.73s - 888.15s |  I'll give one example that I think about
888.15s - 892.41s |  and it may be relevant also in general aviation as well,
892.43s - 896.75s |  which is basically even if the device you're collecting from
896.75s - 900.75s |  is not of some sophisticated protected
900.75s - 902.79s |  or classified origin,
902.79s - 906.47s |  if it has the ability to collect things near it
906.47s - 909.61s |  that are highly classified or protected,
909.61s - 911.35s |  then the data that's collected
911.35s - 914.11s |  then is classified at that level.
914.11s - 916.31s |  So we might fly something like say an F-16
916.31s - 917.99s |  next to something maybe more classified,
917.99s - 920.51s |  like say, I don't know, an F-22 or something, right?
921.17s - 923.37s |  That data would become much more classified
923.37s - 926.49s |  because it collected near something of high importance.
926.49s - 928.53s |  And so, yeah, I could imagine some examples
928.53s - 930.89s |  in civil aviation where that could take place.
930.89s - 933.05s |  The next is the ability to do stuff with the data.
933.05s - 934.57s |  So you need to be able to bring that data
934.57s - 936.85s |  into an environment where you can try and do stuff.
936.85s - 939.69s |  And so what we did is we actually like produced
939.69s - 941.49s |  these really permissive environments
941.49s - 943.77s |  that isolated the protected data
943.77s - 945.57s |  and allowed people to do stuff with it.
945.57s - 946.41s |  Then you employ the effects
946.41s - 948.13s |  and that's how it kind of generalizes.
948.13s - 950.19s |  Okay, back to you.
950.57s - 954.03s |  So anytime I hear classification,
954.03s - 957.93s |  I see a lot of my civil colleagues roll their eyes.
957.93s - 959.61s |  I just think we have the exact same thing.
959.61s - 961.01s |  We just call it proprietary data
961.01s - 963.11s |  and different versions of that.
963.11s - 965.13s |  There's actually a lot of generalizations
965.13s - 967.13s |  between those two problem sets.
968.05s - 973.05s |  I want to just throw out a couple thoughts and perspectives.
973.61s - 976.97s |  Number one, I hear a lot of companies in aerospace say,
976.97s - 979.95s |  hey, we're already collecting like more data off of systems
979.97s - 981.53s |  than we know what to do with.
981.53s - 983.81s |  And I think that that's actually a fallacy.
983.81s - 986.41s |  I think that we can do a significantly better job
986.41s - 990.29s |  actually instrumenting, especially fly-by-wire assets
990.29s - 993.65s |  and must do that for safety, reliability,
993.65s - 994.53s |  it's really good business
994.53s - 997.09s |  or an economic efficiency reasons to do that.
997.09s - 1002.05s |  But the order of magnitude data problem
1002.05s - 1004.57s |  that a lot of people complain about,
1004.57s - 1005.93s |  like what would we do with all of this?
1005.93s - 1007.89s |  It's expensive to collect and record all of that.
1008.87s - 1011.75s |  I think that folks in aerospace that say that
1011.75s - 1013.87s |  don't really appreciate how other industries
1013.87s - 1014.83s |  have solved that problem
1014.83s - 1017.27s |  and how important and useful that data is.
1017.27s - 1022.27s |  That data also, I am worried about how collected aviation
1022.99s - 1026.27s |  aggregated or desensitized data
1026.27s - 1028.15s |  makes its way into the policy process
1028.15s - 1030.71s |  because I actually don't see a lot of examples of that.
1030.71s - 1033.87s |  I think that there are tremendous data silos in industry.
1033.87s - 1037.11s |  You have operators that have data insights,
1037.13s - 1038.61s |  OEMs that have data insights.
1038.61s - 1041.35s |  Those two often do not share appropriately.
1041.35s - 1043.21s |  And then almost the last people
1043.21s - 1045.55s |  to kind of get high level insights,
1045.55s - 1049.13s |  knowledge out of that are regulatory bodies.
1049.13s - 1050.79s |  And so breaking down those silos,
1050.79s - 1053.61s |  I think actually has a tremendous impact on safety
1053.61s - 1055.47s |  and the security conversation.
1056.61s - 1059.69s |  So the whole data, what the Air Force calls an OODA loop,
1059.69s - 1060.83s |  it's a learning cycle.
1061.93s - 1063.61s |  In civil aviation,
1063.73s - 1067.51s |  there's a real significant policy problem,
1067.51s - 1071.03s |  which is that we've learned over time to build safe systems.
1071.87s - 1074.75s |  We have really strict software development,
1074.75s - 1076.95s |  testing and approval processes
1076.95s - 1078.79s |  to make sure that an aircraft
1078.79s - 1081.19s |  and the software on it is safe to fly.
1081.19s - 1083.53s |  And we wanna reduce that risk as much as possible.
1083.53s - 1085.87s |  But that means that it takes a lot of time
1085.87s - 1088.43s |  and a lot of money in order to make changes
1088.43s - 1090.31s |  to important software systems.
1090.31s - 1092.23s |  There's a talk at 12 that's gonna dive
1092.23s - 1095.21s |  into all the nuance there,
1095.21s - 1097.01s |  different design assurance levels.
1097.01s - 1099.17s |  Like you obviously are gonna put more attention
1099.17s - 1101.79s |  to things that are what they call DAL-A,
1101.79s - 1103.73s |  the most important computers on board a plane,
1103.73s - 1105.29s |  as opposed to the things that don't matter
1105.29s - 1107.03s |  or not safety critical.
1107.03s - 1109.91s |  But this is directly at odds with a patching process,
1109.91s - 1111.87s |  which fundamentally does not exist.
1111.87s - 1113.59s |  So from a policy perspective,
1114.43s - 1116.11s |  really nobody has figured out yet
1116.11s - 1121.11s |  if you identify a zero day on an avionics computer,
1121.27s - 1124.85s |  that is really important for the function of that aircraft.
1124.85s - 1129.85s |  How do you quickly spin a fix and then propagate that
1130.11s - 1133.07s |  without either grounding the fleet in the interim
1133.07s - 1135.41s |  or just ignoring that problem,
1135.41s - 1136.63s |  working on it in the background,
1136.63s - 1139.43s |  letting everybody probably not even know
1139.43s - 1140.63s |  that there's a potential risk
1140.63s - 1142.71s |  and then rolling out a software update
1142.71s - 1143.55s |  once it goes through
1143.55s - 1146.23s |  the normal software development process.
1146.23s - 1150.25s |  And there's different DO, 178, 360, et cetera.
1150.25s - 1153.97s |  So that's really interesting
1153.97s - 1157.69s |  that we have both safety and a lack of security processes,
1157.69s - 1161.21s |  but adapting existing IT security processes
1161.21s - 1163.97s |  such as patching will come into direct conflict
1163.97s - 1166.33s |  with the way that we build, certify, test
1166.33s - 1167.77s |  and deliver software today.
1168.97s - 1172.61s |  The instrumentation and data kind of loop
1172.61s - 1175.97s |  and the time horizons there all intersect.
1175.97s - 1178.33s |  And back to the legislation,
1179.17s - 1183.81s |  there's now a committee that's gonna be stood up
1183.81s - 1185.57s |  to try and grapple with these issues.
1185.57s - 1188.09s |  And the way that we can all get involved
1188.09s - 1192.13s |  is that there's a request for comment
1192.13s - 1194.53s |  in a process that many of us are familiar with.
1194.53s - 1196.21s |  A lot of people underutilize that
1196.21s - 1198.29s |  or when they do comment and candidly,
1198.29s - 1203.29s |  a lot of the comments are not offering solutions
1203.41s - 1204.81s |  or not really technically rich.
1204.81s - 1206.41s |  Like if you have thoughts and opinions
1206.41s - 1210.09s |  on how these processes or how specific technology
1210.09s - 1213.65s |  should be implemented, it is fascinating to me
1213.65s - 1216.13s |  to have seen examples of how individual comments
1216.13s - 1218.49s |  get bubbled up and actually like discussed
1218.49s - 1220.93s |  in the committees that actually set the rules
1220.93s - 1224.65s |  and the regulations for how this law is implemented
1224.65s - 1226.57s |  and how safety technologies actually get rolled out.
1226.57s - 1229.25s |  So I would encourage everybody to actually check that out.
1229.25s - 1232.69s |  If you see a component of this problem, that's interesting
1232.69s - 1235.25s |  and you wanna get that voice out there.
1236.01s - 1237.69s |  There's both kind of a government-sponsored
1237.69s - 1240.29s |  and an industry-sponsored side to this world.
1240.29s - 1243.57s |  And so for those that are unaware,
1243.57s - 1247.37s |  there's a set of committees run by an organization
1247.37s - 1250.89s |  called RTCA that essentially builds all of this.
1250.89s - 1253.61s |  It usually has representation from government
1253.61s - 1256.01s |  but mostly industry-focused.
1256.01s - 1259.33s |  And these two things intersect at higher policy levels
1259.33s - 1262.65s |  but it's really important to kind of interface with both.
1262.69s - 1265.73s |  So we, just looking at the clock,
1265.73s - 1267.97s |  actually wanted to reserve a bunch of time
1267.97s - 1270.29s |  with all of this background for questions.
1271.17s - 1272.93s |  I know that we have a lot of experience in the audience.
1272.93s - 1276.89s |  So I think we will, we're just gonna ask Stuart
1276.89s - 1279.21s |  if you wanna talk about hackathons
1279.21s - 1282.55s |  and I wanna preface the Air Force,
1284.05s - 1287.29s |  your component here that I'm really excited
1287.29s - 1289.77s |  to have seen the Aviation Village at DEF CON.
1290.77s - 1292.37s |  Are we out of, are we looking?
1293.65s - 1296.65s |  Oh, get out, are you serious?
1296.65s - 1297.77s |  All right, well, we won't hold you that long.
1297.77s - 1299.33s |  We'll give you some time.
1299.33s - 1302.45s |  But really excited to see how the Aviation Village
1302.45s - 1303.93s |  has evolved over the last couple of years
1303.93s - 1305.85s |  and that major manufacturers are showing up
1305.85s - 1306.79s |  and participating.
1308.01s - 1313.01s |  However, there still is, I think, a lot of work to be done
1314.37s - 1318.25s |  in terms of looking at pen testing, building processes
1318.25s - 1320.69s |  and providing protections for security researchers
1320.69s - 1324.65s |  to do more work, especially on core avionic elements
1324.65s - 1326.41s |  where you can't buy this stuff on eBay.
1326.41s - 1328.45s |  So there's first like an access problem.
1328.45s - 1330.29s |  How do you get access to the tech?
1330.29s - 1333.65s |  Second, a lot of the work that's been done
1333.65s - 1337.69s |  in the IT industry when it comes to bug bounties
1337.69s - 1339.43s |  and reporting processes and protections
1339.43s - 1341.57s |  for security researchers needs to kind of be ported
1341.57s - 1342.77s |  over to aviation.
1342.77s - 1344.89s |  And the Air Force has done some really cool stuff here
1344.89s - 1347.53s |  with the Bravo program.
1347.53s - 1349.49s |  So Stuart, can you talk a little bit about
1349.49s - 1351.81s |  how you stood that up and how it resulted
1351.81s - 1353.53s |  and what civil aviation can learn?
1354.57s - 1355.41s |  Yeah, sure.
1355.41s - 1359.29s |  So it's kind of, it's not so different from,
1359.29s - 1360.57s |  and it's an honor to be here at DEF CON.
1360.57s - 1363.59s |  I've been an admirer, but this is my first time here.
1364.89s - 1367.73s |  But basically what we did is we started
1367.73s - 1371.01s |  with this premise as described of what can we do
1371.01s - 1373.69s |  with kind of recorded operational data?
1373.69s - 1375.89s |  And similar to the Aviation Village here,
1375.89s - 1377.77s |  we basically started running events
1377.77s - 1380.29s |  where like engineers from within DOD,
1380.29s - 1382.81s |  so these are civilian and military personnel,
1382.81s - 1386.93s |  as well as, and actually there was a talk given earlier,
1387.77s - 1391.65s |  the DOD lawyer versus open source software developer,
1391.65s - 1394.25s |  Rebecca Lively ran that, I think on Friday,
1394.25s - 1396.29s |  and really enjoyed that talks.
1396.29s - 1397.95s |  And I think that was inspired in part
1397.95s - 1399.01s |  by one of these events.
1399.01s - 1401.17s |  But basically we ran about 10 of these events,
1401.17s - 1404.31s |  ranging in size from around 50, 75 people
1404.31s - 1407.07s |  to actually 700, which is pretty large.
1407.07s - 1411.07s |  These were classified and protected events,
1411.07s - 1412.43s |  but actually any American citizen
1412.43s - 1415.47s |  for a number of these events was able to participate.
1415.47s - 1418.17s |  So like anybody here who's an American citizen
1418.17s - 1420.67s |  could have applied and participated.
1420.67s - 1424.91s |  We ended up producing about 200 software prototypes
1424.91s - 1428.79s |  from real operational data, which is very unusual at DOD.
1428.79s - 1432.31s |  Oftentimes the prototypes are produced without the data.
1432.31s - 1434.15s |  What did we kind of learn from this?
1434.99s - 1435.83s |  I'd say a couple of things.
1435.83s - 1436.65s |  So number one, we found that within
1436.65s - 1437.75s |  the Department of Defense,
1437.75s - 1440.27s |  there's actually a massive set of talent.
1440.27s - 1444.79s |  Just like when your number N is so large,
1444.79s - 1447.19s |  DOD, I think, I mean, I know Air Force
1447.19s - 1448.71s |  has around two million employees,
1448.71s - 1449.99s |  I don't know the size of DOD,
1449.99s - 1451.71s |  but it's probably around three X that.
1451.71s - 1453.65s |  When your N is sufficiently large,
1453.65s - 1456.99s |  you just have tinkerers, engineers,
1456.99s - 1461.71s |  people who just wanna go play with different systems.
1461.71s - 1464.31s |  And so we were able to kind of create that opportunity
1464.31s - 1468.39s |  across these 10 events and do so as well as international.
1468.39s - 1471.21s |  We ran one in Europe, in Germany.
1471.21s - 1474.55s |  We ran one in the Indo-PACOM region in Hawaii.
1474.55s - 1477.81s |  We ran one in coordination with CENTCOM,
1478.75s - 1480.35s |  which they publicly disclosed
1480.35s - 1483.47s |  was on counter unmanned aerial systems.
1483.47s - 1485.43s |  And so we were able to do some pretty cool
1485.43s - 1487.55s |  and interesting things and like inspire a lot of people
1487.55s - 1488.91s |  just like DEFCON does every year.
1488.91s - 1491.39s |  And so I think we took some inspiration from DEFCON
1492.39s - 1494.79s |  and we're able to kind of produce projects,
1494.79s - 1497.07s |  some of which we're able to enter
1497.07s - 1498.55s |  kind of production within DOD
1498.55s - 1499.79s |  and actually make some impact,
1499.79s - 1503.27s |  some of which I can't even talk about here, but yeah.
1503.27s - 1507.23s |  And then the last slide I'll cover real quick.
1507.23s - 1510.15s |  So those were all kind of like events that we organized,
1510.15s - 1512.19s |  but there's so much more happening
1512.19s - 1516.63s |  in terms of kind of these events
1516.63s - 1518.23s |  where people gather together
1518.23s - 1520.63s |  to kind of learn and adapt from data office systems
1520.67s - 1524.51s |  or do engage in cyber testing and penetration testing.
1524.51s - 1526.31s |  And so these are some of those things
1526.31s - 1527.57s |  that have come out of this.
1527.57s - 1529.43s |  And it's important to note that like this is occurring
1529.43s - 1530.87s |  definitely in the United States
1530.87s - 1534.57s |  and with other democratic allies and things like that.
1534.57s - 1537.43s |  There was a national security hackathon in El Segundo.
1537.43s - 1539.69s |  There was one in Stanford.
1541.15s - 1543.91s |  There's been venture capital involved.
1543.91s - 1545.83s |  There's been kind of just citizens
1545.83s - 1547.91s |  wanting to do this as well.
1547.91s - 1552.07s |  In Ukraine, you have the anti-Shaheed hackathon
1552.07s - 1552.91s |  that took place,
1552.91s - 1555.27s |  focused on basically defending their interests.
1555.27s - 1556.67s |  And then you've also got,
1556.67s - 1558.75s |  of course this is taking place
1558.75s - 1562.59s |  in some kind of, some would say adversarial countries,
1562.59s - 1565.85s |  to democratic republics such as in Russia and China
1565.85s - 1567.63s |  where they're also using these activities.
1567.63s - 1570.11s |  So this is occurring kind of everywhere
1570.11s - 1573.83s |  and we're seeing various ways in which it's being employed.
1573.83s - 1575.67s |  And I can talk more about that in the questions,
1575.67s - 1577.11s |  but Mike, back to you.
1578.03s - 1580.67s |  Yeah, so crazy, crazy policy ideas.
1580.67s - 1583.43s |  One, it would be really cool to see the FAA
1583.43s - 1585.71s |  actually run and sponsor some hackathons
1585.71s - 1588.47s |  and also for industry to open their doors
1588.47s - 1592.15s |  and make some of the most kind of exclusive
1592.15s - 1596.71s |  avionics components that are on many of the planes
1596.71s - 1599.79s |  that provide the most seat carrying capacity.
1599.79s - 1603.07s |  So therefore like the highest impact systems,
1603.07s - 1607.27s |  it'd be really cool to see more of that made available
1607.35s - 1609.63s |  for the community to mess with.
1610.47s - 1614.03s |  We have to figure out a patching process, second.
1614.03s - 1616.71s |  And we have to figure out how we're gonna balance
1616.71s - 1621.51s |  speed with safety and software review.
1621.51s - 1623.31s |  That's really tough not to crack,
1623.31s - 1627.19s |  but I think that there are really important lessons
1627.19s - 1628.03s |  to learn.
1628.03s - 1630.87s |  We don't want to move so fast that you have
1631.91s - 1634.19s |  the ability for somebody to make a mistake
1634.19s - 1635.75s |  like CrowdStrike did the other day.
1635.75s - 1640.47s |  But at the same time, we have to quickly address
1640.47s - 1643.47s |  emerging threats and new discoveries
1643.47s - 1646.39s |  and do so on like a smaller time horizon
1646.39s - 1648.87s |  than the 12 or 18 months that it typically takes
1648.87s - 1652.83s |  to rush through a DAL-A software change
1652.83s - 1655.91s |  to a major component and actually get that proliferated.
1655.91s - 1658.31s |  We also have to figure out somehow
1658.31s - 1660.87s |  what the policy and economic frameworks are
1660.87s - 1663.75s |  that support that to make a more inclusive
1663.75s - 1665.63s |  kind of environment to make all that possible.
1666.63s - 1669.39s |  We would love to get some feedback from the audience
1669.39s - 1672.07s |  and answer any questions or engage in discussion.
1672.07s - 1677.07s |  So with that, we'll just pause there and see.
1677.15s - 1679.51s |  I will start by posing a question to you guys.
1679.51s - 1682.35s |  Which of these crazy ideas that we've thrown out
1682.35s - 1685.07s |  or any of the insights here has really resonated
1685.07s - 1687.19s |  or you think is a terrible idea?
1688.95s - 1689.79s |  Sir.
1745.64s - 1746.52s |  Great question.
1746.52s - 1748.52s |  The first thing that comes to mind is
1749.32s - 1752.40s |  as a technologist, telemetry and real-time monitoring
1752.40s - 1754.48s |  sounds like a phenomenal idea.
1754.48s - 1757.40s |  And I wanna acknowledge as a pilot
1757.40s - 1758.84s |  the first concern that comes to mind,
1758.84s - 1761.56s |  which is like, wait, are they gonna instrument
1761.56s - 1763.60s |  and know every single time
1763.60s - 1765.64s |  that I don't make an absolutely perfect touchdown?
1765.64s - 1768.20s |  And then is my job gonna be potentially at risk
1768.20s - 1770.24s |  if I'm on the back half of that curve?
1770.24s - 1772.44s |  So that's like the first thing that I wanna share
1772.44s - 1774.36s |  that actually came to mind.
1774.36s - 1776.48s |  To your point, sorry, could you just restate
1776.48s - 1808.16s |  very concisely the final question that you asked?
1808.16s - 1809.44s |  Evolving to, yeah.
1809.44s - 1811.64s |  Okay, so my thoughts on this
1811.64s - 1815.12s |  from a crew alerting perspective.
1815.12s - 1819.36s |  Just really, really quick to bring us all up to speed.
1820.52s - 1821.92s |  I think it's really important to acknowledge
1821.92s - 1824.80s |  that one of the fundamental and most important things
1824.80s - 1827.32s |  that a crew does obviously is decision-making
1827.32s - 1830.76s |  and you want to preserve the pilot's ability
1830.76s - 1833.28s |  to make decisions.
1833.36s - 1836.80s |  There is a balance in terms of the amount of information
1836.80s - 1837.76s |  that you give a pilot
1837.76s - 1841.04s |  because all pilots are trained to manage
1841.04s - 1842.76s |  basically their attention, their workload,
1842.76s - 1844.16s |  they call this crew load.
1844.16s - 1847.36s |  And when you overload cognitively the crew,
1847.36s - 1850.00s |  the same thing happens like in a sock
1850.00s - 1852.20s |  when you just throw so many alerts,
1852.20s - 1854.80s |  you can kind of paralyze and affect the ability
1854.80s - 1856.44s |  for them to accomplish their job.
1856.44s - 1858.52s |  So there's a bunch of disciplines
1858.52s - 1862.28s |  that come into this question and figuring out
1862.28s - 1865.44s |  what do you share with the crew for what purpose,
1865.44s - 1868.48s |  when, where and why and how you do so.
1868.48s - 1870.04s |  There are human factors,
1870.04s - 1872.96s |  there's like design UI UX elements to that,
1872.96s - 1875.72s |  there's process, there's training implications.
1875.72s - 1878.44s |  And it's actually a really, really difficult,
1880.48s - 1882.28s |  I think question to answer.
1882.28s - 1884.36s |  So I don't know that anybody has that figured out
1884.36s - 1885.56s |  first thing I want to say is like,
1885.56s - 1886.72s |  I'm not going to have an answer to that,
1886.72s - 1888.80s |  but I feel really strongly as a pilot
1888.80s - 1893.12s |  that I would like to know before I go wheels up
1893.12s - 1897.60s |  on the runway that I have a safe configuration
1897.60s - 1901.32s |  of hardware and software on the plane first and foremost,
1901.32s - 1903.40s |  because the situation is different
1903.40s - 1905.08s |  when you are weight on wheels,
1905.08s - 1907.60s |  you're on the ground as opposed to in flight.
1907.60s - 1912.60s |  If I lose a system, I need to understand very quickly
1912.80s - 1915.28s |  what other systems I can rely on
1915.28s - 1918.48s |  to fly, navigate or communicate the plane.
1919.60s - 1923.28s |  Pilots get indications, warnings, cautions and advisories
1923.28s - 1926.16s |  to do that in the event of systems losses,
1926.16s - 1929.28s |  but we don't train or inform pilots to think today
1929.28s - 1932.64s |  about the implications of either malicious software
1932.64s - 1934.28s |  or software glitches or failures.
1934.28s - 1936.60s |  I think the closest thing that comes to that
1937.92s - 1942.44s |  relatably is like somebody didn't update logs on a plane
1942.44s - 1944.20s |  and now I have like out of date charts
1944.20s - 1945.88s |  or an out of date navigation database
1945.88s - 1946.72s |  or something like that,
1946.72s - 1949.56s |  and I can't do a specific type of procedure.
1949.56s - 1952.44s |  I think that there is a component of training
1952.44s - 1955.64s |  where we want pilots to understand
1955.64s - 1959.92s |  that systems can be impacted in certain ways
1959.92s - 1962.36s |  and it informs the way that they think
1962.36s - 1964.96s |  about using redundant systems
1964.96s - 1968.24s |  or more analog capabilities to perform functions.
1968.24s - 1971.68s |  And I think some type of indication in the cockpit
1971.68s - 1973.68s |  is important while we continue to advance
1974.08s - 1977.60s |  the state of art of actually securing the technology itself.
1979.04s - 1981.52s |  I don't know if that's a satisfying answer for you,
1981.52s - 1983.96s |  but I see a head shaking.
2001.01s - 2001.85s |  Yeah.
2004.09s - 2007.05s |  Well, I don't think that we did, please, please.
2007.05s - 2010.17s |  And also is real time a requirement
2010.17s - 2012.17s |  or is it just getting all of the data
2012.17s - 2014.81s |  and being able to protect a system at scale
2014.81s - 2017.41s |  maybe with some delays in that data collection,
2017.41s - 2019.57s |  the requirement, what are the drawbacks?
2019.57s - 2022.73s |  Yeah, in my experience, basically the use of data
2022.73s - 2024.33s |  basically is most effective when you need
2024.33s - 2026.65s |  to make calibrations or changes to a system.
2026.65s - 2028.33s |  So if everything's working great,
2029.21s - 2031.25s |  I mean like it may be able to improve workflows,
2031.25s - 2032.85s |  it may be able to improve the preciseness
2032.85s - 2033.85s |  or accuracy of your work,
2033.85s - 2036.85s |  but fundamentally if things are going great
2036.85s - 2037.73s |  and you have no problem,
2037.73s - 2039.77s |  then the data's not really important.
2039.77s - 2041.77s |  The data becomes most useful under courses
2041.77s - 2045.29s |  of basically need for calibration or change
2045.29s - 2046.65s |  in current operating flows.
2046.65s - 2048.41s |  So like for example, I could imagine
2048.41s - 2051.53s |  if maybe there's a massive storm
2051.53s - 2053.73s |  that requires basically a bunch of planes
2053.73s - 2056.61s |  to land unexpectedly in different places,
2056.61s - 2058.93s |  potentially the collection of data could inform
2058.93s - 2060.57s |  or improve on decision making there.
2060.57s - 2063.17s |  So that kind of translates to in the DoD world,
2063.17s - 2064.81s |  we call that command and control, right?
2064.81s - 2067.01s |  So some sort of centralized control
2067.01s - 2068.13s |  or decentralized control,
2068.13s - 2069.81s |  the collection of data under that circumstance
2069.81s - 2071.25s |  would be useful.
2071.25s - 2074.21s |  On the plane itself, I can think of a example
2074.21s - 2076.45s |  which I'm gonna be intentionally a little bit vague about,
2077.13s - 2080.25s |  but basically if you were to lose, say,
2081.89s - 2086.33s |  a sensor system that has multiple sensors
2086.33s - 2088.29s |  and you were to lose, say, one of them,
2089.61s - 2092.05s |  you could potentially rely on those others
2092.05s - 2094.53s |  which may like to basically infer,
2094.53s - 2099.53s |  to inference or predict what that missing sensor would see.
2100.93s - 2103.17s |  And so under certain circumstances, that could be useful.
2103.17s - 2104.41s |  So there's ways to basically produce
2104.41s - 2107.17s |  some sort of emergent capability
2107.17s - 2111.49s |  or extract some signal from other systems that are lost
2111.49s - 2113.09s |  that are generally not relied on
2113.09s - 2115.77s |  under general normal operating conditions.
2115.77s - 2118.37s |  And so those are some ways in which we've found
2118.37s - 2121.53s |  the use of data off an operational system
2121.53s - 2126.37s |  to be really valuable under mission, like DoD mission.
2126.37s - 2128.37s |  It may translate to civil aviation.
2128.37s - 2129.85s |  Does that sort of answer your question?
2129.85s - 2133.01s |  Give you some examples?
2133.01s - 2134.09s |  Okay.
2134.29s - 2135.13s |  I'll just add,
2137.41s - 2142.41s |  I think that streaming real-time data is great,
2142.41s - 2145.81s |  but there's a need to get all of the data
2145.81s - 2147.61s |  and it doesn't necessarily happen
2149.13s - 2149.97s |  when the plane is flying.
2149.97s - 2151.13s |  And when I say all of the data,
2151.13s - 2153.29s |  I'm thinking like full take data collection
2154.57s - 2157.57s |  off the onboard avionics networks, right?
2157.57s - 2161.77s |  So hearing 664, MIL-STD-1553,
2161.77s - 2163.93s |  the inner LRU communications
2164.77s - 2167.81s |  because if you were to think a little bit differently
2167.81s - 2170.29s |  about the aircraft, that data allows you
2170.29s - 2173.05s |  to treat each aircraft as a sensing system.
2173.05s - 2175.69s |  And any data scientists will tell you
2175.69s - 2177.53s |  that the more data that they have,
2177.53s - 2179.93s |  obviously the better that they can train predictive,
2179.93s - 2182.13s |  maintenance models, the better that you can train
2182.13s - 2186.17s |  and identify potential predictive indicators of threats,
2186.17s - 2189.49s |  especially as certain adversaries in some cases
2189.49s - 2190.93s |  have demonstrated over and over again,
2190.93s - 2195.73s |  the ability to actually test emergent capabilities.
2195.73s - 2198.81s |  Like you want to be able to identify that
2198.81s - 2201.93s |  before an entire fleet is potentially impacted.
2201.93s - 2205.77s |  So maybe this data is all collected,
2205.77s - 2209.93s |  it's cached and then it's recovered like on the ground
2209.93s - 2211.45s |  where it's less expensive to do so
2211.45s - 2213.09s |  with some near wireless means
2213.09s - 2216.97s |  as opposed to clogging up like an expensive SATCOM link.
2216.97s - 2220.41s |  But you can imagine how useful that would be
2220.41s - 2222.13s |  potentially for a security use case.
2222.13s - 2225.17s |  I think the compelling economic reason to do that
2225.17s - 2227.29s |  will certainly be like maintenance
2227.29s - 2229.69s |  and continuous evaluation of like updates
2229.69s - 2231.65s |  or feature identification initially,
2231.65s - 2234.65s |  but certainly there's a safety
2234.65s - 2236.53s |  and a security element to that
2236.53s - 2239.57s |  that I don't think is fully appreciated yet.
2239.57s - 2240.53s |  Sir.
2240.53s - 2274.27s |  So in the industry, is this problem going to get worse?
2274.27s - 2277.35s |  Is this something, are there mitigations in place
2277.35s - 2278.19s |  that are gonna stop this?
2279.60s - 2281.64s |  I mean, kind of a crude example is
2281.64s - 2284.04s |  if I see my level of pressure indicated about this,
2284.04s - 2285.40s |  is that because my sensor failed
2285.40s - 2287.16s |  or is that because the gravity's spinning things
2287.16s - 2289.32s |  are gonna stop the way gravity spins?
2289.32s - 2291.32s |  So that's a situation where an indicator
2291.32s - 2294.60s |  is going to all of a sudden become much worse situation.
2294.60s - 2296.64s |  So to me, I think that's probably,
2296.64s - 2298.16s |  and we're a long ways from that.
2298.16s - 2299.80s |  We're gonna have to gather a lot of this data
2299.80s - 2303.28s |  to learn that we can now begin to identify
2303.28s - 2305.52s |  this problem is not contained.
2305.52s - 2309.24s |  This problem is going to impact more flight systems
2310.04s - 2311.44s |  and now the urgency of my decision-making
2311.44s - 2314.04s |  is gonna be a fundamentally different thing.
2314.04s - 2316.08s |  I think this is really exciting.
2316.08s - 2317.72s |  The thing that I'm just concerned about
2317.72s - 2321.16s |  is that we can't even do that on terrestrial systems
2321.16s - 2324.00s |  without, we can't even do that on enterprise systems.
2324.00s - 2326.64s |  I don't know how we're gonna do it on aircraft
2326.64s - 2330.60s |  without folding our mental image of how we handle it.
2330.60s - 2332.76s |  And maybe a fourth thing to consider too,
2332.76s - 2334.84s |  and this one's totally up for debate,
2334.84s - 2337.84s |  so contentious concepts here, but what about intent?
2339.96s - 2344.28s |  Would it impact decision-making in the cockpit
2344.28s - 2347.92s |  if you knew that systems were intentionally being affected
2347.92s - 2350.04s |  or if it was an unintended thing, right?
2350.04s - 2352.64s |  So if something was maintenance or if it was malicious.
2352.64s - 2355.16s |  So today, in the last year and a half,
2355.16s - 2356.60s |  if you've been reading the news,
2356.60s - 2358.84s |  there are thousands of flights every month
2358.84s - 2362.44s |  that are impacted with GPS spoofing and jamming.
2362.44s - 2367.44s |  And some MMRs, GPS receivers, when they get bad time
2367.72s - 2371.40s |  from like a delayed GPS signal that's spoofing,
2371.40s - 2374.80s |  it causes internal systems to fail and crash.
2374.80s - 2379.12s |  This can, if you know that that is happening intentionally
2379.12s - 2384.12s |  as opposed to just a maintenance anomaly,
2384.40s - 2386.24s |  it can impact your decision-making
2386.24s - 2390.44s |  on if you proceed, divert, whatever the case may be.
2391.36s - 2395.68s |  That's an insight that I heard from some pilots recently
2395.72s - 2397.44s |  that were sharing an example
2397.44s - 2399.08s |  where coming back from the Middle East
2399.08s - 2404.08s |  where they knew to expect some GPS interference,
2404.76s - 2409.16s |  lost some systems, but they were expecting that.
2409.16s - 2412.04s |  What they weren't expecting was that they would have to fly
2412.04s - 2414.04s |  at a lower flight level over the Atlantic,
2414.04s - 2415.40s |  and that impacted their fuel burn
2415.40s - 2417.48s |  because when you fly at higher altitudes,
2417.48s - 2420.32s |  you get different fuel burn efficiencies.
2420.32s - 2424.24s |  Well, they had not expected that,
2424.24s - 2427.80s |  and so when they reran all of their range calculations,
2427.80s - 2429.76s |  they were within safety limits
2429.76s - 2431.60s |  to make it to their final destination,
2431.60s - 2434.64s |  but had to constantly weigh and consider a divert.
2435.48s - 2437.12s |  Knowing that that was coming
2437.12s - 2439.32s |  and knowing that that was a malicious activity
2439.32s - 2443.24s |  was really impactful because they were expecting it
2443.24s - 2446.92s |  and they were able to monitor and make changes.
2446.92s - 2449.64s |  When the unexpected happens, sometimes it's useful
2449.64s - 2454.00s |  and informs your decision-making if this is malicious.
2454.40s - 2457.84s |  That's another element to the crew alert conversation
2457.84s - 2458.96s |  that's extremely nuanced,
2458.96s - 2460.96s |  and I don't think we have any questions
2460.96s - 2462.40s |  answered around that.
2462.40s - 2465.08s |  But yeah, really, really tough stuff.
2465.08s - 2467.36s |  As it relates to policy,
2467.36s - 2470.00s |  I think getting the right frameworks,
2470.00s - 2471.88s |  the right committees, and the right people in the room
2471.88s - 2475.24s |  to wrestle and grapple with these concepts
2475.24s - 2478.28s |  and see what we can learn from diverse experiences
2478.28s - 2481.88s |  is probably the best way to arrive at the best answer,
2481.88s - 2483.80s |  and that best answer's almost certainly
2483.80s - 2485.88s |  going to evolve over time
2485.88s - 2488.12s |  as threats evolve, as the technology evolves.
2489.00s - 2490.12s |  In the meantime, a lot of people
2490.12s - 2492.68s |  are just gonna be deeply unsatisfied with the status quo,
2492.68s - 2495.76s |  so fantastic.
2495.76s - 2542.37s |  Sir?
2542.37s - 2547.13s |  Did you open that up?
2547.13s - 2549.45s |  I think disclosure may be something
2549.45s - 2553.01s |  like controlling disclosure processes
2554.57s - 2556.49s |  is a potential way to mitigate some of that,
2556.49s - 2558.49s |  but I see some audience reactions.
2558.49s - 2560.93s |  Does anybody in the audience have thoughts and opinions?
2560.93s - 2561.77s |  Sir?
2561.77s - 2578.63s |  So you can see there being a lot of students
2578.63s - 2580.51s |  who would be engaged in this.
2580.51s - 2589.40s |  The thing that I understand where he's coming from,
2589.40s - 2593.36s |  obscurity fails, and it fails in the worst ways
2593.36s - 2597.88s |  because when you only rely on security by obscurity,
2597.88s - 2600.72s |  you don't inform the defenders either.
2600.72s - 2604.52s |  And so at least if we can find these bugs,
2604.52s - 2607.08s |  we don't have to worry that an adversary has found it
2607.08s - 2608.28s |  and just hasn't told anyone
2608.32s - 2610.20s |  because they're waiting for that day
2610.20s - 2613.48s |  that they're gonna, speaking of 9-11,
2613.48s - 2614.84s |  they've got all these people out there
2614.84s - 2616.40s |  ready to insert a thumb drive
2616.40s - 2619.76s |  at all of these maintenance bases across the country.
2619.76s - 2622.32s |  They don't even know why they're doing it.
2622.32s - 2625.94s |  And then that day comes and we're at war.
2625.94s - 2627.22s |  So just summarizing, right?
2627.22s - 2631.22s |  Security, obscurity, the counterpoint to research.
2631.22s - 2632.66s |  How do you control it from getting out?
2632.66s - 2634.58s |  Especially important, just to highlight,
2634.58s - 2637.18s |  I think you missed the, it's really expensive
2637.18s - 2639.54s |  and takes a long time to fix these systems.
2640.42s - 2641.90s |  To your point, yeah,
2641.90s - 2643.94s |  so these are the two battling components.
2643.94s - 2645.38s |  I saw an opinion in the back.
2645.38s - 2647.98s |  Sir, did you have something to add to that?
2647.98s - 2680.93s |  One thing I'll share is,
2680.93s - 2685.12s |  I don't know if this is working or not, it's fine.
2685.12s - 2686.68s |  Yeah, yeah.
2686.68s - 2690.72s |  One thing I noticed at least in the Air Force
2690.72s - 2693.48s |  which consists of Air Force and Space Force
2693.48s - 2696.12s |  is that basically telemetry collection
2696.12s - 2699.68s |  was natural off of space systems.
2699.68s - 2702.08s |  And the connection I made to that was because
2702.08s - 2704.32s |  they're designed, at least Space Force doesn't really,
2704.32s - 2706.84s |  as of now, send astronauts up.
2706.84s - 2709.64s |  And so those are autonomous systems.
2709.64s - 2714.64s |  And so that's probably a very good test bed for,
2715.12s - 2719.48s |  it's naturally collecting and it's naturally instrumented
2720.40s - 2722.08s |  because it has to be.
2722.08s - 2725.32s |  And it naturally also solves for that piping problem
2725.32s - 2728.48s |  because generally, not always,
2728.48s - 2729.64s |  because if you don't have the pipes,
2729.64s - 2731.32s |  then it's gonna just need to be autonomous
2731.32s - 2732.44s |  without the pipes, right?
2732.44s - 2735.24s |  So yes, we did see that.
2735.24s - 2736.68s |  One thing I thought of later,
2736.68s - 2739.20s |  I wanna try to answer your question a little bit better
2739.20s - 2740.04s |  that I thought was relevant.
2740.04s - 2741.40s |  I think it's come up a bit,
2741.40s - 2742.92s |  but may not have been emphasized
2742.92s - 2745.24s |  is the predictive maintenance piece
2745.24s - 2747.08s |  of this data for humans.
2747.08s - 2751.08s |  So in contrast to autonomous systems,
2751.08s - 2754.20s |  like while you have human lives at stake,
2754.20s - 2757.24s |  what we have seen, at least in the Air Force,
2757.24s - 2759.92s |  is that the automatic collection of this data,
2760.04s - 2763.40s |  even if harvested and leveraged later,
2763.40s - 2768.16s |  we may be able to gain insights and start to see signal
2768.16s - 2772.76s |  that certain functions of a mission system
2772.76s - 2774.92s |  are not operating at spec,
2774.92s - 2777.64s |  or maybe they are operating at spec,
2777.64s - 2780.64s |  what we thought was spec 30 years ago,
2780.64s - 2782.76s |  but maybe that spec needs to be changed.
2782.76s - 2784.96s |  So like the collection of that data
2784.96s - 2788.16s |  allows us to make these systems safer.
2788.16s - 2792.52s |  Contrasting that against the concerns of vulnerability
2792.52s - 2796.08s |  or exploitation is tough to understand.
2796.08s - 2799.48s |  It's about, I mean, the typical kind of cost calculation
2799.48s - 2804.48s |  is risk times the impact of that risk coming true, right?
2807.16s - 2811.00s |  So I don't know which one to weigh between the two,
2811.00s - 2814.60s |  but I do know that in terms of safety of systems,
2814.60s - 2815.60s |  the collection of data
2815.60s - 2818.08s |  can allow you to make those systems safer.
2818.84s - 2819.68s |  It also could save money
2819.68s - 2821.48s |  because if we don't have things breaking in the air,
2821.48s - 2823.12s |  to your point of losing oil pressure,
2823.12s - 2825.52s |  if we are able to mitigate them on the ground
2825.52s - 2828.48s |  before you fly, well, it saves people
2828.48s - 2829.92s |  and it also could save money.
2829.92s - 2831.08s |  Those are some kind of thoughts
2831.08s - 2833.04s |  that have emerged from this discussion.
2834.80s - 2836.00s |  I have an observation,
2836.00s - 2840.16s |  and that is that in the emergent eVTOL market,
2840.16s - 2842.04s |  every single one of those designs
2842.04s - 2844.04s |  that I've interacted with their design teams,
2844.04s - 2847.60s |  they are planning as a basic requirement,
2847.60s - 2849.72s |  as a basic feature of the system,
2849.72s - 2851.64s |  full take avionic data collection
2851.64s - 2853.96s |  and significant telemetry instrumentation,
2853.96s - 2857.00s |  like significantly more advanced
2857.00s - 2859.48s |  than anything that we see in manned,
2859.48s - 2862.88s |  both at the airline, GA level, et cetera.
2863.96s - 2867.20s |  They're not just doing that for tests and evaluation.
2867.20s - 2870.44s |  In DOD and in civil aviation,
2870.44s - 2872.00s |  historically how we built systems
2872.00s - 2876.16s |  is when you have a prototype test aircraft,
2876.16s - 2877.68s |  we put all these orange wire
2877.68s - 2879.40s |  and orange boxes, data collectors,
2879.40s - 2881.48s |  and we set everything up,
2881.48s - 2885.00s |  but then we rip all of that out for size weight,
2885.00s - 2887.92s |  for swap savings when things go into production.
2887.92s - 2890.08s |  And I think that those industries
2890.08s - 2890.92s |  have certainly learned,
2890.92s - 2892.88s |  hey, there's all of these unknown unknowns
2892.88s - 2894.08s |  and we just want all of the data
2894.08s - 2896.64s |  because we're convinced that it will satisfy
2896.64s - 2898.28s |  all of these needs in the future.
2898.28s - 2901.60s |  The big question I think for operators right now,
2901.60s - 2902.92s |  like airlines is,
2902.92s - 2905.56s |  is it worth retrofitting legacy fleets
2905.56s - 2908.32s |  with some type of capability to do that?
2908.32s - 2911.76s |  Is there sufficient like safety
2911.76s - 2916.56s |  and economic use case to underwrite that investment?
2916.56s - 2922.41s |  And that's some of the debate that I hear right now.
2922.41s - 2971.12s |  In the back, yes, sir.
2971.12s - 2975.96s |  So I think answering the question to GPS interference
2977.00s - 2980.28s |  is extremely system nuanced, obviously.
2981.72s - 2983.96s |  There's been an interesting trend in aviation
2983.96s - 2985.76s |  over the last 20 years
2986.56s - 2989.44s |  where any systems engineers don't hold me
2989.44s - 2991.12s |  to the strict definitions of this,
2991.12s - 2993.44s |  but you've seen increasing coupling
2993.44s - 2997.44s |  of inertial navigation to discipline that
2997.44s - 3000.68s |  with external GNSS signaling.
3000.68s - 3003.20s |  And when these systems are completely independent,
3003.20s - 3004.16s |  that's fantastic.
3004.16s - 3007.20s |  You lose one, you can roll over to the other.
3007.20s - 3009.44s |  When they are highly coupled,
3009.44s - 3012.08s |  obviously a problem with one flows into the other.
3012.08s - 3015.00s |  And so it degrades the independence
3015.52s - 3017.04s |  in the backup utility.
3017.04s - 3019.32s |  We have seen that in a number of specific designs.
3019.32s - 3020.64s |  I won't call out anybody,
3020.64s - 3023.16s |  but a lot of really smart people right now
3023.16s - 3024.88s |  are trying to implement fixes
3026.36s - 3028.04s |  and separate these systems a little bit more
3028.04s - 3029.76s |  because that seems like the natural thing.
3029.76s - 3031.52s |  There were really good reasons,
3031.52s - 3034.36s |  but I think, you know,
3034.36s - 3036.76s |  like the industry learned that,
3036.76s - 3039.92s |  boy, timing is really important
3039.92s - 3042.08s |  and there's tremendous time sensitivity
3042.08s - 3043.88s |  and synchronization on internal systems.
3043.92s - 3045.64s |  And that wasn't like properly fuzzed
3045.64s - 3047.28s |  or tested for interference
3047.28s - 3049.76s |  because nobody really assumed that GPS spoofing
3049.76s - 3053.68s |  would be such commonplace or directed against civil assets.
3053.68s - 3055.84s |  And now we know that that's probably naive.
3056.92s - 3058.88s |  So those are just some initial,
3058.88s - 3060.12s |  I think thoughts that come to mind
3060.12s - 3063.00s |  or at least perceptions from my point of view.
3063.00s - 3064.60s |  There's really good reporting out
3064.60s - 3069.60s |  on how pervasive GPS spoofing is.
3069.84s - 3072.40s |  I would say spoofing is far more impactful
3072.40s - 3075.32s |  on aviation systems in my learned experience
3075.32s - 3077.12s |  the last two years than jamming.
3077.12s - 3078.48s |  Jamming's kind of fine.
3078.48s - 3080.44s |  Like systems are actually really resilient
3080.44s - 3085.00s |  to not getting lock and not being able to provide that.
3085.00s - 3088.16s |  They're designed with all kinds of redundancies and backups.
3088.16s - 3091.08s |  It's that false data injection,
3091.08s - 3091.96s |  if you think of spoofing,
3091.96s - 3094.20s |  like within the skin of the plane
3094.20s - 3096.32s |  that maybe wasn't appropriately tested.
3098.24s - 3102.12s |  The issue is that on certain fleets that are flying today,
3102.68s - 3106.36s |  you have a subset of those
3106.36s - 3109.60s |  where you can't just drop a software or firmware fix
3109.60s - 3113.08s |  on certain LRUs to evolve this.
3113.08s - 3115.00s |  And so people are trying to figure out
3115.00s - 3117.26s |  like how do they mitigate those risks now?
3118.20s - 3120.24s |  But yeah, there's some really good reporting on this already
3120.24s - 3121.20s |  that's out in the news.
3121.20s - 3179.82s |  I think we have time for one last question, sir.
3179.82s - 3184.10s |  Yeah, I am a huge fan and fanatical advocate
3184.10s - 3185.78s |  for we need to educate pilots
3185.78s - 3188.22s |  to their software dependencies
3188.22s - 3189.94s |  so that they really pay attention
3189.94s - 3192.46s |  and understand that reverting back
3192.46s - 3196.58s |  to secondary and tertiary navigation
3196.58s - 3200.02s |  and flying processes that they're already taught,
3200.02s - 3202.02s |  like keep those skills sharp,
3202.02s - 3204.42s |  expect systems potentially to be lost
3204.42s - 3208.54s |  and put a little bit of thought to like the fact that,
3208.54s - 3213.06s |  yeah, there's a cyber dependency.
3213.34s - 3216.10s |  I think that the training conversation
3216.10s - 3218.62s |  is really gonna evolve in terms of what that means.
3218.62s - 3222.22s |  But today the practical guidance is,
3222.22s - 3224.22s |  make sure that you can use your backup
3224.22s - 3226.74s |  like analog systems to navigate and fly.
3227.90s - 3229.18s |  But what that means in the future,
3229.18s - 3231.82s |  if there's some type of cyber crew indication,
3231.82s - 3233.62s |  what emergency procedures they go to
3233.62s - 3234.62s |  and how that all evolves,
3234.62s - 3236.58s |  I'm really excited to see how that happens.
3236.58s - 3239.02s |  So we have time for one more question, sir.
3257.56s - 3259.52s |  I have not, that sounds really scary.
3261.24s - 3272.56s |  Yeah, just, I haven't, no.
3272.56s - 3274.28s |  That is very evil.
3274.28s - 3276.12s |  Thank you for giving me another reason
3276.12s - 3277.36s |  to stay up at night.
3277.36s - 3280.00s |  Stewart, any last comments before we wrap it up?
3280.00s - 3281.32s |  Hey, everybody, thank you so much.
3281.32s - 3282.92s |  Really appreciate it, take care.


url: https://www.youtube.com/watch?v=h8E6w3vVzWo
title: DEF CON 32 - Exposing Attacks Hiding in the Sheer Noise of False Positives - E Tahoun, L Hamida
type: video
author: DEFCONConference
ingestion_date: 2024-11-09
transcription_model: large-v2
chunking_status: completed
content:
{
  "webpage_url": "https://www.youtube.com/watch?v=h8E6w3vVzWo",
  "title": "DEF CON 32 - Exposing Attacks Hiding in the Sheer Noise of False Positives - E Tahoun, L Hamida",
  "description": "In the complex landscape of modern cybersecurity, identifying coordinated attacks within massive volumes of security data is a formidable challenge. Security professionals often grapple with distinguishing these attacks from numerous false positives and isolated incidents. This talk will illuminate how data science can be harnessed to transform tons of heterogeneous events, logs, and alerts into a bunch of clusters, a few kill chains, and fewer actionable insights, with open-source models, and security knowledge encoding. Join us on a journey to enhance security operations efficacy and efficiency! No data science expertise is required!",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 3323,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241016"
}

0.00s - 5.32s | This text was transcribed using whisper model: large-v2

 I'm Ming from the Packet Hacking Village, and this last and final talk of the day is
5.32s - 10.28s |  uh, sponsored by the Packet Hacking Village, and it is our pleasure to introduce to you
10.28s - 11.28s |  Ez Tahoun!
11.28s - 12.28s |  Let's just talk.
12.28s - 17.50s |  Hello, hello.
17.50s - 18.50s |  Hey, everybody.
18.50s - 19.50s |  My name is Ez.
19.50s - 24.90s |  I'm here to talk a little, a little, about AI, because I know everybody got baited here
24.90s - 28.70s |  into AI, but the more the merrier, you know.
28.70s - 33.82s |  I'll talk more about the use case, less about AI, but before we start, how is everybody's
33.82s - 34.82s |  DevCon?
34.82s - 35.82s |  Yeah?
35.82s - 36.82s |  Alright.
36.82s - 38.78s |  Hell yeah.
38.78s - 42.26s |  Are you guys more on the blue team side?
42.26s - 43.26s |  Anybody here on the blue team?
43.26s - 44.26s |  Blue teamers?
44.26s - 45.26s |  Holy moly.
45.26s - 46.26s |  Alright.
46.26s - 47.26s |  The whole, this side is blue team?
47.26s - 48.26s |  This side is red team?
48.26s - 49.26s |  Who's on this side?
49.26s - 50.26s |  Are you guys red teamers, by any chance?
50.26s - 51.26s |  Okay.
51.26s - 52.26s |  What the hell is going on on this side?
52.26s - 53.26s |  Are you guys, like, cloud engineers?
53.26s - 54.26s |  Network engineers?
54.26s - 55.26s |  Purple?
55.26s - 56.26s |  Lots of purples.
56.26s - 57.26s |  Data scientists?
57.26s - 58.26s |  Lots of data scientists.
58.26s - 59.26s |  Alright.
59.26s - 60.26s |  Email security?
60.26s - 62.93s |  Goddamn.
62.93s - 63.93s |  Alright.
63.93s - 64.93s |  That's pretty cool.
64.93s - 65.93s |  Alright.
65.93s - 66.93s |  So, a lot of blue teamers.
66.93s - 67.93s |  A few data scientists made it in.
67.93s - 68.93s |  So, thank you for, you know, coming into a talk that has AI in the title.
68.93s - 69.93s |  I know that, that doesn't work.
69.93s - 70.93s |  People usually get scared of that word.
70.93s - 71.93s |  I remember at Black Hat, I got sold to while I was pissing in a urinal, and it was an AI.
71.93s - 72.93s |  So, I was like, uh, you know, like, there's a lot of AI, and you don't know what to do
72.93s - 73.93s |  with it.
73.93s - 74.93s |  So, I was like, uh, you know, like, there's a lot of AI, and you don't know what to do
74.93s - 75.93s |  with it.
75.93s - 76.93s |  So, I was like, uh, you know, like, there's a lot of AI, and you don't know what to do
76.93s - 77.93s |  with it.
77.93s - 79.93s |  I know that, that doesn't work.
79.93s - 81.85s |  People usually get scared of that word.
81.85s - 86.73s |  I remember at Black Hat, I got sold to while I was pissing in a urinal, and it was an AI.
86.73s - 92.17s |  So, I was like, uh, you know, like, there's a lot of AI, and you don't know what the hell
92.17s - 93.77s |  works and what the hell doesn't.
93.77s - 97.73s |  But the right framework that I will try to push on you today is essentially, talk about
97.73s - 102.29s |  the use case, less about the tool, convince me about the use case first, and then we'll
102.29s - 103.79s |  figure out how to do it.
103.79s - 104.79s |  Right?
104.79s - 108.03s |  So my talk is going to be all about context is all you need.
108.03s - 110.59s |  I have a few practitioners here.
110.59s - 113.07s |  There's George Cizerou at Ruby.
113.07s - 116.23s |  And there's Harry CIO at SAP AnnaSquare.
116.23s - 119.23s |  They're essentially the people that I bring in whenever
119.23s - 122.23s |  I have to get some validation on the problem.
122.23s - 125.75s |  So I'll try to throw them a few curveballs every now and then.
125.75s - 127.71s |  If you guys want to come up and do a quick intro,
127.71s - 128.63s |  that's fine as well.
128.63s - 130.35s |  You want to come up?
130.35s - 131.47s |  Not feeling like it?
131.47s - 132.79s |  Is everybody so tired at 5?
132.79s - 134.47s |  Is that what's going on?
134.47s - 136.67s |  You're drinking a Red Bull, and you're tired?
136.67s - 138.43s |  What the hell is wrong with that Red Bull?
138.43s - 140.75s |  Is it expired?
140.75s - 147.35s |  There are stairs on this side.
147.35s - 147.85s |  Go ahead.
147.85s - 148.35s |  100%.
148.35s - 150.31s |  Go for it, Harry.
150.31s - 156.15s |  Harry Sorori, NS2, SAP, supporting
156.15s - 159.19s |  Department of Defense.
159.19s - 161.39s |  It's about a $4.5 billion project
161.39s - 164.27s |  that I'm heading over there.
164.27s - 166.87s |  Lots of fun things, especially when
167.39s - 171.11s |  dealing with defense and all that good stuff.
171.11s - 173.59s |  There's a lot of moving parts there.
177.87s - 178.63s |  Hi, everyone.
178.63s - 180.07s |  My name is George Alcora.
180.07s - 183.91s |  I'm the CISO for Ruby Life.
183.91s - 186.91s |  I like to tell people that in my job,
186.91s - 189.87s |  I work to help people get securely laid.
189.87s - 193.07s |  I'm the CISO for, well, you've probably
193.07s - 195.11s |  heard the brand, Ashley Madison.
195.11s - 196.67s |  So we run online dating.
196.97s - 198.51s |  Ashley Madison is our flagship brand.
198.51s - 200.35s |  So that's where I work.
200.35s - 204.27s |  In terms of this, well, when I started my cybersecurity
204.27s - 206.99s |  career, I worked as a security operations analyst.
206.99s - 208.71s |  And I dealt with ArcSight.
208.71s - 210.59s |  If you guys remember ArcSight?
210.59s - 211.31s |  Oh, yeah.
211.31s - 212.83s |  Remember ArcSight?
212.83s - 214.75s |  So this is going to be a really relevant talk.
214.75s - 216.95s |  And Ezeldine's been killing it this afternoon, guys.
216.95s - 217.79s |  So please enjoy.
217.79s - 218.47s |  100%.
218.47s - 219.19s |  I appreciate you.
219.19s - 219.67s |  Please grab a seat.
219.67s - 220.83s |  Can I make a disclaimer?
220.83s - 221.87s |  Oh, more disclaimers.
221.87s - 223.41s |  I don't know if the mics are working.
223.41s - 225.43s |  Are the mics working, folks?
225.43s - 227.43s |  If you may enable them, that would be fantastic.
227.43s - 232.39s |  This way, they don't have to come back and forth.
232.39s - 233.55s |  Disclaimer is all yours.
233.55s - 236.71s |  I'm not a subscriber of Ashley Madison,
236.71s - 238.91s |  so I could keep my job.
238.91s - 239.67s |  Yes.
239.67s - 240.17s |  Yes.
240.17s - 241.47s |  I'll find your profile here.
241.47s - 242.11s |  Right.
242.11s - 244.15s |  None of us are in that breach, huh?
244.15s - 246.23s |  OK.
246.23s - 247.91s |  So the reason I bring in these folks
247.91s - 249.91s |  are essentially to talk more about the use case,
249.91s - 251.51s |  like what the hell is going on.
251.51s - 254.67s |  And usually, if I give them the mic,
254.67s - 256.51s |  they start talking about incidents.
256.51s - 258.95s |  And they tell you, oh, in this incident,
258.95s - 260.79s |  we found so much shit.
260.79s - 262.27s |  Here's how it started.
262.27s - 263.83s |  Step one, we found this thing.
263.83s - 265.39s |  Step two, there was this other thing.
265.39s - 267.71s |  Step three, there was this other thing that we found out
267.71s - 268.87s |  and we uncovered.
268.87s - 270.59s |  And what they're essentially telling you
270.59s - 273.59s |  is they have so much good investigators and their team
273.59s - 275.99s |  and outstanding contextualization
275.99s - 278.03s |  that these humans did.
278.03s - 280.95s |  So context, apparently, is very important.
280.95s - 282.43s |  And let's talk a little about that.
282.43s - 283.75s |  You guys are all blue teamers, so I'm not
283.75s - 285.19s |  going to bore you with the bullshit.
285.19s - 287.19s |  But here's a quick agenda.
287.19s - 288.87s |  The agenda is, who the hell am I?
288.87s - 291.95s |  And then some challenges, a lot of challenges,
291.95s - 293.35s |  a little bit more.
293.35s - 295.55s |  And we're going to talk a little about MITRE ATT&CK.
295.55s - 297.47s |  Anybody knows what's MITRE ATT&CK?
297.47s - 299.07s |  Oh, everybody knows.
299.07s - 300.35s |  OK.
300.35s - 301.71s |  I'll do a quick brief.
301.71s - 304.35s |  And then we're going to talk about the what, the when,
304.35s - 305.19s |  the who.
305.19s - 308.55s |  When you do an investigation, what the hell happened?
308.55s - 309.91s |  When did it happen?
309.91s - 310.87s |  And who was involved?
310.87s - 312.27s |  Tell me all the entities that are involved.
312.27s - 313.59s |  Tell me what the hell happened.
313.63s - 315.23s |  If you can do that with models, that's fantastic.
315.23s - 318.63s |  If you can't, I mean, do it anyways.
318.63s - 320.59s |  Do it the hard way, you know?
320.59s - 321.87s |  And then we're going to go through some examples.
321.87s - 325.35s |  And I don't know why I put QA at the end.
325.35s - 328.71s |  If you have questions, by all means, shout it out.
328.71s - 329.59s |  I'm being serious.
329.59s - 330.83s |  Shout it out.
330.83s - 333.31s |  If you're so polite you cannot do that, just raise your hand.
333.31s - 334.67s |  I will stop whatever the hell I'm saying,
334.67s - 335.91s |  and I'll take your question.
335.91s - 337.11s |  That's my promise.
337.11s - 337.99s |  All right.
337.99s - 338.59s |  Who the hell am I?
338.59s - 340.15s |  I'm a data scientist.
340.15s - 342.11s |  I used to be a data scientist at the SOC,
342.15s - 344.51s |  Royal Bank of Canada, Hawaii Horn Cyber Defense,
344.51s - 346.03s |  Forescout, a bunch of others.
346.03s - 347.99s |  But essentially, I'm a nerd,
347.99s - 351.91s |  and I do data science for the SOC.
351.91s - 353.39s |  What's the problem with cybersecurity?
353.39s - 355.59s |  Why does every year we have essentially
355.59s - 356.71s |  a much bigger problem?
358.03s - 361.39s |  I remember I did this similar talk about a year ago,
361.39s - 362.83s |  and I was talking about Colonial Pipeline.
362.83s - 364.39s |  This year I'm talking about CrowdStrike.
364.39s - 366.71s |  Every year there's something that's way worse, right?
366.71s - 369.15s |  So why do things keep on getting worse?
369.15s - 370.75s |  And maybe CrowdStrike is not the best,
370.79s - 373.79s |  but the other ones are not as popular.
373.79s - 376.63s |  CrowdStrike seems to be popular this time around.
376.63s - 380.31s |  But essentially, attacks seem to be a lot stealthier, right?
380.31s - 382.23s |  And the folks here that work at Blue Team,
382.23s - 383.87s |  they know the job is not very easy.
383.87s - 386.51s |  They came up here because there was AI,
386.51s - 388.19s |  and there was SOC, and they were like, fuck yeah.
388.19s - 390.11s |  Somebody's gonna automate my job?
390.11s - 390.95s |  Fuck yeah.
390.95s - 391.91s |  Automate it, man.
391.91s - 393.91s |  I wanna get another one.
393.91s - 395.87s |  Nobody really likes their job in the SOC
395.87s - 397.95s |  because attacks are so fucking stealthy,
397.95s - 399.71s |  and they grow stealthier every year.
399.71s - 400.59s |  And guess what?
400.59s - 402.99s |  You take the fall because you're the SOC, right?
404.15s - 406.11s |  And because you're the SOC, you also have,
406.11s - 407.35s |  I don't know how many alerts a day.
407.35s - 409.11s |  I stopped updating that number,
409.11s - 410.51s |  but that number keeps on increasing.
410.51s - 411.83s |  But it doesn't matter,
411.83s - 412.87s |  because at the end of the day as a human,
412.87s - 415.55s |  you can only look at maybe like 20 tickets a day, right?
415.55s - 416.79s |  10 tickets.
416.79s - 419.07s |  Anybody here looks at 20 or more?
420.31s - 421.15s |  Yeah.
421.15s - 423.27s |  There's one guy who's probably a fucking genius.
423.27s - 424.43s |  He can look at more than 20.
424.43s - 428.35s |  I actually blank out after five tickets.
428.35s - 429.51s |  I used to work at the SOC.
429.51s - 431.99s |  Like after five tickets, everything sounds the same.
431.99s - 432.83s |  You know, I just like,
432.83s - 436.03s |  I wanna get by and my boss had this weird KPI of,
436.03s - 441.03s |  you know, MTTD, MTTR, whatever bullshit.
441.03s - 443.27s |  And it essentially just meant do it fast.
443.27s - 444.63s |  No one cares.
444.63s - 446.55s |  And they just did everything fast as you know,
446.55s - 449.59s |  like false positive, false positive, false positive.
449.59s - 450.79s |  Right?
450.79s - 451.67s |  You don't want it fast, man.
451.67s - 453.15s |  Sure, I'll get it to you.
453.15s - 455.59s |  I'll get it in 20 seconds if I have to.
455.59s - 458.71s |  But we have so many tools.
458.71s - 460.99s |  I was telling you about Black Hat, terrible experience.
460.99s - 462.71s |  There's like a shit ton of tools everywhere.
462.71s - 463.67s |  Vendors are everywhere.
463.67s - 466.23s |  Can't even find non-vendors anymore.
466.23s - 468.03s |  But there's a lot of vendors.
468.03s - 469.27s |  There's a lot of tools.
469.27s - 471.47s |  And somehow security is worse.
471.47s - 472.51s |  How did that work?
472.51s - 473.35s |  I don't know.
474.75s - 475.59s |  Right?
486.12s - 488.00s |  100%, 100%.
488.00s - 489.28s |  You're on top of it.
489.96s - 491.92s |  Give this man a cookie, right?
491.92s - 493.72s |  You're on top of it.
493.72s - 496.69s |  It's a lot.
496.69s - 497.53s |  Hell yeah.
498.49s - 501.57s |  At 5 p.m. everybody wants a Red Bull, right?
501.57s - 503.49s |  But yeah, we have a lot of tools.
503.49s - 504.41s |  We have a lot of alerts.
504.41s - 505.45s |  We have a lot of shit.
505.45s - 508.61s |  And it's all up to not acquiring more.
508.61s - 511.61s |  It's up to people and process, not technology anymore.
528.99s - 534.45s |  Yeah, that's also presuming that over that three to four year
534.45s - 537.73s |  cycle, you have the same staff and personnel manning your sock.
537.73s - 539.53s |  Let's not forget about turnover, eh?
540.57s - 541.41s |  Yeah.
547.19s - 548.99s |  Dude, I'd fucking buy you a beer tonight.
548.99s - 551.71s |  Like, you know what's up and you speak it out.
551.71s - 552.91s |  Like, I fucking love you, man.
552.91s - 554.15s |  Like, that's what's up.
554.15s - 556.67s |  So, hell yeah.
559.59s - 560.43s |  Hell yeah.
560.43s - 561.75s |  Yep, we need some of that.
561.75s - 562.59s |  We need some of that.
562.59s - 564.55s |  A lot of people are, you know.
564.55s - 565.39s |  I mean.
577.60s - 580.08s |  He was post-breach, though, yeah.
580.08s - 580.92s |  He's post-breach.
580.92s - 584.64s |  He came in to clean up, but dude, I was in fucking,
584.64s - 586.24s |  I was in that fucking data set.
586.24s - 589.52s |  I'm not, yep, yep.
589.52s - 591.96s |  Well, yeah, the funny part is, I was actually,
591.96s - 594.96s |  when that happened, I had started my career in cyber
594.96s - 596.80s |  having left military SIGINT.
596.80s - 598.96s |  So, I was working at a MSSP,
598.96s - 601.28s |  which had a lot of Government of Canada clients.
601.28s - 603.76s |  And so, the funny thing was in that breach list,
604.16s - 606.56s |  there was a lot of at Canada dot C addresses.
606.56s - 608.52s |  So, what a lot of people were doing,
608.52s - 610.00s |  cheating on their spouses,
610.00s - 612.56s |  were actually using their government email accounts,
612.56s - 614.56s |  their government work email accounts,
614.56s - 617.76s |  to get a platform or to get a profile on the site.
617.76s - 619.20s |  But then when they got popped,
619.20s - 621.64s |  not only was it an issue in terms of their spouse,
621.64s - 624.24s |  but now their employer was pretty pissed off at them.
624.24s - 641.40s |  And just saying, hey, that's Bitcoin.
641.40s - 642.24s |  Yep.
642.24s - 643.76s |  Well, there's been multiple.
643.76s - 646.47s |  Multi-extortion.
646.47s - 647.95s |  The funny thing is about that,
648.15s - 649.51s |  I don't want to derail this talk,
649.51s - 652.67s |  but like, the funny thing about that is to this day,
652.67s - 655.11s |  I mean, they use that old list
655.11s - 657.11s |  because Troy Hunt posted it, right?
657.11s - 660.43s |  So, everyone uses that list and tries to act like
660.43s - 663.39s |  it's a new breach info or a new credential to pop off,
663.39s - 665.71s |  but it's like still the 2015 credential.
665.71s - 668.71s |  That person's moved on from the site well beyond,
668.71s - 672.11s |  but they're still trying to run attempts on the old creds.
672.11s - 675.67s |  So, I think it's just, it's a taboo thing.
676.67s - 677.75s |  Everyone's been popped.
677.75s - 679.35s |  SolarWinds been popped.
679.35s - 681.51s |  Like British Airways has been popped.
681.51s - 683.23s |  How many countless breaches have happened
683.23s - 684.91s |  of major enterprises?
684.91s - 686.87s |  Yeah, those are the ones we're talking about.
686.87s - 688.15s |  Those are the ones we know about.
688.15s - 689.51s |  Yeah.
689.51s - 691.11s |  It's just cause it's got,
691.11s - 693.95s |  it has to do with sex and everyone thinks it's taboo.
697.91s - 698.75s |  Yep.
700.75s - 704.79s |  Hell yeah.
704.79s - 706.39s |  I appreciate your service, sir.
707.39s - 711.65s |  But yeah, I mean, I can turn this into a SkyTalk
711.65s - 713.89s |  and we can start ranting, you know, like,
713.89s - 715.93s |  I can fucking rant.
715.93s - 716.77s |  No, no, no.
716.77s - 717.61s |  I'm-
717.61s - 719.33s |  Is this turning into sock therapy?
719.33s - 720.81s |  Sock therapy is valid too.
720.81s - 722.13s |  Look up my fucking agenda, bro.
722.13s - 723.13s |  It's like all SkyTalk.
723.13s - 724.17s |  It's all ranting.
724.17s - 725.37s |  Like the machine learning is like,
725.37s - 726.77s |  you know, number 5.8.
728.77s - 729.93s |  I'm all about the rant, bro.
729.93s - 732.21s |  Like that's, it's the use case, right?
732.21s - 735.61s |  It's like, what's broken and how do we fix it, right?
735.61s - 736.93s |  But yeah.
737.53s - 738.77s |  But yeah, you're on top of it.
738.77s - 742.13s |  Like too many tools, too many rules, too many playbooks,
742.13s - 743.93s |  too many whatever the fuck you want to call them.
743.93s - 746.65s |  It's just searches, lookups, right?
746.65s - 749.53s |  And who has to tune those?
749.53s - 750.77s |  The people in the process.
750.77s - 752.53s |  But we don't want to buy those.
752.53s - 753.49s |  We want to buy the technology.
753.49s - 755.05s |  So we want to buy the sexiest shit
755.05s - 756.97s |  and we want to install the sexiest shit.
756.97s - 757.81s |  Do we have the right people
757.81s - 759.01s |  in process for that technology?
759.01s - 760.17s |  Nope.
760.17s - 761.01s |  Do we care?
761.01s - 761.85s |  Nope.
761.85s - 764.69s |  We care about AI because I'm a new leader
764.69s - 766.49s |  and I want to put AI in my company
767.49s - 769.69s |  and you guys deal with it until you stop dealing with it
769.69s - 771.89s |  and the company's fucked and now I leave
771.89s - 773.77s |  and they get the new guys, right?
774.89s - 777.49s |  So it's just so bloated and ineffective
777.49s - 779.13s |  for a variety of reasons.
779.13s - 781.05s |  Most of these reasons are not technology.
781.05s - 783.61s |  Most of these reasons are people in process.
783.61s - 785.73s |  And since I baited you all with AI,
785.73s - 788.37s |  I will give you a lot more people in process today.
788.37s - 790.73s |  So what the hell is wrong with our security?
790.73s - 794.09s |  Why is it so less secure than what it was 50 years ago?
794.09s - 795.57s |  Well, the naive way to think about this
795.65s - 797.33s |  is it used to be so simple.
797.33s - 798.65s |  It's not even apples to apples.
798.65s - 800.21s |  It used to be so fucking simple.
800.21s - 802.45s |  Now it's so fucking complicated, right?
802.45s - 804.25s |  And to hack Stuxnet,
804.25s - 808.45s |  you had a virus circulate the entire world for two years.
808.45s - 810.21s |  Finally, someone picked it up on a USB,
810.21s - 812.53s |  put it in the printer to print an assignment for their kid
812.53s - 813.97s |  and boom, bada boom, right?
813.97s - 817.65s |  But in reality, if you want to do Stuxnet today,
817.65s - 819.13s |  there's like a smart grid.
819.13s - 820.81s |  There's like people selling solar power
820.81s - 822.09s |  back to the nuclear plant
822.09s - 824.05s |  and some bullshit like that on the smart grid
824.09s - 826.65s |  where technically everything is connected
826.65s - 830.25s |  and the attack surface is like so much easier.
830.25s - 832.05s |  What do you mean we have to wait for two years
832.05s - 833.65s |  for someone to put it on a USB?
833.65s - 835.29s |  Not anymore.
835.29s - 839.77s |  So this is essentially why everybody here is so vibing
839.77s - 842.13s |  when we are complaining
842.13s - 846.25s |  because we are constantly waiting for that talk at DEF CON
846.25s - 848.01s |  that will come and automate our jobs
848.01s - 850.61s |  and take it away from us so that we can do something else.
850.61s - 851.61s |  We don't want to be analysts.
851.61s - 852.65s |  We want to be engineers.
852.65s - 853.61s |  We want to be architects.
853.61s - 854.89s |  We want to be cloud folks.
854.89s - 857.53s |  Fuck it, we want to be compliance folks if we have to.
857.53s - 858.37s |  Any...
859.89s - 861.45s |  No hate on the compliance folks,
863.17s - 864.25s |  but essentially like we can,
864.25s - 865.61s |  I could be a freaking salesperson
865.61s - 866.81s |  instead of being a SOC analyst.
866.81s - 868.69s |  You know, like it's shit,
868.69s - 871.81s |  but what does it take for a SOC analyst?
871.81s - 873.77s |  What is actually so hard?
873.77s - 876.77s |  And the expensive folks at SANS,
876.77s - 878.61s |  they run a SOC survey
878.61s - 881.25s |  and in the SOC survey for the last six, seven years,
881.25s - 882.41s |  it's always been the same shit.
882.41s - 884.81s |  People go and they vote on what's the thing
884.81s - 885.81s |  they hate the most,
885.81s - 887.69s |  what the thing essentially is
887.69s - 890.13s |  we're going to all hang our trouble on.
890.13s - 892.01s |  And it's always, always, always lack of
892.01s - 895.49s |  quote, quote, beautiful, sweet correlation.
895.49s - 897.77s |  What the hell is correlation?
897.77s - 899.49s |  I don't know if someone knows what that is correlation,
899.49s - 900.65s |  but essentially just says like,
900.65s - 902.33s |  what that is relevant to what?
902.33s - 903.97s |  And it's like so ambiguous
903.97s - 907.09s |  that people can sell you what they call correlation searches
907.09s - 908.57s |  if it's looking for like two things
908.57s - 909.97s |  that it's going to put together
910.01s - 912.49s |  if they fit a specific rule, right?
913.69s - 915.09s |  But that's all good
916.37s - 918.61s |  if you have all of your data in one place.
919.57s - 922.41s |  How many people here have everything they need in the SIM?
924.65s - 925.97s |  Yes.
925.97s - 927.37s |  Nobody, right?
927.37s - 928.21s |  Which one?
928.21s - 929.05s |  Yes.
929.05s - 930.61s |  Do you want the Splunk or the Elastic or the S3 bucket?
930.61s - 932.21s |  Like which one do you want, bro?
933.53s - 934.37s |  Damn.
934.37s - 935.21s |  Okay. Which index?
935.21s - 936.05s |  Which silo on it?
936.05s - 936.89s |  Okay.
937.85s - 938.85s |  Yeah.
938.85s - 941.55s |  Yeah.
942.59s - 943.43s |  I have a sock for insider threat.
943.43s - 944.51s |  I have a sock for this guy.
944.51s - 945.87s |  I have a sock for the NERC SIP.
945.87s - 947.23s |  I have a sock for whatever.
947.23s - 949.47s |  I have a sock at the company we bought.
949.47s - 951.03s |  It's not technically part of our company,
951.03s - 952.59s |  but it's, you know, it's a sub-organization.
952.59s - 953.99s |  It's like another entity that we bought.
953.99s - 956.15s |  They have their own sock and they don't give us the shit.
956.15s - 958.15s |  We have a sock that works part of a NOC.
958.15s - 959.87s |  We have a sock that's called Data Fusion
959.87s - 961.07s |  that the new leader made.
961.07s - 962.87s |  You know, I know what's up.
962.87s - 967.51s |  So if we don't have all the data in one place,
967.51s - 969.75s |  can we put all the data in one place?
969.79s - 972.27s |  Wouldn't that be a pretty nice process, right?
972.27s - 974.63s |  Like let's get as much data in one place.
974.63s - 976.15s |  And then we start talking about money.
976.15s - 978.87s |  Like, dude, it costs a shit ton to get it into one place.
978.87s - 981.35s |  And by the way, to get it in one place,
981.35s - 983.23s |  I have to put everything in one data model.
983.23s - 984.83s |  I have to make sure I have the right, you know,
984.83s - 986.71s |  parsers or whatnot.
986.71s - 987.83s |  It's 2024.
988.71s - 991.07s |  LLMs can actually make you, like,
991.07s - 993.39s |  any kind of data model into any other data model.
993.39s - 994.75s |  So we have an open source thing.
994.75s - 996.47s |  If you go to GitHub Sapienta,
996.47s - 999.35s |  we get anything in any data model put into one data model.
999.35s - 1000.91s |  And it's also 2024.
1000.91s - 1002.43s |  Storage is so fucking cheap.
1002.43s - 1004.79s |  I don't know why do you have to put it into a SIM,
1004.79s - 1007.19s |  put it into a fucking S3 bucket as a cold archive.
1007.19s - 1008.47s |  It's cheap enough.
1008.47s - 1010.23s |  If you can get it all there
1010.23s - 1012.83s |  and you can fight the people to get it all there
1012.83s - 1015.07s |  and you can call everybody and get the right data,
1015.07s - 1017.63s |  you can have the dream kind of thing
1017.63s - 1019.27s |  where you have everything in one S3.
1019.27s - 1021.63s |  If you don't get the entire dream, that's fine.
1021.63s - 1023.31s |  If you can get like 70% of that dream,
1023.31s - 1025.83s |  get just like everything into like a cheap storage
1025.83s - 1027.79s |  and a cloud, that'll be fantastic.
1027.79s - 1029.59s |  Because if you have everything in one place,
1029.59s - 1031.71s |  ideally in dreamland,
1032.71s - 1034.91s |  and you can pull it off without wasting a lot of money
1034.91s - 1035.75s |  or asking for budget,
1035.75s - 1036.75s |  just put it in cloud,
1036.75s - 1039.31s |  cost 20 cents a terabyte or something like that, right?
1039.31s - 1040.91s |  On S3.
1040.91s - 1043.87s |  You can essentially have almost everything you need
1043.87s - 1047.27s |  to run these kind of queries, right?
1047.27s - 1049.19s |  Because what do we have in the SOC today?
1049.19s - 1050.39s |  It's 2024.
1050.39s - 1053.87s |  We have the same shit that we used to do before I was born,
1053.87s - 1055.31s |  queries and playbooks.
1055.31s - 1056.83s |  Why?
1056.83s - 1058.43s |  We can trust that shit, right?
1058.43s - 1059.51s |  We can trust it.
1059.51s - 1060.63s |  It's explainable.
1060.63s - 1061.47s |  It's adaptable.
1061.47s - 1062.39s |  It's customizable.
1062.39s - 1063.23s |  It's transparent.
1063.23s - 1067.01s |  Yes.
1079.63s - 1080.47s |  That's true.
1080.47s - 1081.31s |  That's true.
1081.31s - 1082.15s |  A lot of the insider threat data
1082.15s - 1083.55s |  could not be given to the SOC.
1083.55s - 1084.63s |  It's PIIs.
1084.63s - 1085.47s |  Yeah.
1085.47s - 1087.27s |  The risk compliance people
1087.27s - 1089.23s |  are not gonna let you have your insider threat data there.
1089.23s - 1090.95s |  If you have UEBA, they're not gonna let you have it.
1090.95s - 1092.79s |  If you have endpoints or emails
1092.79s - 1094.67s |  or stuff from Outlook or whatnot, nope.
1094.67s - 1096.71s |  You're not gonna have that in the SOC, no way.
1096.71s - 1098.83s |  But if we can get as close as possible,
1099.75s - 1101.23s |  we can get something there.
1101.23s - 1103.59s |  And the point is we use queries and playbooks
1103.59s - 1106.19s |  because I can fucking trust that shit.
1106.19s - 1107.07s |  Like I trust it.
1107.07s - 1107.91s |  I can see it.
1107.91s - 1108.75s |  I can read the rule.
1108.75s - 1109.83s |  Look at how nice it is.
1109.83s - 1110.91s |  It's so open.
1110.91s - 1112.03s |  It's so transparent.
1112.03s - 1113.51s |  It's so nice.
1113.51s - 1115.35s |  I can actually read that shit.
1115.35s - 1117.15s |  I fully understand when it triggers.
1117.15s - 1120.23s |  It triggers when it finds these kind of stuff in the query.
1120.23s - 1122.91s |  Command, all kinds of commands in my web shell traffic
1122.91s - 1125.95s |  or in my web traffic in general as a post,
1125.95s - 1126.83s |  that's when it triggers.
1126.83s - 1127.99s |  I completely understand that.
1128.03s - 1129.27s |  Can you say that about an LLM?
1129.27s - 1130.47s |  Hell no.
1130.47s - 1132.59s |  How many people here are using anomaly detector?
1132.59s - 1134.27s |  Anomaly detection, UEBA?
1135.51s - 1136.35s |  Two people.
1136.35s - 1138.03s |  It's 2024, right?
1138.03s - 1139.07s |  Like five years ago,
1139.07s - 1142.19s |  a shit ton of people put their money on UEBA, right?
1142.19s - 1143.23s |  What's wrong with UEBA?
1143.23s - 1144.07s |  Why don't you use it?
1144.07s - 1144.91s |  Why do you use it?
1144.91s - 1155.92s |  What do you hate about it if you use it?
1155.92s - 1157.16s |  Oh.
1157.16s - 1158.00s |  It works.
1158.00s - 1161.32s |  If you say this is gonna give me everything I don't see
1161.32s - 1164.70s |  and all that's going to be broken.
1164.70s - 1167.10s |  I'm definitely buying you a beer tonight.
1167.14s - 1168.66s |  Bye.
1168.66s - 1169.50s |  Sorry, go ahead.
1170.82s - 1173.22s |  Yeah, yeah, 100%, come up.
1173.22s - 1174.74s |  Hell yeah, come up.
1174.74s - 1175.58s |  Woo-hoo.
1178.68s - 1179.52s |  Can you give us a quick intro?
1179.52s - 1181.00s |  Can we get the third mic running?
1181.00s - 1181.84s |  My dude.
1186.64s - 1187.68s |  Thank you.
1187.68s - 1189.04s |  Oh.
1189.04s - 1189.88s |  All good.
1189.88s - 1190.72s |  Sweet.
1190.72s - 1191.56s |  Thank you for coming up.
1192.60s - 1194.04s |  By popular choice.
1194.04s - 1195.56s |  The people's choice panelist.
1196.88s - 1197.72s |  My name's Walt.
1197.72s - 1199.36s |  I'm a 15 year schmo.
1199.44s - 1204.44s |  I'm in cyber defense working for the man.
1208.62s - 1209.82s |  And-
1209.82s - 1211.02s |  Uncle Sam?
1211.02s - 1211.86s |  That man, yeah.
1213.30s - 1214.18s |  I love that man.
1215.14s - 1220.14s |  But, and I started as a sock analyst
1220.22s - 1224.26s |  and I'm somewhere between senior sock analyst
1224.26s - 1227.98s |  and the guy in the office who does ML
1227.98s - 1230.22s |  and plays with the Splunk models
1230.74s - 1233.74s |  and tries to build the dashboards.
1233.74s - 1234.58s |  Oh yeah.
1235.54s - 1238.82s |  That's, and yeah, I'm loud and over opinionated.
1238.82s - 1242.82s |  I mean, yeah, yeah.
1242.82s - 1244.50s |  I hear you.
1244.50s - 1246.14s |  There's a lot of stuff that you didn't say
1246.14s - 1247.58s |  that, you know, I can feel it.
1247.58s - 1248.42s |  I was in the sock.
1248.42s - 1249.78s |  I was using Splunk.
1249.78s - 1252.70s |  I used MLTK, DSDL, all that good shit, eh?
1252.70s - 1253.54s |  What was that?
1253.54s - 1255.62s |  MLTK, machine learning toolkit.
1255.62s - 1256.46s |  Oh yes.
1256.46s - 1257.30s |  Deep science.
1257.30s - 1259.18s |  MLTK, I like it.
1259.18s - 1263.22s |  It works nicely for something that's embedded.
1263.22s - 1264.98s |  I haven't played with elastics
1264.98s - 1267.50s |  embedded machine learning that much yet.
1268.90s - 1270.22s |  I can do some stuff in scikit.
1270.22s - 1274.50s |  I have done stuff in scikit-learn.
1274.50s - 1276.10s |  I have a master's.
1276.10s - 1277.10s |  Nice.
1277.10s - 1278.74s |  I got it last year.
1278.74s - 1282.30s |  Oh, all fresh with all the data science.
1282.30s - 1286.98s |  Hey, and it's, I went there because there was a need.
1286.98s - 1287.82s |  Hell yeah.
1287.82s - 1290.38s |  Somebody has to be able to sit there and say,
1290.38s - 1293.42s |  the machine learning works for the use case
1293.42s - 1295.50s |  and don't buy the black box.
1295.50s - 1296.50s |  Hell yeah.
1296.50s - 1297.98s |  That's my role in the office.
1297.98s - 1298.82s |  Yes.
1298.82s - 1300.98s |  If they ask me if this actually makes sense,
1300.98s - 1302.94s |  then I figure out a way to use it.
1302.94s - 1303.78s |  That's amazing.
1303.78s - 1304.62s |  It's like taking my life
1304.62s - 1307.62s |  and just making it a lot more full of experience
1307.62s - 1309.30s |  kind of thing, you know?
1309.30s - 1311.30s |  Like I worked like a couple of years in the sock
1311.30s - 1313.38s |  and then I went into a PhD
1313.38s - 1315.78s |  to solve some issues in the sock.
1315.78s - 1318.34s |  You essentially worked a lot more in the sock,
1318.34s - 1319.66s |  saw a lot more bullshit.
1319.66s - 1322.14s |  So yeah, I'm going to refer a lot back to you.
1322.14s - 1323.58s |  If you have anything to say, just-
1323.58s - 1324.42s |  No worries.
1324.42s - 1325.26s |  Boom, right away.
1325.26s - 1326.90s |  I don't have to prompt you.
1326.90s - 1327.74s |  I'll just go for it.
1327.74s - 1329.74s |  Unfortunately, my daughter is now cringing.
1329.74s - 1330.58s |  Oh yes.
1330.58s - 1333.90s |  Right?
1333.90s - 1335.10s |  Yeah, I mean, you made it to the con.
1335.10s - 1336.06s |  What did you think?
1339.06s - 1339.90s |  All right.
1339.90s - 1341.74s |  So back to the discussion,
1341.74s - 1346.34s |  we love rules because they're understandable.
1346.34s - 1347.38s |  They're transparent.
1347.38s - 1348.34s |  I can customize them.
1348.34s - 1349.90s |  I can fucking give them feedback
1349.90s - 1351.46s |  and they can do whatever I want them to do.
1351.46s - 1352.70s |  I trust them.
1352.70s - 1355.30s |  I will never get fired without understanding why.
1356.18s - 1357.02s |  AI?
1357.02s - 1360.30s |  I'll get fired and I will be like, why?
1361.46s - 1362.58s |  Why did it not work?
1362.58s - 1365.22s |  The vendor told me it will work, right?
1365.22s - 1367.82s |  So anyways, rules are pretty nice.
1367.82s - 1370.22s |  Have you guys ever seen investigative playbooks?
1371.18s - 1372.02s |  Anybody know what that is?
1372.02s - 1373.30s |  An investigative playbook?
1373.30s - 1374.14s |  Okay.
1374.14s - 1376.66s |  So an investigative playbook is a fancy way to say,
1376.66s - 1378.98s |  you know, I have a bunch of searches
1378.98s - 1380.82s |  that go back to back to back to back.
1380.82s - 1383.26s |  And if they're within five minutes of each other,
1383.26s - 1385.74s |  they come all together within a ticket.
1385.74s - 1386.58s |  That's pretty much it.
1386.58s - 1390.18s |  It's like security analytics stories from Splunk.
1390.18s - 1393.50s |  In Splunk, they also now have the risk-based alerting.
1393.50s - 1396.94s |  Essentially just means like if something is scored
1396.94s - 1398.10s |  like five out of 10 risk,
1398.10s - 1399.50s |  and another thing is five out of 10 risk,
1399.54s - 1400.70s |  and they happen within five minutes,
1400.70s - 1402.50s |  boom, it's 10 out of 10 risk for both of them,
1402.50s - 1404.50s |  put them together in a ticket and tell me.
1404.50s - 1405.90s |  But essentially all of these nice things
1405.90s - 1408.94s |  are rules on top of rules on top of rules.
1408.94s - 1412.98s |  And every year, although it's 2020 fucking four,
1412.98s - 1417.82s |  we get new ways to apply rules as if we're in the 60s.
1417.82s - 1420.98s |  Why the hell are we not using any more like things
1420.98s - 1424.70s |  other than rules and solid, narrow logic?
1424.70s - 1426.26s |  Because we can not trust it.
1426.26s - 1427.10s |  Okay.
1427.98s - 1429.90s |  So what do we like so much about our rules?
1429.90s - 1431.02s |  What makes us trust them?
1431.02s - 1433.86s |  Well, I can also map them to MITRE ATT&CK techniques.
1433.86s - 1436.42s |  Anybody here, I'll ask this question one more time
1436.42s - 1439.50s |  just to, anybody here does not know what's MITRE ATT&CK,
1439.50s - 1441.14s |  and I will go through it quickly.
1442.14s - 1443.66s |  Okay, let's go through it quickly.
1443.66s - 1447.54s |  So MITRE ATT&CK is essentially a way to say what happened
1447.54s - 1450.10s |  when we talk about the what, the who, the when.
1450.10s - 1454.54s |  If I tell you, oh, this vendor says this thing happened,
1454.54s - 1455.98s |  and you don't have a common reference
1456.22s - 1457.54s |  for what the hell is this thing,
1457.54s - 1460.26s |  you don't really fully understand what is it.
1460.26s - 1462.38s |  And a lot of the people in this industry
1462.38s - 1465.90s |  are so scared to ask or say that they don't know.
1465.90s - 1468.18s |  So nobody actually figures out
1468.18s - 1469.38s |  what the hell are they talking about.
1469.38s - 1471.74s |  And they just keep on going and they never ask,
1471.74s - 1472.82s |  dude, I didn't understand that.
1472.82s - 1474.30s |  I don't know what's going on.
1474.30s - 1475.98s |  And just keep on going, right?
1475.98s - 1478.74s |  Everybody acts like, you know, they know it all.
1478.74s - 1480.18s |  And nobody wants to be, you know,
1480.18s - 1482.30s |  like the only person that asked the question.
1482.30s - 1484.86s |  But anyways, MITRE ATT&CK is solving that
1484.86s - 1486.58s |  as a big Wikipedia.
1486.58s - 1490.10s |  And this Wikipedia is essentially full of techniques.
1490.10s - 1492.62s |  And every technique has a procedural example.
1492.62s - 1493.86s |  It tells you how to detect it,
1493.86s - 1495.62s |  how to mitigate it and whatnot.
1495.62s - 1497.82s |  And one neat thing about MITRE is essentially
1497.82s - 1501.26s |  in MITRE ATT&CK, you can see that going left to right,
1501.26s - 1502.66s |  you're actually going sequentially.
1502.66s - 1504.42s |  So there is causality going left to right.
1504.42s - 1505.82s |  Damn, I lost my light.
1505.82s - 1507.42s |  Was that me by any chance?
1507.42s - 1508.50s |  That wasn't me, right?
1509.62s - 1510.46s |  No worries.
1510.46s - 1511.30s |  You guys can still see me.
1511.30s - 1513.98s |  I don't need a humongous light bulb in my face.
1513.98s - 1517.74s |  But going left to right, like you start at initial access.
1517.74s - 1519.38s |  So this is when I send you like an email
1519.38s - 1521.62s |  and tell you, yo, what's up?
1521.62s - 1524.02s |  You won a hundred million Bitcoins.
1524.02s - 1524.86s |  Click here.
1525.94s - 1528.46s |  And then once you click here, a bunch of shit happens,
1528.46s - 1530.58s |  including like execution, persistence,
1530.58s - 1533.90s |  privilege escalation, you know, the whole thing
1533.90s - 1535.42s |  until you end up at impact, right?
1535.42s - 1537.02s |  You end up with some sort of like ransom.
1537.02s - 1538.46s |  Now I'm extorting you.
1538.46s - 1539.50s |  You end up, maybe it was like
1539.50s - 1540.66s |  some sort of command and control.
1540.66s - 1542.90s |  Now we have something that keeps on moving your mouse
1542.90s - 1544.90s |  or something like that, right?
1544.90s - 1546.78s |  Okay, so that's the fun stuff at MITRE.
1546.78s - 1549.38s |  One more fun thing at MITRE.
1549.38s - 1553.02s |  At the SOC, we are always talking about single alerts,
1553.02s - 1556.58s |  single isolated, disjointed, siloed alerts.
1556.58s - 1559.94s |  And these are not how people talk about incidents.
1559.94s - 1561.70s |  If anybody here can talk about an incident,
1561.70s - 1562.62s |  that would be nice.
1562.62s - 1563.82s |  I don't mean to pick on you guys,
1563.82s - 1565.98s |  but can you share a single incident
1565.98s - 1568.30s |  that was like a full investigation, like end to end?
1568.30s - 1570.34s |  I know George might share one.
1570.34s - 1571.54s |  He kind of prepared one.
1572.54s - 1574.30s |  Or if you can go for it as well.
1574.30s - 1576.18s |  Whoever wants to go for like a full investigation,
1576.18s - 1578.06s |  like some sort of an APT that you can share,
1578.06s - 1578.90s |  some sort of like-
1578.90s - 1581.70s |  Yeah, APTs I can't share.
1581.70s - 1582.54s |  Right.
1582.54s - 1584.18s |  I can't share APTs, sorry.
1584.18s - 1585.78s |  The only thing I can share,
1585.78s - 1587.74s |  and you kind of saw or heard earlier.
1587.74s - 1589.30s |  Yeah, he's probably the only guy that will share
1589.30s - 1592.26s |  because DOD, DOD, so, you know.
1592.26s - 1594.58s |  This is fine because it happened years ago
1594.58s - 1597.46s |  and we weren't like told we had to be classified about it,
1597.46s - 1600.86s |  but like beyond the details of it.
1600.90s - 1604.66s |  But basically we had stopped at my previous employer,
1604.66s - 1607.62s |  a series of persistent DDoS attacks
1607.62s - 1609.54s |  that the campaign ran for,
1609.54s - 1612.50s |  I would say arguably about maybe almost two weeks.
1612.50s - 1614.30s |  And every day we were getting progressively worse
1614.30s - 1615.86s |  and worse attempts at us.
1615.86s - 1618.18s |  We were getting like higher and higher ping rates.
1618.18s - 1621.98s |  And so it was really crippling the latency
1621.98s - 1624.58s |  of our entire organization, our ability to work.
1625.74s - 1628.94s |  Eventually we were able to kind of change
1628.94s - 1629.82s |  rate limiting rules.
1629.82s - 1631.54s |  We were able to change certain configurations
1631.54s - 1633.14s |  within the infrastructure that allowed us
1633.14s - 1636.34s |  to retain traffic flow once again.
1636.34s - 1640.22s |  And suddenly we found that the attacks had stopped
1640.22s - 1642.66s |  and we didn't really know what happened.
1644.30s - 1646.94s |  We got a weird call, because I'm Canadian.
1646.94s - 1649.98s |  We had a weird call about, I'd say 12 days later
1649.98s - 1652.14s |  from our public safety department,
1652.14s - 1654.18s |  which is kind of like our department
1654.18s - 1656.10s |  that has all the intelligence agencies.
1656.10s - 1658.74s |  And so folks from our CSIS,
1658.74s - 1662.34s |  which is like our CIA, came up and told us,
1662.34s - 1663.90s |  and they sat us down for a briefing
1663.90s - 1665.66s |  with our senior executives,
1665.66s - 1669.66s |  that we were actually, we were attacked by Fancy Bear.
1669.66s - 1672.90s |  And we'd actually repelled the attack by Fancy Bear,
1672.90s - 1674.50s |  which was fucking wild.
1677.18s - 1679.62s |  But really what they were trying to do
1679.62s - 1681.54s |  is they were trying to take down the ability
1681.54s - 1683.10s |  of our organization to operate,
1683.10s - 1685.46s |  because we were helping with research
1685.46s - 1687.62s |  for missile targeting systems
1687.62s - 1689.98s |  and other kind of modern technology
1689.98s - 1693.10s |  that the Canadian Armed Forces was developing.
1693.10s - 1695.58s |  Unfortunately, they weren't, well, fortunately for us,
1695.58s - 1698.02s |  but unfortunately for them, they weren't successful.
1698.02s - 1700.46s |  But what was amazing to me was that for us,
1700.46s - 1702.18s |  we just cut to the fundamentals
1702.18s - 1704.10s |  of how to repel a DDoS attack,
1706.02s - 1708.06s |  where we didn't know that we were fighting
1708.06s - 1709.78s |  a nation state actor.
1709.78s - 1711.74s |  We didn't know until after the fact,
1711.74s - 1714.02s |  until the government came and told us,
1714.02s - 1716.86s |  this is actually what you were up against.
1716.86s - 1718.98s |  To this day, I'm still actually blown away by that,
1718.98s - 1720.42s |  because we had no clue.
1720.42s - 1723.94s |  To us, it just seemed like a really, really persistent
1723.94s - 1727.22s |  APT group that was just a run-of-the-mill APT group,
1727.22s - 1731.66s |  because it was really just a really annoying DDoS attack
1731.66s - 1734.30s |  that didn't really have any special parameters to it.
1734.30s - 1736.02s |  So I found that kind of fascinating,
1736.02s - 1738.62s |  and I don't really think that's a standard APT for them,
1738.62s - 1742.54s |  because I've seen the old APT32 blogs
1742.54s - 1743.78s |  come out all the time
1743.78s - 1746.70s |  with some of the innovative social engineering tactics
1747.54s - 1748.46s |  that they like to use.
1748.46s - 1749.90s |  But I think on this one,
1749.90s - 1752.14s |  they were just looking at who's part of the supply chain
1752.14s - 1755.02s |  for this project, and let's attack every organization
1755.02s - 1757.22s |  as part of that build for that construction.
1757.22s - 1760.42s |  So it's kind of an interesting kind of outlook,
1760.42s - 1762.06s |  but you have to look at,
1762.06s - 1764.66s |  when you are attacked by a nation state
1764.66s - 1766.82s |  or a large APT actor,
1766.82s - 1768.58s |  you have to look at it from the human level
1768.58s - 1771.26s |  as to why they are trying to attack your organization,
1771.26s - 1773.86s |  and what are the crown jewels they're trying to go after.
1773.86s - 1775.78s |  So if they're trying to just disable your ability
1775.82s - 1777.22s |  to function and operate,
1777.22s - 1778.94s |  that's legitimate means of compromise
1778.94s - 1780.30s |  that they're trying to achieve.
1780.30s - 1782.98s |  If they're trying to steal and exfiltrate data,
1782.98s - 1785.18s |  that operation's probably gonna be more malicious,
1785.18s - 1788.06s |  because they're gonna have to get inside your environment
1788.06s - 1790.14s |  and then move laterally across,
1790.14s - 1791.78s |  probably break access at some point
1791.78s - 1793.74s |  or get some kind of privileged account,
1793.74s - 1796.30s |  and then be able to exfiltrate the data
1796.30s - 1799.02s |  to a C2 somewhere without you noticing.
1799.02s - 1801.46s |  So oftentimes you're gonna deal with like,
1801.46s - 1802.30s |  what's it called?
1807.30s - 1808.14s |  Low and slow?
1808.14s - 1809.10s |  Low and slow, there we go.
1809.10s - 1810.42s |  Low and slow.
1810.42s - 1811.90s |  By the way, for those of you
1811.90s - 1815.54s |  who are playing in machine learning and anomaly detection,
1815.54s - 1817.26s |  anomaly detection is very good
1817.26s - 1819.66s |  at giving you low and slow prospects.
1819.66s - 1820.50s |  Yeah.
1820.50s - 1821.34s |  Yeah.
1821.34s - 1823.62s |  That's been the best use case I've got so far.
1823.62s - 1825.62s |  But they can maintain your presence in your environment
1825.62s - 1827.10s |  for months without you realizing it,
1827.10s - 1827.94s |  if they do it correctly.
1827.94s - 1828.86s |  If they do it correctly,
1828.86s - 1830.30s |  but at the very least,
1830.30s - 1833.06s |  when you're dealing with just trying to find odd traffic
1833.06s - 1835.82s |  that you'll not spot,
1835.82s - 1839.50s |  otherwise, that's the sort of anomaly
1839.50s - 1841.58s |  that you are actually trying to leverage.
1842.42s - 1846.26s |  But most of the people that I know that have UEBA still,
1846.26s - 1848.38s |  but the people that don't have UEBA,
1848.38s - 1849.70s |  they don't have the anomaly detection
1849.70s - 1853.26s |  because they end up dialing it down so much
1853.26s - 1854.62s |  in face of false positives,
1854.62s - 1857.06s |  they miss the slow and stealthy stuff.
1857.06s - 1859.82s |  They only wanna see the extra, extra, extra spicy stuff
1860.26s - 1861.98s |  that the rule can get them.
1861.98s - 1864.34s |  And that mindset's part of the problem.
1864.34s - 1865.42s |  The other thing is,
1866.86s - 1870.18s |  for the really loud, obvious stuff for the fault,
1870.18s - 1872.30s |  which is generates tons of false positives,
1872.30s - 1876.34s |  you should be tuning your inputs
1876.34s - 1879.62s |  to your anomaly detection algorithm beforehand.
1881.46s - 1883.34s |  If I know this,
1883.34s - 1886.34s |  and your analysts should be able to also go through
1886.34s - 1889.30s |  and say, right, here's the ones that are,
1889.30s - 1891.26s |  this traffic I've seen elsewhere,
1892.14s - 1894.94s |  it's loud, this isn't a good prospect because X,
1894.94s - 1896.98s |  and then go to Y.
1896.98s - 1897.82s |  Hell yeah.
1897.82s - 1900.82s |  Yeah, I mean, it goes back to people on process.
1900.82s - 1903.62s |  Like you have anomaly detection there for years,
1903.62s - 1905.94s |  people don't use it because they don't tune it.
1905.94s - 1908.54s |  And when they tune it, they tune it out.
1908.54s - 1911.14s |  They literally just, it's too many false positives,
1911.14s - 1912.62s |  let's just get rid of it.
1912.62s - 1915.42s |  Because if I have all of the slow and stealthy appearing,
1915.42s - 1917.74s |  I have all of the garbage appearing.
1917.74s - 1919.22s |  So it's a trade-off.
1919.98s - 1921.38s |  Do I wanna see all the slow and stealthy,
1921.38s - 1924.46s |  or do I wanna not have a million fucking tickets every day?
1925.98s - 1929.46s |  I think there's another issue of insider threats, right?
1929.46s - 1932.02s |  Two of some of the biggest ones I've seen
1932.02s - 1936.02s |  that I was a part of that organization
1936.02s - 1940.46s |  were people that were either fired or about to quit,
1940.46s - 1942.82s |  and they set up the environment.
1942.82s - 1945.10s |  And if you don't have that detection,
1946.02s - 1949.66s |  and someone's doing this setting up of the environment,
1949.66s - 1953.74s |  and they're starting to have a bunch of scripts execute
1953.74s - 1956.70s |  to create accounts, and get into those accounts,
1956.70s - 1959.50s |  and piggyback on that, and create scripts
1959.50s - 1960.74s |  to start shutting things down,
1960.74s - 1963.46s |  or moving data, whatever it is, or both,
1965.38s - 1967.46s |  you should be able to detect those things
1967.46s - 1968.78s |  before those people depart.
1968.78s - 1970.74s |  That actually brings me up another point.
1970.74s - 1972.58s |  You should really invest in DLP.
1973.58s - 1976.54s |  Data loss prevention is a major issue,
1976.54s - 1978.86s |  and particularly when it comes to insider threat.
1978.86s - 1980.10s |  So I can give you an example.
1980.10s - 1981.18s |  I won't say which employer,
1981.18s - 1983.66s |  but let's say we had to let go of an HR person,
1983.66s - 1987.10s |  and it was a sudden cut financially-based.
1987.10s - 1990.58s |  Their performance was good, but we had to let them go.
1990.58s - 1992.94s |  Oftentimes, when folks are put in that position,
1992.94s - 1994.46s |  they're gonna try to smash and grab
1994.46s - 1996.14s |  as many files as possible,
1996.14s - 1997.98s |  perhaps to spin off in a consultancy,
1997.98s - 1999.10s |  or do whatever it is they're gonna do
1999.10s - 2000.94s |  with their business after the fact.
2000.94s - 2002.82s |  But obviously, corporate data,
2002.82s - 2004.62s |  you can't just carry home with you.
2004.62s - 2006.74s |  That's not the way it works.
2006.74s - 2009.54s |  So I knew about a month in advance
2009.54s - 2011.74s |  of when this person was gonna get let go,
2011.74s - 2015.46s |  and so I kind of set up a surveillance
2015.46s - 2017.42s |  with my SOC manager, and I was like,
2017.42s - 2019.14s |  hey, can you watch this person?
2019.14s - 2021.46s |  Can you specifically see what's happening
2021.46s - 2023.94s |  in their endpoint over the next few weeks?
2023.94s - 2026.06s |  So it was kind of an interesting process
2026.06s - 2028.40s |  where they were gonna get notice
2028.40s - 2029.74s |  that we were gonna let them go,
2029.74s - 2031.42s |  and then there was a two-week buffer window
2031.42s - 2033.66s |  for them to kind of hand off everything.
2033.66s - 2035.62s |  And I suspected within that two weeks,
2035.62s - 2037.90s |  they would attempt to do a big data exfil.
2037.90s - 2039.54s |  And what happened, it was like,
2039.54s - 2042.00s |  I think a day before we cut off
2042.00s - 2043.90s |  all their accounts and everything,
2043.90s - 2045.88s |  a massive data exfil.
2045.88s - 2048.26s |  So we ended up getting alerted to what they were doing
2048.26s - 2050.50s |  because we had our endpoint sensors
2050.50s - 2052.38s |  detecting what was going on,
2052.38s - 2055.34s |  that we had seen the files in the transfer specifically,
2055.34s - 2057.46s |  so that we knew exactly by name
2057.46s - 2059.46s |  which files had actually gone out.
2060.14s - 2061.66s |  So we were able to call this person back,
2061.66s - 2064.42s |  be like, hey, can you put those files on a USB
2064.42s - 2066.54s |  and please confirm deleting them from your computer
2066.54s - 2070.24s |  because they belong to the company.
2070.24s - 2073.42s |  All right, so DLP is essentially a bunch of rules, right?
2073.42s - 2074.96s |  More rules that we trust.
2074.96s - 2076.12s |  It's not anomalous, right?
2076.12s - 2081.12s |  Yeah, it's a, here we set up these sorts of files
2081.72s - 2084.60s |  or these sorts of indicators.
2084.60s - 2086.72s |  And one of the other things you absolutely need
2086.72s - 2088.86s |  is somebody involved in the process
2088.86s - 2091.54s |  to know what should be happening.
2091.54s - 2092.58s |  It's the deep knowledge.
2092.58s - 2094.54s |  You have to have somebody know what should be happening.
2094.54s - 2095.38s |  Hell yeah.
2095.38s - 2096.90s |  This is what's odd.
2096.90s - 2097.74s |  Hell yeah.
2097.74s - 2102.74s |  And have a clue as to when to really put that extra.
2104.34s - 2106.06s |  Yeah, extra scrutiny kind of thing, you know?
2106.06s - 2106.90s |  Extra scrutiny, yeah.
2106.90s - 2107.90s |  And that's the context.
2107.90s - 2110.02s |  Context was the boss told you, you know,
2110.02s - 2111.76s |  like this guy's gonna do some shit.
2111.76s - 2114.18s |  That's fucking amazing intel, thank you.
2114.18s - 2117.22s |  Somebody's gonna do some shit, I'll look there, right?
2117.26s - 2119.66s |  But if I have anomaly detection,
2119.66s - 2121.58s |  George was talking about that a little earlier as well.
2121.58s - 2123.26s |  He was like, they can be there for months.
2123.26s - 2124.78s |  What does that mean?
2124.78s - 2126.86s |  Anomaly detection, my friends,
2126.86s - 2129.58s |  needs some sort of a time for baselining.
2129.58s - 2131.18s |  It baselines over a month.
2131.18s - 2133.46s |  You have someone that does something fishy every year
2133.46s - 2135.22s |  because they go and they pull financial metrics
2135.22s - 2136.58s |  for the taxes or some bullshit.
2136.58s - 2138.78s |  Every single year, you have a ticket.
2138.78s - 2140.50s |  Every single year, it doesn't matter.
2140.50s - 2142.38s |  And that's why UABA is not the most popular thing
2142.38s - 2143.66s |  in the world, and it will never be
2143.66s - 2147.99s |  because you have to tune the shit out of it, right?
2148.47s - 2152.07s |  For us, we wanna stop fucking hyper-tuning everything.
2152.07s - 2153.75s |  We wanna have regular lives.
2153.75s - 2157.67s |  So that takes us to essentially attack flows.
2157.67s - 2160.99s |  Attack flows are incidents that, you know,
2160.99s - 2162.87s |  when I asked George to talk about an incident,
2162.87s - 2165.67s |  he was like, there was a lot of DDoS,
2165.67s - 2169.23s |  but DDoS usually happens all the way at the end.
2169.23s - 2173.19s |  I know Chris usually has a lot of incidents to share,
2173.19s - 2176.47s |  and sometimes they're all over the place.
2176.47s - 2177.91s |  Sometimes they're only at the end.
2178.75s - 2181.59s |  What happens is, if you only see stuff at the end,
2181.59s - 2183.63s |  you just didn't see the rest.
2183.63s - 2185.27s |  You just didn't put it together.
2185.27s - 2188.59s |  And if you have seen some things but missed a few,
2188.59s - 2190.47s |  you know why you missed them,
2190.47s - 2191.99s |  because these guys were good,
2191.99s - 2194.95s |  and they got your essentially, you know,
2194.95s - 2197.75s |  like blind spots in coverage, blind spots in whatever.
2197.75s - 2199.75s |  So most of the investigations,
2199.75s - 2201.27s |  trying to put the whole story,
2201.27s - 2203.55s |  like give me some sort of an attack flow.
2203.55s - 2205.91s |  Anybody here familiar with a MITRE attack flow?
2206.87s - 2208.15s |  God damn, only three people.
2208.15s - 2210.67s |  What the hell is going on with MITRE?
2210.67s - 2213.27s |  All right, so I'm gonna pitch MITRE for you.
2213.27s - 2215.87s |  Here is what they call a MITRE attack flow.
2215.87s - 2217.19s |  I can see strategically
2217.19s - 2220.27s |  and mainly a little bit operationally
2220.27s - 2221.91s |  what was happening at Equifax, for instance.
2221.91s - 2223.75s |  So there was a vulnerability, exploit, whatever,
2223.75s - 2226.79s |  you know, like web shell, yada, yada, yada, encrypted shell.
2226.79s - 2228.67s |  There was like a lot of queries to the database.
2228.67s - 2231.79s |  That's how Equifax got breached.
2231.79s - 2233.27s |  And my data is there.
2233.27s - 2235.55s |  If you can find my SIN number, my address,
2235.83s - 2238.59s |  you can find a lot of information about me if you want.
2238.59s - 2239.63s |  Download the data breach
2239.63s - 2242.47s |  and please don't steal my identity, but I can't stop you.
2244.11s - 2246.31s |  And God knows I spend a lot of time in the bank
2246.31s - 2248.71s |  whenever I do something because of this,
2248.71s - 2250.71s |  but can't really complain, you know.
2251.67s - 2252.99s |  This is the attack flow.
2252.99s - 2255.55s |  And they archived a bunch of stuff that they got
2255.55s - 2258.27s |  and they exfiltrated it via C2,
2258.27s - 2260.59s |  non-C2 protocol via multi-hub proxy and whatnot.
2260.59s - 2263.67s |  If you want to watch some more of these,
2263.67s - 2267.63s |  instead of APT PDF reports, you can have an APT flow
2267.63s - 2271.19s |  and you can see the nice strategic movement there.
2271.19s - 2272.67s |  But anyways, why the hell do we care about this?
2272.67s - 2273.95s |  We care about this to tell you
2273.95s - 2277.55s |  that we have been fed our entire lives in the sock,
2277.55s - 2279.87s |  that an alert is important.
2279.87s - 2282.83s |  There is something called a notable alert.
2282.83s - 2284.51s |  To hell with an alert.
2284.51s - 2285.75s |  It's about the story.
2285.75s - 2287.79s |  It's about show me the entire freaking flow.
2287.79s - 2289.27s |  To hell with a single technique.
2289.27s - 2290.79s |  Show me the other shit.
2290.79s - 2292.39s |  That's the context.
2292.39s - 2295.15s |  Show me a piece of intel that the boss tells me,
2295.15s - 2296.83s |  somebody's going to pull some shit on you.
2296.83s - 2298.87s |  Good. Now I know where to look.
2298.87s - 2301.03s |  Now it's no more a single incident of data exfiltration.
2301.03s - 2303.95s |  It's data exfiltration that I have good reasoning for.
2303.95s - 2306.15s |  This person is disgruntled and so on and so forth.
2306.15s - 2308.39s |  And these kinds of stories are very important.
2308.39s - 2310.83s |  And that's what usually goes in an incident report.
2310.83s - 2312.11s |  And that's what people like to talk about
2312.11s - 2313.35s |  when they save the day.
2313.35s - 2315.95s |  You don't save the day against a single incident.
2315.95s - 2317.55s |  Sorry, against a single alert.
2317.55s - 2319.67s |  You save the day against a full attack.
2319.67s - 2322.23s |  It might be a full playbook that executes in 20 seconds.
2322.23s - 2324.23s |  It might be an APT that's just been there
2324.23s - 2326.23s |  for a couple of years, whatever it is.
2326.23s - 2327.19s |  It's not one thing.
2327.19s - 2328.23s |  It looks like this.
2329.15s - 2331.91s |  So can we do this with data science?
2331.91s - 2333.91s |  You know, I came here for data science.
2333.91s - 2334.75s |  You baited me.
2334.75s - 2336.15s |  And now you're feeding me a lot of bullshit
2336.15s - 2337.07s |  about people process.
2337.07s - 2338.23s |  Give me some technology, my dude,
2338.23s - 2339.39s |  or I'm going to leave right now.
2339.39s - 2340.51s |  Gotcha. Okay.
2340.51s - 2342.07s |  Here's some technology.
2342.07s - 2345.19s |  So we need some sort of finding
2345.19s - 2346.63s |  mitered attack techniques for everything.
2346.63s - 2348.79s |  Why? Because it's a what?
2348.79s - 2351.79s |  If I hire unicorns like you guys,
2351.79s - 2354.15s |  I don't need to detail everything for a what.
2354.15s - 2358.87s |  But if I hire the 20 resumes that I got in Las Vegas,
2358.87s - 2360.91s |  they're all juniors and they need jobs.
2360.91s - 2362.67s |  And we in security like to say
2362.67s - 2364.23s |  that we have a lack of talent.
2364.23s - 2365.59s |  Fuck no.
2365.59s - 2367.55s |  We have no talent shortage.
2367.55s - 2369.59s |  We have unicorn shortage.
2369.59s - 2372.15s |  I can not hire someone like you guys,
2372.15s - 2376.75s |  but I can hire a shit ton of people that are juniors.
2376.75s - 2378.87s |  And because I can't afford you within my budget,
2378.87s - 2380.59s |  I just say, oh, I have a talent shortage.
2380.59s - 2382.91s |  No, I just can't afford you.
2382.91s - 2384.03s |  And you're too few.
2384.03s - 2387.27s |  I can find a lot of juniors and beginners.
2387.27s - 2389.59s |  So if I give them a mitered attack for everything,
2389.59s - 2390.87s |  their life could be slightly better
2390.87s - 2392.39s |  because now they know the procedural examples,
2392.39s - 2393.35s |  mitigation and detection.
2393.35s - 2394.27s |  They have the description.
2394.27s - 2397.27s |  They have a common language to talk about with me,
2397.27s - 2398.95s |  especially when they see anything in the sim
2398.95s - 2400.67s |  or in any other queue.
2400.67s - 2402.11s |  So how do I get them everything?
2402.11s - 2403.15s |  With mitered attack techniques?
2403.15s - 2406.75s |  Well, you know, I can give them something that I get from,
2406.75s - 2409.59s |  I don't know, sometimes my EDR has mitered attack, right?
2409.63s - 2412.31s |  Anybody here has mitered attack from the EDR?
2412.31s - 2413.91s |  Yeah, a bunch of us.
2413.91s - 2416.47s |  So sometimes the NDR would give you some, you know,
2416.47s - 2419.27s |  but most of the data does not have mitered attack.
2419.27s - 2422.11s |  And the mitered attack that you have was for marketing.
2422.11s - 2423.19s |  It was for dashboards.
2423.19s - 2426.39s |  It was for sexy stuff at RSA and Black Hat.
2426.39s - 2428.51s |  It was not to actually use it.
2428.51s - 2430.35s |  So ideally we have a mitered attack
2430.35s - 2432.71s |  that we can actually use that is not crowdsourced
2432.71s - 2434.99s |  where every single one was given by a different author.
2434.99s - 2435.83s |  Ideally we have one thing
2435.83s - 2437.71s |  that gives everything a mitered attack.
2437.71s - 2438.95s |  How do I do that?
2439.03s - 2440.67s |  I can just deed up everything in my sim
2440.67s - 2443.31s |  and get all the different messages and signatures
2443.31s - 2444.35s |  that would ever trigger.
2444.35s - 2446.83s |  And I, you know, hand annotate them.
2446.83s - 2448.51s |  That's the version 0.1.
2448.51s - 2451.59s |  Version 0.2 is to use an LLM like ChatGPT
2451.59s - 2453.03s |  and let ChatGPT do it.
2453.03s - 2456.83s |  Like I can go to ChatGPT and I'd say, you know,
2456.83s - 2459.95s |  ChatGPT, what technique is happening here and there?
2459.95s - 2461.43s |  And it would tell me, you know,
2461.43s - 2466.43s |  what mitered technique is run DLL 32 registry run key?
2467.43s - 2469.63s |  You know, whatever.
2469.63s - 2471.95s |  It will tell me, it might not be good,
2471.95s - 2473.75s |  but it could be consistent.
2473.75s - 2475.39s |  Can ChatGPT be consistent?
2476.51s - 2479.23s |  Depends, but if you really are after consistency,
2479.23s - 2484.23s |  you go to a model that you can tune the API off.
2485.39s - 2486.95s |  And if you tune the API,
2486.95s - 2489.07s |  it would look something like this.
2489.07s - 2490.43s |  You go to the settings on Hugging Chat.
2490.43s - 2491.51s |  If you don't know about Hugging Chat,
2491.51s - 2495.51s |  it's just a way to get LLMs tuned for your use cases.
2495.55s - 2497.47s |  And you essentially choose any model
2497.47s - 2498.95s |  and you can give it a lot of links
2498.95s - 2501.71s |  for things that it should use, you know,
2501.71s - 2503.79s |  to do OSINT or to do whatever you want.
2504.99s - 2508.51s |  But essentially, let's create one together if you want.
2508.51s - 2510.27s |  Let me figure out how do I create one.
2510.27s - 2511.71s |  I can do this on my phone.
2511.71s - 2514.07s |  I don't have to, you know, walk away from here empty handed.
2514.07s - 2517.11s |  I can walk away with a new assistant that I can create
2517.11s - 2519.51s |  and I can call a TTP detector.
2519.51s - 2520.35s |  And how do I do that?
2520.35s - 2523.71s |  I close ChatGPT and I start any of these models.
2523.71s - 2525.75s |  And the key here is temperature.
2525.75s - 2527.43s |  Why is ChatGPT not consistent?
2527.43s - 2529.87s |  It's creative, it hallucinates every now and then.
2529.87s - 2531.95s |  That's why I don't know a single person in this room
2531.95s - 2535.55s |  that uses an LLM for anything serious other than reporting
2535.55s - 2536.99s |  or some sort of, you know,
2536.99s - 2539.51s |  some sort of how do I write this query
2539.51s - 2540.91s |  or something like that, right?
2540.91s - 2542.87s |  But you don't really depend on it because it hallucinates.
2542.87s - 2544.79s |  If you drive down the temperature all the way down,
2544.79s - 2546.95s |  it will stop hallucinating and it will be consistent.
2546.95s - 2548.47s |  What is consistent or deterministic?
2548.47s - 2550.79s |  It means same input, same output every single day.
2550.79s - 2552.19s |  Same input, same output.
2552.23s - 2553.07s |  And if I have that,
2553.07s - 2557.11s |  I can technically use that for my classification.
2557.11s - 2560.27s |  We're gonna talk a little bit more about that later.
2560.27s - 2562.47s |  For now, let's talk about, okay, my dude,
2562.47s - 2564.31s |  you need miter attacks for everything.
2564.31s - 2567.43s |  Sure, give this guy all the miter attack he needs.
2567.43s - 2568.71s |  Now what?
2568.71s - 2570.67s |  Now the layer ones can actually understand what's going on
2570.67s - 2573.39s |  when they open their sim and they see a million tickets
2573.39s - 2575.43s |  for them to work on, a million notable alerts.
2575.43s - 2578.43s |  However, how the hell do they work through the million?
2578.43s - 2579.87s |  That's why we came here.
2579.87s - 2582.11s |  How do we do data reduction?
2583.03s - 2584.87s |  How do we go from a million notable alerts
2584.87s - 2587.19s |  into, I don't know, 10 tickets?
2587.19s - 2589.39s |  Something that a human can actually do.
2589.39s - 2590.71s |  Because if I have a million notable alerts,
2590.71s - 2593.03s |  I'm only gonna tune my notable alerts
2593.03s - 2595.11s |  to only have 20 extra, extra, extra spicy
2595.11s - 2597.71s |  and I will never lay eyes on anything else.
2597.71s - 2600.71s |  Anybody here has terabytes going into their sim?
2600.71s - 2603.19s |  Like a day, terabytes?
2603.19s - 2604.43s |  Fuck yeah, a lot of people.
2604.43s - 2605.59s |  Okay, nice.
2605.59s - 2608.35s |  So do you ever look at any of that data?
2608.35s - 2609.19s |  No.
2609.19s - 2612.06s |  Why do you collect it?
2612.06s - 2612.90s |  Compliance.
2613.38s - 2614.34s |  Thank you.
2614.34s - 2615.82s |  We do not collect it because we need it.
2615.82s - 2617.98s |  We collect it because the boss wants it.
2617.98s - 2622.30s |  So essentially, what do we actually need?
2622.30s - 2627.10s |  We need about 20 rules, 50 rules, 100 rules.
2627.10s - 2628.86s |  200 rules, that's about it.
2628.86s - 2630.70s |  200 rules, hopefully they don't trigger.
2630.70s - 2632.38s |  When they trigger, I'm kind of worried.
2632.38s - 2633.42s |  Do I ever investigate them?
2633.42s - 2636.50s |  If I'm in the right mood, if I'm in the right day
2636.50s - 2639.34s |  and one of them triggers, I will investigate them.
2639.34s - 2642.34s |  But if you need me to do it super, super duper fast,
2642.42s - 2644.38s |  I'll just close them right away.
2644.38s - 2646.70s |  You want the entity D, I got you.
2646.70s - 2651.10s |  So essentially, how do we find things that are relevant?
2651.10s - 2653.26s |  Yes, 10 minutes to go.
2653.26s - 2654.82s |  How do we find things that are relevant?
2654.82s - 2656.14s |  I have to essentially investigate
2656.14s - 2657.90s |  what are the questions to ask, right?
2657.90s - 2660.38s |  So what is relevant between this alert and this alert?
2660.38s - 2661.86s |  Well, they share an entity
2661.86s - 2663.50s |  or maybe they don't share an exact entity.
2663.50s - 2664.78s |  It's not a common entity.
2664.78s - 2666.66s |  It's a similar entity.
2666.66s - 2668.70s |  Can I put that in the rule or a playbook?
2668.70s - 2671.42s |  No, there is no similarity in the rules.
2671.42s - 2674.26s |  You only have the exact same entity or not.
2674.26s - 2676.26s |  These two entities are in the exact same business unit
2676.26s - 2677.10s |  or not.
2677.10s - 2679.42s |  They have the exact same operating system or not.
2679.42s - 2681.34s |  Similar business units or operating systems
2681.34s - 2682.90s |  or similar ports does not exist.
2682.90s - 2684.02s |  There's no similarity.
2684.02s - 2686.18s |  However, as a human, you're actually doing that.
2686.18s - 2687.58s |  You're looking at similarity.
2687.58s - 2690.34s |  You're looking at similar, even tickets historically,
2690.34s - 2692.86s |  like there was something similar to this before
2692.86s - 2693.94s |  and how would the people do it
2693.94s - 2696.14s |  if I have historical data on my tickets?
2696.14s - 2698.62s |  But essentially, I'm looking for event attributes.
2698.62s - 2700.26s |  Like the EDR gives me a lot of attributes
2700.26s - 2702.10s |  like parent process and whatnot,
2702.10s - 2703.94s |  registry keys and yada, yada, yada.
2703.94s - 2706.18s |  NDR would give me like packet size and so on and so forth,
2706.18s - 2710.14s |  protocol port and identity would give me a lot of events,
2710.14s - 2711.86s |  you know, like what exactly happened in this?
2711.86s - 2712.98s |  Was it like an account change?
2712.98s - 2714.74s |  Was it, what the hell was it?
2714.74s - 2717.38s |  But essentially, I'm looking at event attributes.
2717.38s - 2719.62s |  I'm looking at entities attributes, right?
2719.62s - 2721.46s |  And in my brain, I'm doing similarity.
2721.46s - 2722.74s |  Nice.
2722.74s - 2725.66s |  You were talking about attack detection models.
2725.66s - 2727.78s |  You said I can do it with an LLM.
2727.78s - 2729.38s |  Can you do any better, right?
2729.42s - 2730.26s |  I can do a Hugging Chat.
2730.26s - 2731.50s |  I can even do an Ollama.
2731.50s - 2733.98s |  If you don't know what's an Ollama,
2733.98s - 2737.86s |  you just go here to Ollama and it's a local LLM
2737.86s - 2739.74s |  instead of hosted in Hugging Chat
2739.74s - 2741.54s |  or Chajipati or whatever the hell.
2741.54s - 2742.62s |  You can just host it locally.
2742.62s - 2744.86s |  You can do it in AWS with Bedrock, yada, yada, yada.
2744.86s - 2747.86s |  But can I do better than just a vanilla LLM
2747.86s - 2749.86s |  with the creativity turned all the way down,
2749.86s - 2750.98s |  all the temperature all the way down?
2750.98s - 2751.86s |  Yes, you can.
2751.86s - 2752.70s |  We did.
2752.70s - 2756.18s |  We put three years into this and we built a goddamn LLM
2756.18s - 2758.30s |  that knows everything about cyber and it's open source
2758.30s - 2759.26s |  and you can use it for free.
2760.14s - 2761.22s |  You don't have to pay us ever.
2761.22s - 2762.94s |  But essentially, how did we do that?
2762.94s - 2764.30s |  We gave it a large unlabeled corpus.
2764.30s - 2765.74s |  You know, all the stuff in your bookmarks,
2765.74s - 2767.90s |  the books, the slides, the white papers,
2767.90s - 2768.98s |  it's all the shit that you want to read
2768.98s - 2770.14s |  but you never will.
2770.14s - 2771.82s |  You just put it in bookmarks forever.
2771.82s - 2773.98s |  Or if you're one of these guys like me,
2773.98s - 2776.18s |  you just open a shit ton of tabs
2776.18s - 2778.46s |  and your browser can't take it anymore.
2779.86s - 2780.70s |  Yep.
2782.18s - 2785.38s |  So yeah, we just gave all of that to the LLM
2785.38s - 2787.42s |  and I took them off my bookmarks
2787.42s - 2790.90s |  and now I have an LLM that actually read them from scratch
2790.90s - 2794.38s |  and that LLM, I gave a small labeled corpus to
2794.38s - 2797.06s |  and I can talk a lot about the small labeled corpus
2797.06s - 2798.70s |  but that's what took three years
2798.70s - 2800.50s |  because I actually wanted a small labeled corpus
2800.50s - 2801.94s |  of labels that I trust.
2801.94s - 2803.62s |  Here's the alert, here's the mindset attack
2803.62s - 2805.38s |  and you cannot get that.
2805.38s - 2807.10s |  That is so fucking hard.
2807.10s - 2808.26s |  Humans are not consistent.
2808.26s - 2810.34s |  We have to make one human sit down at the end
2810.34s - 2812.90s |  and write regular expressions to keep themselves consistent
2812.90s - 2814.50s |  when they attack something
2814.50s - 2817.18s |  because every day they would attack something differently.
2817.94s - 2818.78s |  It was so fucking hard.
2818.78s - 2819.62s |  And then we had to like do data balance.
2819.62s - 2820.98s |  Like this is so fucking hard.
2820.98s - 2823.34s |  A small labeled corpus, that's impossible.
2823.34s - 2826.62s |  But again, open source, already out there, use it.
2826.62s - 2828.98s |  But this is how you end up with essentially
2828.98s - 2830.94s |  like you have techniques for everything.
2830.94s - 2833.02s |  Of course, it's actually probabilistic at the backend.
2833.02s - 2835.66s |  Like I actually have a probability for every single class.
2835.66s - 2837.14s |  But in this case, I was like, you know what?
2837.14s - 2839.10s |  Anything above 99% show it to me.
2839.10s - 2839.94s |  And that was it.
2839.94s - 2841.02s |  And it was pretty decent.
2841.02s - 2843.14s |  And even if it was not decent, I don't give a shit.
2843.14s - 2844.86s |  It's consistent and it's in everything.
2844.86s - 2846.74s |  You have a PowerShell in my organization.
2847.30s - 2848.14s |  I have a technique.
2848.14s - 2849.66s |  You have a Windows event log in my organization.
2849.66s - 2850.62s |  I have a technique.
2850.62s - 2852.66s |  You have whatever the fuck that I get in my sim,
2852.66s - 2853.50s |  I have a technique.
2853.50s - 2854.78s |  Even if I don't get it in my sim,
2854.78s - 2856.70s |  as long as it ends on my S3 bucket
2856.70s - 2858.98s |  and it goes through this, I have a goddamn technique.
2858.98s - 2862.50s |  And I can hire the 20 resumes that I got of juniors
2862.50s - 2863.86s |  because they actually know what the hell is going on
2863.86s - 2864.70s |  when they see something.
2864.70s - 2867.22s |  You don't have to ask me, what is run DLL 32?
2867.22s - 2868.50s |  I don't fucking give a shit.
2868.50s - 2871.50s |  You have to just say, what is T1218?
2871.50s - 2872.34s |  And you have to read about it.
2872.34s - 2873.74s |  And you have to figure out how to mitigate
2873.74s - 2874.58s |  and how to investigate about it.
2874.58s - 2876.58s |  You can go to chat GPT and be like,
2877.42s - 2879.98s |  T1218, what should I do?
2879.98s - 2880.82s |  What are the next steps?
2880.82s - 2881.66s |  What should I investigate?
2881.66s - 2882.82s |  And it will tell you, right?
2882.82s - 2884.18s |  It's a common language.
2884.18s - 2885.50s |  So anyways, now that I have that,
2885.50s - 2887.34s |  I wanna cluster events that are relevant.
2887.34s - 2889.14s |  How do I cluster events that are relevant?
2889.14s - 2890.74s |  Well, I can do it vanilla.
2890.74s - 2893.98s |  And I have code here for essentially clustering.
2893.98s - 2897.22s |  And I just zoom in on the sexy eye candy,
2897.22s - 2899.78s |  but forget the eye candy for a second.
2899.78s - 2900.98s |  This is just like eye candy that shows you
2900.98s - 2902.46s |  like clusters of events and whatnot.
2902.46s - 2904.98s |  But if I wanna do much better,
2905.02s - 2908.66s |  and if I can actually hire a summer intern for data science,
2908.66s - 2911.06s |  instead of just DIY it myself,
2911.06s - 2913.18s |  I will tell them to use a knowledge graph.
2913.18s - 2914.38s |  What the hell is a knowledge graph?
2914.38s - 2916.90s |  Clustering is unsupervised, right?
2916.90s - 2917.98s |  Clustering is unsupervised,
2917.98s - 2919.22s |  which means that it actually doesn't know
2919.22s - 2920.66s |  where the hell is it going.
2920.66s - 2921.74s |  And it doesn't know what's right
2921.74s - 2923.50s |  because you don't know what's right.
2923.50s - 2924.70s |  You actually don't know what's right.
2924.70s - 2925.86s |  And you don't know how to guide it,
2925.86s - 2927.66s |  but you know how to think.
2927.66s - 2930.46s |  You know how to investigate to a certain degree.
2930.46s - 2931.86s |  Anybody here has documentation?
2931.86s - 2933.50s |  If I join as a new SOC analyst,
2933.50s - 2935.14s |  how to investigate something?
2936.14s - 2939.30s |  One, okay, two, three, four, four.
2939.30s - 2941.22s |  Okay, you guys are fantastic.
2941.22s - 2942.50s |  Most people don't, right?
2942.50s - 2945.14s |  Do you have historical tickets by any chance?
2945.14s - 2947.14s |  Historical tickets, historical investigations?
2947.14s - 2948.62s |  Okay, about five, six people.
2948.62s - 2950.02s |  Okay, nice.
2950.02s - 2952.06s |  Most of us, we're the normies.
2952.06s - 2953.18s |  We're the 99%.
2953.18s - 2954.50s |  We don't have shit, right?
2954.50s - 2957.86s |  So it's all stuck in the brain of a unicorn
2957.86s - 2958.78s |  sitting in my SOC.
2958.78s - 2961.54s |  And without this unicorn, everything fails, right?
2961.54s - 2962.38s |  So I know how to think.
2962.50s - 2964.66s |  That's a failure of your unicorn.
2964.66s - 2965.50s |  Right.
2965.50s - 2967.50s |  Because the first thing we should be doing
2967.50s - 2970.30s |  when we pull this stuff is writing out,
2970.30s - 2974.62s |  oh, here's a little FAQ of how I do what I do.
2974.62s - 2976.58s |  And it might not work for you,
2976.58s - 2978.86s |  but you can see how my brain's gonna work on it.
2978.86s - 2981.38s |  And then you can adapt your brain
2981.38s - 2983.78s |  to the same goal at least.
2983.78s - 2987.14s |  And oh, by the way, here's all the things I screwed up on
2987.14s - 2989.74s |  so you don't make my mistakes.
2989.74s - 2990.58s |  Yes.
2991.02s - 2992.86s |  There's also SOPs too, right?
2992.86s - 2995.94s |  I mean, if you document what people are supposed to do,
2995.94s - 2996.78s |  then who reads them?
2996.78s - 2999.82s |  Yeah, the SOPs, the FAQs, boilerplate.
2999.82s - 3003.46s |  Oh, dear Lord, as much as you can boilerplate.
3003.46s - 3005.50s |  Boilerplate your friend.
3006.94s - 3011.58s |  Because if they want to spend hours crafting an IR
3011.58s - 3014.78s |  and they've got 75% pre-written,
3015.66s - 3017.54s |  put this here, put this here,
3017.54s - 3019.30s |  make sure it all makes sense.
3019.30s - 3021.34s |  Here's where you put the actual details
3021.34s - 3023.10s |  of what happened in the narrative.
3023.10s - 3024.30s |  And here's all the rest of the stuff
3024.30s - 3025.62s |  that we just have to put in.
3025.62s - 3026.46s |  Hell yeah.
3026.46s - 3028.42s |  I mean, if you actually have some sort of documentation,
3028.42s - 3029.26s |  that's fantastic.
3029.26s - 3031.18s |  If you don't, you have to figure out
3031.18s - 3032.94s |  how to put the knowledge out there.
3034.54s - 3037.34s |  You can, you can, don't lose hope.
3037.34s - 3038.98s |  The knowledge is essentially is gonna be encoded
3038.98s - 3040.30s |  in some sort of data structure.
3040.30s - 3042.22s |  And data structures are essentially pretty nice
3042.22s - 3044.58s |  because they tell the clustering algorithm
3044.58s - 3045.90s |  what to look for.
3045.90s - 3047.42s |  Clustering, again, doesn't know what to do.
3047.42s - 3048.26s |  It's unsupervised,
3048.26s - 3049.74s |  but you can make it semi-supervised
3049.74s - 3051.66s |  and cheat your way a little
3051.66s - 3052.94s |  and just give it knowledge.
3052.94s - 3053.94s |  Tell it, you know.
3053.94s - 3055.94s |  In my investigations, I always look for entities.
3055.94s - 3056.78s |  Okay.
3056.78s - 3060.18s |  So the entity is a node and the event is a edge.
3060.18s - 3063.78s |  And between as, as an entity and Google
3063.78s - 3066.34s |  or Ashley Madison or whatever you want,
3066.34s - 3068.90s |  like it's essentially another entity.
3068.90s - 3070.34s |  And these are the events that happened.
3070.34s - 3072.42s |  And these events, essentially,
3072.42s - 3074.22s |  I want you to cluster them,
3074.22s - 3075.62s |  thinking all the time in the cluster
3075.62s - 3077.22s |  about what entities are involved.
3077.22s - 3079.82s |  It's an entity-centric way.
3079.82s - 3081.42s |  But again, do you have the right process
3081.42s - 3082.90s |  to have the entity attributes?
3082.90s - 3084.38s |  Do you have the right stuff?
3084.38s - 3085.50s |  It's all a process.
3085.50s - 3086.86s |  Because when you go to data science,
3086.86s - 3088.50s |  it's about what data do you have, right?
3088.50s - 3090.74s |  And also what knowledge do you have to put there?
3090.74s - 3092.78s |  But given the right data, not the right data,
3092.78s - 3095.62s |  given a good enough data and a good enough knowledge,
3095.62s - 3097.10s |  you can actually get very useful clusters.
3097.10s - 3097.94s |  And guess what?
3097.94s - 3099.38s |  They compete with nothing.
3099.38s - 3101.78s |  Today, chapter one, machine learning and clustering
3101.78s - 3103.58s |  competes with absolutely nothing
3103.58s - 3105.58s |  because you have a bunch of humans that sit in your sock
3105.58s - 3108.70s |  and they do whatever,
3108.70s - 3112.22s |  but you don't actually know how do they correlate things
3112.22s - 3113.74s |  because you don't document them.
3113.74s - 3115.86s |  Clustering, at least, is fully transparent.
3115.86s - 3117.06s |  It's auditable.
3117.06s - 3118.90s |  It's actually explainable.
3118.90s - 3121.22s |  And you can track it down and you can give it feedback.
3121.22s - 3123.06s |  And it's very easy to give feedback.
3123.06s - 3124.94s |  But also, you can also chain things
3124.94s - 3126.06s |  in a finite-state machine.
3126.06s - 3128.50s |  And in data science, we call those Markovian chains,
3128.50s - 3130.98s |  but Markovian models are another way
3130.98s - 3132.50s |  to say finite-state machine.
3132.50s - 3134.06s |  We just like to complicate things.
3134.10s - 3136.74s |  But essentially, they say that if you find a few steps,
3136.74s - 3138.98s |  even if it misses a few because of zero days or whatnot,
3138.98s - 3140.30s |  it's fine, put them together.
3140.30s - 3143.26s |  And what you end up with is 2,500 alerts
3143.26s - 3146.26s |  given with 180,000 events and logs.
3146.26s - 3147.50s |  And they give you eight clusters.
3147.50s - 3148.46s |  In reality, in the sock,
3148.46s - 3151.74s |  we only knew about one ticket or one cluster.
3151.74s - 3155.58s |  And that one cluster had about 10 alerts.
3155.58s - 3157.66s |  And 10 alerts are essentially a lot.
3157.66s - 3159.54s |  I don't think anybody has a ticket with 10 alerts,
3159.54s - 3160.54s |  but that was not enough
3160.54s - 3163.94s |  because that exact cluster had 202 alerts.
3164.94s - 3166.74s |  And of course, not all of these were good.
3166.74s - 3169.46s |  Some of these were garbage, but we gave it feedback.
3169.46s - 3170.42s |  And it was fantastic.
3170.42s - 3172.34s |  And when I showed it to my sock people,
3172.34s - 3174.26s |  it was like, okay, this is pretty good.
3174.26s - 3176.74s |  What amazing technology, what alien technology is this?
3176.74s - 3179.18s |  And I was like, this is chapter one machine learning.
3179.18s - 3180.74s |  This is clustering.
3180.74s - 3181.78s |  And you can give it feedback.
3181.78s - 3183.38s |  It's chapter one, fuck yeah.
3183.38s - 3186.26s |  Like we're working with rules, we're working with stuff,
3186.26s - 3187.42s |  and it's a big data problem.
3187.42s - 3189.02s |  And we don't have a single big data solution
3189.02s - 3191.66s |  because we're skeptical about anything
3191.66s - 3192.62s |  that we don't understand.
3192.62s - 3193.78s |  Clustering, you can understand
3194.06s - 3195.82s |  down to the latest bit of it,
3195.82s - 3198.02s |  and you can give it feedback and you should use it.
3198.02s - 3198.86s |  And it's open source.
3198.86s - 3202.22s |  So essentially, if you want to take something from this,
3202.22s - 3204.10s |  put techniques in everything, that's the what.
3204.10s - 3207.50s |  And for investigations, welcome to cybersecurity.
3207.50s - 3209.78s |  No one actually knows how do we do investigations correctly.
3209.78s - 3211.30s |  We don't have proper documentation.
3211.30s - 3213.38s |  We don't have a single even resource.
3213.38s - 3215.02s |  We don't have a course about how to investigate stuff
3215.02s - 3218.30s |  in the SOC that is unified and people know about, yeah.
3218.30s - 3219.94s |  But essentially, if you have a clustering algorithm,
3219.94s - 3222.54s |  you have a way to unify how do you deal with this
3222.54s - 3225.74s |  and it scales and it's not a GPU, it's not an LLM.
3225.74s - 3228.66s |  It's $20 a month for a clustering algorithm
3228.66s - 3231.18s |  to run through terabytes and terabytes of data every day
3231.18s - 3233.82s |  and fully explainable and you can give it feedback.
3234.78s - 3237.38s |  But yeah, here's essentially a quick example
3237.38s - 3239.22s |  that is technical, so I didn't completely bait you.
3239.22s - 3241.62s |  Here's an input and here's how you cluster it.
3241.62s - 3243.14s |  You just say cluster zero has all of these
3243.14s - 3244.94s |  and you can give that to an LLM and write the report.
3244.94s - 3246.58s |  LLMs are really good at writing reports.
3246.58s - 3248.06s |  If I give this to an LLM,
3248.06s - 3250.82s |  it will make me an amazing report I can give to my boss.
3250.82s - 3252.02s |  But now when I look at a ticket,
3252.50s - 3254.30s |  it doesn't have to be one alert, a notable alert.
3254.30s - 3256.42s |  My ticket is one notable alert,
3256.42s - 3258.82s |  200 possibly relevant alerts
3258.82s - 3261.46s |  and if I have historical tickets,
3261.46s - 3264.14s |  here is three relevant tickets from history
3264.14s - 3266.86s |  so that I know what happened historically.
3266.86s - 3271.02s |  But yeah, that's pretty much a wrap.
3271.02s - 3274.34s |  This is how we compare against essentially other methods.
3274.34s - 3276.82s |  It's actually efficient because you don't do rules,
3276.82s - 3279.38s |  you don't do searches and it's easier to adapt and maintain
3279.38s - 3280.30s |  and it's actually standalone.
3280.30s - 3281.90s |  So when your boss changes the SIM,
3282.78s - 3283.62s |  you don't lose your work, it's standalone
3283.62s - 3285.62s |  and it's a legacy you can leave behind you.
3285.62s - 3286.58s |  Anyways, I appreciate you.
3286.58s - 3287.98s |  Thank you for the panelists.
3287.98s - 3295.57s |  Thank you guys for listening.
3295.57s - 3298.09s |  I have a shit ton of stickers and I don't know,
3298.09s - 3300.41s |  I can take a lot of questions outside as well.
3300.41s - 3301.25s |  I have a shit ton of stickers
3301.25s - 3302.53s |  and I'd love to connect with you.
3302.53s - 3305.33s |  You guys probably should connect with these guys.
3305.33s - 3307.17s |  There are innovative leaders.
3307.17s - 3309.17s |  These are the kind of leaders that we have on camera
3309.17s - 3314.17s |  saying they like juniors and they don't like MTTD.
3314.41s - 3317.21s |  They don't like the old fashioned way of doing things.
3318.21s - 3320.09s |  These are the kind of leaders you probably want to work with
3320.09s - 3321.17s |  but I appreciate you.


url: https://www.youtube.com/watch?v=jS3iNUfYtLA
title: DEF CON 32 - Data On Demand The challenges of building a privacy focused AI Device - Matt Domko
type: video
author: DEFCONConference
ingestion_date: 2024-11-09
transcription_model: large-v2
chunking_status: completed
content:
{
  "webpage_url": "https://www.youtube.com/watch?v=jS3iNUfYtLA",
  "title": "DEF CON 32 - Data On Demand The challenges of building a privacy focused AI Device - Matt Domko",
  "description": "Building an AI product for the everyday person is challenging - doing it in a privacy focused way is nearly impossible without support from the right people. I'll walk through the techniques we're using at Rabbit to secure customer data and provide people a choice as to where their data goes.\n\nWe'll cover the pipelines that\n\nCollect and Manage customer identity after they login to a site\nLog, Anonymize, and Process customer voice interactions\nProvide \"just in time\" access to customer data for personalized RAG-like models\nAs a community, I think we're well within our rights to demand control over the data we provide to companies. This talk aims to provide engineers with a list of ideas on \"what right could look like\", and general attendees a list of things that are possible, so they know its ok to ask for them.",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 2447,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241016"
}

0.00s - 6.08s | This text was transcribed using whisper model: large-v2

 so hi everybody my name is Matt Domko I don't know who that was but they're my
6.08s - 10.92s |  new best friend so you are at data on demand the challenges of building a
10.92s - 19.52s |  privacy focused AI device and in reality like what I want to talk about is I am a
19.52s - 28.48s |  consumer and also a supporter of the AI magical things and if if I have the one
28.48s - 32.56s |  that I work on at work or if I have one from somebody else they're just certain
32.56s - 36.68s |  things that I really want to make sure that they happen and that's kind of the
36.68s - 43.92s |  the goal of this thing so I do have a job they pay me to do stuff these are my
43.92s - 51.04s |  thoughts things in my brain that I wrote down in order to make a device safer but
51.04s - 58.08s |  this is not the thoughts and ideas of my company my company a company I work at
58.08s - 64.20s |  so I'm into 3d printing laser-cutting cosplay mostly steampunk stuff if you
64.20s - 67.80s |  ever want to nerd out about any of that or just security education in general
67.80s - 73.40s |  super super into it I'm also the director of fun at tines if anybody's
73.40s - 78.08s |  familiar with tines it's an unofficial title and they don't pay me but I the
78.08s - 86.12s |  director of fun here's the agenda will work through so the problem there's all
86.12s - 89.44s |  these things and it's funny when I was creating these slides it was like okay
89.44s - 92.96s |  what are the AI devices that exist and there were like three and then all of a
92.96s - 97.24s |  sudden we had two new ones appear that are the exact same but different with
97.24s - 100.60s |  the same name I don't know anyway the point is is I want a hardware device
100.60s - 106.40s |  that makes AI easy for just the general consumer but I want to respect their
106.40s - 112.68s |  privacy because it's the right thing to do and so it's it's kind of a challenge
112.88s - 116.32s |  when you think about the difference between working in the consumer space
116.32s - 121.72s |  where it's like anyone in my family who's not into technology might actually
121.72s - 127.52s |  purchase one of these versus the team that I work with at an organization and
127.52s - 131.60s |  they already have an understanding of how they treat their data and where it's
131.60s - 137.76s |  going so before we get into the pipelines that we we should be using to
137.76s - 143.72s |  protect those that data I want to start off talking about some basic request
143.72s - 149.24s |  workflows so when I think about doing something with any kind of AI it's
149.24s - 153.28s |  really four different types of requests and there are two it's basically two
153.28s - 157.40s |  with a little differences so the first one is just a general knowledge request
157.40s - 163.40s |  I don't need to know anything about you I can just make this request the second
163.40s - 167.92s |  one is a contextual knowledge request so I need to know some things about you
167.92s - 172.24s |  but I don't need any super sensitive data generic actions requests so if I
172.24s - 176.16s |  want to do something for you but it could be anybody it could be done for
176.16s - 179.84s |  Matt it could be done for Steve it could be done for Jay I think that's who that
179.84s - 185.28s |  was now that's what we would do but if I wanted to do something on behalf of you
185.28s - 189.48s |  on your Spotify account on your Grubhub account whatever it is I need to be
189.48s - 196.60s |  authenticated and so that's that fourth type that I like to think about so if we
196.60s - 202.88s |  look at the general knowledge request it's it's fairly simple so I have my my
202.88s - 208.68s |  AI walkie-talkie I push the button and I say whatever it is I'm gonna say what
208.68s - 214.92s |  what's the weather out today it's gonna go up through the internet into my cloud
214.92s - 218.80s |  provider there's a routing and storage and replay engine that sort of glues
218.80s - 223.12s |  everything together but at its core we're really just doing speech to text
223.12s - 230.96s |  text to speech and some LLM calls to to figure out what the right answer is so
230.96s - 236.64s |  that's a knowledge request when we're doing those those types of requests
236.64s - 241.56s |  right what kind of data are we thinking about well if my request is tell me a
241.56s - 248.12s |  cat about a fact about cats super easy if I say I've got a weird rash should I
248.16s - 253.64s |  see a doctor a little bit more sensitive than tell me a fact about cats and so
253.64s - 257.60s |  when I think about protecting this data it's really three different kinds I've
257.60s - 262.16s |  got audio data that recording of my voice that needs to get converted into
262.16s - 267.12s |  speech-to-text I've got the transcript data which is the result of that
267.12s - 271.88s |  speech-to-text call and then I've got my response data which is where I took that
271.88s - 279.73s |  that text ran it through an LLM and had the the LLM give me an answer when we
279.73s - 284.89s |  think about generic action requests it's very very similar to what we just
284.89s - 288.97s |  saw the only difference is now we insert an actuator so an actuator is just a
288.97s - 294.77s |  thing that can perform a task when you provide an input and so this is this is
294.77s - 302.99s |  the thing that calls the Google weather API for you as far as the types of data
302.99s - 306.75s |  that that we need and that we need to protect we've still got our audio
306.75s - 311.43s |  transcript and response data but we also have some contextual data right things
311.43s - 317.71s |  like your location things like your interests if I ask about if I ask if I
317.71s - 323.03s |  ask my a walkie-talkie for five restaurants in the area that are good
323.03s - 329.03s |  ideally if I absolutely do not like cheeseburgers it would not give me the
329.03s - 332.31s |  greatest cheeseburger restaurant in the neighborhood because it knows and so
332.31s - 336.95s |  that contextual data is also something super sensitive that we want to protect
336.95s - 342.83s |  and the last piece is the authenticated action request exact same flow as
342.83s - 346.83s |  everything else the only difference is now we have to store some sort of
346.83s - 352.47s |  credential somewhere right I can't order you food from your uber eats account
352.47s - 358.55s |  unless I have a way to tell uber hey Matt wants food from uber so whenever I
358.55s - 366.55s |  think about that more examples call me a nude an uber order me some tacos did
366.55s - 371.63s |  Jimmy do his homework same old same data as before but we have additional
371.63s - 376.23s |  context we have the identity of the person that's asking for it we have
376.23s - 381.23s |  additional context about who this Jimmy person is right some like familial
381.23s - 391.46s |  connection and then authentication information so this is like the sticky
391.46s - 397.98s |  point that I feel like always it's always a really fun discussion and so
397.98s - 401.54s |  so yeah I don't want to just make authentication information something
401.54s - 406.90s |  tiny on the slide I want to actually talk about it so if I think about how
406.90s - 414.82s |  can I authenticate a customer well or as a customer sorry I can do one of three
414.82s - 419.18s |  things really I can save their username and password in a database and then
419.18s - 424.78s |  anytime I need to do something as them I just log in as them that's cool right
424.78s - 430.78s |  probably not I can have them log in and I can store their cookies so at least I
430.78s - 435.74s |  can't create a new session I can only use that same session again and then the
435.74s - 442.54s |  last option is I can just use OAuth the problem is is as security professionals
442.54s - 447.06s |  it's really easy to just say go be a grown-up and use OAuth but whenever
447.06s - 450.66s |  you're you're working with a business that has to make money you you actually
450.66s - 454.98s |  have to think about these things and consider some of the trade-offs so we're
454.98s - 457.86s |  going to talk about some of the trade-offs so if I just store the
457.86s - 463.90s |  username and password it's great we can log in whenever we want sorry yeah
463.90s - 468.34s |  wherever we want whenever we want I don't actually have to store any session
468.34s - 471.66s |  information because if if I get logged out I'll just log back in because I know
471.66s - 477.78s |  their username and password downside I have their username and password and
477.78s - 485.46s |  someone can steal it bonus we can log in whenever we want I covered that part
485.46s - 491.26s |  already and then the downside to that is in order to actually revoke our access a
491.26s - 497.06s |  customer has to change their password again another bonus we can do anything
497.06s - 501.18s |  that the customer can do because we have their username and password but the
501.18s - 505.94s |  downside we can do anything the customer can do including change their password
505.94s - 511.70s |  so if we're thinking about trade-offs this one doesn't feel like the right
511.70s - 518.78s |  thing to do so the next thing we have right session cookies so lots of pros
518.78s - 523.42s |  here sessions expire regularly the downside for the engineering team is
523.42s - 528.46s |  sessions expire regularly I can have access to almost everything that a user
528.46s - 534.62s |  can do if you've ever tried to go in and add someone to a repository in github
534.62s - 539.62s |  like you can create a repository just I'm logged in but in order to add a
539.62s - 542.86s |  person to that repository you have to step up you have to type in your
542.86s - 548.06s |  password again you have to do an MFA push and so this is really great because
548.06s - 553.58s |  if the provider supports it we can actually scope down what it is that
553.58s - 558.74s |  we're able to do but the downside is the provider actually has to support that so
558.74s - 564.02s |  while github might have that requirement the McDonald's mobile app maybe doesn't
565.02s - 572.18s |  another nice thing on the engineering side is typically MFA requirements bot
572.18s - 577.18s |  protection all of that happens at sign-in and before you actually get your
577.18s - 584.86s |  session token for the site the downside is that it also doesn't usually generate
584.86s - 588.94s |  a new login event so if you're like me and every time you get a message from
588.94s - 593.38s |  Google that says hey you just logged in from somewhere new was that you and you
593.38s - 598.42s |  get like super paranoid you're not gonna get those because most providers
598.42s - 601.06s |  just say oh you've got a session token that already works so we're just gonna
601.06s - 609.90s |  use that so that's it's not great a good thing users can can actually manually
609.90s - 613.94s |  expire those sessions for themselves which is great right because if I go to
613.94s - 619.02s |  gmail and I say where am I logged in and it says I'm logged into AWS I'm not
619.06s - 624.14s |  logged into AWS I'm gonna click log out so that's great but again it requires
624.14s - 630.50s |  the provider to actually create that opportunity for their customer and then
630.50s - 634.54s |  the the other nice thing about this is it can be used on almost any website
634.54s - 641.70s |  right when we get to the OAuth piece the biggest limitation is if you look at all
641.70s - 646.62s |  of the websites on the internet how many of them actually support OAuth if we're
646.62s - 653.22s |  in the b2b world and we're focusing just on oh I want I want Datadog I want
653.22s - 658.18s |  GitLab I want all of these like commercial enterprises absolutely
658.18s - 661.30s |  there's OAuth because it's a thing that we've been hounding vendors about for
661.30s - 666.50s |  the last I don't know 20 years but there's a benefit there and that is if
666.50s - 672.06s |  they do it they get our business whereas if you're a local mechanic shop and you
672.06s - 677.62s |  just want people to book spots online with you you're not incentivized to
677.62s - 683.14s |  invest in OAuth and so how do we support the general consumer with a technology
683.14s - 688.78s |  that doesn't exist everywhere the other thing that I think sort of makes OAuth
688.78s - 693.98s |  tricky in situations like this is you have to configure it for each site and
693.98s - 699.82s |  so if there are a hundred million sites on the internet and I hire a 10x
699.90s - 705.66s |  engineer who can knock out one integration every six hours okay so
705.66s - 710.82s |  that's six hundred million did I say a hundred million sites I don't know but
710.82s - 714.02s |  the the point is it's a very very long time to actually be able to reach the
714.02s - 720.26s |  entire internet so we've done our pros and cons let's put them on a graph that
720.26s - 723.98s |  graph saying low effort to high effort obviously the business likes that
723.98s - 728.66s |  whenever we do things low effort not secure to more secure obviously as
728.70s - 732.18s |  professionals we like to be over there on the far right hand side so we look at
732.18s - 735.54s |  this graph and we say you know what there's just so much risk with username
735.54s - 739.58s |  and password that's out and then we go to our CTO and we say hey I want to do
739.58s - 744.26s |  OAuth to the world we're gonna call get token every time we need this and I tell
744.26s - 748.02s |  them it's gonna take a thousand years to get all of the sites that they want to
748.02s - 751.98s |  cover done and I get told no you know what that's probably not and even as a
751.98s - 757.46s |  practitioner right I realized that if I try to make the world's most secure
757.46s - 762.14s |  company that's just us not making money with all the computers turned off and I
762.14s - 766.14s |  I like having a place to work I like building cool things for consumers and
766.14s - 773.74s |  so working with cookies for now is kind of like the way that I see us going so
773.74s - 781.34s |  let's talk about that user context that authentication information so there's
781.34s - 785.74s |  sort of like the naive way right where you can just do it make it work it's
785.74s - 789.98s |  gonna work great and then there's more of a more secure way so first let's talk
789.98s - 794.38s |  about the naive way so the first thing that I'll do is recognize oh the user
794.38s - 799.06s |  wants to store a cookie I'll create context the intention controller is
799.06s - 803.14s |  going to recognize that and say oh they want to store a cookie cool it's going
803.14s - 809.70s |  to create a context container that container exists purely to to to allow
809.70s - 814.42s |  the user to store those cookies so some companies do it in a web browser some
814.42s - 820.54s |  companies do it with a Chrome extension lots of different ways that you could do
820.54s - 824.54s |  it but the point is we're going to collect that context we're gonna write
824.54s - 829.86s |  it into a database whenever it comes time to use that cookie again it all
829.86s - 834.98s |  fits on one slide I recognize I want to use this context I say oh this is Matt's
834.98s - 840.06s |  user account I'm gonna go ahead and go into the database grab Matt's cookie and
840.18s - 844.74s |  then stuff it into an actuator that actuator now has a login session for me
844.74s - 850.18s |  and it can order the thing that I asked for it goes off into the third-party
850.18s - 855.42s |  space and does the thing it's supposed to do what's the problem with this what
855.42s - 862.61s |  makes you nervous stolen cookies I heard that in the front awesome yeah exactly I
862.61s - 868.25s |  don't want to be the guy that has a database just full of cookies that other
868.25s - 873.65s |  people can just come in and take from me that would be really really bad so
873.65s - 878.49s |  let's think about a way that we could do this a little bit more securely so again
878.49s - 883.01s |  I'll recognize I want to create some context I want to store that cookie the
883.01s - 886.53s |  intention controller is going to recognize that very similar to before
886.53s - 891.81s |  it's gonna create that that web browser so that the customer can log in but then
891.81s - 896.49s |  notice we have a vault service down below and so once that cookies collected
896.49s - 901.33s |  instead of just stuffing it into a vault and then returning it to the
901.33s - 904.89s |  database what we're actually gonna do is we're gonna stuff it into the vault but
904.89s - 909.33s |  we're also going to add the identity of the customer it belongs to and so when
909.33s - 913.77s |  we get to the next slide you'll see that we should actually say hey yes I want
913.77s - 918.37s |  this cookie also Matt said I could have it two minutes ago and so by having like
918.37s - 924.57s |  a short-lived JWT that the user provides with you provides to you your life just
924.57s - 928.41s |  gets a lot better I can sleep a lot better at night knowing that I'm not
928.41s - 933.61s |  storing cookies for a hundred thousand people I'm storing things that I'm
933.61s - 938.73s |  storing encrypted blobs and you would have to actually have a request from the
938.73s - 945.28s |  user in order to go get that cookie so when we get to using the context
945.28s - 949.44s |  securely I kind of already covered this but we'll walk through it again we
949.44s - 953.32s |  recognize the user wants to take an authenticated action we get the object
953.32s - 959.12s |  ID and not the actual object from the database we send that object ID and the
959.12s - 965.80s |  users JWT to our vault or sorry to our context actuator the context
965.80s - 970.96s |  actuator now is the thing that reaches out to the vault and gets that cookie
970.96s - 977.84s |  and so this one tiny space in our network is the only place that with a
977.88s - 983.96s |  request from the customer you can actually go get their cookie once once
983.96s - 988.92s |  the actuator performs the action we tear it down we never use it again it was
988.92s - 993.56s |  just that one thing and so the risk of someone coming in and stealing a token
993.56s - 998.60s |  off of the the actuator gets a lot smaller right essentially we're looking
998.60s - 1005.00s |  at like build system compromises that allow you to get in versus earlier it
1005.00s - 1012.64s |  was just can someone access my database so it's a lot as far as securing the
1012.64s - 1018.48s |  customer context so some do's and don'ts to sort of take away don't collect
1018.48s - 1027.08s |  context that'll make you a target if you are only storing cookies for DoorDash
1027.08s - 1034.28s |  Spotify and uber not a lot of people are gonna come after you right like like why
1034.28s - 1040.32s |  do I want this cookie that is likely going to get caught there's much better
1040.32s - 1045.48s |  things for me to spend my time on as an attacker so if we ever get to a world
1045.48s - 1050.84s |  where somebody wants to use their AI walkie-talkie to spend money I don't
1050.84s - 1056.00s |  want to store that financial instrument because that makes me a target and so
1056.00s - 1061.64s |  allowing allowing vendors service providers to actually own that piece is
1061.64s - 1069.50s |  super super important to me the second piece is don't reuse context or or yeah
1069.50s - 1073.76s |  context containers or actuators across users so anytime I'm taking something
1073.76s - 1078.36s |  sensitive from the customer it should be a one-off thing and then when it's done
1078.36s - 1083.24s |  it should go away and then I don't ever have to worry about oh well I accidentally
1083.24s - 1090.52s |  ordered $1,000 worth of tacos on Jay's uber eats account instead of on Matt's
1090.52s - 1099.84s |  and now Jay has a ton of tacos to share with who I don't know so not doing those
1099.84s - 1105.44s |  and then the the other don't big don't is don't trust that context as being
1105.44s - 1111.44s |  true right it's really easy for for our engineers and developers to think oh
1111.44s - 1114.68s |  yeah no this is a cookie that the customer gave us to order for them so
1114.68s - 1118.68s |  that's good right no the answer is no this is data that came from the internet
1118.68s - 1121.40s |  and we should just treat it like all the other data that came from the
1121.40s - 1128.72s |  internet a couple of dues allow this vault access to only the that one thing
1128.72s - 1135.56s |  that actually needs to go get it this way if you do if you do have any issues
1135.56s - 1140.72s |  with people trying or having the ability to connect to your vault service they
1140.72s - 1144.84s |  can't actually do anything right because you have to be running in that one
1144.84s - 1150.64s |  specific container in order to access those tokens and then the last piece
1150.64s - 1156.32s |  which is kind of my favorite is correlation IDs so anytime I need to ask
1156.32s - 1162.88s |  for a cookie from the vault I should be able to match that up to a request that
1162.88s - 1168.16s |  came from a physical device and if I can't that means that somebody that I
1168.16s - 1171.56s |  work with is going to have a bad day or I'm gonna have a bad day because
1171.56s - 1175.44s |  somebody else is creating those requests and so I think that's a thing
1175.44s - 1179.56s |  that we sort of owe to our customers when we build devices like this is a way
1179.56s - 1183.36s |  to tell them not only are we doing our best to protect your authentication
1183.36s - 1188.24s |  information from random people on the internet but we also recognize your data
1188.24s - 1192.60s |  is important to you we are not you so we shouldn't have access to it either and
1192.60s - 1199.52s |  so by by introducing those correlation IDs you can do really cool things like
1199.52s - 1204.68s |  requiring that correlation ID to exist before the request gets routed into the
1204.68s - 1208.80s |  vault or you can just set up automated alerting so that you know if it ever
1208.80s - 1216.92s |  happens you at least know about it so do's and don'ts for context so the next
1216.92s - 1222.96s |  piece securing customer conversations this one was really really fun to think
1222.96s - 1229.04s |  about so if I take out my AI walkie-talkie and I say what's my
1229.04s - 1234.00s |  favorite color there's a couple of types of data that happen there right we still
1234.00s - 1239.44s |  have our same speech-to-text request and response we still have the LLM request
1239.44s - 1245.24s |  and response and the the text-to-speech back as well so essentially I have audio
1245.24s - 1250.72s |  data and I have text data that I need to worry about as far as what type of
1250.72s - 1254.60s |  binary data it might be an audio recording but it also might be a picture
1254.60s - 1259.76s |  right maybe your your magic AI walkie-talkie takes magic photos and when
1259.76s - 1266.36s |  it takes the photo it converts it into like some cool 8-bit format I probably
1266.36s - 1270.28s |  don't want random people on the internet or even the company that makes that AI
1270.28s - 1273.88s |  walkie-talkie to have access to those pictures right because I'm a general
1273.88s - 1279.68s |  consumer why do people need access to that same thing goes with with all of
1279.68s - 1282.84s |  the the text-to-speech that we just talked about right we have a transcript
1282.84s - 1287.44s |  of what the user said we have an answer to their question and we have what we
1287.44s - 1293.76s |  want the device to echo back so how do we store that well really really easy
1293.76s - 1300.24s |  way is I have my magic AI gadget it sends a request to that super awesome
1300.24s - 1306.00s |  router that will take everything that I wrote and then just store it in a
1306.00s - 1311.64s |  database if it's binary data it'll just store it in s3 in the database I just
1311.64s - 1316.60s |  put a pointer to s3 life's great this is super easy right again we're storing
1316.60s - 1322.96s |  sensitive things about people in a database I don't want to be like going
1322.96s - 1328.52s |  to sleep at night knowing that that happens so what do we do to make life a
1328.52s - 1336.56s |  little bit safer so instead of just receiving that data from the the magical
1336.56s - 1342.84s |  device and then writing it all down again we'll do the same thing with with
1342.84s - 1349.72s |  our vault engine and so whenever we receive the data we'll actually reach
1349.72s - 1355.00s |  out to the vault engine and say can I have a kind of got two really cool
1355.00s - 1360.40s |  options here so you could have the the service send that data to the vault
1360.40s - 1365.40s |  engine have it encrypt it and then return back to you the the ciphertext
1365.40s - 1369.16s |  and now you can just write that now in the future you just have to take that
1369.16s - 1372.48s |  ciphertext and say vault engine can you give me this data in plain text please
1372.48s - 1377.12s |  the other option that you have is you can request the customers storage key
1377.12s - 1380.60s |  and you can say please give me the key for Matt Domko I have a bunch of stuff I
1380.60s - 1387.64s |  want to write in in both cases I'm not storing things that I have access to I'm
1387.64s - 1392.04s |  storing things that I only have access to for that two-minute window whenever
1392.04s - 1402.58s |  Matt Domko pushes the button so I've got some do's and don'ts for securing those
1402.58s - 1408.66s |  conversations so don't please don't use built-in types for these things right
1408.66s - 1413.82s |  the my worst day ever is whenever someone says oh yeah no we're just
1413.82s - 1416.90s |  sending this JSON and there's just like a string there and I look at it I'm like
1416.90s - 1420.70s |  okay cool it's just string no big deal and that string is actually like six
1420.70s - 1424.98s |  hours of me watching Gilmore Girls because I started a meeting
1424.98s - 1429.14s |  transcription during it so rather than taking these things and just going with
1429.14s - 1433.50s |  the defaults let's create a custom object use a strongly typed language
1433.50s - 1437.70s |  that allows you to say okay this this is actually a type of sensitive data and
1437.70s - 1443.42s |  the only way that it's allowed to be logged is either through that vault
1443.42s - 1451.22s |  controller interaction or through a secure logger so yeah don't please one
1451.22s - 1459.74s |  second so the other thing that definitely in the business-to-business
1459.74s - 1466.46s |  space it happens and it's not great but it could be worse right essentially if I
1466.46s - 1470.34s |  need to do analytics on data and I have the data in a place well let me just go
1470.34s - 1474.70s |  grab that data and do analytics it's one thing to do it whenever it's how many
1474.70s - 1479.82s |  times did my employees click on a phishing link it's another thing all
1479.82s - 1487.94s |  together for it to be a recording of me and my kid talking about something so
1487.94s - 1494.46s |  don't let it happen right don't don't share data between production and
1494.46s - 1498.98s |  anything else if you're not using that data to provide a direct value to the
1498.98s - 1504.86s |  user you're essentially stealing their data right now and I not a fan and then
1504.86s - 1510.10s |  the last one don't allow new log types without a privacy and security review
1510.10s - 1516.26s |  and so this is a thing that I've sort of started harping on a lot more work which
1516.26s - 1520.74s |  is just like if if you want to do something new and it has to do with
1520.74s - 1526.26s |  customer data we owe it to our customers to spend 15 minutes drawing out what
1526.26s - 1529.22s |  we're going to do identifying the data that we're going to write down and
1529.22s - 1533.90s |  talking about whether or not that is a good thing to do with our customers data
1533.90s - 1542.50s |  so yeah don't do that do move encryption to client-side where possible so the way
1542.50s - 1550.62s |  that it is in this diagram that I just showed you as the service provider you
1550.62s - 1556.02s |  can just grab a JWT and go get the data wouldn't it be great if the only person
1556.02s - 1560.14s |  that had your data was like you in your web browser when you get to go view your
1560.14s - 1565.02s |  pictures that would be great that's a technology that exists it's not a
1565.02s - 1569.98s |  technology that exists as far as I'm aware that works really well with AI use
1569.98s - 1573.54s |  cases where we want to get your permission to use your data to make
1573.54s - 1579.46s |  things better and so that's that's a tough it's a tough road to climb but I
1579.46s - 1585.06s |  think I think that there's it's it's a goal to move towards require a short
1585.06s - 1591.30s |  lift JWT like this is really really easy to do you just when your user wants
1591.30s - 1595.10s |  to do something make them send you a token that says that they want to do it
1595.10s - 1599.74s |  and have that expire quickly if you look into the different types of vault
1599.74s - 1605.30s |  providers that exist I know of at least one that that does that and you can give
1605.30s - 1609.90s |  them a JWT and they will only give you the data back if that JWT is signed by
1609.90s - 1614.02s |  the customer the person who owns the data I sleep a lot better at night
1614.02s - 1619.14s |  knowing that I have that and then the last piece if you've ever worked at an
1619.14s - 1625.14s |  AI company you probably have like a chat room where it's just AI news and people
1625.14s - 1628.42s |  are excited about new models and new things that are coming out and
1628.42s - 1634.98s |  anthropic has this AWS has this open AI has this and they want to try it out the
1634.98s - 1640.42s |  problem is unless you have like like a commercial agreement with them a lot of
1640.42s - 1645.50s |  times you're just sort of giving them free rein to do whatever they want with
1645.50s - 1651.62s |  your customer data and so one of the things that that I've worked really hard
1651.62s - 1655.86s |  on at the last few jobs has been making sure that we we actually make those
1655.86s - 1660.98s |  thoughtful decisions we say okay this type of data maybe we're okay with with
1660.98s - 1665.42s |  that company using it for whatever they want but this other type of data super
1665.42s - 1670.30s |  super important to us and we're not gonna allow it to to go to those levels
1670.30s - 1677.58s |  of LLMs essentially pay more to protect our customers I think it's worth it so
1677.58s - 1684.26s |  the last one is privacy focused logging so if you're an engineer and you're
1684.26s - 1688.18s |  coming up with logs for this new service you built this is probably how you're
1688.18s - 1690.54s |  gonna do your logs you're just gonna take everything that you know you're
1690.54s - 1694.86s |  like I might need this someday ship it to data doc and then one of your SRE
1694.86s - 1698.54s |  managers is gonna be like hey so your data dog bills kind of high can you cut
1698.54s - 1701.78s |  it back you're like no I need all of this need every single piece of data
1701.78s - 1707.78s |  that comes in or I can't do my job okay that's that's a way but again we're
1707.78s - 1711.90s |  talking about consumers we're not talking about business-to-business
1711.90s - 1719.86s |  operations and so if I'm a consumer and and I have to worry about every single
1719.86s - 1724.22s |  thing being stored on my behalf I start to get nervous and so what I like to do
1724.22s - 1731.10s |  in these cases is require like a custom logging handler engineers are already
1731.10s - 1734.78s |  creating these to make their lives easier all you have to do as the
1734.78s - 1739.10s |  security person to say hey so right now it looks like you're taking everything
1739.10s - 1742.06s |  you're formatting it and then you're you're shipping it out what I would love
1742.06s - 1746.94s |  for you to do is instead explicitly declare these are the the fields that
1746.94s - 1751.26s |  we're going to log and by forcing them to explicitly declare the fields that
1751.26s - 1755.82s |  they're going to log you don't have to worry about oh I just updated the code
1755.82s - 1761.90s |  to log this extra field also it's everyone's birthday and social security
1761.90s - 1765.62s |  number that's okay right you don't have to worry about that because the logger
1765.62s - 1770.34s |  won't allow it and now instead of monitoring your entire code base for a
1770.34s - 1775.66s |  change that might log something in a wrong way you only have to monitor that
1775.66s - 1782.38s |  that base privacy logger so it's definitely worth investment this code is
1782.38s - 1789.10s |  from chachi PT write me a privacy focused log handler in Python it might
1789.10s - 1794.06s |  work I don't I don't know but the the point is it's like it's not super
1794.06s - 1801.38s |  difficult and your engineers are likely already doing it anyway so some some
1801.38s - 1809.06s |  highlights on privacy focus logging prefer metrics over like actual counts
1809.06s - 1812.86s |  and group by statements whenever you're thinking about things you don't need to
1812.86s - 1817.18s |  log every single request in order to know how many requests happened right
1817.18s - 1823.94s |  and so if you don't need to store the data don't a thing that I've been big
1823.94s - 1830.66s |  about for a very long time has been the fact that business metrics and that type
1830.66s - 1835.18s |  of work needs to be a feature request of the product this is not something
1835.18s - 1839.06s |  where oh I've got a really strong program manager they're gonna go into
1839.06s - 1842.66s |  data dog and create these dashboards that are gonna tell them like what our
1842.66s - 1847.42s |  most popular feature is it's a very very easy shortcut but it's also a very very
1847.42s - 1852.34s |  easy easy way to lose control of the way that you're managing the privacy of your
1852.34s - 1859.10s |  customer data and so rather than getting into that when we do a like a product
1859.10s - 1865.62s |  design doc right let's explicitly call out I need these metrics and now it's
1865.62s - 1868.70s |  part of the product you don't have to go look through logs because you've already
1868.70s - 1874.14s |  decided I'm going to use counters instead engineering logs for engineering
1874.14s - 1880.66s |  things we talked about using custom logging classes anonymize where possible
1880.66s - 1887.82s |  sudo anonymize everywhere else so I might need to know which user I'm
1887.82s - 1891.98s |  dealing with whenever I'm solving an engineering challenge I don't need to
1891.98s - 1897.70s |  know that users email I don't need to know that users address I don't need to
1897.70s - 1903.66s |  know any of those things I just need to be to be able to say user 1 2 3 of a
1903.66s - 1908.26s |  thousand and so this is where when we do logging rather than logging all of the
1908.26s - 1912.54s |  information we have about that that customer let's just log a sudo
1912.54s - 1917.14s |  anonymized user ID it doesn't provide access to anything but it lets us sort
1917.14s - 1923.54s |  of work through the streams and track down when bugs happen set an extremely
1923.54s - 1928.10s |  short time limit for your your engineering logs if you need something
1928.10s - 1932.54s |  for longer than a week two weeks that should probably live somewhere else
1932.54s - 1938.10s |  probably doesn't need to be in Datadog your CFO is gonna thank you and so are
1938.10s - 1941.26s |  your customers because you're not storing their personal data somewhere
1941.26s - 1948.14s |  that you don't need to enforce just-in-time logging so I think one of
1948.14s - 1953.50s |  the coolest and scariest things about joining an engineering team at Facebook
1953.50s - 1957.50s |  is like the first two days when they're like oh yeah and by the way if you look
1957.50s - 1961.30s |  at anyone that you work with's data we're gonna fire you and I'm just like I
1961.30s - 1964.30s |  don't even want to accidentally do that you're paying me really well I get free
1964.30s - 1970.92s |  pizza like why would I mess that up and the way that they enforce that is if you
1970.92s - 1975.06s |  need access to something and you don't have it by default you just go find the
1975.06s - 1980.12s |  table and say I would like access to this I need it for this long and this is
1980.12s - 1985.96s |  my business purpose behind it and as long as it's not like your ex-partners
1985.96s - 1994.36s |  page it'll just grant you access and log it and I feel like it's way better to
1994.36s - 1998.76s |  have that then oh yeah just everybody in engineering has access to everything all
1998.88s - 2003.44s |  the time so that that just-in-time access gives us again a little bit more
2003.44s - 2007.84s |  safety and a little bit better of a way to recognize when something's going off
2007.84s - 2013.44s |  the rails all of the do's and don'ts that we talked about in in the other two
2013.44s - 2020.68s |  sort of apply to privacy focused logging as well all right the last one privacy
2020.68s - 2026.32s |  focused analytics so if I'm got a feature that's out there it's doing
2026.32s - 2029.88s |  great things but I want to make it faster but I don't understand what
2029.88s - 2034.48s |  requests are happening and so I need to like actually see these requests in
2034.48s - 2041.32s |  order to make the product work better well 18 year old Matt Domko goes into
2041.32s - 2046.96s |  the routing engine and he just adds a new branch of code for 2a that says yeah
2046.96s - 2051.32s |  so anytime somebody makes a request I want you to go do the thing that you
2051.32s - 2057.12s |  always do but also lock a copy of it to my analytics storage and then once that
2057.12s - 2060.84s |  table is super full or that bucket has all the data I need I can go in and do
2060.84s - 2065.88s |  some sort of analytics process on it the problem with that is in order to solve
2065.88s - 2070.88s |  whatever challenge I'm facing again I probably don't need to know the
2070.88s - 2075.72s |  customers name I don't need to know all of the things that they did I probably
2075.72s - 2081.96s |  just need to know what's the length of their request and what time was it when
2081.96s - 2086.72s |  they made the request well whatever the thing is that I need it's probably not
2086.72s - 2094.88s |  everything so the way that the way that I've thought about handling this we have
2094.88s - 2104.36s |  our our new analytics logger and again we still insert it into 2a but instead
2104.36s - 2108.80s |  of having it directly write data outside of my little nice fancy
2108.80s - 2112.52s |  production bubble where data never leaves I read it to a privacy filtering
2112.52s - 2117.08s |  account and so that privacy filtering account whenever it receives new data it
2117.08s - 2122.24s |  reaches in and it says oh I'm expecting that Matt needs to know the locations of
2122.24s - 2130.08s |  every failed uber request and so what that privacy filtering lambda will do is
2130.08s - 2136.84s |  it will just extract the location and the time that that it happened because I
2136.84s - 2141.44s |  don't need to know anything else about that conversation or what's going on
2141.44s - 2146.48s |  except for that one single line so why would I allow myself to copy the entire
2146.48s - 2151.56s |  thing out so I create this process where in order to get data out of production I
2151.56s - 2155.32s |  ensure that it's anonymized I ensure that I only have the data that I need
2155.32s - 2161.12s |  once that data has been cleaned we've ran it through something like Amazon
2161.12s - 2165.92s |  Macy to check for PII and things like that then we'll go ahead and copy it
2165.92s - 2171.68s |  from the privacy account into the analytics account analytics is already
2171.68s - 2177.28s |  expensive and so like this additional process that we're introducing in order
2177.28s - 2188.83s |  to protect our customers is totally worth it and so we've got a summary of
2188.83s - 2194.51s |  the the things that that have made my life easier in protecting customers
2194.51s - 2201.99s |  privacy the first thing simple data classification guide anyone that was
2201.99s - 2205.15s |  ever in the military they've got like those colors and when you see colors
2205.15s - 2208.79s |  you're like oh this is sensitive I shouldn't do anything wrong with this oh
2208.79s - 2214.27s |  this is green I think I can do whatever I want with this but let me check having
2214.27s - 2219.75s |  some sort of simple guide where your engineers know if data is labeled as red
2219.75s - 2224.95s |  that means it can't leave leave prod if data is labeled as yellow it means it
2224.95s - 2230.79s |  can go from prod into the privacy account into an analytics account if
2230.79s - 2236.99s |  data is labeled as green it's on the website so who cares but coming up with
2236.99s - 2242.27s |  those shortcuts for your engineers it's gonna make your life a lot easier build
2242.27s - 2246.59s |  that culture of design reviews show up to them I know that our engineers build
2246.59s - 2251.55s |  a lot of really cool stuff all the time and that means I'm gonna be at more
2251.55s - 2255.55s |  meetings but again it's worth it you're learning more about the product you you
2255.55s - 2259.11s |  have a chance to actually step in and say well what is this data and why do
2259.11s - 2265.51s |  you actually need to store it or move it or read it so build that culture show up
2265.51s - 2272.47s |  to those things service control policies so these exist I know in AWS
2272.47s - 2276.47s |  and Azure does GCP have something like this where you can say you're not allowed
2276.47s - 2282.07s |  to break this rule no matter what I don't care who you are yeah okay and so
2282.07s - 2285.79s |  set that up if you have a production account where all of your day-to-day
2285.79s - 2290.27s |  data exists make it so you can't mess it up no data is allowed to leave
2290.27s - 2296.19s |  production except for to go to this singular privacy account it works fairly
2296.19s - 2299.87s |  well and it keeps you out of trouble when you're traveling or at a conference
2299.87s - 2305.91s |  talking about privacy the two-step filtering process that we talked about I
2305.91s - 2310.35s |  feel like that's the only way that we can truly ensure we're not accidentally
2310.35s - 2315.55s |  moving data somewhere we shouldn't and so think about how to implement something
2315.55s - 2319.91s |  like that there's tons of services and all the different cloud providers that
2319.91s - 2326.27s |  will parse your data and tell you yes or no this can this can go or this yes
2326.27s - 2334.11s |  or no this has sensitive data in it I just learned about s3 bucket filtering
2334.11s - 2341.83s |  that I don't remember the exact name but anyway you can create a new s3 access
2341.83s - 2346.43s |  point we'll go with that you can create a new s3 access point and say through
2346.43s - 2351.71s |  this access point you can only read filtered data which kind of takes your
2351.71s - 2354.75s |  hands away from having to do anything as long as you only let your developers
2354.75s - 2365.46s |  read through that singular access point oh yes almost done so a couple of
2365.46s - 2369.34s |  guidelines that that I've set with the teams that I've worked with in the past
2369.34s - 2374.90s |  this is this is the one that you screenshot and and send to everyone and
2374.90s - 2380.66s |  it's really just four questions are you logging a new type of data we should
2380.66s - 2383.98s |  talk are you moving data outside abroad we
2383.98s - 2389.46s |  should talk are you connecting to broad databases we should talk are you
2389.46s - 2395.18s |  bringing in a new tool or vendor we should talk I think like those are
2395.18s - 2401.06s |  fairly easy to do in practice and it's worth the extra time that that we have
2401.06s - 2411.98s |  to invest that's it what time is it 442 I've time for questions if anybody has
2411.98s - 2420.15s |  any if not I'm gonna get off the stage and chug a bunch of water Oh contact
2420.15s - 2428.35s |  page so hashtag cyber on the Twitter and if like you're worried about your
2428.35s - 2443.74s |  rabbit r1 security at rabbit tech don't that guy right there cool well thank
2443.74s - 2447.14s |  you everybody have a great time


url: https://www.youtube.com/watch?v=fs0QR7fPnJg
title: DEF CON 32 - D0N0H4RM Cyber STEM Storytime - Panel
type: video
author: DEFCONConference
ingestion_date: 2024-11-09
transcription_model: large-v2
chunking_status: completed
content:
{
  "webpage_url": "https://www.youtube.com/watch?v=fs0QR7fPnJg",
  "title": "DEF CON 32 - D0N0H4RM  Cyber STEM Storytime - Panel",
  "description": "All-star panel discussing Cyber STEM",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 3261,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241016"
}

0.00s - 9.92s | This text was transcribed using whisper model: large-v2

 All right, Defcon. How tired are you of people asking you how you're doing? Yeah? Cheer really
9.92s - 17.23s |  loudly if you're really tired of that. The other thing I'm trying to do is get people
17.23s - 24.71s |  out there to realize how good a time you guys are having in here. So I'm going to say, um,
24.71s - 30.23s |  no one doesn't like cake, right? I mean, cake is universally. Can we all cheer for cake?
30.23s - 38.95s |  Yeah! Everyone out there, come in here. All right, folks. Welcome to, uh, another creator
38.95s - 44.79s |  stage talk. We have some killer folks here to talk to you about some very pressing issues.
44.79s - 48.39s |  And I know we started out with cake, which is going to be the high mark. We're going
48.39s - 52.11s |  to be talking about healthcare, cybersecurity, medical devices, whistleblowing, and a bunch
52.11s - 56.43s |  of other really cool stuff. In some sense, it can be a little bit of a downer. So I don't
56.43s - 59.51s |  have any trigger warnings or anything for our panel, but the only thing I'll ask is
59.51s - 62.87s |  for the audience, uh, we'll have an opportunity for a little Q and a at the end, unless we
62.87s - 68.23s |  go really over, uh, but just be respectful of the community and other folks. Uh, because
68.23s - 72.19s |  sometimes this can be a really personal thing as we're going to talk about. I think the
72.19s - 76.75s |  first thing we're going to do is actually go down the line and do introductions. And
76.75s - 80.35s |  before I do that, can you guys hear us? Okay. I know we're competing over here. You guys
80.35s - 84.27s |  are good. All right. So let's go ahead and, uh, let's go right down the line, Matt on
84.27s - 89.23s |  and go to introduce yourself, tell the crowd what you do. And, uh, we'll get going on to
89.23s - 94.87s |  the real good questions. All right. After you, sounds good. Um, I'm Matt Hazlett. I'm
94.87s - 102.27s |  the chief regulatory officer at MedSec currently. I most recently left the FDA a couple of weeks
102.27s - 108.23s |  ago. Um, I was at the FDA for eight and a half years. Um, started getting very involved
108.23s - 115.51s |  in the cybersecurity policy, um, and implementation efforts. So I was very involved in the pre-market
115.51s - 122.59s |  cybersecurity guidance, writing a significant portion of that, um, and overseer oversaw
122.59s - 128.31s |  our implementation efforts. So the reviewer resources training of how we were going to
128.31s - 131.83s |  review cybersecurity, given our new statutory authorities,
131.83s - 143.90s |  Hi everyone. I am Erica Chung. I'm currently the executive director of a nonprofit called
143.90s - 149.46s |  ethics and entrepreneurship. Uh, my interest in the safety of medical devices started
149.46s - 156.62s |  off at my very first job. When I was 22 years old, I was a lab associate working for a biomedical
156.62s - 162.06s |  company called Theranos, which ended up being a $9 billion fraud scandal, which I was one
162.06s - 167.14s |  of the key whistleblowers who reported the company to regulators that stopped them from
167.14s - 175.94s |  utilizing a faulty device on patients. And, uh, I am also involved, uh, as a board member
175.94s - 180.86s |  of whistleblowers of America, which we provide mental health services and peer support for
180.86s - 186.78s |  whistleblowers across the United States. And also a advisor to the signals network, which
186.78s - 194.54s |  is a agency that helps whistleblowers with legal advice, uh, safe housing, uh, funding
194.54s - 200.14s |  job placement in the event that, um, they are in need of those services.
200.14s - 202.34s |  Give it up for Erica.
202.34s - 210.18s |  Hey everybody. Um, I'm Andrew Carney. Uh, I'm a program manager at a relatively new
210.18s - 216.82s |  federal agency ARPA-H where I work on healthcare cybersecurity, uh, patient data privacy. Um,
216.82s - 221.22s |  I'm also the program manager for the AI cyber challenge at DARPA. Uh, so if you haven't
221.22s - 225.90s |  already, please come visit us next door, uh, and spend some time there, have some fun.
225.90s - 231.10s |  And before all of that, um, I spent most of the last 15 years as a vulnerability researcher
231.10s - 239.58s |  and a painful CTF player. Um, and I am now semi-retired from that fabulous pastime. Um,
239.58s - 243.50s |  please go check out DEF CON CTF as well. If you haven't, the folks put on an amazing game.
243.50s - 249.54s |  Um, and I'm super excited to be, uh, so the last year, uh, plus in healthcare, uh, looking
249.54s - 253.94s |  at the health cybersecurity of healthcare and, um, coming from a very offensive kind
253.94s - 259.14s |  of mindset, uh, just seeing what we can, seeing what we can do from a defensive kind of position
259.14s - 263.74s |  and, and really, um, hoping to supercharge kind of our efforts to safeguard, uh, this,
263.74s - 264.74s |  this sector.
264.74s - 265.74s |  Give it up, Andrew.
265.74s - 277.38s |  I'm the deputy director of CISA. Hopefully you've heard of us, some ways you've performed.
277.38s - 282.54s |  Um, and, uh, my earlier in my career, I was actually a hospital administrator and a flight
282.54s - 286.94s |  medic. So I started my career in healthcare. So it's great to be here today to merge cybersecurity
286.94s - 290.82s |  and healthcare together and talk about what we can all do, uh, to continue to make the
290.82s - 297.26s |  sector more safe. Thanks.
297.26s - 301.02s |  All right. So we're gonna, yeah, this is give it up for the whole panel. Try to beat them
301.02s - 309.30s |  out next door. All right. I think it's important to level set a little bit, but I want to take
309.30s - 313.54s |  a poll. The audience real quick, raise your hand. If you work in healthcare, some adjacent
313.54s - 318.30s |  field, raise your hand. There's no one in this audience. This is all brand new for you.
318.30s - 323.14s |  I take it. Just kidding. It's like everyone, it's like my high school reunion out there.
323.14s - 327.38s |  All right. I do think it's important for us to level set a little bit. And we're gonna
327.38s - 331.38s |  talk about threat land landscape a bit. I have some, a little bit of a couple of slides
331.38s - 337.18s |  at the end, but a deputy director, you could tell us a little bit more than about the threat
337.18s - 343.58s |  landscape and what you're seeing kind of nationally about healthcare ransomware because, and just
343.58s - 347.86s |  healthcare threats, generally speaking, just give us a little bit of a one-on-one and what
347.86s - 348.86s |  do you see?
348.86s - 352.42s |  Thanks for sure. I think the big thing we're trying to message out to folks as we look
352.42s - 356.90s |  at the healthcare sector, we're seeing an increase in the volume frequency and complexity
356.90s - 361.70s |  of attacks against the healthcare sector, not just in the United States, but globally.
361.70s - 367.04s |  I think when we think about healthcare, if we go back to kinetic warfare going back centuries,
367.04s - 372.14s |  we never attacked hospitals, right? We always protected healthcare providers. We always
372.14s - 376.42s |  protected the tents with the red cross on it. We never attacked those institutions,
376.42s - 380.50s |  but today we're seeing attacks against healthcare organizations throughout the country. This
380.50s - 384.66s |  is not just about urban America. We're seeing attacks against rural America as well, where
384.66s - 389.14s |  arguably healthcare systems are more critical in those communities, given the access to
389.14s - 393.34s |  care and the access to backup care is much further away and the consequence of patient
393.34s - 398.50s |  safety is even greater. As we look at a lot of, everyone has published a top three or
398.50s - 404.98s |  a top five list of ransomware attacks or sector impacts. Healthcare continues to be in that
404.98s - 409.78s |  top three and top five list of every list that I see as sectors that are being attacked
409.78s - 413.34s |  by our adversaries. And we're not just talking about nation states. We're not just talking
413.34s - 417.30s |  about China, Russia, Iran, North Korea. We're seeing cyber terrorists and cyber criminal
417.30s - 422.38s |  organizations also attacking healthcare. Why they foresee money there. They know that,
422.38s - 427.54s |  I think healthcare facilities are kind of one-stop shops. You have access to PII, you
427.54s - 430.94s |  have access to billing information, you have patient information, you have information
430.94s - 435.06s |  that essentially people don't want out in the public space that you can get a hold of.
435.06s - 439.02s |  It really is that one-stop shop and our adversaries know this. So we're continuing to see this
439.02s - 442.94s |  increase in attacks against healthcare, which is why it's even more critical today to make
442.94s - 446.62s |  sure that we're building resilience across the healthcare space. And when we talk about
446.62s - 452.34s |  healthcare, it's not just hospitals, it's that entire spectrum that's needed for healthcare
452.34s - 458.58s |  to be delivered. So it includes medical manufacturing, distribution of pharma, labs, blood, biotech,
458.58s - 464.10s |  health IT, insurers, payers, HMOs, that entire spectrum that's needed for that clinical care
464.10s - 467.26s |  to be delivered. And we want to make sure that we're continuing to build resilience
467.26s - 470.06s |  across the board.
470.06s - 474.02s |  That is awesome. And I have a couple slides to now take a little bit of another audience
474.02s - 481.02s |  poll here. Raise your hand if you've ever had your medical records leak or be breached.
481.02s - 487.22s |  Raise your hand. All right. That number is growing every time. I'm going to just take
487.22s - 491.82s |  a gut pull here for anyone brave enough to raise their hand. Has anyone had their clinical
491.82s - 497.10s |  care impacted by some type of cyber attack? Maybe your appointment was canceled. I'm seeing
497.10s - 501.74s |  a couple of hands. Maybe you couldn't go to the hospital that was nearby. You heard
501.74s - 506.54s |  about that? Now there's a couple hands. That's going to increase because what are we seeing
506.54s - 514.34s |  now? You know, 2024 has been a banner year for healthcare ransomware. And we're seeing
514.34s - 519.26s |  big attacks and some not ransomware things like CrowdStrike. But what I wanted to show
519.26s - 524.10s |  you guys is for those of you who don't really work in this very often, now it's not just
524.10s - 531.58s |  about privacy of data. It's not just about the financial threat. It's also about threats
531.58s - 540.78s |  to clinical care and human life. And so here's some social media I grabbed based on one of
540.78s - 545.18s |  these attacks this year about people that were working. These are doctor and nursing
545.18s - 551.10s |  forums on Reddit and other places where they basically talk about their experience working
551.10s - 556.38s |  at some of these hospitals during a ransomware attack. And so in true DEF CON fashion it's
556.38s - 561.90s |  stuff like largest hospital system in the country is under attack. No one knows where
561.90s - 569.22s |  the forms are. We got a separate sign out. Nursing staff was trying to communicate what
569.22s - 573.74s |  medications patients are on. Had to do stuff from memory. We were just told the internet
573.74s - 577.46s |  may be out for days. We're still on a previous owner's network and they're down in multiple
577.46s - 581.58s |  states. And then there's a nursing comment here. Vermont here, they never taught me how
581.58s - 588.86s |  to use paper chart in nursing school. What about this one? We brought a trauma patient
588.86s - 593.46s |  to an Ascension hospital and the trauma team was freaking out because half the team didn't
593.46s - 598.50s |  get the page or notification. They're down doing paper charts, handwriting orders and
598.50s - 607.30s |  doing consults over their personal phones. The top comment says they couldn't get Tylenol
607.30s - 618.54s |  for a patient that needed it for two hours. We also learned a lot about critical connected
618.54s - 623.42s |  infrastructure this last year with things like CrowdStrike where it wasn't even an attack
623.42s - 628.38s |  but we saw huge amounts of hospitals go down as a consequence. And this is a couple social
628.38s - 633.82s |  media grabs I pulled for the CrowdStrike issue. I swear to you I pulled this image on the
633.82s - 639.46s |  left here right off of Reddit. So when the hospital went down, they took all their patients
639.46s - 643.14s |  and had to write them on a white board where they were, what their name was and what the
643.14s - 650.98s |  current issue was. On the same white board below they drew this picture. The ICU telemetry
650.98s - 656.40s |  monitors are down. They said that the ones in the NICU weren't operational. They're unable
656.40s - 660.86s |  to upload labs. How many of you folks think this type of stuff is really important? The
660.86s - 665.02s |  ability to do laboratory tests and imaging and do things in the electronic health record.
665.02s - 670.62s |  Raise your hand. How many of you feel like doctors and nurses can't be good at the jobs
670.62s - 674.70s |  of taking care of their sick patients without these things? Raise your hand. You are correct.
674.70s - 680.70s |  And so we're going to go into kind of the first question at the tip of this little period
680.70s - 686.46s |  here. Cyber attacks degrade, delay, disrupt and decay the digital systems that power timely
686.46s - 690.94s |  life-saving medical care. And for this we're going to go into this Q&A and try to get
690.94s - 694.30s |  some amazing insights from the folks here. But I also remind you there's an opportunity
694.30s - 699.68s |  at the end to ask some questions yourself. So the first question has to do with a lot
699.68s - 705.62s |  of what we continue to learn more about every year is this interdependency. So after 2008,
705.62s - 711.30s |  the financial crisis, the nation went under a painstaking process to try to better understand
711.30s - 715.78s |  and map the dependencies of the financial sector. To understand if this bank fails,
715.78s - 721.78s |  what will happen to the rest of it? In 2024, we've seen a bunch of attacks, change, ascension
721.78s - 726.62s |  and then Krauszak was an attack. But the question I have for the first part of this panel is
726.62s - 731.74s |  should the U.S. undergo a similar mapping exercise, right? Where we understand where
731.74s - 736.74s |  the critical interdependencies, third party risk are of healthcare delivery organizations
736.74s - 741.66s |  in this country because to my knowledge, no one knows what's going to happen. No one knows
741.66s - 746.38s |  where the linchpins of linchpins are. We have a pile of them. So the first question
746.38s - 750.46s |  is what do you all think about mapping the sector dependencies and what we should do
750.46s - 753.42s |  about that? And this is not a new thing and we've been doing it for a little bit but let's
753.42s - 755.26s |  learn about it now. What's going on?
755.26s - 761.26s |  So I'm happy to go first. I'm a huge fan of mapping out the sector, something I tried
761.26s - 766.86s |  to do actually when I was at HHS back in 2009. I think the challenge is it's getting that
766.86s - 771.58s |  visibility and I think we've made some progress. CISA right now is trying to look at, can I
771.58s - 774.78s |  ask any consequence analysis and part of that is really understanding, mapping out
774.78s - 779.62s |  the sectors, understanding where those critical nodes are. I think so we are much further
779.62s - 783.78s |  ahead than where we were 20 years ago but I still offer we're still nowhere near where
783.78s - 792.14s |  we need to be to truly understand those interdependencies within a sector, much less between sectors.
792.14s - 797.74s |  I think the other part of it is is getting visibility to understanding the actual software
797.74s - 801.26s |  platforms and the other challenges. So it's one thing to say that the connections exist
801.26s - 806.62s |  between this type of financial system and healthcare and agriculture and those types
806.62s - 811.18s |  of entities but to get to that next level to understand the market space, to understand
811.18s - 815.22s |  that is just a massive undertaking. We've done, there's pockets of it. There's a great
815.22s - 820.46s |  report from 2013 that looked at working through the Department of Commerce that looked at
820.46s - 825.26s |  understanding global supply chain issues for pharmaceuticals and some medical devices.
825.26s - 829.34s |  So there's pockets of this type of information out there but we don't have the ability yet
829.38s - 834.34s |  to kind of coalesce it. We've launched a recent IT tool called Star that we're trying to use
834.34s - 838.22s |  to really understand some of that but it's still at a very macro level. There's a lot
838.22s - 842.02s |  more that needs to get done. A lot of that information is proprietary so getting access
842.02s - 846.34s |  to it is somewhat of a challenge and then frankly the question I always ask when we
846.34s - 850.26s |  think about how the government should be asking questions and getting information, the next
850.26s - 854.06s |  question I always ask is what are we going to do with it? I never want to be in a government
854.06s - 858.90s |  agency where we're asking for information that we can't actually use to have some return
858.90s - 862.78s |  on investment and value back to the people providing information and understanding what
862.78s - 866.62s |  that looks like is another piece that we're trying to figure out. How do we get information
866.62s - 871.54s |  and how do we ensure there's an adequate ROI back to those information sharers that can
871.54s - 874.58s |  help them increase their cyber defense posture?
874.58s - 881.58s |  Just kind of building on that, I mean the, it's really interesting talking to different
882.10s - 888.86s |  stakeholders in both industry and government about their introspection into kind of the
888.86s - 894.70s |  interdependencies and then the acknowledgement that there may be common good kind of upstream
894.70s - 899.06s |  but perhaps a reticence to actually provide the information that would enable that common
899.06s - 906.06s |  good to manifest and so there we've, you know, talking to folks over the last year and sort
906.34s - 911.02s |  of trying to identify like how do we get a lot of value from investment of public kind
911.02s - 915.30s |  of public interest of taxpayer dollars from a research perspective, from a kind of transition
915.30s - 920.50s |  or ops perspective, how do we find those really high value points to insert, inject
920.50s - 927.10s |  kind of like support and it requires collaboration at a pretty large scale but it doesn't necessarily
927.10s - 931.66s |  require exposure like for, you know, the folks that are, that we would need to kind of talk
931.66s - 935.98s |  to that we are talking to, you know, folks are getting braver and that's a very good
935.98s - 941.68s |  sign and sort of recognizing that this is, you know, we all win together or we all lose.
941.68s - 945.04s |  So I think we're making progress but we could definitely make progress faster.
945.04s - 952.04s |  I'd say on the medical device side it's incredibly interesting to think about how to scope such
955.48s - 961.56s |  an exercise because you're going to have differences, the medical device landscape is incredibly
961.56s - 968.56s |  complex when you're ranging from implants to bedside equipment, capital equipment, software
969.56s - 976.08s |  functions that only operate on a mobile device or in the cloud, then looking at what's actually
976.08s - 983.08s |  used in different facilities and whether there's differentiation between similar devices from
983.20s - 990.20s |  other manufacturers. So if you have one issue from one device type, do they have a backup
990.44s - 997.44s |  that can still have some continuity of care? We've also seen a lot of discussions around
999.32s - 1005.32s |  hospital CISOs trying to figure out how to respond to ransomware and what devices are
1005.32s - 1011.68s |  relying on network or external connections because the initial response is to pull that
1011.68s - 1018.68s |  network down and retract in order to better defend the larger ecosystem. But we've seen
1019.92s - 1026.16s |  instances where all of a sudden the product security people are running to those CISOs
1026.16s - 1032.56s |  or they flip the switch to tell them that if they do that they have surgeries in progress
1032.56s - 1038.76s |  that would be interrupted because they're losing that live access. So how do we maintain
1038.76s - 1045.36s |  that continuity of care in response and how do we know what would be impacted based off
1045.36s - 1050.80s |  of different actions that could be taken to resolve some of these issues? So the mapping
1050.96s - 1056.80s |  can get incredibly complex. So then it's the how do you approach it and how do you make
1056.80s - 1063.80s |  it useful for the facilities that are using it as well as useful for government regulators
1064.60s - 1076.20s |  to help in response activities as well. Kind of a terrifying thought. So many times when
1076.20s - 1081.00s |  I think about these types of problems, I'm always like, surely someone has done this
1081.04s - 1086.64s |  and surely we have really great data on this. And so the thought of that we don't really
1086.64s - 1093.00s |  even understand these interdependencies at any deep level and certainly don't have visibility
1093.00s - 1097.36s |  over the entirety of the problem makes me think about how many other CrowdStrike-like
1097.36s - 1101.40s |  issues we're going to have. Or like what's going to happen when, we'll talk about this
1101.40s - 1105.24s |  in a little bit, when there's only really three or four electronic health record vendors
1105.24s - 1110.60s |  in the whole country and we don't understand the technical plumbing behind it and understand
1110.60s - 1114.00s |  what's really going to happen when something goes down. All right, we're going to go to
1114.00s - 1119.84s |  question two here. All right, this question does not apply to anyone in this room, I guarantee
1119.84s - 1125.34s |  it. Just kidding, it's everyone. Hackers, cyber security professionals employed at health
1125.34s - 1130.04s |  systems, medical device manufacturers are often not considered whistleblower protections
1130.04s - 1137.16s |  unless they see criminal activity. But we hear time and time again from folks in these
1137.16s - 1142.64s |  spaces that they see problems and they can't fix them. And they're increasingly worried
1142.64s - 1148.72s |  about what would happen when these issues are not fixed. So my question to the panel
1148.72s - 1156.12s |  is really just talking about should we expand protections to folks in technical healthcare
1156.12s - 1161.32s |  roles or you could say technical roles more broadly that offer some protections when they
1161.32s - 1166.84s |  don't necessarily cross the line of criminality but they believe in good faith that there
1166.84s - 1175.24s |  is going to be some issue before the ransomware hits. So maybe also take it away.
1175.24s - 1180.48s |  So I think when these whistleblower complaints sort of come about, you have to understand
1180.48s - 1185.44s |  where they exist. Is it happening internally in the company? And is there a concern that
1185.44s - 1190.20s |  you can address with the internal controls that exist within a company? And a lot of
1190.20s - 1196.04s |  that is do you have the leadership buy-in? Do you have the board buy-in to take cyber
1196.04s - 1201.16s |  security concerns seriously? And how do you sort of implement that culture within that
1201.16s - 1208.68s |  organization to have them say this is a top critical issue in order to maintain good business
1208.68s - 1214.80s |  practices, in order to maintain patient safety by the examples that you have seen. And so
1214.80s - 1220.96s |  there's a lot of work to be done in terms of what can the infrastructure within an organization
1220.96s - 1225.28s |  look like so the people that are working with these technologies can action on them
1225.28s - 1231.20s |  appropriately. And then there's the sort of external whistleblower. I've tried to basically
1231.20s - 1236.08s |  work within my organization. It doesn't seem like these issues are going to be addressed.
1236.08s - 1242.62s |  So what do I do now? Who do I turn to in order to prevent some major crisis from happening?
1242.62s - 1248.28s |  And I will say if there are lines that are crossed, if say a company does not make a
1248.36s - 1254.44s |  disclosure about a hack that has happened, then there are ways in which you can report to the
1254.44s - 1259.00s |  SEC that they didn't make the appropriate disclosures for the information that was
1259.00s - 1265.96s |  granted. And you are covered under federal whistleblower protections in those cases.
1265.96s - 1270.76s |  And then there are also several different whistleblower protections that exist at a state
1270.76s - 1276.84s |  level. But it has to sort of pay attention to what those agencies are. And then it also depends
1276.84s - 1283.16s |  what type of regulatory agency. Are you talking to the HHS? Are you talking to the SEC? Who are
1283.16s - 1289.16s |  the appropriate parties involved that can help guide you through the process of getting
1289.16s - 1295.24s |  the concern addressed? Whether it's patient information that shouldn't have been disclosed
1295.24s - 1299.96s |  that is disclosed, whether it's a ransomware attack that instead of sort of addressing that
1299.96s - 1308.04s |  and submitting that to the FBI or someone else that that happened. And with those, there should
1308.04s - 1313.88s |  be expansion of those protections for some of these people. But it's also about kind of turning
1313.88s - 1318.92s |  back to the internal controls. What most of these people who are reporting these concerns are
1318.92s - 1325.24s |  concerned about are, can I maintain my anonymity? If I can't maintain my anonymity, will I be able
1325.24s - 1331.72s |  to keep my job? Am I going to face any type of retaliation? Is there going to be litigation
1331.72s - 1338.04s |  involved? Is there going to be public backlash? Am I going to get blacklisted from my career?
1338.04s - 1343.08s |  And so I think that's some of the things fundamentally and structurally, both in terms of
1343.08s - 1349.32s |  like how we treat people who report concerns, in addition to the sort of external infrastructure
1349.32s - 1355.40s |  that we need to take into consideration, considering we're seeing so many people speak up
1355.40s - 1359.16s |  about the fact that they're seeing these attacks, but they don't really know what to do because
1359.16s - 1364.52s |  there's not necessarily enough external pressure to address them just yet. So I think those are
1364.52s - 1370.04s |  some of the fundamentals to pay attention to when it comes to working with people who are
1370.04s - 1374.92s |  concerned about these issues, but the regulatory landscape isn't as clear cut yet.
1375.00s - 1380.68s |  Raise your hand if you've ever worked for a healthcare organization, you had some real
1380.68s - 1384.92s |  concerns about the security, you raised them a bunch of times and then nothing happened and
1384.92s - 1393.56s |  you found a new job. Raise your hand. Yep. That's a common story. There should be more hands up.
1393.56s - 1402.76s |  I've talked to you guys at bars. Anything else? Any comments? I'm going to pull a little bit of
1402.76s - 1406.44s |  a thread out of that if that's all right. I was just amazed at the work that you do to support
1406.44s - 1411.16s |  whistleblowers. And one of the things I learned is how much you do to support the mental health
1411.16s - 1415.96s |  and wellbeing of these whistleblowers as they go through incredibly stressful situations.
1415.96s - 1420.68s |  I imagine there are folks in this audience that feel similarly, those stress and pressure. And
1420.68s - 1425.32s |  if we could just take a moment, if you have any advice, suggestions, anything that folks out there
1425.32s - 1431.56s |  that might feel some of those constraints that they could access. Yeah. I always tell people
1431.56s - 1437.80s |  whistleblowing is a last resort. You shouldn't really rely on like one David against a Goliath
1437.80s - 1442.44s |  for some of these issues. So the best way to help whistleblowers is usually to
1443.16s - 1449.40s |  figure out how to build the infrastructure to address concerns early because it's an incredibly
1449.40s - 1454.44s |  stressful process. I haven't met a single person that this hasn't deeply affected their families,
1455.08s - 1459.80s |  their mental health, their careers, their professions. It's an incredibly stressful
1459.80s - 1468.36s |  process that is very difficult to negotiate and navigate. So people who ever witnessed someone
1468.36s - 1472.68s |  in that position, the more support infrastructure you can build around those people, the better
1472.68s - 1477.96s |  they're going to fare. And then if they are, if you are in a position that you're reporting a
1477.96s - 1483.64s |  concern, the biggest piece of advice is try to find a lawyer, a lawyer, you can work on contingency
1483.64s - 1489.16s |  and not just the lawyer that your company provides because you need someone who's going to protect
1489.24s - 1494.60s |  your own interest and really show you the landscape of how you can appropriately protect yourself.
1495.24s - 1501.32s |  And then additionally to that, you know, there are lots of advocacy agencies, non-profits that are
1501.32s - 1507.40s |  here to help and to support people who are going through that tough process, whether it's
1507.40s - 1512.84s |  Whistleblowers of America, whether it's different regulatory agencies that have a Budsman's programs
1512.84s - 1518.04s |  that are meant to really support the people who are coming forward. But make sure you have a
1518.04s - 1523.56s |  good support network of the right people through it because it's really critical for people in that
1523.56s - 1531.00s |  position. Give it up. That's really great stuff. All right, we're going to shift back gears to some
1531.00s - 1537.88s |  medical devices. All right. There are no legacy medical devices in hospitals anymore. We fixed
1537.88s - 1545.00s |  the problem, right, Matt? You fix it? No. Oh, wow. I don't have trillions of dollars.
1545.88s - 1551.24s |  They're often cited as a major source of risk for hospitals. They have antiquated operating
1551.24s - 1557.08s |  systems, unpatched remote vulnerabilities. They're often deployed on super flat networks.
1557.88s - 1563.32s |  And this is not just a problem in rural America or poorly resourced hospitals. I mean, we see
1563.32s - 1570.36s |  similar types of really concerning implementations, deployments in larger hospitals as well, some of
1570.84s - 1576.44s |  which you might actually get care at. The question I have for here is talking about upgrade. And I
1576.44s - 1581.56s |  think this is going to be a really important thing to talk about. How can we take this problem of
1581.56s - 1589.40s |  patching legacy medical devices that should have, many people thought would have been solved by now,
1589.40s - 1593.00s |  like 20 years ago. You think people would have been like, oh, we're not going to be talking
1593.00s - 1598.12s |  about this at DEF CON 32 anymore. So clearly what we're doing isn't working. What's some new
1598.12s - 1602.84s |  approaches we can get at, Andrew, that I think would be a good opportunity for us to get into?
1603.48s - 1610.12s |  You're very kind, Christian. You're very kind. So yeah, the legacy medical device problem,
1610.12s - 1614.68s |  or the legacy device problem generally is especially problematic in healthcare because
1614.68s - 1621.32s |  of how many devices we use to provide care, to provide high quality care. And so getting the
1621.32s - 1626.92s |  most life out of a system that's still performant, right, there's a lot of value in that. But if the
1626.92s - 1631.08s |  security pieces of that, if the security or connectivity or interoperability elements of that
1631.64s - 1635.24s |  device, despite its ability to provide care, maintaining, you know, being sufficiently
1635.24s - 1640.60s |  performant, if it can't, maybe not, I would have, if you would ask me 15 years ago to
1641.72s - 1645.72s |  develop a device that would be safe from today's threats, I'd be like, nope, can't do that.
1646.68s - 1649.40s |  So, you know, how we think about this space.
1652.92s - 1653.96s |  Exactly, exactly.
1655.56s - 1657.24s |  Yeah, they're clapping for you.
1657.24s - 1659.32s |  Very nice. DEF CON next, everybody.
1661.80s - 1667.00s |  So I think, so you have this large complex ecosystem with lots of different vendors,
1667.00s - 1670.84s |  lots of different stakeholders, you have providers that are doing everything,
1670.84s - 1677.96s |  their focus should remain on care. I have a small aneurysm, every time someone tells me
1677.96s - 1684.60s |  that better training for clinicians will solve hospital cybersecurity, I flip the table, rage,
1684.60s - 1689.64s |  quit and leave immediately. Ideally, we want to get to a place where clinical staff don't think
1689.64s - 1695.00s |  about the cybersecurity of the systems they're dealing with. That's the dream. But we still have
1695.00s - 1700.44s |  this very complex, diverse tech ecosystem to deal with. And so how we do that, and how we do that
1700.44s - 1704.28s |  in a way that is context sensitive to each different clinical environment, to each different
1704.28s - 1709.48s |  department, that's not something that I've seen addressed in industry, kind of like enterprise
1709.48s - 1714.60s |  tooling, like does not hit the it's not looking at that problem space, because it's really hard.
1714.60s - 1718.52s |  And there's not necessarily like the upside, I think, to them from from an investment standpoint.
1719.16s - 1724.60s |  So at ARPA-H, we are looking at how we can invest and create the next generation of tools
1724.60s - 1729.88s |  to address that space, so that all of the hospitals, all the clinical environments in the
1729.88s - 1737.40s |  US can have like more performant care of their own kind of healthcare technology ecosystems. So we
1737.40s - 1741.32s |  can understand what's there kind of going back to this mapping question from earlier, you can't
1741.32s - 1746.76s |  defend what you can't find what you can't see. So how do we understand the environment? And then
1746.76s - 1752.68s |  how do we empower the IT staff, even if they're only one or two folks to engage with and manage
1752.68s - 1758.60s |  that environment in a super effective way? When they're dealing with, you know, hundreds or
1758.60s - 1762.52s |  thousands of devices across hundreds, potentially 10s to hundreds of vendors, like the configuration
1762.52s - 1770.76s |  management alone is a nightmare. So it's just incredibly kind of challenging stack of problems,
1770.76s - 1775.56s |  on top of the fact that if you make a mistake, or if your devices are out of commission,
1775.56s - 1779.80s |  like you increase the mortality of your patients every time you increase the delay to care.
1780.28s - 1784.84s |  And so, you know, we don't really have a choice but to do better in that space.
1784.84s - 1789.00s |  And so I'm really excited to see we've had a lot of engagement across healthcare providers,
1789.00s - 1793.40s |  across industry, you know, folks coming to the table with, you know, hey, we kind of had this
1793.40s - 1797.32s |  idea for this space. Let's let's see if we can make it work. Let's see if we can, you know,
1797.32s - 1802.68s |  make a huge dent in this in this challenge. So yeah, I'm very excited to kind of see what we
1802.68s - 1808.92s |  can do, because it really is a tremendous, like, just technical challenge. But I think I think
1809.24s - 1811.56s |  obviously, it's worth solving. Hell, yeah.
1813.96s - 1815.64s |  DEF CON next, everybody. DEF CON next.
1816.84s - 1820.60s |  All right, Matt, do you want to pick up a little bit where that left off from the legacy perspective
1820.60s - 1825.96s |  from, you know, not now as current FDA, but maybe in the past, right? Tell us a little bit about
1825.96s - 1829.16s |  what your guys's evolution of thinking has been around it around this.
1830.04s - 1838.04s |  Yeah. A lot of our effort has started in the healthcare sector coordinating council and in
1838.04s - 1844.76s |  the International Medical Device Regulators Forum, or FDA involvement, not our anymore.
1846.76s - 1853.64s |  It's vocal memory from eight and a half years there. It's hard to fight. But a lot of the
1853.64s - 1859.00s |  effort has been very collaborative, trying to get the healthcare perspective, the medical device
1859.00s - 1866.28s |  manufacturer perspective, as well as the regulator involvement. The legacy device problem is not
1866.28s - 1874.20s |  going away anytime soon, especially since FDA's statutory authority for cybersecurity just took
1874.20s - 1884.04s |  effect last year. It's going to take some time for those better devices to fully help prevent
1884.04s - 1892.76s |  some of the onset of the legacy device problem. A lot of what we see in response to some of the
1892.76s - 1899.24s |  issues to maintain continuity of care is, okay, well, we'll just make it not connected to the
1899.24s - 1906.52s |  Ethernet, and that removes a lot of our risk. But as we start to see devices evolve and additional
1906.52s - 1912.92s |  functionality being added, once you start doing that, you can start impacting some of the intended
1912.92s - 1918.12s |  use of that medical device and some of the core functionality that that device is providing.
1918.12s - 1923.48s |  So there's a greater cost to some of those mitigations that were available on older
1923.48s - 1929.32s |  products may no longer be available on some of the more recent products that are going out. So
1929.32s - 1938.04s |  it's a complex issue. It's also a regulated environment for updating and patching devices.
1938.04s - 1946.44s |  So making sure that addressing some of those challenges to make sure that the device is not
1946.44s - 1954.60s |  impacted by some of these updates to address some of the vulnerabilities, it's going to take
1954.60s - 1961.72s |  a kind of large collaborative effort to make sure that all of the nuances, the challenges,
1961.72s - 1968.20s |  and the best product for patients is what's ultimately achieved. Because at the end of the
1968.20s - 1973.40s |  day, that's always been FDA's mission while I worked there. It's always putting the patient
1973.40s - 1981.08s |  first and putting the patient's top of mind in all of our approaches. But the legacy device
1981.08s - 1987.80s |  challenge is just one that's going to take a lot of government coordination as well as a lot of
1987.80s - 1992.84s |  coordination across healthcare facilities and the medical device manufacturer community
1993.96s - 1999.64s |  in order to get to workable solutions, not just for what's out there today, but also
2000.36s - 2006.20s |  to maintain the devices that are currently out there and going to be going out there because
2006.76s - 2014.04s |  the medical device lifecycle is so different than traditional tech. Clinicians will use a device
2014.04s - 2020.92s |  until it no longer physically functions, and that's a hard place to secure. So it's just
2021.48s - 2027.48s |  addressing all of those challenges and finding the right solutions and fixes.
2028.04s - 2031.00s |  Fantastic. And I'm going to put you on the spot. I didn't tell you about this question,
2031.00s - 2036.36s |  so it's not. But I'm sure that healthcare is the only sector that you have to deal with that has
2036.36s - 2041.08s |  this legacy problem, right? It's only healthcare. There are no lessons learned or stuff you've
2041.08s - 2046.52s |  figured out from other sectors that we could apply here. Sarcasm. I mean, I'm assuming this
2046.52s - 2050.92s |  is not a unique problem to healthcare. We talk about it a lot, but what are you seeing across
2050.92s - 2054.68s |  other sectors that maybe we could learn a little bit from the healthcare side?
2054.68s - 2058.44s |  I think it's not unique to the sector, which is probably a good thing and also a scary thing
2058.44s - 2065.56s |  to some extent. What do we see across the board? I see a lot of Windows 95. I see a lot of Clippy
2065.56s - 2071.24s |  from Office, who I'm a fan of Clippy. I want to bring Clippy back, but we really need to look at
2071.24s - 2074.68s |  what the next generation looks like. We've seen this in food and agriculture. We've seen this in
2074.68s - 2078.76s |  the water sector. We've seen this in every sector as we go across the board. Because I think there's
2078.76s - 2084.28s |  still a perception in most organizations that cybersecurity is a nuisance versus a good thing.
2084.28s - 2089.16s |  Versus a necessity. We need to make that pivot and get people to realize that this isn't just
2089.16s - 2094.68s |  about being an inconvenience or taking down a unit or part of your organization for a period of time
2094.68s - 2100.44s |  so we can upgrade or patch, but it's a necessity to ensure the prompt and accurate and strong
2100.44s - 2104.84s |  delivery of care and safe delivery of care. Well, frankly, also if people are looking at this
2104.84s - 2109.56s |  really from a numbers perspective, it is in the best interest of an organization in the long run
2109.56s - 2114.76s |  to take these steps early on. This is something we're seeing across the board,
2114.76s - 2119.00s |  but it's frankly something that we need to change the entire landscape of how we're talking
2119.00s - 2123.96s |  with everybody from CISOs to clinical personnel in the healthcare sector, but to CEOs and boards
2123.96s - 2128.68s |  of directors to understand that we need to make this pivot from nuisance to necessity
2128.68s - 2132.76s |  when it comes to patching, upgrading, and frankly cybersecurity at large.
2132.76s - 2137.72s |  We've made some progress. I talk to a lot of healthcare CEOs these days that are talking
2137.72s - 2141.72s |  to me about their attack surface, which frankly the fact that those two words are coming out of
2141.72s - 2146.12s |  their mouth in that order is a wonderful thing. It means that they are acknowledging the fact
2146.12s - 2149.56s |  that this is an issue. The fact that they know who their CISOs are and they're having these
2149.56s - 2154.28s |  conversations is a huge step forward, but it's only the tip of the iceberg when you look at the
2154.28s - 2161.16s |  breadth and scope of the healthcare sector of where we need to go. Awesome. All right,
2161.16s - 2165.40s |  so who here feels a little ... I mean, I promise we started at cake. Now we're talking about
2165.40s - 2170.44s |  depressing stuff, but I'm trying to bounce it back up a little bit and say, how many of you
2170.44s - 2177.00s |  out there would volunteer with the skills you have as a hacker to try to make this problem
2177.00s - 2181.16s |  better? Raise your hand. Yeah, that's awesome. I hope to see almost all your hands in the future.
2181.16s - 2186.84s |  Many of you are already, but let's talk about what you can do a little bit or maybe where
2187.96s - 2192.12s |  I think in some sense we've seen some great growth in hackers involved in this,
2192.12s - 2197.48s |  and maybe we can do a little bit more. So it's been over 15 years of great medical device
2197.48s - 2204.04s |  cybersecurity research. Devices like pacemakers, insulin pumps, all sorts of stuff has been shown
2204.04s - 2209.32s |  at places like this. Barnaby Jack, Jay Radcliffe, Billy Rios and others, these are names that we
2209.32s - 2215.88s |  talk about at DEF CON and Black Hat, and they contributed to these tremendous leaps in what
2215.88s - 2219.72s |  happened at the FDA or what happened in the national conversation about medical device
2219.72s - 2224.92s |  cybersecurity, and that came from folks like you. It came from hackers. You guys did something,
2224.92s - 2231.00s |  you showed others, and it caused some amazing action to happen. But stuff's kind of changed a
2231.00s - 2236.68s |  little bit. Anyone seen a really good medical device, uh, hack on, on a big stage at Black
2236.68s - 2243.48s |  Hat or DEF CON recently? No. The question I have is we have great spaces like the Biohacking
2243.48s - 2246.36s |  Village. If you haven't had a chance to check it out, you definitely should, where hackers
2246.36s - 2251.08s |  get their hands on medical devices. But do we need to do more? Do we need to be giving more
2251.08s - 2256.92s |  medical devices, more exposure to the folks in this room that have that power, and maybe do
2257.64s - 2264.76s |  what Jay and Kevin Fu and others did 10 years ago to change things? So to the, to the audience,
2264.76s - 2269.88s |  what should we do? How do we get these folks out here more engaged in medical devices or healthcare
2269.88s - 2277.08s |  cybersecurity infrastructure or whistleblower? I mean, I think if, uh, if Apple could provide
2277.08s - 2280.84s |  security researchers with devices, even if there is, you know, some rigmarole to get, to get access
2280.84s - 2285.72s |  to them, um, the idea that you could get access to firmware for medical devices, the model that
2285.72s - 2289.80s |  the Biohacking Village has started, um, feels like something that we can scale and we could scale
2289.80s - 2294.76s |  and have a significant impact, um, and do it, doing it really in a very, once again, very collaborative
2294.76s - 2299.72s |  way. Like there is so much good intent and so much capability in this community, um, and reward that
2300.28s - 2305.40s |  success in that space. Uh, and just the, the dividends would be tremendous across the sector.
2305.40s - 2308.76s |  Um, and I think the, the upfront investment actually wouldn't necessarily be significant
2308.76s - 2313.08s |  if we choose to take that action, right? Like it's, it's fundamentally a choice that we need
2313.08s - 2319.40s |  to make first, um, across regulators, uh, manufacturers, uh, research agencies. But
2319.40s - 2322.84s |  you know, if we make that choice, we commit a little bit and like, I think we will see
2322.84s - 2326.84s |  massive returns very quickly. Um, so let's make that choice.
2328.84s - 2335.16s |  So I'd say from the medical device perspective, there's a great benefit in that the new
2335.16s - 2341.08s |  statutory requirements for connected medical devices includes that the manufacturer has to
2341.08s - 2347.96s |  have a coordinated vulnerability disclosure process, um, so that it should become easier
2348.04s - 2355.00s |  to access people at the company. If you're able to, um, identify potential vulnerabilities in a
2355.00s - 2363.00s |  product, I will say one of the challenges and one of the, uh, things that the people that you named,
2363.00s - 2371.24s |  um, had a immense amount of patience, um, especially for the older products that take
2371.24s - 2380.52s |  longer to patch that had, uh, older devices, uh, devices that don't have as easy delivery
2380.52s - 2388.36s |  mechanisms for patching and updates, um, in order to ensure patient safety in that responsible
2388.36s - 2395.16s |  disclosure of the vulnerabilities. Sometimes those take time, um, in order to process and develop,
2395.16s - 2399.48s |  have the manufacturer develop patches to address the issues.
2399.48s - 2405.56s |  Uh, but now that coordinated vulnerability disclosure is a requirement for new products,
2405.56s - 2410.76s |  that should become a easier process, but definitely keep in mind that there is that
2410.76s - 2418.44s |  patient safety aspect, um, that may take, cause the disclosure to take a little longer than you
2418.44s - 2425.32s |  would like. Um, but you can still go through the process, still, um, engage with the manufacturer,
2425.32s - 2430.60s |  still get the appropriate credit and while maintaining that patient safety consideration.
2431.88s - 2435.48s |  Just a, just kind of a follow-up to that. I think talking to folks in the security research
2435.48s - 2439.96s |  community, uh, especially if we're looking at like academic research, access to devices is the
2439.96s - 2444.28s |  number one reason that we don't, I think, see more work in this space. Um, and there are a lot of
2444.28s - 2450.20s |  cons- they're clapping for you, but they're next door. Not everyone at DefCon is clapping
2450.20s - 2457.24s |  for me while I'm talking. I appreciate the vibe though. Um, uh, like if you don't have access to
2457.24s - 2462.44s |  any of the kind of artifacts of a device, it is very hard to assess its security properties.
2462.44s - 2468.36s |  Um, and I think that's where we see, I mean, if, if, if, you know, controlling the, the ecosystem,
2468.36s - 2473.00s |  um, may be disadvantageous in the long run or, or, or limiting access, like, like the
2474.12s - 2479.16s |  providing more avenues for controlled access or, or just identifying what level of control
2479.16s - 2483.72s |  is actually necessary to maintain whatever interest you have in devices safety in your
2483.72s - 2489.80s |  own business, whatever. Um, I think reassessing kind of those, those parameters, uh, and then
2489.80s - 2495.32s |  engaging more with the community, uh, like, like grad students can do a whole lot of really good
2495.32s - 2500.36s |  work for, you know, not a whole lot of money. Like thank, thank the NSF and NIH. Like, like we
2500.36s - 2504.60s |  can see via their work in other spaces, in other sectors, even other critical infrastructure
2504.60s - 2509.24s |  sectors. So we have the ability, we have the talent and we know kind of what it costs. Um,
2509.24s - 2514.36s |  so I think unleashing and kind of like building more work in that space could be a very cost
2514.36s - 2520.36s |  effective, um, and also security effective way of getting more, more kind of progress, uh, here.
2520.36s - 2524.84s |  But once again, it requires the choice to kind of open yourself up to that, that relationship and
2524.84s - 2528.60s |  that community. Um, so yeah, that's, that's something that I spent a lot of time thinking
2528.60s - 2532.76s |  about because you're right, right? We don't see that a lot. Like the biohacking village, very
2532.76s - 2536.68s |  unique kind of in this respect, or, or there are other efforts across the nation. I'm not trying
2536.68s - 2542.76s |  to discount those, but, um, we could do more. Absolutely. I, you shouldn't have to hack on
2542.76s - 2549.72s |  your own medical device that you own because, and that helps you be alive to do cool cutting
2549.72s - 2556.84s |  edge research, right? You shouldn't have to go on eBay and buy the only device available for you
2556.84s - 2561.32s |  in a device category that's 10 years old or 15 years old and has, of course you're going to find
2561.32s - 2565.72s |  stuff because you can't get your hands on the latest and greatest. You know, I really wonder
2565.72s - 2572.20s |  if that's holding us back. And it's just then a game of if I could get ahold of it, I could find
2572.20s - 2576.12s |  something, but I'm not going to, and it's going to just float along. We miss an opportunity to
2576.12s - 2581.56s |  really make some meaningful change earlier. Um, so that's a plea to the plea to the audience,
2581.56s - 2584.76s |  get involved. Who would, who would take a medical device home and wrench on it if he could?
2585.32s - 2591.32s |  Yeah. Hell yeah. No drug delivery pumps for you guys though. Okay. No fentanyl pumps. All right.
2592.76s - 2601.24s |  All right. Consolidation. Okay. Here we go. Smaller. Uh, give me a round. I want an audience
2601.24s - 2605.24s |  poll real quick. Raise your hand. If you think the profit margins of most hospitals in this
2605.24s - 2615.64s |  country is over 20%, raise your hand. All right. Keep your hand up. 10%. 5%. 1%. Yeah. You guys
2615.64s - 2622.84s |  know it's about 1% sub 1% meaning your hospital makes a profit margin probably between one and
2622.84s - 2629.24s |  4%. And then if they don't, if they screw something up, they go red. More and more hospitals are
2629.24s - 2634.04s |  getting financially distressed. And I want to just hear if anyone in this audience knows what
2634.04s - 2639.48s |  happens. You have a hospital system, it's in the red. And then what is it going to do to survive?
2639.48s - 2646.28s |  Is it going to see more patients or become more efficient? No, it's going to get bought.
2647.32s - 2654.04s |  It's going to get consolidated. What happens when hospital system A buys hospital system B?
2654.04s - 2658.60s |  Do you think they're going to have two different, uh, entire technology stacks? No, they're going
2658.60s - 2665.08s |  to unify under one stack, right? What happens when more and more hospitals are just part of
2665.08s - 2671.08s |  more and more mega healthcare delivery organization conglomerates and one of them gets hit? And then
2671.08s - 2677.40s |  not only is it then one or two hospitals that are down, it's 200 over four states. The question I
2677.40s - 2682.04s |  have is from a national security perspective, as something that we should do from folks that are
2682.04s - 2686.12s |  interested in this, making sure hospitals can function, you know, how should we look at the
2686.12s - 2690.92s |  consolidation of healthcare delivery organizations when it comes to risk of catastrophic failure?
2690.92s - 2696.76s |  And is there anything we can do when hospital systems try to marry one another that could
2696.76s - 2702.68s |  limit this? So to the panel. Also, I'll offer, I think we are looking at this and having a lot of
2702.68s - 2706.76s |  conversations about really understanding risk. I think we look at risk in not necessarily the
2706.76s - 2711.88s |  right light when it comes to cybersecurity. I look at risk as a three-legged stool. There's risk
2711.88s - 2715.64s |  identification. We spend a lot of time on that. There's risk mitigation. We spend a lot of time
2715.64s - 2720.52s |  on that. The third leg of the stool is risk acceptance. And we don't spend enough time
2720.52s - 2725.72s |  understanding the risks that we're accepting in our organizations by not investing in
2725.72s - 2730.60s |  cybersecurity or modernization and infrastructure. That risk acceptance is not the CISO.
2731.24s - 2735.96s |  That risk acceptance is the CEOs and the boards of directors of organizations that are deciding
2735.96s - 2742.68s |  to not invest. I get the margins issue. I worked in healthcare. We were never even in the one percent,
2742.68s - 2745.48s |  so I think that's a great... We would have loved to have been in the one percent.
2746.84s - 2751.40s |  So I think that there's those types of challenges that folks are balancing against, but people need
2751.40s - 2755.72s |  to understand the risks that they're accepting. I will say that we are hearing more healthcare
2755.72s - 2762.20s |  organizations talking about tech debt and cyber risk in the M&A process. They're having these
2762.20s - 2766.60s |  discussions of saying, we want to buy this healthcare system or this hospital, and we know
2766.60s - 2772.36s |  that it's going to cost us 2 million, 3 million, 4 million to get their IT to the standards that we
2772.36s - 2777.32s |  have set within our organization. And they're building that into the M&A discussion when it
2777.32s - 2781.72s |  comes to that. Now, that being said, that's a small fraction of the conversations that are
2781.72s - 2785.08s |  happening. So I think it's a multi-pronged approach. One, we want to make sure that we're
2785.08s - 2790.60s |  able to get that message out to folks and change the way that we're looking at M&A within healthcare
2790.60s - 2796.04s |  so that people are factoring in tech debt and cybersecurity as part of that dialogue. And I
2796.04s - 2800.28s |  think the other piece of it is making sure that we understand, going back to the first question
2800.28s - 2805.40s |  about mapping out the sector, where are those key dependencies where something is, you know,
2806.12s - 2811.56s |  we know this with the HR, we know this obviously with change, but there's other types of events
2811.56s - 2816.68s |  that we don't know what's out there, where there's these entities that have such large market share
2816.68s - 2821.32s |  that the impact of one becomes an impact to more than we can tolerate in healthcare. We need to
2821.32s - 2826.52s |  know that so we can start having those discussions of buying down that risk or going in collectively
2826.52s - 2830.92s |  and accepting that risk. And we have not been able to do that effectively yet where we need to
2830.92s - 2840.30s |  in the healthcare sector. Oh, mergers and acquisitions. Sorry. Thank you. Anyone else?
2841.66s - 2849.66s |  I'd say, in terms of consolidation, I'd say, what can we learn from other international models
2849.66s - 2856.94s |  where there are single payer systems that have large networks of facilities? Are there things
2856.94s - 2862.38s |  that we can learn to address some of those risks based off of what we've seen them do well or them
2862.38s - 2869.66s |  have issues with? And how can we adopt what has worked well or improve upon what hasn't?
2870.94s - 2877.34s |  But I'd say it's definitely something we need to pay careful attention to and see what protections
2877.90s - 2885.50s |  can be in place to isolate facilities in case one gets hit, to ensure that continuity of care,
2885.50s - 2891.98s |  especially if it's in an overlapping region, you don't want to lose an entire region of facilities
2893.50s - 2900.62s |  based off of it hitting the central core facility or just affecting the entire network.
2900.62s - 2908.62s |  So how can we get better detection and automated response capabilities in order
2908.62s - 2914.52s |  to cut off those networks when exposed? All right. I want to make sure we can get
2914.52s - 2918.36s |  through some questions here. And this has a whistleblower component, I think,
2918.36s - 2921.80s |  which is the interesting part. I'd like to pull on that a little bit in here.
2923.96s - 2928.68s |  For years, we have known very little in what happens inside hospitals that have been hit
2928.68s - 2934.12s |  with ransomware. Every once in a while, you'll get a news report that says an attack happened,
2934.12s - 2938.12s |  and you'll hear some updated news reports that the attack's still going on. Maybe you'll get
2938.12s - 2942.84s |  an anonymous quote from a doctor or nurse that worked at the hospital. But for longest times,
2942.84s - 2947.48s |  we had no idea, really, with rare exception. Maybe, I'm just going to shout out University
2947.48s - 2951.80s |  of Vermont, right? They've been incredibly transparent in their attack. Well, as a
2951.80s - 2957.80s |  consequence of not sharing that information very openly and exhaustively is we don't get lessons
2957.80s - 2962.12s |  learned, right? We don't know what happened when they're taking care of their diabetic patients
2962.12s - 2967.80s |  that were in a crisis or their heart attacks or their strokes. We don't really learn like we
2967.80s - 2974.44s |  should. And there are some organizations like ISACs and these types of things. But clearly,
2975.00s - 2985.07s |  there seems to be an information vacuum. Do we offer some additional legal protections,
2985.07s - 2990.43s |  some type of additional efforts that we can do to make health systems feel more comfortable about
2990.43s - 2995.87s |  talking about their failures so other people can learn from it? To the audience, or sorry,
2995.87s - 3002.59s |  to the panel. So, I think you see in other domains where people make upfront disclosures
3002.59s - 3007.71s |  that say if they are in violation of some sort of tenant, like foreign corrupt practices,
3007.71s - 3013.07s |  that there will be leniencies in terms of the fees that they might incur. But I think it is
3013.07s - 3018.19s |  to this point of like getting that board buy-in, getting that executive buy-in to say like mistakes
3018.19s - 3023.39s |  are going to be made and we're here to fix them. And that there's an immense amount of power
3023.47s - 3029.39s |  in deconstructing the narrative of exactly what went wrong and the details of that. Because even
3029.39s - 3034.43s |  for a cybersecurity failure, it's not just one or two things. It's probably a list of
3034.43s - 3041.07s |  30 different decisions that were made. And being able to have really clear granularity
3041.07s - 3048.59s |  of who made what decisions, who was affected, who was unaware, whatever those details are,
3048.59s - 3054.51s |  being very explicit, very clear, and really being able to dig in the weeds of those retrospective
3054.51s - 3060.35s |  analysis. And not only sharing them internally with those organizations, but also externally
3060.99s - 3067.15s |  to other people who work in the cybersecurity industry is immensely helpful. But I think
3067.15s - 3073.71s |  psychologically very hard, right? It's hard even though you may be valued by other cybersecurity
3073.71s - 3079.31s |  professionals for being transparent and open and admitting a mistake. The public perception
3079.31s - 3085.63s |  of that could be seen while you were in negligent or everything else. And that sort of shift
3085.63s - 3091.87s |  in people's perception of when people make mistakes is also a bit of a challenge there.
3091.87s - 3096.03s |  So you can see that there's maybe some sort of incentivization structure that you can create to
3096.03s - 3100.99s |  say you'll get leniency if you're very clear at reporting what went wrong and how it went wrong
3100.99s - 3107.15s |  in very, very specified details. Or alternatively, again, it's like this is a deliberate decision
3108.03s - 3112.75s |  typically by people in positions of leadership to say transparency is important to us.
3112.75s - 3118.19s |  Being able to say we are engineers, we are going to fail, that is a nature of engineering, but we
3118.19s - 3124.59s |  are also here to fix. And this is how we fixed it. And for the benefit of our industry, here is the
3124.59s - 3131.79s |  details of how we resolved that issue. And I think having those case studies is crucially
3131.79s - 3137.39s |  important for basically any field that you're really in. But it's a tricky problem, right?
3137.39s - 3144.43s |  Because it's a public perception, it's a liability issue or a perceived liability issue. And it's
3144.43s - 3150.51s |  like how do you overcome those hurdles is more of a people problem I would see than a technical
3151.47s - 3157.31s |  problem. Yeah, it's been a technical problem at the end of the day.
3158.99s - 3164.83s |  I think kind of building on that, like looking at the FAA and how we deal with aviation incidents,
3164.83s - 3169.47s |  I mean, I think there was a recognition that the entire industry, like if people did not feel safe
3169.47s - 3174.83s |  flying, that entire sector would collapse. And so the need for transparency, the processes that
3174.83s - 3179.87s |  have been put in place, like are they perfect? Probably not. I'm not an expert in that field.
3179.87s - 3183.31s |  But there is a high degree of industry and government cooperation. There's a high degree
3183.31s - 3190.75s |  of transparency. There's a high degree of forensic capacity built into the systems that we use to
3190.75s - 3197.95s |  ensure commercial flight. Or like the NTSB to a lesser degree. But things that we have decided
3197.95s - 3204.75s |  are necessary for the economy, for the nation to move forward every day. We find a way to achieve
3204.75s - 3208.99s |  more transparency and more cooperation. And so it'd be really interesting just to see
3209.63s - 3215.79s |  how can we do that for healthcare? Because this is also a necessity. Very, very complex one.
3217.63s - 3222.11s |  But I think the fundamental kind of like problem and maybe the solution looks similar.
3225.64s - 3229.48s |  All right. I've gotten the less than five minutes. I know we had talked a little bit about a Q&A,
3229.48s - 3231.96s |  but I don't think we're going to be able to take a Q&A. Is that correct?
3233.24s - 3236.20s |  Yeah, unfortunately not. Blame this person. I'm just kidding. Blame me,
3236.84s - 3240.60s |  the monitor. What I will offer is I'll be available in the back. We'll be respectful
3240.68s - 3244.28s |  to the next speakers. I can't guarantee any of these folks that are very busy,
3244.28s - 3248.04s |  they may or may not be able to answer some questions. But I want to say from the bottom
3248.04s - 3253.24s |  of my heart, and I hope you out there agree, thank you so much for coming and giving us
3253.24s - 3256.92s |  your knowledge today on this very complicated topic. Everyone give him a round of applause.


url: https://www.youtube.com/watch?v=WC-tY-gEIPc
title: DEF CON 32 - Hacker vs AI perspectives from an ex spy - Harriet Farlow
type: video
author: DEFCONConference
ingestion_date: 2024-11-09
transcription_model: large-v2
chunking_status: completed
content:
{
  "webpage_url": "https://www.youtube.com/watch?v=WC-tY-gEIPc",
  "title": "DEF CON 32 - Hacker vs AI perspectives from an ex spy - Harriet Farlow",
  "description": "The convergence of Artificial Intelligence (AI) and national security not only fuels international discourse but also inspires narratives within popular culture. Harriet is no stranger to these myths, as an ex-intelligence professional who specialized in applying machine learning to cyber security. In fact, she likes to lean into them. This makes her previous bosses nervous, so she uses pop culture as the lens through which to communicate her insights - and in this talk she utilizes the worlds of Ghost in the Shell, Neuromancer and Mission Impossible.\n\nThrough these stories, as well as her own decade of experience working at the intersection of artificial intelligence and cyber security, Harriet discusses the extent to which fears surrounding AI systems are applicable to real life national security settings. From cyber warfare to AI-driven surveillance, she unravels the interplay between hackers, AI, and government agencies. This session is interactive, with demos of how these AI systems actually work under the hood, as well as discussion time. Blur the lines between human and machine, and understand how you can contribute your skills to prevent our own modern day Puppet Master.",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 2439,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241016"
}

0.00s - 5.24s | This text was transcribed using whisper model: large-v2

 Okay. We're starting. Um, it was really wild walking past a queue to get into this room
5.24s - 10.80s |  to see me talk. I mean, I, I know I'm, I'm obviously ex intelligence, but I'm not going
10.80s - 16.20s |  to be divulging any state secrets here. In fact, definitely the opposite because obviously
16.20s - 22.16s |  like someone is watching this, so I don't want to get in big trouble or arrested. Um,
22.16s - 28.36s |  but it's, it's amazing to see you all here. So thank you. Um, so this is a talk about
28.36s - 35.16s |  the intersection of AI and security specifically from the national security lens. Um, this
35.16s - 40.40s |  is a policy village talk that is up here on the creator stage. So there is a policy slant
40.40s - 46.60s |  to it. So if you're expecting to see cool like hacking techniques or how to evade an
46.60s - 52.68s |  APT, this is not the talk. Um, although maybe I will talk about it. Um, but I hope you're
52.68s - 56.68s |  all here because you're interested in policy in some way. Could I get a show of hands if
56.72s - 62.48s |  you are like a policy person? Okay. That's good. That's good. And what if you're more
62.48s - 68.64s |  of a technical person, like a cyber or an AI person? Okay. So probably a bit more, but
68.64s - 73.68s |  a good mix. Okay. That's okay. Um, hopefully this is interesting for you. I don't know.
73.68s - 80.08s |  Um, we'll see. So who am I? Um, my name's Harriet Farlow. I've worked at the intersection
80.08s - 86.72s |  of artificial intelligence and security for about 10 years now. My undergraduate degree
86.72s - 92.00s |  was in physics and like many physicists, I didn't really know what to do with it. So
92.00s - 98.68s |  I ended up working in data science. Why is there a laugh there? Um, so I ended up working
98.68s - 104.80s |  in data science, um, mostly specializing in defense projects, um, in Australia. So I spent
104.80s - 109.48s |  a year working on the patrol boats in Darwin. If anyone's familiar with Darwin, it's, it's
109.48s - 113.96s |  a small town far North in Australia where there's obviously a lot of military activity
113.96s - 118.76s |  and crocodiles and that's sort of what's going on, but an insane number of British backpackers
118.76s - 123.88s |  and it's, it's, it's loose all the time. Um, and I also worked on sort of air force projects
123.88s - 130.40s |  where we were augmenting people's roles with, um, like robotic process automation. Um, ideally,
130.40s - 134.80s |  hopefully not to, you know, take people's jobs away. Right. But just to make them not
134.80s - 141.08s |  have to do the, the uncool bits. Um, I worked there for a while, um, had my, you know, quarter
141.08s - 145.56s |  life crisis ended up working at a startup in New York city, which is really cool. And
145.56s - 152.56s |  I was also working on sort of advising large companies in the United States on AI and cybersecurity.
152.56s - 158.28s |  Uh, unfortunately during COVID I had to move back home. Um, and the Australian government
158.28s - 163.44s |  was the only people hiring. So that's how I ended up working in intelligence. Um, not
163.44s - 167.08s |  to make it sound like I didn't want to, I was really grateful to, and it's something
167.08s - 172.08s |  that I'd always been really interested in. Um, and I guess COVID just forced me into
172.08s - 177.12s |  that opportunity. Um, but it was really great. I worked at the Australian signals directorate
177.12s - 182.76s |  in Australia, which is our equivalent of the NSA. I always get scared about saying the
182.76s - 187.64s |  wrong thing. So yeah, like this is not going to be the spiciest talk obviously. Um, because
187.64s - 191.64s |  I'm scared of saying the wrong thing. So this is, this is ASD and this is what they do.
191.96s - 195.52s |  They're the Australian government intelligence agency responsible for foreign signals, intelligence
195.52s - 200.68s |  and cybersecurity. And they do all those things. And so over the time I was working there,
200.68s - 206.12s |  I was mostly a data scientist in the cybersecurity teams. Um, and by the time I left, I was acting
206.12s - 211.72s |  as a technical director on one of their sort of AI streams. And through this job, I got
211.72s - 217.88s |  to travel to Canada and the USA and lead some of the technical work around AI in that space
217.92s - 223.88s |  there as well, which is really great. Um, fantastic organization, fantastic people believed
223.88s - 228.16s |  in the mission wholeheartedly, but I guess the entrepreneurial spirit never really left
228.16s - 233.20s |  me. Um, and while I was there, I started doing my PhD in adversarial machine learning and
233.20s - 240.20s |  investigating ways to hack models and basically found that in the, like the, the, the private
240.20s - 244.24s |  sphere, there was just not that much activity happening in that space, even though there
244.28s - 249.96s |  was, um, you know, that it represented a real threat. So I left my government job and for
249.96s - 255.56s |  the last year I've been running an AI security company called Maleba Security Labs. Um, we've
255.56s - 259.72s |  just received funding to start building a tech product, which is exciting, especially
259.72s - 264.60s |  because there's, there's so much grind. It's, it's a long time, but that's who I am. Um,
264.60s - 270.44s |  I also have a social media presence at Harriet Hacks, which is not amazing, but I'm trying.
270.48s - 277.20s |  Um, I'm there on YouTube. Um, you can reach out to me on, uh, like X and other platforms
277.20s - 282.08s |  and we have a podcast now, which is really cringy, but, um, anyway, you know, as an
282.08s - 286.96s |  entrepreneur, you just got to do what you got to do. Um, so I've been doing quite a lot of
286.96s - 294.76s |  research at the intersection of AI and security for a while. This is my fourth talk this
294.76s - 300.96s |  week. So if I am a bit like foggy or tired, I apologize. It's been a massive week and I
300.96s - 306.36s |  don't think I've ever needed a drink so much as I will right after this talk. Um, but
306.36s - 310.68s |  yesterday, um, well, I spoke at B-Sides and then the main stage yesterday and the AI
310.68s - 317.64s |  village yesterday, um, on some of the methods that are used and new methods to, uh, hack
317.68s - 322.40s |  facial recognition AI models. Um, and that's in the field of adversarial machine learning,
322.40s - 327.80s |  which is my PhD topic. And in particular, um, the, the content I was talking about was in
327.80s - 333.04s |  the context of urban camouflage. That's sort of how I envisioned it, um, at the time that
333.04s - 338.00s |  I, they created that method. Um, but basically the idea is that machine learning models are
338.00s - 342.60s |  pretty brittle and easily exploitable and that most of the organizations that are
342.60s - 348.44s |  leveraging machine learning, um, are relying on pretty insecure models, even though lots
348.44s - 353.52s |  of organizations are doing the right thing. Like it's, it's really cool to see, um, AIXCC
353.52s - 358.00s |  if you've been there and all the companies like, um, Google, Microsoft, Anthropic, Open
358.00s - 362.56s |  AI that are working on secure AI. But for all the other organizations that are creating
362.56s - 367.68s |  AI products, there's no real mandate for them to actually be secure. And, and that's part
367.68s - 372.12s |  of the problem. Um, some other talks were showing that, but I also do research, um,
372.12s - 378.36s |  on policy as well and applying that in the policy sort of lens. And maybe it sounds really
378.36s - 384.40s |  bad, but I'm far more excited to deliver this talk than the other ones. Um, I, I never
384.40s - 389.52s |  really thought that I would consider myself a policy nerd. It always seemed pretty dry.
389.52s - 394.52s |  Um, especially when you work in the bureaucracy and you have to try and create policy, like
394.52s - 399.64s |  that just sucks. But it's actually really interesting to think about the, the impacts
399.64s - 404.00s |  of policy because it is real. Um, so now if someone called me a policy nerd, I would probably
404.00s - 409.08s |  actually be quite happy about that, uh, which is an identity crisis slash shift I guess
409.08s - 414.72s |  I've gone through. But that sort of leads us into the objectives of this talk, which
414.72s - 419.20s |  I hope it's not too theoretical for you. It kind of has to be, but I find it really interesting
419.20s - 422.84s |  actually. So maybe if there's something you take away from this, it's that policy can
422.84s - 428.68s |  actually be quite interesting and important. Um, so I'm going to cover some of the different
428.68s - 435.68s |  ways that AI, um, is used in a national security context, cyber defense and offense. I'm sure
435.68s - 439.84s |  this will not be surprising to you at all. Um, so I'll just go over that lightly, but
439.84s - 444.08s |  then I'll talk about some of the national security implications from that, uh, from
444.08s - 448.88s |  my perspective. And then you might be disappointed by this as well, but I'm going to talk about
448.88s - 452.80s |  security theory because I actually find it really interesting. And I think it's really
452.80s - 459.44s |  interesting to see how traditional security theory at stemming from sort of military sciences
459.44s - 465.44s |  has moved into cyber security, but hasn't really moved into AI security yet. And, and
465.44s - 472.44s |  how we can sort of encourage that change to make sure that AI also is secure, um, as,
472.44s - 479.16s |  as our other, other, as our other disciplines. But first, so this is an AI, uh, pop the,
479.20s - 483.92s |  the policy village talk and they told me in submitting this talk that it had to be interactive
483.92s - 489.08s |  with the audience and then it had to encourage discussion. So I, I feel like maybe that's
489.08s - 494.08s |  a bit different as a creative stage like this. I think like maybe in the policy area, that's
494.08s - 498.64s |  a bit easier, but I do still think it's important actually. So maybe take 30 seconds and say
498.64s - 504.00s |  hello to the person next to you. Um, you can explain why you're interested in policy and
504.00s - 507.36s |  then note your favorite sci-fi movie. If you read the description, obviously I'm talking
507.36s - 511.28s |  about sort of leaning into sci-fi here. So I'm going to break for 30 seconds and you,
511.28s - 581.83s |  you can meet the people around you. Okay. Well, that's a minute. I hope everyone found
581.83s - 587.91s |  that valuable. Okay. We can pause the talking now. We're going to, we're going to kill the,
587.91s - 592.47s |  the audio for the, for the recording. Okay, great. Well, I've ticked that box for, for
592.47s - 596.39s |  the policy people. So I hope you found that useful as well. Um, that is the benefit of
596.39s - 603.65s |  being here, right? Um, I, I don't, I don't think I'll try audience engagement. I was
603.65s - 608.85s |  going to say, can someone yell out their favorite sci-fi movie that might work? Terminator.
608.85s - 621.16s |  Yes. Classic use of AI. Anything else? Star Wars. Yes. Blade Runner. Fantastic. Well,
621.16s - 626.52s |  all of them involve AI, right? Which is, uh, uh, I guess funny, but sort of the point of
626.52s - 631.68s |  why I wanted to involve sci-fi in the talk. Um, also because then it's easy to talk about
631.68s - 637.56s |  stuff without necessarily saying that, um, you know, it comes from experience. I should make
637.56s - 642.20s |  the disclaimer, actually, all of this is my own opinion and nothing from ASD. Um, I forgot to
642.20s - 647.24s |  mention that earlier. Um, but that is the benefit of leaning into the science fiction narrative as
647.24s - 652.24s |  well, because all of those movies that you've referred to do involve artificial intelligence
652.36s - 659.24s |  and see the way that it's depicted in movies really does. I'm sure that will come back. It
659.24s - 663.40s |  really does impact how people think about it and the kinds of narratives that people have about it.
663.40s - 668.88s |  Um, as well as sort of in the world of intelligence, right? All of the things we think about when it
668.88s - 672.60s |  comes to national security and intelligence, all of, a lot of the time, unless you've worked in
672.60s - 676.52s |  those kinds of fields or with people in those fields come from movies, it's, it's really
676.64s - 682.64s |  impactful. Um, and there have been quite a lot of studies that show that the, the way that
682.64s - 689.04s |  technology is constructed in movies is how it progresses. Not necessarily, but the, the
689.04s - 695.12s |  creativity that's shown in, um, in narratives like this ends up, you know, informing people
695.12s - 699.72s |  who then go and design them themselves. We've seen that in sort of biotech. So this is
699.72s - 703.32s |  important when it comes to AI, cause we need to think about it. But these are some of my
703.36s - 708.24s |  favorite science fiction. Oh, those were some of my favorite science fiction movies. I think
708.24s - 714.68s |  it'll come back. Um, there we go. Um, they all also involve AI. Um, if you've read the
714.68s - 717.68s |  description, which I can't really remember what I put in it actually, but I think I
717.68s - 723.72s |  referenced, um, Ghost in the Shell, Neuromancer, um, Mission Impossible, not really a sci-fi
723.72s - 728.80s |  movie, but it's a, an action movie that I do quite enjoy. Um, especially the last one
728.80s - 732.84s |  because it involved some examples of hacking AI, which I really like and is the kind of
732.84s - 737.08s |  thing that I do and had not seen in movies very much before. I also put Doctor Who up
737.08s - 741.32s |  there because I'm not talking about it today, but it is my favorite science fiction show
741.32s - 745.68s |  slash content. My, um, I don't know if you can tell that I was a nerd because I studied
745.68s - 754.64s |  physics, but my sweet 16th birthday party was a Doctor Who themed party. And it's even
754.64s - 758.08s |  amazing that I had friends to come to this at the time, but they all came dressed up as
758.08s - 763.56s |  different Doctor Who characters. Um, and I was Rose of course, and I made my own custom
763.56s - 768.60s |  Doctor Who Cluedo game. Um, I created all the different cards and characters myself
768.60s - 773.60s |  and then stuck them on top of my original Cluedo. So I guess we're all impacted by science
773.60s - 778.76s |  fiction in some way. And now you are too because of that really terrible story. But I'm going
778.76s - 784.12s |  to be sort of discussing some of the implications of the technologies that we see in these movies.
784.16s - 788.64s |  Of course there is an important question we have to ask, and what is AI at all? Have any
788.64s - 794.60s |  of you in here been to the other talks I gave this week? Okay, because I've, there's a really
794.60s - 797.92s |  bad joke that I have about what AI is and I don't know whether to give it again because
797.92s - 806.16s |  I've given it three times already this week and it's really bad. Okay, so when I first
806.16s - 814.38s |  told my mum I work in AI, she said, oh darling, why do you work in artificial insemination?
814.42s - 819.22s |  Which is really like, it's not a good joke. Um, but it's because she works in medicine
819.22s - 824.50s |  and that's what AI meant to her. And she wasn't even saying that to be funny. That, that's
824.50s - 829.78s |  literally the first thing that came to her mind. Um, and so even when I say AI to all
829.78s - 834.26s |  of you, you think artificial intelligence, what that means to different people is really
834.26s - 838.94s |  different. So some people would think something like the Terminator or Skynet. Um, other people
838.94s - 844.06s |  would think like just a decision making algorithm. Um, I have friends who aren't really tech
844.06s - 848.30s |  people and I was talking to them about AI and they said, oh yeah, I saw this really
848.30s - 853.02s |  fancy like 3D billboard in the street. That's an example of AI, right? So I think we also
853.02s - 856.62s |  take it for granted that, you know, maybe we're a bit more technically literate than
856.62s - 862.10s |  most people out there. Um, including people who work in sort of, um, you know, policy
862.10s - 868.62s |  and a lot of, a lot of government jobs, uh, which is not, you know, not a, not to discredit
868.62s - 873.02s |  their work or anything. It's just that it's such a new and emerging technology and we
873.02s - 877.14s |  need to have a bit of empathy for the people who really aren't there. But I guess when
877.14s - 884.06s |  I talk about AI, when we think about it, artificial intelligence really refers to a goal and the
884.06s - 888.14s |  term artificial intelligence has been around since the 1950s when John McCarthy coined
888.14s - 894.02s |  the term for the Dartmouth conference in 1956 and he was a cybernetics researcher. And so
894.02s - 897.86s |  like he was trying to get grant funding for his cybernetics research, which is basically
897.90s - 903.10s |  the ability to just like create models. Um, and at the time in the 1950s that was pretty
903.10s - 909.62s |  simplistic, but over the years, whatever we've referred to as AI has just referred to the
909.62s - 914.18s |  cutting edge, right? So I guess these days you, you would consider AI something like
914.18s - 919.66s |  LLMs and chat GPT, but in 10 years time, what we consider AI will, will change as well.
919.66s - 926.38s |  So the goalposts are always moving. The other thing about definitions in AI is also that
926.38s - 931.86s |  when I say AI security, so like when I say I run an AI security company, what that means
931.86s - 938.14s |  is also very different. Most people assume AI security means AI for cybersecurity. Um,
938.14s - 941.90s |  whereas for me and other people who sort of work in the field, what I really mean is the
941.90s - 947.26s |  security of AI systems themselves. And they're very different, like they're inherently different.
947.26s - 953.26s |  It's either using AI to do something, um, like cybersecurity applications versus like
953.34s - 958.46s |  implementing or adopting security methodologies into the world of AI, which are like very
958.46s - 962.38s |  different to how you would implement it in a cybersecurity setting. And then another
962.38s - 967.82s |  term is AI safety, which some people would consider to be kind of the same as AI security.
967.82s - 973.34s |  And I would consider quite different. Um, and why that is, I will sort of get to in a moment
973.34s - 979.82s |  as well. But when we think of all the different AI uses in like security, we can sort of group
979.82s - 984.94s |  them into offensive and defensive security. So in terms of the different job roles,
984.94s - 990.06s |  uh, we have things like ethical hackers, red teamers, exploit developers, malware analysts,
990.06s - 995.18s |  vulnerability researchers, social engineers, um, just to name a few. These are all the kinds of
995.18s - 1001.90s |  roles that are now being, um, you know, supplanted or augmented by AI technologies.
1003.26s - 1006.94s |  When we think of defensive security, we have things like security analysts,
1006.94s - 1010.94s |  network security engineers, security architects, incident responses,
1010.94s - 1016.94s |  sock analysts, and threat hunters. Um, again, just to name a subset. And there is so much work
1016.94s - 1024.38s |  and investment going on in this space at the moment. Um, again, looking at AI CC in the,
1024.38s - 1029.50s |  in the hall below, which is insane and massive and so much funding. And I just can't imagine
1029.50s - 1034.94s |  that happening in Australia. Um, again, not to bash Australia, but just like, this is such an
1034.94s - 1041.02s |  incredible investment from the government in that. So that's really cool. And the challenge
1041.02s - 1048.14s |  about applying AI in these kinds of settings in any, in any organization, national security or not
1048.70s - 1054.78s |  is that like actually building the model itself is pretty, pretty simple, but making it work,
1054.78s - 1060.94s |  making it work as part of a system is really hard. Um, I do sort of have a demo. Um, I guess
1060.94s - 1068.22s |  it's worth showing, but I think that the point of the demo is really just to show how simple it is
1068.22s - 1076.86s |  to build like a model that, that does this kind of thing. So as part of our work, we're often
1076.86s - 1083.50s |  thinking about like the intersection of AI and security, we do demos, labs, all that kind of
1083.50s - 1089.10s |  stuff. Um, we, we were originally like trying to apply for AXCC, but like we're a small company,
1089.10s - 1095.42s |  we couldn't quite get it together enough to do it in time. Um, but as a, as a demo, we decided to
1095.42s - 1101.66s |  build a model that could classify vulnerabilities in code. Um, I know a lot of you might not be
1101.66s - 1107.10s |  code people. The point of this is just to show that in the, like this is a two time speed, but
1107.10s - 1115.02s |  in the three minutes that this notebook takes to run, we were able to, um, down, we were able to
1115.02s - 1123.50s |  download a bunch of code, secure and insecure code, um, build a model that was able to classify
1123.50s - 1130.38s |  which of this code was secure or insecure. Um, run that a few times, you can sort of see this
1130.38s - 1136.94s |  training process here. And then when it was presented new code, it could correctly classify
1136.94s - 1143.42s |  whether it was vulnerable or not. Um, and that's the whole point of the AI XCC challenge, but
1143.42s - 1149.10s |  actually applying this at scale is really, really hard. And so some of the troubles that we see in
1149.10s - 1154.70s |  applying AI in all of these settings is this whole idea of like moving beyond the pilot stage,
1154.70s - 1158.38s |  like actually getting these sorts of models to speak together is really difficult and it's not
1158.38s - 1164.78s |  trivial. And it's something that we're all grappling with. Um, and the reason that it's
1164.78s - 1170.38s |  important from a sort of policy perspective, I guess, is because like the kinds of organizations
1170.38s - 1177.82s |  who are working on this stuff, um, you know, the big tech giants, um, as in like who have that sort
1177.82s - 1183.02s |  of that AI capability and have the compute to be able to do this. Um, this is a really novel
1183.02s - 1187.50s |  challenge, right? Like in the past we've seen governments have quite a lot of power when it
1187.50s - 1192.86s |  comes to the technologies that are challenging. So you've probably heard of like the crypto wars
1192.86s - 1199.10s |  in the nineties and the noughties and like the, the challenge that different governments and
1199.10s - 1204.78s |  national security organizations were having around people using end-to-end encryption and
1204.78s - 1210.78s |  their inability to sort of get through that and how they can now, um, you know, mandate different
1210.78s - 1216.30s |  bodies to be able to either like bypass that, or they were trying to do things like, um, mandate
1216.30s - 1221.42s |  implants into different technologies. In Australia in particular, there was some recent controversial
1221.42s - 1227.18s |  legislation that would also sort of mandate companies to, or at least provide the ability
1227.26s - 1235.02s |  to mandate companies to open those, those back doors as well. But being able to like do that in
1235.02s - 1239.50s |  an AI setting, when we're talking about like applying these models to really difficult use
1239.50s - 1245.42s |  cases, um, is, is a real challenge that we're seeing in the policy space at the moment. Like
1245.42s - 1251.66s |  how do we actually do that? How do governments cooperate with, like with these different
1251.66s - 1257.34s |  companies? And that's something that we're trying to figure out now. Um, so if you consider that a
1257.34s - 1265.42s |  bit of a summary of how AI for security in an offensive and defensive, um, like fashion is used,
1265.42s - 1269.66s |  um, of course I feel like I have to touch on hacking with AI. There have been some really
1269.66s - 1276.86s |  high profile cases of, um, APT groups, so Advanced Persistent Threats, um, trying to use,
1277.58s - 1283.90s |  um, you know, AI created by big companies like OpenAI and Anthropic to do hacking for them and to
1283.90s - 1290.62s |  augment this. Um, is this a real threat? I mean, yes and no. I think the way to think about
1290.62s - 1295.26s |  artificial intelligence is that it augments existing efforts, right? So we've seen quite
1295.26s - 1302.30s |  a lot of hype around how this can be, um, I guess a revolutionary challenge, um, and how it's a,
1303.26s - 1309.26s |  a really big deal and maybe that's not really the right way of thinking about it but, but thinking
1309.26s - 1315.26s |  about it as more of a tool because we're still sort of waiting to see, like, the kind of
1315.26s - 1322.86s |  impacts that people are promising we might see. Um, there are two examples of, like, APT groups
1322.86s - 1328.06s |  that have been using AI that I can sort of think of off the top of my head. Um, Russia and Iran,
1328.06s - 1333.98s |  for example, have been doing it to create deepfakes, um, to sort of augment existing,
1334.78s - 1342.22s |  um, you know, ways to make money for them, um, I guess as a way of sort of putting it bluntly.
1342.22s - 1347.18s |  Um, but I think the right way to think about it, again, is that it's part of the kill chain. It's
1347.18s - 1355.10s |  not necessarily a new, a new technology, um, or a new threat but it's really how it augments the
1355.10s - 1364.65s |  existing kill chain and amplifies those sorts of efforts. I hope the, I can't tell how often
1364.65s - 1369.61s |  the screen is doing that so I hope it's not too annoying. Um, we've seen examples of this from
1369.61s - 1375.37s |  all of the different APT groups, um, to different extents, um, and this is just a selection of them
1375.37s - 1383.53s |  as well. But I, I feel like quite a lot of talks do focus on things like AI for hacking and I,
1383.53s - 1388.17s |  I don't want to go down that rabbit hole because that's not really the thing that I'm interested
1388.17s - 1394.65s |  in. The thing I'm interested in is more of the, the strategic so what, um, which again might not
1394.65s - 1399.37s |  be all that interesting for some people but the thing I care about is like how do we actually
1399.37s - 1404.33s |  approach all those different issues of, you know, AI for security and security of AI because
1404.33s - 1409.61s |  especially working in an AI security field, I see there is so much talk about AI for security,
1409.61s - 1412.81s |  there's a lot of investment, there's a lot of smart people thinking about it, I don't think
1412.81s - 1417.45s |  that's really the problem, problem at the moment. I think the problem right now is that not many
1417.45s - 1421.61s |  people or not enough people are talking about the security of the AI systems themselves.
1422.89s - 1429.77s |  So let's think about how we hack an AI system at all. So I guess you could say that the idea
1429.77s - 1435.29s |  of hacking an AI has been around as long as AI systems have themselves, you know, especially
1435.29s - 1440.89s |  whatever we define as AI, right? So the first example that comes to mind is a simple algorithm
1440.89s - 1445.69s |  like an email spam filter. As long as those have been around, people have been trying to evade
1445.69s - 1452.49s |  spam filters and you could think of that as an example of hacking an AI system. When we think
1452.49s - 1457.93s |  about the modern or the the most recent implementation of AI hacking, it's the field
1457.93s - 1462.81s |  of adversarial machine learning which is sort of my field and the topic of my PhD and my other research
1463.53s - 1467.93s |  but it's basically ways that you can exploit the inherent characteristics of machine learning
1467.93s - 1472.57s |  models and machine learning models are the underpinning of most or all AI systems at the
1472.57s - 1479.29s |  moment and so in the real world we're starting to see these kinds of attacks possibly come to
1479.29s - 1485.05s |  fruition. It's always been considered a very academic discipline. This is sort of the classic
1485.05s - 1489.37s |  adversarial machine learning example. Can I get a show of hands if anyone's like seen this before
1489.37s - 1496.25s |  or familiar with adversarial machine learning? Okay, so it's definitely entering more of the
1496.25s - 1501.21s |  discourse at the moment but the idea at its heart, and this is from a paper about 10 years
1501.21s - 1506.81s |  ago now, so it's it's new but it's not that new. The idea was that you could take a clean image,
1506.81s - 1513.45s |  so of this panda, and you could create special noise that when superimposed on top of that image
1513.45s - 1518.73s |  prevents a model from recognizing it and the idea is that this this noise or these adversarial
1518.73s - 1524.65s |  perturbations, this adversarial example, is crafted specifically with the target model in mind and
1524.65s - 1531.37s |  that you're able to constrain it within a small epsilon value so that a human can't recognize it.
1531.37s - 1535.45s |  It's just enough that it passes a sort of classification boundary according to the model
1535.45s - 1540.81s |  but not so much that it's recognized and this is sort of the, I guess, the proverbial example that
1540.81s - 1545.53s |  most people show when they talk about adversarial machine learning and it's always been considered
1545.53s - 1550.33s |  a bit of an academic threat. Like it wasn't necessarily taken seriously. When I told my
1550.33s - 1554.89s |  PhD supervisors this is what I wanted to work on, they were like, I don't know if this will ever
1554.89s - 1558.89s |  become a thing, you know, it might not, you know, you might be shooting yourself in the foot, this AI
1558.89s - 1566.73s |  security thing. Um times have changed. It was also Australia. Again, love Australia but it's I'm not
1566.73s - 1574.25s |  trying to, yeah, it's it's it's always um yeah it's a smaller market. Um so now we're starting to see
1574.89s - 1580.81s |  more examples in the wild as you'd call it. So things like being able to paint special paint
1580.81s - 1586.01s |  onto a stop sign so that like an autonomous vehicle doesn't recognize it and would drive
1586.01s - 1591.77s |  straight through. And this is just in computer vision, right? So computer vision is a kind of
1591.77s - 1596.01s |  machine learning where you're looking at the world around you and identifying what it is.
1596.65s - 1600.49s |  Um but when we think about all of the different use cases of AI, there's things like natural
1600.49s - 1606.57s |  language processing and LLMs, um signal classification, RF, radio frequency, audio
1606.57s - 1610.65s |  waves, those are all use cases for machine learning where all of these kinds of attacks
1610.65s - 1616.73s |  apply as well but they're harder to see, like they're even harder to see. And if we think about
1616.73s - 1622.01s |  machine learning systems as well you know you'd call them an attack surface, right? As you'd use
1622.01s - 1626.89s |  the the cyber sort of lexicon. You can think about all of these different attack surfaces that have
1626.89s - 1631.45s |  their own unique characteristics. All the different kinds of models that do different things.
1631.45s - 1636.01s |  So at the top we have a convolutional neural network which is a kind of machine learning
1636.01s - 1640.73s |  model that's really good for computer vision because it decomposes information down really
1640.73s - 1645.77s |  easily. Um and then on the bottom we have a transformer which is the backbone of of GPT
1645.77s - 1649.85s |  models and is very good at natural language processing. Those are very different kinds
1649.85s - 1654.65s |  of models. Like they have some commonalities in the sense that it's all about optimization and
1654.65s - 1659.45s |  being able to you know predict things whether it's next words or images um but they're really
1659.45s - 1664.01s |  quite different. They're different attack surfaces and especially if we're adding these two cyber
1664.01s - 1669.53s |  systems they present entirely new threats. Like this is an extension of the existing cyber attack
1669.53s - 1675.85s |  surface um that is not covered by existing cyber security methodology. You know for the organizations
1675.85s - 1680.97s |  that are adopting AI without thinking about the security of them um they're they're opening
1680.97s - 1685.93s |  themselves up to new vulnerabilities. So this is sort of the example that I gave in my other talks.
1685.93s - 1693.29s |  It's being able to add different adversarial um like regions distributed regions to images so that
1693.29s - 1698.49s |  you can sort of hack facial recognition. You can do this with any kind of model really. Um the reason
1698.49s - 1702.97s |  I was so excited to see the recent Mission Impossible movie is because this is what they did.
1702.97s - 1708.33s |  I was it was really great. Um there was this scene where Ethan Hunt was running through an airport
1708.33s - 1712.97s |  and people were looking at the surveillance footage and someone was able to digitally
1712.97s - 1718.33s |  manipulate the surveillance footage so that he looked like somebody else. And the thing was that
1718.33s - 1721.69s |  they didn't need to do it in the real world because the people were only looking at the
1721.69s - 1726.89s |  surveillance footage. And it's the kind of thing where you know a lot of AML techniques or adversarial
1726.89s - 1731.45s |  machine learning techniques they were considered too academic because people couldn't really see
1731.45s - 1737.05s |  how it could relate to the real world. Like how do you put in a bunch of adversarial pixels in a
1737.05s - 1741.29s |  real world and move it around. But you know the point is that you don't always need to especially
1741.29s - 1746.01s |  now that machine learning models are doing a lot of this kind of stuff autonomously. You know
1746.01s - 1751.13s |  in the national security setting especially you know you have a lot of models that are being built
1751.13s - 1756.41s |  to do things like platform detection looking for uh you know tanks and ships and boats and things.
1756.41s - 1762.01s |  Um person identification um you don't always need to rely on having something in the real
1762.01s - 1765.77s |  world anymore. A lot of it's digital and a lot of this kind of stuff can be injected
1765.77s - 1772.97s |  just like in Mission Impossible. So this is where we get to something that I find really interesting.
1774.57s - 1781.37s |  So bear with me um there's some security studies uh I guess theory that is really interesting to
1781.37s - 1788.49s |  apply to AI and AI security. Um a few particular things are thinking about the referent object,
1788.49s - 1795.05s |  the direction of protection and securitization. Um so what do I mean by these things?
1796.25s - 1802.57s |  The referent object basically refers to the thing that you're trying to protect. Um so security
1802.57s - 1809.93s |  studies comes from sort of military security um and then is now being applied to like cyber
1809.93s - 1818.41s |  security um more rigorously. But it it basically means uh if we're creating um policy or legislation
1818.41s - 1825.93s |  or you know rules um what are we actually trying to protect? Um and usually in a in a national
1825.93s - 1830.65s |  security sense that would be the state so like a nation state um and if we're thinking about
1830.65s - 1837.61s |  cyber security it'd be like the cyber system, the cyber system. Um direction of protection
1837.61s - 1845.37s |  is all about what is if we think about what is being protected from whom. So if we think about
1845.37s - 1853.29s |  comparing AI for security versus the security of AI um this is one way of thinking about the
1853.29s - 1860.09s |  direction of protection um and it's a fundamental difference. The other one is AI safety versus AI
1860.09s - 1865.93s |  security. In the AI world there's actually quite a lot of debate about whether AI safety is different
1865.93s - 1873.05s |  to AI security and what safety versus security even means and it's fascinating to me maybe not
1873.05s - 1878.57s |  to everyone else but people in AI get really heated about this because people have very strong
1878.57s - 1885.21s |  opinions and it's often seen as sort of a philosophical question almost whereas to me
1885.21s - 1890.81s |  I I think it's pretty simple and it comes down to the direction of protection. Like to me AI safety
1890.81s - 1897.45s |  is protecting the environment from the AI system whereas AI security is about protecting the system
1897.45s - 1902.09s |  from the environment and that's how you'd characterize it in a military studies or a
1902.09s - 1908.25s |  cyber security approach as well. Like if we think about the cyber analogy, cyber safety is protecting
1908.25s - 1915.13s |  like people or users from um like cyber systems that might do them harm. So protecting them from
1915.13s - 1919.21s |  online bullying, making sure there's equitable access to the internet, things like that whereas
1919.77s - 1923.85s |  cyber security is about protecting the cyber system from external threat actors.
1923.93s - 1933.21s |  We then arrive at this concept of securitization uh and securitization basically takes the premise
1933.21s - 1938.33s |  that if something is considered an existential threat then a state is able to use extraordinary
1938.33s - 1947.53s |  measures to protect that thing. So a good example of this is the rise of um yeah cyber security.
1947.53s - 1956.17s |  So in uh say 2008 kind of times we were starting to see um the cyber attacks on Estonia uh and
1956.17s - 1962.73s |  Georgia being considered the first instances of cyber war and cyber warfare and this you know
1962.73s - 1970.17s |  enabled um the government to enact lots of cyber security laws and and measures because the threat
1970.17s - 1976.33s |  was suddenly considered existential when it's applied to say a nation state versus when it's
1976.33s - 1982.25s |  just applied to sort of the users. And it's interesting because we've seen this evolution
1982.25s - 1987.93s |  of that take place through terms like computer security versus cyber security. I mean the
1987.93s - 1994.17s |  discipline of protecting cyber systems used to be called computer security um but as it's gone
1994.17s - 1999.45s |  through this transition to becoming an existential threat and one which warrants additional laws and
1999.45s - 2005.85s |  regulations to protect it, it's become um cyber security. And there's other you know stories that
2005.85s - 2010.81s |  people have about the evolution of that as well. Um the point I'm making is that it's a transition
2010.81s - 2019.35s |  that has happened alongside the securitization of of computers and cyber systems. So when we
2019.35s - 2024.63s |  think about this in terms of AI policy there's a lot we can learn about how to make sure we're
2024.63s - 2032.23s |  creating good AI policy based on those principles and the evolutions that we've seen from cyber.
2033.19s - 2041.91s |  This is a a research paper that um my team has done recently which was um a lot of work um but
2041.91s - 2047.27s |  basically it's uh it it's looking at this, it's it's understanding if AI is going through a
2047.27s - 2053.43s |  securitization process. Um and so we did a review of public AI policy which is why I said it was a
2054.07s - 2064.31s |  lot of work. Um oecd.ai currently has a live repository of like all or at least um hopefully
2064.31s - 2073.19s |  all AI policies in the world. There's 1,937 AI policies in the world um at least time of doing
2073.19s - 2077.03s |  this research and based on what they have access to, based on certain requirements of things.
2077.99s - 2084.07s |  Um that's a lot of policy. So we wanted to understand which of these policies um
2085.03s - 2089.35s |  although those three different axes of information to what extent these policies
2089.35s - 2095.35s |  focus on those. So what did the policy consider as the referent object? Um how did it consider
2095.35s - 2105.59s |  the direction of security? Um and then um what was it did how did it define AI security? Like did
2105.59s - 2112.15s |  it define it as AI for cyber security? Did it define it as the security of AI? Um or maybe it
2112.15s - 2118.79s |  was something else. Um how did they they think about all of those things? And so we found that
2118.79s - 2125.19s |  out of all of those policies an overwhelming number of them only considered AI in the context
2125.19s - 2131.51s |  of using it for security and it wasn't even for cyber security right it was for national security.
2131.51s - 2135.11s |  Um I mean obviously these are public policies so that does sort of make sense.
2135.83s - 2141.75s |  Um but it was so overwhelming that for us this is really interesting because
2143.59s - 2149.83s |  the the the lack of consideration for AI safety in particular was really surprising to me because
2149.83s - 2156.63s |  there is quite a lot of narrative about AI safety at the moment. Um the lack of consideration for AI
2156.63s - 2161.75s |  security for me was less surprising um based on all the conversations I have which I also think
2161.75s - 2168.31s |  is a really big problem if um you know we need to be considering AI security far more. We also
2168.95s - 2173.59s |  looked at who the referent object was in the policy and especially given that these policies
2173.59s - 2179.03s |  mostly focused on AI for security of the state it makes sense that the referent object was the
2179.03s - 2184.31s |  nation state. Um and this was followed by sort of a mixture of the state and the individual
2184.31s - 2189.83s |  and then the individual and then the AI. Now what does like it does this even matter these
2189.83s - 2195.27s |  are public policies you know is this really what they need to be addressing? This number represents
2196.31s - 2202.23s |  the proportion of cyber policy that focuses on cyber security. 60 percent of cyber policy focuses
2202.23s - 2211.59s |  on cyber security. Um why can't we learn these lessons and apply it to AI? Um Neuromancer is a
2211.59s - 2216.31s |  really good like science fiction book. This is one of my favorite sci-fi books I think actually
2216.31s - 2223.91s |  and it's often credited as the first um time that the term cyberspace was used. This is written in
2223.91s - 2228.95s |  the I think seventies I believe by William William Gibson and I highly recommend it. Um and the
2228.95s - 2233.91s |  premise of the book is basically that you can sort of jack into cyberspace physically and then
2233.91s - 2240.39s |  interact with that environment. Um it's it's very cool but the connection here is that most of the
2240.39s - 2246.31s |  time AI security is considered a subset of cyber security. Uh rightly or wrongly I I just want to
2246.31s - 2251.83s |  ask everyone the question to consider. You know if if AI represents new risks and a new attack
2251.83s - 2257.27s |  surface should it be considered a subset of cyber security or shouldn't it? So outside of policy
2257.27s - 2263.67s |  we're starting to see uh more practitioner-based frameworks that address AI risk. So this example
2263.67s - 2268.63s |  by NIST is pretty good. There's lots of other sorts of taxonomies and references out there.
2268.63s - 2274.23s |  MITRE Atlas is a repository of all the TTPs of adversarial machine learning attacks for example.
2275.03s - 2279.03s |  But we're still sort of going through this maturation process especially when everything
2279.03s - 2285.51s |  is extremely AI safety focused. Um this is the model that I typically use to talk about AI
2285.51s - 2292.23s |  security threats. I talk about the three Ds. Those are disrupt, disclose and deceive. So if we're
2292.23s - 2297.75s |  thinking about that panda versus gibbon example um if you're able to disrupt the model it means
2297.75s - 2303.43s |  that that model basically just doesn't recognize that image as a panda. To deceive it means that
2303.43s - 2308.31s |  it's able to recognize that image as something specific like something else like we want it to
2308.31s - 2313.59s |  be specifically targeted as a gibbon and disclose means that you're able to leak information about
2313.59s - 2319.43s |  the training data or something like that. A lot of the conversations I have with other AI people
2319.43s - 2324.15s |  are very much that you know you can solve this problem through technology. Like if you create
2324.15s - 2329.99s |  solutions that basically pen test AI systems um you don't need to think about people or process
2329.99s - 2335.67s |  because the AI will be secure. And I can see from some of you in the room that you also don't
2335.67s - 2340.63s |  agree with that premise um because I definitely don't agree with that premise and most of the
2340.63s - 2347.51s |  time it is actually a people and process issue. Um you know you can have as much secure technology
2347.51s - 2351.67s |  as you want but if you're not able to actually create an environment where it supports that
2351.67s - 2360.23s |  security um that's that's really challenging. So I'm sort of at time but I want to end on again
2360.23s - 2366.63s |  because it's the policy village some discussion points um or maybe questions. I I we might have
2366.63s - 2371.99s |  time for Q&A I'm not really sure but I'm really interested to understand from all of you in the
2371.99s - 2378.71s |  room who obviously care about sort of the intersection of AI and security um to what
2378.71s - 2384.23s |  extent you think that you know policy can actually address these kinds of challenges
2384.23s - 2392.39s |  and how you know why is it that we're not seeing more um more action around AI security when
2392.39s - 2399.35s |  cyber security is clearly such a big problem um for all levels of society. You know the national
2399.35s - 2405.35s |  security implications of AI um are extreme and we're just not seeing these lessons learnt being
2405.35s - 2410.95s |  applied from cyber security and national security into AI security and so I hope that's something
2410.95s - 2415.35s |  that maybe you take away with you and some questions that you can ask and I also really
2415.35s - 2421.43s |  want to hear from you as well because I I want to see AI security more on the agenda. So um please
2421.43s - 2432.23s |  do keep in touch. Um yeah I I do we have time for questions? No okay well stay in touch.


url: https://www.youtube.com/watch?v=Q-rGVE9xCKw
title: DEF CON 32 - Responding to Breaches, Ransomware, and State Sponsored Threat Actors - Panel
type: video
author: DEFCONConference
ingestion_date: 2024-11-09
transcription_model: large-v2
chunking_status: completed
content:
{
  "webpage_url": "https://www.youtube.com/watch?v=Q-rGVE9xCKw",
  "title": "DEF CON 32 - Responding to Breaches, Ransomware, and State Sponsored Threat Actors - Panel",
  "description": "For the past few years, we have had multiple instances of sophisticated cyber attacks ranging from ransomware attacks to attacks propagated by state sponsored threat actors; targeting elections, organizations, critical infrastructure etc. Organizations have had to step up and compensate with additional security controls and resources. We are living in a phase where even the most secure organizations are not immune to targeted cyber threats, the landscape of cyber security is in the state of constant evolution, with everybody playing to catch up.\n\nThis panel has been structured to delve into the complex and evolving nature of cyber adversaries. Beginning with an overview of recent cyber-attacks, breaches, and targeted ransomware incidents. We will also examine the rising wave of state sponsored threat actors, while focusing on their sophisticated adversary tactics, techniques and procedures.\n\nThis panel will focus on why organizations with even the most advanced cyber defense tooling and more than capable resources are still affected by breaches and threat actors. Our panel of experts will discuss the reasons behind these incidents and provide Insights into effective response and contentment strategies. Conversation will explore the critical components of how efficiently respond to threats, contain, and remediate them.\n\nAdditionally, the panel will also touch upon how threat intel assisted adversarial attack simulation, offensive cyber security operations could be used as proactive measures in enhancing an organization\u2019s defense posture, offering valuable insights into the mindset and methodologies of potential attackers.",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 2952,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241016"
}

0.00s - 1.48s | This text was transcribed using whisper model: large-v2

 Hey, everyone.
1.48s - 3.16s |  Good morning.
3.16s - 5.24s |  Morning, DEF CON.
5.24s - 6.84s |  Good morning.
6.84s - 7.84s |  Just come on.
7.84s - 11.84s |  I flew like 20 hours from India to Las Vegas.
11.84s - 12.64s |  Come on.
12.64s - 15.73s |  Good morning, DEF CON.
15.73s - 17.49s |  Now we got it.
17.49s - 19.69s |  So we have an amazing panel here.
19.69s - 23.25s |  My name is Abhijit Babirajan Renuga.
23.25s - 24.85s |  I know how that sounds.
24.85s - 26.81s |  So I call myself ABX.
26.81s - 29.41s |  Much, much shorter so that the people will not
29.41s - 31.57s |  be ruining my night, right?
31.57s - 33.21s |  So I used to be called many things,
33.21s - 36.53s |  but ABX is kind of very, very simple.
36.53s - 37.65s |  I manage.
37.65s - 40.77s |  I lead the advocacy village at DEF CON for the past,
40.77s - 42.85s |  like, 45 years, right?
42.85s - 44.37s |  So we are all there.
44.37s - 46.41s |  After this panel, maybe you can come there,
46.41s - 48.61s |  listen to the talks, workshops, all this amazing stuff
48.61s - 50.17s |  happening in there.
50.17s - 53.73s |  And I'm handing over the mic to the amazing panel here.
53.73s - 56.09s |  They will introduce themselves, and we
56.09s - 61.12s |  can start insulting each other.
61.12s - 62.00s |  I'll go.
62.00s - 64.60s |  I'm what's-his-face Adam Pennington.
64.60s - 67.64s |  I'm with a nonprofit called the MITRE Corporation,
67.64s - 71.16s |  where I run a cybersecurity framework called MITRE ATT&CK.
71.16s - 73.88s |  I've been with MITRE a long, long time at this point.
73.88s - 75.52s |  I helped gather a lot of the data
75.52s - 76.92s |  that we used to originally create
76.92s - 81.12s |  ATT&CK through a series of honeypots with state actors.
81.12s - 86.15s |  And so I've been watching this space for a pretty long time.
86.15s - 87.99s |  Hi, I'm Stryker.
87.99s - 90.83s |  I am the head of security communications and planning
90.83s - 91.75s |  and SCP.
91.75s - 95.47s |  And yes, that acronym was on purpose.
95.47s - 97.07s |  With the Adversary Pursuit Group,
97.07s - 99.59s |  that's the Threat Intel and Threat Research Unit
99.59s - 101.47s |  within Blackpoint Cyber.
101.47s - 103.63s |  We're an MDR, which means that we actually
103.63s - 108.71s |  get a lot of information from both the feedback.
108.71s - 111.43s |  We get a lot of information from both end user environments,
111.43s - 114.71s |  from a wide range of clients, from health care
114.71s - 116.83s |  and critical infrastructure, all the way
116.83s - 119.23s |  through your service-based industries,
119.23s - 121.51s |  and your local mom-and-pop shop.
121.51s - 124.75s |  And so we get both the supply chain moments
124.75s - 128.31s |  of them attacking directly the MSPs and then our end clients,
128.31s - 130.95s |  which leads to some really interesting research
130.95s - 132.87s |  and intel that our teams have been working on.
132.87s - 134.63s |  So looking forward to sharing that.
134.63s - 137.51s |  Oh, also, if you're going to pitch the Adversary Village,
137.51s - 140.35s |  come visit later at the Lonely Hackers Club.
140.35s - 141.15s |  I am an admin.
141.15s - 142.39s |  It's lots of fun.
142.39s - 143.63s |  And then the XR Village.
143.63s - 150.33s |  So.
150.33s - 152.37s |  What's up?
152.45s - 155.37s |  I'm the guy that can't work a microphone.
155.37s - 156.09s |  My name's Ken.
156.09s - 159.17s |  I'm the VP of AI for Omni Federal.
159.17s - 161.81s |  Previous to that role, I was a White House Presidential
161.81s - 163.29s |  Innovation Fellow for four years,
163.29s - 166.57s |  where I got to see some pretty interesting fun attacks.
166.57s - 168.21s |  And I'm looking forward to sharing
168.21s - 172.05s |  some of those experiences with you all today.
172.05s - 172.97s |  Hi, everyone.
172.97s - 174.45s |  I'm Nikhil Mittal.
174.45s - 176.05s |  I'm the founder of Altered Security.
176.05s - 179.37s |  We are a small organization that train people
179.37s - 182.45s |  in red teaming, on-prem, Azure, et cetera.
182.45s - 185.25s |  So we expect some stuff on Microsoft from me.
185.25s - 188.85s |  I'm pretty interested in that.
188.85s - 191.21s |  Now that the introductions are over,
191.21s - 193.85s |  I'm going to start from the right end with Adam.
193.85s - 196.09s |  So like I mentioned, the panel topic
196.09s - 199.37s |  is about the formidable adversaries and threat actor.
199.37s - 203.45s |  So I think Adam has a long experience on identifying
203.45s - 207.57s |  and putting these threat actors in the light.
207.57s - 211.89s |  So ATT&CK tracks publicly available threat intelligence
211.89s - 214.85s |  information on lots of different adversary groups.
214.85s - 218.09s |  And we've been doing that since our creation back in 2013
218.09s - 218.97s |  to 2015.
218.97s - 220.93s |  And so everything I'm going to be talking about
220.93s - 223.17s |  is coming from publicly available open source
223.17s - 225.01s |  intelligence sources.
225.01s - 228.05s |  But state hackers are not a new thing.
228.05s - 230.01s |  We've known about it for a long time.
230.01s - 231.61s |  It's been going on for a while.
231.61s - 233.97s |  It's been in the public eye for a pretty long time
234.21s - 238.09s |  back to the cuckoo's nest in the 80s, which
238.09s - 242.13s |  might have had a role in, not a terrific one.
242.13s - 245.37s |  And so it's been something that has been out there.
245.37s - 248.93s |  We saw a lot more awareness coming with the APT1 report
248.93s - 252.21s |  and then Russian hacking with the elections.
252.21s - 254.17s |  And so we've seen a lot of these waves,
254.17s - 256.25s |  North Korean ransomware.
256.25s - 259.29s |  And more recently, we've seen a lot of activity
259.29s - 261.73s |  where China has become prevalent again,
261.77s - 264.37s |  where we're seeing sophisticated activity happening
264.37s - 269.37s |  across a lot of organizations, some successful activity.
269.37s - 272.37s |  And so we're seeing trends in a lot of these spaces.
272.37s - 275.17s |  I flinch a little bit at the word sophisticated.
275.17s - 277.25s |  I know it was in the panel description,
277.25s - 281.81s |  but most threat actors are exactly as sophisticated
281.81s - 284.37s |  as they need to be in a given situation.
284.37s - 287.97s |  If they're any good, they're not usually pulling out
287.97s - 290.81s |  sort of the big guns unless they have to.
290.81s - 293.73s |  But in places where we've been seeing the defenses
293.73s - 296.93s |  get a lot better, people are watching their networks,
296.93s - 298.89s |  people watching their end systems,
298.89s - 301.45s |  and it's gotten a lot harder to work your way
301.45s - 302.81s |  through a network.
302.81s - 305.77s |  Those of you who are red teamers probably know this too,
305.77s - 307.53s |  that the space has gotten harder.
307.53s - 311.01s |  And so we've seen adversaries who are interested
311.01s - 313.93s |  in not getting caught and sometimes ransomware,
313.93s - 317.57s |  not so much, but a state actor that wants to steal
317.57s - 322.25s |  information and be in a network for months or years
322.25s - 325.73s |  needs to not get caught or not get completely caught
325.73s - 328.29s |  in order to meet their goals.
328.29s - 331.29s |  And so we're seeing a more and more of a trend
331.29s - 335.05s |  of adversaries getting into places that we don't watch.
335.89s - 337.73s |  And so it's a natural place to be.
337.73s - 340.81s |  It's nothing that we didn't know was possible.
340.81s - 343.45s |  It's not incredibly surprising,
343.45s - 345.41s |  but adversaries getting into routers.
345.45s - 348.21s |  We saw a lot of reporting on routers last year
348.21s - 350.09s |  and system security devices.
350.09s - 353.01s |  So finding a lot of zero days in the devices
353.01s - 355.49s |  that we actually bought to protect our networks,
355.49s - 358.53s |  getting into those and using those as pivot points
358.53s - 362.69s |  has been a popular trend to get into VMware ESX servers.
362.69s - 366.93s |  So getting into places where we can't run an ADR,
366.93s - 370.01s |  they're not supported, we don't know how to see there.
370.01s - 372.85s |  And so you're more and more buried into the system.
372.85s - 375.01s |  We've also seen a trend lately with adversaries
375.61s - 376.85s |  getting into security cameras.
376.85s - 381.01s |  And so crappy Linux devices that we have no security on
381.01s - 383.33s |  have no way of adding security to.
383.33s - 385.53s |  And so we're gonna have to be looking at some other places
385.53s - 390.95s |  to actually spot this activity.
390.95s - 393.31s |  That actually reflects a lot of what we've been seeing
393.31s - 395.63s |  in the wild with a lot of our different client bases,
395.63s - 397.15s |  to be honest.
397.15s - 401.23s |  I would say that in addition to some of the really neat
401.23s - 403.83s |  hackery kind of almost admirable things
403.87s - 408.07s |  and sophisticated, maybe less just clever,
408.07s - 410.95s |  unexpected ways that nation state level
410.95s - 412.43s |  threat actors are using,
412.43s - 415.59s |  they do make their way down into the pipeline.
415.59s - 417.99s |  There is a whole undercurrent on the dark web
417.99s - 421.79s |  of people selling everything from malware and ransomware
421.79s - 424.19s |  to initial access and even phishing as a service.
424.19s - 427.11s |  I have seen extremely sophisticated UI
427.11s - 429.83s |  that look like HubSpot or Salesforce
429.83s - 432.39s |  is gonna send you an email like no before,
432.39s - 433.47s |  but for bad guys.
434.11s - 435.35s |  It's pretty sophisticated.
435.35s - 437.63s |  So the tactics and techniques that we're seeing
437.63s - 439.67s |  at the APT level eventually do trickle down
439.67s - 443.07s |  to the script kitties who are just spamming out things
443.07s - 446.79s |  to all of the different organizations at the same time.
446.79s - 450.79s |  And one of the things to add to that is going to be,
450.79s - 454.35s |  we're seeing a lot more of living off the land tactics.
455.43s - 459.03s |  People who are using and abusing either red team tools
459.03s - 462.35s |  that were developed explicitly for research,
462.35s - 464.47s |  impact it, et cetera,
464.47s - 468.15s |  or they're using and abusing scripts and systems
468.15s - 470.63s |  and controls within the endpoints themselves
470.63s - 472.39s |  that were designed for system admins
472.39s - 473.43s |  to make their lives easier.
473.43s - 476.23s |  I mean, remote desktop protocol guys,
476.23s - 479.59s |  like it's designed for somebody with privilege
479.59s - 482.15s |  to go in and fix another user's computer.
482.15s - 483.95s |  Boy, I can't imagine how an adversary
483.95s - 485.55s |  is gonna use that, right?
485.55s - 487.79s |  That's an easy lateral movement.
487.79s - 490.51s |  And you get such friction from the business side
490.51s - 492.39s |  to turn that off because what's the solution
492.39s - 494.31s |  in an increasingly remote world?
494.31s - 496.87s |  So really what we've discovered is one,
496.87s - 498.27s |  you have to be really careful.
498.27s - 500.15s |  Allow listing and block listing
500.15s - 502.51s |  doesn't matter as much anymore.
502.51s - 504.19s |  I mean, obviously make sure
504.19s - 506.51s |  that you have a centralized software center
506.51s - 508.99s |  and we can get more into remediations later.
508.99s - 511.51s |  But the major threat actors we've been seeing lately
511.51s - 514.87s |  have just been using and abusing these particular tools.
514.87s - 516.99s |  And so it's time that we stop talking
516.99s - 518.71s |  about IOCs explicitly.
518.71s - 521.83s |  And it's time that we start talking, to Mitre's point,
521.83s - 523.87s |  about how they're abusing these tools
523.87s - 525.79s |  and how we can sense that change in behavior
525.79s - 530.34s |  if you really wanna do something about it.
530.34s - 534.62s |  The biggest thing that I always think about
534.62s - 538.90s |  when considering state-sponsored attacks is scale.
538.90s - 540.54s |  It's the amount of resources
540.54s - 542.98s |  that state sponsors can commit to it.
542.98s - 546.26s |  It's entire job and workforce.
546.26s - 549.94s |  So the days are gone when I could reliably hope
549.94s - 551.18s |  for a single adversary.
551.18s - 552.70s |  That's never the case.
553.62s - 558.14s |  So now I'm up against teams who has a lot of money,
559.06s - 563.22s |  a lot of compute, and very, very distributed
563.22s - 565.06s |  with interesting, sophisticated attacks
565.06s - 567.70s |  to spend their own R&D money on.
567.70s - 570.50s |  That's the landscape of sponsored attacks.
571.38s - 573.82s |  And that's up to your point, that's trickled down,
573.82s - 575.82s |  where we're now seeing the dark net,
575.82s - 578.34s |  some of those same tech from a few years back
578.34s - 580.02s |  available as a service.
581.06s - 585.78s |  And the next evolution to change the individual players
585.78s - 588.34s |  are models like WhiteRabbit Neo
588.34s - 593.14s |  that allows you to ask AI without guardrails,
593.14s - 595.34s |  hey, how do I do a DDoS?
595.34s - 598.98s |  And it gives you a pretty simple example in Python.
598.98s - 601.66s |  So now we have tools that can supercharge
601.66s - 604.38s |  the average person to become a one-person team.
604.38s - 607.58s |  And that is pretty terrifying to think about.
607.58s - 610.50s |  And now let's add that to the state-sponsored level.
610.50s - 613.30s |  All that R&D money, all that resource,
613.30s - 615.62s |  all that GPU access,
615.62s - 621.18s |  that's the current reality we're up against.
621.18s - 626.18s |  Okay, so I would agree to what other panelists say,
627.30s - 629.34s |  but one thing that I would like to add here
629.34s - 634.34s |  is when we talk about advanced adversaries,
634.66s - 637.54s |  are we really defending even for normal attacks?
637.54s - 640.58s |  So if you look at any previous hack,
640.58s - 642.82s |  as I said, Microsoft, for example,
642.82s - 645.50s |  if an organization at the level of Microsoft,
645.50s - 647.38s |  or for that matter, any tech organization,
647.38s - 650.98s |  they can't compromise just using a password spray attack.
650.98s - 654.94s |  That's not absolutely anything that is sophisticated.
654.94s - 657.26s |  You know, just so blowing our own trumpet here.
657.26s - 660.78s |  So when we teach, let's say Azure Red Teaming,
660.78s - 663.98s |  we don't even consider password spraying as a valid attack.
663.98s - 665.14s |  We mentioned that and we said,
665.14s - 667.74s |  okay, this is not going to work against Azure
667.74s - 668.58s |  without testing.
668.58s - 671.02s |  I mean, that is the sort of confidence we had,
671.02s - 673.50s |  we used to have on Microsoft.
673.50s - 675.98s |  So what I think is lacking,
675.98s - 679.58s |  whether it is the advanced adversaries
679.58s - 681.74s |  or your good attackers like penetration testers
681.74s - 684.78s |  or Red Teamers, is the basic hygiene.
684.78s - 689.02s |  Are we still leaving credentials in clear text on shares
689.02s - 690.54s |  in an internal environment?
690.54s - 692.38s |  Well, yes, probably.
692.38s - 695.34s |  So that doesn't need any research,
695.34s - 697.54s |  any research budget at all.
697.54s - 700.94s |  So that is what I would like to bring in.
700.94s - 703.22s |  Go for the basic hygiene.
703.22s - 707.50s |  Doesn't need an advanced adversary to read your credentials
707.50s - 709.74s |  or, you know, have an SMB relay attack,
709.74s - 711.82s |  or for that matter, I mean, you know,
711.82s - 715.86s |  sending a phishing link to one of your employees.
715.86s - 719.62s |  So defense in depth, not even that basic security hygiene,
719.62s - 721.94s |  if you follow that, you can actually stop,
722.34s - 724.42s |  using it once again from Microsoft's marketing,
724.42s - 726.14s |  99% of the attacks.
726.14s - 727.38s |  That's true.
727.38s - 729.94s |  So that is what my point is.
729.94s - 736.43s |  On top of that, I would add something for Red Teamers,
736.43s - 737.83s |  give them time.
737.83s - 740.19s |  If you are in an organization,
745.41s - 747.49s |  if you're in a position to make a decision,
747.49s - 750.33s |  do not get your Red Team operations done in a week.
750.33s - 752.09s |  Don't do that, please.
752.09s - 754.17s |  Provide the good attackers more time.
754.17s - 757.45s |  You know, APTs include the word persistent.
757.45s - 760.49s |  Have persistently tested your stuff.
760.49s - 762.69s |  It's not going to happen in a week or two,
762.69s - 766.29s |  where you give a couple of IPs to your good attackers
766.29s - 768.85s |  and say that, okay, these are our firewall IPs.
768.85s - 771.05s |  Let's see if you can get your domain admin.
771.05s - 773.73s |  That's not unfortunately how it is going to be
773.73s - 775.17s |  for the actual attackers.
776.01s - 777.65s |  Yeah, and one more thing for the Red Teamers,
777.65s - 779.09s |  domain admin is not everything.
779.09s - 781.13s |  Don't go for that all the time.
782.33s - 783.33s |  Yeah, that's for me.
786.06s - 788.10s |  What is this, Amit?
788.10s - 790.10s |  I stand with Nikhil on this
790.10s - 795.02s |  because he taught a generation of AI hackers in India
795.02s - 797.58s |  with respect to Red Teaming, right?
797.58s - 799.66s |  I also would like to add a point in there,
799.66s - 801.02s |  a humiliating one.
801.02s - 805.22s |  So I was performing Red Teaming for one of my clients, right?
805.22s - 807.54s |  I'm not going to tell Derek Knight, maybe.
807.54s - 808.94s |  I'm not, okay.
808.94s - 809.90s |  I should not.
809.90s - 813.42s |  So I found a service, like he mentioned, the hygiene.
813.46s - 815.70s |  I have seen a service account in there
815.70s - 819.74s |  that has been waiting for me for the last 18 years.
819.74s - 822.50s |  They created that service account in there
822.50s - 824.54s |  when I was studying in my, I don't know,
824.54s - 826.46s |  maybe eighth or ninth standard.
826.46s - 828.70s |  And it was there for like waiting for me.
828.70s - 829.70s |  Come and break me.
829.70s - 830.90s |  Come and break me.
830.90s - 832.46s |  I'm waiting for you, right?
832.46s - 834.54s |  It was there for 18 years.
834.54s - 837.18s |  It was like within a couple of minutes we got that.
837.18s - 838.02s |  I was amazed.
838.02s - 841.02s |  Okay, this is when the password was last changed.
841.06s - 844.58s |  That was in 2002, I guess, right?
844.58s - 846.94s |  This is, the basic security hygiene is important
846.94s - 849.66s |  because if you're looking at the attacks happening
849.66s - 851.62s |  around the globe, they are not,
851.62s - 853.02s |  sometimes they are not even using
853.02s - 855.02s |  a sophisticated attack vector.
855.02s - 858.42s |  They're just getting in, you know, by brute forcing SSH,
858.42s - 860.06s |  brute forcing RDP, or, you know,
860.06s - 861.22s |  finding stolen credentials.
861.22s - 863.54s |  I mean, these are very, very, very, you know,
863.54s - 866.74s |  basic matter of security hygiene.
866.74s - 868.50s |  I'm not going to take much more time
868.54s - 871.14s |  because once I start talking, then done.
871.14s - 873.86s |  Okay, I am going to give back to the panel
873.86s - 876.14s |  so that they can share their insights
876.14s - 880.06s |  on how even the major organizations are getting breached.
880.06s - 881.14s |  Right?
881.14s - 884.46s |  Some of them are considered to be impenetrable, right?
884.46s - 888.04s |  So I'm going to, you know.
888.04s - 888.92s |  Pass it back.
890.16s - 891.00s |  You started with me again?
891.00s - 891.92s |  Yeah.
891.92s - 893.76s |  Okay, I guess starting with me again.
895.24s - 899.00s |  So MITRE's got a pretty good example of this.
899.00s - 902.48s |  We came out in public a matter of months ago
902.48s - 907.48s |  that we had had a breach into a lab network at MITRE.
907.80s - 911.36s |  And so, you know, adversary had used a couple of zero days
911.36s - 912.76s |  against a security appliance,
912.76s - 915.88s |  had gotten into the ESX infrastructure
915.88s - 918.36s |  that was within that lab.
918.36s - 922.00s |  And so, you know, we try pretty hard at security,
922.00s - 925.64s |  but, you know, there, we patched as fast
925.64s - 927.04s |  as the patches were available.
927.04s - 929.72s |  We watched the stuff as well as we could,
929.72s - 931.64s |  but they were getting into places
931.64s - 935.00s |  that just hadn't necessarily been seen yet,
935.00s - 939.56s |  or, you know, just a couple days ahead of the zero days.
939.56s - 941.44s |  And so, you know, I'd like to suggest,
941.44s - 944.12s |  and I know some people in sort of software hardening
944.12s - 945.56s |  might get mad at me for this,
945.56s - 948.76s |  but that if an adversary is willing
948.76s - 951.52s |  to dedicate enough resources to it,
951.52s - 954.24s |  they are going to get into their target.
954.24s - 956.92s |  You know, if it doesn't work
956.92s - 959.36s |  through some sort of connected means,
959.36s - 961.48s |  you always have close access operations,
961.48s - 965.72s |  you can, you know, send somebody to the environment.
965.72s - 967.72s |  And so it's, you know, one of the reasons
967.72s - 971.16s |  that even organizations that are getting a lot right
971.16s - 974.24s |  are still having problems is that, you know,
974.24s - 977.52s |  we do have places that are willing to escalate
977.52s - 980.40s |  right up until they succeed.
980.40s - 982.32s |  And so as long as that's going on,
982.32s - 983.72s |  as long as we have people sort of willing
983.72s - 984.88s |  to dedicate resources,
984.88s - 988.04s |  and as long as you're a juicy enough target,
988.04s - 990.36s |  you know, it is, you're going to have to sort of
990.36s - 994.28s |  deal with containment, deal with being able to detect it,
994.28s - 996.04s |  deal with the fallout,
996.04s - 999.76s |  rather than just assuming that you can keep them out.
999.76s - 1003.52s |  We also just have so many interconnected complex systems.
1003.52s - 1008.00s |  And so cloud has definitely made this harder
1008.00s - 1010.92s |  where we have new systems that can get,
1010.96s - 1014.72s |  adversaries can get into more challenging visibility
1014.72s - 1017.08s |  in being able to monitor those systems
1017.08s - 1019.72s |  and just creating a bigger surface now
1019.72s - 1026.79s |  that people have access to.
1026.79s - 1029.67s |  That's very similar to what we've been observing
1029.67s - 1033.55s |  on our level, which I can't disclose who our clients are,
1033.55s - 1037.63s |  but we see, we're certainly not protecting the NSA yet.
1039.19s - 1042.91s |  That said, a lot of the attacks
1042.91s - 1045.11s |  that we've been seeing are opportunistic.
1045.11s - 1047.47s |  So to the point of basic security hygiene,
1047.47s - 1050.07s |  you don't need a pen test to know that you need
1050.07s - 1052.79s |  to get business buy-in to get MFA enabled, right?
1054.99s - 1059.31s |  It's the trick of convincing them that this is worth doing.
1059.31s - 1062.39s |  And to that, I can add a couple of stories.
1062.39s - 1065.11s |  For example, about one out of every four
1065.11s - 1068.75s |  or one out of every five of the people that we onboard
1068.75s - 1072.91s |  at our MDR are in the middle of an active BEC,
1072.91s - 1074.19s |  business email compromise.
1074.19s - 1077.19s |  They had no idea that they were compromised.
1077.19s - 1079.87s |  We would go in as part of the onboarding process
1079.87s - 1081.35s |  and our SOC will get tickets all the time.
1081.35s - 1083.51s |  Hey, we're pinging.
1083.51s - 1085.55s |  Can you isolate that for us, please?
1085.55s - 1086.39s |  Thank you.
1087.35s - 1089.99s |  And they got it as a preventative
1089.99s - 1092.39s |  without knowing that they were actively infected
1092.39s - 1095.51s |  and in some cases for months
1095.51s - 1097.11s |  before they were able to detect that.
1097.11s - 1100.71s |  And so to reiterate, if they wanna get in,
1100.71s - 1101.55s |  they're gonna get in.
1101.55s - 1104.67s |  And even if you're not a major organization,
1104.67s - 1107.39s |  all it takes is one person to get in.
1107.39s - 1109.47s |  And I think part of the problem here
1109.47s - 1112.99s |  is that we're dealing with people don't like the idea
1112.99s - 1114.55s |  of them going into our home.
1115.51s - 1117.67s |  Our servers, our environment, our endpoints,
1117.67s - 1119.87s |  this is where we live in a digital era,
1119.87s - 1120.99s |  especially if you work from home,
1120.99s - 1123.59s |  there is something very personal and intimate.
1123.59s - 1126.91s |  And thinking about somebody inside your system
1126.91s - 1128.27s |  is a little bit like coming home
1128.27s - 1129.47s |  and having the door wide open
1129.47s - 1130.79s |  and seeing muddy footprints in front of you.
1130.79s - 1131.63s |  It terrifies you.
1131.63s - 1134.35s |  So you spend bazillions of dollars
1134.35s - 1136.15s |  preventing that from ever being seen,
1136.15s - 1138.83s |  but the adversaries are sophisticated enough,
1138.83s - 1141.03s |  even at a script kiddie level,
1141.03s - 1145.07s |  thanks to trickle down dark web economics, I suppose,
1146.51s - 1149.47s |  that they're cleaning up after themselves
1149.47s - 1151.83s |  and the door is very carefully locked behind them.
1151.83s - 1153.51s |  You cannot tell.
1153.51s - 1158.51s |  And so what I would recommend and reiterate
1158.71s - 1160.67s |  is that you can spend all of this money
1160.67s - 1164.95s |  on every phishing email attention and antivirus and EDR.
1164.95s - 1167.99s |  Those are important core technologies
1167.99s - 1169.71s |  that you need for both compliance
1169.71s - 1172.19s |  and just getting rid of the kind of the base level,
1172.19s - 1174.95s |  but don't think that you've stopped everyone.
1174.95s - 1177.79s |  We had a supply chain attack actually
1177.79s - 1180.11s |  with a critical infrastructure partner.
1180.11s - 1183.11s |  It was a supply chain business email compromise
1183.11s - 1185.39s |  that I'm thinking of specifically.
1185.39s - 1188.55s |  Their partner was compromised, but didn't know it.
1188.55s - 1192.91s |  And one of their personnel sent an email that was expected.
1192.91s - 1194.31s |  They wrote it all nine
1195.83s - 1200.35s |  to our protected critical infrastructure environment
1200.35s - 1202.31s |  about a meeting and it had an attachment
1202.31s - 1205.59s |  and it wasn't the attachment, the email PDF
1205.59s - 1207.91s |  that was actually the vector.
1207.91s - 1210.95s |  It was the image file in this signature line,
1211.83s - 1213.23s |  which was fricking...
1214.07s - 1215.99s |  It was bad.
1215.99s - 1220.47s |  It was very naughty of them, but it was just so clever.
1220.47s - 1223.19s |  And they had ended up compromising several
1223.19s - 1227.35s |  of that other organizations.
1227.35s - 1229.23s |  And so these people were sending out
1229.23s - 1232.67s |  completely legitimate emails that were actually phishing.
1232.67s - 1237.67s |  And we tripped up on attempted NTLM credential theft
1237.87s - 1239.99s |  was how we ended up catching it
1239.99s - 1241.83s |  because at that point they got in
1241.83s - 1243.03s |  and it wasn't even your front door.
1243.83s - 1244.75s |  It was somebody else's and it was a complete...
1244.75s - 1246.63s |  You would never have guessed this was a phishing email.
1246.63s - 1249.27s |  I still read this and I'm like, is there a typo?
1249.27s - 1253.35s |  It was just the image in the email subject line,
1253.35s - 1255.63s |  excuse me, signature line.
1255.63s - 1262.28s |  So just food for thought.
1262.28s - 1264.88s |  At this scale of our organization,
1264.88s - 1267.16s |  the size of the United States government,
1267.16s - 1270.36s |  there is no version where they're doing
1270.36s - 1272.64s |  all the security by themselves,
1272.64s - 1275.12s |  where they're going to rely on
1275.12s - 1276.44s |  private industry vendors.
1276.44s - 1281.24s |  There's no version where that's remotely conceivable
1281.24s - 1285.27s |  to replace private industry.
1285.27s - 1288.31s |  At what point do you draw the distinction
1288.31s - 1290.67s |  of how you trust a company?
1290.67s - 1295.31s |  How far do you dig to find out if they have some,
1296.67s - 1300.03s |  at worst, a vulnerability they know but don't disclose
1300.99s - 1306.59s |  or willfully ignorant and something popped?
1306.59s - 1309.87s |  The hardest part isn't whether or not we have to
1309.87s - 1312.59s |  or are willing to rely on these vendors.
1312.59s - 1314.87s |  Without that level of trust,
1314.87s - 1317.83s |  we can't also move this industry forward.
1317.83s - 1320.11s |  We all have jobs for this very reason.
1321.07s - 1325.11s |  And at what point can we start forgiving
1326.39s - 1328.83s |  ways to disclose information that's highly critical
1328.83s - 1330.51s |  but also tightly held?
1330.51s - 1334.07s |  What's the difference between a zero day to hit MITRE
1334.07s - 1336.23s |  or a zero day that hits the White House?
1336.87s - 1340.31s |  Why is one more valuable than the other?
1340.31s - 1341.15s |  Thank you.
1342.27s - 1345.03s |  I would like to add on the same thing
1345.03s - 1347.31s |  on the supply chain stuff.
1347.31s - 1352.31s |  So that is what a lot of us call gentrification of security,
1353.59s - 1355.43s |  hiding stuff behind licenses.
1355.43s - 1357.27s |  You know, you get, you pay more.
1357.27s - 1359.67s |  If you want to be secure, you pay more out of that.
1359.67s - 1363.71s |  So for example, if you are an organization who has,
1363.71s - 1366.91s |  let's say their voice support outsource to Philippines,
1367.27s - 1369.15s |  your tech support to India and so on,
1370.03s - 1373.75s |  are you sure that the kind of security that your HQ
1373.75s - 1375.87s |  or your main office would have,
1375.87s - 1378.75s |  is that the same thing that your partners have?
1378.75s - 1381.99s |  And I can tell you that coming from a poor country
1381.99s - 1382.95s |  that is still developing,
1382.95s - 1384.95s |  I can tell you that no, that's not the case.
1384.95s - 1386.55s |  Having worked from people right away
1386.55s - 1388.23s |  from the easternmost part of the world
1388.23s - 1389.67s |  to the westernmost part,
1389.67s - 1393.27s |  that is something that always stand out.
1393.27s - 1396.35s |  An organization based out of, you know,
1396.79s - 1397.71s |  we call it the western world,
1397.71s - 1400.03s |  you call it the richer part of the world,
1400.03s - 1403.23s |  the kind of security features and the money
1403.23s - 1406.39s |  that they would have, even if it is the same organization,
1406.39s - 1409.63s |  is going to be entirely different across geographies.
1409.63s - 1412.95s |  And however, there is an internal trust that,
1412.95s - 1414.67s |  okay, this is my US office
1414.67s - 1416.11s |  and that is the same organizations,
1416.11s - 1417.47s |  let's say Bangalore office.
1417.47s - 1419.23s |  So we trust those guys.
1419.23s - 1422.47s |  However, the level of security controls the money
1422.47s - 1424.91s |  that is spent there, that is entirely different.
1424.91s - 1427.19s |  So that is a sort of a supply chain attack
1427.19s - 1429.59s |  that goes under the radar.
1429.59s - 1433.71s |  You look at your partners, but not your own offices,
1433.71s - 1435.75s |  if you're a large enough organization.
1435.75s - 1437.63s |  And if you are a small organization
1437.63s - 1441.91s |  that unfortunately not everyone is interested to talk about,
1441.91s - 1444.23s |  where you would have an organization of a thousand people
1444.23s - 1445.71s |  and a couple of IT guys,
1445.71s - 1449.43s |  no, of course, dedicated threat team, then best of luck.
1449.43s - 1453.03s |  No one is interested in talking about you at that time.
1453.03s - 1456.35s |  So for them, I would say, pick up the open source,
1456.35s - 1461.19s |  much hated tools, the OSTs that people create on weekends,
1461.19s - 1463.47s |  on their own time, pick them up,
1463.47s - 1466.91s |  run it on your own in your environments
1466.91s - 1468.55s |  and create your own IOCs.
1468.55s - 1471.79s |  If you're a small enough organization, no one cares.
1471.79s - 1476.67s |  You have to take care of yourself.
1476.67s - 1481.67s |  So I used to share a story about my school days,
1482.35s - 1483.87s |  shamelessly everywhere.
1484.67s - 1487.39s |  That's about I being bullied in the school.
1487.39s - 1489.19s |  So when I was in the lower primary school,
1489.19s - 1490.91s |  I was not this big.
1490.91s - 1492.59s |  I didn't have a mustache.
1492.59s - 1494.99s |  I was a very small, very lean guy, right?
1494.99s - 1497.31s |  So other people, they used to bully me a lot.
1497.31s - 1500.43s |  Then my mother, she got me into a karate school.
1500.43s - 1504.27s |  Then after a couple of years, I became a bit taller.
1504.27s - 1506.59s |  Then eventually I became kind of the bully
1506.59s - 1508.27s |  in my high school days.
1508.27s - 1510.51s |  So here we have been talking about
1510.51s - 1512.87s |  how we have been bullied so far.
1512.87s - 1516.07s |  All these organizations are getting bullied, right?
1516.07s - 1521.07s |  And now it is a time to learn from the wise people here,
1521.35s - 1523.83s |  how we can respond to such attacks.
1523.83s - 1525.15s |  So we have seen that,
1526.67s - 1529.31s |  so we have seen that all of these organizations
1529.31s - 1532.95s |  can be bullied, even using a small technique,
1532.95s - 1536.19s |  maybe to the, like, you know, Adam's apple,
1536.19s - 1537.47s |  very small technique, right?
1537.47s - 1539.87s |  Maybe you can try talking to your friends, right?
1539.87s - 1542.03s |  So we have seen that all these organizations
1542.03s - 1543.55s |  can be bullied.
1543.55s - 1548.11s |  Now, back to them, how we can respond to these attacks.
1548.11s - 1550.71s |  How can we respond to these incidents
1550.71s - 1554.11s |  in a better way that we could handle things, right?
1554.99s - 1560.90s |  Back at you.
1560.90s - 1562.70s |  So I think people might be expecting for me
1562.70s - 1565.22s |  to say use MITRE ATT&CK.
1565.22s - 1569.42s |  And that's not where you want to start.
1569.42s - 1572.90s |  I mean, and so a couple of people have mentioned hygiene
1572.90s - 1574.34s |  along the way.
1574.34s - 1578.50s |  And, you know, it sounds so basic,
1578.50s - 1581.06s |  but making sure that you're getting the basics right first,
1581.06s - 1584.06s |  you know, things like multi-factor authentication,
1584.06s - 1585.90s |  segmentation of privileges,
1585.90s - 1589.06s |  making sure that your network isn't just a flat space
1589.06s - 1591.78s |  that an adversary can dance around,
1591.78s - 1594.26s |  actually patching your systems.
1594.26s - 1597.22s |  And so, you know, working your way up through,
1597.22s - 1598.70s |  starting to look at behaviors,
1598.70s - 1601.26s |  looking at what people are doing in systems,
1601.30s - 1604.90s |  sort of more the ATT&CK end of things
1604.90s - 1607.86s |  where people are using EDRs and whatnot.
1607.86s - 1611.94s |  But I'm a huge fan if you've got your act together
1611.94s - 1613.38s |  on all of those things.
1613.38s - 1614.98s |  And, you know, talking a little bit about
1614.98s - 1617.78s |  how do we bring it back to the adversary.
1617.78s - 1621.30s |  I'm a big fan of direct adversary engagement.
1621.30s - 1623.50s |  So honeypots, deception,
1623.50s - 1626.22s |  actually placing adversaries in environments
1626.22s - 1628.06s |  where you're able to monitor them
1628.06s - 1630.62s |  potentially for long periods of time
1630.66s - 1632.26s |  for a couple of different purposes.
1632.26s - 1635.82s |  One is starting to understand what an adversary might do
1635.82s - 1638.38s |  when they think that they've broken into your environment.
1638.38s - 1641.34s |  If you've really got things going well
1641.34s - 1643.22s |  and you're able to get somebody to operate,
1643.22s - 1646.50s |  being able to see what exactly those things would be
1646.50s - 1650.18s |  that you might find out that they have ready for you.
1650.18s - 1651.86s |  The other thing is deterrence though.
1651.86s - 1655.34s |  So I've had some experience with getting caught
1655.34s - 1657.90s |  doing that by adversaries too.
1657.90s - 1661.94s |  And what we saw was that they were much more cautious
1661.94s - 1664.14s |  in how they operated in the future.
1664.14s - 1666.14s |  And so they realized that they had been caught.
1666.14s - 1669.02s |  They realized that they'd given up some of their trade craft
1669.02s - 1670.34s |  and we saw them back off.
1670.34s - 1672.58s |  We saw them spend more time doing
1672.58s - 1674.22s |  an attack we'd call discovery.
1674.22s - 1676.78s |  So figuring out, am I in the right place?
1676.78s - 1678.10s |  What's the system I'm on?
1678.10s - 1679.86s |  What are the systems around me?
1679.86s - 1682.38s |  Which can be really noisy activity
1682.38s - 1684.70s |  if you're watching for the right things.
1684.74s - 1687.94s |  And so serving as a little bit of deterrence.
1687.94s - 1690.82s |  And so once you're beyond the basics
1690.82s - 1693.50s |  and once you're bringing it back to the adversary,
1693.50s - 1697.06s |  if you really have all those things working together,
1697.06s - 1699.18s |  I'm a fan of taking it one step farther
1699.18s - 1705.98s |  and starting to interact with them a bit.
1705.98s - 1710.98s |  I will start with MFA, please.
1711.26s - 1712.98s |  Please, just MFA.
1714.78s - 1717.82s |  That's my security hygiene pitch right there for today.
1718.58s - 1721.10s |  But okay, so let me build on that then.
1721.10s - 1723.14s |  Why do more organizations not have MFA?
1723.14s - 1724.90s |  Why do more organizations not have
1724.90s - 1726.10s |  these basic security protocols?
1726.10s - 1729.06s |  One, we're overworked and tired and under-resourced.
1729.06s - 1730.74s |  Just straight out, right?
1730.74s - 1735.38s |  Second reason, people see security
1735.38s - 1738.26s |  not as an insurance policy, but as a cost center.
1738.26s - 1739.62s |  And by people, I mean finance
1739.62s - 1742.18s |  and I mean the executives who control the budget.
1742.18s - 1744.78s |  They aren't here right now, you are.
1744.78s - 1748.74s |  You are the advocate for every user in your organization.
1749.58s - 1751.62s |  You wanna know how you use sophisticated
1751.62s - 1754.58s |  nation state attacks at your organization
1754.58s - 1755.98s |  regardless of the size?
1755.98s - 1758.50s |  You use it as an example.
1758.50s - 1760.34s |  Executives and people with finance
1760.34s - 1763.18s |  actually understand headlines, right?
1763.18s - 1765.46s |  Find ones that are similar to yours
1765.46s - 1769.50s |  and say, look, this costs millions scaled down.
1769.50s - 1772.42s |  This could cost us this amount.
1772.42s - 1774.82s |  And of course, do your ALE calculation,
1774.82s - 1777.34s |  percentage of probability of something attacking
1777.34s - 1779.54s |  times the cost of the impact.
1779.54s - 1781.70s |  Remember your soft costs, your knock-on costs,
1781.70s - 1785.38s |  your lost contracts and time and reputation.
1785.38s - 1787.42s |  Those are all in addition to whatever
1787.42s - 1791.18s |  your insurance premium is going to go up by, right?
1791.18s - 1793.30s |  Present that then, and then go to them and say,
1793.30s - 1796.18s |  if we enable MFA, it costs like nothing.
1797.70s - 1799.98s |  And your executives who will be on the line
1799.98s - 1804.06s |  and talking to the press when an attack happens
1804.06s - 1806.34s |  and you have paper trailed
1807.38s - 1811.38s |  everything of your recommendation, you will be fine.
1811.38s - 1812.50s |  The organization ultimately,
1812.50s - 1815.78s |  unless you are in critical infrastructure and healthcare,
1815.78s - 1817.22s |  data is at risk.
1817.22s - 1818.90s |  The company is at risk.
1818.90s - 1821.14s |  Livelihoods are at risks, but not lives.
1821.14s - 1824.26s |  You will be fine.
1824.26s - 1826.38s |  The executives know that they're on the line.
1826.38s - 1828.34s |  Bring it home to them and talk to them
1828.34s - 1829.94s |  in the language that they most understand
1829.94s - 1832.18s |  because it's easy for us to sit up here, right?
1832.18s - 1835.62s |  And say, yeah, easy peasy.
1835.62s - 1837.14s |  We know the solution already
1837.14s - 1839.78s |  for a lot of these nation state attacks,
1839.78s - 1842.58s |  but when boots on the ground, we're not there with you.
1842.58s - 1844.78s |  When you're trying to illustrate to them,
1844.78s - 1847.86s |  you're all fired up from DEF CON, from Hacker Summer Camp,
1847.86s - 1849.98s |  and you're trying to justify this expenditure
1849.98s - 1852.98s |  to those people, bring it back to the money
1853.86s - 1856.10s |  and then demonstrate how this is
1856.10s - 1858.34s |  perhaps a minor inconvenience,
1858.34s - 1861.22s |  but it's so much better than the alternative.
1861.22s - 1865.58s |  And you have all of the stories here at this conference
1865.58s - 1871.02s |  to fuel that for your next budget.
1871.02s - 1873.42s |  The thing to consider is psychology.
1875.10s - 1878.30s |  You have to ask yourself,
1878.30s - 1883.30s |  not who or how you get attacked, but why.
1884.74s - 1886.14s |  What is the motivation?
1886.14s - 1889.06s |  And that motivation direct influence
1889.06s - 1891.50s |  to how the attack is carried out.
1891.50s - 1894.26s |  Because there is high value to attacks
1894.26s - 1896.78s |  that are very noisy and very obvious
1896.78s - 1898.58s |  that winds up on CNN.
1898.58s - 1901.42s |  There's also a lot of value to attacks
1901.42s - 1905.78s |  that go unnoticed for days, weeks, months, and years.
1906.78s - 1910.90s |  So understanding the persona of your adversary
1910.90s - 1915.06s |  is so critical to even have a chance to push back
1915.06s - 1916.86s |  to wear that hat for a day
1916.90s - 1919.82s |  and really consider beyond what this attack
1919.82s - 1921.74s |  or what this person, this human is doing,
1921.74s - 1924.22s |  but what's their motivation?
1924.22s - 1925.82s |  What's their culture?
1925.82s - 1927.66s |  What's their everyday like?
1927.66s - 1930.42s |  Why are they even in that seat?
1930.42s - 1933.62s |  So think about the fact that the other side,
1933.62s - 1937.22s |  there's someone just like you just having a job
1937.22s - 1940.82s |  and well, you are it today for the target.
1942.74s - 1944.06s |  That is a very good point.
1944.42s - 1947.94s |  One tech aspect that I would like to address is,
1949.34s - 1952.78s |  when we look at the defense versus offense side,
1954.02s - 1957.06s |  so the skills are not equal.
1957.06s - 1959.26s |  So on the offense side, on the red team side,
1959.26s - 1962.90s |  you would have tools that are not enterprise grade
1962.90s - 1964.58s |  if I use that word.
1964.58s - 1968.06s |  So for the attackers, you would have tools
1968.06s - 1970.42s |  like still mimic arts and probably something similar
1970.42s - 1973.22s |  that was written by someone bored over a weekend
1973.22s - 1974.82s |  or just out of interest.
1974.82s - 1976.50s |  Whereas if you look at the defense side,
1976.50s - 1978.22s |  they have a lot better tools.
1978.22s - 1982.22s |  So why is it that it is looked at
1982.22s - 1984.46s |  as a failure of blue side?
1984.46s - 1986.06s |  It is not the case.
1986.98s - 1989.58s |  The only thing that I would like to put in here
1989.58s - 1994.22s |  for the defense is we need to improve on what we look at.
1994.22s - 1996.70s |  So the parameter-based security is long died.
1996.70s - 1998.62s |  Do not look at it that way.
1998.62s - 2000.46s |  So there are some very good points made by her,
2000.46s - 2003.14s |  for example, to let your executives understand
2003.14s - 2005.70s |  that even that wasn't eye-opening stuff for me.
2005.70s - 2007.90s |  Of course, we need to speak their language.
2007.90s - 2011.38s |  But on the tech side, I would say look for identity.
2011.38s - 2014.22s |  So if I may use some very tech words,
2014.22s - 2017.10s |  you know, like say attacks very specific to Windows,
2017.10s - 2019.94s |  credential extraction, overpass the hash,
2019.94s - 2024.94s |  replay of tickets, everything is abuse of an identity.
2025.06s - 2026.94s |  Do you look at that?
2026.94s - 2028.46s |  Can someone steal my credentials?
2028.46s - 2029.78s |  Yes, try to stop that.
2029.78s - 2030.62s |  It is fine.
2030.62s - 2031.46s |  They get it.
2031.46s - 2033.94s |  But when they are using those credentials,
2033.94s - 2035.78s |  that is where you step in.
2036.62s - 2040.26s |  And as you said, you know, you push them back.
2040.26s - 2042.06s |  So that needs to be changed.
2042.06s - 2043.14s |  Yes, tools evolve.
2043.14s - 2044.94s |  We've got, you know, your CISOs may get, you know,
2044.94s - 2047.02s |  new toys from RSA.
2047.02s - 2047.86s |  I take names.
2047.86s - 2049.38s |  I'm sorry.
2049.38s - 2052.42s |  So your CISO may get new toys, let's say from RSA.
2052.42s - 2053.26s |  That's fine.
2053.26s - 2054.66s |  But look at the identity part.
2054.66s - 2056.78s |  That is where everything is.
2056.78s - 2057.70s |  It may be hybrid.
2057.70s - 2058.86s |  It may be cloud only.
2058.86s - 2060.54s |  It may be on-prem only.
2060.54s - 2062.30s |  Do not look at the network.
2062.30s - 2064.34s |  It is the identity.
2064.34s - 2065.86s |  That is, it gets stolen.
2065.86s - 2066.70s |  Yes, fine.
2066.70s - 2067.54s |  It will.
2067.54s - 2070.34s |  But when someone uses that, you step in and stop them.
2070.34s - 2071.66s |  That would be my advice.
2072.54s - 2079.80s |  I'm going to add a point.
2079.80s - 2081.40s |  The mic is not letting me speak.
2082.88s - 2083.72s |  Okay.
2083.72s - 2087.52s |  I'm going to add a simple point to what Stryker mentioned.
2087.52s - 2089.36s |  Like, you know, the small things.
2089.36s - 2091.56s |  So there is a, there was an executive.
2092.40s - 2093.24s |  Okay.
2093.24s - 2094.24s |  There was an executive.
2094.24s - 2096.44s |  I think he's still here somewhere.
2096.44s - 2097.28s |  I don't know.
2097.28s - 2098.60s |  I don't know.
2098.60s - 2101.56s |  What he did, he was using MFA
2101.56s - 2106.56s |  and he was using Google Chrome in his office laptop
2107.84s - 2111.69s |  with his personal email account.
2111.69s - 2114.05s |  Everything, all the credentials got synced
2114.05s - 2116.53s |  with that Google Chrome email account.
2116.53s - 2118.97s |  Then eventually he used the same account outside.
2120.49s - 2121.93s |  On a fine morning.
2121.93s - 2122.77s |  I don't know.
2123.57s - 2125.37s |  The breaches happens on Friday.
2125.37s - 2127.97s |  I don't know the logic of that.
2127.97s - 2131.25s |  It's only after Friday or during Christmas.
2131.25s - 2133.09s |  That's Christmas, New Year Eve, right?
2133.09s - 2134.17s |  I don't know how it is.
2134.17s - 2135.01s |  I don't know.
2135.01s - 2137.09s |  Maybe that's how it works.
2137.09s - 2139.09s |  Then that email got breached.
2139.09s - 2140.97s |  Then all the credentials were there.
2140.97s - 2142.57s |  Some of them might be having MFA.
2142.57s - 2143.85s |  Some of them might not.
2143.85s - 2147.17s |  And this guy, he was also using a small extension
2147.17s - 2150.53s |  in his browser as a substitute for 2FA.
2151.53s - 2152.77s |  I don't know.
2152.77s - 2156.17s |  Even after using 2FA, people can actually,
2157.45s - 2159.97s |  yeah, mess things up, right?
2160.89s - 2165.57s |  And we have like 15 more, I think, like, yeah,
2165.57s - 2166.89s |  17 more minutes.
2166.89s - 2169.05s |  I'm going to add something to Nikhil's point as well
2169.05s - 2171.09s |  about the defense part.
2171.09s - 2172.77s |  So I always tell people, everyone,
2172.77s - 2175.65s |  like, you know, the teams actually work for the defense.
2175.65s - 2177.53s |  That's where all the money is.
2177.53s - 2179.73s |  They have all the fancy tools.
2179.77s - 2180.61s |  You need to work with them.
2180.61s - 2183.05s |  You need to work with them very closely to like, you know,
2183.05s - 2185.53s |  share or provide more value
2185.53s - 2188.25s |  in terms of offensive security assessments, right?
2188.25s - 2191.85s |  Then I kind of started doing that in my life as well.
2191.85s - 2194.85s |  I kind of, you know, got close with someone in the blue team
2194.85s - 2196.29s |  and I had to marry her.
2196.29s - 2200.05s |  But then again, I tell people, don't go that far.
2200.05s - 2202.69s |  Be friendly with your defense guys.
2202.69s - 2204.97s |  Like, you know, share tactics, right?
2204.97s - 2206.53s |  Share the detection plans.
2206.53s - 2208.49s |  Then don't go that far, right?
2208.49s - 2210.57s |  I joke about it all the time, right?
2210.57s - 2213.13s |  And going back to the panel,
2213.13s - 2214.77s |  because we have like 15 more minutes,
2214.77s - 2216.09s |  if they don't have anything to say,
2216.09s - 2217.81s |  then we can take questions.
2217.81s - 2218.85s |  I will not be answering anything.
2218.85s - 2221.69s |  All these four guys will be answering your questions.
2223.49s - 2226.37s |  Unless you don't have anything more to say, yeah.
2226.37s - 2227.69s |  Yeah, let's see what they want to know.
2227.69s - 2237.74s |  Yeah, it's totally up to you, yeah.
2237.74s - 2239.82s |  Could someone get him a mic?
2239.82s - 2251.22s |  Set, yeah, yeah, yeah.
2251.22s - 2253.26s |  It's going to happen every time.
2253.26s - 2257.00s |  All right.
2257.00s - 2261.77s |  I'm just finding the sweet spot.
2261.77s - 2264.94s |  No mic?
2264.94s - 2266.54s |  Oh, okay.
2266.54s - 2268.78s |  You told a story about the email compromise, right?
2268.78s - 2271.14s |  And there was an image on the signature, right?
2271.14s - 2272.58s |  Yes.
2272.58s - 2274.50s |  I'm trying to wrap my head around it.
2274.50s - 2276.10s |  Why would the adversary do that?
2276.10s - 2278.70s |  Because it's easy for them to open,
2278.70s - 2280.42s |  it's easy for the victim to open the attachment
2280.42s - 2281.82s |  rather than the signature.
2281.82s - 2284.78s |  I don't remember the last time I clicked on an email signature.
2284.78s - 2288.18s |  So, the question had to do with the explicit
2288.18s - 2290.66s |  business email compromise example that I gave.
2291.58s - 2293.62s |  So, I'm going to give you a little bit of background
2293.62s - 2295.22s |  on what I was talking about earlier.
2295.22s - 2299.30s |  Why would an adversary put it into the signature line?
2299.30s - 2300.94s |  I actually have a right,
2300.94s - 2304.18s |  I believe we presented on this at Black Hat.
2304.18s - 2306.78s |  That was one of the three case studies that was picked
2306.78s - 2310.90s |  by my VP, Mac, as part of her presentation.
2310.90s - 2313.62s |  So, I do have the actual technical information there.
2313.62s - 2316.22s |  It is literally just blanking on my head right now.
2316.22s - 2318.66s |  I will tell you the motivation for doing something like that
2318.66s - 2321.66s |  because if you have correctly targeted,
2321.66s - 2323.74s |  speaking of knowing the persona, right?
2323.74s - 2328.74s |  If my client was a critical infrastructure client,
2328.78s - 2332.78s |  which means that they're susceptible to nation state attacks
2332.78s - 2334.86s |  like that is one of their targets, right?
2334.86s - 2338.66s |  If they get in there, they can have all of us, right?
2339.70s - 2343.42s |  So, it was worth it to them to investigate the supplier
2343.42s - 2345.22s |  and the type of people that they worked with
2345.22s - 2349.38s |  and do those months and that research that's required,
2349.38s - 2353.14s |  days and weeks and months in order to do that, right?
2353.14s - 2355.74s |  So then, to your point earlier,
2355.74s - 2357.38s |  you don't want to be noisy at that point, right?
2357.38s - 2360.58s |  You want to do something that will escape
2360.58s - 2363.30s |  and evade traditional indicators of compromise
2363.30s - 2364.74s |  where you're not doing discovery.
2364.74s - 2367.62s |  It's a weird APT spray and pray approach, right?
2367.62s - 2370.26s |  You're trusting that you did your OSINT correctly,
2370.26s - 2373.82s |  your research and your reconnaissance
2373.82s - 2376.74s |  that you have in fact infiltrated the correct one, right?
2376.74s - 2379.46s |  So, that's the first reason why you would do that supplier.
2379.46s - 2383.86s |  The second is you put it in the email signature line
2383.86s - 2387.26s |  because why would you write the phishing email for them,
2387.26s - 2388.10s |  right?
2388.10s - 2390.34s |  It's written by the victim.
2390.34s - 2391.30s |  They don't know their...
2391.30s - 2393.54s |  How often do you guys go and check your signatures?
2393.54s - 2396.50s |  Just out of curiosity, how often do you check
2396.50s - 2399.62s |  if somebody's changed your signature in your outlook?
2399.62s - 2400.78s |  Are you doing it now?
2401.78s - 2403.62s |  Yeah, I haven't looked at mine in a while
2403.62s - 2405.30s |  and now I'm suddenly very nervous.
2406.46s - 2408.74s |  And so, it's something that...
2408.74s - 2411.06s |  It's a space that you don't think to look.
2411.06s - 2412.66s |  You don't think to check.
2412.66s - 2414.78s |  We're looking for attachments on emails usually.
2414.78s - 2416.54s |  We're trying to distrust that.
2417.58s - 2419.86s |  The email itself triggered.
2419.86s - 2422.58s |  I don't actually recall what the image was.
2422.58s - 2423.66s |  It did require a click.
2423.66s - 2425.42s |  This was not clickless as I recall.
2426.26s - 2430.86s |  So, something about that image was close enough
2430.86s - 2433.02s |  and familiar enough to the person sending the email
2433.02s - 2434.86s |  that they didn't question it.
2434.86s - 2437.86s |  It led to an attempted sign-in,
2437.86s - 2441.54s |  which was rather clumsy and suspected.
2441.54s - 2442.94s |  I don't know if I can say,
2442.94s - 2444.50s |  but it was a nation state threat actor
2444.50s - 2445.70s |  that was suspected based on some
2445.70s - 2447.26s |  of the other indicators we saw.
2448.50s - 2450.66s |  And it did lead to attempted credential theft.
2450.66s - 2453.10s |  So, I hope that answers your question.
2454.10s - 2455.14s |  Yeah.
2460.17s - 2463.57s |  If you come up, we will read it back into the mic
2463.57s - 2488.52s |  and not kill you.
2488.52s - 2491.12s |  So, when you're dealing with an organization
2491.12s - 2493.92s |  with many, many endpoints,
2493.92s - 2496.84s |  what is the low-hanging fruit when dealing with tech debt,
2496.84s - 2498.20s |  when you're starting to implement this?
2498.20s - 2500.12s |  And I'll leave this to everybody else.
2501.56s - 2503.32s |  I don't know if we have quite enough cord
2503.32s - 2505.20s |  for me to answer this piece of it.
2505.20s - 2506.40s |  And so, yeah.
2507.68s - 2508.52s |  Just one suggestion,
2508.52s - 2509.88s |  if you're talking about an organization
2509.88s - 2513.76s |  that has 100,000 level systems,
2513.76s - 2515.32s |  and it has a ton of tech debt,
2515.32s - 2517.24s |  really hasn't done a lot yet,
2517.24s - 2518.48s |  start with inventory.
2519.80s - 2522.04s |  And so, it's amazing how many organizations
2522.04s - 2523.88s |  don't know what computers they have,
2523.88s - 2526.24s |  what systems they have hooked up to their network.
2526.24s - 2529.32s |  And again, it sounds super basic,
2529.32s - 2531.76s |  but it can be incredibly important
2531.76s - 2533.68s |  in actually dealing with a breach,
2533.68s - 2536.44s |  knowing what systems need which patches,
2536.44s - 2538.92s |  where you actually need to defend yourself.
2538.92s - 2540.68s |  And it's also sort of impressive
2540.68s - 2543.64s |  how many places don't actually have one
2543.64s - 2545.28s |  that are that sort of scale.
2545.28s - 2550.83s |  So, at least that's my suggested starting point.
2550.83s - 2555.24s |  Start with your executives.
2555.24s - 2556.76s |  Check their systems first.
2556.76s - 2559.52s |  That's my personal contribution there.
2560.76s - 2566.50s |  I'm gonna hit back on the human factor.
2566.50s - 2569.78s |  Without some kind of a way to measure,
2569.78s - 2571.98s |  track, framework, et cetera,
2571.98s - 2574.46s |  of here's my standard for passwords
2574.50s - 2575.86s |  that you should probably use,
2575.86s - 2578.78s |  or let's not all use the same root password
2578.78s - 2580.38s |  for every server out there.
2581.46s - 2582.34s |  Might be a good idea,
2582.34s - 2585.02s |  but how do you pass those standards down
2585.02s - 2587.46s |  when the organization isn't five people,
2587.46s - 2589.14s |  it's 100,000 people?
2589.14s - 2590.26s |  How do you set that standard
2590.26s - 2592.78s |  where the expected behavior
2592.78s - 2594.98s |  is that you don't likely have more than one IT team?
2594.98s - 2597.06s |  So, how do you pass information along,
2597.06s - 2600.02s |  and how do you also change the way people work?
2600.02s - 2601.50s |  Simply put, there are some systems
2601.50s - 2604.30s |  that it's just an utter pain to get to.
2605.14s - 2606.42s |  So, as an IT admin,
2606.42s - 2608.74s |  you're gonna come up with creative ways
2608.74s - 2611.38s |  to circumvent your own security
2611.38s - 2613.74s |  to be able to work on things.
2613.74s - 2615.58s |  So, how do you set those standards,
2615.58s - 2617.54s |  and how do you communicate them effectively
2617.54s - 2619.62s |  to have an expected,
2619.62s - 2623.38s |  we're all doing the same thing?
2623.38s - 2626.18s |  I'll say use the free tools.
2626.18s - 2628.90s |  That's how you find the low-hanging fruits.
2630.74s - 2631.78s |  I keep going back there
2631.78s - 2633.02s |  because that is what I experienced.
2633.02s - 2635.58s |  Do not go for the new shiny tools.
2635.58s - 2639.18s |  Anything that shows up as ultra-cool stuff
2639.18s - 2641.10s |  on your Twitter, on your Masternode,
2641.10s - 2642.90s |  go for the basic free tools
2642.90s - 2644.78s |  that have been available for eternity.
2644.78s - 2646.02s |  Go for them.
2646.86s - 2648.74s |  Create your own baseline.
2648.74s - 2650.82s |  That would be a very good starting point.
2652.30s - 2655.26s |  All of us, any one of us can be owned
2655.26s - 2657.14s |  by someone sitting in their mom's basement.
2657.14s - 2659.78s |  So, let's at least try to stop that.
2659.78s - 2679.66s |  So, that's where you start.
2679.66s - 2681.10s |  Okay.
2681.10s - 2681.94s |  Yes.
2681.94s - 2682.78s |  Yeah.
2682.78s - 2685.46s |  So, the question is,
2685.46s - 2688.18s |  who you think is a more dangerous threat,
2688.18s - 2691.62s |  a kid in their mom's basement or an actual professional?
2691.62s - 2692.50s |  We want to know the truth.
2692.50s - 2694.98s |  In my experience, it is the kid in the basement
2694.98s - 2697.54s |  because they are not limited by time.
2697.54s - 2699.02s |  They can be very persistent,
2699.02s - 2700.82s |  going after you for six months.
2700.82s - 2703.66s |  Whereas a professional, a consultant,
2703.66s - 2706.62s |  or even in your own in-house security team
2706.62s - 2708.62s |  would need to get that done in 10 days,
2708.62s - 2711.94s |  and you need the report on your table by 5 p.m.
2711.94s - 2714.22s |  So, the kid in the basement, of course,
2714.22s - 2716.10s |  persistence, consistency pays.
2717.30s - 2718.54s |  Thank you.
2718.54s - 2720.94s |  So, as we all respond enthusiastically,
2720.94s - 2722.70s |  yes, we worry about both,
2722.70s - 2724.42s |  but to your point,
2724.42s - 2725.46s |  that kid in the basement,
2725.46s - 2727.82s |  because that kid's pretty bored.
2727.82s - 2729.90s |  That kid just wants to try things and go,
2729.90s - 2731.42s |  I wonder if this works.
2731.42s - 2732.70s |  If I get caught,
2732.70s - 2734.66s |  do I get charged an adult with a minor?
2735.94s - 2738.06s |  They have less legal liability, right?
2738.06s - 2743.40s |  So, I would worry about that kid 100% of the time.
2744.16s - 2745.00s |  I think this gets back
2745.00s - 2747.28s |  to the annualized lost expectancy formula.
2747.28s - 2748.60s |  Honest to God, I swear,
2748.60s - 2751.04s |  I'm gonna do math to my response here.
2751.04s - 2752.76s |  What is the percent likelihood
2752.76s - 2755.96s |  that an attack will happen in a given year
2755.96s - 2758.48s |  multiplied by the dollar value
2758.48s - 2760.88s |  of the impact of that incident, right?
2760.88s - 2761.72s |  Okay.
2761.72s - 2764.12s |  So, while the hacker kid,
2765.24s - 2767.24s |  God bless us all,
2767.24s - 2771.44s |  is more likely to find you personally interesting
2771.44s - 2773.56s |  just to say they did it,
2773.56s - 2775.24s |  to see how far they can push,
2775.24s - 2777.72s |  and forget that it's a federal crime to do that.
2779.60s - 2781.12s |  That's more likely.
2781.12s - 2783.24s |  Let's think about what the actual dollar impact
2783.24s - 2785.60s |  to the business is, frankly, right?
2785.60s - 2789.80s |  Meanwhile, an APT is much less likely
2789.80s - 2792.32s |  to target an organization on average, right?
2792.32s - 2794.08s |  Just your average organization,
2794.08s - 2796.04s |  they might get caught up in a web,
2796.04s - 2797.28s |  they might be a supply chain attack,
2797.28s - 2799.56s |  but it's less likely that there'll be a direct target.
2799.64s - 2800.64s |  On the other hand,
2800.64s - 2803.36s |  the impact to the business is much greater.
2803.36s - 2807.08s |  So, yes, we worry about both,
2807.08s - 2809.48s |  and it's easier to get justification for the APTs
2809.48s - 2811.16s |  because they're like big headlines
2811.16s - 2812.48s |  and no executive wants to admit
2812.48s - 2813.72s |  that they've been pwned by a teenager
2813.72s - 2815.20s |  in their mom's basement,
2815.20s - 2816.20s |  or their dad's actually,
2816.20s - 2819.28s |  I had to share a room with my civil engineer dad.
2819.28s - 2822.12s |  But you need to do that calculation
2822.12s - 2824.80s |  and that risk for your own organization,
2824.80s - 2826.84s |  and then move forward with the solutions
2826.84s - 2831.44s |  that cost less than the actual expected incident rate.
2831.44s - 2834.28s |  And that is how you will make your finance people love you.
2834.28s - 2835.68s |  And that requires learning about
2835.68s - 2836.88s |  who you think is attacking you
2836.88s - 2840.86s |  and knowing what you have to protect.
2840.86s - 2842.58s |  I think the question is a trap.
2845.54s - 2849.42s |  So, I think the only right answer to that is it depends.
2850.42s - 2854.34s |  But, and so, whichever is successful
2854.34s - 2856.30s |  and causes damage to you in a way
2856.30s - 2858.26s |  that actually harms your organization
2858.86s - 2859.70s |  is the one that matters.
2859.70s - 2861.06s |  And that can be anyone.
2861.06s - 2864.46s |  That can be a script that got loose, went wrong.
2864.46s - 2868.18s |  That can be just a DDoS that accidentally got released,
2868.18s - 2869.42s |  but took out your network
2869.42s - 2871.58s |  and caused you to lose that big sale.
2871.58s - 2875.22s |  So, it can be anyone.
2875.22s - 2878.30s |  We do have a big focus on talking about state actors
2878.30s - 2881.26s |  because they're a unit that we can really consider,
2881.26s - 2883.74s |  that we've got cool names for them.
2883.74s - 2887.14s |  We might have giant statues of them at Black Hat.
2887.18s - 2890.46s |  But, you know, it can be anyone
2890.46s - 2893.94s |  that can cause sort of any impact to the organization.
2897.99s - 2900.79s |  I think that's our last question.
2900.79s - 2902.67s |  The goons are about to kick us out.
2902.67s - 2905.27s |  So, before that, I will just add one more point.
2905.27s - 2906.91s |  So, this is the power of community,
2906.91s - 2909.31s |  like the hacker community,
2909.31s - 2912.95s |  because we create new tools.
2912.95s - 2915.27s |  We talk, I mean, we teach each other.
2915.27s - 2917.47s |  We kind of, you know, use that in use,
2917.47s - 2918.95s |  you know, increase our defenses.
2919.71s - 2923.11s |  So, again, it is always good to be in the hacker community.
2924.23s - 2928.51s |  I mean, because from my personal experience,
2929.19s - 2931.31s |  if I'm sitting here along with these folks,
2931.31s - 2933.59s |  that is a part of community, right?
2933.59s - 2936.99s |  And I would like to thank the panel, the entire panel,
2936.99s - 2939.51s |  DEF CON, all the amazing goons out here,
2939.51s - 2941.59s |  all the, you know, participants.
2942.15s - 2943.55s |  Thank you. Thanks a lot.
2943.55s - 2947.03s |  And shameless plug, do visit Advasive Village.
2947.03s - 2949.11s |  Yeah. Thank you.


