100 AM Keynote Matt Devost

There you go.

All right.

Good morning everyone. Thank you for joining us today. Our second annual B Size nova. I want to start by thanking a few people here. Organizing these type of events is more than just putting together a one day conference. It's about giving a platform for a community to network, come together and share information. On that note, I want to start by thanking a few people. First, I would like to thank our advisory board for their support in making sure Bsides NOVA is a successful event and continues to be one. I also would like to thank our board of review who helped pick and select the talks and puts together a schedule. I also want to thank the speakers for sharing their expertise with the community. As a matter of fact, I would like to thank not just a speaker, but every single person that submitted a call for paper. These individuals are what make the content for these conferences. So I encourage anyone that wants to have an influence on what gets discussed in Security conference to submit for a talk in the future. I also would like to thank our sponsors. Of course, without their generosity we wouldn't be able to have events like these. Their funding goes beyond just funding for this one day event. It also goes into supporting kids programs. We mentor middle school and high schoolers and cybersecurity topics and hands on experience. And on that note, I also would like to thank all the mentors that helping me with that program here. The list is too long to thank them individually, but their support is great and they're an amazing group of people. I would like to also thank all the volunteers that have been working hard the past three days and making sure everything flows smoothly. They're the ones running around in blue T shirts, so if you need any help, feel free to grab one of them. They're awesome bunch of folks. And on that note, I would like to introduce Matt Devoe, our morning keynote. Matt is a technologist, an entrepreneur and an international security expert.

So we did all these thank yous and have a round of applause for Sophia and all the volunteers. Knowing how hard I know how hard it is to pull off an event like this, it's a tremendous amount of work and I also have a middle schooler who participates in the Sunday hacking session. So I'm doubly grateful for that as well. I am usually a walker when I present, but I'm told that there are people in the back cafeteria that won't see me if I walk or won't be able to hear me. So I'll try and see. Stand still. Why am I here? I've been involved in this community for quite some time. There may be companies up there that you recognize that I've been part of. I recognized 25 years ago, really from a national security perspective. I was a hacker who was into political science and national security issues, that the two were becoming intertwined and were going to be dependent on each other, that there was an inherent risk based on our vulnerability in our technology and the role that technology was playing in our society. And I kind of built a career around that. First as a hacker working in the Department of Defense and intel communities, Then out in the private sector, I've been the founder of a couple of different companies. The terrorism research center, Fusion X. I was one of the founding employees at iDefense, and most recently I left in November as the head of the global cyber defense practice at Accenture. So this is an area that I've been involved with for quite some time. And I'm also known as the toaster guy. Back 21 years ago, I wrote a paper called Information can you trust your toaster? That typically when I get introduced, I'll be introduced as the toaster person. But back then, we correctly predicted a lot of ways in which the world was going to go, including, as you can see, the joke around the Internet of things or the emergence of connected devices, which 21 years ago was not something that a lot of people were talking about. But also in a talk later in the presentation about what are some of the things that we got wrong as well. At the end of the day, I love events like these because it lets me speak to who I consider to be my peers. And I've tried to build a little bit of something for everyone in here. At the core, I am a hacker. I started as a technical hacker, breaking into systems, parlayed that into kind of being an entrepreneur. These days, I hack at a much different level. I'm looking for systems in society that are susceptible to change, things that can be transformed through. Through technology. So the base ethos remains the same. Trying to figure out what to say to a broad audience. I'm hoping in the audience we have some attackers, we have some defenders, we maybe have some management folks. So I wanted to build a presentation that stepped through a bunch of different perspectives based on the role that I've played in those. And the first I wanted to do was for the red teamers in the audience. I sat down after being a red Teamer for 20 years and said, what are the 10 things that I've determined over the course of my career that are most important? So I'll step you through those 10 lessons learned. The first is what I call asymmetry. Everywhere we're always taught that there's yin and yang and we need balance. And even in Star wars we want to bring balance to the Force. And I've learned over time that that is not true. We are always seeking advantage. And the challenge for us in the cybersecurity domain is to make sure that the good guys have the advantage, that our systems are more secure, that we're taking away that attacker advantage. On a broader level, we need to make sure that as we are introducing technologies that they are providing a net benefit to society. They're going to go either way. They're going to be providing for greater evil in society or greater benefits. I think that is also a challenge that we need to face. But it was this recognition that don't look for balance, look to gain advantage, look to seek that advantage. Look to get that asymmetry in your favor over time, which applies to the technical critique as well. The other piece is, I call it the OODA Loop compression. Is anyone familiar with the OODA Loop, at least some of our military folks, stands for Observe, Orient, Decide and Act. It's a decision making framework that was put together by a Air Force fighter pilot named John Smith. And one of the things I've recognized over time as a huge wearing an OODA shirt right now. The OODA loop is important in cybersecurity. There are essays and things that you can read about that, but that we were also facing this scenario in which that OODA loop is going to be compressed and we're going to need to be seeking greater agility. Are there elements of the cycle that we need to take out or trust the machines? Because on the attack side, the machines are becoming automated or autonomous. So I throw that out there about thinking about how we can compress that OODA loop, how we can factor in better agility around what we're doing, not only from a Red Team perspective, but from a defensive perspective. An analogy that's often used in kind of demonstrating the benefit of agility in the OODA loop is if you're playing a game of chess and you offer up to somebody that you will take half your pieces off the board, but for every time they move, you get to move twice, even with half the pieces. A chess novice can beat a chess master. Right, because you've introduced that agility. So we need to figure out ways to bring agility into the equation to our benefit. No artificial constraints. This was something that I Learned when I did red teaming in the military in support of a guy named General Van Reichmort, who is another person you can Google is infamous for having brought the red forces into play in a very big and expensive war game and defeating the US and coalition military partners in less than two days. One of the things that I saw him speak to in a war gaming environment was he took his assets that he had, of which he had jeeps and tanks, and used Mylar balloons and aluminum foil to make the jeeps have a radar profile profile of a tank and then move them in a particular direction to kind of spoon the enemy to respond with their tanks and looped around. And when he was accused of saying like, oh, you're cheating, that's no fair, his response was what? The bad guys don't have access to aluminum foil and Mylar balloons. Too often when we are engaged in red teaming environments, the target of the red team wants to impose artificial constraints. And I would argue that you need to consistently push back and say don't constrain me in any way in which you can't constrain a relative. If you're introducing constraints now, you're basically running a simulation. You're not running a red team. You're not truly testing to the extent that a real adversary is going to look at your environment. There is no spoon. A great matrix reference. I'm sure most of you have seen that. I often get asked, when I formed Fusion X, we created a red teaming company that, that operated with a ton of agility that brought that adversary perspective to the equation. And I would often get asked what's your assessment methodology? And I had worked within assessment methodologies forever. I was one of the first people certified in the NSA. Assessment methodology back in the 90s had worked in all these different formal environments. And I said our methodology is that there is no spoon. I don't want to again constrain how the red team is viewing a particular network. I don't want to tell them the steps that they have to follow in order to engage in a red team. We want to introduce some basic parameters that become kind of an ethos, do no harm, things of that sort in the engagement. But I want them to use their creativity and ingenuity. And the phrase that I often use is I don't want them to think outside the box. I want them to think without the box. If I am an attacker and I am motivated to achieve a particular objective, how do I see the problem that's before me, not go to a checklist say, what is the next step that I need to follow? Context is king. I learned early on as well that if you're going to be successful at red teaming and information security, that you have to be able to articulate the problem in a way that is meaningful to the person that you're talking to. There's a great story I love to tell. Back when I was very young, Red teamer I stumbled into, just based on my capabilities, to be the head of the Red Team for the Department of defense. In the mid-90s, I got to travel around the world with a team and break into any classified or unclassified system that the US military had. It was a great gig. For a guy from Vermont who hadn't traveled a lot. I would just say Hawaii, yes. Colorado, yes. I spent a lot of time in Florida, but I remember in particular being briefing one on one. You got to imagine, you know, me 20 years ago briefing a general who was the head of our Special Operations Command. And what I was trying to brief him on, one on one was a particular issue I had encountered in my Red team and that he had a one character password. Think back 20 years, the introduction of computers. He's down, you know, in, in Florida at SOCOM with his one character password. And I said, sir, this one character password is an issue. And he said, son. And I knew this was coming because I talked to the staff. Son, that's my combat ready password. Like, okay. But I had a strategy in how I was going to try and break this bridge, this gap between the snake eater general at socom and the 25 year old kid that was trying to get him to change his behavior. And I had been there when his predecessor was in command as well and had been there through the transition. And one thing that I noticed was that when he arrived, whether he drove himself or was driven in that parking lot at the SOCOM headquarters building, he engaged in what he called combat ready parking, which for those that aren't familiar, means you back into your spot where you get in the car, you're ready to go, you don't have to back up and go in reverse and drive. You put it in drive and go. What was interesting was I had observed that over the course of two weeks, everyone in that SOCOM parking lot started backing into their parking space after he started doing it. So I used that to my advantage and said, sir, here's the thing. Did you notice what happened in the parking lot after you started pulling in doing your combat ready parking? Pay attention. I said, everybody else is Doing it as well. I said so how long do you think it's going to be until the people in your command, whether you think your account is worth protecting or not, the people in your command that are actually in the field not sitting in Florida start instituting a one character password. And he looked at me and he said I'll change my effing password. I used the effing because my 9 year old son is sitting in the center of the audience. Might have a little bit more color to it in other environments. So understanding how to communicate and effectively drive the communication behavior that you're trying to change is something that I've heard over and over and over. Right. In the intel community they refer to pluf bottom line up front. Learn that as well. Right? If you are going to have limited amount of time or you might be interrupted, what is the most important messaging? What do you have to convey? Getting that up front and providing right context. Tools are not talent. This was a finding that I had again, I was running another red team and we were given what I would call the best of the best. I was running a red team that was a coalition team. It was a five eyes. New Zealand, Australia, Canada, UK and the US and each country had donated some offensive tools and they had also donated people. And what I figured out early on was that the people that were given to me were more valuable than the tools that were given because they had the ability to emulate and innovate and use their imagination and bring new thought processes. That despite the fact that we had this Rolodex of tools, the talent was the most important thing. And I saw the reverse of that as well. Right. I couldn't give an untalented person a really good tool and expect a legitimate outcome. Just didn't work that way. So it constituted what we call kind of like there was the equivalent of a fireside chat. A kind of mentor. Master and apprentice were people that weren't talented, were paired up who folks over time in order to learn how they think and use stuff. So tools are not talent. You can't script an adversary. Again, going back to the methodology, right? There is a benefit to automating technology using automated tools to check the security posture in an environment. But you don't ever want to script them. You can't script human behavior. You can't script how a human is going to their decision treatment given an objective that they're trying to achieve on the network. The attacker is not a one or a zero. This is something that came up with my Friend Jay Healy, who's now Columbia up in New York, where we wanted to bring the human factor back into the equation. Too often we sit and think about the technology or the attacker as what we're seeing on the behavior that we're seeing on the system. But we need to recognize that at the end of the other connection on the keyboard is a live human being. Even if you're facing some sort of automated tool, it was coded based on the objectives of your human being. One of the things we tried to do at FusionX was bring that human component back into the equation. What is the threat model? What capabilities do they have? What are they trying to achieve? If you have a Russian organized crime on your network and you're a commercial entity, they're likely trying to make money, right? So the decisions that they are making and how they view your network and how they move laterally and what they decide to compromise are going to have that focus. So you need to bring that human attacker focus to the equation as well. The 10th man rule made famous by the movie World War Z, right? You have the person who is required to dissent against a particular force of action is something that I always have found very valuable in red teaming. Having the person that is challenging the status quo, that is countering the consensus that you might have on the team to inject new ideas, or at least get you thinking critically about the course of action that you're about to take. Speaking truth to power. Something that's gotten me in trouble many times over the years, but I have unfiltered, have always told people exactly what I think or have always provided that assessment. I think that is as well. Don't candy coat it. Spent once, 45 minutes with my team that was talking to the CISO at a very large customer of ours, publicly traded customer, debating over the inclusion of one word in the report where we would not back down because changing that word would have changed the representation of the finding, right? So making sure that you stick to your guns and that you are articulating the world, the findings as you see them, Anybody keeping track as to how many lessons we've had? I told you 10. But I built in a bonus, right? Because I added this after the fact, after it came up. And that was kind of born out of frustration. And don't call it luck. Too often I've worked with team and they get to a certain part like, oh man, I got lucky or this happened, right? The luck is the result of the, the circumstances that you achieve, right? The training, the tools, the Perspective, maybe an outcome in a particular bet, if you're doing an A B type thing, might be attributed to luck. But don't ever go and give a briefing and say, oh, I got lucky. You accomplished something based on a particular perspective that you brought to the equation and the whole trail of circumstances that brought you there. All right, so now we're going to shift gears. That was the attackers in the room, so hopefully you're happy and now you can nod off to sleep or drink your cup of coffee. I'm going to shift gears and talk a little bit about the threat and I'm going to talk a little bit about from the defender perspective. This, to me, when I encountered this quote over a beer seven years ago with somebody out in California, is the perfect analogy for the Internet as fun. We have something that provided this great capability of communication, changing society, but was not developed with security in poverty. Right? One of the original sins of the Internet was the fact that it was not designed to be as important as it is. Steve Lukasik, who was the head of DARPA at the time that DARPA Arpanet was started once over a beer as well. So Maybe there's a 12th rule, which is drink lots of beer to exchange ideas. He said, hey, had we known that this was going to be so important, we would have taken an entirely different perspective. Right? We just had no idea that this was the catalyst that was going to happen, which to me raises all sorts of issues when we start talking about network defense as well. The other aspect of this is this is the new normal, right? We live in an environment now where the attackers are the new problem. Twenty years ago, I used to be begging for attention. They were trying to get folks to embrace these ideas that cyber attacks were coming, that cyber conflict was coming, that information warfare was something that we're going to have to be dealing with now. You cannot, you literally cannot go and read any of the major news sites, pick up a newspaper in any given place and not encounter major stories, right? So we have their attention for certain, but now we have to live within that and deal with the reality of it from a threat perspective. Intellectual property theft. I went on the record, I guess, probably like four years ago that I wasn't concerned about intellectual property theft. And I took a lot of heat for that perspective from academics and others on Twitter and other social media. And it wasn't that I didn't think that we need to be protecting our intellectual property. It was that I saw that development of normalization or international norms that would stop countries from engaging in such rampant intellectual property theft. The other trend that I saw was what I called innovation parity, which if you steal a bunch of intellectual property, you've reached this point where you say, if I apply the technical talent I have to stealing that incremental improvement in the intellectual property over time, or do I apply that technical talent to actually innovating on the IP itself? And we've seen that clearly, right, in places like China, where they are emerging as scientific, whether it's in genetics or in artificial intelligence, investing a ton of money and emerging as a superpower on the backbone of intellectual property that may have been sourced from elsewhere. So I still think you need to think about intellectual property, but I don't put it in the category of national security threats. But I feel like that horse is already out of the barn. The time to protect IP was 10 to 15 years ago. Cybercrime, obviously a big one and not going away over time. So we have huge requirement in a lot of organizations for countering cybercrime, countering that ingenuity for those folks that are motivated by making money, and make money they will. Folks that work in the cyber defense practice not know that the criminals are successful. They're stealing money every day in lots of innovative ways. We see it in the press, right? We saw what could be just coupled as a great social engineering attack against Google and Facebook that resulted in $100 million being stolen from each of those organizations, where it was somebody who actually interacted with the accounts payable department and convinced them to say, like, hey, I'm this vendor and I want to change the bank account in which how you deposit the payments in against our invoices. The attackers didn't really even expect that it was going to be successful. They didn't have the bank accounts created. And the response came back and said, yes, of course, what bank account did you use? That one little switch and then every invoice that that vendor was issuing was being paid into the wrong bank account when the attackers were walking away. So sometimes even simple methods are going to catch us off guard, or we don't think of the accounts payable as being a huge cyber crime coming in. Ransomware, obviously a big one, right? With the emergence of the digital currencies and the cryptocurrencies out there that create a viable way for wealth to be transferred associated with ransomware. I dealt with ransomware as far back as 16 or 17 years ago. It was cumbersome as heck to try and figure out the path in which you would pay the person that was engaging. They wanted you to go through some sort of Russian equivalent of PayPal which was blocked by all the US banks wire fund. Take you a week just to figure out how you would into the account that they were asking for. Now it's easy, right? They give you the sheet on how to sign up for Bitcoin address that even a grandmother can follow. Some of them are providing you with an 800 number that you can call and get assistance. Right. So this is a. An issue that is going to become much more rampant over time. So it needs to be obviously on all of our computer screens. Espionage. I think we all know the role that cyber is playing in kind of the traditional espionage domain. Why is espionage moving to cyberspace? It's the same way that the bank robbers have moved to cyberspace, right? Because it's where the money is. Why are espionage entities engaged in cyberspace as. Because it's where we are. If Facebook has created what is the greatest source of intelligence I think ever perpetrated in human history. Just thinking about the volumes of information connectivity that they have, of course those platforms are going to be mined. Of course they're going to be running influence operations through them. It's just too attractive because it is where we are living today. What I call the kind of the leak environment as well. Those that are seeking to access information just to post it online is going to be a continuing trend. We've seen this most with WikiLeaks but with others as well. Whether it's sensitive information being posted or state secrets. This was my experience in 2015, right. Anthem, Experian. Experian OPM. So health information, financial information and everything else. For those that aren't familiar with APM, they are the holders of the SF86 form that you fill out when you're obtaining or maintaining a clearance. Has all of the information about my family, including their Social Security numbers, dates of birth. It has information about my close contacts, everywhere I went to school, everywhere that I've ever lived, my foreign contacts as well, based on my interactions with them. It is a wealth of information. So if you just look at in 2015, if you're an attacker and you want to target Matt Defoe, you know more about me than I know about me. Right. Which is a little bit crazy. I am grateful that this was a triangle and not a square because it would have meant that I was also involved in the Ashley Patterson breach, which I was not. Thankfully. My 9 year old is not laughing at that and everybody else is. And then we have the, you know, one of my favorite movies of all time, the cyber conflict, Cyber war, the kind of beyond espionage aspect, right. Which is also emerging. Dive into that a little bit deeper. But recognizing that our society is dependent on computers and networks, that is just the base reality. Right. There's no way to reverse that at this point. And so it's obviously going to be a domain of conflict. The Department of defense in 2010 officially acknowledged that cyber was a domain of conflict. So we have that reality that we have to deal with as well and the potential for that to have a fairly drastic impact on society if we don't play our car type. Those systems in which we are dependent on for critical infrastructure are connected to computers and networks and vulnerable in of itself. We haven't had an attack against critical infrastructure that's had any kind of catastrophic impact. But I feel like we have this misalignment where you have a terrorist organization might have the intent to take down a power plant in future geography, but they don't have the capability. And then you have a nation state that has the capability to do it, but doesn't have the intent.

Right.

There's lots of classical deterrence, fear of global condemnation, economic interdependence, all of these things that come into play. But in today's environment, where do we start to have that misalignment that reaches that bar where the bad guys with the intent that are going to attack us no matter what, develop the capability? Or you have a nation state in which for some sort of economic security, regional security issue, decides to delve into the domain of critical infrastructure attack and develops the intent. You see, I borrowed the slide from my old employer that copyright. It's my slide, though. They just gave it the pretty graphic strategic penetration for future exports, exploitations. This is an area that I like to talk about as it relates to those cyber attacks against critical infrastructure. And it's a part that I think that we often miss as a security community. We think that our intent needs to be in line with our current activities, which is not the case. Right. If you think about our perspective as a society tends to be fairly short term, Right. We think in terms of corporate quarterly projections, annual projections. I had to do the Red Team for the chairman of the Joint Chiefs 2020 plan. And my first question was, why are we doing 2020? Why can't we project further out? Right. Whereas our adversaries are thinking in terms of decades and generations. And it would call the fact to say, if you take the perspective of an adversary, and they say well, right now I don't have the intent to attack critical infrastructure, but I can zero vision in the future where I might want that capability. What do you need to be doing now? If you have that vision thinking that you might want the capability, you have to develop the capability now. You have to do that preparation that positions you to engage in the attack. An analogy I often throw out there with my audiences. Let's say, let's pretend that you're the President of the United States prior to World War II and someone comes to you and says, Mr. President, we think we're going to be involved in military conflict with the Germans. We have this plan, we're going to go and deploy explosives in their ball bearing manufacturing plants and we can do it anonymously without attribution. You don't ever have to push the button to detonate the explosives. But if we are involved in military conflict, pushing the button will provide great strategic advantage and save a lot of American lives because it will impact they're warming. Do you do it? How many people raise their hand? Do you plant the explosives? Yeah, we're rewinding earlier. Yeah. The point I'm trying to make with that analogy is that if you are an attacker, that pre positioning of the explosives is a no brainer. Right. So we need to be thinking, if you're chartered with protecting critical infrastructure in this space, you need to be thinking about those attacks that don't look like the attacks that we hear about or think about in the press. Right. That are trying to take down your power grid or your critical infrastructure. You need to be thinking about the attacks that are positioning themselves for that capability in the future. And the signature of what those look like is a lot different than the attacks that you deal with on a day to day basis. So this is acknowledgement of what I call a time shifted intent. Right. The activity doesn't have to match current intent. The adversary might be thinking with regards to future. It's important that we introduce that into our thinking as well. And then targeting trust. This is interesting. I mentioned the information terrorism. Can you trust your toaster paper where we get a lot of things right but we got some things wrong. One of the things that we got wrong was if we anticipated that in the next 20 years. When we wrote the paper in 1996, we anticipated that there would have been an attack on critical infrastructure at this point. Something that was substantial, consequential here in the United States. And then we have case studies elsewhere in the world. And so at the 20 year mark I sat down with my co authors Neil Pollard and Brian Houghton. And we said, well, let's sit for fun. Look at what we got right, what we got wrong. And we realized that we got this targeting of critical infrastructure wrong. We said, okay, if we got that wrong, what did we miss? Like, what was the replacement? And what we came up with was this targeting trust, right? If we think about the role that some of these institutions or the infrastructure and networks play in our society, we have a lot of trust, right? How many people know or even get a paper state from their bank with regards to their bank balance? It's dependent on information that is contained within systems that are vulnerable. We see this playing out in institutions like the election, right, where even if there isn't an attack which causes a change in some sort of outcome, you're diminishing trust in that institution, which creates conflict and creates life, which we are seeing now and not yet. My Facebook feed, in some spaces almost becomes unmanageable based on the amount of distrust that's just been stewed amongst each other in our society. So the one thing I would say is to be thinking about targeting trust in the future, right? If we're not going to see the big critical infrastructure attacks, what are those other institutions of trust, Trust that become attractive from an attacker perspective? All right, and now we have the third shift where I want to talk to the defenders a little bit. So at times I feel like when I talk to the network defense folks or the CISOs, that this is the reality they're trying to achieve, which is kind of. This is the aspiration. It's time to make the security. It's like the time to make the Nomad Sky. And if you can't get from the looping animation, it's just creating a chain, right? The links are being added on there. So that's the aspiration that this becomes something that we can manage. And we have technology that we're deploying and that we're building and it's kind of steady state. And then I come in as a red Teamer and demonstrate. Right. And the. Yes, it probably is. And then the irony, right, of course, is how many times do you think that padlock was locked and unlocked, right. Even with that zip tie attached to it. Right. So our implementation doesn't often match our aspirations. Right. And we need to keep ourselves in check and recognize that from the network defense perspective. We also need to recognize this fact, based on the Neal Stephenson quote, that for attacker advantage, it seems like the attackers have their hand on the sword. These Days, and that's something that we need to disrupt. One of my favorite presentations over the past couple of years, again, Jay Healy out of Columbia with the New York Cyber Task Force. Anybody encountered that report yet? What was interesting was that at Black Hat, not last year, the year before, that was rated the number one talk of the entirety of Black Hat. And normally at Black Hat, right, it's the hacking insulin pump or making jackpot ATMs, things of that sort. But here, the number one talk was a guy that wanted to talk about overcoming attacker advantage. Looking at. And they brought together. I would encourage you to go watch the presentation on YouTube, read the report they looked at over time with this panel of experts, at 30 to 40 people, phenomenal experience. What technologies or things have we invested in that have given us a disproportionate advantage where we've invested a dollar on the defense side and it's cost the attacker more than a dollar to overcome that. So looking for things that can be achieved at speed and at scale, that is our challenge really moving forward is how do we swing the pendulum? We can implement more than a dollar of defense that cost the attacker. Increasing the cost of the attacker is a very viable strategy over time because you're never going to ultimately defend the networks. They're not going to ever be impenetrable. We do want to make it more disruptive, make it higher cost for the attacker. The other thing that frustrates me from a cyber defense perspective is that we seem to measure all the wrong things. If we look at Jack Welch, who's regarded as one of the best managers of all time, he has this quote, and if you watch CNBC or news channels, he'll repeat it over and over again that you get the behavior that you measured. What do we measure in cybersecurity? Number of vulnerabilities, number of attacks detected per day, things of that sort. Right. So I would question, are you really measuring the right things? Are you measuring how critical the data is just within your environment? Are you measuring how quickly you're able to detect an attack, not just how many times somebody targets you, the efficiency of the response, what you think it costs the attack, business impact, rate of explanation, exploitation, impact of controls. So I would argue on the defender side that you go back and start thinking about what is important to us that we can measure, that we can actually influence over time. And my guess is that the list looks probably different from what you're measuring today. This is another favorite of mine. Anyone familiar with this study? You can watch it on YouTube, you basically are given a video that. And you are told, count the number of times that the players in the white T shirts pass the basketball amongst themselves. And they move around and they pass the basketball. There's lots of confusion. And in the middle of the video, a person in a gorilla suit walks into frame, pounds their chest and walks out of frame. At the end of the study, you're asked, how many times do they pass the basketball? The correct answer is 14. Then you're asked the you see the gorilla? 50% of the people missed the group. To me, that is kind of a perfect analogy for the current state of our security operations centers or this problem that I call Eyes on glass, right where we are telling people based on a signature. Here are the things that you need to look at. Here's an alert you need to deal with where it becomes a very cyclical kind of functional. Getting back to that link in the chain being generated, when really the role that they should be playing is also an act on thinking about, if I were the attacker, where would I be hiding? Now I have a thesis like going out and actually running hypotheses as to where an attacker might be or how an attacker might target them, as opposed to just dealing with the alerts that are being generated. Based on my analogy here is that I feel like a lot of the times were missing because we're too busy counting the basketball as it's being passed back and forth. Again, this slide that's so important that it makes it into the presentation twice, your attacker is not a one or a zero. Remember that human aspect of it. And this one, I think, you know, had been a frustration of mine, but I see a lot of momentum where we recognize that we kind of have to give the attacker the. Not that we want to stop engaging in perimeter defense, but it is so incredibly easy through spear phishing, through byod, through lots of other mechanisms for the attacker to establish a foothold. When in 2010, I signed up as a special government employee to help with the first DoD cyber strategy, this was a key piece that I argued and argued and argued with folks in the Department of Defense over inclusion in that strategy. And that was a presumption of if we think about the fact that our network is already breached, whether it's currently breached or going to be breached in the future, how does that change your perspective about Defender? Can't spell security without it. Isn't that cute? It's like out of an episode of the Office. But it's an important point. Too often I See functions separated, the lack of communication, the focus on saying I'm spending on security but then I'm ignoring my technology infrastructure. We talk about the speaking truth to power and experience with a large again publicly traded company. It was me meeting one on one with the CEO. I'd been doing a lot of work with them, they had a lot of problems and one of their problems was just not allocating appropriate spending perspective on security. And the CEO, I kid you not, looked at me and said hey Matt, aren't you proud of me? I just approved the budget for this great three million dollar network intrusion defense technology. I thought it was funny. Matt, aren't you proud of me, the CEO, my successful guy, kind of back to my general days of briefing socom. And I said sir, that's great that you're spending money. I said, but what you've done is the equivalent of installing a smoke detector and alarm system in an elementary school where every kid has a book of matches. Because I've also seen over the past three years where you have denied the budget about equivalent. It was 3.5 million to upgrade your local desktop environment away from Windows XP 11. The attackers in the crowd are laughing because they know that it's really just a matter of when you're going to break into the system, not if you're going to break into the system. But he had equated improving in security with just buying security tools when there's actually things from a security perspective around upgrading their infrastructure that would provide more benefit to them. So again it's that finding useful analogies but then getting to recognize that this is a technology problem in of itself security in the design process. I mentioned the Steve Lukasik in saying if I had known the Internet was going to be so important, we would have designed security. And from the get go, how many people in this room know that the Internet of things is going to be important? How many companies out there building Internet of things devices you think are truly beyond just authentication of username and password? And I'm using ssl, building secure devices. We are making the same mistake and this time we know it's going to be important. Almost everybody in the room raised their hand, we know it's going to be important. But we're making the same mistake, right, of not building security into the design process. Years ago I did an assessment for a satellite system that was providing IP networking and we went in, it was a commercial company, talked to the team, wrote a proposal, was a competitive bid, won the proposal, we went in, had the kickoff Meeting we walked away with that kicking off like a huge stack of design specs, etc. I had this brilliant engineer that worked for me that went away and he found all of these issues we wanted to do to address. So we went back to the company and we said, hey, we're ready. Let us in the lab, let us access some equipment, we've got things we want to bang on. And they go, let you in the lab. Like, yeah, you hired us to do the assessment of this satellite. We need to get access to the components of the satellite. Don't understand the satellite's already in space. We'd gone through this whole process, us thinking we were part of the design process. Then they put it in space. So I had to again tell the CEO, I said, you realize that our value that we can provide is greatly diminished by the fact that the satellite is in effing space. And you can be. It's kind of truth to power right in your environments where you're launching these technologies or building these things. Making sure that we're thinking about and addressing security as part of the design process going in. No plan survives contact with the enemy. This gets back to that, you know, the chain link fence with the zip tie around it. I think Mike Tyson put a little bit better. I said everyone has a plan until they get punched in the mouth. This is my plug for the value of red teaming, right? For viewing yourself as the attacker sees you independently and objectively. I think from a yield perspective, and I'm a red teamer, so I'm biased, but I think of all the security initiatives that I've participated in, one of the most valuable by way of education in the organization, identifying attack surfaces that are going to be critical, etc. Etc. Etc. Red teaming has a very significant. So you should be building red teaming as well. Learning from failures. I put this picture of the black box recorder and then read last week that somebody was proposing it would create the equivalent of a transportation entity for cyber security incidents. I think one thing that we need to do better in this industry is learning from from our failures. And this is inspired a lot by a book that I read last year called Black Box Thinking. If you haven't read it, it's a great book to read. It looks at a case study of two different industries in which lessons learned were incorporated in the industry and the role that that had in improving public safety vice when they were not. And the two industries that they look at were the aviation industry, again, black box and having a very robust lessons learned process. And the medical industry, which tends to attribute patient death and patient health issues to bad luck. Right. And drawing that distinction of saying like, hey, if we had a mechanism for incorporating lessons learned, if we studied where we fail, where patients die, where we just don't attribute it to it, bad circumstances, bad luck, we could drastically increase medical safety for patients. Same type of perspective in cyber security. Right. We need to be learning those lessons from each other. I like the idea of a NTSB for cyber that can go out and independently look and review and publish results around some of these incidents. Not to embarrass companies, I think we're beyond the point where a breach is embarrassing. I worked at the Citibank breach over 20 years ago where they thought they would announce and say, hey, they stole 10 million, but we recovered all but 400,000 and they thought that would be viewed as a win and the market punished them. I think we're beyond that now. Right. With the breach of disclosure laws and with a lot of these big companies championing that perspective, we shouldn't be ashamed. We should be drawing from those lessons learned over time. And then it's easy in this industry to become a pessimist because it seems like we're always losing. But I'm actually an optimist. I feel like things are getting better. I feel like we are making the investments in technologies now that are going to drive security in lots of interesting directions. This is my new hope slide. The things that I get excited about, the behavioral analytics and machine learning and artificial intelligence. Are we doing artificial intelligence right now? Of course not. It's a complete head fake. Sorry to the vendors that maybe have artificial intelligence on their banners up in the lobby, but we're not doing it. But we're going to get there. And what I like is the fact that we're actually making investments from a cybersecurity perspective. These types of technologies. I get very excited just about the blockchain. Not the Bitcoin, but the blockchain and its potential to be very disruptive in all sorts of industries. Why should you pay title insurance anymore when you buy a house? Why isn't that ripped in the blockchain? Why should you pay a middle market, the pharmaceutical system, 45% of the cost of drugs to serve as a check that could be done through machine learning, artificial intelligence, or prescriptions that can to a blockchain. Right. There are lots of ways in which these technologies that we build on from a security perspective are going to be beneficial, not just in security, but in other ways as well. And the last remark I want to make is what I call this generation hack, right? The first hacker conference I went to officially, right before I went to DEFCOT for the first time, was local here in DC. It was when SummerCon, back when it was invite only, was held in Georgetown. And I was at this weird point in my career in that I was a hacker. I had messed with things in my university. I was getting paid to be a hacker within the Department of Defense. But the term had this incredibly negative connotation. It was used as a criminal hacker. And I remember doing the briefing of my SF86, they would ask you some of these questions, oh no, not a hacker. That has changed, right? I feel like this is generation hack, right? The benefits that we are providing to society with this hacker mindset, with this methodology are incredible. And our challenge now as we move out of it, is my fund. Who hacks wins slide. Our challenge now as we move, move out of it, is to make sure that we start applying that hacker mindset to other problems in society. I mentioned this stuff of why not use blockchain for title insurance, why not use blockchain for medical records, right? So I think the value, and this maybe is me reaching this age where I'm approaching 50 and I have a nine year old in the audience. But I'm beyond this point of view, thinking about it solely from the perspective of we hack technical systems. We need to be thinking about hacking as how do we apply those same principles of I want to study a problem, take it apart, reassemble it maybe in a different way, maybe introduce new elements to the equation to better other aspects of society. That I think is one of the true kind of advantages to a group like this is not just what we're going to do in the cybersecurity domain, but what we're going to be able to do by applying that mindset and this generation Hat perspective to other problems in society. That's my call to arms. I try to make myself very accessible. So feel free by all means to connect. I put the two links at the bottom. Ooda Loop is where I do a bunch of blogging. And also you can find the written version of the Red Teaming and Lessons Learned and then the global frequency. That's just my mailing list. It's just me personally. I use it as an exercise. Essentially. What did I encounter in the past week that I think link to like seven to 10 stories that I put out every Sunday morning instead of reading the paper or actually just sit down and say, what did I encounter this week that I think is important. So with that, I am done. My formal remarks, I saved about five minutes for questions. So hopefully I have somebody here in the audience. Can't take questions from the cafeteria. Yes, Kathleen, it. Yeah, I mean, you have to invest intellectually to kind of that reversal of roles. This is an area I spend a lot of time on, not well known in my background. I created a course called Mirror Image, which was a counterterrorism course, had nothing to do with cyber security, in which we took US Military personnel and Canadian. For example, if you're a Canadian military, you could not deploy to Afghanistan. They weren't deploying to Iraq at the time. You couldn't deploy to Afghanistan without taking this course. And what we did is we took them for six days and we did the equivalent of if we dropped them in a terrorist training camp in Afghanistan, where they had to live like a terrorist, think like a terrorist, be subjected to the same propaganda, the same training tactics, etc. With the sole purpose of that. Now, when they were out responsible for defending and engaging, that they could view themselves from the outside in. So I think that that's important. I mean, from. From my perspective over the years, people have always said, I gave a presentation in 2015 where I said, our focus is on China right now. It's not that China's not important, but I'm really scared about Russia, right? And it was to some intelligence folks and based data, more sign over the Russian flag and a less sign over the China flag. And a couple of weeks ago, somebody came up that was in that presentation, said, how did you know? You predicted that the Russians were going to interfere in the elections, this was going to happen. I said, I didn't predict anything. All I've done is I've studied over the years the doctrine that they put out, the strategy that they put out. And I recognize that we are at a point in time in which they're going to be taking advantage of that aspect reading of reflexive control, of engaging in information operations, psychological manipulation, etc. It was recognizing that the playbook was stacked. So I think one way that you can really understand the adversary perspective is to read what they're writing, study what they're doing. I got in trouble and thought I was going to lose my clearance in 1999. This is a funny story because back before WikiLeaks, there was a site called Crypto. Does anyone familiar Crypto? It was John Young, who's an architect that lived up in New York City, decided to create this Leak site. And I came into my possession an unclassified document, but it was still for official use only. It was a translation of unrestricted warfare, which was something that had been written in China that provided their. If you haven't read it, you should go read it, even though it's 20 years old. Their perspective on how the world was changing. Economic warfare, information warfare, terrorism. And I said, this document is so important that I can't stand the fact that a lot of people aren't reading it. So I sent it to John and said, put it on the site. The open source center, which I had obtained the document was very mad and very upset. But in the end I'm glad that I did it because it created a whole dialogue around, let's think about the Chinese perspective on information warfare that I think better informed us. So we need to be doing that. We need to be thinking about some of these other adversaries as well. What is Iran thinking about cyber warfare? What are the North Koreans thinking about cyber warfare? What are our traditional Adventists thinking? And kind of put. You got to put your head in the attack. One more question. Yeah, we're here, sir. I wish I could say that we had. I know lots of great people that have been over there and studied it and lots of great folks from Estonia that have come over and worked with us. I think that the issue is that we are, we're creating this kind of house of cards, especially as it relates to government services where we're building and more government services with a technology dependent component without addressing some of the core issues like identity and authentication and security and privacy. So I would say we understand kind of the potential for attck, but haven't done enough to kind of establish ourselves to be presented. All right, I want to keep the agenda on track and it is exactly 10 o'. Clock. So thank you so much. It was an incredible honor to come and speak.