Episode 036: Matt Devost

All right, all right, we're live.

We're live. Okay. Episode 36 of the Red Team podcast. And this time we have a guest. Not just a guest, but someone that's been there, done that in the community, been red teaming for a while, has a ton of experience, a ton of stories to go with it. Welcome, Matt, to the podcast. Please, Matt, introduce yourself. To those of you that don't know.

You, my name is Matt Devoe. I've been in the red teaming community for over 20 years now. I got my start back in the Department of Defense and intel community running red teams that were going after DoD networks, classified and unclassified. So for a country boy who wanted to travel the world and was highly technical, like the hack things, it was a great gig to have. Was also the creator and ran the first ever of the Coalition Vulnerability Assessment, which was a red team by another name that came together to play the Red Force during classified coalition military exercises. So we had legal authority to go after target systems, primarily command and control systems in Canada, us, Australia, New Zealand and the uk Pivoted from there into working red teaming type issues in the private sector, applying those same skills against critical infrastructure, and then founded the Terrorism Research center, which I ran for about 10 years. And at TRC, we had a very robust, robust red teaming component as well. We did physical security red teaming as well as cybersecurity red teaming. But then we also did a lot of things like we're a prime contractor for the defense adaptive Red Team, did stuff for the Joint Chiefs on red teaming engagements, did work with DARPA and built a training program in which we applied a lot of red teaming principles. We built a program called Mirror Image Training in which we took the US and Canadian military forces and dropped them into a terrorist training camp as if they were being indoctrinated and trained like the terrorist were, with the sole intent of giving them that adversary perspective, that when they deployed, they would be better able to engage the adversary because they kind of understood how the adversary was going to see them, how it was going to target them. Sold that company in 2006 and stayed on board working for three years. I had sold it to Erik Prince, who also owned Blackwater. As you can imagine, it was a fun and exciting and very dynamic period of three years there, and then decided to get focused really specifically on the cybersecurity red teaming side of the equation. I saw in 2000, end of 2008, going into 2009, that the adversary, the state sponsored type red teaming, what we now call APT was emerging and was on the minds of a lot of my friends in the private sector and decided to build a business of practice that was really almost exclusively focused on red teaming, and that was Fusion X. We went in and disrupted the industry with a different methodology. Focus really on that adversary perspective. Right. So that we could replicate what the attacker goals would be, what the tactic, techniques and procedures would be for those adversaries, and achieving a particular outcome. We wanted to demonstrate to the clients the art of the possible in order to raise some of the awareness on their side. So we built that company over the course of five years, myself and Tom Parker, and sold it to Accenture. I stayed on board with Accenture for a couple of years running their global cyber defense practice. And then last November made a pivot, where I'm now working more kind of in the financial investment world for a company called Telco holdings, but really finding it. And when we get to kind of the definitional aspects of red teaming, I think as I've matured over the years, I've developed a broader perspective on kind of the value that red teaming can bring, that it's not just a technical and security issue, but that it's actually something that can be applied in a lot of different disciplines. Folks know me with other hats as well. I taught at Georgetown for 14 years, a flagship information warfare and security class. I'm on the Black Hat Board of Advisors, and I run a reasonably popular website called ooda loop.com which covers security and technology and kind of global risk issues.

Nice. So let's circle back because you mentioned a few things that people like Dan and myself and most of the listeners of the podcast will benefit from knowing a little bit more. And it's the fact that in providing the way of thinking like a bad guy, the way of providing how an adversary would view things and training people into that, provides a ton, a ton of good stuff. So if you can go a little deeper as to why thinking like an adversary provides such a crazy good thing for the world security and then for the whole thing in general, right?

Yeah, absolutely. I mean, being able to view yourself from the adversary perspective. Right. Kind of informs your own decision process. So that's kind of value proposition number one. You sit in the attacker's shoes and you see yourself from the attacker perspective. And that gets you a deeper understanding really, of what the attacker's motivations are. If you understand what their motivations are, you're going to understand kind of the way in which they're going to attack you. You're going to understand the decisions that they're going to make when faced with choices in a particular attack tree because they're driven towards a particular goal. And you're going to be able to gauge the vulnerability of whatever you're looking at from the perspective of the attacker with those scenarios in play. So I've always been a huge fan and at Fusion X, I really feel like we kind of perfected the art of the unconstrained Red Team. We would argue that you couldn't impose any goals on our Red Team or any restrictions on the Red Team that you couldn't also impose on a real adversary. And that was a lesson learned that I got back from my early days of red teaming when I got to work with General VanRiper. I'm sure many of the listeners are familiar with Marine Corps where he would engage. Yeah, Marine Corps. He and I were on the defense adaptive Red Team together. So I worked with him for a number of years while I was at the Terrorism Research Center. Tremendous guy, tremendous mentor. But he was very big and had a bit of a reputation, of course, in running some of these Red teams, in not accepting constraints. If you can't impose the constraint on the adversary, why would you impose that constraint on your Red Team? The minute that you impose those constraints, then obviously you're skewing the results, you're skewing the outcome and you're skewing the decision tree for the attacker, for the Red teamer, which means the overall results are going to be skewed. So we became very adamant about saying, hey, we're not going to accept those constraints. We're going to operate with real TTP as well. We also weren't going to give an unsophisticated attack or a very sophisticated attack capability. We would operate within their known operational capabilities, maybe extrapolate for how they might evolve or engage in research and development over time. Or if they were a very sophisticated attacker, it meant that we had to realistically be able to mimic the tools that they had in their arsenal. Are they a nation state attacker that is able to have an exploit based on a modern patched web browser? Then we would have to have an exploit that went against that particular type of system. We spent a lot of time as well at Fusion X on focusing on developing the tool set enabled in order to be able to replicate what the real attackers were doing.

Now go down.

Yeah, I was just going to say it's interesting that you brought up the General because I think early on, very early on in our episodes, I had mentioned him and how he was doing the, the exercises and where he would take the smaller boats.

Right.

And during the exercise he would have the boats go up to the larger boats and like that was like mimicking how real attackers and stuff like that. Yeah. Would use the boats to charge at, you know, the forces. So like, it's funny that you bring that up because I'm just connecting it back to what we said probably a year ago now at this point. And the biggest thing is he didn't believe in the constraints. And I love how you're popping this because that's exactly right. You don't want to constrain your red team because you're not going to get accurate or even realistic results out of that.

Once you start throwing your own bias into that, whether it's your own constraint or someone else throwing the bias, that's it. It ceases to be a true adversarial approach and it becomes more like, just give it a look, see what you think.

I remember one scenario with General VanRiper where he was offered up. You have X number of jeeps, you have X number of tanks. And one of the things that he prop. Well, I'm going to go get a bunch of Mylar balloons and aluminum foil and I'm going to make my jeeps look like tanks similar to the boat scenario. And then that'll fool you into thinking my tanks are coming this direction and I'm actually going to have them back here in reserve. And somebody said, hey, wait a minute, that's no fair. You can't do that. And he looked at him and said, what the fuck the adversary does. The attacker doesn't have access to balloons.

Right.

So it was one of those things where. And also thinking there was kind of an unsophisticated approach, but understanding how he might impact the sensors and the decision cycle of the attacker operate on some assumptions that they were going to make based on what they were seeing from that sensor activity and then be able to exploit it. But I've used that line multiple times with the Fusion X team where it's like, we're never going to deny ourselves access to Mylar balloons.

That's great. Now going back to the. The training people how to think on how to think like a bad guy, how to think like the adversary. Because I mean, the reason for a podcast is educate people on what actually red teaming is and what is not. And the idea is to get to a point that people understand red teaming is actually mimicking the worst case scenario, mimicking a Real attacker that is coming at you full force. They don't have any rules, they don't have anything. Have you had or have you met people that were opposing to that and how did you deal with that? It's really hard in my own experience. And then as well get to a point where you're trying to explain that to people and they're like, no, no, no, no, I'll give you the system. You run your little tool, just give me a report and it's gonna be okay.

Yeah, Those tend to be folks that have an audit or compliance kind of regulatory mindset. Right. Anybody that really understands risk, I usually found myself able to convince them under the merits of running a real red team. So, yeah, I've encountered resistance numerous times over the years, right. Trying to impose artificial constraints, trying to limit the tool set, trying to second guess what the attacker decision cycle would look like. They definitely have played a huge role in, in the public and in the private sector and trying to educate people on the value of understanding the attacker. For example, I wrote a book with a bunch of folks, Mark Sachs, Tom Parker, others, Eric shaw, the famous PhD from the agency over 12, 13 years ago called Cyber Adversary Characterization, where we started to at least even go through the models of how do we think, through what are the cyber adversaries, how can they be influenced? How do we replicate them? With the mirror image training that we ran at trc, it was a non cyber, right? There's a kinetic style training. And the importance there, it was actually a little bit of serendipity. I was out with Robert Young Pelton, having a few too many beers one night. And I don't know if you're familiar with him, he's the author of the World's Most Dangerous Places, kind of adventure journalist. And he said, hey, I want to introduce you to this guy. And this is not long after September 11, right? So with the Terrorism Research center, we had crazy op tempo and programs that I had created that the government had denied funding to because they didn't think terrorism was an issue. We're now getting all sorts of funding and attention. He said, I've got a guy who was in Bin Laden training camp in Afghanistan. He's US born encounter him. When I was over there, he lost a leg, came back to the United States and in the aftermath of September 11th has decided that being a Jihadi is not for him. So I met with him and realized that through him, through others that we had access to that were engaging in interviews of detained terrorists, that we could paint A really good picture of what was the day in life of somebody that was training to attack, in this instance, attack the United States. Later, we took on a little bit more of a counterinsurgency focus as well. And so we built a curriculum around that. Let's take and we trained thousands of people. For example, you could not deploy to Afghanistan. They didn't do any Iraq deployments. You couldn't deploy to Afghanistan if you were Canadian military personnel unless you took this training for at least one week. We ran a bunch of the Special Forces groups through. We ran a bunch of Navy seals, a ton of Marines. It was a foundry course for the U.S. army. And in each and every instance, when they showed up, we took their phones away, their BlackBerries away, we issued them new clothing, we had them sleep in bunkhouses, we woke them up for call to prayer. And we trained and indoctrinated them exactly as the terrorists had been, solely to kind of teach them that perspective. Right. Understand the adversary that you're facing. Here is the way that they trained, here's the way that they thought, here's the videos that they watched, you know, propaganda wise, when there was access to a television to really give them that perspective. And, and that training ended up being immensely successful because the soldiers saw the value in it. We just had great testimonials about how it was saving lives, how it was providing alternative perspectives, how when they were overseas, they now felt like they were able to see themselves better or even predict what the attacker was going to do because they had put themselves in that mindset previously.

Yeah, that brings me back to my days in the Israeli military. And this is the 90s, where Israel was still deployed well within southern Lebanon. And, you know, my unit was about to get there. It's just fresh out of boot camp and advanced training. You know, you get to the combat deployment, right, and boom, we are thrown to something similar to a Sears school. But it was not just Sears school. It was like you mentioned right now, it was essentially spending time with people that have been there. And they give you the perspective of Hezbollah, of some of the jihadists over there, what they see, how they did what they did, how do they. They coming after you and, you know, all these preconceptions you have in your head, they're just getting blown away in the change. And it changed the way I approach personally, the way I approach thinking like a bad guy for everything, right? I always, you know, a simple thing. You know, we go, my family, to some country for vacation that we've never been. I'M not gonna research the best places to go and have fun. I'm gonna research the worst places. I'm gonna understand what the criminal activities are. I'm gonna try to get myself in touch with people that have been there or were part of the criminal culture. And I want to understand what is the worst case scenario so I can be, I can be ready for that. So that makes total sense to me. And I'm sure it's going to make total sense to the listeners. However, and this is a question I think Dan and I get asked almost daily is sure, I get it, I get it. You need to mimic an adversary to the best of your capabilities, whether it's a physical security situation, whether it's training for law enforcement, military, first responders, even teachers in the school with active shooting. But how do you change the mindset of someone that is like, oh, no, no, no, we just can all get along. Let's just talk and it's gonna be fine. Right. And over the years when I, you know, when I have my own company, the whole thing, I discovered that it's almost impossible to change the mindset of someone that decides, you know what, that is not going to happen. And again, I'm circling here because it's interesting to me, you're a successful Red team in various levels. How do you manage to get to the point where people took you seriously?

Yeah, early on I got exposed to having to deal with very senior leadership that was a bit skeptical, developed communication strategies, I think, that were effective for me. Right, right. The first is, you know, having something meaningful to say. Right. So I never went into a meeting without having at least thought through, you know, if we hadn't conducted the Red Team, you know, understanding what the, what the threat model would look like, you know, what an adversary might be thinking, what is a worst case scenario if it was a company? I always found the potential for developing what I call useful analogies. Being able to articulate to somebody through kind of the power of analogy the reason why they should take something serious. And this became very important, I think also for articulating red teaming results. There's a story I love to tell. When I did an assessment for Special Operations Command down in Florida and I had started the work and then there had been a change in commands. There was a new general that was running SOCOM and went in this one on O with the head of SOCOM. So if you think back then, I'm 25 years old and you know, the caliber of the folks that have led the special Operations Command.

Yeah, we've been there with Ansel.

And one of the things that I wanted to address was this particular head of Special Operations Command had a one character password. And this was back in the day when you didn't have password enforcement policies, et cetera. And I knew, and I had talked with the folks on his staff and I said, hey, I'm gonna have to bring this up with the boss. And they're like, hey, he calls that his combat ready password. Okay, it's his combat ready password.

I'm using that one.

So I went in, I sat with him. We were stepping through the results of the red team and he was fairly engaged, definitely through it. And then I said, hey, sir, there's something that we need to chat about. And he said, what's that? I said, we need to chat about your password. And he knew it was coming. I could tell that he'd get a heads up. And he said, son, that's my combat ready password.

Boom.

I said, I understand that, sir. Right. I understand, you know, the predisposition towards combat and readiness. I said, you know, there are two things I'd like to point out for you. One, we're in Florida right now, right? In a secure facility within a secure base, typing. And what we're asking for at the time was a seven character password. Because this was back when even if you had an eight character password, they kind of did the seven character hash and then just did the one character hash. So we were actually recommending seven characters at the time. So you can kind of date the story based on that. I said, sir, you know, we're not really under the duress of combat. Right? That's point number one. He was like, whatever. The second was an observation I had made. And this is kind of when I say the useful analogy, I had noticed that when he took over command, if you've been to the facility and those that have been, you know, there's the parking lot out in front, and he, whether he had a driver or was driving himself, would back into his parking spot. And of course, we, we call that combat ready parking. Wants to be able to just put it in drive and steer out of here. Of course, what I noticed was that within two weeks, every single person under his direct line of command was also engaging in combat ready parking. So I said, sir, here's the thing. I told the story. Did you notice how many people started to emulate your parking and how long it took? I said, it took about two weeks. He hadn't noticed. Which was an interesting kind of observation. I said, what happens if people start replicating your password policies and they start of engaging in combat ready passwords and it's one character and you think about the impact that that'll have for overall security. And he sat there and looked and now I had framed it as kind of a leadership and influence and kind of legacy type issue. And he looked at me and he's like, son, I'll change my fucking password. So that was kind of an early dose for me of recognizing the power of bringing it into context. Right. Maybe it is not always going to be a red teaming or cybersecurity type of analogy, but getting them to understand the importance, you know, a different perspective. So I've done that over the years and we've gotten in fights with customers. You know, the team remembers fondly 45 minutes I spent on the phone with a major CISO who wanted to change the findings of a report. Right. Of course, didn't understand why we couldn't change the wording. Right. And we refused to do it. Right. So we were always also very adamant about accurately representing our results if it was going to the board of directors and others as well. So I think finding that, you know, developing the effective communication strategy, finding that kind of power of analogy, having a very good truth to power perspective, I think a lot of people don't fight hard enough. They acquiesce too easy because they're dealing with a more powerful person or decision maker that's providing the resistance. And I will always tell them, listen, part of the red teamer mindset, part of the kind of the hacker mindset, is a truth to power perspective. And so you have to be willing to stick to your guns from that side as well. And if that's not enough to convince them the value, you're probably wasting your time. Right? There is such a thing as a customer or client that it just is not worth the effort. Where your resources would be best applied with somebody who can actually appreciate the work that's going to be conducted.

And that's a valid point because over the years, and I'm sure you probably agree with me on this one as well, over the years, years we've had customers that say, oh, we want red teaming at that point, we really need red teaming. And then you walk them through the process and you tell them what are you going to do and how are you going to mimic the adversary and I don't care your boundaries and I'll come with the full force of my team. And they just, well, that's not what I wanted, that's just too much. Or they say yeah, I want that. And then like you said, you give them a report that everything is wrong and they check. They become so defensive that it's almost impossible to present a report.

Yeah, I've dealt with that issue definitely over the years. And one thing I would always tell the red teams that I was working with is that we have to articulate this as really something that is providing value into their decision making cycle and not something that they pass or fail. I've seen too often where you go in and you provide the presentation and it's. And red teamers are guilty of this. And I was as well, certainly right, where you've got the scorecard and you've got the rankings and you're going through and articulating all of the ways in which that they've failed and their defenses have broken down and it's very easy for somebody to take a very adversarial perspective to that. But if you come in and say listen, red teaming is a tool. It is a tool that is going to be used to improve your security profile and you are not going to like the results. But the reality is that the results that we're providing are basically adversary actions that you get to mitigate before the adversary gets to engage in them. Correct. That's the simple value proposition is that an attacker sufficiently motivated to target you with sufficient capability is going to find the same exact attack surface and exploit it. Except guess what, the attacker is going to really steal the $10 million from your bank. They're really going to engage in the destructive attack. They're really going to steal all your customer pii. We've demonstrated that that is possible. We've given you the attack surface, the vulnerability space that was used to do it. We've given you the mitigation strategy. Now you can go and mitigate against that. And guess what? Attackers are resilient. They innovate. So this has to be a repetitive process, not a one and done. It has to be recurring. When we were running Fusion X we had a majority of our clients were on what we called our Fusion care retainer where they signed up on an annual. It was a one to three year basis for OR X number of red teams to be done at the frequency in which we wanted to conduct them, typically coordinating with the ciso. There were no notice red teams because another value proposition I think of the red team especially in the technical space is any organization that you're dealing with today has put a lot of money into cyber defense. They have built matrices that say for this particular type of risk, Here is the mitigation strategy, here is the security operations center that we've built that is going to detect the attacks. Here is the protocol we're going to use in order to get an attacker off our network. And then they don't exercise that capability. The actual implementation doesn't match their aspirations. Or maybe they've invested in a particular technology that they are expecting that is going to mitigate a particular type of attack. And the red team is able to come in and demonstrate that they that mitigation strategy isn't working. So that would be also something that you provide. A value is to say we are going to test your defenses and we're going to tell you where those defenses break down, where you've made assumptions and are true, where you've invested in technologies where you're not getting the yield so that you can rebalance that risk management strategy on your end. That also becomes very powerful from the customer's perspective to get that access to that kind of perspective.

So you bring up a good point, Matt. And a question that I have that just popped to my, my mind is, what do you think the value is in comparing kind of internal tabletop exercises that are done by, say, a security operations group, you know, taking scenarios, taking the threat intelligence that they cultivate, and creating these, you know, exercises and they run through them internally versus having a red team either potentially participate in that tabletop or create that scenario and then run them, run the defenders through that. Like, what are your thoughts on that aspect of red versus Blue?

Almost, yeah.

So I've been an advocate for a blended approach. As long as it's not done in complete isolation. Right. As long as it's not the only approach that you're taking, there is value. You know, we will do what we will call kind of the freeform red teaming, right, where people refer to as the black box, where we just determine what the attacker model looks like, what our goal is going to be, what we're going to exploit, you know, and all that we know is that the client exists over time, though. You know, for example, some organizations, I read team for a period that was six or seven years, right? So if you're conducting it was four to six red teams per year over that long a duration of time, having a more collaborative effort starts to be very fruitful. If they have a piece of threat intelligence that's come in that is worrisome to them, we were very happy to use that as an injection point into the Red Team to try and cause a red Team outcome that demonstrated their ability to ingest and act upon that piece of intelligence that they had received that I found was. Is very useful. So you have the threat intelligence coming in. We get a copy of it. We design a red team that is designed to exploit the nature of whatever the threat intelligence might be, and that is testing how well are they ingesting this threat intelligence, how well are they operationalizing it? We also would encounter scenarios where they either, through the blue team activities on their network, understand how the attacker is targeting them in a way that they want to articulate to us, or they might understand the business. Right. There might be a shift in the business and they want to understand the risk that is being exposed, or there might be something else that is internal. So where you have that collaboration around those types of issues, that's helpful as well. Right. Where they're able to say, hey, we just want to know. We've been coming at it from this perspective because we felt like that was really where the threat model was. But we've seen it shift. We had that happen with a big financial services customer after the Saudi Aramco attack, where a lot of our modeling with them was on the theft of money. Right. We're going in and trying to engage in fraud and to try and steal money out of bank accounts. And we did it across all different types of business units. And then the attack happened. The Saudi Aramco attack happened. And the CISO called and said, hey, I know with this threat actor, they don't like us. They launched denial of service attacks against us. There's other things that they've done, right. That we know that we're on their target list. If they tried to do something like that to us, how susceptible are we? So we said, well, let's take that on as a red team task. Let's take it from that particular threat perspective with that particular type of outcome, and let's see where that leads. And that was a very useful exercise, not only for us to shift kind of mid stage with that client, but also for the client to understand, okay, we need to think about the survivability of our business beyond just somebody trying to steal money from the bank.

Yeah. So one of the things I noticed early on when I was trying to change mindsets of people really not really getting red teaming, was explaining that the end goal of red teaming was to make the people more resilient. Right at the end of the engagement, essentially, they were going to Be stronger and more, I don't know, I think more ready to where the actual attack was coming and they knew exactly what to do. I mean, that cannot be seen 100%. But the more you put them through a red team assessment, the more you show them how a true adversary can come and do harm to them, the better their business is going to thrive. Would that happen? Right. The other thing I noticed, and this continues to be true even today when red teaming is a buzzword, is the fact that if you engaged on them about, we're not going to come at you as just the normal hacker doing the whole digital red teaming and we're not even going to try to physically penetrate your premises and steal stuff directly out of your desk, but we are going to come and work with your leadership, understand your plans, understand your policies, understand the way your company thinks and the industry they belong to, and just play the, how do I put it? Play the, how do I break that? Right. Play the hand of. All right. That's your policy. Perfect. That works in my favor. This is how I break it. And this is why your policies suck and it's how you make it better. Once they begin to understand that red teaming is not just hacking that it's not just, you know, picking the lock, their mindsets change. And that's when really red teaming begins to get a really good tool and it factors in, in the planning of security.

Yeah, I did my 2015 and you can find it on the OODA link blog. I did 10 year, you know, 10 lessons learned after 20 years of red teaming.

Yeah, that was a great book.

That was one. Is it the kind of the, it's the 10th man role. Right. From World War Z. Right. Having somebody in the room who is going to challenge your perceptions is going to look for ways that maybe things aren't in alignment or that might be exploited or look at it from an alternative perspective. Right. I will often say when I do the tabletops, part of my role is to reduce the level of naivete in the room. Because if you're part of a company and you've got a new technology or you've got a plan, you've got a tremendous amount of excitement around it. And a lot of times that frames you to be thinking solely from a positive perspective and you're not thinking downstream of. If we introduce this or if we, you know, process is planned, here is the way in which bad people might exploit it. Right. So kind of adding that dimension to it. And then you raised a useful point too, in kind of the iteration. There's a slide that I've used thousands of times now, I'm sure in presentations where I'd say that, you know, the analogy for red teaming is sparring. You know, if you were going to be fighting Mike Tyson in a boxing match, how would you train for that particular match? Would you just go hit a static punching bag and say, hey, I'm okay? Or would you want to have a live sparring partner that can emulate Mike Tyson and say, hey, he's got a really strong hook. You got to look out for that. And here's how his feet moves and get in there and spar with somebody who can replicate as a real live partner. Vice, a very static training tool. A lot of people engage. Their security programs are really that static training tool. They do internal red teams, they do compliance checking, but they don't bring that kind of real life sparring partner. And the reality is that for a lot of these organizations where you or I might have to choose whether we want to fight Mike Tyson in a ring or not, they have no choice. The adversary is coming for them. So they have to train and get themselves ready to defend themselves, become more resilient against an adversary. Does it mean that I'm going to be able to train and go successfully beat Mike Tyson? Absolutely not. Does it mean that maybe I'm able to train where I get an extra 30 or 45 seconds out of it? Possibly. Right. So you're building, building that resiliency into the equation through red teaming as well.

Yeah. The funny thing is, though, and this is a small story that I've recounted many times, but we were brought into Red Team. The physical security of a scale doesn't matter what skiff, but it was a highly secure skiff. They built a ton of technology around the entrance. They put a bunch of things that were prevent people from bringing digital devices inside. Opening the door, you needed a badge and a key code and a bunch of other things to get in. And I'm like, dude, all it takes in someone doing a low tech here to bypass everything say, no, can I pop. I brought a sledgehammer and I just dig a hole around the wall around the door. You know, the wall around the door? The door was. I mean, there was no way you can go through the door, but the walls were not fortified. So I just dig a hole and get myself into the skiff. And people were like, whoa, how do you. How do you even do that? I'm like, dude, it's pretty obvious. And that, that's the Story I use just to give the sense of why red teaming works, why bad people do what they do, and if they have a very easy to follow solution, they will go that way regardless of how much money you throw at the problem. Right?

Yeah, it's resource allocation. If I can achieve the objective with the minimum allocation of resources, that's what I'm going to do. If digging a hole around the wall is the easiest allocation of resources, that's the path that I'll take. Which is why a lot of these organizations, you see simple attacks still working and they say, well, it can't be a sophisticated attacker because they used a simple spear phishing campaign. It's like, well, they could be a sophisticated attacker. They just recognize that that tactic works. Right. Why use something that is more sophisticated and going to be wasted when the simple tool, when the simple approach actually allows them to reach their objective?

Got it. Cool. So one more question, and this is something that I think is interesting to me. Definitely it's interesting to a lot of people. The last, I would say probably three or four weeks, an average of 20 people ask this question. So it will be interesting to get your take to that.

One.

How do you begin your path as a red teamer? And second, you've been working as a red teamer. What is next? What is the next. The next thing you're gonna be subjecting yourself to or learning in order to get yourself better?

Yep, those are great questions. I was kind of, you know, I came into this domain at an interesting time and that there was really not a lot of attention that was being paid to the cybersecurity. So my background was I was a student that had two interest areas. One was national security issues with a focus, kind of asymmetric and gray areas, which is the counterterrorism side of the equation. And then a computer scientist. It was a computer scientist who hated math. I loved code, I could do anything in code. But you didn't like taking math. And I started hanging out once I got to college, recognizing that there was an emerging online community. It wasn't the commercial Internet days quite yet, but still lots of connectivity through bulletin board systems and university networks, et cetera. And started hanging out with peers of my generation that were what I would call the early white hat hackers. They were engaging in hacking, but it was really the kind of intellectual curiosity and I saw what they were able to do and I saw the vulnerability of the systems and I put on my national security hat and I said, geez, you know, we are becoming increasingly Dependent on technology that is a given. Right. You can see the roadmap emerging that technology is inherently vulnerable. I'm seeing that every day. I can sit down and hack into the phone network if I want or go after targets in the US government. And I came to the conclusion that an adversary was going to exploit that someday, that that was going to be a mechanism in which we were going to start engaging in conflict and attacks. And nobody else at the time was really talking about that. Maybe a very small handful. The year I wrote my first paper on information warfare, cyber conflict type issues was the same exact year that the Department of Defense Defense issued their top secret directive on information warfare in 1992. Right. And I had no idea that because I didn't have a clearance, I was just a college kid. And I decided to pursue that as my area of study for graduate school. And this is kind of an interesting aspect to kind of persistence and networking as well. I was actually denied that as a topic for graduate school. They said, no, it's not significant enough. There's no real national security issue there. Why don't you go look at the national security implications of free trade? I still remember that was one of the areas they wanted to push on me. But I persisted and networked. And then the US government recognized the work that I was doing and people from national defense universities started reaching out to me. There was retired CIA folks that started publicizing my papers and attracting attention and established enough momentum speaking at conferences, getting stuff published that it forced the university to say, hey, ok, okay, we were wrong. We're going to let you do your thesis on this topic. So I wrote a thesis, it was called National Security in the Information Age that was looking at all of these issues. And that thesis was 1995. So if you think back, we didn't have the President's Commission on Critical Infrastructure Protection. We didn't have any national strategies. The joint staff was actually writing their first kind of piece of information warfare doctrine. And I realized that D.C. was the area that I needed to be. So I came to DC, bought a one way train ticket to Washington D.C. with no job, found a job within two weeks and just got sucked into the defense industrial base based on my expertise. And they realized soon because of my computer science degree that hey, here is a guy who not only understands the national strategic and can help the chairman of the Joint write their policy on information warfare, but can sit down at a keyboard and actually break into things. And that is when I get pulled in to run this first Red Team for The Department of Defense, where we were traveling around the world and engaging in those attacks, and then from there kind of following the vanriper style of red teaming. I had raised an issue around not red teaming our coalition commanding control systems. When we engaged in these big military exercises, we said, hey, we're doing these big exercises. Like JWID was a big one. The Joint War Fighting Interoperability Demonstration, where the sole purpose of the exercise is to demonstrate that our command and control could talk with our allies. Command and control, primarily Five Eyes. I said, you know, we're allocating all these red forces to play, you know, the Red Navy and the Red army and the Red Air Force. And I said, but we don't have Red Cyber. And I remember somebody in DOD said, oh, there's no way that you'll get legal authority to put that team together, but if you do, we'll fund 100% of the cost for the team to operate. So I did a lot of what you guys are doing right now, what I'm doing. I wasn't quite a whiskey drinker yet. I drank a lot of beer, acquired whiskey a little bit later in life, but I went out and met with my counterparts in Australia and New Zealand, and we drank a lot of pints of beer and we talked a lot and went up to Canada and got in touch with a great commander up there named Robert Garrig. And he started pushing on his end. And lo and behold, we started getting the letters together to put this coalition red team together. And soon we were five for five. We had all five. So we launched it actually against the Jaywood exercise. I ran it for two years. We did some incredible things. And then I actually turned it over to Robert Garrig, the Canadian, to run for the subsequent two years. So that was kind of my trial by fire as I was exposed to all of this stuff at the national strategic level. But I was also a hacker. I could sit at the keyboard. I understood how to write exploits, how to exploit systems. I've always kind of had that mindset of being able to dissect complex problems. And it was an emerging field. Right. It really was a green field. I like to joke that I helped make the wave, and then I caught the wave from a surfing perspective. I was writing about how important these issues were, and then I was actually going and being part of the solution for how we solved for them.

Awesome. Cool. All right. We are on the 45th minute already. So if any of the listeners want to get in touch with you, learn a little bit More about you. Go get some really awesome information at the OODA Loops website. How do they do that?

Yeah, it's easy to connect with me. You can write just devoe.net, my last name, Delta echo Victor Oscarsierra, tango.net has a lot of the stuff that I've written over the years. Papers even going Back to that 1995 thesis is posted there, as well as a famous paper I wrote the next year with Neil Pollard and Brian Houghton called Information. Can you trust your toaster? I still get these days, based on the fact that we're talking basically predicting the emergence of the Internet of things, but dealing with a lot of complex issues. So that's a great way. I'm just Matt DeVoe, all one word on Twitter. And then most of my writing on these topics is done at the OODA Loop website, which is just ooda loop.com and if you haven't checked that site out, I would encourage your readers to check it out. There's a. There's a team of analysts that surf primarily open some proprietary sources for interesting tidbits. They are producing a daily intelligence report that goes out. There's original content that's getting posted there. Great group of contributors. If you look just. Even over the past week, we've had a stellar exemplar. We did an interview with PW Singer around his book Like War, that just came out. We had Congressman Will Hurd talking to us about AI and quantum computing after the white paper that they released. And then for those that want to get really deep, I have a newsletter that I put out every Sunday morning called the Global Frequency. You can just go to globalfrequency.com and if anybody encounters me in a bar and understands the backstory to the name, it's worth a free drink on me. So that's the how to get in touch with me, the future focus for me. I gave a keynote a couple years ago and I said, kind of challenge the audience. I said, gosh, it would be a shame for our generation of hackers and thinkers and red teamers if the only domain that we applied that expertise to was in the security space. I said, we need to figure out how to apply a similar mindset to solving other problems. And last November I made the jump to actually work and start thinking, okay, how can we apply that same type of mindset to complex business issues, to emerging industries, to kind of old sleepy industries in which we haven't applied technology, data science and some of machine learning and some of these advanced approaches? So I spend a lot of my time doing that, spend a lot of my time focusing on the emergence of these advanced technologies. A lot of my reading list, if you read the Global Frequency list, you'll see each week I put out a book review as well on that list. A lot of books on AI. Right. I'm really trying to wrap my head around what if I think through from a red teaming perspective, you know, what are the possible scenarios. I also spend a lot of time still just staying very focused on the emerging kind of adversarial environment. What are our adversaries doing? Where are they going to innovate? What are possible futures doing? Long term thinking, if there's one critique that I tend to have is that we tend to have a very short term focus and our adversaries have a very long term focus. So I also try, when I'm doing the more theoretical red teaming and supporting the Chairman of the Joint Chiefs or working with the Defense Science Board or whatever it may be, I'm always pushing to look in that. Not even the sci fi future, but kind of the near future. Let's project out 10, 15, 20 years. If there are possible scenarios that we believe are kind of world truth. So, you know, the world can go in one of five directions. What does an adversary need to be doing now in order to cause one of those outcomes and how do we detect, prevent, become more resilient against that? So that's the kind of the stuff that I'm focused on now. If you sat me down at a keyboard, I'm sure I could bang out an exploit in maybe 20 times the length it would take you guys to do it. My coding skills have deteriorated over the years, but you know, I still have that fundamental understanding of the technology and how it works that I could probably get by.

Tell you what, next time we're doing, next time you're in New York, by the way, hit us up. Dan and I will be there and we'll put you through the test. Let's see how you doing, by the way. I'm thinking and you know, and I'm going to put it out there because I know Mark, Mark is going to be listening to this one. Mark Matesky. I think at some point we should all get into an episode, you know, you, Mark Matesky, Dan, me, potentially a bunch of other people that I'm sure we know and we've been kind of, you know, work together at some point here or other and do a maybe 50 minutes, an hour of kind of like a roundtable. What now Right.

Yeah.

And. And, I mean, Marcus been. I mean, Marcus. I mean, he and I know. Know each other for a long time. He's. He's. He's a great guy to just. I mean, his mind is awesome. And the idea of, okay, what's next in the world? Red teaming, and if it's red teaming at all. Right. And it's something I think we should. We should just discover. We try many times here. The podcast. He was here, I think, three times. Two or three times.

At least two, I think.

Yeah.

I'm back for a third.

Yeah. And every time we got him on board, he's, like, all fired up about bringing the next level of red teaming, and it's getting there, so. Yeah, well, we'll see.

Yeah, absolutely. I mean, obviously, I've known mark now for 20 years. I think it's actually our 20th anniversary. Been involved with the red team since the beginning. I think that would be a fun episode. I'd love to. And anytime you guys want to have me back on, as you can tell, I love talking about these.

You got it, man. You got it. Yeah, we have. Fortunately, we have a bunch of guests that you might know as well line up. So keep an eye on that, or ear, rather, but cool. Matt, thanks so much for coming to the show. Hopefully. Hopefully this will bet, you know, they will bring people to the next level, and I'm sure we're gonna have a bunch of questions. I'll forward them to you if you're interested.

Absolutely.

After each episode, we got a, you know, an average of about, you know, 15, 20 questions, some related, some unrelated. But after this one, I'm sure people will have a lot of really good questions. So I'll send them your way when we can do a Q and A based on that.

Sounds great.

Awesome. Thanks so much for coming.

Thanks, Matt.

All right, thanks, guys.

Cheers.