1
00:00:00,000 --> 00:00:02,860
Lastly, now my pleasure to introduce you, Eric Capuano.

2
00:00:08,640 --> 00:00:09,760
I appreciate that.

3
00:00:10,080 --> 00:00:14,380
And also the line that you guys were in to get in here was super humbling for me.

4
00:00:14,620 --> 00:00:24,540
Thank you so much for taking time out of your awesome DEF CON to come and listen to me drone on a little bit about security operations on a budget and some tips and tricks that I've learned in my time.

5
00:00:24,540 --> 00:00:30,280
As Ming said, we go back a little ways because I'm actually a member of the Pack of Hacking Village and the Wallace Sheep here.

6
00:00:30,380 --> 00:00:31,520
I run the Honeypot Project.

7
00:00:31,740 --> 00:00:35,680
So if anybody here has seen that or if you haven't, please come take a look.

8
00:00:36,040 --> 00:00:38,420
We've got a really cool deal going on over here.

9
00:00:38,980 --> 00:00:40,300
So I'll dive right in.

10
00:00:41,180 --> 00:00:43,480
Heart rate is 101 right now.

11
00:00:43,540 --> 00:00:45,980
So let's see how that fluctuates throughout the talk here.

12
00:00:47,160 --> 00:00:47,560
Here.

13
00:00:50,700 --> 00:00:51,500
Oh, clicker.

14
00:01:04,900 --> 00:01:05,420
Okay.

15
00:01:05,420 --> 00:01:05,620
Okay.

16
00:01:05,940 --> 00:01:06,540
All right.

17
00:01:06,580 --> 00:01:07,620
So a quick introduction.

18
00:01:07,820 --> 00:01:11,560
So I am the SOC manager for the Texas Department of Public Safety.

19
00:01:12,200 --> 00:01:15,460
I'm also a cyber warfare operator for the Texas Air National Guard.

20
00:01:16,320 --> 00:01:21,180
In my limited free time, I'm also a private consultant.

21
00:01:21,920 --> 00:01:24,520
As I mentioned, I support the Pack of Hacking Village.

22
00:01:24,540 --> 00:01:26,780
I'm also a member of the Pack of Hacking Village here and the Wallace Sheep at DEF CON each year,

23
00:01:27,360 --> 00:01:30,200
specifically emerging threats, honeypots, and deception systems.

24
00:01:30,760 --> 00:01:32,400
Cyber patriot instructor as well.

25
00:01:32,840 --> 00:01:36,660
And that's something that I think everybody, if you're in the industry, you should be doing that.

26
00:01:36,780 --> 00:01:37,400
Pay it forward.

27
00:01:37,580 --> 00:01:38,260
Teach the kids.

28
00:01:38,400 --> 00:01:40,580
We need more talented folks in this industry.

29
00:01:41,280 --> 00:01:42,280
I'm a blog author.

30
00:01:43,200 --> 00:01:44,460
Not often enough, though.

31
00:01:44,580 --> 00:01:45,840
Security against obscurity.

32
00:01:46,080 --> 00:01:47,960
Blog.ecapuano.com.

33
00:01:48,200 --> 00:01:49,880
And I'm a hobbyist teacher student.

34
00:01:50,060 --> 00:01:54,080
So if you notice, there's all these things over here, and it all revolves around coffee.

35
00:01:56,080 --> 00:01:57,760
A few disclaimers, right?

36
00:01:58,220 --> 00:02:00,420
These are just my opinions and mine alone.

37
00:02:00,740 --> 00:02:03,440
There is no absolute truth in any situation.

38
00:02:03,680 --> 00:02:04,460
Your mileage may vary.

39
00:02:04,600 --> 00:02:10,560
And to cover my ass, all products, vendors, figures, and potentially anything else in this presentation are completely fictional.

40
00:02:12,180 --> 00:02:14,940
And also, the only wisdom is knowing that you know nothing.

41
00:02:15,120 --> 00:02:16,700
Guys, I don't have all the answers, okay?

42
00:02:16,740 --> 00:02:19,040
I just know a few things that I figured out in my journey.

43
00:02:21,260 --> 00:02:23,620
So here's the million-dollar question, right?

44
00:02:23,620 --> 00:02:26,440
Why is enterprise security so hard?

45
00:02:26,580 --> 00:02:29,100
And then why is it so damn expensive, right?

46
00:02:30,460 --> 00:02:31,920
Quick history lesson.

47
00:02:32,680 --> 00:02:42,340
114 years ago, this guy, right, Marconi, he wanted to go out and demonstrate to the public that he could securely transmit information, completely hacker-proof, right?

48
00:02:42,400 --> 00:02:46,860
Anti-APT, zero-day proof, secure transmission of data.

49
00:02:47,180 --> 00:02:50,860
Well, just like today, most of those promises were empty.

50
00:02:50,980 --> 00:02:52,940
And this guy, Maskeline.

51
00:02:53,620 --> 00:02:56,320
He was actually, Neville Maskeline was actually a magician, right?

52
00:02:56,400 --> 00:02:57,400
This guy wasn't a hacker.

53
00:02:57,520 --> 00:03:00,600
He wasn't any kind of a computer dude, but he was a magician.

54
00:03:00,740 --> 00:03:02,820
And he said, I'm going to embarrass the hell out of you.

55
00:03:04,100 --> 00:03:10,340
And so what happened was this guy, he's like, hey, look, I can broadcast things over radio, totally secure.

56
00:03:10,840 --> 00:03:15,160
Trust me, because there's a padlock picture next to the radio tower, right?

57
00:03:17,080 --> 00:03:23,000
And this guy over here is like, nope, what I'm going to do is I'm going to hijack your transmissions and I'm going to replace them with my own.

58
00:03:23,100 --> 00:03:23,600
And I'm going to do this.

59
00:03:23,620 --> 00:03:27,420
And I'm going to talk all kinds of shit about you in Morse code during your proof of concept.

60
00:03:27,780 --> 00:03:33,780
So he totally rocked this guy during his POC just to demonstrate that security is hard.

61
00:03:35,160 --> 00:03:36,660
So here's the question, okay?

62
00:03:37,000 --> 00:03:39,020
114 years ago, this is happening.

63
00:03:39,160 --> 00:03:40,440
Why are we still getting it wrong?

64
00:03:42,260 --> 00:03:46,020
In my opinion, honestly, what it boils down to is a mindset.

65
00:03:46,500 --> 00:03:48,000
It's not stuff you buy.

66
00:03:48,220 --> 00:03:52,160
It's not, you know, magic boxes that you put in your data center.

67
00:03:52,240 --> 00:03:53,600
It's a mindset that we've got to get.

68
00:03:53,620 --> 00:03:53,860
It's a mindset that we've got to get right.

69
00:03:59,000 --> 00:04:00,800
And slides, you've got to get those right, too.

70
00:04:04,740 --> 00:04:06,940
Okay, what does it not come from, right?

71
00:04:07,600 --> 00:04:09,140
Padlock.png on your website.

72
00:04:09,740 --> 00:04:11,260
Magic box in the data center.

73
00:04:11,720 --> 00:04:14,280
Next gen magic box in the data center.

74
00:04:15,560 --> 00:04:17,000
Or spending millions, right?

75
00:04:17,120 --> 00:04:20,760
There is not a direct correlation between how much you spend and how secure you are.

76
00:04:22,520 --> 00:04:23,160
Checking yes.

77
00:04:23,160 --> 00:04:26,480
Yes, on your compliance audit, we're good.

78
00:04:28,700 --> 00:04:29,420
It's a mindset.

79
00:04:30,940 --> 00:04:33,060
Okay, so some common problem statements, right?

80
00:04:33,140 --> 00:04:35,020
These are things that you hear all too often.

81
00:04:35,780 --> 00:04:37,540
I can't hire good people, right?

82
00:04:37,600 --> 00:04:40,000
There's this major talent shortage, apparently.

83
00:04:40,580 --> 00:04:43,280
If that's the case for you, please leave me a business card

84
00:04:43,280 --> 00:04:45,740
because when I post a job in Austin, Texas,

85
00:04:45,940 --> 00:04:49,320
I end up getting about 20 times the applicants

86
00:04:49,320 --> 00:04:50,860
than I can afford to hire.

87
00:04:51,020 --> 00:04:52,640
So I have too many.

88
00:04:52,640 --> 00:04:53,620
I have too many qualified applicants.

89
00:04:53,860 --> 00:04:55,660
So let me know if you need help there.

90
00:04:55,780 --> 00:04:57,640
I can't train the people I have, right?

91
00:04:57,780 --> 00:04:59,620
We're going to talk about some ways to do that.

92
00:04:59,820 --> 00:05:01,820
I'm too busy responding to incidents

93
00:05:01,820 --> 00:05:03,740
to improve incident response.

94
00:05:04,020 --> 00:05:04,740
That's one of my favorites.

95
00:05:05,020 --> 00:05:07,240
And my budget has a lot of zeros,

96
00:05:07,320 --> 00:05:09,220
but they're on the wrong side of the decimal.

97
00:05:10,960 --> 00:05:12,460
This is a really common one.

98
00:05:12,520 --> 00:05:13,580
And this one drives me crazy.

99
00:05:13,700 --> 00:05:14,680
My users are dumb.

100
00:05:14,980 --> 00:05:18,660
And they keep clicking and opening and downloading stuff, right?

101
00:05:19,460 --> 00:05:20,200
Next, next.

102
00:05:20,300 --> 00:05:22,620
Gen APT Signature Avialess Firewall is too expensive.

103
00:05:23,460 --> 00:05:24,860
It's true, it is.

104
00:05:24,960 --> 00:05:25,860
It is too expensive.

105
00:05:26,020 --> 00:05:27,460
But the good news is you don't need it.

106
00:05:27,900 --> 00:05:31,340
If only there was an affordable way to solve the problem, right?

107
00:05:31,400 --> 00:05:34,920
Open source solutions are not feasible because of reasons.

108
00:05:35,940 --> 00:05:39,020
If anybody wants to debate that, please see me after the talk.

109
00:05:41,100 --> 00:05:41,660
All right.

110
00:05:41,680 --> 00:05:45,180
So going into what I think is the foundation for solving this problem,

111
00:05:45,380 --> 00:05:45,920
it's people.

112
00:05:46,560 --> 00:05:49,060
You absolutely must hire the right people.

113
00:05:49,260 --> 00:05:51,600
And then when you have them, you need to take care of them

114
00:05:51,600 --> 00:05:52,440
to keep that team.

115
00:05:52,560 --> 00:05:52,600
So I'm going to show you how to do that.

116
00:05:52,600 --> 00:05:54,560
Because if you can't get this right,

117
00:05:54,660 --> 00:05:56,180
nothing else is going to matter.

118
00:05:56,300 --> 00:05:58,280
This is the foundation for doing this.

119
00:06:01,140 --> 00:06:03,020
So I know you guys have seen this before.

120
00:06:03,200 --> 00:06:05,240
And if you haven't,

121
00:06:05,240 --> 00:06:06,100
this is something to consider.

122
00:06:06,340 --> 00:06:07,540
When you post your job rec,

123
00:06:09,060 --> 00:06:10,380
you're hiring keywords.

124
00:06:10,680 --> 00:06:11,640
You're hiring certifications.

125
00:06:11,760 --> 00:06:13,760
Or at least that's what your HR department is looking for.

126
00:06:14,080 --> 00:06:15,420
We've got to get away from that.

127
00:06:15,680 --> 00:06:19,280
Because keywords do not fill SOC analyst seats

128
00:06:19,280 --> 00:06:20,240
with the right people.

129
00:06:20,240 --> 00:06:23,740
So your cybersecurity job requisition, right?

130
00:06:23,820 --> 00:06:24,980
This Venn diagram illustrates

131
00:06:24,980 --> 00:06:26,980
that the people that perform security jobs

132
00:06:26,980 --> 00:06:29,760
often do not overlay with your job requisition.

133
00:06:30,740 --> 00:06:31,840
Bridge that gap.

134
00:06:35,680 --> 00:06:38,940
Stop hiring based on degrees or certifications.

135
00:06:39,520 --> 00:06:39,900
Okay?

136
00:06:41,100 --> 00:06:43,380
I do not have a degree in cybersecurity.

137
00:06:43,720 --> 00:06:45,180
I do not have a degree in computer science.

138
00:06:46,180 --> 00:06:48,560
But I do this stuff night and day.

139
00:06:48,720 --> 00:06:50,220
And somehow stumbled upon this.

140
00:06:50,240 --> 00:06:51,120
I'm pretty good at it.

141
00:06:51,260 --> 00:06:53,820
Same story for every single analyst in my SOC.

142
00:06:54,900 --> 00:06:55,880
Look for passion.

143
00:06:56,000 --> 00:06:56,540
Look for drive.

144
00:06:56,840 --> 00:06:59,380
Look for someone that has the ability to learn.

145
00:06:59,660 --> 00:07:00,060
Right?

146
00:07:01,840 --> 00:07:04,220
If you guys have seen CISSP Googling,

147
00:07:04,320 --> 00:07:05,180
I mean it's a bit of a parody.

148
00:07:05,280 --> 00:07:06,500
Not to pick on the CISPs, right?

149
00:07:06,580 --> 00:07:08,360
But what it really is here is that this industry

150
00:07:08,360 --> 00:07:10,040
is driven entirely by certifications.

151
00:07:10,380 --> 00:07:12,300
When you're hiring just based on the certs

152
00:07:12,300 --> 00:07:14,080
that someone has, you're doing it wrong.

153
00:07:15,560 --> 00:07:16,740
Instead, take a chance.

154
00:07:16,920 --> 00:07:19,420
Take a chance on the newcomer that has no certifications.

155
00:07:20,240 --> 00:07:20,380
No experience.

156
00:07:20,660 --> 00:07:22,580
But in the interview expresses a passion.

157
00:07:22,780 --> 00:07:25,360
Says, hey, I go home at night and I build

158
00:07:25,360 --> 00:07:27,220
a malware reverse engineering lab

159
00:07:27,220 --> 00:07:29,200
just because I want to learn how this stuff works.

160
00:07:29,360 --> 00:07:30,800
That's the person that you want on your team.

161
00:07:35,780 --> 00:07:37,180
Once you get your rock star team,

162
00:07:37,380 --> 00:07:39,360
you absolutely got to take care of them

163
00:07:39,360 --> 00:07:41,420
and you've got to give them the tools that they need to succeed.

164
00:07:41,660 --> 00:07:41,800
Right?

165
00:07:42,320 --> 00:07:43,620
Especially for someone like me.

166
00:07:43,720 --> 00:07:44,480
I'm state government.

167
00:07:44,700 --> 00:07:46,640
I do not have infinite budget.

168
00:07:50,240 --> 00:07:50,280
I've been in a lot of ways.

169
00:07:50,840 --> 00:07:53,720
So first, enabling effective security operations

170
00:07:54,060 --> 00:07:55,620
communication, you got to get it right.

171
00:07:55,760 --> 00:07:58,500
If you're still using e-mail for security operations,

172
00:07:58,780 --> 00:08:00,400
you're going to have a bad time.

173
00:08:00,700 --> 00:08:01,000
Alright?

174
00:08:01,180 --> 00:08:03,440
You've got to come up with something that can keep up

175
00:08:03,440 --> 00:08:04,760
with the speed of operations.

176
00:08:05,140 --> 00:08:07,160
Because your team's never gonna be any faster

177
00:08:07,160 --> 00:08:09,160
than the method by which they communicate.

178
00:08:11,100 --> 00:08:14,180
So when we migrated away from e-mail based communication,

179
00:08:14,560 --> 00:08:20,220
we actually achieved a rate of about 90,000 emails

180
00:08:20,240 --> 00:08:23,460
thousand useful messages per year between our analysts. It's a

181
00:08:23,460 --> 00:08:26,620
lot of traffic. And that's not just analysts talking to one

182
00:08:26,620 --> 00:08:28,280
another, but that's integrations. That's chat

183
00:08:28,280 --> 00:08:30,820
operations. You know, my analysts are able to blacklist

184
00:08:30,820 --> 00:08:34,240
IP addresses from Slack. You know, that's pretty cool. You

185
00:08:34,240 --> 00:08:36,540
know, if you're on call and you're at the movies with your

186
00:08:36,540 --> 00:08:39,240
significant other and you find out you're getting attacked by a

187
00:08:39,240 --> 00:08:41,460
phishing campaign, it's kind of neat that you can just pull out

188
00:08:41,460 --> 00:08:46,740
your phone and handle the situation. But at the same time,

189
00:08:46,780 --> 00:08:48,860
it raises the situational awareness for everyone on the

190
00:08:48,860 --> 00:08:54,340
team. Train your people. Because hacker typer and the

191
00:08:54,340 --> 00:08:57,400
threat, the Norse threat map are only going to fool your

192
00:08:57,400 --> 00:09:02,520
executives for so long. Training is a must. So how do you get it,

193
00:09:02,560 --> 00:09:06,920
right? Training is so expensive. Well, guys, you know, it can be

194
00:09:06,920 --> 00:09:10,680
done on a budget. Send your folks to DEF CON. Send your

195
00:09:10,680 --> 00:09:13,760
folks to SANS if you have the budget for it. And I'll go over

196
00:09:13,760 --> 00:09:18,720
a few more training options. Documentation. The least

197
00:09:18,720 --> 00:09:22,180
favorite thing among developers, engineers, analysts,

198
00:09:22,420 --> 00:09:25,980
but it's a must have. If you're not documenting your procedures,

199
00:09:26,200 --> 00:09:28,680
if you're not building repeatable standardized

200
00:09:29,180 --> 00:09:31,240
procedures for the things that your analysts do on a day-to-day

201
00:09:31,240 --> 00:09:34,220
basis, you're not going to have a good time. So it doesn't

202
00:09:34,220 --> 00:09:36,920
matter how you do this, but crowdsource it. Each one of the

203
00:09:36,920 --> 00:09:40,100
folks on your team, put them in charge of a program or a tool

204
00:09:40,480 --> 00:09:43,640
or a system, and they need to be the one that develops the

205
00:09:43,640 --> 00:09:46,860
documentation for others to follow. Because everyone on the

206
00:09:46,860 --> 00:09:48,700
team knows something that the others don't know. And that's

207
00:09:48,840 --> 00:09:52,340
Do not capture that. Tribal knowledge will be your Achilles

208
00:09:52,340 --> 00:10:00,440
tendon. So some ways you can train your team, right? CTFs.

209
00:10:00,620 --> 00:10:05,000
Send the team. As a team, participate in CTFs. If you

210
00:10:05,000 --> 00:10:08,820
haven't known, CyberArea.IT, fantastic resource, completely

211
00:10:09,340 --> 00:10:13,560
free. And this was, this was, I wrote this a while back, they're

212
00:10:13,560 --> 00:10:17,900
well over 400 now, free courses in IT and security. Send your

213
00:10:17,900 --> 00:10:20,640
people to conferences, especially ones like DEF CON,

214
00:10:20,880 --> 00:10:24,800
B-Sides. And if you've got the budget, again, SANS is pretty

215
00:10:24,800 --> 00:10:29,960
unbeatable. You've got to train your people for worst-case

216
00:10:29,960 --> 00:10:33,080
scenarios. Now this one, I could have a whole, actually I

217
00:10:33,080 --> 00:10:36,000
do have a whole other talk on just this point alone. If you're

218
00:10:36,000 --> 00:10:39,740
not training your team for the worst-case scenarios, they will

219
00:10:39,740 --> 00:10:42,860
not be ready when that day comes. Because you cannot train

220
00:10:42,860 --> 00:10:45,420
for something you've never, you cannot participate, or you

221
00:10:45,420 --> 00:10:47,880
cannot effectively respond to something that you've never seen.

222
00:10:47,880 --> 00:10:51,360
You have never encountered before. So tabletops are a good

223
00:10:51,360 --> 00:10:54,240
place to start. If you don't have the resources to actually

224
00:10:54,240 --> 00:10:58,720
simulate an incident, then do tabletop scenarios. What if? What

225
00:10:58,720 --> 00:11:02,340
if we were breached today, and someone moved loudly through the

226
00:11:02,340 --> 00:11:05,000
network, and now they're exfilling, you know, MySQL

227
00:11:05,000 --> 00:11:08,720
database across the network. What would we do? And find out

228
00:11:08,720 --> 00:11:11,720
if your team is prepared to work as a team effectively in the

229
00:11:11,720 --> 00:11:17,860
middle of a shitstorm. If you do have the resources, then you

230
00:11:17,880 --> 00:11:21,840
can use simulated incidents. So a DFIR simulation is as close as

231
00:11:21,840 --> 00:11:26,760
you're going to get to actually performing as a team when the

232
00:11:26,760 --> 00:11:30,240
heat's on. And like I said, tomorrow around this time, I'm

233
00:11:30,240 --> 00:11:32,740
giving a talk on how you can do this yourself, to build an

234
00:11:32,740 --> 00:11:36,400
actual incident response simulation platform. But one of

235
00:11:36,400 --> 00:11:38,600
the best parts about this is it can be extremely, it can be

236
00:11:38,600 --> 00:11:42,380
done very inexpensive if some open source concepts are applied

237
00:11:42,380 --> 00:11:47,440
here. Okay, and then this is really more kind of your

238
00:11:47,880 --> 00:11:49,940
administrative, your managerial, but lead. Don't manage, okay,

239
00:11:50,020 --> 00:11:53,100
because micromanaging, it's a morale killer. You've got to

240
00:11:53,100 --> 00:11:55,200
maintain the morale of your team. They're already in a very

241
00:11:55,200 --> 00:11:58,160
high stress environment, working long hours, dealing with

242
00:11:58,160 --> 00:12:01,280
incidents in the middle of the night, Sunday mornings. Morale's

243
00:12:01,280 --> 00:12:05,200
a big deal, right? So what I do once a month, you know, the

244
00:12:05,200 --> 00:12:08,140
first Friday of each month, I let my team go half day. We go

245
00:12:08,140 --> 00:12:11,120
to the local pub for team building. I mean, it's things

246
00:12:11,120 --> 00:12:13,960
like that that improve morale, that keep people happy, that

247
00:12:13,960 --> 00:12:15,560
keep a good team with you.

248
00:12:17,880 --> 00:12:20,100
Once you've figured all this out and you can keep a good team,

249
00:12:20,200 --> 00:12:22,160
that's when you can move on to the more technical sides of

250
00:12:22,160 --> 00:12:24,360
these things, how to do security operations just a little bit

251
00:12:24,360 --> 00:12:27,620
better without the latest tool that leverages artificial

252
00:12:27,620 --> 00:12:33,100
intelligence to take zero days in your environment. So be less

253
00:12:33,100 --> 00:12:37,080
busy with this one simple trick, right? Love it. It's my

254
00:12:37,080 --> 00:12:41,080
click bait, sorry. By shifting from a reactive to a proactive

255
00:12:41,080 --> 00:12:45,180
posture, right? And that's one of those buzz words that we love

256
00:12:45,180 --> 00:12:47,760
to see and hear that everyone uses, but no one can

257
00:12:47,760 --> 00:12:51,740
explain. So how do you start? How do you achieve this, right?

258
00:12:52,610 --> 00:12:56,540
Well, first thing we have to do is identify where are your actual

259
00:12:56,540 --> 00:13:00,200
threats? Like, where are you most vulnerable? Not where the

260
00:13:00,200 --> 00:13:04,020
latest headline or vendor tells you that you are. And here's

261
00:13:04,020 --> 00:13:07,560
some extreme examples. Fansmitter. Who remembers this

262
00:13:07,560 --> 00:13:12,000
one? Transmitting information across air graphs using the CPU

263
00:13:12,000 --> 00:13:16,140
fan RPM. Who's seen this in their environment? Raise your

264
00:13:16,140 --> 00:13:16,620
hand.

265
00:13:18,740 --> 00:13:21,600
Exactly. So why as an industry do we care about things like

266
00:13:21,600 --> 00:13:24,980
this? When this hits the news, we all go crazy, right? Everyone

267
00:13:24,980 --> 00:13:27,960
starts tweeting, oh, my God, they're exfilling data with CPU

268
00:13:27,960 --> 00:13:34,480
fans. In a laboratory at MIT. Not in the real world, okay? So

269
00:13:35,020 --> 00:13:38,360
we need to stop getting all crazy about the theoretical

270
00:13:38,360 --> 00:13:41,640
nonsense and focus on things that apply, like word macros.

271
00:13:43,600 --> 00:13:45,860
Now, here's an extreme on the other side of the spectrum,

272
00:13:45,980 --> 00:13:47,740
right? Is anyone familiar with the word macro? It's an

273
00:13:47,760 --> 00:13:51,400
IP address with APT squirrel cyber squirrel one. Now this is

274
00:13:51,400 --> 00:13:55,000
real. These numbers are real here. Somebody actually did, ran

275
00:13:55,000 --> 00:13:58,900
the numbers to find out how many major outages were caused by

276
00:13:58,900 --> 00:14:05,420
animals. 927 major information system outages caused by

277
00:14:05,420 --> 00:14:13,180
squirrels. So you've had zero incidents caused by APT or

278
00:14:13,180 --> 00:14:17,060
fansmitter, but we've had over 927 across the nation caused by

279
00:14:17,060 --> 00:14:17,740
squirrels. So this is real. So we're going to try to figure out a

280
00:14:17,740 --> 00:14:22,020
So should we invest in anti-fansmitter or anti-squirrel?

281
00:14:22,240 --> 00:14:26,000
Again, extreme example but just to show you the differences on

282
00:14:26,000 --> 00:14:28,700
both sides. You've got to be aware of where your actual

283
00:14:28,700 --> 00:14:34,920
threats are. So think critically and apply this, apply this

284
00:14:34,920 --> 00:14:38,980
mindset to all of the incidents that your team's handling. When

285
00:14:38,980 --> 00:14:41,240
you encounter an incident whether it's phishing, we'll

286
00:14:41,240 --> 00:14:43,640
call it phishing, how frequently do you see this type

287
00:14:43,640 --> 00:14:47,000
of incident? Does it have similarities to other recent

288
00:14:47,000 --> 00:14:50,060
incidents, right? This is how you're racking and stacking to

289
00:14:50,060 --> 00:14:52,760
prioritize the things that you're encountering. Now let's

290
00:14:52,760 --> 00:14:56,240
say you're just seeing a rash of word macros that are coming in,

291
00:14:56,880 --> 00:14:59,380
infected word macros that are dropping ransomware in your

292
00:14:59,380 --> 00:15:02,740
environment, okay? Well what type of in-house proactive

293
00:15:02,740 --> 00:15:07,780
controls can you put in place to stop that? Doesn't mean rush

294
00:15:07,780 --> 00:15:11,940
out and look for the latest anti-word macro product, there

295
00:15:11,940 --> 00:15:14,320
are actually things you can do in-house. So let's apply it to

296
00:15:14,320 --> 00:15:16,980
a real world scenario. So ransomware, right? You're

297
00:15:17,000 --> 00:15:20,060
looking for a real world example. So last six months at

298
00:15:20,060 --> 00:15:24,840
DPS, well, we ran some numbers. We saw over 140 ransomware

299
00:15:24,840 --> 00:15:29,040
campaigns and we've got a user base of about 10,000. So if one

300
00:15:29,040 --> 00:15:32,960
campaign went out to 400 people, on average, then you can do the

301
00:15:32,960 --> 00:15:35,780
math on how much exposure we have to this problem. So it's

302
00:15:35,780 --> 00:15:37,900
real. This is definitely something that we were concerned

303
00:15:37,900 --> 00:15:44,380
about. So we did a little bit of research, right? And I just

304
00:15:44,380 --> 00:15:46,980
want to say this threat research, I've never, it's not

305
00:15:47,000 --> 00:15:52,180
been shared with the public till now. So where was the

306
00:15:52,180 --> 00:15:57,640
ransomware coming from? It was coming from emails, right? Email

307
00:15:57,640 --> 00:16:03,200
attachments. Really advanced delivery mechanism and

308
00:16:04,240 --> 00:16:07,260
fortunately, we have some in-house controls that we could

309
00:16:07,260 --> 00:16:11,680
use to mitigate this threat. But what else do we want to know?

310
00:16:11,760 --> 00:16:14,040
What else do we know about the delivery? What else do we know

311
00:16:14,040 --> 00:16:16,980
about the threat? That if you're using ransomware, you

312
00:16:17,000 --> 00:16:20,380
know, if they're macro enabled, macro enabled documents, we can

313
00:16:20,380 --> 00:16:24,720
actually control macro execution on our workstations. So we stood

314
00:16:24,720 --> 00:16:29,360
up a CA and we required digitally signed macros now on

315
00:16:29,360 --> 00:16:34,160
our environment. So now we've, we've, we've stopped, we've,

316
00:16:34,160 --> 00:16:37,020
we've stopped malicious emails at our boundary, at our

317
00:16:37,020 --> 00:16:39,700
perimeter. And we've also mitigated the execution of

318
00:16:40,360 --> 00:16:44,700
macros on our workstations and it cost us nothing but time. So

319
00:16:44,700 --> 00:16:46,980
we've, knock on wood, 100% of our workstations are

320
00:16:47,000 --> 00:16:50,500
100% mitigated this threat without spending a dollar. If

321
00:16:50,500 --> 00:16:53,880
anyone's curious about how you can go about doing that, actually

322
00:16:53,880 --> 00:16:56,940
have a, a blog post. You can go and see step by step, even from

323
00:16:56,940 --> 00:17:00,560
selling your ex, your executives on this to actually implementing

324
00:17:00,560 --> 00:17:09,260
the plan and rolling it out. Yes. So we found that, that, that,

325
00:17:09,280 --> 00:17:12,980
that eliminated about 91% of the ransomware that we were

326
00:17:12,980 --> 00:17:15,620
encountering on our network. The remaining 9% were coming in the

327
00:17:15,620 --> 00:17:16,980
form of, you know, the ransomware that we were

328
00:17:17,000 --> 00:17:20,580
using, you know, Billy's resume dot PDF dot EXE dot JS dot WSF,

329
00:17:20,720 --> 00:17:23,620
et cetera. Right? So it's, it's, it's fooling the, the average

330
00:17:23,620 --> 00:17:26,060
user that's not paying really close attention to their file

331
00:17:26,060 --> 00:17:28,940
extensions to running executable code thinking that it's

332
00:17:28,940 --> 00:17:33,440
something else. So what we, we did was we looked at these rogue

333
00:17:33,440 --> 00:17:36,180
file extensions that were coming in and we noticed, hey, wait a

334
00:17:36,180 --> 00:17:40,700
minute, you know, Susie in HR does not need to run dot JS

335
00:17:40,700 --> 00:17:44,860
files on her workstation or dot VBS files. So how about we

336
00:17:44,860 --> 00:17:46,980
just change the default opener for all these weird files? So,

337
00:17:47,000 --> 00:17:50,380
weird file types to notepad so that instead of double clicking

338
00:17:50,380 --> 00:17:54,180
and running script, she double clicks and sees script and no

339
00:17:54,180 --> 00:17:57,300
harm is done. Another completely free solution to a

340
00:17:57,300 --> 00:18:01,680
very real problem. So, that was a good, that was a good win

341
00:18:01,680 --> 00:18:05,560
because with all that money I saved, I was able to hire

342
00:18:05,560 --> 00:18:09,340
another analyst. So let's look at one more that I'm sure

343
00:18:09,340 --> 00:18:11,300
everyone here has probably dealt with, right? Phishing

344
00:18:11,300 --> 00:18:14,940
campaigns. So this is, this is one that I think a lot of teams

345
00:18:15,600 --> 00:18:16,980
are, are losing, are losing a lot of their time and they're

346
00:18:16,980 --> 00:18:19,340
losing a lot of time over because we're, we're, we're

347
00:18:19,340 --> 00:18:22,220
still playing IP address and URL whack-a-mole, right? Quick,

348
00:18:22,300 --> 00:18:26,780
blacklist the URL that's never going to be used again. There's

349
00:18:26,780 --> 00:18:29,960
probably a better way to do this and you don't have to buy a

350
00:18:29,960 --> 00:18:34,100
special tool to do it. Any kind of IDS, IPS, including a free

351
00:18:34,100 --> 00:18:37,960
one like Snort or Suricata can do this next, this next thing I'm

352
00:18:37,960 --> 00:18:40,580
going to show you. So let's take, we got a phishing URL, it

353
00:18:40,580 --> 00:18:43,180
takes us to this really cool looking Facebook site that's

354
00:18:43,180 --> 00:18:46,960
obviously not really Facebook. How can we proactively stop a

355
00:18:46,980 --> 00:18:52,540
this with next, next, next gen anti-APT technology? Well, let's

356
00:18:52,540 --> 00:18:55,320
just look at the source code and that doesn't look good at all,

357
00:18:55,460 --> 00:18:59,160
I'm sorry. But if you can, if you can make this out, the

358
00:18:59,160 --> 00:19:04,780
source code of the page actually has an entry for the tool that

359
00:19:04,780 --> 00:19:10,700
was used to clone this website. So HTT, HTTAC website copier. I

360
00:19:10,700 --> 00:19:13,980
don't know if anyone analyzes phishing pages often, but this

361
00:19:13,980 --> 00:19:16,960
one is very frequently used. And it's, it's, it's, it's a

362
00:19:16,980 --> 00:19:19,840
great tool. And our red, our attackers are way too lazy to

363
00:19:19,840 --> 00:19:23,260
pull it out. So let's capitalize on that, right? I can write a

364
00:19:23,260 --> 00:19:26,740
really quick IDS signature now that's going to detect this

365
00:19:26,740 --> 00:19:32,260
string and now proactively stop not 100% of phishing sites, but

366
00:19:32,260 --> 00:19:34,960
a hell of a lot of them, and it costs me nothing. And it saves

367
00:19:34,960 --> 00:19:38,940
my team a ton of time. So again, it's finding ways to

368
00:19:38,940 --> 00:19:44,220
proactively prevent incidents, leveraging things you already

369
00:19:44,220 --> 00:19:44,560
have.

370
00:19:48,260 --> 00:19:51,600
Cool. So moving on, we're getting a little better at this

371
00:19:51,600 --> 00:19:54,480
security thing, right? Thinking proactively, what can we do to

372
00:19:54,480 --> 00:19:58,220
reduce our, our, our attack, our attack surface without spending a

373
00:19:58,220 --> 00:20:00,760
ton of money? But at the end of the day, guys, security does

374
00:20:00,760 --> 00:20:04,360
cost money. So how do we get money, right? You need executive

375
00:20:04,360 --> 00:20:07,660
support. But there's a right and a wrong way to go about getting

376
00:20:07,660 --> 00:20:10,320
it. And if you're not getting the executive support that you

377
00:20:10,320 --> 00:20:13,220
need, there's a chance that you might be selling it wrong. So

378
00:20:13,220 --> 00:20:14,540
how do you do it right?

379
00:20:16,980 --> 00:20:19,640
Instead of asking for it, convince them why you should

380
00:20:19,640 --> 00:20:25,500
have it and it will come. So example, stop using the fear

381
00:20:25,500 --> 00:20:28,520
tactics, guys, okay? Don't go into your CISO or your CIO's

382
00:20:28,520 --> 00:20:31,160
office, if you don't give me this much money, we're going to

383
00:20:31,160 --> 00:20:34,120
get ransomware. He's heard it before and he doesn't want to

384
00:20:34,120 --> 00:20:36,840
hear it anymore. Instead, what you need to do is you need to

385
00:20:36,840 --> 00:20:40,060
put the stats in his face on how much awesome you're already

386
00:20:40,060 --> 00:20:43,540
doing with the nothing that you have, right? That's not common

387
00:20:43,540 --> 00:20:46,880
actually. Most IT folks go in and say, well, I could do that.

388
00:20:46,980 --> 00:20:49,680
But I won't because I don't have budget or I don't have people.

389
00:20:49,920 --> 00:20:52,480
Okay, well, that guy is going to continue to not have budget or

390
00:20:52,480 --> 00:20:55,860
people. But if you just go ahead and kick ass with the little bit

391
00:20:55,860 --> 00:20:58,540
that you have, generate some stats and go and put that in

392
00:20:58,540 --> 00:21:01,120
front of the executives, all of a sudden, they're seeing value.

393
00:21:01,480 --> 00:21:05,520
Okay, I'll throw a little bit more money your way. But get

394
00:21:05,520 --> 00:21:10,640
away from the fear stuff because it's counterproductive. Also,

395
00:21:12,320 --> 00:21:16,960
showing your executives what you're doing and showing your

396
00:21:16,980 --> 00:21:20,580
users what you're doing. Publish a newsletter. Honestly, it

397
00:21:21,040 --> 00:21:23,140
sounds like a waste of time, but I'm going to tell you that's

398
00:21:23,140 --> 00:21:26,960
something we started doing that has paid dividends. Publishing a

399
00:21:26,960 --> 00:21:30,600
newsletter to our 10,000 users about what our team actually

400
00:21:30,600 --> 00:21:34,140
does to protect them, we get a flood of thank you emails every

401
00:21:34,140 --> 00:21:37,280
month after we put that newsletter out. And we honestly,

402
00:21:37,440 --> 00:21:39,440
we put it out just as like a trial, like let's see what

403
00:21:39,440 --> 00:21:43,180
happens. People actually give a damn, like seriously. So put that

404
00:21:43,180 --> 00:21:46,400
out because now you're winning friends. You're gaining

405
00:21:46,400 --> 00:21:46,820
influence.

406
00:21:46,980 --> 00:21:48,260
You're getting a lot of comments, which trickles up to

407
00:21:48,260 --> 00:21:50,820
executives, which trickles back down to you in the form of

408
00:21:50,820 --> 00:21:56,520
budget. And it turns out that your C-level folks do like

409
00:21:56,520 --> 00:22:04,920
honey. So, securing all the things without spending all the

410
00:22:04,920 --> 00:22:08,300
money, right? Because budget doesn't always come, but

411
00:22:08,300 --> 00:22:13,820
security must continue. So how can we do this on a very small

412
00:22:13,820 --> 00:22:16,960
budget? Well, first of all, we're going to have a lot of

413
00:22:16,960 --> 00:22:17,100
people say we're going to have to invest on this. So here's the

414
00:22:17,100 --> 00:22:18,340
little trick. We're going to talk about breaking bad habits,

415
00:22:18,800 --> 00:22:22,640
building your own tools, ditching bad solutions starting with the

416
00:22:22,640 --> 00:22:26,100
pew pew map in your sock. So here's my advice on how to do

417
00:22:26,100 --> 00:22:31,880
this. When it comes to the stuff that you already have,

418
00:22:31,980 --> 00:22:36,420
right? Stop suffering from contract renewals. Let's just

419
00:22:36,420 --> 00:22:39,740
renew this because we've had it for years. We just, we need it.

420
00:22:39,820 --> 00:22:42,440
Let's just renew it. But hold on a minute. You're spending a

421
00:22:46,960 --> 00:22:51,540
And I've got a few examples for you. But stay away from these statements here. Well, we've always

422
00:22:51,540 --> 00:22:57,000
used it, so just renew it, right? Or why have we been paying for X when we're only getting Y?

423
00:22:57,300 --> 00:23:02,240
And then the big brand romances, right? If you're in love with big brand and that's why you're

424
00:23:02,240 --> 00:23:11,320
hanging on to it, then you're living in a silo. When you're assessing a problem that you're

425
00:23:11,320 --> 00:23:16,540
trying to buy a solution for, absolutely ask yourself the question, like, is this actually

426
00:23:16,540 --> 00:23:21,040
a problem that exists or is this just something that you've manufactured that someone else has

427
00:23:21,040 --> 00:23:28,080
manufactured? You know, my CISO comes to me all the time, hey, we should buy this new anti-APT.

428
00:23:28,160 --> 00:23:32,640
And I say, okay, but we have these other four tools already in the environment that do what

429
00:23:32,640 --> 00:23:38,000
you're asking. Do we really need to buy this? And then ask yourself, are we even using the

430
00:23:38,000 --> 00:23:42,400
tools that we already have? Because that is a huge issue right now. How many tools are in

431
00:23:42,400 --> 00:23:46,520
your environment and how many people on your team know how to use all of those?

432
00:23:46,540 --> 00:23:53,560
That answer is always a frightening one, right? So instead of buying more stuff, use the stuff you

433
00:23:53,560 --> 00:24:01,600
already have. But when you do need to buy something, do your research. Don't talk to vendors.

434
00:24:02,860 --> 00:24:08,380
Gartner, it's a love-hate thing, but it's a better place to start. You know, NSS labs, read

435
00:24:08,380 --> 00:24:12,640
the reports, find out how these tools actually perform in real-world environments. Resist the

436
00:24:12,640 --> 00:24:16,520
marketing. And then always demand a hands-on demo in your environment, because you're going to be

437
00:24:16,540 --> 00:24:19,580
getting paid for it. Because it's just like clothing. If you don't absolutely love it the first

438
00:24:19,580 --> 00:24:27,560
time you try it on, it's not going to get any better after that. Also, buy what fits in your

439
00:24:27,560 --> 00:24:33,180
environment. Nothing sucks more than buying a device or a component or software and then

440
00:24:33,180 --> 00:24:40,060
finding out that it doesn't integrate with anything, but that manufactures other stuff. Big

441
00:24:40,060 --> 00:24:44,180
firewall company sells a threat Intel platform that, guess what, only integrates with big

442
00:24:44,180 --> 00:24:46,520
firewall company's firewall. Bad data. Bad data. Bad data. Bad data. Bad data. Bad data. Bad data.

443
00:24:46,540 --> 00:24:56,360
Bad move. That's how they're trying to trap you into their ecosystem. Most importantly, why buy

444
00:24:56,360 --> 00:25:03,840
what might be free? Ask yourself, is there an open source tool that can solve this problem? The

445
00:25:03,840 --> 00:25:12,340
answer is probably yes. I'm going to ask you guys to consider something, right? Why is it that

446
00:25:12,340 --> 00:25:16,520
security product, why, costs millions of dollars, but the security product, why, costs millions of

447
00:25:16,540 --> 00:25:20,940
dollars? The social engineering tool kit that Boris just used to break into your company is

448
00:25:20,940 --> 00:25:32,540
free. Slippery slope, right? What if I told you there was a free tool that could block Tor

449
00:25:32,540 --> 00:25:36,960
exit notes, blacklist phishing URLs, automate analysis and incident response, pull hundreds of

450
00:25:36,960 --> 00:25:41,320
open source threat feeds, deceive your adversaries and warn defenders in the early stages of

451
00:25:41,320 --> 00:25:46,340
attack and almost anything else you can imagine. Has anyone used this tool? You probably

452
00:25:46,540 --> 00:25:54,160
have. Python. Come see us in the honey pot project where we're actually doing a lot of those

453
00:25:54,160 --> 00:26:01,900
things with Python. Constantly assess the tools that you already have. For every noteworthy

454
00:26:01,900 --> 00:26:05,520
security incident that your team is handling, you need to be holding your solutions

455
00:26:05,520 --> 00:26:12,380
accountable. Are the indicators of this attack new or old? Because if they're a year old but your

456
00:26:12,380 --> 00:26:16,520
sensors did not detect them, you need to be making a phone call to attack. Now, let me tell you a bit about this. The first thing when you

457
00:26:16,520 --> 00:26:18,940
Why the hell did this get through my million dollar IPS

458
00:26:18,940 --> 00:26:22,520
when I found open source intel on Twitter from a year ago for

459
00:26:22,520 --> 00:26:25,620
this attack. That's embarrassing and that shouldn't be, you

460
00:26:25,620 --> 00:26:27,400
know, that's not something vendors should be getting away

461
00:26:27,400 --> 00:26:31,120
with. So ask yourself what systems had visibility over this

462
00:26:31,120 --> 00:26:33,520
threat. If it was an e-mail born threat, obviously your e-mail

463
00:26:33,520 --> 00:26:36,040
security appliances had visibility. Maybe your IPS had

464
00:26:36,040 --> 00:26:38,340
visibility and then obviously endpoint agent had visibility.

465
00:26:38,660 --> 00:26:40,820
So those are three solutions that you should be holding

466
00:26:40,820 --> 00:26:45,500
accountable to why did this incident happen. And hold your

467
00:26:45,500 --> 00:26:51,000
vendors accountable for it. So I'll give you guys some really

468
00:26:51,000 --> 00:26:54,660
quick examples, I'm going to glaze over these, on how we've

469
00:26:54,660 --> 00:26:56,760
walked the walk at the Department of Public Safety in

470
00:26:56,760 --> 00:27:02,160
Texas with said vendors. So scenario one, big brand e-mail

471
00:27:02,160 --> 00:27:04,660
security appliance, right? Big brand usually means big

472
00:27:04,660 --> 00:27:07,660
marketing. We were paying $234,000 annually for these

473
00:27:07,660 --> 00:27:11,120
systems. Terribly difficult to use, configure. Stability sucks,

474
00:27:11,300 --> 00:27:14,260
they don't cluster. Zero bells and whistles. I mean it was just

475
00:27:14,260 --> 00:27:15,480
basic e-mail security. I mean it was just basic e-mail

476
00:27:15,500 --> 00:27:22,100
security stuff, right? $234,000 a year. I replaced them with a

477
00:27:22,100 --> 00:27:26,040
solution, also a big brand, but very little marketing. And that

478
00:27:26,040 --> 00:27:30,400
saved me about $200,000 a year. Way easier to configure. Oh, and

479
00:27:30,400 --> 00:27:33,000
it came with attachment sandboxing. Pretty cool feature

480
00:27:33,000 --> 00:27:37,400
for e-mail. And actually our in-house testing showed better

481
00:27:37,400 --> 00:27:42,120
security performance. Win-win. Scenario two, perimeter UTM next

482
00:27:42,120 --> 00:27:44,520
gen firewall. Now this is a big brand that's actually a

483
00:27:44,520 --> 00:27:45,480
marketing company. This is a big brand that's actually a

484
00:27:45,500 --> 00:27:52,560
sales firewalls. $750,000 buy in. $274,000 a year with a 4%

485
00:27:52,560 --> 00:27:55,660
increase annually. Terrible support. Absolutely terrible

486
00:27:55,660 --> 00:27:59,580
support. Matter of fact, they once held support for ransom

487
00:27:59,580 --> 00:28:02,560
because I was a month out from my renewal and they said we'll

488
00:28:02,560 --> 00:28:06,500
help you as soon as you renew. False negatives on threats with

489
00:28:06,500 --> 00:28:09,480
year old OSINT. Hey, I just used that example, right? And

490
00:28:09,480 --> 00:28:13,040
then usually the response from support on said incident is, oh,

491
00:28:13,200 --> 00:28:15,480
good catch. That's going to be in our next signature. That's going

492
00:28:15,480 --> 00:28:18,280
to be a signature update. I'm glad that I pay a quarter of a

493
00:28:18,280 --> 00:28:21,660
million a year for these. So migrate to almost as big brand

494
00:28:21,660 --> 00:28:25,800
with no marketing. $36,000 buy in, $40,000 annually. Magic,

495
00:28:25,840 --> 00:28:28,820
awesome greatness. We're so happy. I'm saving a fortune,

496
00:28:28,960 --> 00:28:31,340
guys. What does that equate to? That equates to more SOC

497
00:28:31,340 --> 00:28:33,820
analysts because if you recall from the beginning, people,

498
00:28:34,260 --> 00:28:41,400
that's how you do this right. So then let's get to the fun

499
00:28:41,400 --> 00:28:45,460
part. Where's all this free stuff, right? We're going to do

500
00:28:45,460 --> 00:28:47,780
this. You're telling me to use free stuff. Where is it? It's on

501
00:28:47,780 --> 00:28:53,580
pirate bay. I'm just kidding. But try GitHub, okay? But there's a

502
00:28:53,580 --> 00:28:56,520
few of you out here. You don't have to identify yourself but

503
00:28:56,520 --> 00:28:59,200
you're saying to yourself open source has no place in an

504
00:28:59,200 --> 00:29:02,720
enterprise environment. Well, I've yet to hear an argument

505
00:29:02,720 --> 00:29:07,100
that actually sticks because I have a single DevOps engineer on

506
00:29:07,100 --> 00:29:10,780
my team that's able to maintain about 14 open source projects

507
00:29:10,780 --> 00:29:14,680
that brings a ton of value to my team but I'd be glad to have

508
00:29:14,680 --> 00:29:18,000
that conversation with anyone that feels strongly. I will say

509
00:29:18,000 --> 00:29:21,140
though, if you're totally against open source, when's the

510
00:29:21,140 --> 00:29:23,220
last time you looked under the hood of the commercial product

511
00:29:23,220 --> 00:29:27,040
that you have? What do you think it's running on? Open source

512
00:29:27,040 --> 00:29:29,980
stuff. So, you know, at the end of the day, yes, there's a lot

513
00:29:29,980 --> 00:29:32,400
to be said about the support number you can call when things

514
00:29:32,400 --> 00:29:35,760
break but when you're doing security on a budget, you're not

515
00:29:35,760 --> 00:29:38,460
going to be able to avoid using open source, nor should you.

516
00:29:38,520 --> 00:29:44,660
It's a fantastic resource to use. I'm going to go back to

517
00:29:44,680 --> 00:29:47,540
this. This is a good one, right? You would not get clone a sim,

518
00:29:47,820 --> 00:29:51,160
would you? Right? Why the hell not? Because, guys, think about

519
00:29:51,160 --> 00:29:54,720
this. In the context of InfoSec, right? Hacking was built by

520
00:29:54,720 --> 00:29:58,540
communities of smart, passionate people exchanging free and open

521
00:29:58,540 --> 00:30:01,900
information. And the good news is that still exists today. You

522
00:30:01,900 --> 00:30:04,540
just have to tap into it. So here's an interesting thought

523
00:30:04,540 --> 00:30:09,380
for you, right? If you think back to the Cold War, right? One

524
00:30:09,380 --> 00:30:12,440
school of thought about why Russia lost the Cold War is,

525
00:30:12,600 --> 00:30:14,660
well, we outspent them, right? You know, they lost the Cold War.

526
00:30:14,680 --> 00:30:18,280
They basically, they went broke. Well, consider this. What if

527
00:30:18,280 --> 00:30:22,080
during the Cold War, our weapons cost money but Russia's weapons

528
00:30:22,080 --> 00:30:25,400
were free? Do you think it would have ended the same way?

529
00:30:26,680 --> 00:30:29,680
Think about how that applies to cyber security today, right?

530
00:30:29,840 --> 00:30:32,880
We're spending millions of dollars on defense. Our

531
00:30:32,880 --> 00:30:36,700
attackers don't have to spend a dime. We're not going to

532
00:30:36,700 --> 00:30:41,320
outspend them. So it's just another way of looking at

533
00:30:41,320 --> 00:30:44,160
leveraging open source tools that you're evening the playing

534
00:30:44,160 --> 00:30:44,660
field a little bit.

535
00:30:44,680 --> 00:30:49,200
So there are so many great open source projects, guys, that I

536
00:30:49,200 --> 00:30:52,080
could have spent this entire talk just listing them off. So I

537
00:30:52,080 --> 00:30:55,020
won't. But I will cover a few. And then I will publish these

538
00:30:55,020 --> 00:30:58,200
slides later on. But one that's certainly noteworthy, that

539
00:30:58,200 --> 00:31:01,160
everyone in this room, if you work in a SOC, if you manage a

540
00:31:01,160 --> 00:31:04,080
team of security analysts, you should check out this one. The

541
00:31:04,080 --> 00:31:07,200
Hive is an incident response collaboration platform. It is

542
00:31:07,200 --> 00:31:12,920
phenomenal. It costs $3,000. That's free with an F. And it

543
00:31:12,920 --> 00:31:14,660
is phenomenal. And it will, I'm not going to go into too much

544
00:31:14,660 --> 00:31:16,320
detail, but it will allow your analysts to collaborate on

545
00:31:16,320 --> 00:31:19,040
incidents, automate analysis, track observables, you know, all

546
00:31:19,040 --> 00:31:22,700
the magic stuff that a $140,000 a year platform that I could

547
00:31:22,700 --> 00:31:27,900
name but won't does. But it does it for free. And here's

548
00:31:27,900 --> 00:31:30,140
just a little screenshot of the Hive. It's actually been updated

549
00:31:30,140 --> 00:31:32,960
a few times, so it's even cooler and better than this. And

550
00:31:32,960 --> 00:31:35,440
by the way, if anyone does use the Hive or is interested in

551
00:31:35,440 --> 00:31:37,720
Hive stickers, they actually shipped me some to hand out

552
00:31:37,720 --> 00:31:41,900
after this talk. So I have some swag from these guys. The Hive

553
00:31:41,900 --> 00:31:44,580
is also highly integratable. Like I said before, how does a tool,

554
00:31:44,660 --> 00:31:46,420
you know, fit into your environment? Well, this one does

555
00:31:46,420 --> 00:31:50,460
very well. Here's some other things, right? Sim. So if anyone

556
00:31:50,460 --> 00:31:52,840
here is familiar with AlienVault, AlienVault has a

557
00:31:52,840 --> 00:31:57,520
freemium sim. It is $300,000. And it does all of the things

558
00:31:57,520 --> 00:32:02,120
that your $2 million sim does. Asset discovery, vulnerability

559
00:32:02,120 --> 00:32:05,100
scanning, hits, nids, behavior monitoring, and it integrates

560
00:32:05,100 --> 00:32:07,520
with a free threat Intel platform. Pretty cool stuff,

561
00:32:07,660 --> 00:32:09,880
right? If you're doing security on a budget, that's a lot of

562
00:32:09,880 --> 00:32:14,640
capability for nothing. Log aggregation, right? We all know

563
00:32:14,660 --> 00:32:17,660
Splunk. Splunk is awesome, but Splunk is not cheap. So if

564
00:32:17,660 --> 00:32:21,440
you're on a budget, GreyLog, Elk Stack, which GreyLog actually

565
00:32:21,440 --> 00:32:24,340
runs on the Elk Stack. Grafana, there are free tools that can

566
00:32:24,340 --> 00:32:28,300
do all of those things. For HIDS, Antivirus, OSEC, Clam AV,

567
00:32:28,480 --> 00:32:31,380
these are phenomenal tools that guess what? A ton of those

568
00:32:31,380 --> 00:32:36,020
enterprise grade, super expensive platforms run these tools

569
00:32:36,020 --> 00:32:40,040
underneath the hood. Vulnerability scanning, OpenVAS,

570
00:32:40,100 --> 00:32:42,720
NIC2, WAPT, the list goes on. There's so many of these.

571
00:32:43,320 --> 00:32:47,120
Intrusion detection, Suricata, and Snort. They're very similar

572
00:32:47,120 --> 00:32:51,240
one is a fork of the other. Firewall, PFSense, Indien. Again,

573
00:32:51,300 --> 00:32:54,020
I'm not going to say that you're going to want to replace all of

574
00:32:54,020 --> 00:32:56,440
your systems with these tools. I'm just saying that in the

575
00:32:56,440 --> 00:32:59,220
absence of the budget to buy the enterprise grade stuff, these

576
00:32:59,220 --> 00:33:05,100
things will get the job done. IOC sharing, right? AlienVault

577
00:33:05,100 --> 00:33:09,460
OTX is a personal favorite, but Anomaly Stacks, there's plenty of

578
00:33:09,460 --> 00:33:12,580
these things. If you're into the really fun stuff, Honeypot.

579
00:33:12,720 --> 00:33:16,040
That's right. Check out Modern HoneyNet, Cowrie Kippo, RDPi for

580
00:33:16,040 --> 00:33:19,280
remote desktop stuff. Tons more in that area, threat research.

581
00:33:20,640 --> 00:33:23,700
So, again, I know this is a wall of information. I'm kind of

582
00:33:23,700 --> 00:33:26,340
blasting through it really quickly, but I will publish these

583
00:33:26,340 --> 00:33:29,540
slides and I'll also, if anyone's interested in open

584
00:33:29,540 --> 00:33:32,420
source tools in any other area, let me know. I've got a long list

585
00:33:32,420 --> 00:33:37,700
of them. Forensics, if you're into that. Google's rapid

586
00:33:37,700 --> 00:33:41,180
response platform, live collection, magnet ram capture.

587
00:33:41,320 --> 00:33:42,700
These are all free. Every one of these tools is free. You can

588
00:33:42,720 --> 00:33:45,960
download them. If you're paying a ton of money for some sort of

589
00:33:45,960 --> 00:33:51,780
CBT to train your user base, PhishMe actually publishes free

590
00:33:51,780 --> 00:33:55,760
CBTs that you can load right into your LMS and train your

591
00:33:55,760 --> 00:33:59,540
entire company with. That would probably save a lot of people a

592
00:33:59,540 --> 00:34:03,660
lot of money. I probably don't need to tell anyone in this room

593
00:34:03,660 --> 00:34:08,280
about Cali or Metasploit or SCTK. And that's all I got for

594
00:34:08,280 --> 00:34:11,760
you guys. So if you have any questions, if you want to share

595
00:34:11,760 --> 00:34:14,140
intel, feedback, any of that good stuff, tell me that the talk

596
00:34:14,140 --> 00:34:17,940
was terrible. Please, you can meet with me afterwards or find

597
00:34:17,940 --> 00:34:21,080
me on Twitter and I'd love to hear from you. Like I said, come

598
00:34:21,080 --> 00:34:23,040
see us at the Honeypot project. We're doing some really cool

599
00:34:23,040 --> 00:34:25,600
stuff over there. And also if you're interested in building

600
00:34:25,600 --> 00:34:29,040
your own incident response training simulations, I have

601
00:34:29,040 --> 00:34:31,680
another talk at this time tomorrow about how to do that.

602
00:34:31,900 --> 00:34:39,880
Way more technical. So thank you guys. We're going to spend what?

603
00:34:41,760 --> 00:34:43,480
10 minutes for questions. We've got 10 minutes for questions.

604
00:34:44,040 --> 00:34:46,660
All right. You have a question. I'm sure there are plenty of

605
00:34:46,660 --> 00:35:00,000
questions. Please. Sir? So he's asking about what sort of

606
00:35:00,000 --> 00:35:02,440
metrics do we report up to executives. So that's going to

607
00:35:02,440 --> 00:35:04,560
vary based on obviously what you've got in your environment

608
00:35:04,560 --> 00:35:07,980
now. So if you already have some sort of IDS component or

609
00:35:07,980 --> 00:35:10,960
vulnerability scanning, you know, e-mail security, something

610
00:35:10,960 --> 00:35:11,740
that's producing a lot of data, you're going to be able to get

611
00:35:11,760 --> 00:35:14,280
logs that you can generate reports from. That's an

612
00:35:14,280 --> 00:35:19,920
excellent place to start. Don't fall into the trap of, you know,

613
00:35:19,920 --> 00:35:23,920
hey, our firewall stopped 400,000 threats today because

614
00:35:23,920 --> 00:35:26,640
eventually they're going to ask you what that's based on and

615
00:35:26,640 --> 00:35:28,280
then they're going to find out that that's a pretty empty

616
00:35:28,280 --> 00:35:32,240
metric. But if your team, like my team actually, we write

617
00:35:32,240 --> 00:35:35,720
custom IDS signatures every day. We'll probably average anywhere

618
00:35:35,720 --> 00:35:39,840
between 5 to 15 custom IDS signatures a day. That's a real

619
00:35:39,840 --> 00:35:41,740
metric. I report that up to my executives and they're like,

620
00:35:41,740 --> 00:35:41,880
hey, that's a metric. And I report that up to my executives

621
00:35:41,880 --> 00:35:45,460
because that's stuff that says, hey, look, the team that you pay

622
00:35:45,460 --> 00:35:49,180
for, that I hired, that runs this SOC is producing high

623
00:35:49,180 --> 00:35:51,280
quality things and we're sharing them with sister

624
00:35:51,280 --> 00:35:53,900
agencies. That's a metric that hits home with my executives.

625
00:35:53,980 --> 00:35:56,560
They're like, hold on a second. We're making this stuff? Yes,

626
00:35:56,560 --> 00:35:59,860
you bet. So metrics like that have a lot of weight. But, you

627
00:35:59,860 --> 00:36:03,020
know, until you get there, you know, do your best to report on,

628
00:36:03,080 --> 00:36:05,880
you know, hey, because we recently fine-tuned our e-mail

629
00:36:05,880 --> 00:36:09,500
security appliance, we had an increase of threats stopped. We

630
00:36:09,500 --> 00:36:11,620
increased by 30 percent. You know, things like that. That's

631
00:36:11,620 --> 00:36:14,240
what your executives want to hear about is what are you doing

632
00:36:14,240 --> 00:36:18,380
with the stuff you already have? Then we'll talk about giving you

633
00:36:18,380 --> 00:36:20,740
more. They want to see, you know, executives, they want to

634
00:36:20,740 --> 00:36:23,820
see value before they invest. It's not the other way around,

635
00:36:23,960 --> 00:36:26,720
which we want it to be, right? No, invest. Then I'll show you

636
00:36:26,720 --> 00:36:29,160
value. No, it's got to happen the other way, which sucks for us

637
00:36:29,160 --> 00:36:33,260
because you got to do a lot with a little to get there. Anybody

638
00:36:33,260 --> 00:36:35,500
else? Sir?

639
00:36:35,880 --> 00:36:39,260
One of the most common kind of pushbacks I get on open source

640
00:36:39,260 --> 00:36:41,380
software is the support aspect. You bet.

641
00:36:44,140 --> 00:36:47,300
I love it. So he said one of the arguments about leveraging open

642
00:36:47,300 --> 00:36:49,280
source in the enterprise environment is the support,

643
00:36:49,440 --> 00:36:53,140
right? There's no 1-800 number to call if this thing breaks. But

644
00:36:53,140 --> 00:36:56,040
here's another cool thing to think about. So the Hive, that's

645
00:36:56,040 --> 00:37:00,020
one of my favorite projects. So when we started using the Hive,

646
00:37:01,180 --> 00:37:05,340
one of my analysts, she found a bug. And we put in an issue in

647
00:37:05,340 --> 00:37:09,500
GitHub and it was fixed in 48 hours. Do you know any commercial

648
00:37:09,500 --> 00:37:11,600
vendors that will fix a bug and they're going to fix it in 48

649
00:37:11,620 --> 00:37:19,240
hours? No, because you are just one of millions that are sending

650
00:37:19,240 --> 00:37:23,240
them money. Yes, we'll put that in our queue, thank you. Open

651
00:37:23,240 --> 00:37:27,860
source projects are open source because anyone can contribute.

652
00:37:28,200 --> 00:37:31,200
If you don't like the bug, you can fix it. You know what I

653
00:37:31,200 --> 00:37:34,500
mean? So yes, there is a difference between having a 1-800

654
00:37:34,500 --> 00:37:37,500
number to call at 4 o'clock in the morning on Sunday. That is

655
00:37:37,500 --> 00:37:41,600
sometimes a saving grace. But I will say that open source can

656
00:37:41,600 --> 00:37:44,640
compete. Because if it's open source, that means there's going

657
00:37:44,640 --> 00:37:47,140
to be tons of, in some cases, there's tons of documentation

658
00:37:47,140 --> 00:37:50,760
publicly available and there's a repository where you can submit

659
00:37:50,760 --> 00:37:56,780
issues or submit a patch, submit a bug fix yourself. So, sir?

660
00:38:04,480 --> 00:38:07,920
Okay, great question, great question. So very real problem

661
00:38:07,920 --> 00:38:11,580
too because he got sick a couple of weeks ago and we were

662
00:38:11,600 --> 00:38:14,360
feeling the pain. So his question was, so I mentioned I

663
00:38:14,360 --> 00:38:16,760
have a single DevOps engineer maintaining 14 open source

664
00:38:16,760 --> 00:38:18,900
platforms and he does a phenomenal job. What happens

665
00:38:18,900 --> 00:38:21,760
when he is not here? If he gets hit by a bus, am I in trouble?

666
00:38:22,080 --> 00:38:25,680
Yes. So luckily, if you go back to one of my recommendations

667
00:38:25,680 --> 00:38:29,520
about documentation, right? So I do not allow anyone on my team

668
00:38:29,520 --> 00:38:34,420
to maintain all of their TTPs in their head. If you have things

669
00:38:34,420 --> 00:38:37,920
that you do on a daily basis, routine, maintenance items,

670
00:38:38,520 --> 00:38:41,580
incident response items, that needs to get documented. So if

671
00:38:41,600 --> 00:38:45,180
you are not here, anyone can pop open your procedure and do

672
00:38:45,180 --> 00:38:50,020
what you do in your absence. So that guy, while he is really good

673
00:38:50,020 --> 00:38:52,340
at what he does, he has documented all the things that

674
00:38:52,340 --> 00:38:56,020
he does. All his systems, his diagrams, all that are publicly

675
00:38:56,020 --> 00:38:59,120
accessible, publicly, but by my whole team. So if he's not here

676
00:38:59,120 --> 00:39:02,420
and we need to restart a system or we need to go in and change

677
00:39:02,420 --> 00:39:04,800
something, we've got the information we need to do that.

678
00:39:04,940 --> 00:39:07,820
But the real solution to that problem is not to have a single

679
00:39:07,820 --> 00:39:10,340
point of failure also, right? So if you only have one highly

680
00:39:10,340 --> 00:39:11,580
specialized person on a team, you're not going to be able to

681
00:39:11,600 --> 00:39:14,360
team, then you've got a choke point. Ideally, you'd have two.

682
00:39:14,500 --> 00:39:18,400
But I, like the talk covers, I'm doing security on a budget. So

683
00:39:18,400 --> 00:39:21,340
I've got to make do with a single engineer. So I compensate

684
00:39:21,340 --> 00:39:29,620
with those procedures for continuity purposes. How much

685
00:39:29,620 --> 00:39:35,380
time spent documenting? How much time spent documenting? I

686
00:39:35,380 --> 00:39:38,120
would, this is going to be a stab in the dark. I'd say

687
00:39:38,120 --> 00:39:41,300
probably about, you know, 10 to 15 percent of their time,

688
00:39:41,300 --> 00:39:44,680
because I don't say, hey, stop work and go write documents. What

689
00:39:44,680 --> 00:39:48,240
I say is, while you're working, keep your documents up to date.

690
00:39:48,560 --> 00:39:52,420
Because, you know, the best way, the best time to be documenting

691
00:39:52,420 --> 00:39:56,000
something is while you're doing it, right? So maybe you're just

692
00:39:56,000 --> 00:39:58,740
adding, you know, a few extra minutes to the task, because

693
00:39:58,740 --> 00:40:00,940
while you're doing it, you're jotting down notes over here

694
00:40:00,940 --> 00:40:03,700
about what you're doing. So I wouldn't imagine it's a ton of

695
00:40:03,700 --> 00:40:08,120
time. Yeah, no, but the return on investment is significant,

696
00:40:08,240 --> 00:40:11,280
though. It's significant. Sir? I'm sorry. I'm sorry. I'm sorry.

697
00:40:21,700 --> 00:40:26,700
He's asking, in my portfolio of open source solutions, is there

698
00:40:26,700 --> 00:40:31,180
an area where a commercial product would be recommended? So

699
00:40:31,640 --> 00:40:35,140
yes, I would say there's always going to be areas that, you

700
00:40:35,140 --> 00:40:38,940
know, it's going to be better to put a commercial tool. And not

701
00:40:38,940 --> 00:40:41,280
necessarily because it's better. It's a better tool to put a

702
00:40:41,300 --> 00:40:44,000
better tool, or, you know, it's faster, or more next gen, or

703
00:40:44,000 --> 00:40:48,900
whatever. But for instance, you know, for an agency my size, like

704
00:40:48,900 --> 00:40:51,360
I said, I've got over 10,000 users, and we're spread across

705
00:40:51,360 --> 00:40:55,480
460 remote locations. So I have a very big network that's

706
00:40:55,480 --> 00:40:59,240
literally the size of Texas. So what it boils down to is I need

707
00:40:59,240 --> 00:41:03,160
a very reliable infrastructure. So if I'm looking at, you know,

708
00:41:03,180 --> 00:41:06,000
perimeter firewalls, IDS, IPS, and things like that, I'm

709
00:41:06,000 --> 00:41:09,120
dealing with, you know, 40 gig throughput in the core. I'm

710
00:41:09,120 --> 00:41:11,280
dealing with 10 gig throughput at the perimeter. I'm dealing with

711
00:41:11,280 --> 00:41:13,920
that. I need to have things that can handle that sort of traffic

712
00:41:13,920 --> 00:41:16,760
without issue, without hiccup. And then if there is an issue or

713
00:41:16,760 --> 00:41:19,780
hiccup, I need to have a vendor that I can be hanging from the

714
00:41:19,780 --> 00:41:23,000
ceiling until he gets it right. Because it's just too critical.

715
00:41:23,140 --> 00:41:25,440
It's too critical for our infrastructure, right? Would I

716
00:41:25,440 --> 00:41:27,900
be happy to put an open source tool on that perimeter?

717
00:41:28,080 --> 00:41:32,020
Absolutely. But at 4 o'clock in the morning on a Sunday, I'd

718
00:41:32,020 --> 00:41:36,400
much rather call brand X to come in and fix this. So yes, there's

719
00:41:36,400 --> 00:41:38,840
always a time and place for that commercial grade product.

720
00:41:44,920 --> 00:41:46,880
Credential management. Are you talking about, say, for my

721
00:41:46,880 --> 00:41:50,340
security team or for my entire agency? For the security team,

722
00:41:50,400 --> 00:41:53,920
we leverage LastPass. Phenomenal tool. They leverage perfect

723
00:41:53,920 --> 00:41:56,100
forward secrecy, all the encryption's done, client side.

724
00:41:56,320 --> 00:41:58,900
So you're not sharing your secrets with LastPass. They're

725
00:41:58,900 --> 00:42:04,140
simply holding them for you. We had started off on a local, like,

726
00:42:04,140 --> 00:42:07,760
key pass type thing where it's reading, writing from a flat

727
00:42:07,760 --> 00:42:11,020
file sitting on a network share. It's okay from a security

728
00:42:11,020 --> 00:42:13,280
perspective. It's terrible from a collaboration perspective

729
00:42:13,280 --> 00:42:15,780
because what happens when two people are writing to it at the

730
00:42:15,780 --> 00:42:19,380
same time? And so the best tool that I found, and there are

731
00:42:19,380 --> 00:42:21,580
others, don't get me wrong. There are others. Dashlane's one

732
00:42:21,580 --> 00:42:23,560
of them. But the best tool that I found for the job is

733
00:42:23,560 --> 00:42:26,900
LastPass. They do a hell of a job, especially for teams. So

734
00:42:26,900 --> 00:42:30,040
that teams can share highly sensitive information without

735
00:42:30,040 --> 00:42:32,960
trusting your stuff to a third party. It's pretty good stuff.

736
00:42:34,400 --> 00:42:34,760
Yes?

737
00:42:36,160 --> 00:42:36,520
.

738
00:42:36,520 --> 00:42:36,920
.

739
00:42:36,920 --> 00:42:37,040
.

740
00:42:37,040 --> 00:42:37,140
.

741
00:42:37,140 --> 00:42:37,240
.

742
00:42:37,240 --> 00:42:37,520
.

743
00:42:37,520 --> 00:42:37,600
.

744
00:42:42,560 --> 00:42:44,820
Absolutely. So, yeah, you bet. So my

745
00:42:44,820 --> 00:42:46,800
DevOps engineer is not only maintaining the applications

746
00:42:46,800 --> 00:42:50,540
that we use internally, but he's also maintaining the underlying

747
00:42:50,540 --> 00:42:53,520
infrastructure. So, yes, the ESXI, the, you know, route

748
00:42:53,520 --> 00:42:56,180
switch, everything. Everything in that environment is under

749
00:42:56,180 --> 00:42:59,320
his. Now, luckily, though, being a cybersecurity team, we've got

750
00:42:59,320 --> 00:43:02,440
in-house network engineers. We've got in-house, you know,

751
00:43:03,540 --> 00:43:06,480
sysadmins or previous, former sysadmins. And so that's one of

752
00:43:06,480 --> 00:43:08,460
the cool things about a security team that you guys absolutely

753
00:43:08,460 --> 00:43:11,000
need to tap into is that almost all security teams are going to

754
00:43:11,000 --> 00:43:13,480
have security people who are previously something else in IT.

755
00:43:13,860 --> 00:43:16,080
They came from sysadmin. They came from network engineering.

756
00:43:16,340 --> 00:43:19,060
You know, they came from development. So leverage those

757
00:43:19,060 --> 00:43:21,100
tools. Don't just look at your people and be like, oh, you

758
00:43:21,100 --> 00:43:23,140
used to be a developer. That's cool. Well, now you're this and

759
00:43:23,140 --> 00:43:25,960
you're just this. So do that, you know. No, tap into that.

760
00:43:26,040 --> 00:43:28,540
Hey, you used to be a developer, right? Can you help us automate

761
00:43:28,540 --> 00:43:31,940
this thing that takes us all day long to do? Because that's what

762
00:43:31,940 --> 00:43:34,440
you did. You're a developer. You're still a developer. So

763
00:43:34,860 --> 00:43:37,340
leverage those tools. Leverage those experiences.

764
00:43:38,680 --> 00:43:39,040
.

765
00:43:40,620 --> 00:43:40,980
.

766
00:43:44,800 --> 00:43:48,040
You bet. So he's asking about that newsletter and what sort of

767
00:43:48,040 --> 00:43:51,740
information garners the most attention and appreciation from

768
00:43:51,740 --> 00:43:56,120
our users. So what we found is obviously so our security team,

769
00:43:56,200 --> 00:43:58,820
we see a wide, you know, breadth of things, you know, all kinds

770
00:43:58,820 --> 00:44:02,020
of things. Things that may not really impact the everyday user,

771
00:44:02,120 --> 00:44:04,860
right? Like really unique threats that no one's going to

772
00:44:04,860 --> 00:44:08,040
see or notice. So obviously you want to write about things that

773
00:44:08,040 --> 00:44:10,980
are applicable to everyone, you know. So write about things that

774
00:44:11,000 --> 00:44:11,980
are not applicable to everyone. Write about the things like the

775
00:44:13,100 --> 00:44:16,880
IRS tax scams, right? That's something that everyone needs to

776
00:44:16,880 --> 00:44:19,420
worry about. Grandma needs to worry about it. You know, like

777
00:44:19,420 --> 00:44:22,000
everyone needs to worry about that because it's indiscriminate.

778
00:44:22,060 --> 00:44:26,180
It applies to all of us. And so things like that that are going

779
00:44:26,180 --> 00:44:29,520
to have higher impact are the things that are going to affect

780
00:44:29,520 --> 00:44:32,620
your audience. Don't write about, you know, the latest zero

781
00:44:32,620 --> 00:44:35,920
day in Adobe because they don't care. They don't care. You know,

782
00:44:35,940 --> 00:44:38,440
as far as they know, as long as they're updating and patching,

783
00:44:38,440 --> 00:44:40,980
they're fine, right? Which to an extent is true. But, you know,

784
00:44:41,000 --> 00:44:43,840
write about things that, look, no amount of updates or patches

785
00:44:43,840 --> 00:44:46,720
are going to stop you from getting an IRS scam e-mail. You

786
00:44:46,720 --> 00:44:48,520
need to know what that looks like. You need to know that

787
00:44:48,520 --> 00:44:50,620
that's a real problem. So that's the kind of stuff that we

788
00:44:50,620 --> 00:44:53,320
tend to write about. Ma'am?

789
00:44:57,240 --> 00:44:58,040
Awesome. Awesome.

790
00:45:00,620 --> 00:45:05,160
And we actually don't have any security staff. And I recently

791
00:45:05,160 --> 00:45:08,200
learned about a library. And I want to start getting some of my

792
00:45:08,200 --> 00:45:10,760
colleagues up there to do that. You bet.

793
00:45:18,260 --> 00:45:26,220
Okay. Okay. Love it. Love it. Absolutely. So her question is

794
00:45:26,220 --> 00:45:29,520
essentially how do you make time for your team to train? If training

795
00:45:29,520 --> 00:45:33,980
is so important, right? Well, I stand by what I say. Training is

796
00:45:33,980 --> 00:45:36,780
important. Therefore, it's a function of your job. Therefore, you

797
00:45:36,780 --> 00:45:40,880
can do it at your job. You must be, you must enable your people

798
00:45:41,000 --> 00:45:43,980
to spend time training without requiring them to do it on their

799
00:45:43,980 --> 00:45:47,640
own time. Now, I will caveat that with you will not succeed in

800
00:45:47,640 --> 00:45:50,240
this industry if you are not dedicated and motivated enough

801
00:45:50,240 --> 00:45:53,680
to train in your own time. If you're a nine-to-fiver and

802
00:45:53,680 --> 00:45:57,360
that's it and you go home and you just leave work at work and

803
00:45:57,360 --> 00:46:00,100
you don't care, okay, well, you're just going to float and

804
00:46:00,100 --> 00:46:02,500
kind of coast right where you are for the rest of your career.

805
00:46:02,560 --> 00:46:05,800
That's fine if that's what you're into. But I will say that

806
00:46:05,800 --> 00:46:09,920
I specifically, I make time, I let my people do training at

807
00:46:09,920 --> 00:46:10,220
work.

808
00:46:11,000 --> 00:46:13,660
I have a couple of guys doing OSCP right now. I bet if anyone

809
00:46:13,660 --> 00:46:16,240
here has done OSCP, when did you do it? You did it nights and

810
00:46:16,240 --> 00:46:19,900
weekends, you know, many of them, right? No. If I'm asking you

811
00:46:19,900 --> 00:46:22,640
or if I'm enabling you to take OSCP, I'm going to give you time

812
00:46:22,640 --> 00:46:25,800
during your day to do it within reason. So, enable your people

813
00:46:25,800 --> 00:46:30,340
to get training. That's critical. Half my team is here at

814
00:46:30,340 --> 00:46:35,260
DEF CON right now and has been. So, you know, taking time away

815
00:46:35,260 --> 00:46:38,540
from work for training. Sure.

816
00:46:43,440 --> 00:46:46,400
What kind of validation environment? Okay, great

817
00:46:46,400 --> 00:46:49,120
question, right? Because always, always, always validate your

818
00:46:49,120 --> 00:46:52,620
tools, especially in security, especially in forensics. You

819
00:46:52,620 --> 00:46:55,780
know, don't just, you know, get cloned that repository without,

820
00:46:55,840 --> 00:46:58,560
you know, giving it a once over, making sure that it's got a

821
00:46:58,560 --> 00:47:03,320
reputation. So, how we validate our stuff, usually it boils

822
00:47:03,320 --> 00:47:05,960
down to this. Between those of us on the team that have

823
00:47:05,960 --> 00:47:08,460
experience with a particular tool or platform, we're

824
00:47:08,460 --> 00:47:10,980
personally vouching for it. So, the Hive, for instance, I've

825
00:47:11,000 --> 00:47:13,480
been working with it for some time before I even brought it up

826
00:47:13,480 --> 00:47:16,020
to our team. Hey, guys, let's use the Hive. I'd already looked

827
00:47:16,020 --> 00:47:18,860
at the code. I'd actually already pushed a commit to the

828
00:47:18,860 --> 00:47:21,400
repository. So, I was pretty familiar with the code base. I

829
00:47:21,400 --> 00:47:23,220
said, okay, this is a trustworthy, it's a stable

830
00:47:23,220 --> 00:47:26,740
platform. You know, so there has to be validation. I'll be

831
00:47:26,740 --> 00:47:29,520
honest with you. I don't have a structured validation plan aside

832
00:47:29,520 --> 00:47:32,500
from just, hey, what's the reputation of the repo? You

833
00:47:32,500 --> 00:47:34,740
know, who are the developers? You know, how frequent are the

834
00:47:34,740 --> 00:47:40,640
commits? One thing to definitely look for is how frequently do

835
00:47:40,640 --> 00:47:40,980
they push the code? How frequently do they push the code?

836
00:47:41,000 --> 00:47:43,840
To this repository? If it hasn't been touched in years, you

837
00:47:43,840 --> 00:47:47,100
need to be aware that it may have issues and that they're not

838
00:47:47,100 --> 00:47:51,360
going to get fixed. So, how fresh is the project? You know,

839
00:47:51,400 --> 00:47:54,640
how common, how frequently updated is a big one for sure?

840
00:48:04,960 --> 00:48:08,240
Sir? So, if you had a small team, what would maybe the top

841
00:48:08,240 --> 00:48:10,980
tools be to implement? Okay. I'm imagining you have a

842
00:48:10,980 --> 00:48:11,980
security perspective and you're starting with nothing from a

843
00:48:11,980 --> 00:48:14,180
security perspective. Okay. If you're starting with nothing,

844
00:48:14,300 --> 00:48:16,960
well, you probably have some things like maybe a firewall and

845
00:48:16,960 --> 00:48:19,340
you know, some other things. Okay. The very first thing, the

846
00:48:19,340 --> 00:48:22,980
most critical thing that you need to have is a SIM of some

847
00:48:22,980 --> 00:48:26,580
sort because you have all these systems already, right? Just in

848
00:48:26,580 --> 00:48:28,780
a native Windows environment, you've got domain controllers

849
00:48:28,780 --> 00:48:31,620
that are generating millions of logs. You've got firewalls

850
00:48:31,620 --> 00:48:33,540
generating millions of logs. Maybe you have an email

851
00:48:33,540 --> 00:48:36,400
appliance generating millions of logs. If you don't have a

852
00:48:36,400 --> 00:48:38,940
central pane of glass to look at all that stuff, you're not

853
00:48:38,940 --> 00:48:40,960
going to be able to find anything anywhere else. So, if

854
00:48:40,980 --> 00:48:41,260
you're going to be able to find anything anywhere else, you're

855
00:48:41,260 --> 00:48:41,660
not going to be able to find anything anywhere else. So, the

856
00:48:41,660 --> 00:48:45,860
first thing, log aggregation. Have all of your things sending

857
00:48:45,860 --> 00:48:50,360
logs to a central place. That's priority number one. Grey log.

858
00:48:50,620 --> 00:48:53,760
Elk. Phenomenal tools. Extremely powerful. Do I need

859
00:48:53,760 --> 00:49:03,020
to go? Okay. Okay. But, and then for SIM, OSIM. AlienVault

860
00:49:03,020 --> 00:49:06,940
OSIM. It is a completely free SIM platform. They hold back

861
00:49:06,940 --> 00:49:10,820
like two features that you would otherwise have to pay for and you

862
00:49:10,980 --> 00:49:12,980
wouldn't even know they were gone. Those two features. I

863
00:49:12,980 --> 00:49:17,460
mean, 147 capabilities, too, that you'd have to pay for that

864
00:49:17,460 --> 00:49:21,440
you've already replaced with grey log effectively. So, that

865
00:49:21,440 --> 00:49:24,080
would be my top two right there. Log aggregation and SIM.

866
00:49:24,380 --> 00:49:27,300
Because you're also, with OSIM, you're getting vulnerability

867
00:49:27,300 --> 00:49:29,840
scanning, passive asset detection to learn about all

868
00:49:29,840 --> 00:49:32,920
those things in your network you don't know exist. All kinds of

869
00:49:32,920 --> 00:49:35,040
cool tools. The list goes on. If you want to know more about

870
00:49:35,040 --> 00:49:38,920
it, meet with me afterwards. I'll tell you some more. Wrapping

871
00:49:38,920 --> 00:49:40,500
up? Okay. That's all I got, guys. Thank you.

872
00:49:40,980 --> 00:49:42,020
Thank you.