1
00:00:00,000 --> 00:00:12,520
There we go. There we go. Thank you, gentlemen. All right. Whew. Step one accomplished. Got

2
00:00:12,520 --> 00:00:19,200
slides to display. So, throughout my career I've done a lot of red teaming. I'm a former red

3
00:00:19,200 --> 00:00:24,020
teamer, former pen tester. I've done everything from, you know, your standard phishing,

4
00:00:24,020 --> 00:00:30,580
vishing, to physical security assessments. At one point, a team I was a part of, we recreated

5
00:00:30,580 --> 00:00:37,360
the original Trojan horse and we FedExed a person, a fellow pen tester, inside a facility. He

6
00:00:37,360 --> 00:00:42,200
did make it through security, popped out, and he did not do as the original Trojan horse folks

7
00:00:42,200 --> 00:00:47,620
did and slay a bunch of people. But he did let us in and he also, you know, dropped USBs and

8
00:00:48,140 --> 00:00:53,900
plugged in things everywhere he could. And as part of a lot of that work, I've also read a lot

9
00:00:53,900 --> 00:00:59,260
of reports that have come out of social engineering assessments. And one thing that's really

10
00:00:59,260 --> 00:01:05,120
stuck out to me, both from actually doing the work and my own report writing to reading a lot of

11
00:01:05,120 --> 00:01:11,660
reports, has been that there's a huge emphasis on fixing or training the human layer of this, you

12
00:01:11,660 --> 00:01:17,220
know, revised OSI stack that we're all working with. And by fixing or training, we really mean

13
00:01:17,840 --> 00:01:22,780
making non-security personnel, and even security personnel in some cases, think more like

14
00:01:22,780 --> 00:01:23,880
security people. Look at this, look at this. I mean, I've done a lot of research on security people.

15
00:01:23,880 --> 00:01:28,540
at the world through a security lens. And one of the things that I've really struggled

16
00:01:28,540 --> 00:01:33,400
with now that I've moved away from the consulting assessment side of things and actually owning

17
00:01:33,400 --> 00:01:39,920
a security program is that it doesn't actually work in practice how we would like it to.

18
00:01:40,180 --> 00:01:45,020
And so this talk is a summary of things I've been experimenting, ideas I've been tinkering

19
00:01:45,020 --> 00:01:51,160
with for a while and how I think we can challenge ourselves both in how we test, what we look

20
00:01:51,160 --> 00:01:55,920
at, what we talk about to make social engineering remediation really scale.

21
00:01:57,380 --> 00:02:01,800
So really quickly, here is the agenda that we're going to cover today. So we're going

22
00:02:01,800 --> 00:02:06,380
to step one, really quickly focus on or touch on the state of social engineering today,

23
00:02:06,620 --> 00:02:12,720
the widening gap that's occurring or that is happening. Start to look at themes. This

24
00:02:12,720 --> 00:02:19,140
is where we'll inject the central concept or premise of the talk. And then talk about

25
00:02:19,140 --> 00:02:21,060
putting all of those ideas into practice.

26
00:02:21,160 --> 00:02:24,380
Both as a tester and as a practitioner owning a program.

27
00:02:26,200 --> 00:02:32,900
And so before I go any further, this is me in a nutshell. I'm DC based. I run the trust

28
00:02:32,900 --> 00:02:36,960
and security team at a company called Nuna. We're a healthcare analytics company based

29
00:02:36,960 --> 00:02:42,260
out of San Francisco. Not really important to all of this, just to say that because

30
00:02:42,260 --> 00:02:46,160
we are a healthcare company, we see a lot of crazy stuff come at us in the form of social

31
00:02:46,160 --> 00:02:50,320
engineering attacks. You know, we've seen the spoofed e-mails. We've seen compromised

32
00:02:50,320 --> 00:02:50,920
e-mails.

33
00:02:52,920 --> 00:02:57,900
We've had all of the whaling and the financial based attacks coming after all of our funding.

34
00:02:58,500 --> 00:03:04,580
Things like that. When I was I consulted for the beginning part of my career most recently

35
00:03:04,580 --> 00:03:09,020
at a company called sigidl if anyone's familiar with it. And there I ran red team operations

36
00:03:09,020 --> 00:03:16,940
and red team services. And I am, as Caz mentioned, a huge Batman fan. This is me, I do own a

37
00:03:16,940 --> 00:03:20,740
full Batman suit in addition to tattoos and everything. Only one of these was actually on

38
00:03:20,740 --> 00:03:33,580
Halloween. So why not? All right. So this is the typical situation. Company is trying to,

39
00:03:33,640 --> 00:03:40,200
you know, bolster its security posture. It engages some kind of third party security firm.

40
00:03:40,320 --> 00:03:44,840
They come in, they do some testing, social engineering testing. Maybe it's directed at

41
00:03:44,840 --> 00:03:49,440
social engineering or maybe it's just part of a broader scope. And through that social

42
00:03:49,440 --> 00:03:53,640
engineering testing, lo and behold, they find that people are clicking on links, they're

43
00:03:53,640 --> 00:03:58,340
giving up credentials, they're giving up sensitive information in some form or fashion. They're

44
00:03:58,340 --> 00:04:03,460
giving up a foothold. And when they call them up on the phone, as we saw a little bit during

45
00:04:03,460 --> 00:04:08,660
the SE competition here, people give up information when they're sweet talked a little bit.

46
00:04:08,800 --> 00:04:15,280
Or if there isn't something stopping them from giving up that information. Very, very

47
00:04:15,280 --> 00:04:19,420
basic. And what that ends up leading to is a report that focuses on the security of the

48
00:04:19,420 --> 00:04:23,280
network. And it's probably pretty squarely on awareness training. So we need to start

49
00:04:23,280 --> 00:04:29,300
looking at training those people to not click on links, to not give up their passwords to

50
00:04:30,080 --> 00:04:36,080
websites, things like that. And we've gotten really, really creative around how we educate

51
00:04:36,080 --> 00:04:42,700
people. Through games, through video content, through little social nudges. At NUNA we run

52
00:04:42,700 --> 00:04:48,080
this thing called, or this little program we call the Human Firewall Award. And on a monthly

53
00:04:48,080 --> 00:04:49,400
basis, we have this really cool program called Human Firewall Award. And on a monthly basis, we have this

54
00:04:49,420 --> 00:04:55,060
really cheesy little Grammy-style trophy that says NUNA Human Firewall on it. We give it to

55
00:04:55,060 --> 00:05:00,820
somebody on a monthly basis to kind of celebrate the fact that they were the best fishing report

56
00:05:00,820 --> 00:05:05,600
for that month, that they caught the craziest thing for that month. So there's a lot of ways that

57
00:05:05,600 --> 00:05:13,740
we can bolster awareness. But it's expensive. A lot of it is anyways. It's expensive in terms of

58
00:05:14,260 --> 00:05:19,080
people's time and investment relative to the return on investment that you end up getting in terms

59
00:05:19,080 --> 00:05:26,840
of everything that they take away from the training and apply on a day in, day out basis. And then

60
00:05:26,840 --> 00:05:32,440
what a lot of these social engineering assessments end up pointing to, or at least some that I've

61
00:05:32,440 --> 00:05:38,280
read in my role now, is that people are constantly clicking on things. They're constantly falling

62
00:05:38,280 --> 00:05:43,480
for stuff. And because of that, we have to assume that we're all breached already. Everything is

63
00:05:43,480 --> 00:05:48,640
already over. And so instead, we have to shift to, you know, prevention is dead. We have to focus on detect

64
00:05:48,640 --> 00:05:55,420
faster, respond better. I don't actually believe that's true. For anyone that does, I'm sorry. We can

65
00:05:55,420 --> 00:06:03,360
duke it out after this. Let me have my moment of fame here. So during that tooling arms race, you

66
00:06:03,360 --> 00:06:09,480
end up with more and more tools in the form of capabilities being injected into a program. And

67
00:06:10,020 --> 00:06:14,540
all of those come with increased costs. And we're kind of shooting blind. We're stumbling through

68
00:06:14,540 --> 00:06:18,620
the woods in the dark, bumping into trees. And every time we come up against a tree, we're

69
00:06:18,620 --> 00:06:25,800
like, we introduced a new tool, cut it down, get it out of our way. And thanks to DBIR and their

70
00:06:25,800 --> 00:06:30,900
fantastic, Verizon's DBIR, that is, and their fantastic graphing skills, making things that are

71
00:06:30,900 --> 00:06:37,980
really easy to understand, we have this graph right here, which is a little bit of an eyesore. But

72
00:06:37,980 --> 00:06:43,740
what I want people to focus on is this little tiny middle section here, the yellow and green

73
00:06:43,740 --> 00:06:48,600
lines. And what those lines tell us on this graph is that we're going to be able to do a lot of

74
00:06:48,620 --> 00:06:51,100
things. One of the things that we want to look at is that over the last six years or so, you see

75
00:06:51,100 --> 00:06:58,620
social engineering vectors and malware based vectors having an increasingly prevalent, or

76
00:06:58,620 --> 00:07:03,560
attackers are using them more and more and more as a foothold into a data breach of some form.

77
00:07:03,820 --> 00:07:11,820
They are the initial cause of exploitation or cause of breach. So if we're spending more money on

78
00:07:11,820 --> 00:07:16,080
all of these things, yet they continue to go up, something is not actually working. We need to

79
00:07:16,080 --> 00:07:18,600
rethink the way that we are actually doing that. And that is, we need to be able to do the same

80
00:07:18,620 --> 00:07:23,020
testing or the way that we're approaching remediation. Because we know we can find this stuff.

81
00:07:23,800 --> 00:07:29,400
We know we're very good at that. But we clearly are not very good at actually getting our point

82
00:07:29,400 --> 00:07:35,460
across at scale. In program environments where, you know, we have a lot of metrics, we have very

83
00:07:35,460 --> 00:07:40,600
frequent touch points, you can absolutely see, you know, people's susceptibility trending

84
00:07:40,600 --> 00:07:45,860
downwards and that's amazing. But I don't think that that's actually working fast enough or

85
00:07:45,860 --> 00:07:51,580
broadly enough in order to really truly make a difference at scale. It definitely helps and we

86
00:07:51,580 --> 00:07:59,380
should continue doing it, but I think we need to do even more. So the status quo. So right now

87
00:08:00,720 --> 00:08:05,720
we're investing in training, we're investing in, you know, bolstering that individual or that

88
00:08:05,720 --> 00:08:12,640
team of individuals awareness about social engineering attacks. And as a CISO or, you know,

89
00:08:12,640 --> 00:08:15,840
somebody leading a security program, I have to ask myself a few questions. First of all,

90
00:08:15,860 --> 00:08:19,600
I'd like to ask you a couple of key questions. Such as, what happens when that person who I've

91
00:08:19,600 --> 00:08:24,540
invested all of this time in, leaves the company? They take that investment with them. They

92
00:08:24,540 --> 00:08:32,140
no longer are contributing to our resilient security posture. Plus, I don't know how this

93
00:08:32,740 --> 00:08:37,400
applies to any of you but any training that you've gone through on day 1 or, you know, your

94
00:08:37,400 --> 00:08:40,820
annual security training or any annual training, I don't know how much of that you actually

95
00:08:40,820 --> 00:08:45,800
remember. Outside of the security stuff, because me being a security person, I don't

96
00:08:45,800 --> 00:08:51,140
really remember much of it. And I know this is true for a lot of folks. And then bigger than

97
00:08:51,140 --> 00:08:56,020
that, how do people behave under stress? Especially when they're in a role that's geared around

98
00:08:56,020 --> 00:09:03,240
helping people that are interacting with them. IT help desk, people on like a customer service

99
00:09:03,240 --> 00:09:08,160
role, things like that. They're incentivized and there are metrics behind how they are able to

100
00:09:08,160 --> 00:09:15,780
assist, not necessarily how secure they are. Which is another slight issue. So I think

101
00:09:15,800 --> 00:09:19,800
that this graph is a little bit easier to understand. This came out of some research that

102
00:09:19,800 --> 00:09:24,640
was done on retention rates in enterprise training. Not necessarily for security

103
00:09:24,640 --> 00:09:30,560
specifically but training programs in general. And what this graph tells us is that there is a

104
00:09:30,560 --> 00:09:39,420
huge drop off on the amount of information that's retained and the days after the training that

105
00:09:39,420 --> 00:09:44,780
the individual retains that information. And really effective awareness programs are

106
00:09:44,780 --> 00:09:45,780
attempting to shift this information from the structure to the practice. And they're

107
00:09:45,780 --> 00:09:51,800
that line up and to the right. But unless we can get that line to just be straight across

108
00:09:53,280 --> 00:09:59,080
indefinitely, then there's always going to be a gap. Everything over here is where adversaries

109
00:09:59,080 --> 00:10:03,960
are going to take advantage of an opening and continue to leverage those openings to get into

110
00:10:03,960 --> 00:10:09,800
our environments. And so you can liken this to trying to hunt grizzly bears with birdshot.

111
00:10:10,360 --> 00:10:16,320
You're likely to just make a small impact. It's not going to be complete. You might have to hit

112
00:10:16,320 --> 00:10:21,800
them a million times before they bleed out and you can actually win that particular interaction.

113
00:10:22,300 --> 00:10:25,980
I don't know about you, but I would not want to hunt or come up against a grizzly with nothing

114
00:10:25,980 --> 00:10:34,060
but birdshot. And one of the things that is interesting about security, not, you know, outside

115
00:10:34,060 --> 00:10:39,160
of a lot of enterprise training programs, is that our field is evolving so, so quickly.

116
00:10:39,800 --> 00:10:43,540
And so there's always more things that we're trying to pile onto the awareness training plate.

117
00:10:43,860 --> 00:10:49,200
And if we're always piling more stuff on and they're not retaining the stuff that we're already

118
00:10:49,200 --> 00:10:52,880
trying to emphasize, then it's just going to get harder and harder and harder and harder.

119
00:10:53,900 --> 00:10:59,040
And then one thing that I've really challenged myself on is why is it that we as security

120
00:10:59,040 --> 00:11:05,120
professionals, we are expecting other people to think like us, but we are not stopping to think

121
00:11:05,120 --> 00:11:09,720
about how they actually go through a system or interact with a process or a technology

122
00:11:09,800 --> 00:11:15,240
or things like that. So we have to put on their user experience hat and try to think like them

123
00:11:15,580 --> 00:11:21,920
and build better things. And so that is ultimately the core of the theme based approach that I'm

124
00:11:21,920 --> 00:11:27,680
going to talk through today. So there's a few things that I want people to, that I hope people

125
00:11:27,680 --> 00:11:34,480
can accept, not necessarily as absolutes, but as probable things going through this. So the

126
00:11:34,480 --> 00:11:38,920
first being, people are always going to be vulnerable as long as they're making a decision in

127
00:11:38,920 --> 00:11:39,520
some context.

128
00:11:39,800 --> 00:11:46,320
As long as there is a discretionary series of actions that occur, people are susceptible to

129
00:11:46,320 --> 00:11:50,420
potentially making the wrong one, especially when they're coerced in a certain direction.

130
00:11:51,580 --> 00:11:55,760
Coerced towards, you know, maybe they're receiving a phone call from somebody claiming to be

131
00:11:55,760 --> 00:12:00,640
an executive director and that person needs their password reset because they're about to go

132
00:12:00,640 --> 00:12:07,320
into a critical meeting. You know, that person is likely to fall for that attack, give up the

133
00:12:07,320 --> 00:12:09,300
password or reset the password for the individual.

134
00:12:10,200 --> 00:12:15,740
The second is, the person is not necessarily to blame. However, the role that they are playing in the

135
00:12:15,740 --> 00:12:23,420
organization is to blame. You can liken this to, like, child product safety rules. Or, product

136
00:12:23,420 --> 00:12:30,960
safety features for, to protect children from, you know, pulling a thing up, like, pulling a pill

137
00:12:30,960 --> 00:12:36,820
top off and swallowing a bunch of pills or screwing up with a toy or something and hurting themselves.

138
00:12:37,340 --> 00:12:39,780
We're designing roles where people are, you know, they're not necessarily to blame. They're not

139
00:12:39,800 --> 00:12:43,960
susceptible and able to actually blow their own foot off and make a mistake.

140
00:12:44,760 --> 00:12:51,040
And then third is, that training is not going to stick 100% of the time for 100% of the days in

141
00:12:51,040 --> 00:12:55,020
which they are operating in that role. There's always going to be a little bit of a gap no matter

142
00:12:55,020 --> 00:13:01,060
how good that we are at training. And, you know, for anyone who's familiar with the security

143
00:13:01,060 --> 00:13:05,920
engineering space where we're trying to train developers up and get them to, you know, know

144
00:13:05,920 --> 00:13:09,760
about things like cross-site scripting and sequel injection, we've seen this a million

145
00:13:09,800 --> 00:13:14,460
times over where, you know, we're expecting them to keep up on all of the things that we talk

146
00:13:14,460 --> 00:13:19,920
about at security conferences like this. But, at the same time, they have to keep up with all of

147
00:13:19,920 --> 00:13:25,000
the things that make them good at their jobs, put all that together and apply it on a day and day

148
00:13:25,000 --> 00:13:29,220
off basis. And it's a lot to remember. So, if we don't, if they don't have guard rails in the

149
00:13:29,220 --> 00:13:35,900
form of security controls, it's easier to make mistakes. So, I want to, I want to describe or

150
00:13:35,900 --> 00:13:39,780
walk through this process in the form of an attack tree. A very simple, uh, easy way to do it.

151
00:13:39,800 --> 00:13:45,500
Easy to understand attack tree. And consider that an attacker wants to start by, uh, taking over

152
00:13:45,500 --> 00:13:49,820
an account in some capacity. They might brute force credentials. They might choose to go down

153
00:13:49,820 --> 00:13:54,600
the fishing ground. Probably a little bit easier. If they go down the fishing ground, they may

154
00:13:54,600 --> 00:13:58,420
have a few options available to them. They might want to steal credentials. Um, they might want

155
00:13:58,420 --> 00:14:05,240
to achieve some kind of RCE, um, with that user, whether it's, uh, an attachment, um, a

156
00:14:05,240 --> 00:14:09,780
nefarious attachment of sorts. A, maybe it's, say, a link that they browse to, you know, a

157
00:14:09,800 --> 00:14:13,920
link that they want to that then allows them to, like, a beef, uh, beef-infected web page. Or

158
00:14:13,920 --> 00:14:19,140
maybe they just, uh, lead them to a page that is spoofed in some form or fashion and get them to

159
00:14:19,140 --> 00:14:24,080
give up their credentials. And then from there, they can do other things. Maybe they can replay

160
00:14:24,080 --> 00:14:27,940
those credentials. Maybe they can pivot. Maybe they can dig in, like, bed bugs into your

161
00:14:27,940 --> 00:14:33,000
environment. Whatever it happens to be, they have some foothold at that point. Pretty easy to

162
00:14:33,000 --> 00:14:39,720
understand. So, you might ask yourself, thinking through this very, very simple attack tree, a

163
00:14:39,800 --> 00:14:44,320
few things, and this is where we start to get into the themes, is why in the first place are

164
00:14:44,320 --> 00:14:49,720
credentials able to be replayed? Can we find a way to prevent that malicious code from actually

165
00:14:49,720 --> 00:14:54,780
running? Is there a way that we can stop that content from hitting the inbox in the first

166
00:14:54,780 --> 00:15:01,460
place? Or if they send that to maybe 15 people and it's detected once, can we really, really

167
00:15:01,460 --> 00:15:07,600
quickly respond and remove it from the other 14 recipients? Find, find who has received it,

168
00:15:07,660 --> 00:15:09,780
remove it before the impact gets even worse.

169
00:15:09,800 --> 00:15:13,920
And you have some kind of epidemic on your hands. So, those are the kind of questions that we're

170
00:15:13,920 --> 00:15:20,720
going to start to tease out as part of this, as part of this theme-based approach. And what I

171
00:15:20,720 --> 00:15:26,220
want to focus here on is systemic defenses. So, finding ways that within an attack tree, we can

172
00:15:26,220 --> 00:15:33,380
inject control or detection and response capabilities into that flow. And by doing that, we

173
00:15:33,380 --> 00:15:39,320
can find ways to break out training. Instead of having, like, one time, coming at you,

174
00:15:39,800 --> 00:15:45,620
training sessions, to break up training into smaller social nudges or smaller technology-based

175
00:15:45,620 --> 00:15:50,900
nudges into that same workflow. So, that way the user is getting smaller, more efficient and

176
00:15:50,900 --> 00:15:57,780
effective bits and bytes of training and hopefully allowing them to kind of interrupt their

177
00:15:57,780 --> 00:16:02,360
workflow, think about something, and then move on. And you could, this is not a perfect example,

178
00:16:02,540 --> 00:16:09,020
but it's an example nonetheless. You can think about Google Chrome's user experience around

179
00:16:09,800 --> 00:16:15,400
insecure websites, potentially malicious websites. If you browse to something that's not using

180
00:16:15,900 --> 00:16:20,260
the HSTS header, let's say, they don't allow you to go to it. You know, you'll get the certificate

181
00:16:20,260 --> 00:16:25,720
warning, it'll present you with some educational information, and it doesn't allow you to go

182
00:16:25,720 --> 00:16:29,920
further. If that site is a little bit better, they're using that, but their certs are out of

183
00:16:29,920 --> 00:16:35,420
date or something like that, it's self-signed, you'll still get the same interrupt in user

184
00:16:35,420 --> 00:16:39,780
experience. They'll try to educate you about something and then let you proceed. So, that's

185
00:16:39,800 --> 00:16:44,480
how you proceed if you decide to click through. And it gets a little bit less egregious the

186
00:16:44,480 --> 00:16:50,240
better the site is in, the better state that the site is in. So, maybe it's just a little, you

187
00:16:50,240 --> 00:16:54,680
know, red lock or something or it's missing a lock in the browser bar, something to that

188
00:16:54,680 --> 00:17:03,240
effect. All right. And that's the big thing here, is finding ways to use control within a

189
00:17:03,240 --> 00:17:09,760
workflow to make things more effective. So, you can achieve benefits of scale. And so,

190
00:17:09,800 --> 00:17:14,580
thinking about this, we'll do an attack and defense tree in that same very, very simple attack

191
00:17:14,580 --> 00:17:20,900
tree. We're going to do it with the same attack methods here. So, if I wanted to lock that brute

192
00:17:20,900 --> 00:17:26,840
force credentials path off of the attack tree, I might use very simple controls like locking

193
00:17:26,840 --> 00:17:32,520
them out or multi-factor authentication. This has all been done. Great. We've kind of stopped

194
00:17:32,520 --> 00:17:37,340
that or made that much more difficult. If I want to start to make phishing a little bit harder, I

195
00:17:37,340 --> 00:17:39,780
might have a layer in there where I know that I'm going to have to do something about it, and then I

196
00:17:39,800 --> 00:17:45,540
narrow the attack surface a little bit through some specifically placed controls, using things

197
00:17:45,540 --> 00:17:51,520
like DMARC or DKIM or better spam filtering, something like that. And we can keep moving on

198
00:17:51,520 --> 00:17:57,360
through. And maybe we have another layer relative to where the attacker is at in that stage.

199
00:17:58,600 --> 00:18:03,140
You can use things like application white listing or browser plug-ins or something that you roll

200
00:18:03,140 --> 00:18:07,180
out across the enterprise. These are things that you could do on an enterprise-ready basis.

201
00:18:09,100 --> 00:18:15,540
And then moving on through to the end of the attack tree, there's more stuff that you can layer

202
00:18:15,540 --> 00:18:20,740
in. And ultimately, what we're trying to do here is either make it harder to traverse a particular

203
00:18:20,740 --> 00:18:27,180
attack tree or path down an attack tree, or find ways that you can remove branches of that tree

204
00:18:27,180 --> 00:18:32,400
altogether. And if you can remove branches of that tree, then you can narrow the amount of the

205
00:18:32,400 --> 00:18:37,160
scope and the focus of that particular training. And ultimately, the user's focus, that's going to

206
00:18:37,180 --> 00:18:42,740
they have to remember a little bit less, and so your retention rate might be a little bit better. Or

207
00:18:42,740 --> 00:18:47,440
maybe you just make it a little bit harder for that particular capability to, or that particular

208
00:18:47,440 --> 00:18:54,940
path to be executed against. And ultimately, if you have confidence as somebody managing these

209
00:18:54,940 --> 00:19:00,240
controls at an enterprise scale, if you have confidence in the controls that you're layering out

210
00:19:00,240 --> 00:19:04,240
here, then you can start to figure out where you might want to put your training. Like, for

211
00:19:04,240 --> 00:19:07,160
instance, if you're taking advantage of that, as you're running your training, if you're

212
00:19:07,180 --> 00:19:11,180
application whitelisting, like on the left side of this particular attack tree, and the right

213
00:19:11,180 --> 00:19:16,620
side is a little bit more on the atrocious side, then maybe you focus your training over there on

214
00:19:16,620 --> 00:19:23,580
where exactly people are giving up their credentials, something like that. All right. So now,

215
00:19:23,660 --> 00:19:30,040
switching gears into putting all of this stuff into practice. First things first is you have to be

216
00:19:30,040 --> 00:19:35,740
mindful of the user experience. If you create or inject a lot of high friction touch points or

217
00:19:35,740 --> 00:19:36,960
gates that the people...

218
00:19:37,180 --> 00:19:43,320
that your user base has to, you know, kind of jump over, then ultimately they're probably

219
00:19:43,320 --> 00:19:47,820
going to find ways to route around you or they're just going to be in a perpetual state of being

220
00:19:47,820 --> 00:19:52,100
pissed off at your security team. Or if you're a tester and you're recommending things that are

221
00:19:52,100 --> 00:19:55,940
very, very high friction or take a lot of time, then you're going to be putting your client in a

222
00:19:55,940 --> 00:20:00,860
potentially bad position where they're going to be the ones who are... whose users are pissed off

223
00:20:00,860 --> 00:20:05,000
at them. So be very mindful of the user experience when you're making these kind of

224
00:20:05,000 --> 00:20:07,160
recommendations. And the second thing is...

225
00:20:07,180 --> 00:20:12,920
your particular context is absolutely paramount to consider. So, you know, we could sit up here and

226
00:20:12,920 --> 00:20:18,620
talk around like how you create a secure help desk workflow. How you prevent against...

227
00:20:20,240 --> 00:20:25,300
prevent against password reset processes from being abused, things like that. But every

228
00:20:25,300 --> 00:20:31,040
enterprise or every organization is going to have a unique way of doing this. Very likely. And so

229
00:20:31,040 --> 00:20:37,160
you have to be willing to break down these particular workflows for your organization and look at how

230
00:20:37,180 --> 00:20:42,520
an attacker is going to step through them within your org, within your context, within your

231
00:20:42,520 --> 00:20:52,220
process, your technology, things like that. All right. So as a tester, we'll focus on this from a

232
00:20:52,220 --> 00:20:59,040
few different perspectives. First being from that tester consultant perspective. So we mentioned

233
00:20:59,040 --> 00:21:04,160
this at the beginning, but a lot of times when we find those issues, we find that people are

234
00:21:04,160 --> 00:21:07,160
clicking on links. People are downloading attachments and running them. People are running

235
00:21:07,180 --> 00:21:12,960
them. People are doing any number of things that are ultimately going to degrade the resiliency or

236
00:21:12,960 --> 00:21:19,480
the security posture of that organization. We recommend controls that focus on the human layer.

237
00:21:19,660 --> 00:21:24,780
We recommend that they, you know, go through that training, go through that, you know, go

238
00:21:24,780 --> 00:21:31,080
through, you know, like recertification or whatever the process is. And instead, I want to

239
00:21:31,080 --> 00:21:36,760
challenge folks to break down, think about issues from a root cause analysis perspective. And think

240
00:21:36,760 --> 00:21:42,420
about within the context of whatever it is you found, what is the root cause that actually led to

241
00:21:42,980 --> 00:21:50,660
that human being able to do what they did? Whether it's give up credentials, you know, whether

242
00:21:50,660 --> 00:21:57,360
it's give up sensitive information, you know, open an attachment, give up credentials on a web

243
00:21:57,360 --> 00:22:02,340
page, whatever it happens to be, what is it that allowed them to do that? And make your

244
00:22:02,340 --> 00:22:06,740
recommendations center around those things. They're much more tangible, much more

245
00:22:07,420 --> 00:22:16,080
appropriate at scale. And so you can consider this from the perspective of going through a few

246
00:22:16,080 --> 00:22:22,420
sample social engineering engagements. So these are all real. I have lived and breathed these

247
00:22:22,420 --> 00:22:27,760
myself. But let's say you're doing a physical security assessment and you walk in, you sweet talk

248
00:22:27,760 --> 00:22:33,780
some people, and you get them to plug something in, and you get it to run, you know, a sample

249
00:22:33,780 --> 00:22:36,720
benign application. And then you get them to plug something in, and you get it to run, you know, a

250
00:22:36,740 --> 00:22:40,960
. And so you come back and you say, well, I was able to launch that application,

251
00:22:41,180 --> 00:22:47,700
that benign application. Therefore, I could launch something much more nefarious. Find it. You

252
00:22:47,700 --> 00:22:53,520
know, you write it up, winning as social engineer. So in this particular context, you

253
00:22:53,520 --> 00:22:59,600
might report it as, you know, why in the world was a U.S.P.A. device able to get plugged in in

254
00:22:59,600 --> 00:23:06,700
the first place. In this particular context I was in a bank. Opposing as IT audit support. And in a

255
00:23:06,700 --> 00:23:06,720
balance, you know

256
00:23:06,740 --> 00:23:11,180
bank, I've been in banking environments where sometimes they don't even allow USB drives.

257
00:23:11,460 --> 00:23:20,900
Especially not, why was there not a call up to whoever I said I was there working with to

258
00:23:20,900 --> 00:23:25,940
validate my identity before I was able to proceed anywhere. There's a few process or

259
00:23:25,940 --> 00:23:34,400
technical things that you could do first to make this a little bit harder. So this is another

260
00:23:34,400 --> 00:23:40,720
one. This was also with a bank that I worked with. Doing a vishing test of a call center. Get

261
00:23:40,720 --> 00:23:46,140
some background noise playing like airport or something like that. Say you're high ranking

262
00:23:46,140 --> 00:23:52,660
executive so and so, you're trying to reset your password, get on to the VPN, whatever it is,

263
00:23:52,760 --> 00:23:59,080
and you're having, you're running into issues. You've done your research, you know about some

264
00:23:59,080 --> 00:24:04,340
of the, you know about the individual you're impersonating's background information that

265
00:24:04,400 --> 00:24:09,380
is likely to be used for security questions, et cetera, et cetera. You get somebody on the

266
00:24:09,380 --> 00:24:15,560
phone, because it is a call center, they're there to help you, and you start sweet talking. You

267
00:24:15,560 --> 00:24:20,300
start using vague responses like, well, you know, I don't know, I don't remember exactly what

268
00:24:20,300 --> 00:24:24,380
answer I used in the, what street did you grow up on. You know, I was trying to throw people

269
00:24:24,380 --> 00:24:29,480
off, you know, maybe I, maybe I used this one, maybe I used that one, something like that. And

270
00:24:29,480 --> 00:24:34,380
if a call, if a call center person, the person working at the call center, if they were

271
00:24:34,400 --> 00:24:38,860
able to see those answers, they're much more likely or that it is possible that they could

272
00:24:38,860 --> 00:24:44,760
make a decision in that sequence of actions to let you have it, to take it easy on you that

273
00:24:44,760 --> 00:24:49,820
day, because you're going through a bad day, they are incentivized to help you. Versus

274
00:24:49,820 --> 00:24:55,200
something where they have to enter the information you provide them. They enter it into a system,

275
00:24:55,340 --> 00:25:00,460
it comes back and says it's right or it's wrong, it allows them to proceed, something like

276
00:25:00,460 --> 00:25:04,340
that. Almost an invisible introduction and

277
00:25:04,400 --> 00:25:09,040
workflow for something that cannot be gamed, necessarily. It cannot be sweet talked or

278
00:25:09,040 --> 00:25:13,160
smooth talked. You know, you could, you can inject a lockout on that person's account through

279
00:25:13,160 --> 00:25:17,900
that same, through that same process. You could have escalation points in place, things like

280
00:25:17,900 --> 00:25:26,280
that. So, when you're writing those reports, again, you have to focus on, or I would challenge

281
00:25:26,280 --> 00:25:33,260
folks to focus on the underlying set of circumstances, be it technology issues, process issues, whatever,

282
00:25:34,400 --> 00:25:40,520
that allowed that thing to happen. And instead propose technology, process, human-oriented

283
00:25:41,040 --> 00:25:45,600
system components that could prevent or make that a little bit harder to carry out in the

284
00:25:45,600 --> 00:25:52,100
future. Yeah, so a lot of, I won't, I won't read through all of those things, but it's

285
00:25:52,100 --> 00:25:54,980
basically drill down to the root cause, recommend around that.

286
00:25:57,660 --> 00:26:02,980
So thinking about tooling. So, as a, as, if you're working on the practitioner, the

287
00:26:03,640 --> 00:26:04,320
practitioner's side.

288
00:26:05,060 --> 00:26:08,720
You know, there's a lot of, you'll, and you come to a conference like this, you'll have a lot of

289
00:26:08,720 --> 00:26:13,180
people begging you to spend money with them. There's a lot of tools out there, if anyone's ever

290
00:26:13,180 --> 00:26:18,640
traversed the RSA or Black Hat Expo floors. There's a lot of things going on, and those

291
00:26:18,640 --> 00:26:23,040
vendors will of course tell you that they have the perfect solution to all of your problems.

292
00:26:23,120 --> 00:26:27,800
They have your silver bullet in mind. So if you were to start, if you were to take that same

293
00:26:27,800 --> 00:26:33,940
attack tree, attack and defense tree approach, where you're layering controls within a

294
00:26:33,940 --> 00:26:39,340
particular workflow that might be social engineering relevant, um, what you can do from a

295
00:26:39,340 --> 00:26:44,480
from a tooling perspective is figure out, alright vendor A is coming to me, they are

296
00:26:44,480 --> 00:26:50,920
providing me this particular capability, it fits exactly within my attack tree in this way, and

297
00:26:51,500 --> 00:26:56,120
ultimately this'll help you reduce some of that vendor FUD, um, it'll help you figure out

298
00:26:56,120 --> 00:27:01,180
exactly where it's protecting you, where it's not protecting you. And you can figure out, you

299
00:27:01,180 --> 00:27:03,920
can kind of bucket it into to these control detect response, and it will help you, it will help you

300
00:27:03,920 --> 00:27:09,760
categories. Maybe you don't want a program that's solely or very heavily geared towards

301
00:27:09,760 --> 00:27:14,080
detection and response. Because detection is always going to get harder. Response is always

302
00:27:14,080 --> 00:27:18,420
going to get harder. And that almost inherently puts you in a position where you're fighting a

303
00:27:18,420 --> 00:27:23,460
widening gap. Whereas prevention can help you keep that gap, keep the possibility of the gap

304
00:27:23,460 --> 00:27:32,760
narrow to begin with. All right. So focusing on some next steps. Because I always like to end

305
00:27:32,760 --> 00:27:37,280
my presentations with some practical things that people can do. So first things first, I would

306
00:27:37,280 --> 00:27:42,820
say figure out what your particular context is. Figure out what social engineering scenarios are

307
00:27:42,820 --> 00:27:47,580
most relevant to you. Maybe it's, maybe you're very concerned about phishing. Maybe you're very

308
00:27:47,580 --> 00:27:52,560
concerned about the types of scenarios that we're stress testing in the competition leading up to

309
00:27:52,560 --> 00:27:58,880
this. The phishing, the calls against help desks, calls against employee directories, things

310
00:27:58,880 --> 00:28:02,740
to that effect. Figure out whatever it is that's important to you. And if it's something that

311
00:28:02,760 --> 00:28:06,640
you're concerned about, build an attack tree against that particular scenario at first. Don't try

312
00:28:06,640 --> 00:28:11,060
to do it for every single thing that's in your organization. You'll be overwhelmed. You won't

313
00:28:11,060 --> 00:28:16,720
know where to start. And really trying to solve every single problem at once is just, you know,

314
00:28:16,740 --> 00:28:21,240
you're going to be fraught with disaster. So Rome wasn't built in a day. Complete security

315
00:28:21,240 --> 00:28:27,300
postures are not also built in a day. So pick one. Dive into it. Analyze it. Break it down.

316
00:28:28,040 --> 00:28:32,500
And within that attack and defense tree, figure out where you can potentially introduce

317
00:28:32,760 --> 00:28:40,700
improvements through that workflow in technology, process, or new systems. And figure out where

318
00:28:40,700 --> 00:28:45,100
you can start to layer them. You don't have to, again, solve an entire attack tree at once. You

319
00:28:45,100 --> 00:28:49,780
can make small iterative improvements. If one particular branch through that tree looks like it

320
00:28:49,780 --> 00:28:55,560
is, or based on your historical data, is very likely to get taken advantage of or, you know, you

321
00:28:55,560 --> 00:29:00,260
know it's been taken advantage of zillions of times in the past, then focus there first. Try to

322
00:29:00,260 --> 00:29:02,740
make that a little bit better. And then maybe you shift over to the next one. And then maybe you

323
00:29:02,760 --> 00:29:06,260
shift over to something else that is higher priority. But find ways that you can exert the

324
00:29:06,260 --> 00:29:11,460
Pareto principle, you know, 80% of the benefit for 20% of the cost or 20% of the investment

325
00:29:12,060 --> 00:29:17,140
onto that attack and defense tree. So you're making small investments for big gain and keep

326
00:29:17,140 --> 00:29:23,060
going through that process. And then ultimately I would encourage folks to try out some kind of

327
00:29:23,060 --> 00:29:28,120
AB testing. Try out some way to experiment with this. So you're not always going to get it

328
00:29:28,120 --> 00:29:32,300
right. Sometimes you might screw up the user experience. And that's okay. You can always

329
00:29:32,300 --> 00:29:38,760
revert. No decisions have to be final and permanent. But find ways that you can make small

330
00:29:38,760 --> 00:29:45,260
iterative improvements. Test them. If they don't work, change them. But ultimately the more and

331
00:29:45,260 --> 00:29:49,760
more you're striving towards making these little dents in your security posture, little dents in

332
00:29:49,760 --> 00:29:54,720
your workflows, you're going to end up coming out on top. Or at least in a much better position.

333
00:29:54,980 --> 00:29:59,540
So that is all the content I had. So I wanted to leave a little time for Q&A. So thank you very

334
00:29:59,540 --> 00:30:02,280
much. And I will pause and wrap up.

335
00:30:02,300 --> 00:30:04,120
And leave open for any questions.

336
00:30:12,440 --> 00:30:20,600
So the approach of rather focusing on the people and moving to more technical

337
00:30:20,980 --> 00:30:30,400
science and things, how do you handle companies that are more metric driven and focus on like

338
00:30:30,400 --> 00:30:32,220
those support folks?

339
00:30:33,660 --> 00:30:34,220
Sure.

340
00:30:34,580 --> 00:30:41,820
How do you get them to change the mentality from maybe your metric isn't going to work in that

341
00:30:41,820 --> 00:30:43,840
type of environment with that new mentality?

342
00:30:44,040 --> 00:30:45,500
The support metric, that is.

343
00:30:45,680 --> 00:30:45,880
Yes.

344
00:30:46,060 --> 00:30:53,340
So the question was, just to repeat for everyone, is how, in a more technology-focused

345
00:30:53,340 --> 00:31:02,280
approach, how do you get a function, a business function like a customer support representative,

346
00:31:02,300 --> 00:31:11,560
who is very heavily incentivized towards helping, how do you flip the script on them to not impact the

347
00:31:11,560 --> 00:31:15,420
way that they're evaluated and still tackle this?

348
00:31:16,060 --> 00:31:20,700
So I would say there, you don't necessarily have to focus on a technology approach, but maybe it's a

349
00:31:21,260 --> 00:31:24,600
process-focused, or maybe you can change the KPI entirely.

350
00:31:24,940 --> 00:31:31,060
So if they're incentivized purely on how many people they help, and that's it, there might be a more

351
00:31:31,060 --> 00:31:32,280
efficient way to do that.

352
00:31:33,620 --> 00:31:40,380
There might be a more efficient way to write that KPI, and, you know, maybe it's the amount of

353
00:31:40,380 --> 00:31:48,820
people that you help and, you know, let's say, like, you follow a validation process, or

354
00:31:48,820 --> 00:31:49,420
something like that.

355
00:31:49,500 --> 00:31:54,420
Like the amount of times you've followed the exact process or not had to, you know, have an

356
00:31:54,420 --> 00:31:56,040
escalation or, you know, something like that.

357
00:31:56,120 --> 00:32:00,800
There might be ways to either change the KPI or there might be slight changes in process, like the

358
00:32:00,800 --> 00:32:01,560
way that they validate.

359
00:32:01,760 --> 00:32:02,280
The way that they do it.

360
00:32:02,300 --> 00:32:04,200
The things that they check of the user.

361
00:32:04,560 --> 00:32:08,920
Something like that where you're still letting them do their job and you're incentivizing them to do

362
00:32:08,920 --> 00:32:09,340
their job.

363
00:32:09,500 --> 00:32:10,900
They just do it slightly differently.

364
00:32:11,920 --> 00:32:13,820
Because a lot of these things are just process issues.

365
00:32:14,100 --> 00:32:17,580
At least, like, that help desk issue that I cited.

366
00:32:17,840 --> 00:32:23,040
So I was going after and trying to get them to reset a VPN profile for this bank.

367
00:32:23,340 --> 00:32:28,760
And, like, literally, I provided a few phony answers on security questions.

368
00:32:29,140 --> 00:32:30,280
They let me on to the VPN.

369
00:32:30,280 --> 00:32:33,300
And, like, from there, it was all SSO driven.

370
00:32:33,440 --> 00:32:36,560
So I could get on to whatever that person had access to.

371
00:32:36,740 --> 00:32:42,940
And it's, like, you know, if a very small change in process would have stopped me from doing that.

372
00:32:43,080 --> 00:32:43,800
So, yeah.

373
00:32:44,520 --> 00:32:44,960
Cool.

374
00:32:45,080 --> 00:32:45,740
Any other questions?

375
00:32:51,720 --> 00:32:52,160
Yeah.

376
00:32:56,340 --> 00:33:00,260
One, considering turnover and all of that, how would you go about maintaining that

377
00:33:01,020 --> 00:33:01,460
?

378
00:33:02,060 --> 00:33:04,700
How would you go about doing that?

379
00:33:05,020 --> 00:33:09,100
And just with phishing, let's focus on that.

380
00:33:09,160 --> 00:33:12,060
Like keeping that line moving up and to the right as much as you can.

381
00:33:12,420 --> 00:33:15,120
Because after a while, I mean, let me break it.

382
00:33:15,240 --> 00:33:15,580
Sure.

383
00:33:15,660 --> 00:33:19,420
After a while, sending a bunch of them just makes people not support them.

384
00:33:19,800 --> 00:33:20,300
Or not trust.

385
00:33:20,300 --> 00:33:21,500
Sending a bunch of phishing e-mails, you mean?

386
00:33:22,160 --> 00:33:22,600
Yep.

387
00:33:22,800 --> 00:33:23,240
Yep.

388
00:33:23,300 --> 00:33:30,260
And I don't know about you guys, but, you know, if my organization could basically not trust e-mail, then that's really not going to happen.

389
00:33:30,280 --> 00:33:30,380
That's really tough.

390
00:33:30,920 --> 00:33:38,720
I noticed, like, in your program that you didn't retrain people that if you found an instance of e-mail for a live one.

391
00:33:39,440 --> 00:33:40,420
A live phish.

392
00:33:40,560 --> 00:33:42,640
So, yes.

393
00:33:42,980 --> 00:33:43,700
So that is true.

394
00:33:43,780 --> 00:33:50,640
And so the comment up here was in this particular program, we didn't do a lot of retraining for those that fell for the attack.

395
00:33:50,900 --> 00:34:00,180
So the way that we ended up approaching this is we do really frequent and we, you know, we, of course, vary our social engineering tests.

396
00:34:00,280 --> 00:34:01,940
Like phishing tests on a regular basis.

397
00:34:02,300 --> 00:34:10,680
And instead of forcing people into a negative situation where they have a negative correlation with the experiences that they have, so they fell for it, whatever.

398
00:34:10,920 --> 00:34:15,260
Like we'll actually reward some people if they fall for the social engineering test.

399
00:34:15,480 --> 00:34:25,640
And every time that they fall for it, we have a very small, like, mini touch point in the form of, like, a retrospective on, like, how they fell for it, what they fell for, something like that.

400
00:34:25,700 --> 00:34:29,660
Instead of going through a, you know, big bolt-on awareness test.

401
00:34:29,800 --> 00:34:30,260
And depending on that.

402
00:34:30,280 --> 00:34:36,480
Depending on how they respond to that, they may end up being candidates for the, like, the human firewall award.

403
00:34:36,880 --> 00:34:51,540
And going through it like that where we give them a positive association with interacting with our security team as well as receiving training, we found a lot better retention rates as well as just people feel better about engaging with us.

404
00:34:51,600 --> 00:34:54,520
They feel better about reporting because there's no shame in doing so.

405
00:34:54,960 --> 00:34:55,760
Things like that.

406
00:34:55,860 --> 00:35:00,260
So instead of thinking about it as training, we think about it, you know, more as, like, these small things.

407
00:35:01,000 --> 00:35:13,160
And then we'll encourage them to, like, a lot, I'm very big on trying to find proxies to go do my work for me because, you know, I don't have the amount of resources to just go do everyone's jobs and, like, make everything secure.

408
00:35:13,320 --> 00:35:20,320
So if I can find somebody else to go, you know, be a champion for me, be a proxy, then I'm going to go and do that.

409
00:35:20,540 --> 00:35:22,380
And that will also kind of boost their profile.

410
00:35:22,620 --> 00:35:23,600
It boosts my mission.

411
00:35:23,940 --> 00:35:24,560
Things like that.

412
00:35:25,080 --> 00:35:25,500
So, yeah.

413
00:35:25,740 --> 00:35:26,100
Yeah.

414
00:35:26,200 --> 00:35:29,480
So just to, like, put a, like, fine point on that.

415
00:35:29,480 --> 00:35:42,660
On the original question, in terms of, like, regular, like, trying to keep that line as high up and as far right as possible, you know, we rely really heavily on very small touch points.

416
00:35:42,840 --> 00:35:52,180
And as, like, using proxies as much as possible because if people are hearing it not from the security team, then, you know, they just have a better experience.

417
00:35:52,720 --> 00:35:58,580
And I found that, like, when people feel better about security, they're ultimately just going, like, they're going to interact with us more.

418
00:35:58,580 --> 00:36:00,980
And the more they interact with us, the better we end up being.

419
00:36:01,320 --> 00:36:01,590
Like, so.

420
00:36:02,860 --> 00:36:03,240
Yeah.

421
00:36:04,280 --> 00:36:08,640
I'd like to focus on the role aspect, particularly in a high-pressure situation.

422
00:36:09,520 --> 00:36:17,620
I've noticed that, in some cases, your C-suite types, your executive types or those, they will look at the security team and say, well, you work for me.

423
00:36:17,860 --> 00:36:18,200
Yep.

424
00:36:18,260 --> 00:36:19,080
I need this.

425
00:36:19,080 --> 00:36:19,780
I need this now.

426
00:36:19,880 --> 00:36:20,900
I need this password now.

427
00:36:20,960 --> 00:36:21,940
I need this access now.

428
00:36:22,000 --> 00:36:23,140
I need this to work this way.

429
00:36:23,300 --> 00:36:24,960
So bypassing these processes.

430
00:36:25,860 --> 00:36:27,100
How do you deal with that?

431
00:36:27,100 --> 00:36:27,460
Yep.

432
00:36:27,460 --> 00:36:28,560
So the question does come up a lot.

433
00:36:28,560 --> 00:36:32,280
And just to repeat was, oftentimes, C-suite people can be a little pushy.

434
00:36:33,220 --> 00:36:37,100
I don't know if anyone has ever experienced a CEO who demands something immediately.

435
00:36:38,520 --> 00:36:44,980
And they may look at the security team and say, you belong to me in some form or fashion.

436
00:36:45,100 --> 00:36:46,800
I control your budget, so make it so.

437
00:36:47,420 --> 00:36:51,280
And try to bypass those processes that you're putting in place.

438
00:36:51,980 --> 00:36:57,820
So one thing that we did is, let's say, for access control requests.

439
00:36:58,560 --> 00:37:03,660
We funnel everything through a Slack bot-based access control request and response process.

440
00:37:03,980 --> 00:37:21,400
And the way that the process is set up is that even if we wanted to, there is no, you know, without a huge amount of pain in the ass and we don't advertise it, there is no way to just manually bypass it through, you know, people shouting and crying and screaming and kicking on the floor and, you know, whatever else, whatever other tactics that may be resorted to.

441
00:37:21,600 --> 00:37:28,400
And so, you know, if we're not advertising any possible workaround and, like, basically the process.

442
00:37:28,560 --> 00:37:34,860
Is designed such that they have to funnel through it, then, you know, we've seen a lot more luck with that.

443
00:37:35,000 --> 00:37:39,740
And if we make the process really frictionless, then they have a lot less problem going through it.

444
00:37:40,680 --> 00:37:43,660
And so, like, it's not perfect.

445
00:37:44,040 --> 00:37:51,220
Of course, like, in any ways, you may still have a, you know, a potential backdoor around it or something.

446
00:37:51,460 --> 00:37:58,400
In that case, I might recommend that they get it, like, if it's something really sensitive, like a CIO.

447
00:37:58,560 --> 00:38:04,440
Or a CTO or something demanding a, you know, access to active directory or, you know, something to that effect.

448
00:38:04,640 --> 00:38:11,040
That there be a secondary sign-off at, like, a department head level or something like that where there has to be an interaction.

449
00:38:11,320 --> 00:38:22,320
And, like, I've instructed my team that, you know, for things like that, that they just cannot proceed without having some kind of, you know, some kind of documented sign-off.

450
00:38:22,360 --> 00:38:25,360
Where, you know, somebody is being a bad actor.

451
00:38:25,360 --> 00:38:29,940
Or they're just being kind of pushy and trying to, like, get people to fall in line.

452
00:38:30,160 --> 00:38:32,540
That they still have to go have a conversation around it.

453
00:38:32,600 --> 00:38:35,380
And, like, they're not to, they're just not to proceed otherwise.

454
00:38:35,800 --> 00:38:38,100
And the more that you can make that a technical control.

455
00:38:38,680 --> 00:38:42,640
For instance, with, like, you know, engineering guard rails.

456
00:38:43,200 --> 00:38:46,960
Like, you can't land code in master unless it checks, like, passes all tests.

457
00:38:47,280 --> 00:38:50,260
Like, finding the equivalence of that through these kind of workflows.

458
00:38:50,640 --> 00:38:55,000
The more you can do that where it's just impossible to bypass, the better position to be in.

459
00:38:55,380 --> 00:38:55,740
So.

460
00:38:57,600 --> 00:38:57,960
Cool.

461
00:38:58,040 --> 00:38:58,680
Any other questions?

462
00:39:01,440 --> 00:39:02,040
All right.

463
00:39:02,240 --> 00:39:02,780
Well, excellent.

464
00:39:02,880 --> 00:39:03,640
Thank you so much, everyone.