1
00:00:18,650 --> 00:00:22,490
Hello everyone, AfterPacket here.

2
00:00:22,490 --> 00:00:24,970
We have another great speaker for you today.

3
00:00:25,130 --> 00:00:32,970
We have Alan with FireNameVirus with a spreadsheet and we're very excited to have him.

4
00:00:32,970 --> 00:00:35,490
And with that, I will let Alan take it away.

5
00:00:35,530 --> 00:00:37,030
Thank you.

6
00:00:39,780 --> 00:00:42,100
Yeah, I'm Alan Baranov.

7
00:00:42,100 --> 00:00:43,860
I'm from Melbourne, Australia.

8
00:00:44,380 --> 00:00:49,100
Today I'll be taking you through a real life story that happened to me.

9
00:00:49,100 --> 00:00:50,480
Mostly real life.

10
00:00:50,900 --> 00:00:54,860
Names and places have been changed to protect the innocent.

11
00:00:56,040 --> 00:01:09,220
What we'll do is we'll start at the successful end and we'll rewind a couple of months back to see exactly what steps were taken by me and my team to ensure that everything worked out okay.

12
00:01:10,660 --> 00:01:15,580
Yeah, whole thing will be done in Excel because that's what we're on about.

13
00:01:16,600 --> 00:01:18,360
A bit about me.

14
00:01:18,500 --> 00:01:23,300
So I started off as a technical person about 20 years ago.

15
00:01:23,420 --> 00:01:33,420
Worked my way through firewalls and other kind of technical security controls and am now a GIC consultant.

16
00:01:34,200 --> 00:01:37,340
So yeah, that's where I am and who knows where the future will be.

17
00:01:37,340 --> 00:01:39,160
If you want to reach out to me, I'm A.

18
00:01:39,160 --> 00:01:43,860
Baranov or Alan Baranov on most social media.

19
00:01:44,740 --> 00:01:47,420
And yeah, let's take it away.

20
00:01:48,140 --> 00:01:49,000
All right.

21
00:01:49,000 --> 00:02:02,480
So on this slide, one of my friends who works in a Blue Team environment said I must definitely put a warning here because some of the stuff that we were about to talk about can be quite scary for Blue Teamers.

22
00:02:02,720 --> 00:02:07,020
So yeah, Tuesday, the 27th of June, 2017.

23
00:02:09,580 --> 00:02:16,200
I arrive into work and yeah, my boss Trevor was waiting for me.

24
00:02:16,200 --> 00:02:23,640
He was sipping on a milkshake, which was a bad sign for me because when he does that, that means it's going to be an interesting day.

25
00:02:24,460 --> 00:02:31,320
And he said that he just wanted to get in before the big people came to speak to me.

26
00:02:31,320 --> 00:02:37,100
So essentially the CIO and what they called the security board came in and said that they wanted to speak to me.

27
00:02:37,100 --> 00:02:40,560
I'm like, okay, I'm not sure what's going on, but okay.

28
00:02:41,120 --> 00:02:48,540
They took me into a meeting and they told me that there was something called MS17-010 and that it had been used.

29
00:02:48,540 --> 00:02:53,200
We didn't know what it was called just yet, but now it's got a name called NotPetya.

30
00:02:53,480 --> 00:03:02,300
It had taken down many of the Australian businesses and businesses around the world like Maersk and Merck and they were worried about our infrastructure.

31
00:03:03,440 --> 00:03:06,800
And they were worried that we were going to be brought down.

32
00:03:07,860 --> 00:03:12,260
And so could I actually get involved and help them out with that?

33
00:03:12,260 --> 00:03:14,220
So, yeah, that's all good.

34
00:03:17,460 --> 00:03:27,560
And so what actually happened in that was I went back to them and I said, listen, we've got no problems because we're fully patched.

35
00:03:27,560 --> 00:03:30,740
And they were like, they didn't believe me.

36
00:03:31,020 --> 00:03:32,500
And I said, okay, that's fine.

37
00:03:32,500 --> 00:03:33,000
No problem.

38
00:03:33,000 --> 00:03:34,900
I've got all the information in spreadsheets.

39
00:03:34,900 --> 00:03:39,240
I can show you how we've tracked the patching that we've done over time.

40
00:03:40,140 --> 00:03:48,720
And they were a bit impressed, but they're also a bit disappointed because I think they actually wanted to put up a bit of a fight against this piece of malware.

41
00:03:49,100 --> 00:03:52,140
But anyway, we were successful.

42
00:03:52,140 --> 00:04:00,720
And so now I want to take you back through a bit of the history before this as to how we got to this point, and I could actually say, yep, all good.

43
00:04:00,800 --> 00:04:03,560
That virus is not going to come anywhere close to us.

44
00:04:04,140 --> 00:04:05,160
All right.

45
00:04:05,160 --> 00:04:16,580
So, yeah, while I was working there, my manager, he came out with this idea that he wanted big monitors and he wanted us to look like NASA.

46
00:04:17,040 --> 00:04:24,320
And, well, yes, we had Pew Pew maps and all of that on there, but he also wanted to put some other information up there.

47
00:04:25,100 --> 00:04:28,880
And so, yeah, he got me to do that.

48
00:04:29,540 --> 00:04:33,460
And I actually coined the phrase security through big monitors.

49
00:04:33,460 --> 00:04:39,180
And I Googled this and there were no search results that came out for that.

50
00:04:39,560 --> 00:04:41,960
So, basically, I think I invented the term.

51
00:04:41,960 --> 00:04:43,780
So, if anyone wants to use it, you're welcome.

52
00:04:43,780 --> 00:04:45,460
You just need to pay me royalties.

53
00:04:46,860 --> 00:04:51,860
So, the first thing I decided that we'll do is put up some traffic lights.

54
00:04:51,860 --> 00:04:58,820
Because any time you have a manager and they want information, traffic light, all the things, of course.

55
00:04:59,080 --> 00:05:03,180
Because bosses like to be given pretty pictures to look at.

56
00:05:03,680 --> 00:05:16,980
So, what we did, yep, we came out and did a graph where we took all the patches, all the servers, sorry, all the patches, divided them by all the servers and, of course, got a lovely diagram.

57
00:05:17,420 --> 00:05:20,860
Some months we had more than 90% of patches applied.

58
00:05:20,860 --> 00:05:24,240
Some months we had less than that.

59
00:05:25,060 --> 00:05:28,040
And so, we tracked against the stats there.

60
00:05:30,240 --> 00:05:35,200
And, of course, because we're using traffic lights, you always want to make sure that you're in the yellow.

61
00:05:35,600 --> 00:05:38,780
Just basically because if you're in the red, that means you're not doing your job.

62
00:05:38,780 --> 00:05:41,960
And if you're in the green, it means that you've got way too much budget.

63
00:05:42,780 --> 00:05:46,660
So, that's... you've got to keep it in the yellow.

64
00:05:46,960 --> 00:05:50,780
Which is a what you're looking at now.

65
00:05:51,060 --> 00:05:54,280
If Microsoft release a lot of patches, you'll probably go into the yellow.

66
00:05:54,280 --> 00:05:56,780
If they don't release a lot of patches, you'll go into the green.

67
00:05:56,860 --> 00:06:00,980
If they release a lot, a lot of patches, then you might hit the red.

68
00:06:01,720 --> 00:06:04,720
So, you're tracking Microsoft and that doesn't really help you.

69
00:06:04,720 --> 00:06:06,980
It doesn't give you any direction of where to go.

70
00:06:07,780 --> 00:06:15,820
But some of the stuff that we were looking at at this time to try and improve the whole process is, is it really the total number of patches?

71
00:06:15,880 --> 00:06:17,380
Did we get them all right?

72
00:06:17,540 --> 00:06:19,120
Is it improved patches?

73
00:06:19,200 --> 00:06:22,020
Are there other servers that we could be looking at, et cetera?

74
00:06:24,520 --> 00:06:25,940
So, that was that.

75
00:06:26,460 --> 00:06:31,040
And then the other thing that... so, then what I did was I thought, okay, well, let's enhance it.

76
00:06:31,040 --> 00:06:34,580
Let's see if we can actually dig into the information a bit deeper.

77
00:06:35,040 --> 00:06:40,900
So, you'll see I've taken this kind of list of computers, total patches, installed patches.

78
00:06:40,900 --> 00:06:43,520
All in all, we came out 93.6%.

79
00:06:43,520 --> 00:06:45,320
Which is good.

80
00:06:45,320 --> 00:06:46,040
Which is great.

81
00:06:46,040 --> 00:06:47,160
Which gets us in the green.

82
00:06:47,160 --> 00:06:52,600
But if you have a look at the actual computers themselves, you'll see that there's some issues here.

83
00:06:52,600 --> 00:06:56,760
So, some of them are below what we're supposed to be having.

84
00:06:57,080 --> 00:06:59,260
Some of them are good.

85
00:06:59,260 --> 00:07:00,560
Most of them are good.

86
00:07:00,720 --> 00:07:04,000
But this one you'll see even is 76.5%.

87
00:07:04,000 --> 00:07:10,760
That may or never have received any patches in the lifetime of that server at all.

88
00:07:13,700 --> 00:07:15,420
So, it's good to do that.

89
00:07:15,540 --> 00:07:18,620
Because, of course, it gives us direction.

90
00:07:18,660 --> 00:07:20,300
Let me just go back to that one.

91
00:07:20,420 --> 00:07:23,120
So, it gives us direction as to where to go.

92
00:07:23,120 --> 00:07:24,420
So, we can see... oh, hang on.

93
00:07:24,420 --> 00:07:25,340
Most of these are okay.

94
00:07:25,340 --> 00:07:26,260
We can just leave them.

95
00:07:26,260 --> 00:07:27,560
They seem to be updating.

96
00:07:28,540 --> 00:07:29,500
Everything's fine.

97
00:07:29,540 --> 00:07:32,060
The two that aren't, we can fix that out.

98
00:07:32,060 --> 00:07:36,400
That might be just one month that just didn't quite work out properly.

99
00:07:36,400 --> 00:07:37,700
Maybe they just need to be rebooted.

100
00:07:37,700 --> 00:07:38,580
Who knows?

101
00:07:39,140 --> 00:07:40,460
So, you can sort those.

102
00:07:40,460 --> 00:07:50,420
And then the one that is getting no patches at all, that's the one where you're gonna want to concentrate and get everything sorted out.

103
00:07:51,780 --> 00:07:52,200
Yeah.

104
00:07:52,200 --> 00:07:57,700
So, I mean, I can talk about an hour on each one of these kind of slides.

105
00:07:58,560 --> 00:08:00,080
But unfortunately, I can't.

106
00:08:00,080 --> 00:08:05,860
But if anyone wants to catch me on the Discord, yeah, I'm available there.

107
00:08:05,860 --> 00:08:08,760
Or if you want to drop me a tweet, whatever, we can talk further.

108
00:08:09,000 --> 00:08:25,200
But essentially, the reason why I put this in here is, you know, once you've sorted out stuff, if you see that stuff is recurring, then you can do... you can check against it and see why it's happening and just keep on working through it.

109
00:08:25,200 --> 00:08:28,220
And over time, what you'll find is that you're actually improving.

110
00:08:28,220 --> 00:08:29,320
And that's a good thing.

111
00:08:29,320 --> 00:08:34,380
So, you're no longer tracking whether Microsoft has released too many patches for you to patch or not.

112
00:08:34,400 --> 00:08:39,480
What you're actually tracking now is how well are you doing and how well are you getting patched?

113
00:08:44,500 --> 00:08:45,180
Okay.

114
00:08:45,180 --> 00:08:57,160
So, what I just wanted to point out at this point is that a many-many-two relationship is actually a very difficult thing to get right.

115
00:08:58,300 --> 00:09:01,500
And we have one in this particular case.

116
00:09:01,500 --> 00:09:05,680
So, what we're looking at here is we have multiple servers, we have multiple patches.

117
00:09:05,900 --> 00:09:15,320
And if you have a case like that, then you need to start working out because it's too much information to try and work with all at once.

118
00:09:15,380 --> 00:09:20,460
So, you kind of summarize it down to, okay, how many servers do we have?

119
00:09:20,460 --> 00:09:20,600
Okay.

120
00:09:20,600 --> 00:09:21,400
These are the servers.

121
00:09:21,400 --> 00:09:21,560
Okay.

122
00:09:21,560 --> 00:09:23,160
And then, what patches are there?

123
00:09:23,420 --> 00:09:28,300
But you can get more interesting information once you start looking at the patches.

124
00:09:28,300 --> 00:09:33,040
So, you can have a look at whether they're a high, medium, or low-risk patch.

125
00:09:33,240 --> 00:09:36,120
And maybe you have different rules for each of those.

126
00:09:36,120 --> 00:09:41,760
So, now you're starting to get into understanding the information at an even higher level.

127
00:09:43,400 --> 00:09:48,160
And also, you can start looking at the actual ages of the patches.

128
00:09:48,580 --> 00:09:58,980
So, what you might do is you might say, okay, well, we haven't actually patched these patches here, but we're not expecting to because they only came out this month and we just haven't had time to test them.

129
00:09:58,980 --> 00:10:00,740
We haven't had time to apply them.

130
00:10:00,820 --> 00:10:03,520
And they're not critical that we need to do it immediately.

131
00:10:03,700 --> 00:10:06,400
So, that's okay that they haven't been patched.

132
00:10:06,400 --> 00:10:07,060
All good.

133
00:10:08,180 --> 00:10:11,400
You might have some that are one month out.

134
00:10:11,400 --> 00:10:14,220
And that's a problem because they haven't gone through.

135
00:10:14,220 --> 00:10:15,620
But at least you know that.

136
00:10:15,620 --> 00:10:17,560
And the next time you patch, okay, well, then that's fine.

137
00:10:17,560 --> 00:10:18,740
We'll patch them that time.

138
00:10:20,080 --> 00:10:25,640
You might then have a process... you might have it where the process has failed twice.

139
00:10:26,140 --> 00:10:28,520
And now you're going to have a bit of a problem.

140
00:10:28,520 --> 00:10:29,900
Why is your process not working?

141
00:10:29,960 --> 00:10:31,260
That's a bit of an issue.

142
00:10:31,800 --> 00:10:34,940
And then, of course, if it fails three times, then hang on a sec.

143
00:10:34,940 --> 00:10:36,180
Okay, now we have a huge issue.

144
00:10:36,180 --> 00:10:39,800
Because we've looked at it three times and we still haven't been able to work it out.

145
00:10:39,800 --> 00:10:44,900
Hopefully something is being worked out to get that sorted eventually.

146
00:10:47,360 --> 00:10:53,060
And now that you have that information, you have meaningful information that you can graph.

147
00:10:53,080 --> 00:10:58,160
And you can go back to doing the red, the yellow, and the green like a Ghana flag.

148
00:10:58,500 --> 00:11:00,140
And it actually means something.

149
00:11:00,140 --> 00:11:05,280
Because what you can say is, like, hang on a sec, where you see red is where our processes are failing.

150
00:11:05,280 --> 00:11:07,680
And we can actually start to work on that.

151
00:11:07,680 --> 00:11:10,200
And you can bring that down over time.

152
00:11:14,970 --> 00:11:15,970
All right.

153
00:11:16,010 --> 00:11:17,110
But wait.

154
00:11:19,090 --> 00:11:23,070
What about MS17010 from the beginning of our discussion?

155
00:11:25,870 --> 00:11:33,830
So what we were doing before this point was we were actually trying to patch all the different servers over time.

156
00:11:33,830 --> 00:11:35,550
We weren't looking at the patches, really.

157
00:11:35,550 --> 00:11:39,790
We were just looking at the servers and trying to patch server by server.

158
00:11:40,630 --> 00:11:47,750
And now, all of a sudden, you have this really bad vulnerability.

159
00:11:48,290 --> 00:11:52,010
It can be remotely attacked.

160
00:11:52,670 --> 00:11:57,850
And, yeah, it's just a very, very bad vulnerability.

161
00:11:57,850 --> 00:11:59,330
It came out bad.

162
00:11:59,330 --> 00:12:06,410
And then, of course, one of the things that Joshua Coleman came out with is something called H.D.

163
00:12:06,410 --> 00:12:12,430
Moore's Law, which is... it's basically a pun on Moore's Law.

164
00:12:13,210 --> 00:12:23,790
And essentially, what it is, is as virus... well, as vulnerabilities get easier and easier to exploit, they become more and more dangerous.

165
00:12:24,270 --> 00:12:36,570
And so what happened with this one is it slowly... I noticed that exploits were being built, theoretical exploits and real exploits and metasploits.

166
00:12:36,730 --> 00:12:43,550
And then I saw that and I thought, oh, okay, this thing is going to become a worm in the not-too-distant future.

167
00:12:44,450 --> 00:12:57,540
So going back into this slide here, as I said, many-to-many relationships are not good because they bring in complexity.

168
00:12:57,560 --> 00:13:08,140
But sometimes they are good because now we can actually pivot and we can say, okay, well, we were looking at servers and how many patches we had running on the different servers.

169
00:13:08,440 --> 00:13:19,240
Now, we can actually go back and we can say, okay, well, now let's look at this one single patch and how many servers have this patch installed on it.

170
00:13:22,730 --> 00:13:32,110
And so if we work out that information, we can see, okay, well, these servers, A, B, C, D, E, G, A, N, H, have the patch installed.

171
00:13:32,350 --> 00:13:36,290
And then these three computers have the patch missing.

172
00:13:36,350 --> 00:13:37,610
Now, remember, we're also using...

173
00:13:38,530 --> 00:13:47,710
so the reason why we've got so many computers that actually have it patched is because we're going through the computers and we will attack the critical patches while we're doing it.

174
00:13:48,010 --> 00:13:51,890
And also at the same time, we were looking for computers that were missing.

175
00:13:52,150 --> 00:13:57,230
So we actually managed to get all the computers and got them mostly patched.

176
00:13:57,230 --> 00:14:02,330
And then, hang on, these three, for some reason, just don't have this one single patch.

177
00:14:02,570 --> 00:14:04,070
And it could be that they're new computers.

178
00:14:04,070 --> 00:14:06,630
They just haven't had patches applied at all ever.

179
00:14:07,090 --> 00:14:10,490
And so therefore, boom, we can just basically apply the patch.

180
00:14:11,590 --> 00:14:13,330
And so that's what we did.

181
00:14:13,330 --> 00:14:15,090
And that's why we were successful.

182
00:14:15,090 --> 00:14:20,530
So essentially, we built the information over time and got to this point.

183
00:14:20,530 --> 00:14:27,790
And then we managed to flip it and managed to change our processes.

184
00:14:28,050 --> 00:14:29,790
So there's a couple of takeaways.

185
00:14:29,910 --> 00:14:31,250
Well, there's more than a couple of takeaways.

186
00:14:31,250 --> 00:14:34,330
There's a few takeaways that I'd like to show you here.

187
00:14:34,930 --> 00:14:36,510
Number one, get information.

188
00:14:36,510 --> 00:14:38,530
There's always information out there.

189
00:14:38,770 --> 00:14:45,270
The information I got directly from the Microsoft guys, they just basically pulled it out and sent it my way.

190
00:14:45,270 --> 00:14:47,430
Raw information, stick it into Excel.

191
00:14:48,150 --> 00:14:54,130
And then number two, play with it, manipulate it, move it around, experiment, keep changing it.

192
00:14:54,330 --> 00:14:55,370
It's low risk.

193
00:14:55,370 --> 00:14:59,910
You have no issue with playing around with information.

194
00:14:59,910 --> 00:15:01,090
It's all in your spreadsheet.

195
00:15:01,090 --> 00:15:01,950
It's all good.

196
00:15:02,710 --> 00:15:04,610
Number three, use it to improve things.

197
00:15:04,610 --> 00:15:08,670
Try and say, okay, well, hang on a sec, our processes need to be improved or not.

198
00:15:08,770 --> 00:15:11,870
Do we know or don't we know?

199
00:15:11,930 --> 00:15:19,450
And then, of course, get the information that will tell you exactly what you need to know, whether your processes are working or not.

200
00:15:20,250 --> 00:15:21,290
Always ask why.

201
00:15:21,290 --> 00:15:22,750
Don't just fix stuff.

202
00:15:22,750 --> 00:15:24,910
Work out, why was it broken in the first place?

203
00:15:24,910 --> 00:15:29,710
Because if it happens again, you'll know and you'll be able to fix it up.

204
00:15:31,150 --> 00:15:34,530
Also, just note that you don't need expensive tools.

205
00:15:34,530 --> 00:15:35,630
We have Excel.

206
00:15:35,730 --> 00:15:37,550
And that's all I used.

207
00:15:37,570 --> 00:15:45,570
So, basically, that was... I didn't have to go out and buy anything, any special tools or anything.

208
00:15:45,570 --> 00:15:46,790
I had it already.

209
00:15:46,790 --> 00:15:50,390
All I needed was the information and some of my time to get it working.

210
00:15:51,530 --> 00:15:53,250
WSSZ Excel was free.

211
00:15:54,230 --> 00:15:54,830
Yeah.

212
00:15:55,050 --> 00:15:55,610
Okay.

213
00:15:55,610 --> 00:15:56,070
Yeah.

214
00:15:56,070 --> 00:15:58,010
So, doing security right is hard.

215
00:15:58,010 --> 00:15:59,510
There's no easy wins.

216
00:15:59,730 --> 00:16:03,390
So, it looks easy from what I've shown you here.

217
00:16:03,390 --> 00:16:06,270
But there was a lot of hard work behind the scenes.

218
00:16:06,290 --> 00:16:19,770
Once I got the information in place, sitting with the IT team and getting them to patch and repatch and get it right and research and find out what was going wrong, there was a lot of work.

219
00:16:19,770 --> 00:16:34,430
The one thing that I could point out at this point now is that having that extra good information that I could give to them made them more excited about the job that they were doing.

220
00:16:34,430 --> 00:16:40,830
It wasn't me just coming as a security person and saying, listen, you need to patch your servers because patching servers is a good thing to do.

221
00:16:40,990 --> 00:16:48,410
It was me coming to them and saying, hey, this computer, it doesn't seem to be working, doesn't seem to be getting its patches.

222
00:16:48,870 --> 00:16:50,930
Can you work out why that is?

223
00:16:51,030 --> 00:16:56,310
And then they come back to me and say, listen, this is the story and we can actually sort it out and fix it.

224
00:16:56,310 --> 00:17:00,350
So, that's what comes out of having the information.

225
00:17:00,350 --> 00:17:04,410
It makes life a lot easier for you and for your IT team.

226
00:17:07,130 --> 00:17:10,250
And, yeah, as I said, work with your teams.

227
00:17:12,070 --> 00:17:16,430
Yeah, you can say, okay, well, if you're asking why, can you help them?

228
00:17:16,430 --> 00:17:21,130
A lot of times they would come back to me and say, listen, I have no idea why this isn't working.

229
00:17:21,190 --> 00:17:26,390
And we dig in the history and we can see, okay, well, it patches sometimes, sometimes not.

230
00:17:26,390 --> 00:17:28,550
There must be something strange with that box.

231
00:17:28,650 --> 00:17:30,550
Or it's never been patched before.

232
00:17:30,550 --> 00:17:35,050
And then you can work out stuff like maybe there's a firewall in the way, et cetera, et cetera.

233
00:17:36,370 --> 00:17:37,850
Keep digging deeper.

234
00:17:38,310 --> 00:17:45,770
So, as I showed you, the first things we were monitoring were just like the total number of patches across everything and divided by the total number of computers.

235
00:17:46,270 --> 00:17:49,050
And it didn't really tell us very much.

236
00:17:49,050 --> 00:17:53,970
It didn't give us a good, deep amount of information that we could work with.

237
00:17:54,630 --> 00:17:56,570
And usually that information's there.

238
00:17:56,570 --> 00:17:58,810
You're just not looking at it.

239
00:17:58,810 --> 00:18:00,870
So, always keep getting more information.

240
00:18:00,910 --> 00:18:04,210
And don't be scared to get information from two different places.

241
00:18:04,770 --> 00:18:12,130
Like, for instance, what I was saying earlier is you want to... we had all the computers that we knew about.

242
00:18:12,310 --> 00:18:16,350
But when I found some other lists of computers, those were different.

243
00:18:16,350 --> 00:18:18,650
And then the question is, well, why are they different?

244
00:18:19,170 --> 00:18:27,050
And then that helps you to actually get a more... a bigger understanding of your total...

245
00:18:27,850 --> 00:18:30,550
the total issue that you need to deal with.

246
00:18:31,850 --> 00:18:33,990
And number 10, don't be scared to change your process.

247
00:18:33,990 --> 00:18:35,250
So, we had a good process.

248
00:18:35,250 --> 00:18:40,890
We were getting... we were making leeway against what we had to do.

249
00:18:41,570 --> 00:18:44,790
So... sorry, making headway against what we were trying to do.

250
00:18:44,790 --> 00:18:47,270
So, we were getting our servers patched.

251
00:18:47,270 --> 00:18:48,630
And we were getting more servers patched.

252
00:18:48,630 --> 00:18:53,290
And the lines were coming down because less and less critical patches were missing.

253
00:18:53,290 --> 00:18:55,770
Less and less non-critical patches were missing.

254
00:18:55,990 --> 00:19:04,230
But then when all of a sudden I saw that there was one patch that was really, really important that we really needed to get out of the way, changed everything.

255
00:19:04,230 --> 00:19:04,470
Okay.

256
00:19:04,470 --> 00:19:05,390
This is the one.

257
00:19:05,390 --> 00:19:07,110
This is what we need to sort out first.

258
00:19:07,110 --> 00:19:12,390
Everything else needs to take... we'll get to that.

259
00:19:12,390 --> 00:19:13,610
We'll get to it eventually.

260
00:19:13,710 --> 00:19:15,910
But this is what we need to get right now.

261
00:19:18,330 --> 00:19:20,010
And, yeah, next steps.

262
00:19:20,010 --> 00:19:24,490
So, if you're interested in this, the next step for you would be get your information.

263
00:19:24,490 --> 00:19:25,930
Go find where you can get it from.

264
00:19:25,930 --> 00:19:27,330
Get CSVs.

265
00:19:27,330 --> 00:19:28,530
Get some JSON.

266
00:19:28,530 --> 00:19:29,510
Get text.

267
00:19:30,150 --> 00:19:31,370
And convert it.

268
00:19:31,370 --> 00:19:33,230
Put it all into Excel.

269
00:19:33,230 --> 00:19:34,590
Start fiddling with it.

270
00:19:34,590 --> 00:19:36,870
Learn how to join the sources together.

271
00:19:36,870 --> 00:19:38,470
Learn how to use pivot tables.

272
00:19:38,470 --> 00:19:39,890
Learn how to use graphs.

273
00:19:40,110 --> 00:19:41,030
And play.

274
00:19:41,030 --> 00:19:44,490
And play and play until you get the information that you need.

275
00:19:45,110 --> 00:19:46,710
Just, yeah.

276
00:19:47,610 --> 00:19:48,530
You're a hacker.

277
00:19:48,530 --> 00:19:54,650
So, use your hacking ability to work with Excel.

278
00:19:55,390 --> 00:19:56,890
And that's pretty much it.

279
00:19:56,890 --> 00:20:06,690
Just a shout out to my Baranoff clan and to the DEF CON group of Melbourne.

280
00:20:07,050 --> 00:20:08,250
Hey, guys.

281
00:20:08,250 --> 00:20:10,530
Also to the Australian B-Sides team.

282
00:20:10,530 --> 00:20:12,470
B-Sides Melbourne.

283
00:20:13,490 --> 00:20:20,270
And, yeah, to all of you that are there taking your time out to watch this presentation, thank you very much for that.

284
00:20:20,810 --> 00:20:25,710
And thank you very much to the DEF CON team and to the Blue Team Village for having me.

285
00:20:25,970 --> 00:20:31,790
It's a great honor to be able to speak in this forum.

286
00:20:32,290 --> 00:20:36,270
And, yeah, if there's anyone that does have any questions, I'm not sure.

287
00:20:36,270 --> 00:20:38,310
There might be a bit of time left.

288
00:20:38,310 --> 00:20:47,470
Alternatively, just find me in other DEF CON, the DEF CON Discord or alternatively in the Blue Team Village Discord.

289
00:20:47,470 --> 00:20:49,990
And, yeah, I'll answer any questions that you have.

290
00:20:50,250 --> 00:20:51,430
Thank you very much.

291
00:20:51,550 --> 00:20:52,130
Awesome.

292
00:20:52,130 --> 00:20:55,010
Thank you for the wonderful presentation, Alan.

293
00:20:55,510 --> 00:21:06,430
As always, we suggest that you join the Blue Team Village Discord and direct your questions to texttalktrack1.

294
00:21:06,650 --> 00:21:08,630
Okay, I will do for sure.

295
00:21:09,050 --> 00:21:13,870
The presenter will take a look and be able to answer your questions.

296
00:21:14,570 --> 00:21:19,210
And other than that, I appreciate that and thank you again.

297
00:21:19,490 --> 00:21:20,410
Thank you.