start	end	text
1550	7790	Welcome. Today I'm going to tell you a story about things that I learned about incident response
7790	14890	by being a firefighter. Let's get to it. Here's the agenda, what we're going to cover.
15070	19470	I'm going to start with a little introduction about myself, tell you a little bit about my
19470	25250	background in IR, and I'm going to tell you a little bit about myself as a firefighter.
25350	30570	Then we'll delve into what IR is. For those of you who don't know what IR is,
30730	34230	and then we'll talk a little bit about firefighting, because even though you might
34230	39990	know what IR is, you might not be familiar with firefighting beyond, obviously, putting out the
39990	46570	fire. Then we'll do some comparisons between IR and firefighting. Definitely some similarities
47210	52630	and some differences, of course. Then I'll describe some challenges and opportunities,
52630	57490	the things that I learned from being a firefighter that I then brought back to IR.
58210	64710	I'll summarize and then end with some final thoughts. Let's get going.
65590	71720	All righty. So, for those of you who are not familiar with me, my name is Catherine Allman.
72070	78510	I go by Investigator Chih on the internet, in the Twitter-verse, and I've been with the
78510	84550	University of Buffalo for over 20 years. I'm on staff with B-Sides Rochester and a cyber camp
84550	89190	that we hold. I volunteer with some staff. I've spoken at a bunch of conferences. I have some
89190	96170	certifications and a couple degrees. Even those of you who know me from the IT realm may not be
96170	101790	familiar with this information about me as a firefighter. I've been in the fire service since
101790	108410	about 1997, and since then I've become a state fire instructor with New York State. I've done
108410	113790	some credits, college credits, on firefighting. I was a certified fire investigator at both levels
113790	120030	in New York State, and I was also a member of the J-Fire team. So, the fire thing is something I've
120030	128110	been doing a long time. Just in case you're still not convinced, this is me at the scene of a fire,
128110	132770	and this is part of the story that I'm going to tell you. I'm holding what's called a thermal
132770	138490	camera. When you look into a thermal camera and you point it at something, what it's going to show
138490	145030	is a difference in temperature. So, things that are darker are usually cooler in temperature,
145030	150490	and things that are warmer are going to be are going to show up as lighter in color.
151050	155730	We'll see why that matters later. And just in case you weren't sure,
155730	159310	I'm the one with the camera, and the person to my right is our captain.
160390	167070	So, now let's delve into what incident response is. I like this definition of incident response
167070	173070	because it focuses on the technical components that you're going to need to analyze and contain
173070	178730	an incident. We'll see in a bit why that's a little different from incident handling.
178730	182450	So, you're going to be the boots on the floor person. The person who's actually focused
182450	187570	on dealing with this incident directly. You're going to address network events.
187730	192790	You might deal with them in a reactive or a proactive way, depending on your organization.
192790	199630	And an event can be anything that's going to affect the CIA triangle. Your confidentiality,
199630	206710	integrity, and availability of information. The goals of incident response are going to
206710	212330	be to make sure you know when there is, in fact, an incident or, you know, some kind of
212330	217230	thing going on. You're going to stop that attacker. You're going to minimize the damage
217230	222730	that is caused. And ultimately, you want to prevent it from ever happening again
222730	229370	or something similar from happening. These are your basic phases of incident response.
229370	235070	Preparation, identification, containment, eradication, recovery, and lessons learned.
235310	242030	Let's break these down a little bit. Preparation. So, during the preparation phase,
242030	248430	we're going to document, document, document. You want to document both your network itself.
248450	253250	You might want to document the particular machines in question. One of the most important
253250	257670	things you'll want to document is where your important data is, right? Where are the keys
257670	263290	to the kingdom? That's critical. You might do some tool building. Perhaps to help you
263290	268790	respond better to an incident. Or perhaps to help you know when something is happening that
268790	275290	shouldn't be. Then the next step is going to be awareness of the attacks. And ultimately,
275290	281070	this could be something as simple as an automated ticket system that tells you that there's a
281070	287310	problem. Could be from a phone call. Your containment phase, you want to stop whatever
287310	293570	is happening. So, that might be patching a system, blocking some sort of C2 connection,
293570	299730	maybe pulling the power out of the back of a machine. Depends. Then during the eradication
299730	304110	phase, you're ultimately going to remediate. You're going to remove compromised hosts from
304110	309750	your network. Whatever it is you have to do to get them to get the bad guys gone.
310490	315550	During the recovery phase, you need to restore those business functions. Because, of course,
315550	321070	that is the whole point of incident response initially, is to get up and running again.
321070	326130	Then you want to learn from exactly what happened so that the same thing doesn't happen again.
327650	332790	Here we have incident handling. You'll notice it's a little different. It focuses on the other
332790	338190	things that are important in an incident. The logistics, communication, the coordination,
338190	343950	planning, all of these other functions. And ideally, you want these two things to be separate.
344570	350070	Now, I understand in smaller organizations, you might be the only person doing this job.
350070	354870	You might have to do both. But if you're the person whose boots on the ground and you're
354870	362250	working on containing an incident or eradicating the attacker, you don't also want to have to be
362250	367210	the person who's communicating out every five minutes what's going on. So, if you have somebody
367210	374570	else doing that, it's a whole lot easier to focus on what's at hand. Now let's move to firefighting.
374570	380290	What is firefighting? Well, it's the obvious. We're going to put the wet stuff on the red stuff,
380290	386490	as they say. We're going to prevent the spread and extinguish significant unwanted fires. So,
386490	391870	you know, not your backyard barbecue unless it's out of control. And we'll do that for buildings
391870	398930	and vehicles, woodlands, that sort of thing. Our goals, as you might expect, are to protect the
398930	405290	health and safety of ourselves and of the public. We're also going to protect property and the
405290	410690	environment. Just because we're in the process of putting a fire out doesn't necessarily mean
410690	416690	we want to make things worse, right? So, for example, if we have a situation that might
416690	421390	involve hazardous materials, we need to make sure that we're doing our best to prevent that from
421390	428210	making the situation worse. And we want to minimize, excuse me, the disruption of community activities.
428930	435230	Great example of that would be a car fire or a car accident. You have a lot of people who are,
435230	439170	say, trying to get to work in the morning or trying to get home. And if one of those things occurs,
439170	444890	we need to set up traffic support to help you still get from place to place and minimize any
444890	451450	disruption while we're taking care of the particular incident. We, too, have a preparedness cycle.
451450	455830	It looks kind of like this. We'll do some preparing. Then an emergency will happen.
455830	461550	We'll respond to it. We're going to recover from it. We'll mitigate where we can. And we're
461550	467910	back to preparation. Now, in this preparedness cycle in the fire service, we usually start more
467910	475430	on the mitigation side. And let me show you how and why. So, mitigation for the fire service has
475430	480250	to do with preventing future emergencies or minimizing their effects. So, if you've ever
480250	486610	been to any kind of, say, fire department open house where they're doing fire safety demonstrations,
486610	491830	they're handing out smoke detectors, right? That's a mitigation. We want to see if we can
491830	497370	help people understand how to prevent fires and accidents in the first place. Sprinklers in a
497370	503150	building are another great mitigation method. Preparedness. We need to be prepared to handle
503150	507490	that emergency. So, we're going to make sure our gear is maintained, that we're drilling so we know
507490	512050	how to use the equipment on the truck, that we have pre-plans of the building. Perhaps there's
512050	518370	something unique about accessing certain parts of the building or getting people out if necessary.
518490	523210	And then recovering. When we recover from an emergency, we're going to clean up. We're going
523210	528410	to restore things to their functional purpose again. We're going to repair equipment that
528410	535670	might have been damaged. This is pretty standard for us. So, here's the next part of the story.
535670	541550	You saw me looking at the camera, right? This is the same fire. Two more pictures from this fire.
541910	549590	The one on the left has me, if you probably can't tell because my name's not on my coat, but that is
549590	556470	me. And what I'm attempting to do in that picture is change out an air bottle. The way firefighters
556470	562330	breathe inside a building that is on fire is we wear something called self-contained breathing
562330	572090	apparatus. And that's made out of a harness and a bottle and some other pieces that help redirect
572090	579430	airflow. Needless to say, there are several components. My job on the left-hand side is to
579430	586570	change the air bottle. Your average air bottle is about 30 minutes, 45, which can go very quickly if
586570	592730	you're working hard in a scene. And when a firefighter runs out of air or starts to run out of air,
592730	598350	they come out and they ask somebody to change that bottle. So, that was my job at this fire. I was
598350	603730	changing bottles for the people who needed them. If you look in the picture on the right-hand side,
603730	608890	you'll get at least a small idea of what that bottle and harness setup looks like, because you
608890	613810	can kind of see the top of the bottle. What I want you to focus on in that right-hand picture
614630	621530	is the fact that the firefighter's shoulder has a lot of damage. If you look carefully,
621530	627690	you will see there's actually been flame and heat impingement to that shoulder area.
628350	636430	What I didn't realize when I was changing that bottle is that it was not just his coat that had
636430	643790	been damaged, but in fact the harness that holds the bottle and the air hoses that connect to it.
644470	649810	So, I go to change that bottle, and unfortunately when I put the new bottle back in and connect it
649810	657030	all up, I get hit with a blast of air in the face. Fortunately for me, I was wearing my gear correctly,
657030	663990	there was no damage, and ultimately I instructed the firefighter to take the pack and make sure
663990	671250	that it went out of service. Now, why is this important? Nobody got hurt, it wasn't a really
671250	678490	huge deal, nothing bad ultimately happened. We'll get back to that. So,
678490	683750	pay close attention to that picture, think about that story, and remember here, I was just doing
683750	690410	my job. All right. So, one other piece of terminology in the fire system that's really
690410	696290	important to understand is the incident command system. And it's this idea of an organized response
696290	703590	to a problem. You're going to have a coordinated response with potentially multiple agencies,
703590	711030	you need some way to organize that chaos, right? Such that everybody knows what they're doing and
711030	716430	what their job's supposed to be. If you've been in the military before, you're probably familiar
716430	721230	with chain of command. Obviously, if you're in law enforcement, that's something else you're
721230	727310	familiar with. Not dissimilar idea. This is what forms our effective chain of command.
728790	732850	So, here's what the incident command system looks like. And we're not going to spend time looking
732850	737470	at all of this. But you'll see the incident commanders at the top, typically going to be
737470	742750	one of your chief officers. And at the bottom, you're going to have operations and planning,
742750	748090	logistics, finance. And in between, you'll have some other folks who report directly to the
748090	753290	commander. What's important to note here is that the incident commander doesn't have a ton
753290	758750	of people reporting directly to them. And the reason is, it makes this whole situation
759450	766130	way more manageable. So, let's look at the pieces that are most often in smaller incidents.
766810	772450	So, you have your incident commander. They're going to define what the goals and the objectives
772450	776670	are for that particular incident. Again, usually your chief, or it might be a senior officer if
776670	784230	no chief is available. And then you'll have operations. Operations is often the person who
784230	790850	is in charge of making sure that those goals and objectives get met by figuring out what the
790850	795830	strategy and the tactics are going to be. We sometimes have external operations and internal
795830	801190	operations. If it's a large building, we might have operations on multiple floors. So, we might
801190	808650	have operations for the first floor. We have a high-rise facility and sometimes we need
808650	815550	multiple levels of operations. So, that's not uncommon. The last three here, logistics planning
815550	822110	and admin finance, are more common in very, very large incidents. When you need to have lots of
822110	827010	people and extra supplies and equipment brought in. If there's going to be a long-range plan,
827010	832670	something like a hurricane hits and we have to mobilize troops or demobilize them quickly,
832670	837070	that's going to be on the part of planning. And then if we need some kind of licenses or deal
837070	842450	with compliance issues, get some money together, whatever, that's where admin and finance is going
842450	848790	to come in play. All right. So, let's do a comparison of the two and kind of see,
848790	856770	I think you'll find it interesting to see how they do compare. So, methodology-wise,
857010	862190	I think you've seen they're very, very similar, right? The only thing that was really missing
862770	868270	from the firefighting circle were the lessons learned. And I'll tell you, even though it's not
868270	873930	officially part of the methodology, if you are good at what you do as a firefighter, you absolutely
873930	879110	pay attention to lesson learned. So, I would say that these really, in terms of their functionality,
879110	884970	are really very similar. But let's talk about some misconceptions.
885830	890890	In incident response, there's this idea that every event is an incident. Well, that's certainly not
890890	896850	the case. You can have an event where something is, you know, changed, but it's not necessarily
896850	902410	an incident on the part of the particular organization you're with. And not every
902410	908370	incident is handled the same way, right? I mean, certainly a small incident involving maybe
909010	912630	one social security number is going to be different than an incident involving
913290	919290	a hundred social security numbers or a thousand. Every incident is quickly solved. Well, we know
919290	924870	that's not true. We can have an incident that's really fast, maybe gets resolved in 10 minutes,
924870	929930	and it could take one that takes days, weeks, months. It can be a really long time, depending
929930	934090	on how big the incident is. If law enforcement is involved, it can be even longer than that,
934090	939730	depending on what court cases and all the other details play into it.
940310	945590	This is, I think, one of the most important ones. There's this idea that every person on an incident
945590	950630	response team needs to be a rock star. Well, that's not true. I'm not a rock star. I'll tell
950630	956250	you that right now. And as new people come into this field, we shouldn't expect them to be rock
956250	963590	stars either. We can all learn from each other. Another thing that's a misconception in IR is this
963590	971170	idea that we can accurately attribute whatever's happened to a particular entity. It's hard enough
971170	977430	to, you know, figure out attribution at all, but to do it accurately is even harder. Likewise,
977430	982810	in firefighting, we have some misconceptions. How about this idea that firefighters are always paid?
983050	987510	How many of you know that there are tons of firefighters around this country
988250	994270	that aren't paid? I'm one of them. I've been a volunteer firefighter for many years.
994270	1001450	I've never, ever earned a dime from firefighting. And yet, I still love it. It's a fantastic hobby
1001450	1006810	and one that I wouldn't trade for anything. There's also, from television especially, this
1006810	1012450	idea that firefighters are big tough dudes. Well, I know you can only see my floating head, but guess
1012450	1019690	what? I'm not a big tough dude. Never was, never will be. We also don't fight fires the same way
1019690	1025170	every time. Again, yes, we put the wet stuff on the red stuff, as one of my fire instructors
1025730	1033430	has said, but we don't do it the same way. Maybe we need to do a search and rescue first. Maybe
1033430	1038010	the building has partially underground. There are all sorts of challenges with the situation
1038010	1045050	that don't allow us to do the same exact thing every time. Certainly, there's this idea that,
1045050	1049770	you know, fires get extinguished quickly, especially, again, on television shows,
1049770	1056630	but it can take days. And in large, really large situations, it can take longer than that.
1056770	1062570	Just depends. Maybe, maybe all you need is a water can and it's a little bit of burning mulch.
1062570	1068890	That's extinguished quickly, but not all of them. And definitely not a full-time job,
1068890	1074070	because that's not my full-time job. My full-time job is incident response.
1074130	1081030	But we'll see, they're pretty similar things in some ways. First, we'll talk about the differences.
1082070	1087590	So, in terms of incident response, it rarely involves life safety, except in the universe
1087590	1093090	of healthcare. If you work in healthcare, you absolutely can be the difference between life and
1093090	1098630	death in some of the incident response situations you might wind up in. Patient records are critical.
1099210	1102990	Ideally, there are things in place to prevent that from being, you know,
1102990	1109590	catastrophic. But in the rest of the world, despite what everyone would have you believe,
1109590	1115230	life safety isn't usually the issue. That's important to remember.
1116090	1121310	Certainly, IR teams typically get paid, and as I already mentioned, firefighters, not so much.
1121790	1129010	We use computers and software for our day-to-day job. And while firefighters also sometimes use
1129010	1135170	computers in certain capacity, they use mostly water, foam, chemicals, hoses, and show up in
1135170	1140090	special vehicles, like fire trucks. Most of us doing IR, drive whatever we want, doesn't really
1140090	1144810	matter. Obviously, if you're in an organization like law enforcement, well, you might have different
1144810	1150430	experience. And we wear special gear as firefighters. I'm not going to show up at a fire
1150430	1156790	in just a t-shirt and shorts. I'm certainly going to put on my gear, right? So those are some
1156790	1164210	differences. Now, here's where they are similar. In both cases, we're going to focus on that
1164210	1170130	immediate issue first and find that cause later. We need to put that fire out. We need to stop that
1170130	1177110	attacker. We'll deal with attribution and the cause later. We're also going to use triage to
1177110	1182070	determine the best course of action. If you're not familiar with triage, it's this idea that
1182070	1187470	when you have more than one thing to consider, you're going to decide which of those things is
1187470	1194510	most critical. So what most people are familiar with in terms of triage is a situation where
1194510	1201430	there's been a motor vehicle accident and you have multiple people who are injured. You might
1201430	1209130	have somebody who just has a bump on the head. You might have somebody who maybe is beyond saving.
1209130	1214210	And you might have somebody who's serious, but with the right interventions could easily be
1214210	1220290	saved. And looking at all those details, you have to decide which one to treat first.
1220290	1225710	Fire situations are exactly the same thing. You're going to want to take a look at the facts
1225710	1231970	and make some decisions about what to do first. Ideally, you've pre-planned that,
1231970	1236390	but we'll come back to that. They're cyclic in nature, both of them. We've seen that already,
1236390	1242150	right? And they both require some pretty interesting thinking outside the box.
1242330	1246930	In incident response, sometimes we use tools that we might use for other things
1247610	1255590	to try to get information for the response. And in firefighting, we do the same kinds of things
1255590	1260270	in the sense that, for example, I have a friend who's a firefighter in my hometown
1261430	1268610	who had a patient on a multi-story building who was very large and they didn't have equipment
1268610	1272970	that would easily facilitate getting him out of the building where he was.
1272970	1280090	So he went to the local hardware store, got some equipment, and built something to get this
1280090	1285190	individual out of where he was stuck. Thought outside the box, didn't just use the equipment
1285190	1292250	he had, worked with other things that he was able to get a hold of. In both cases, we often
1292250	1296830	bring in outside entities. Firefighters rely heavily on mutual aid, bringing in other fire
1296830	1302630	departments as necessary or perhaps specialty teams. We do the same thing in incident response.
1302630	1307990	While I do incident response for the university, we might need another team if something were
1307990	1312970	significantly serious enough to come in and help us. Maybe if it's a large enough incident,
1312970	1319010	maybe if it's a certain kind of incident. And sometimes in both cases, there are inside teams.
1319030	1324450	So again, I'm inside at the university and there are companies that have inside
1324450	1328870	firefighting teams because they're a manufacturing organization that's large enough.
1330010	1334750	So now let's talk about the things I've learned from being a firefighter that I think are relevant
1334750	1341550	to IR specifically. I'll start with this first challenge, tunnel vision. This is an idea where
1341550	1347670	we focus exclusively on one particular thing instead of seeing that big picture, right? And
1347670	1354890	we make bad decisions when we do that. Think back to that image, the two images of me changing out
1354890	1362590	that air bottle for the firefighter and his burn coat. This is an example of tunnel vision. I'm
1362590	1369550	focused on doing my job. That's all I'm doing. And frankly, I could have gotten really hurt here
1369550	1377450	because of tunnel vision. I wasn't taking a step back in my head and looking at the bigger picture.
1377450	1383510	I was just focused on the task at hand. Here's another example from firefighting.
1383510	1390150	Look carefully at those cones. Pull up to the fire, get off the fire truck, and this is what you see.
1390650	1396950	What are those cones protecting? At first glance, you see a fire hose. No big deal. So maybe you're
1396950	1402210	going to use that hose. You're going to help with the fire out. Maybe you're going to bring a piece
1402210	1408330	of gear to the other person if you look carefully who's standing at the door. If you look more
1408330	1415550	carefully, you may or may not see there is actually a live power line that those cones
1416310	1422130	are actually trying to protect you from. And if you go rushing into the scene because you're so
1422130	1428690	focused on putting the fire out or getting the gear that somebody needs, you could get really hurt.
1428930	1434850	We have the same kind of thing in IR. We need to consider whether or not a scene is safe.
1434850	1440130	In many cases, sure, it might be, but it depends. It depends on the situation.
1440330	1447270	The picture that I'm showing you below is of a server room that has asbestos. If there's an issue
1447270	1453230	in a server room with asbestos, you don't want to go running in there. Consider if somebody tells
1453230	1459190	you that you have a malware situation and you get focused on that, but it turns out it's just
1459370	1465990	a misconfiguration. Or maybe you do blind hardware acquisition, so you go running in and you grab
1465990	1474410	drives, but that machine you find out later was powered on and was running encryption and now you
1474410	1478710	don't have the keys anymore because all you've done is grabbed hardware. You haven't thought
1478710	1485970	about it. Maybe you were told that a situation involved ransomware and you're worried now and
1485970	1490190	you're focused on how you're going to handle the ransomware, but it turns out it's just a phishing
1490190	1498990	email. So hand-in-hand with tunnel vision is reactionary behavior. Not only are we focused on
1498990	1506090	one thing, but we react to it without thinking ahead, right? We're allowing those outside forces
1506630	1512510	to make that decision instead of relying on the data we have at hand and thinking about that
1512510	1521390	bigger picture. The fire service, it can lead to really deadly situations. So the photograph you
1521390	1527510	see here is from a horrible fire that happened not all that long ago in Worcester, Massachusetts.
1528210	1534380	It was a cold storage fire in an old meat packing plant that was built in 1906.
1535290	1541670	People hadn't been in that building in a very, very long time. It had been vacant. No pre-plans
1541670	1549450	had been made. It turns out it had a maze of meat lockers in it. When this fire broke out, there was
1549450	1555670	supposedly somebody trapped inside. So they sent in two firefighters. The two firefighters went in
1555670	1562670	and attempted to find the individual they thought was trapped. They got hopelessly lost and radioed
1562670	1571550	for help. So the chief sent in two more firefighters to help them. Unfortunately, those two firefighters
1571550	1575830	also got hopelessly lost and could not get out of the building, nor could they find the two
1575830	1583210	original firefighters that had been sent in. So the fire chief sends in two more firefighters.
1583910	1592530	Guess what? They too get hopelessly lost. And ultimately, the fire chief says, no more.
1592670	1600310	I'm not sending any more in. Now, at first he was harshly criticized by his team for this,
1600310	1606650	because, of course, their own folks were inside that building. But the reality is,
1606650	1611230	any further reactionary behavior to try to save these individuals would just have led to more
1611230	1618970	death. These folks died because pre-plans weren't made, and they didn't know what was in there,
1618970	1622470	and it would have been a reaction to just keep sending firefighters in.
1623090	1631110	We see the same thing within IR, although usually not as deadly, right? If we're doing forensics,
1631110	1637390	we need clear, explicit goals. If the reactionary behavior is just figure out the bad stuff,
1637390	1642690	that's not helpful. You need to know more specifically what it is they want you looking for.
1643710	1648210	Another example is just pulling a network connection. What if you need more information
1648210	1651970	about the attacker because of what they're doing on other systems?
1652270	1657450	Or what happens if you just turn off a machine? We've already talked about the situation where,
1657450	1664370	you know, you have a key in memory and you turn the machine off and it's gone. Suspending all
1664370	1668830	accounts is another example where it could be you have one account that's compromised,
1668830	1671650	now you suspend them all, and that causes more headaches.
1673710	1681310	Another challenge is freelancing. Now, in our field in IT, a freelancer we often think of as
1681310	1688610	somebody who's more of, perhaps, somebody who's just not working directly for the company, right?
1688610	1693630	They're a contractor. But in the fire service, this notion of freelancing is this idea that
1693630	1698150	somebody is not following chain of command, they go off on their own and kind of do what they want
1698150	1704170	in an attempt to get the job done, but they're not following what's been laid out for them.
1704730	1709910	And that can lead to dangerous and reckless situations and bad feelings and all kinds
1709910	1717110	of problems. In the fire department, we see this typically where we have what's called the
1717110	1721690	crossing of the streams. And for those of you who don't know, the picture in the bottom right
1721690	1726010	is Ghostbusters, and they always talk about never cross the streams.
1726610	1730850	Well, in firefighting, the idea is if I'm streaming water through the front of a building,
1730850	1736210	and then a team comes to the rear of a building, and that building is a small house,
1736210	1742330	now I'm fighting the team that's putting the water in, in both directions. And that could
1742330	1748330	be really dangerous. Another way we see this freelancing in the fire department that can
1748330	1753790	be really dangerous is something where doors are opened or windows are smashed
1754330	1760450	without coordinating it with other people. We've seen situations where a window could get smashed
1760450	1763990	and a firefighter could be standing right on the other side of it because they don't realize
1763990	1769710	somebody's there. It can also ultimately feed the fire because where there's more oxygen,
1769710	1774010	that fire is going to go. So if it hasn't been planned out and it's not coordinated,
1774010	1776930	it can actually make things significantly worse.
1778330	1784390	In incident response, we see the same kinds of things. A team goes in to do a response,
1784390	1788450	and you get somebody who thinks they're just going to collect everything. Well, there could
1788450	1794410	be legal ramifications for that. What happens if they don't collect what's absolutely required?
1794430	1799770	Maybe they overlook something. Maybe there's a duplication of data collection which wastes time.
1799770	1805750	Or maybe data gets altered or misrepresented because people are freelancing and not everybody's
1805750	1815910	not following the same set of rules or the same guidance. Patience. This is a fantastic opportunity.
1817010	1823290	Ultimately, you want to take that moment to determine what the best course of action is.
1823290	1829290	As one of my fire instructors would say, slow is fast, right? You want to be deliberate about what
1829290	1837710	you do because ultimately it will take less time if you take a moment, think things through,
1837710	1846210	and then proceed. So in terms of firefighting, you may remember the same house here. It's the
1846210	1852090	same story on the left is what we pulled up to. You'll notice you can see flame in the picture
1852090	1858150	on the right hand side, the sort of orangey bit that's on the right part of that underneath the
1858150	1864190	eaves next to the downspout. And you'll see a little bit of a glow toward the front of that
1864190	1870130	third window on the right. But we don't see flame blowing through the roof. Now what I was seeing in
1870130	1875490	that thermal camera image was that all of the fire, all of the significant flame and heat
1876050	1883970	for this particular fire, that was up in that roof area. So what would have been ideal is for
1883970	1893510	somebody to go in on the inside, break through from the second floor up into that attic area,
1893510	1901210	and ultimately put the fire out. Unfortunately, we had people who focused solely on where they
1901210	1908210	saw flame. And as a result, we see what we see on the right hand side where flame
1908770	1915910	blows through the roof and there's a lot more of it. And it took us a lot longer to get this
1915910	1921210	fire out. Which isn't to say that what everybody did was wrong, but taking a beat and thinking
1921210	1928490	this through might have saved a lot of time with this fire. Okay, patience in terms of incident
1928490	1936170	response. For those of you not familiar with Chegg, Chegg is a company that rents textbooks.
1936170	1943350	Now what do you think the odds are of an entity that rents textbooks to students in higher ed,
1943350	1950550	of them using, oh I don't know, same credentials at the university that they use at Chegg or vice
1950550	1959030	versa? Yeah, pretty darn good. So Chegg had a massive breach that involved millions of accounts
1959850	1966830	and because they provide services to multiple universities, as you might expect,
1966830	1974090	many institutions wound up with this exact problem. Tons of compromised accounts. But
1974510	1983450	is it really the university's problem in the sense that is it their breach? No.
1983450	1990290	What it is, is password reuse. Chegg had the breach. Yes, the universities and institutions
1990290	1994830	have to do something about making sure those passwords get reset, right? That's important.
1995150	1999470	But it's not the same as having those passwords having been breached on the
1999470	2005990	systems that are actually at the university. That is an incident. That's pretty serious.
2006450	2012510	So before you panic when you hear about a huge breach, even if it could impact your institution,
2012510	2019750	think for a moment. Take that beat about exactly what the implications are. What is the real risk
2019750	2026470	here? And also consider that time is important, but as we saw with the picture of the asbestos
2026470	2032190	room, life safety is more important. So taking that beat can also be life-saving in incident
2032190	2039710	response depending on what you're walking into. All right, accountability. It's this idea,
2039710	2044430	at least in the fire service, of knowing where all your people are. You want to know if they're
2044430	2049670	in the trucks. You want to know who came with one truck. You want to know who's gone inside a
2049670	2055290	building. You want to know who's getting rehabbed. But really, in incident response, we do the same
2055290	2060730	kinds of things. We want to make sure that we prevent hazards and duplication of efforts. We
2060730	2064170	don't want to step on each other's toes or have any sort of direct interference.
2066070	2073290	So on the left are accountability tags that we use in firefighting. And for example, we'll use
2073290	2079210	one of those tags we'll place on the truck so that everybody knows what truck you came in on.
2079330	2087650	That way, the officer on that truck knows where their people are at all time. They might put
2087650	2091790	another, if they go inside the building, they'll use a second tag and put it with the accountability
2091790	2096450	person at the door so that they know where they are inside the building.
2096690	2103010	For incident response, we can do the same kinds of things. Perhaps wipe card access. If you're
2103010	2110390	going inside a facility where you work, we'll show you what room you're in. And maybe you need
2110390	2115410	something more detailed, like an incident access log, depending on the situation. So we can do
2115410	2123630	accountability with IR, and it's important. Okay, pre-planning. Pre-planning is absolutely
2123630	2128910	critical. You want to know your environment. You want to know through your own documentation
2128910	2136330	and planning, third-party documentation, and anything else that you can think of before it
2136330	2143930	becomes a problem. And in the fire service, we're going to do that with what are called pre-plans.
2143930	2148910	And in incident response, we're going to do it with things like tabletop and pre-mortem exercises,
2149510	2155950	so that we have this idea of what we might run into before we run into it, and prevent those
2155950	2165270	gotchas. So this is the kind of thing we do in firefighting. On the left is a map of a building,
2165270	2171310	basically. I know it's a little difficult to see, but the idea is that it maps out for us where the
2171310	2178830	hydrants are, where the electrical shutoff is, and it might tell us if there's any hazardous
2178830	2183790	materials in the area. The thing on the right might tell us a little more about the building
2183790	2192250	construction. This is more of a general pre-plan that's going to tell us about other hazards,
2192250	2197370	other information, but it's the same concept, right? It tells us what we need to know about
2197370	2202890	the facility we're going into to keep us safe, and those that we're trying to rescue,
2203350	2207410	and perhaps the general public, depending on the particular situation.
2207790	2214230	We can do the same thing in incident response. We can do tabletop exercises. If you're not already
2214230	2220470	familiar with backdoors and breaches, you should be. The Black Hills folks, John Strand and his
2220470	2226630	crew, have built this amazing card game, which uses a 20-sided die and this set of cards,
2226630	2235530	and it can help you build an entire event from the ground up, and then you can do the investigation
2235530	2241410	using those cards. It's really interesting, and I highly recommend it if you haven't already tried
2241410	2250410	them. But it can walk you through scenarios, everything from something happening in a natural
2250410	2257050	disaster type emergency to, you know, the intern who's done the wrong kind of thing and made an
2257050	2262890	accidental mess. Obviously, documentation we've talked about, right? Document your servers,
2262890	2267150	document your workstations, document where your data is and what your network is like,
2267150	2273130	and the more information you have, the better off you'll be. And hopefully it goes without saying,
2273130	2277550	to a certain degree, that this would also include your incident response plan and whatever team
2277550	2286990	you have. So to summarize, we want you to start thinking like a firefighter. I think that applying
2286990	2292710	these firefighter ideas to incident response has really made me a better incident responder,
2292710	2299550	ultimately. You want to avoid tunnel vision. You want to do what's called a 360 of the problem,
2299550	2304950	which in firefighting might literally mean a 360 around the building, which is what we try to do,
2304950	2309330	or at least somebody does when we get there, whether it might be the operations person,
2309330	2314450	it might be the incident commander. But at a minimum, we always pull past the building that's
2314450	2320090	on fire, or potentially on fire, so that we can see at least three sides of the building.
2320430	2325910	That gives us that bigger scope. We want to make sure we're acting, we're deliberate,
2325910	2332930	we don't just react. We don't want to be misled by emotion. Follow whatever plan that you and
2332930	2337790	your colleagues have come up with. Don't just freelance. It can be, you know, physically
2337790	2344810	dangerous in certain circumstances, and it can just be plain frustrating in others.
2344950	2350350	Have patience and take that beat. You never know what you might have missed if you didn't.
2350350	2358210	Those 30 or 60 seconds could save tons of time. And even in the fire service,
2358210	2363110	taking those few seconds ultimately could save a life, even if you think going faster
2363110	2371170	might have done it. Location. Make sure you know where your people are. Document, document,
2371170	2380630	document your location. Both of your equipment, your people, where your data is, and pre-plans
2380630	2385310	they rock, right? Less chaos, way easier to respond if you already have a plan.
2385310	2390430	And consider something like the incident command system, so that you're organizing your response.
2390970	2395770	The thing about the incident command system that's so cool is that ultimately it is fantastic
2395770	2403370	for scaling to larger incidents. As I mentioned, you can have only one person in charge of just
2403510	2408690	a few people. And if you scale that out, it works really well in larger situations.
2408790	2414350	So bringing in outside entities, this is so much easier because everybody's on the same page.
2416050	2424650	So, some final thoughts. I know that many of you have never thought about incident response
2424650	2433330	in this way. And that's okay. That's the idea. Think outside that box. Try some things you've
2433330	2445290	never tried before. You may find that ultimately it makes your job maybe more challenging in the
2445290	2453810	And the reality is great things never come from comfort zones. So, do it. Push that envelope.
2454670	2460490	Hopefully you will find these tactics helpful. I want to thank you for coming to hear me speak.
2460490	2465590	And I want to thank Wall of Sheep so much for having me. And I hope you have an absolutely
2465590	2469330	wonderful DEF CON and a wonderful rest of your day.