1 00:00:00,000 --> 00:00:04,020 Shannon Morse with DECCON 30 here and I am over at the Blue Team Village. 2 00:00:04,020 --> 00:00:06,380 I am so excited to speak to both of you today. 3 00:00:06,380 --> 00:00:08,040 Thank you so much for joining me. 4 00:00:08,040 --> 00:00:08,940 Thanks for having us. 5 00:00:09,040 --> 00:00:09,740 Absolutely. 6 00:00:09,740 --> 00:00:10,540 Oh my goodness. 7 00:00:10,580 --> 00:00:14,100 I am very, very new to blue teaming. 8 00:00:14,100 --> 00:00:23,140 And I think that speaks true of how people look at things like blue teaming and red teaming as kind of having a barrier to entry. 9 00:00:23,280 --> 00:00:33,120 And I would love to chat with you today about how the Blue Team Village is really, really welcoming to folks that want to get into this and are not really sure how. 10 00:00:33,300 --> 00:00:33,720 Right. 11 00:00:33,720 --> 00:00:39,160 So for anybody watching this, join our online community on Discord. 12 00:00:39,360 --> 00:00:41,320 There is no barrier to entry. 13 00:00:41,320 --> 00:00:49,900 We don't care if you've been doing it for 10 years or if just yesterday you read something interesting and you think InfoSec might be right for you. 14 00:00:49,900 --> 00:00:50,560 Yeah. 15 00:00:51,800 --> 00:00:55,140 That concept pervades everything we do. 16 00:00:55,140 --> 00:01:01,220 So this year, one of the programs, one of the many programs we have is something we call Obsidian. 17 00:01:01,280 --> 00:01:06,060 And we're providing content for blue teamers. 18 00:01:06,060 --> 00:01:08,080 And we can talk a little bit about Obsidian later. 19 00:01:08,080 --> 00:01:17,900 But we're providing the content, the raw content for people to learn, join the community, have conversations instead of just one class. 20 00:01:17,900 --> 00:01:18,240 Yeah. 21 00:01:18,240 --> 00:01:20,080 Have ongoing conversations. 22 00:01:20,080 --> 00:01:24,860 And then even within the program itself. 23 00:01:24,860 --> 00:01:26,260 We have leaders in Obsidian. 24 00:01:26,260 --> 00:01:29,000 We have people, analysts doing the work. 25 00:01:29,000 --> 00:01:33,820 If you're brand new and you want to be on the project, we're saying, come in. 26 00:01:33,820 --> 00:01:37,340 Be the next group of people to do this next year or the year after. 27 00:01:37,340 --> 00:01:43,260 So constant training is something that is just, it's built into our DNA. 28 00:01:43,260 --> 00:01:47,120 And this is something that absolutely has no barrier to entry. 29 00:01:47,120 --> 00:01:48,520 It's free of charge. 30 00:01:48,520 --> 00:01:49,040 Free of charge. 31 00:01:49,040 --> 00:01:50,880 Anybody can go into the village. 32 00:01:50,880 --> 00:01:51,960 Tools are open source. 33 00:01:51,960 --> 00:01:53,260 Oh, that's wonderful to hear. 34 00:01:53,260 --> 00:01:59,080 And where can people find out more about how they can get access to the Blue Team Village assets? 35 00:01:59,080 --> 00:01:59,420 Right. 36 00:01:59,420 --> 00:02:05,240 So there's a couple of places you can start at blueteamvillage.org, our website. 37 00:02:05,580 --> 00:02:10,400 Most of the other ways of getting to information are there. 38 00:02:10,400 --> 00:02:17,100 But if you want to get the data, the Obsidian data, that's at media.blueteamvillage.org. 39 00:02:17,100 --> 00:02:22,380 And then we will be posting all of the talks on YouTube. 40 00:02:22,380 --> 00:02:26,180 Not all of the talks, but all of the pre-recorded talks will be on YouTube. 41 00:02:26,200 --> 00:02:33,220 And we'll be providing all of the slide decks on our GitHub repo. 42 00:02:33,220 --> 00:02:34,000 Oh, perfect. 43 00:02:34,000 --> 00:02:35,120 I'm so happy to hear that. 44 00:02:35,120 --> 00:02:36,580 Everything we've done. 45 00:02:36,580 --> 00:02:37,320 Everything. 46 00:02:37,320 --> 00:02:38,520 Nothing's held back. 47 00:02:38,520 --> 00:02:40,000 It all goes back to the community. 48 00:02:40,000 --> 00:02:41,500 I love that about DEF CON. 49 00:02:41,500 --> 00:02:44,040 Like, everything here is very community driven. 50 00:02:44,040 --> 00:02:45,620 Everyone is so excited to be here. 51 00:02:45,620 --> 00:02:50,060 I've noticed throughout the couple of days, your village is packed. 52 00:02:50,060 --> 00:02:51,880 There was a line out the door the other day. 53 00:02:51,880 --> 00:02:54,740 It was almost impossible for me to get in there and ask for an interview. 54 00:02:54,740 --> 00:02:55,240 Right. 55 00:02:55,600 --> 00:02:58,600 And it's wonderful to see so many people interested. 56 00:02:58,800 --> 00:03:03,880 Another thing I've noticed is how red teaming tends to get a lot of popularity. 57 00:03:03,880 --> 00:03:07,140 It's very, very interesting because people love to be on the attack. 58 00:03:07,140 --> 00:03:09,660 But blue teaming is defensive. 59 00:03:10,000 --> 00:03:13,560 It's extremely important, especially to careers. 60 00:03:13,560 --> 00:03:15,880 It's lucrative for people to get into. 61 00:03:15,880 --> 00:03:20,020 I would love to chat about the importance of blue team village as well. 62 00:03:20,020 --> 00:03:21,440 And blue teaming in general. 63 00:03:21,440 --> 00:03:24,620 Well, I've talked a lot, so... 64 00:03:24,620 --> 00:03:26,200 I'll take over the mic here. 65 00:03:27,900 --> 00:03:28,440 Yeah. 66 00:03:28,960 --> 00:03:32,640 I mean, I'm personally, I am like pure, pure blue teamer. 67 00:03:32,640 --> 00:03:34,480 Which, I mean, my hair, my glasses. 68 00:03:34,500 --> 00:03:34,940 Yes . 69 00:03:35,060 --> 00:03:36,940 I know, if you couldn't tell. 70 00:03:37,560 --> 00:03:38,940 Yeah, I get that. 71 00:03:38,940 --> 00:03:40,460 I get that comment sometimes. 72 00:03:40,460 --> 00:03:43,660 But yeah, I think it's kind of... 73 00:03:43,660 --> 00:03:47,260 We always have a joking rivalry with red team village. 74 00:03:47,260 --> 00:03:50,200 And neither of us would be here without the other. 75 00:03:50,200 --> 00:03:51,040 Exactly. 76 00:03:51,240 --> 00:03:52,880 Red team village without blue teamers and vice versa. 77 00:03:53,120 --> 00:04:02,520 And a lot of the content that we provide is, to be honest, I think it's really what convinces employers to send their folks to DEF CON to learn. 78 00:04:02,580 --> 00:04:03,340 Absolutely. 79 00:04:03,340 --> 00:04:17,980 And once they have a connection to content that they actually can apply to work in their real lives, then everything else is kind of getting deeper and deeper and deeper into tooling and tactics and technology in general. 80 00:04:19,300 --> 00:04:22,860 So we also, blue team village runs year-round. 81 00:04:22,860 --> 00:04:24,400 We have an active Discord community. 82 00:04:24,400 --> 00:04:25,020 Oh , really? 83 00:04:25,020 --> 00:04:25,680 Yeah. 84 00:04:26,420 --> 00:04:31,300 One of the things that we do that we started a couple of years ago was a mentor program. 85 00:04:31,300 --> 00:04:33,960 So meet a mentor basically is... 86 00:04:33,960 --> 00:04:40,300 We have a mentor matching, we do panels, we'll do mini workshops and things like that. 87 00:04:40,300 --> 00:04:41,840 We run lightning talks. 88 00:04:41,840 --> 00:04:46,740 We give people a chance to present for the first time to a small community. 89 00:04:49,240 --> 00:04:51,380 And we've helped people get jobs. 90 00:04:51,380 --> 00:04:54,800 I mean, just from connections, from resume reviews, things like that. 91 00:04:54,800 --> 00:04:55,860 Yeah , that's amazing. 92 00:04:55,860 --> 00:05:08,360 I really think that red teaming is great, but blue teaming is kind of where we can connect passion and learning with actual industry and employment. 93 00:05:08,360 --> 00:05:11,160 Unfortunately, we all need money to live. 94 00:05:11,160 --> 00:05:12,220 We do. 95 00:05:12,220 --> 00:05:14,740 So it's kind of a core piece of that as well. 96 00:05:14,740 --> 00:05:16,380 You mean I have to buy groceries? 97 00:05:16,380 --> 00:05:17,000 What? 98 00:05:17,520 --> 00:05:19,340 I have to pay my mortgage? 99 00:05:19,340 --> 00:05:20,380 Come on. 100 00:05:21,200 --> 00:05:25,180 Now, I also would love to mention the CTF that's running this weekend. 101 00:05:25,300 --> 00:05:26,640 Tell me all about it. 102 00:05:26,640 --> 00:05:30,960 So we kind of looked at with Project Obsidian. 103 00:05:31,300 --> 00:05:33,980 Just to give a real quick overview of it. 104 00:05:33,980 --> 00:05:36,600 We created a fictitious company. 105 00:05:36,960 --> 00:05:38,360 It's all in AWS. 106 00:05:38,580 --> 00:05:42,060 We staffed it with fictitious employees. 107 00:05:42,060 --> 00:05:43,540 They send each other email. 108 00:05:43,640 --> 00:05:47,640 And then we had a red team come in and do three different compromises. 109 00:05:47,640 --> 00:05:49,980 We call them Kill Chain 1, Kill Chain 2, and Kill Chain 3. 110 00:05:49,980 --> 00:05:50,500 Nice. 111 00:05:50,560 --> 00:05:51,140 That's cool. 112 00:05:51,140 --> 00:05:55,420 So all of the content that we have is based on that. 113 00:05:56,120 --> 00:06:02,260 Digital forensics, incident response, threat hunting, cyber threat intelligence, and malware reverse engineering. 114 00:06:02,260 --> 00:06:14,320 All looking at the same data so that if you come here and you're interested in incident response, and then you think, well, I'd like to know a little bit about malware reverse engineering, you already have the background. 115 00:06:14,360 --> 00:06:15,120 That's awesome. 116 00:06:15,120 --> 00:06:17,760 So that is the CTF. 117 00:06:17,760 --> 00:06:21,880 The CTF is really all of that content just put into a CTF. 118 00:06:21,880 --> 00:06:30,940 So if you go to the talks, if you download the data, if you do the analysis yourself, if you talk in the community, you're doing the CTF. 119 00:06:30,940 --> 00:06:31,640 That's so cool. 120 00:06:31,640 --> 00:06:37,420 And then you can get on the CTF, enter your answers in typical CTF form. 121 00:06:37,420 --> 00:06:40,680 But the idea is it's all the same data. 122 00:06:40,680 --> 00:06:50,840 It's all preventing having to relearn the compromise or the project. 123 00:06:51,160 --> 00:06:56,560 Make the project central and then just look at it five different ways. 124 00:06:56,560 --> 00:07:01,160 I appreciate that you're making this so easy for people to get into. 125 00:07:01,160 --> 00:07:08,540 Blue teaming is so important to infrastructure, to agency, to home networks, to pretty much everything in this world. 126 00:07:08,540 --> 00:07:14,020 It's something that we definitely need, and we need more people getting into it as their careers. 127 00:07:14,020 --> 00:07:15,080 No doubt about it. 128 00:07:15,080 --> 00:07:23,900 And just to add on top of that, you have people that may never even know that this is available to them. 129 00:07:23,900 --> 00:07:24,780 Absolutely. 130 00:07:24,780 --> 00:07:29,220 By saying, we don't care who you are, we don't care where you come from. 131 00:07:29,220 --> 00:07:33,220 We need people to come join us, be a part of the conversation. 132 00:07:33,220 --> 00:07:33,600 Yes. 133 00:07:33,600 --> 00:07:38,840 We can reach people that are not reachable through other means. 134 00:07:38,920 --> 00:07:45,240 And to end this interview, let's mention the badge, because the badge looks really cool. 135 00:07:45,280 --> 00:07:46,600 It is really cool. 136 00:07:46,600 --> 00:07:48,600 I know it's sold out now, but... 137 00:07:48,600 --> 00:07:49,880 Yeah, yeah. 138 00:07:49,980 --> 00:07:51,100 That's a good thing. 139 00:07:51,100 --> 00:07:53,960 I don't have a good example of the regular one. 140 00:07:53,960 --> 00:07:57,040 We have a staff version, it has a little e-ink screen, which is pretty cool. 141 00:07:57,360 --> 00:08:02,100 The other one we made, it's the same board, so it's a nice big Blue Team Village. 142 00:08:02,100 --> 00:08:03,340 It's our fifth anniversary. 143 00:08:03,340 --> 00:08:03,760 Cool. 144 00:08:03,760 --> 00:08:05,240 So we went big with everything. 145 00:08:05,480 --> 00:08:06,120 Congratulations! 146 00:08:06,180 --> 00:08:07,020 That's so cool. 147 00:08:07,340 --> 00:08:09,480 Got some Blinky lights in there, SAO connectors. 148 00:08:10,020 --> 00:08:16,300 I mean, I'm just overwhelmed by how great a response we got to it, and to the little SAOs. 149 00:08:17,480 --> 00:08:20,120 I mean, really, people come to DEF CON for the swag, right? 150 00:08:20,120 --> 00:08:20,640 Oh, totally. 151 00:08:20,640 --> 00:08:21,560 I mean, I do. 152 00:08:23,780 --> 00:08:25,640 There's several things I come for. 153 00:08:25,640 --> 00:08:28,740 It's work, because I do ThreatWire. 154 00:08:28,740 --> 00:08:34,940 It's meeting all my friends, and bringing home as many electronic badges that I can get my hands on. 155 00:08:35,480 --> 00:08:35,960 100%. 156 00:08:35,960 --> 00:08:37,020 100%, yes. 157 00:08:37,020 --> 00:08:38,100 And going to the villages. 158 00:08:38,100 --> 00:08:39,560 We'll make more next year. 159 00:08:39,580 --> 00:08:44,940 We'll definitely be back next year, and we'll bring all the swag and Blinky lights that we possibly can. 160 00:08:44,940 --> 00:08:48,800 I know you mentioned it earlier, but where can people find out more? 161 00:08:48,800 --> 00:08:51,560 So, blueteamvillage.org is the base for everything. 162 00:08:51,580 --> 00:08:53,700 It has a link to our active Discord community. 163 00:08:53,700 --> 00:08:55,280 We are year-round, like I mentioned. 164 00:08:55,380 --> 00:08:56,780 The Metro Program link is there. 165 00:08:56,780 --> 00:08:59,780 The Project Obsidian information is there as well. 166 00:08:59,780 --> 00:09:04,080 You can get to everything from blueteamvillage.org, and we're on Twitter at Blue Team Village. 167 00:09:04,320 --> 00:09:06,000 Thank you so much for joining me today. 168 00:09:06,000 --> 00:09:08,340 I appreciate chatting with both of you. 169 00:09:08,460 --> 00:09:09,500 Now go have some more fun.