1 00:00:00,080 --> 00:00:01,520 if someone submits credentials then 2 00:00:01,520 --> 00:00:03,199 those credentials are now completely 3 00:00:03,199 --> 00:00:06,160 compromised right like 4 00:00:06,160 --> 00:00:09,680 if that's the except yes 5 00:00:12,080 --> 00:00:14,559 i was saying yes that is an exception 6 00:00:14,559 --> 00:00:16,079 it's like i mean they have to be able to 7 00:00:16,079 --> 00:00:18,320 respond to those things but as long as 8 00:00:18,320 --> 00:00:19,760 you but do you put something in the 9 00:00:19,760 --> 00:00:20,960 contract that they should not be 10 00:00:20,960 --> 00:00:22,640 penalized for 11 00:00:22,640 --> 00:00:24,240 these results that they should be 12 00:00:24,240 --> 00:00:27,119 educated on them not harmed 13 00:00:27,119 --> 00:00:28,880 um that wouldn't be a question for my 14 00:00:28,880 --> 00:00:31,359 employer 15 00:00:31,359 --> 00:00:34,000 i await that answer yeah i mean look to 16 00:00:34,000 --> 00:00:36,000 put something in the contract that you 17 00:00:36,000 --> 00:00:37,840 have with the target organization that 18 00:00:37,840 --> 00:00:39,360 says you know you're not going to 19 00:00:39,360 --> 00:00:40,800 penalize them 20 00:00:40,800 --> 00:00:42,640 employees that might be a difficult 21 00:00:42,640 --> 00:00:44,160 negotiation point because they want it 22 00:00:44,160 --> 00:00:46,559 to be up to them what they do right but 23 00:00:46,559 --> 00:00:48,000 on the other hand no to your point there 24 00:00:48,000 --> 00:00:50,399 jason about educating the employees one 25 00:00:50,399 --> 00:00:52,559 thing most of the the organizations that 26 00:00:52,559 --> 00:00:53,920 are going to be going through these 27 00:00:53,920 --> 00:00:55,760 types of exercises are larger 28 00:00:55,760 --> 00:00:57,199 organizations with bigger budgets that 29 00:00:57,199 --> 00:01:00,160 can afford it right so part of what they 30 00:01:00,160 --> 00:01:01,680 are getting better at doing and they're 31 00:01:01,680 --> 00:01:03,039 not great about it is but when you 32 00:01:03,039 --> 00:01:05,280 onboard a new employee you put this kind 33 00:01:05,280 --> 00:01:06,960 of stuff in the employee handbook and 34 00:01:06,960 --> 00:01:08,960 you let them know you're responsible for 35 00:01:08,960 --> 00:01:11,040 these assets these assets need to be 36 00:01:11,040 --> 00:01:13,680 properly managed we run penetration 37 00:01:13,680 --> 00:01:16,560 testing scenarios we you might be social 38 00:01:16,560 --> 00:01:17,920 engineered you can put all of this in 39 00:01:17,920 --> 00:01:19,600 the employee handbook and i frankly 40 00:01:19,600 --> 00:01:21,119 think that they should because then 41 00:01:21,119 --> 00:01:22,799 they're on notice that there might be 42 00:01:22,799 --> 00:01:24,479 some test at any particular moment it 43 00:01:24,479 --> 00:01:26,560 might be a pitch it might be a phone 44 00:01:26,560 --> 00:01:27,920 call it might be something and they 45 00:01:27,920 --> 00:01:29,520 might be named in some kind of report i 46 00:01:29,520 --> 00:01:31,680 think that's the exception but the the 47 00:01:31,680 --> 00:01:33,520 other thing i would say is if there are 48 00:01:33,520 --> 00:01:35,840 really egregious employees what you 49 00:01:35,840 --> 00:01:37,680 might want to do is orally again 50 00:01:37,680 --> 00:01:39,680 communicate who those people are without 51 00:01:39,680 --> 00:01:41,600 putting it in writing and then put those 52 00:01:41,600 --> 00:01:43,840 remedial measures the things that jason 53 00:01:43,840 --> 00:01:45,040 had mentioned and grifter mentioned 54 00:01:45,040 --> 00:01:47,360 either sandboxing or you know some 55 00:01:47,360 --> 00:01:49,600 additional email filtering more help at 56 00:01:49,600 --> 00:01:51,600 the email gateway for these these you 57 00:01:51,600 --> 00:01:53,040 know people 58 00:01:53,040 --> 00:01:55,600 uh that might be part of the report that 59 00:01:55,600 --> 00:01:57,840 you put together but i think when it 60 00:01:57,840 --> 00:02:01,119 comes to duty of care jc which is 61 00:02:01,119 --> 00:02:04,159 sometimes these acts are so egregious 62 00:02:04,159 --> 00:02:06,240 that you might think it could cross over 63 00:02:06,240 --> 00:02:08,878 into intentionality and 64 00:02:08,878 --> 00:02:10,399 there's a big difference between someone 65 00:02:10,399 --> 00:02:12,160 an employee who's negligent and somebody 66 00:02:12,160 --> 00:02:15,040 who is intentionally crossing the lines 67 00:02:15,040 --> 00:02:16,560 there i would think that you know you 68 00:02:16,560 --> 00:02:18,400 might have an insider threat problem at 69 00:02:18,400 --> 00:02:20,640 that particular moment if somebody is is 70 00:02:20,640 --> 00:02:22,640 that bad or that negligent grossly 71 00:02:22,640 --> 00:02:25,360 negligent and then i think it's it would 72 00:02:25,360 --> 00:02:27,280 be within the balance of due care to 73 00:02:27,280 --> 00:02:28,640 name that person but again that would be 74 00:02:28,640 --> 00:02:30,400 an exception 75 00:02:30,400 --> 00:02:32,959 excellent thank you and then corgi with 76 00:02:32,959 --> 00:02:34,879 uh work from home resulting from covet 77 00:02:34,879 --> 00:02:36,480 how everybody works from home now we've 78 00:02:36,480 --> 00:02:38,000 ditched the office 79 00:02:38,000 --> 00:02:40,319 now employees especially with the start 80 00:02:40,319 --> 00:02:42,800 of the pandemic and the assets not being 81 00:02:42,800 --> 00:02:44,400 available they were encouraged to use 82 00:02:44,400 --> 00:02:45,840 their own personal devices old personal 83 00:02:45,840 --> 00:02:47,440 computers a lot of employers are still 84 00:02:47,440 --> 00:02:48,959 doing that 85 00:02:48,959 --> 00:02:51,040 knowing that we have the work from home 86 00:02:51,040 --> 00:02:52,800 situation employees might be on personal 87 00:02:52,800 --> 00:02:55,040 devices how do we feel from an ethical 88 00:02:55,040 --> 00:02:57,360 or moral standpoint of engaging with 89 00:02:57,360 --> 00:02:58,480 those employees where we might be 90 00:02:58,480 --> 00:03:00,879 touching home devices now 91 00:03:00,879 --> 00:03:02,800 yeah um so that's just something that i 92 00:03:02,800 --> 00:03:04,879 wouldn't really do um 93 00:03:04,879 --> 00:03:06,319 you know when we're conducting tests 94 00:03:06,319 --> 00:03:08,080 like this and regarding social 95 00:03:08,080 --> 00:03:09,519 engineering we're pulling like a lot of 96 00:03:09,519 --> 00:03:10,800 system information with that kind of 97 00:03:10,800 --> 00:03:12,239 stuff so if you're conducting efficient 98 00:03:12,239 --> 00:03:14,159 campaign you're getting like the user's 99 00:03:14,159 --> 00:03:15,920 domain you know in addition everything 100 00:03:15,920 --> 00:03:17,280 else that you're doing their username 101 00:03:17,280 --> 00:03:19,040 stuff like that um so you would be able 102 00:03:19,040 --> 00:03:21,760 to recognize very quickly whether or not 103 00:03:21,760 --> 00:03:24,640 it's a home device or a work device and 104 00:03:24,640 --> 00:03:26,239 we just wouldn't continue an escalation 105 00:03:26,239 --> 00:03:27,840 on a 106 00:03:27,840 --> 00:03:31,040 device that someone owns 107 00:03:31,040 --> 00:03:32,799 neil or jason would you go the opposite 108 00:03:32,799 --> 00:03:35,120 direction knowing that that's 109 00:03:35,120 --> 00:03:37,440 the working environment now yeah i think 110 00:03:37,440 --> 00:03:40,319 um as we saw our networks expand into 111 00:03:40,319 --> 00:03:42,720 users homes and and what that meant for 112 00:03:42,720 --> 00:03:45,280 security i mean uh i mean it really 113 00:03:45,280 --> 00:03:47,760 turned things on its head like i mean in 114 00:03:47,760 --> 00:03:50,000 one regard it was nice because it it 115 00:03:50,000 --> 00:03:52,560 forced the ability to like to transition 116 00:03:52,560 --> 00:03:55,200 into a state that allowed for that type 117 00:03:55,200 --> 00:03:57,360 of work which i think it you know was 118 00:03:57,360 --> 00:03:59,599 better for all of our mental health at a 119 00:03:59,599 --> 00:04:00,879 certain point right is just being able 120 00:04:00,879 --> 00:04:02,159 to be like i'm gonna i'm gonna work from 121 00:04:02,159 --> 00:04:03,200 home today 122 00:04:03,200 --> 00:04:04,560 um but 123 00:04:04,560 --> 00:04:08,400 it you saw immediately the hockey stick 124 00:04:08,400 --> 00:04:10,480 level of phishing attacks things that 125 00:04:10,480 --> 00:04:13,920 that did target home users right um and 126 00:04:13,920 --> 00:04:16,000 so i think if you're leaving 127 00:04:16,000 --> 00:04:17,918 those devices out you're doing a 128 00:04:17,918 --> 00:04:20,798 disservice to the company i know but if 129 00:04:20,798 --> 00:04:22,560 if i'm an attacker 130 00:04:22,560 --> 00:04:24,000 i don't care that that's your home 131 00:04:24,000 --> 00:04:26,960 machine um if if i had to put a limit 132 00:04:26,960 --> 00:04:29,120 somewhere i would say okay well i want 133 00:04:29,120 --> 00:04:30,800 to be able to say that i got access and 134 00:04:30,800 --> 00:04:32,639 then i was able to reach a certain level 135 00:04:32,639 --> 00:04:34,479 of access in that machine but i'm not 136 00:04:34,479 --> 00:04:36,160 like i would draw the line i'd say it 137 00:04:36,160 --> 00:04:37,600 like exfiltration you're not going to 138 00:04:37,600 --> 00:04:39,680 take anything that's personal data or 139 00:04:39,680 --> 00:04:41,840 anything like that i kissed you you can 140 00:04:41,840 --> 00:04:44,800 cough on me because it's just 141 00:04:44,800 --> 00:04:47,360 considered um and so 142 00:04:47,360 --> 00:04:49,919 um yeah i just think that you you do 143 00:04:49,919 --> 00:04:51,919 have to like the scope should include 144 00:04:51,919 --> 00:04:53,360 those things because the attacker 145 00:04:53,360 --> 00:04:54,639 includes those things as a matter of 146 00:04:54,639 --> 00:04:57,040 fact they count on those things 147 00:04:57,040 --> 00:04:58,080 but the 148 00:04:58,080 --> 00:04:59,680 the data that you remove from that 149 00:04:59,680 --> 00:05:01,039 environment should have some kind of 150 00:05:01,039 --> 00:05:02,720 guardrails around it 151 00:05:02,720 --> 00:05:04,080 and that's a good point let's move that 152 00:05:04,080 --> 00:05:05,840 over to alex with 153 00:05:05,840 --> 00:05:08,479 allowing an employer to in scope your 154 00:05:08,479 --> 00:05:10,560 home personal devices how 155 00:05:10,560 --> 00:05:13,360 practically legal is that 156 00:05:13,360 --> 00:05:16,000 it that's a gray area it definitely is i 157 00:05:16,000 --> 00:05:17,840 mean because if you think about it you 158 00:05:17,840 --> 00:05:20,639 only can authorize some kind of test on 159 00:05:20,639 --> 00:05:22,800 an asset that you are i couldn't 160 00:05:22,800 --> 00:05:25,280 authorize as much as i would look to jc 161 00:05:25,280 --> 00:05:26,960 somebody to perform a penetration test 162 00:05:26,960 --> 00:05:29,039 on your home network you know i'm sure 163 00:05:29,039 --> 00:05:31,120 it would be interesting all the things 164 00:05:31,120 --> 00:05:33,520 right oh my god yeah can only imagine 165 00:05:33,520 --> 00:05:34,800 all the television 166 00:05:34,800 --> 00:05:36,960 doors open you know that's uh 167 00:05:36,960 --> 00:05:39,120 yeah but the i think 168 00:05:39,120 --> 00:05:41,280 it it really it would be crossing a line 169 00:05:41,280 --> 00:05:43,199 in a sense i totally agree with grifter 170 00:05:43,199 --> 00:05:44,720 here in that 171 00:05:44,720 --> 00:05:45,680 that would 172 00:05:45,680 --> 00:05:47,680 emulate a real world attack because you 173 00:05:47,680 --> 00:05:48,880 know 174 00:05:48,880 --> 00:05:50,320 somebody behind a router with 175 00:05:50,320 --> 00:05:52,240 three-year-old firmware or longer than 176 00:05:52,240 --> 00:05:54,320 that is going to be more susceptible 177 00:05:54,320 --> 00:05:56,080 right the problem too though is there 178 00:05:56,080 --> 00:05:58,400 could be liability there you know it's 179 00:05:58,400 --> 00:06:00,960 it's a lower risk but if you compromise 180 00:06:00,960 --> 00:06:03,919 an asset and it couldn't technically be 181 00:06:03,919 --> 00:06:04,880 within 182 00:06:04,880 --> 00:06:07,520 the legal authority of let's say the 183 00:06:07,520 --> 00:06:09,680 employee's company to give 184 00:06:09,680 --> 00:06:11,600 you the right to access their home 185 00:06:11,600 --> 00:06:14,319 network or home devices personal devices 186 00:06:14,319 --> 00:06:17,039 etc and you do some fuzzing there's some 187 00:06:17,039 --> 00:06:18,960 kind of denial of service or something 188 00:06:18,960 --> 00:06:21,360 is taken out you destroy a laptop or 189 00:06:21,360 --> 00:06:24,400 whatever right you could be subject to a 190 00:06:24,400 --> 00:06:26,319 civil lawsuit after that under the 191 00:06:26,319 --> 00:06:28,240 computer fraud and abuse act the hacking 192 00:06:28,240 --> 00:06:30,880 statute also has not just criminal 193 00:06:30,880 --> 00:06:32,560 consequences but a private right of 194 00:06:32,560 --> 00:06:34,400 action for somebody to bring a civil 195 00:06:34,400 --> 00:06:36,960 case against anyone who 196 00:06:36,960 --> 00:06:39,840 uh intrudes or or accesses it another's 197 00:06:39,840 --> 00:06:42,240 computer without authorization now that 198 00:06:42,240 --> 00:06:44,080 there's a damages limitation though it's 199 00:06:44,080 --> 00:06:45,280 five thousand dollars you have to do 200 00:06:45,280 --> 00:06:47,039 five thousand dollars worth of damages 201 00:06:47,039 --> 00:06:48,479 in order to 202 00:06:48,479 --> 00:06:49,919 um 203 00:06:49,919 --> 00:06:51,440 be liable in order for there to be a 204 00:06:51,440 --> 00:06:53,680 case that's part of the the actual claim 205 00:06:53,680 --> 00:06:56,639 is the damages component um but we all 206 00:06:56,639 --> 00:06:58,240 know you can ring up a five thousand 207 00:06:58,240 --> 00:07:00,880 dollar bill from any kind of dfir firm 208 00:07:00,880 --> 00:07:02,720 really really quickly so 209 00:07:02,720 --> 00:07:03,759 i think 210 00:07:03,759 --> 00:07:05,280 you're right grifter and that it 211 00:07:05,280 --> 00:07:06,960 emulates the real world but you got to 212 00:07:06,960 --> 00:07:09,120 be extremely careful about how you go 213 00:07:09,120 --> 00:07:10,960 about scoping those engagements in the 214 00:07:10,960 --> 00:07:13,919 language that you're using 215 00:07:13,919 --> 00:07:15,919 awesome so looking at the the lens of 216 00:07:15,919 --> 00:07:18,639 ethics and morals 217 00:07:18,639 --> 00:07:22,160 uh i guess grifter jason or corgi is 218 00:07:22,160 --> 00:07:24,800 there any personas that you would not 219 00:07:24,800 --> 00:07:26,639 impersonate as part of your engagements 220 00:07:26,639 --> 00:07:28,720 this is completely off the table whether 221 00:07:28,720 --> 00:07:31,280 it's asked for or not 222 00:07:31,280 --> 00:07:32,960 no 223 00:07:32,960 --> 00:07:36,000 good answer next yes all right and 224 00:07:36,000 --> 00:07:38,319 yes 225 00:07:39,280 --> 00:07:41,039 you know if you ask a yes or no question 226 00:07:41,039 --> 00:07:43,039 you get a yes or no answer that's on me 227 00:07:43,039 --> 00:07:44,960 what do you mind for the yeses would you 228 00:07:44,960 --> 00:07:47,599 mind elaborating um 229 00:07:47,599 --> 00:07:49,599 i i won't go as to popo because they 230 00:07:49,599 --> 00:07:50,960 hate me enough as it is and i got 231 00:07:50,960 --> 00:07:54,319 warrants uh in several countries uh uh 232 00:07:54,319 --> 00:07:55,039 but 233 00:07:55,039 --> 00:07:57,360 hypothetically that's cool right it's 234 00:07:57,360 --> 00:07:59,680 like hypothetically uh 235 00:07:59,680 --> 00:08:01,599 yeah so uh 236 00:08:01,599 --> 00:08:03,840 um wait hang on can alex actually answer 237 00:08:03,840 --> 00:08:06,160 that one hypothetically hypothetically 238 00:08:06,160 --> 00:08:08,240 impersonating the police yeah you should 239 00:08:08,240 --> 00:08:10,240 not do that i never don't do it well i'm 240 00:08:10,240 --> 00:08:12,000 never going to paraguay again anyway so 241 00:08:12,000 --> 00:08:15,599 it doesn't matter uh and uh but the they 242 00:08:15,599 --> 00:08:17,280 know what they did don't act like 243 00:08:17,280 --> 00:08:20,960 they're bad guys uh but so um i would 244 00:08:20,960 --> 00:08:22,080 say it's like i wouldn't go that i 245 00:08:22,080 --> 00:08:23,759 wouldn't go as a doc something that 246 00:08:23,759 --> 00:08:25,280 would actually 247 00:08:25,280 --> 00:08:27,360 emotionally affects someone in a 248 00:08:27,360 --> 00:08:30,000 negative way it's like i'm never going 249 00:08:30,000 --> 00:08:33,440 to tell someone that they want enough 250 00:08:33,440 --> 00:08:35,679 money to alter their their lifestyle or 251 00:08:35,679 --> 00:08:37,440 like a hundred bucks i'm not going to do 252 00:08:37,440 --> 00:08:39,200 that i'm not going to tell them that 253 00:08:39,200 --> 00:08:42,479 there's a and yes godaddy did that and 254 00:08:42,479 --> 00:08:44,480 uh yes i'm not going to tell i name 255 00:08:44,480 --> 00:08:46,240 names i don't filter 256 00:08:46,240 --> 00:08:48,320 exactly it's like trust me i don't 257 00:08:48,320 --> 00:08:50,880 filter and then i get life i get paid to 258 00:08:50,880 --> 00:08:52,800 lie for a living i don't do it for free 259 00:08:52,800 --> 00:08:55,440 it's like and um and telling people that 260 00:08:55,440 --> 00:08:57,279 there's a vaccine available for them to 261 00:08:57,279 --> 00:08:59,120 go get that they can sign up to it when 262 00:08:59,120 --> 00:09:00,560 there's a middle of a pandemic which a 263 00:09:00,560 --> 00:09:02,399 library did that should be out of 264 00:09:02,399 --> 00:09:05,120 because that was horrible and uh and 265 00:09:05,120 --> 00:09:07,600 because when you do those things 266 00:09:07,600 --> 00:09:09,519 you may have had one or two insider 267 00:09:09,519 --> 00:09:12,560 threats in your company after it's over 268 00:09:12,560 --> 00:09:15,040 you've got a lot more to worry about 269 00:09:15,040 --> 00:09:17,519 it's like because you just created them 270 00:09:17,519 --> 00:09:19,760 and so yeah that's not effective it's 271 00:09:19,760 --> 00:09:21,600 like you can't do something that is 272 00:09:21,600 --> 00:09:23,920 going to do that kind of harm and expect 273 00:09:23,920 --> 00:09:26,640 to get away with it it's like so no i'm 274 00:09:26,640 --> 00:09:28,640 not going to go in as a character that's 275 00:09:28,640 --> 00:09:30,480 going to do something that that is going 276 00:09:30,480 --> 00:09:33,440 to give them relief or cause them trauma 277 00:09:33,440 --> 00:09:36,160 if they don't respond the whole point of 278 00:09:36,160 --> 00:09:39,839 an attack is to make them think uh react 279 00:09:39,839 --> 00:09:42,080 uh you know emotionally instead of think 280 00:09:42,080 --> 00:09:43,200 logically 281 00:09:43,200 --> 00:09:44,000 but 282 00:09:44,000 --> 00:09:45,440 i do the 283 00:09:45,440 --> 00:09:47,760 reacts in demos 284 00:09:47,760 --> 00:09:49,760 i mean i've done demonstrations of 285 00:09:49,760 --> 00:09:51,360 phishing attacks and i do that for 286 00:09:51,360 --> 00:09:53,680 security awareness all the time and i 287 00:09:53,680 --> 00:09:56,240 will use the deaths of real people it's 288 00:09:56,240 --> 00:09:58,720 like to send a phishing email example 289 00:09:58,720 --> 00:10:01,360 not actually sending it to the employees 290 00:10:01,360 --> 00:10:03,440 but i show them how i would find the 291 00:10:03,440 --> 00:10:05,440 email address how i would find out who 292 00:10:05,440 --> 00:10:06,880 to target 293 00:10:06,880 --> 00:10:10,640 then i google tragically terrible it's 294 00:10:10,640 --> 00:10:13,360 like in a in in from the city that i'm 295 00:10:13,360 --> 00:10:15,680 trying to get the message to and then i 296 00:10:15,680 --> 00:10:18,480 use one of those stories because trust 297 00:10:18,480 --> 00:10:20,240 me it's like that's what the attackers 298 00:10:20,240 --> 00:10:22,959 are doing i got an email uh two days 299 00:10:22,959 --> 00:10:25,680 after the boston bombing talking about 300 00:10:25,680 --> 00:10:28,240 uh the boston bombing it's like and then 301 00:10:28,240 --> 00:10:30,160 the link was just an ip address that's 302 00:10:30,160 --> 00:10:32,000 at boston.html 303 00:10:32,000 --> 00:10:34,640 but if you have children or family 304 00:10:34,640 --> 00:10:37,040 running in that race back then it's like 305 00:10:37,040 --> 00:10:38,720 if you had someone that was dealing with 306 00:10:38,720 --> 00:10:41,519 that and the cell services were horrible 307 00:10:41,519 --> 00:10:43,839 who's not going to click that link it's 308 00:10:43,839 --> 00:10:45,839 like and criminals know that and i am 309 00:10:45,839 --> 00:10:48,240 not going to play that part of a i'm not 310 00:10:48,240 --> 00:10:50,399 a method actor when it comes to playing 311 00:10:50,399 --> 00:10:52,399 the part of the criminal so 312 00:10:52,399 --> 00:10:55,680 uh but humans when they're fear 313 00:10:55,680 --> 00:10:58,320 they want to get information and so most 314 00:10:58,320 --> 00:11:00,640 of those demo emails i never tell person 315 00:11:00,640 --> 00:11:02,079 to click the link i just say i heard 316 00:11:02,079 --> 00:11:03,440 about this global thing happening and 317 00:11:03,440 --> 00:11:05,839 then this is happening nearby to you you 318 00:11:05,839 --> 00:11:07,680 need to be aware of it and it's like and 319 00:11:07,680 --> 00:11:09,120 then when you say where i heard about 320 00:11:09,120 --> 00:11:11,600 this thing you just put like a bad link 321 00:11:11,600 --> 00:11:13,360 and it's like you never tell them to 322 00:11:13,360 --> 00:11:14,480 click the link 323 00:11:14,480 --> 00:11:16,480 they're gonna click the link it's like 324 00:11:16,480 --> 00:11:18,640 but that's a demonstration that never 325 00:11:18,640 --> 00:11:19,680 goes 326 00:11:19,680 --> 00:11:22,320 into the internet because you are a 327 00:11:22,320 --> 00:11:24,399 horrible person and 328 00:11:24,399 --> 00:11:27,120 deserve horrible things if you ever do 329 00:11:27,120 --> 00:11:29,839 yeah i think again you're um you're 330 00:11:29,839 --> 00:11:31,279 you're saying okay this is something 331 00:11:31,279 --> 00:11:33,279 that an attacker is going to do gave 332 00:11:33,279 --> 00:11:35,279 examples of where attackers did do that 333 00:11:35,279 --> 00:11:37,680 and i said it's bad to emulate that like 334 00:11:37,680 --> 00:11:40,160 okay well they're going to do it right 335 00:11:40,160 --> 00:11:43,839 and so yes so i guess i mean if you're 336 00:11:43,839 --> 00:11:45,600 if i had to draw a line like if you had 337 00:11:45,600 --> 00:11:47,519 to say like oh yeah where are we like 338 00:11:47,519 --> 00:11:49,760 telling somebody their kids are hurt 339 00:11:49,760 --> 00:11:51,680 would probably not be something i would 340 00:11:51,680 --> 00:11:54,000 do oh yuri 341 00:11:54,000 --> 00:11:56,780 or no yeah i'll 342 00:11:56,780 --> 00:12:00,079 [Music] 343 00:12:00,079 --> 00:12:01,519 like i would probably not tell somebody 344 00:12:01,519 --> 00:12:03,920 that their children were hurt right 345 00:12:03,920 --> 00:12:06,240 um 346 00:12:06,320 --> 00:12:07,600 there's 347 00:12:07,600 --> 00:12:09,760 grandma's what 348 00:12:09,760 --> 00:12:12,160 yeah grandma's a fair game 349 00:12:12,160 --> 00:12:15,120 grandma likes ham yeah corgi yourself 350 00:12:15,120 --> 00:12:18,240 um i could play on par with jason 351 00:12:18,240 --> 00:12:20,639 anything like too emotionally drawing is 352 00:12:20,639 --> 00:12:22,320 probably pretty off limits but with a 353 00:12:22,320 --> 00:12:23,920 bigger emphasis on like things that are 354 00:12:23,920 --> 00:12:26,079 illegal so like anything related to the 355 00:12:26,079 --> 00:12:28,160 government or stuff like that like i had 356 00:12:28,160 --> 00:12:30,320 an intern i think a few weeks ago and he 357 00:12:30,320 --> 00:12:32,639 was like oh can i make a fake driver's 358 00:12:32,639 --> 00:12:34,720 license for this and i was like please 359 00:12:34,720 --> 00:12:36,959 don't [ __ ] do that 360 00:12:36,959 --> 00:12:38,560 have somebody else make it for you it's 361 00:12:38,560 --> 00:12:40,480 so much higher quality 362 00:12:40,480 --> 00:12:42,720 that's true i'm not i'm like do you give 363 00:12:42,720 --> 00:12:45,040 them yeah 364 00:12:45,600 --> 00:12:47,839 all right that's cool good initiative 365 00:12:47,839 --> 00:12:49,279 bad judgment 366 00:12:49,279 --> 00:12:52,000 so um from from a moral perspective 367 00:12:52,000 --> 00:12:53,760 having a client that asks you to remove 368 00:12:53,760 --> 00:12:55,360 a finding 369 00:12:55,360 --> 00:12:58,959 have we had that and no yeah i so i've 370 00:12:58,959 --> 00:13:00,480 been in 371 00:13:00,480 --> 00:13:02,639 meetings where i start to report right 372 00:13:02,639 --> 00:13:04,399 we sit down to go through the brief and 373 00:13:04,399 --> 00:13:06,800 as i start to discuss where things have 374 00:13:06,800 --> 00:13:08,480 gone wrong they say you need to stop 375 00:13:08,480 --> 00:13:10,480 talking it's happened twice 376 00:13:10,480 --> 00:13:12,079 you need to stop talking and i'm like 377 00:13:12,079 --> 00:13:13,839 what and they're like don't say another 378 00:13:13,839 --> 00:13:14,639 word 379 00:13:14,639 --> 00:13:16,079 and the reason they're saying that is 380 00:13:16,079 --> 00:13:18,000 because guys like 381 00:13:18,000 --> 00:13:19,760 yeah that's right i was sitting behind 382 00:13:19,760 --> 00:13:22,480 them going from the moment i tell them 383 00:13:22,480 --> 00:13:24,399 that they have a problem it's actually 384 00:13:24,399 --> 00:13:26,880 the clock starts for them to fix that 385 00:13:26,880 --> 00:13:29,760 problem and i have done hundreds of 386 00:13:29,760 --> 00:13:31,920 assessments who know i don't even i 387 00:13:31,920 --> 00:13:33,839 don't know how many can't count but 388 00:13:33,839 --> 00:13:36,160 twice i have been told 389 00:13:36,160 --> 00:13:38,160 don't say anymore you can take that with 390 00:13:38,160 --> 00:13:41,120 you you're free to go like 391 00:13:41,120 --> 00:13:43,680 so yeah not just we don't want to hear 392 00:13:43,680 --> 00:13:45,760 about that finding we don't want to hear 393 00:13:45,760 --> 00:13:48,560 anything else you get paid and you leave 394 00:13:48,560 --> 00:13:51,040 and you're like i hated that that's not 395 00:13:51,040 --> 00:13:53,199 cool at all but put all that time into 396 00:13:53,199 --> 00:13:54,800 that report 397 00:13:54,800 --> 00:13:57,440 i curated and everything 398 00:13:57,440 --> 00:13:59,519 i've had a contractor who literally they 399 00:13:59,519 --> 00:14:01,120 they put in the scope 400 00:14:01,120 --> 00:14:03,040 that i could go into the circle with for 401 00:14:03,040 --> 00:14:06,480 a defense contractor you know just 402 00:14:06,480 --> 00:14:07,920 it was for a defense contractor 403 00:14:07,920 --> 00:14:10,560 somewhere in the dc area will say here's 404 00:14:10,560 --> 00:14:13,839 the pentagon and uh i don't care it's 405 00:14:13,839 --> 00:14:16,480 like uh and they told me that they gave 406 00:14:16,480 --> 00:14:18,720 me the scope and it wasn't a very good 407 00:14:18,720 --> 00:14:21,680 scope and i followed the scope and uh i 408 00:14:21,680 --> 00:14:23,760 ended up in their server room 409 00:14:23,760 --> 00:14:25,920 and then like five minutes after getting 410 00:14:25,920 --> 00:14:28,880 in there the guy runs in and says dude 411 00:14:28,880 --> 00:14:31,040 you need to get them out now and i'm 412 00:14:31,040 --> 00:14:33,360 like i can't belie you can't you're out 413 00:14:33,360 --> 00:14:34,560 it's over 414 00:14:34,560 --> 00:14:36,480 everything's over and i was like you 415 00:14:36,480 --> 00:14:38,320 said it was okay but we didn't think you 416 00:14:38,320 --> 00:14:40,880 could get in i was like that's not my 417 00:14:40,880 --> 00:14:41,920 problem 418 00:14:41,920 --> 00:14:43,839 it's like they'll put findings in 419 00:14:43,839 --> 00:14:46,160 thinking that it's like if you failed 420 00:14:46,160 --> 00:14:48,240 that makes them look better not 421 00:14:48,240 --> 00:14:50,560 realizing if you succeed it makes them 422 00:14:50,560 --> 00:14:52,560 look worse and literally that whole 423 00:14:52,560 --> 00:14:54,480 contract was over it's like they that 424 00:14:54,480 --> 00:14:56,160 was the end of it it's like i had to go 425 00:14:56,160 --> 00:14:58,720 back in the next day uh talk to all the 426 00:14:58,720 --> 00:15:01,360 c's and the o's on on mahogany row and 427 00:15:01,360 --> 00:15:02,959 explain to them what was happening and i 428 00:15:02,959 --> 00:15:04,320 didn't get to do a report i didn't get 429 00:15:04,320 --> 00:15:05,519 to do anything they just said you're 430 00:15:05,519 --> 00:15:08,000 paid get the out and we will never see 431 00:15:08,000 --> 00:15:11,760 you again uh it's like so i gt upload 432 00:15:11,760 --> 00:15:13,120 because i don't know if they could black 433 00:15:13,120 --> 00:15:16,399 fan me or not it's like 434 00:15:16,399 --> 00:15:18,079 interesting 435 00:15:18,079 --> 00:15:20,560 okay exactly i was like 436 00:15:20,560 --> 00:15:22,959 so so that happened uh 437 00:15:22,959 --> 00:15:24,560 yeah look i 438 00:15:24,560 --> 00:15:25,920 from the lawyer's perspective here i 439 00:15:25,920 --> 00:15:27,199 feel i feel like we're on the please 440 00:15:27,199 --> 00:15:30,000 defense here you know but uh there are 441 00:15:30,000 --> 00:15:32,399 some good reasons why certain things 442 00:15:32,399 --> 00:15:34,480 shouldn't be put into reports as well 443 00:15:34,480 --> 00:15:36,079 and there's also a lot of different ways 444 00:15:36,079 --> 00:15:39,199 to manage the reporting function as well 445 00:15:39,199 --> 00:15:42,639 so like a good lawyer will ask you to 446 00:15:42,639 --> 00:15:44,480 you know orally read out the report 447 00:15:44,480 --> 00:15:45,839 before you putting anything in writing 448 00:15:45,839 --> 00:15:47,440 so you know what those contours are 449 00:15:47,440 --> 00:15:48,800 there's going to be no surprises when 450 00:15:48,800 --> 00:15:50,480 you get the right people in the room and 451 00:15:50,480 --> 00:15:52,639 there might be some massaging or a good 452 00:15:52,639 --> 00:15:54,079 lawyer might say well we don't 453 00:15:54,079 --> 00:15:56,720 necessarily have direct evidence of what 454 00:15:56,720 --> 00:15:58,399 you just said right you know you 455 00:15:58,399 --> 00:16:00,079 shouldn't be speculating in some of 456 00:16:00,079 --> 00:16:02,560 these reports because that could lead to 457 00:16:02,560 --> 00:16:04,399 bad things happening down down the line 458 00:16:04,399 --> 00:16:06,639 right so there's also another way that 459 00:16:06,639 --> 00:16:08,399 you can manage these reports is to work 460 00:16:08,399 --> 00:16:10,079 your engagements through council and a 461 00:16:10,079 --> 00:16:11,839 lot of you have probably done this in 462 00:16:11,839 --> 00:16:14,800 the past so that to a certain extent the 463 00:16:14,800 --> 00:16:17,519 output of what you're doing your reports 464 00:16:17,519 --> 00:16:19,680 could be legally privileged or protected 465 00:16:19,680 --> 00:16:21,920 by the attorney work product doctrine 466 00:16:21,920 --> 00:16:23,440 but then protects the company and allows 467 00:16:23,440 --> 00:16:24,720 you to put more 468 00:16:24,720 --> 00:16:26,800 you would be more candid in your reports 469 00:16:26,800 --> 00:16:28,560 and you could have a privileged version 470 00:16:28,560 --> 00:16:30,880 that the company has with you know all 471 00:16:30,880 --> 00:16:33,040 of the the warts and everything on it 472 00:16:33,040 --> 00:16:34,959 and then an unprivileged version that 473 00:16:34,959 --> 00:16:36,320 you're going to share with third parties 474 00:16:36,320 --> 00:16:38,399 that the test was successful there's 475 00:16:38,399 --> 00:16:39,759 going to be certain remedial measures 476 00:16:39,759 --> 00:16:41,279 that we're implementing et cetera so 477 00:16:41,279 --> 00:16:44,240 there's lots of ways to manage it but uh 478 00:16:44,240 --> 00:16:45,839 i i would say you know for what you 479 00:16:45,839 --> 00:16:48,079 mentioned grifter you probably had a 480 00:16:48,079 --> 00:16:50,079 really risk-averse 481 00:16:50,079 --> 00:16:51,759 jerk of a lawyer on the other side of it 482 00:16:51,759 --> 00:16:53,839 whispering in the clients here and that 483 00:16:53,839 --> 00:16:55,680 that doesn't benefit anybody i mean 484 00:16:55,680 --> 00:16:56,560 what's the whole point of that 485 00:16:56,560 --> 00:16:58,320 engagement zach 486 00:16:58,320 --> 00:16:59,920 so i have one more question and then 487 00:16:59,920 --> 00:17:01,279 we'll turn it over to q a so if you 488 00:17:01,279 --> 00:17:02,800 would like to ask questions i have the 489 00:17:02,800 --> 00:17:04,799 question answer mike right over here 490 00:17:04,799 --> 00:17:06,240 between the chairs and the booth so feel 491 00:17:06,240 --> 00:17:08,000 free to start a line right there but 492 00:17:08,000 --> 00:17:10,319 alex this uh last question is directed 493 00:17:10,319 --> 00:17:12,240 towards you and then we can uh allow the 494 00:17:12,240 --> 00:17:14,640 testers to opine i think the coal fire 495 00:17:14,640 --> 00:17:16,240 engagement proved that the get out of 496 00:17:16,240 --> 00:17:19,359 jail free card is not really a thing 497 00:17:19,359 --> 00:17:21,599 so with that uh one of the things that 498 00:17:21,599 --> 00:17:23,359 was important that everyone noticed was 499 00:17:23,359 --> 00:17:25,280 that coal fire was the company that did 500 00:17:25,280 --> 00:17:27,039 the test but the two testers were the 501 00:17:27,039 --> 00:17:28,480 ones in jail 502 00:17:28,480 --> 00:17:31,360 right so for our penetration testers 503 00:17:31,360 --> 00:17:32,640 that are doing those physical social 504 00:17:32,640 --> 00:17:34,400 engineering engagements 505 00:17:34,400 --> 00:17:36,000 what can they do 506 00:17:36,000 --> 00:17:37,360 differently or what can they do to work 507 00:17:37,360 --> 00:17:38,480 with their company to make sure they 508 00:17:38,480 --> 00:17:40,400 don't end up in jail 509 00:17:40,400 --> 00:17:42,960 or is that just part of the risk of this 510 00:17:42,960 --> 00:17:45,039 work now it goes back to 511 00:17:45,039 --> 00:17:46,880 you know full circle of what we started 512 00:17:46,880 --> 00:17:49,440 on right which is that this is an an 513 00:17:49,440 --> 00:17:51,200 area where you're always going to be on 514 00:17:51,200 --> 00:17:53,679 the edge of legality right no matter 515 00:17:53,679 --> 00:17:55,280 what there could be a something could be 516 00:17:55,280 --> 00:17:57,600 misinterpreted something can go wrong 517 00:17:57,600 --> 00:17:59,120 at any moment and frankly that's 518 00:17:59,120 --> 00:18:00,880 probably why you should be charging more 519 00:18:00,880 --> 00:18:02,240 for these types of engagements because 520 00:18:02,240 --> 00:18:04,320 there is so much inherent risk there but 521 00:18:04,320 --> 00:18:06,160 let's the coal fire engagement was from 522 00:18:06,160 --> 00:18:07,919 a couple of years ago but let's go back 523 00:18:07,919 --> 00:18:10,160 like 16 17 years ago where there was a 524 00:18:10,160 --> 00:18:13,039 somewhat similar situation with hp you 525 00:18:13,039 --> 00:18:15,600 know and hp i can't remember the name of 526 00:18:15,600 --> 00:18:17,760 the chair person 527 00:18:17,760 --> 00:18:19,440 i believe it was a woman 528 00:18:19,440 --> 00:18:22,720 she had a problem with some 529 00:18:22,720 --> 00:18:24,559 leakings happening to the media and she 530 00:18:24,559 --> 00:18:25,840 believed that it was happening over at 531 00:18:25,840 --> 00:18:27,760 the board level and so what she did was 532 00:18:27,760 --> 00:18:29,280 she got in touch with people in the 533 00:18:29,280 --> 00:18:30,640 general counsel's office general 534 00:18:30,640 --> 00:18:33,039 counsel's office of hp then hired 535 00:18:33,039 --> 00:18:36,080 investigators who then pre-texted 536 00:18:36,080 --> 00:18:38,640 and impersonated certain members of the 537 00:18:38,640 --> 00:18:41,120 board to access their telephone records 538 00:18:41,120 --> 00:18:43,360 to see who was actually going and 539 00:18:43,360 --> 00:18:45,679 talking with the media and once this got 540 00:18:45,679 --> 00:18:46,480 out 541 00:18:46,480 --> 00:18:48,320 well you know there were criminal 542 00:18:48,320 --> 00:18:50,160 charges against the lawyers involved 543 00:18:50,160 --> 00:18:51,840 against the investigators involved both 544 00:18:51,840 --> 00:18:54,240 at the federal and the state level 545 00:18:54,240 --> 00:18:56,400 i think it ultimately ended with 546 00:18:56,400 --> 00:18:58,320 community service from a bunch of people 547 00:18:58,320 --> 00:18:59,840 pleaded out with community service but 548 00:18:59,840 --> 00:19:01,360 that was another case from you know a 549 00:19:01,360 --> 00:19:03,600 decade and a half earlier where there 550 00:19:03,600 --> 00:19:05,919 were real real world consequences and 551 00:19:05,919 --> 00:19:07,440 then that led to 552 00:19:07,440 --> 00:19:09,919 federal law being passed preventing you 553 00:19:09,919 --> 00:19:12,480 from pretexting to obtain telephone 554 00:19:12,480 --> 00:19:14,320 records and i think you know you've got 555 00:19:14,320 --> 00:19:15,600 to be really careful when you're dealing 556 00:19:15,600 --> 00:19:17,520 with telephone records and financial 557 00:19:17,520 --> 00:19:18,960 records because you have the graham 558 00:19:18,960 --> 00:19:21,600 leach bliley act and then this telephone 559 00:19:21,600 --> 00:19:23,520 records privacy protection act i can't 560 00:19:23,520 --> 00:19:25,120 remember the name of the actual statute 561 00:19:25,120 --> 00:19:26,640 but that's a big problem but to go back 562 00:19:26,640 --> 00:19:28,160 to the coal fire thing you really have 563 00:19:28,160 --> 00:19:30,160 to level set i think with the employer 564 00:19:30,160 --> 00:19:32,000 and the employee you have to have 565 00:19:32,000 --> 00:19:34,320 you can have a get out of jail free card 566 00:19:34,320 --> 00:19:35,840 you got to make sure that you have the 567 00:19:35,840 --> 00:19:38,000 right contacts on there that it's up to 568 00:19:38,000 --> 00:19:39,840 date that it specifies the date and the 569 00:19:39,840 --> 00:19:41,280 time that you're doing this and that you 570 00:19:41,280 --> 00:19:43,280 are caught or whatever happens within 571 00:19:43,280 --> 00:19:45,120 that particular scope all of these 572 00:19:45,120 --> 00:19:46,880 things have to be really detailed you 573 00:19:46,880 --> 00:19:48,960 want to have at least two contacts on 574 00:19:48,960 --> 00:19:50,400 that get out of jail free card because 575 00:19:50,400 --> 00:19:52,160 one of them's going to be spelunking in 576 00:19:52,160 --> 00:19:54,240 paraguay or something and inevitably 577 00:19:54,240 --> 00:19:55,840 when you get picked up 578 00:19:55,840 --> 00:19:57,039 and uh 579 00:19:57,039 --> 00:19:58,799 yeah it's it's really really risky and i 580 00:19:58,799 --> 00:20:02,000 think anything that touches on physical 581 00:20:02,000 --> 00:20:04,320 intrusion especially into i think like a 582 00:20:04,320 --> 00:20:06,000 coal fire engagement i think it was a 583 00:20:06,000 --> 00:20:08,159 courthouse right yeah that's a little 584 00:20:08,159 --> 00:20:10,799 bit crazy right i mean you may also want 585 00:20:10,799 --> 00:20:13,120 to give some other depending upon the 586 00:20:13,120 --> 00:20:15,120 risk level there's some third-party 587 00:20:15,120 --> 00:20:17,200 notification even perhaps to like the 588 00:20:17,200 --> 00:20:19,760 local police or the judiciary itself 589 00:20:19,760 --> 00:20:22,400 that something is going to go down 590 00:20:22,400 --> 00:20:24,559 i know it takes away from the veracity 591 00:20:24,559 --> 00:20:26,480 of the emulation 592 00:20:26,480 --> 00:20:29,120 but it also reduces some of the risk so 593 00:20:29,120 --> 00:20:31,919 there are ways to do it i think you know 594 00:20:31,919 --> 00:20:34,080 there's a pitch to to talk with a lawyer 595 00:20:34,080 --> 00:20:36,320 first before you do anything that risky 596 00:20:36,320 --> 00:20:37,919 and as someone who talked to the coal 597 00:20:37,919 --> 00:20:40,240 fire guys it's like one thing that that 598 00:20:40,240 --> 00:20:41,440 saved them 599 00:20:41,440 --> 00:20:43,760 immensely was 600 00:20:43,760 --> 00:20:46,799 get as much uh good receipts you know 601 00:20:46,799 --> 00:20:48,480 show the receipts make sure that you're 602 00:20:48,480 --> 00:20:50,640 talking to the employers and the people 603 00:20:50,640 --> 00:20:52,400 your clients and making sure that 604 00:20:52,400 --> 00:20:54,400 there's a written record that can you 605 00:20:54,400 --> 00:20:56,640 can go back on because when they find 606 00:20:56,640 --> 00:20:58,320 out that the stuff hits the fire they 607 00:20:58,320 --> 00:20:59,840 can go oh no we didn't really put that 608 00:20:59,840 --> 00:21:02,000 in scope oh we really didn't say that 609 00:21:02,000 --> 00:21:04,400 they could do that you make sure you 610 00:21:04,400 --> 00:21:07,039 have the recordings that you have 611 00:21:07,039 --> 00:21:09,280 any kind of agreement it's like verbal 612 00:21:09,280 --> 00:21:11,360 or written and you have documentation of 613 00:21:11,360 --> 00:21:14,080 it to prove what what went on yeah 614 00:21:14,080 --> 00:21:15,600 totally agree totally agree with that 615 00:21:15,600 --> 00:21:17,360 and just to expand on it i think that's 616 00:21:17,360 --> 00:21:19,360 so important you got to keep these these 617 00:21:19,360 --> 00:21:21,120 records anything that's outside the 618 00:21:21,120 --> 00:21:23,039 contract the negotiations that you went 619 00:21:23,039 --> 00:21:25,600 through and and nothing is going to 620 00:21:25,600 --> 00:21:27,760 prevent you from getting arrested right 621 00:21:27,760 --> 00:21:29,600 you know a cop might pick you up take 622 00:21:29,600 --> 00:21:30,720 you down the station you might have 623 00:21:30,720 --> 00:21:32,799 criminal charge pending against you but 624 00:21:32,799 --> 00:21:34,640 at that point you probably want to make 625 00:21:34,640 --> 00:21:36,480 sure you know earlier on that you have 626 00:21:36,480 --> 00:21:38,000 indemnification provisions in your 627 00:21:38,000 --> 00:21:39,200 contract so that you know the 628 00:21:39,200 --> 00:21:40,960 organization that's the target of your 629 00:21:40,960 --> 00:21:42,640 testing you know might be on the hook to 630 00:21:42,640 --> 00:21:44,320 pay for your legal fees or at least you 631 00:21:44,320 --> 00:21:46,320 know indemnify you for whatever they are 632 00:21:46,320 --> 00:21:47,919 but if you've got the the records that 633 00:21:47,919 --> 00:21:50,000 jason's mentioning that negates that 634 00:21:50,000 --> 00:21:52,640 mental element of the crime right and so 635 00:21:52,640 --> 00:21:55,120 you should be able to hire a lawyer 636 00:21:55,120 --> 00:21:57,360 yeah and who was going to talk with the 637 00:21:57,360 --> 00:21:59,200 local prosecutor and get these charges 638 00:21:59,200 --> 00:22:01,039 dismissed because you are going they are 639 00:22:01,039 --> 00:22:02,400 going to have a deficient charge if you 640 00:22:02,400 --> 00:22:04,480 don't have that mental element there you 641 00:22:04,480 --> 00:22:06,480 should be able to get this dismissed but 642 00:22:06,480 --> 00:22:08,720 it's stressful and it's risky and you 643 00:22:08,720 --> 00:22:11,440 have to be really careful about it 644 00:22:11,440 --> 00:22:14,400 excellent first question 645 00:22:20,240 --> 00:22:21,280 please 646 00:22:21,280 --> 00:22:23,440 is it still not on there you go i think 647 00:22:23,440 --> 00:22:25,120 you're wrong you just got to be closer 648 00:22:25,120 --> 00:22:27,840 all right i'll eat the mic real quick 649 00:22:27,840 --> 00:22:32,240 um so uh question for alex uh 650 00:22:32,240 --> 00:22:33,200 what's 651 00:22:33,200 --> 00:22:34,320 if there is 652 00:22:34,320 --> 00:22:36,559 what do you think the threshold is for 653 00:22:36,559 --> 00:22:37,760 testers 654 00:22:37,760 --> 00:22:40,720 um who come across a 655 00:22:40,720 --> 00:22:42,320 uh critical 656 00:22:42,320 --> 00:22:43,679 uh 657 00:22:43,679 --> 00:22:46,720 like uh life-threatening vulnerability 658 00:22:46,720 --> 00:22:49,600 uh or whistleblowing status 659 00:22:49,600 --> 00:22:50,400 and 660 00:22:50,400 --> 00:22:52,080 uh a second 661 00:22:52,080 --> 00:22:54,559 uh for testers um 662 00:22:54,559 --> 00:22:57,679 when you're dealing with uh 663 00:22:57,679 --> 00:23:00,880 let's say morally questionable clients 664 00:23:00,880 --> 00:23:03,360 or you know people you contract 665 00:23:03,360 --> 00:23:05,600 what's your personal ethical 666 00:23:05,600 --> 00:23:07,919 guidelines for dealing with people or 667 00:23:07,919 --> 00:23:09,600 determining whether you'll deal with 668 00:23:09,600 --> 00:23:11,840 people thank you all right sure so i'll 669 00:23:11,840 --> 00:23:14,480 take the first part of that uh you know 670 00:23:14,480 --> 00:23:16,400 so if you come across something 671 00:23:16,400 --> 00:23:18,240 that is absolutely critical it could be 672 00:23:18,240 --> 00:23:19,760 life-threatening and you want to turn 673 00:23:19,760 --> 00:23:21,280 this into some kind of whistle-blowing 674 00:23:21,280 --> 00:23:22,880 situation i mean you're doing it at your 675 00:23:22,880 --> 00:23:24,960 own peril at that point right i mean 676 00:23:24,960 --> 00:23:26,880 the the organization 677 00:23:26,880 --> 00:23:28,640 that you're dealing with might have some 678 00:23:28,640 --> 00:23:30,799 kind of tip line or whistle blowing line 679 00:23:30,799 --> 00:23:32,880 large organizations generally do i used 680 00:23:32,880 --> 00:23:34,640 to be the chief compliance officer of a 681 00:23:34,640 --> 00:23:36,320 very big uh 682 00:23:36,320 --> 00:23:37,840 luxury conglomerate and i ran the 683 00:23:37,840 --> 00:23:39,360 whistleblowing line for that the 684 00:23:39,360 --> 00:23:41,200 worldwide whistleblowing line and was 685 00:23:41,200 --> 00:23:42,960 amazing some of the stuff that you would 686 00:23:42,960 --> 00:23:44,320 see come in some of it was really 687 00:23:44,320 --> 00:23:46,559 important some of it wasn't but all of 688 00:23:46,559 --> 00:23:48,240 it has to be investigated and so that 689 00:23:48,240 --> 00:23:51,120 might be one avenue to pursue there are 690 00:23:51,120 --> 00:23:52,080 certain 691 00:23:52,080 --> 00:23:54,080 uh legal protections for whistleblowers 692 00:23:54,080 --> 00:23:56,480 but it might get you in significant hot 693 00:23:56,480 --> 00:23:58,080 water if your 694 00:23:58,080 --> 00:24:00,799 identity comes out and it 695 00:24:00,799 --> 00:24:02,799 shows that you know was your your for 696 00:24:02,799 --> 00:24:05,360 your employer you know that um is 697 00:24:05,360 --> 00:24:06,960 responsible for this big mess that 698 00:24:06,960 --> 00:24:09,679 you've now caused this client so you're 699 00:24:09,679 --> 00:24:11,600 doing so at your own peril i would say 700 00:24:11,600 --> 00:24:14,559 to definitely talk to a lawyer before 701 00:24:14,559 --> 00:24:17,039 you make any moves that's i think the 702 00:24:17,039 --> 00:24:18,799 best advice that i could give because 703 00:24:18,799 --> 00:24:20,240 all of this is going to be context 704 00:24:20,240 --> 00:24:22,720 dependent fact driven 705 00:24:22,720 --> 00:24:24,640 and it will also depend on the 706 00:24:24,640 --> 00:24:26,640 organization if the organization is in 707 00:24:26,640 --> 00:24:28,720 like the defense industrial base there's 708 00:24:28,720 --> 00:24:30,320 going to be a lot of ramifications for 709 00:24:30,320 --> 00:24:32,080 that particular company there may be 710 00:24:32,080 --> 00:24:34,480 better ways for you to approach it 711 00:24:34,480 --> 00:24:36,559 but i think um yeah i think the best 712 00:24:36,559 --> 00:24:38,080 advice i could say is definitely talk to 713 00:24:38,080 --> 00:24:40,400 a lawyer before you make any moves um 714 00:24:40,400 --> 00:24:42,320 and and be prepared to be without a 715 00:24:42,320 --> 00:24:44,720 paycheck 716 00:24:44,720 --> 00:24:46,799 i can straight out tell you it's like uh 717 00:24:46,799 --> 00:24:48,159 i had a uh 718 00:24:48,159 --> 00:24:50,240 a family that used to was raised on uh 719 00:24:50,240 --> 00:24:51,919 food stamps and government cheese and i 720 00:24:51,919 --> 00:24:53,600 used to buy a dumpster it's like i could 721 00:24:53,600 --> 00:24:56,400 lose a job in a heartbeat it's like so 722 00:24:56,400 --> 00:24:58,400 there's no job worth me doing something 723 00:24:58,400 --> 00:25:01,440 like that so uh yeah i i've turned down 724 00:25:01,440 --> 00:25:03,760 contracts i've i've told people stuff 725 00:25:03,760 --> 00:25:05,600 that they don't want to hear not my 726 00:25:05,600 --> 00:25:08,320 problem it's like so uh and it's never 727 00:25:08,320 --> 00:25:10,320 going to be it's like they can't 728 00:25:10,320 --> 00:25:12,559 make it worse it's like i mean my worst 729 00:25:12,559 --> 00:25:15,039 day now is better than my best day then 730 00:25:15,039 --> 00:25:17,440 so sorry mother you i've told my boss 731 00:25:17,440 --> 00:25:18,720 that once 732 00:25:18,720 --> 00:25:21,360 it's like so it's like that's the way i 733 00:25:21,360 --> 00:25:23,440 stand on it it's like i just no you can 734 00:25:23,440 --> 00:25:25,279 get a different job you can't get a 735 00:25:25,279 --> 00:25:28,600 different soul 736 00:25:38,159 --> 00:25:40,000 um i really like that you mentioned the 737 00:25:40,000 --> 00:25:42,960 idea uh as much of us 738 00:25:42,960 --> 00:25:44,320 don't like to talk with cops or deal 739 00:25:44,320 --> 00:25:46,640 with cops or be around cops but the idea 740 00:25:46,640 --> 00:25:48,799 of informing potentially law enforcement 741 00:25:48,799 --> 00:25:50,720 it's actually something that our firm 742 00:25:50,720 --> 00:25:52,960 has started to do after gabby and justin 743 00:25:52,960 --> 00:25:54,559 experienced what they did 744 00:25:54,559 --> 00:25:57,520 what do you think of the fact that even 745 00:25:57,520 --> 00:25:59,600 in those contexts we are all social 746 00:25:59,600 --> 00:26:01,360 engineers and we 747 00:26:01,360 --> 00:26:03,760 massage even that language for example 748 00:26:03,760 --> 00:26:06,480 we will not engage with local police 749 00:26:06,480 --> 00:26:08,799 even if it's a local towny job we'll 750 00:26:08,799 --> 00:26:10,799 actually talk to the states or the 751 00:26:10,799 --> 00:26:12,799 sheriff and we'll massage their ego 752 00:26:12,799 --> 00:26:14,880 we'll be like hey you understand like we 753 00:26:14,880 --> 00:26:16,480 can't talk to the locals because they 754 00:26:16,480 --> 00:26:18,080 might bowl with these cats but like if 755 00:26:18,080 --> 00:26:19,120 you 756 00:26:19,120 --> 00:26:20,960 don't communicate this at roll call but 757 00:26:20,960 --> 00:26:22,880 like just tell your chief deputy if you 758 00:26:22,880 --> 00:26:24,880 think they can be read in and they love 759 00:26:24,880 --> 00:26:26,240 that they're like oh yeah i totally 760 00:26:26,240 --> 00:26:27,919 understand discretion 761 00:26:27,919 --> 00:26:29,440 and we also don't say we're going to 762 00:26:29,440 --> 00:26:30,960 break in we say 763 00:26:30,960 --> 00:26:33,600 we were contracted to trespass on the 764 00:26:33,600 --> 00:26:35,440 property 765 00:26:35,440 --> 00:26:37,600 which like if push comes to handcuffs 766 00:26:37,600 --> 00:26:38,720 someone's going to say something it's 767 00:26:38,720 --> 00:26:40,720 like oh no no like sheriff so and so 768 00:26:40,720 --> 00:26:42,720 like oh they were ready on the project 769 00:26:42,720 --> 00:26:44,640 but do you do you think it's okay to 770 00:26:44,640 --> 00:26:46,720 play in that gray area and to massage 771 00:26:46,720 --> 00:26:48,480 egos even while we're trying to cover 772 00:26:48,480 --> 00:26:50,960 our asses and 773 00:26:50,960 --> 00:26:52,880 as a i just don't like messing with the 774 00:26:52,880 --> 00:26:55,840 po-po it's like uh just i mean let's put 775 00:26:55,840 --> 00:26:58,000 i mean i used to work as a supplemental 776 00:26:58,000 --> 00:26:59,520 officer for a gang task force back in 777 00:26:59,520 --> 00:27:01,039 the 90s okay 778 00:27:01,039 --> 00:27:03,200 horrendous people it's like it's gotten 779 00:27:03,200 --> 00:27:05,200 worse and it's like one of the reasons 780 00:27:05,200 --> 00:27:08,159 why i quit well that and and the bullet 781 00:27:08,159 --> 00:27:12,080 but uh no i i'm seriously it's not uh 782 00:27:12,080 --> 00:27:14,159 something i want to deal with because 783 00:27:14,159 --> 00:27:16,960 the authorities the authority and the 784 00:27:16,960 --> 00:27:20,720 way that the the police will respond 785 00:27:20,720 --> 00:27:23,600 is improportionate and it's like and 786 00:27:23,600 --> 00:27:26,240 let's face it i'm a white guy so it's 787 00:27:26,240 --> 00:27:28,000 going to be a lot easier for me than 788 00:27:28,000 --> 00:27:29,600 several other people that are trying to 789 00:27:29,600 --> 00:27:32,880 do that it's like but that doesn't make 790 00:27:32,880 --> 00:27:34,880 it right that makes it worse 791 00:27:34,880 --> 00:27:37,840 and it's like so no i do not trust the 792 00:27:37,840 --> 00:27:39,919 way that they do policing these days the 793 00:27:39,919 --> 00:27:43,200 way that it takes two years 794 00:27:43,200 --> 00:27:46,080 to get a cosmetology license in texas to 795 00:27:46,080 --> 00:27:47,279 cut hair 796 00:27:47,279 --> 00:27:49,679 for those lethal weapons called scissors 797 00:27:49,679 --> 00:27:51,279 takes six months to get a t closed 798 00:27:51,279 --> 00:27:53,200 certification for a police officer in 799 00:27:53,200 --> 00:27:55,360 texas and they got a gun 800 00:27:55,360 --> 00:27:57,120 it's like so i'm sorry 801 00:27:57,120 --> 00:28:01,120 back in my day i did community policing 802 00:28:01,120 --> 00:28:02,640 we got to know the people in the area we 803 00:28:02,640 --> 00:28:03,840 got to show them they got to know that 804 00:28:03,840 --> 00:28:05,760 i'm not there just to try to shoot them 805 00:28:05,760 --> 00:28:07,840 i'm there to try to make it better not 806 00:28:07,840 --> 00:28:09,919 be part of the problem we don't have 807 00:28:09,919 --> 00:28:13,120 that anymore it's like so i'm sorry i 808 00:28:13,120 --> 00:28:15,360 don't trust police officers on an 809 00:28:15,360 --> 00:28:18,000 engagement not to overreact and get a 810 00:28:18,000 --> 00:28:20,240 little upset and get their feelings hurt 811 00:28:20,240 --> 00:28:23,200 and throw me in jail coal fire and just 812 00:28:23,200 --> 00:28:24,480 because 813 00:28:24,480 --> 00:28:27,279 sore losers because these sore losers 814 00:28:27,279 --> 00:28:28,720 aren't just gonna like you know pout 815 00:28:28,720 --> 00:28:32,399 about it they can shoot it out 816 00:28:36,080 --> 00:28:38,000 i i think like i mean we all we all 817 00:28:38,000 --> 00:28:39,200 think about that right we carry the 818 00:28:39,200 --> 00:28:40,720 letter and we go all right well we might 819 00:28:40,720 --> 00:28:43,039 go to jail today so like let me put this 820 00:28:43,039 --> 00:28:45,039 in my pocket uh 821 00:28:45,039 --> 00:28:46,720 as far as like safety goes in dealing 822 00:28:46,720 --> 00:28:48,399 with law enforcement i think the like 823 00:28:48,399 --> 00:28:50,000 one of the times that i was the most 824 00:28:50,000 --> 00:28:52,480 concerned um wasn't when i thought law 825 00:28:52,480 --> 00:28:54,000 enforcement themselves would be involved 826 00:28:54,000 --> 00:28:56,640 but when private security was involved 827 00:28:56,640 --> 00:28:59,120 um we were doing a physical engagement 828 00:28:59,120 --> 00:29:01,840 in a very very wealthy neighborhood um 829 00:29:01,840 --> 00:29:03,679 in the la area 830 00:29:03,679 --> 00:29:05,440 and they had private security in there 831 00:29:05,440 --> 00:29:07,120 and like so we checked them out you know 832 00:29:07,120 --> 00:29:08,559 and they had like what i can only 833 00:29:08,559 --> 00:29:10,640 describe as a movie trailer about how 834 00:29:10,640 --> 00:29:12,799 awesome they were on their website it 835 00:29:12,799 --> 00:29:14,880 was insane 836 00:29:14,880 --> 00:29:18,159 um and i was with two um you know junior 837 00:29:18,159 --> 00:29:21,440 testers were with me and i was like 838 00:29:21,440 --> 00:29:22,559 normally you know when you're on 839 00:29:22,559 --> 00:29:23,679 engagement you'll try to talk your way 840 00:29:23,679 --> 00:29:25,039 out of something you'll try to find your 841 00:29:25,039 --> 00:29:27,039 way out of there whatever and i'm like 842 00:29:27,039 --> 00:29:29,919 that's not today like today 843 00:29:29,919 --> 00:29:31,520 if something happens you lay on the 844 00:29:31,520 --> 00:29:33,360 ground immediately and put your letter 845 00:29:33,360 --> 00:29:34,720 on your back like that's it get your 846 00:29:34,720 --> 00:29:36,559 letter put on your back and lay down 847 00:29:36,559 --> 00:29:39,120 that's it we die today if barney fife 848 00:29:39,120 --> 00:29:41,039 decides that he's got a you know a 849 00:29:41,039 --> 00:29:43,120 chance to do something and i'm like do 850 00:29:43,120 --> 00:29:45,440 not give these guys an opportunity like 851 00:29:45,440 --> 00:29:47,679 just lay on the ground and be careful 852 00:29:47,679 --> 00:29:50,240 like the letter out i uh this reminds me 853 00:29:50,240 --> 00:29:51,440 of the story i've used in the talk 854 00:29:51,440 --> 00:29:54,159 before where in 2000 i was doing an 855 00:29:54,159 --> 00:29:55,919 assessment and i was coming out of the 856 00:29:55,919 --> 00:29:57,520 dumpsters it's like spent a lot of time 857 00:29:57,520 --> 00:29:59,600 in dumpsters and i'm coming out and i'm 858 00:29:59,600 --> 00:30:02,399 all happy because i got uh the 859 00:30:02,399 --> 00:30:04,640 blueprints for the bank 860 00:30:04,640 --> 00:30:06,559 that they're working on and if you do 861 00:30:06,559 --> 00:30:08,159 banking you know blueprints are pretty 862 00:30:08,159 --> 00:30:10,640 nice to have that's a good trophy and so 863 00:30:10,640 --> 00:30:12,000 i'm about to get out of the dumpster so 864 00:30:12,000 --> 00:30:14,159 i can do my happy route dance it's like 865 00:30:14,159 --> 00:30:15,840 also not seeing these blue and flashing 866 00:30:15,840 --> 00:30:17,840 lights i'm like i didn't ask disco 867 00:30:17,840 --> 00:30:19,600 lights my happy root day but i'll take 868 00:30:19,600 --> 00:30:22,799 it until i hear these two cops 869 00:30:22,799 --> 00:30:25,039 uh open up their doors and this one it's 870 00:30:25,039 --> 00:30:26,480 like he had to have been a rookie man 871 00:30:26,480 --> 00:30:28,240 because he was like screaming the it's 872 00:30:28,240 --> 00:30:29,840 like 873 00:30:29,840 --> 00:30:32,399 i'm in texas i could die and so it's 874 00:30:32,399 --> 00:30:34,159 like so i'm like i'm 875 00:30:34,159 --> 00:30:37,600 just reaching into m i'm like literally 876 00:30:37,600 --> 00:30:40,080 showing my butt because it's like i mean 877 00:30:40,080 --> 00:30:42,000 it might hurt less it's like the shooter 878 00:30:42,000 --> 00:30:44,480 there to pull out the letter 879 00:30:44,480 --> 00:30:46,799 and it's like and then i try to sachet 880 00:30:46,799 --> 00:30:48,559 over to the guy who doesn't look like 881 00:30:48,559 --> 00:30:51,039 he's about to kill me immediately 882 00:30:51,039 --> 00:30:53,440 it's like to hand it to him and then the 883 00:30:53,440 --> 00:30:55,760 guy looked at it and glanced at it it 884 00:30:55,760 --> 00:30:57,840 was like oh they're doing some kind of 885 00:30:57,840 --> 00:30:59,919 security thing it's all good and just 886 00:30:59,919 --> 00:31:01,519 let go and that's when i realized they 887 00:31:01,519 --> 00:31:02,880 didn't check for a nump they didn't call 888 00:31:02,880 --> 00:31:04,720 the number that was on there they didn't 889 00:31:04,720 --> 00:31:06,559 check any kind of verification and 890 00:31:06,559 --> 00:31:09,279 that's why every engagement now i carry 891 00:31:09,279 --> 00:31:12,000 a forged get out of jail free card with 892 00:31:12,000 --> 00:31:14,000 my people's information on it and phone 893 00:31:14,000 --> 00:31:15,919 numbers it's like instead of the other 894 00:31:15,919 --> 00:31:17,600 people because that's been very 895 00:31:17,600 --> 00:31:19,200 effective as well 896 00:31:19,200 --> 00:31:20,960 and that's why when i commit actual 897 00:31:20,960 --> 00:31:23,519 crimes i carry a fake letter too yeah 898 00:31:23,519 --> 00:31:26,159 exactly 899 00:31:26,799 --> 00:31:28,399 pro tips you're only going to get them 900 00:31:28,399 --> 00:31:29,600 here 901 00:31:29,600 --> 00:31:31,440 all right that's it for our questions a 902 00:31:31,440 --> 00:31:34,559 round of applause for our steam panel 903 00:31:34,559 --> 00:31:36,880 alex griffner jason corgi thank you so 904 00:31:36,880 --> 00:31:38,799 much for spending your evening with us i 905 00:31:38,799 --> 00:31:39,679 have 906 00:31:39,679 --> 00:31:41,919 somewhere in my pocket of tricks 907 00:31:41,919 --> 00:31:42,960 receipts 908 00:31:42,960 --> 00:31:44,960 and our challenge coins if you pass 909 00:31:44,960 --> 00:31:48,480 those down or just take them all 910 00:31:49,600 --> 00:31:51,919 you saw i gave out four 911 00:31:51,919 --> 00:31:53,679 uh thank you again so much for joining 912 00:31:53,679 --> 00:31:55,279 us and helping uh talk about the 913 00:31:55,279 --> 00:31:57,919 legality ethics and morality in social 914 00:31:57,919 --> 00:31:59,600 engineering thank you everyone for 915 00:31:59,600 --> 00:32:01,440 attending for participating have a great 916 00:32:01,440 --> 00:32:04,440 night 917 00:32:12,120 --> 00:32:16,349 [Music]