I kid you not. Okay, this shows age.
We're doing a talk, so we're going to have some fun.
You realize I'm going to piss you off because I'm going to walk backwards and forwards on this stage.
This shows age. I still have, so...
I think I still have the Polaroid that I took out of the window
of the Flamingo looking over the Bellagio and the tall shower
that they have over there from 20-odd years ago when my daughter...
Once upon a time, I tried this whole marriage thing.
I ended up getting married 20... it was actually 20 years ago.
Because Morgan was born in 2003. Here we are, 2023.
I still got the one freaking Polaroid from the White Chapel wedding chapel place
from 20 years ago in this freaking place.
And that was, I think, whatever it was, DEF CON 10 or 11.
DEF CON 11. What are we, 31 this year, isn't it?
Jeez. First one, I think, was like number 6 or number 7.
So I just dated my... I can't do this.
I need my hands. Sorry. I need hands. I got to do hands. Is that all right?
You're going to hate me. Anyway, I'm doing hands.
All right, so we're going to have a talk.
And we're going to talk about the human aspect of things.
How many of you are here for the first time? Start with an easy one.
Holy sh... Bloody hell.
Well, first and foremost, welcome.
Secondly, those of us that have been here numerous times,
find one of these people that's here first time and help them.
DEF CON has gone to the point where even I have to find a map to figure out where the hell I'm going.
Okay, so there are a lot of people here who have not been here.
This is family.
You help people here. All right? First and foremost.
How many of you are following .mil or .gov?
Family.
You help each other. You collaborate with each other.
Do you find somebody getting lost? Do you find somebody that doesn't know the way around?
Take them under your wing and have fun with them.
Don't get them drunk and get pictures of them on the Internet.
That's happened before.
Do not fall asleep at DEF CON in an open area.
You will wake up. There will be ink on your face.
There will be... just don't do it.
20 years ago, the worst you had was a Polaroid.
This day, it's going to end up all over the bloody Internet. Let's face it.
For me, in this day and age,
this whole conference is about seeing people.
I come here to catch up with family.
Front row.
I come here to catch up with people I know.
I come here, honestly, probably like a lot of you,
to see what's out there work-wise as well.
How many of you here are looking for jobs?
OK.
Those of you that are looking for people,
now you know who to talk with.
There was somebody wandering around with a breadboard just now
for somebody that was looking for a job.
This whole industry,
for 20, 30, 40 years,
we've been talking about technology.
We've chased technology.
And we've forgotten about the human.
I remember the days, years ago,
when we would stand up on stage
and we would lament the user.
The user kept clicking shit.
The user kept moving stuff.
The user wouldn't listen.
The user did this.
The user did that.
We blamed them.
And then when the user wouldn't change,
we blamed the network team.
And then, because the network team actually fought back,
because they're geeks as well,
we blamed the DBH,
because they're weird,
and they smell,
and they're normally in the dark in the corner somewhere.
They're easy to blame.
It was kind of fun.
They do weird database shit.
And then when we couldn't blame them anymore,
we blamed leadership.
The CFO won't give me money.
The CEO doesn't listen.
The CISO's an arse.
CISO.
CTO doesn't want to talk with me.
Chief of Engineering doesn't care.
What we failed to do
was look in the mirror.
What we failed to do was go,
how can we do differently?
How can we talk with,
not talk to,
but how can we talk with people differently?
I run a reasonable-sized team.
I run a reasonable-sized organization.
We build supersonic airplanes.
We're building.
Today, 11th of August,
we are, touch wood,
going through type approval
for our experimental jet
three and a half hours from here in Mojave.
That means we can actually do testing
faster than walking pace.
For those of you who know about
building engines and airplanes and shit,
you get to a point of no return.
So as you test this thing going up and down the runway,
if you're going fast enough,
your exit strategy is
throw a throttle and get the thing off the ground
and hope for the best.
That's where we're at with the experimental jet.
That's it.
A team of humans have been sitting in sheds
for goodness knows how many years
putting shit together.
All to do with collaboration.
All to do with working together.
Quick question.
How many of you are in security today?
How many of you are in networking
or application or development
or coding or that stuff?
Okay.
Again,
look at each other.
We're all one team.
Whether you like it or not,
whether you sit in different areas
or different buildings or different locations,
you're all one team.
As an assessor,
as somebody who's done virtual see-sawing,
as somebody who's walked into organizations,
there'll be too many...
Come and sit in.
Yeah, these guys are waving at you
not to fucking do anything other than
get your ass in and come sit down.
Bad seats at the front.
That way you can throw things
and it doesn't have to hurt as much.
I walked into a large car manufacturing facility
in the middle of...
I want to say it was Ohio or somewhere like that,
so that narrows it down to one.
I'm only a couple for you.
I walked in
and I was talking with the security team.
And they're like,
oh, we're going to go buy a new sim.
I'm like, why are you going?
Yeah, well, the network team run that.
I go, all right.
Why do you want to buy one?
Well, because they bought theirs.
I'm like, okay.
Well, we need a different one.
Well, are y'all going to talk to the network team?
Well, no, we don't meet with that.
Like, motherfuckers, why not?
Well, because they're the network team.
I'm like,
do y'all get paid from the same company?
Well, yes.
Okay.
Then take some of that money,
go down to the damn donut shop,
buy two dozen donuts,
buy a couple of gallons of coffee,
walk into their weekly meeting,
and apologize.
For being a bunch of fucking special snowflakes.
And you can see they're like,
oh, right.
You can have your silo.
I will not make you break your silo down,
but you sure as hell will build a bridge to the others.
Please.
We had to come up
with a new way
of talking with people.
And this isn't a cut on AppSec or DevSecOps.
We had to come up with a word called DevOps and DevSecOps
because we couldn't use the word collaboration.
Am I wrong?
No.
This is what we've come to.
We like the computers in front of us.
You can't hear me?
All right.
I'll use the bloody microphone.
Sorry.
I will never, ever say no,
and I will never ignore that one person.
There's a very few people on the planet I listen to.
She is one of them.
All right.
Where the hell was I?
We were talking about collaboration, weren't we?
So that is one thing.
It's...
I lost my train of thought.
I squirrel, by the way,
as you probably might have figured out.
Welcome to ADHD.
We were just talking.
So how many of you...
There's an amazing individual,
Rachel Arnold,
who is in our community.
She runs the Coffee Morning Talk.
And I was actually hunkered down over there,
just giving...
I was on the Coffee Talk this morning.
Rachel runs the damn thing.
And it was all about how to take care of yourself
in this community.
I am the poster child for how not to do it.
By far and away.
This is somebody who woke up this morning,
had to pack up the house,
because we rented the house from Monday to Friday,
forgetting that Saturday and Sunday actually existed.
And so I packed up the house.
I'm like, where am I staying tonight?
Fucked if I know.
So all of my stuff is down in the car,
in the car park at the Flamingo at the moment.
And I'll figure it out later.
We'll figure shit out.
And Rachel's like, how does that make you feel?
I'm like, eh, mildly stressed.
But the worst case scenario,
I can sleep in the back of the car,
or I'm just going to do nighttime con here.
It's more fun that way.
We've done that more years,
and you just kind of curl up on a sofa
with a watcher,
so that you don't end up getting crayoned
in the middle of the night.
So let's talk about the collaboration side.
We're talking about DevSecOps.
We're talking about AppSec.
We're talking about all this other kind of stuff.
And it definitely is one of those things.
I mean, I remember...
How many of you remember the days
when there were three layers to the internet?
There was the web server,
the application layer,
and the database layer?
Life was so much fucking simpler back then.
By the way, I will swear,
I kind of apologize in advance,
and I kind of don't.
If you have sensitive ears,
I will apologize for those,
but I'm probably not going to change
because every now and again,
the odd F-bomb has its uses.
Now, we've abstracted the internet
to such a degree that we've got, what,
20, 30, 40, 50 different layers between everything?
So no one person in our industry
can understand what the heck is going on.
We had Snowball's chance in hell.
Now, when it was three layers,
the web team could maybe send a representative
over to the network and the application team
who then might actually, like,
throw a muffin or a donut into the database team
and then charge in and ask more questions.
But nowadays, with all these bloody layers
and the abstraction,
the ability to do that is gone.
So we have to take a step away from the technology.
We have to go,
how do we work and collaborate
more efficiently and effectively together?
My office, two of the walls, whiteboards.
Because if I have people,
and we've got a local team,
we've got a few folks that are remote,
but if I've got the local team
or even the remote team,
we'll jump on the bloody whiteboard
and we'll start figuring shit out.
It's the easiest way.
Yes, there's all the online stuff
that you can use.
I still like my whiteboards.
It's easier to rub shit out on them still.
And it's all about the collaboration side of things.
It's all about,
how do we talk with each other?
How do we work with each other?
You know, how many of you
are sitting here with collaboration tools
on your phones right now?
Because I know that I'm trying to keep an eye.
As I'm walking around here,
people are like,
hey, where are you?
On LinkedIn.
I can't do Twitter anymore.
I got banned from Twitter.
Yeah.
Fuck if it's X.
Stupid shit.
I mean, seriously.
Do you want to talk about
the ultimate of narcissism?
Buy a company for $44 billion
and change its name
to the one you've held on for 20 years.
I'm like, you asshole.
You know, I'm sitting there.
I'm trying to coordinate life across,
you know, like text messaging
and WhatsApp and Signal and LinkedIn.
I'm like, I'm just here.
I'm putting a point in the map
hope for the best and off we go.
That's about as good as it gets.
And so we've, again,
taken the ability to communicate
and now we've fragmented communication.
My ask is one thing
for anybody who wants to develop.
Could I please have one tool
that actually narrows all of those
into one freaking place, please?
Yeah, no shit.
Tell me about it.
Good.
God's alive.
So let's talk a little bit
about journeys and stuff.
Let's talk a little bit about journeys.
How many of you...
That's just a quick show of hands.
How many of you have been in this industry,
say, for five plus
or maybe ten plus years?
Nice.
So we're going to hope...
How many of you are just coming into this industry
wondering what the hell is going on?
Like three to five years in this industry.
Yeah.
Okay, again,
those of us that are old farts
in this industry,
find one of these people.
Don't abuse them.
Don't get them drunk too much.
Don't take naked photos of them.
But take them under your wing
and help them, please.
Because this is family.
These are called villages
for a bloody good reason.
Years ago,
all the villages
were in one sodding area.
And then everybody realized
that the villages
were about as much fun
as going to a main talk.
You didn't have to stand in line
for three hours,
which is rather useful.
So this is where
we all learn.
I go online
and everybody says,
hey, how did you get into this industry?
I'm like, get your asses here
and volunteer.
One,
you get a free badge
more often than not.
Secondly,
somebody often
comes to your room,
if you're lucky.
But you get to hang out
with people.
You get to learn.
You get to talk.
Most of us
come into this industry
a little,
how should we say,
off kilter
in the brain department.
We don't necessarily
like to talk
to other humans.
It's easier to talk
to the keyboard.
A very, very good friend of mine,
Ryan Cloutier,
says it absolutely splendidly.
We are analog humans
working in a digital world.
And he's perfectly right.
The problem is
that digital world
is collapsing
on the analog humans
probably a lot faster
than we want it to.
Witness the latest thing
when we decided to drop
chat GPT
on almost
8 billion people
with no
sodding instructions.
It's like handing
a kid a hand grenade,
pulling the pin out
and going,
have a good time.
Some of them
will just stand there.
This is that fight,
flight,
or freeze
that humans have.
Some of them
will be like...
Some of them
will be like...
Fuck you!
And some
are going to be like,
run the fuck away!
That's the Air Force
people, by the way.
I'm sorry.
I'm sorry, yeah.
Royal Marine Commandos.
We actually took
the grenades,
stole everybody else's
fucking grenades
and charged.
After a cup of tea.
You all had coffee
in this place.
Burnt beans?
Don't do it.
Get a cup of tea.
Be civilized.
Alright.
So let's talk
absec.
Let's talk humans.
Let's talk integration
and stuff like that.
Actually, no, fuck it.
Let's talk camels.
Have any of you
heard the camel story?
How many of you have heard
the cow story
or the camel story?
None of you.
Oh, God.
I had so much fun.
This is application security.
So, years and years ago,
I'm driving across Wyoming.
I'm going...
I think I'm going up
to some corner.
I was going somewhere.
And I'm driving
across Wyoming.
I'm going rather quickly
across Wyoming.
A hundred and something silly
because you can do that
across Wyoming.
Normally, when I'm driving,
I normally have a laptop
or something with me
and there's a couple
of antennas poking out of it
and I'm trying to see
what the hell is going on
in the world.
I'm driving across
the middle of
bug fuck nowhere
in Wyoming
and the damn antennas
keep pinging at me.
I'm like,
what?
There's nothing here.
Antennas going off,
wireless networks going off,
NFC and a few.
I'm like,
what the hell is out here?
So, I pull off
to the side of the road.
Nearest one.
I back up a little bit.
I'm like,
what's here?
There's a cow
staring at me.
How are you all doing?
Bing, bing, bing.
I'm like,
what the fuck?
I get out of the car.
I try chasing the cow
across the fields.
Me versus
a thousand,
1,500 pounds
of heavyweight animal.
Not a smart thing to do,
but hacker.
I realize the cow
has an earpiece in it
and has a pedometer on.
The pedometer
is giving off
a signal.
The signal
is a GPS signal.
I'm like,
oh, this is cool.
I get online
to Google's
and I'm like,
Googling
cow pedometers.
I find out
there's these
really freaking
cool things.
And the NFCs
on the ears
are on there as well.
They talk to the pedometer.
What it's doing
is it's pulling
temperature,
heartbeat,
movement,
and a whole bunch
of other things out.
And it's sending it
to a centralized database.
Because when you buy
these pedometers,
you get a database.
It was a Windows 98 machine
at the time.
I'm like,
yay!
Play, play, play, play, play.
MySQL,
MySQL database.
So I'm sitting there
and I'm like,
well,
one has to get
one of these things.
So one purchased
one for one cow.
eBay, by the way,
great thing.
Two of my accounts
are now banned on eBay.
They haven't found
the other three yet.
I fucking love eBay.
It's so much fun
to abuse.
So I buy
one of these things,
start taking it to pieces,
and realize all the fun
and games.
I then get hold
of the vendor
and the software.
I call the vendor,
I'm like,
how are y'all doing?
And they're like,
hello.
I start talking with them
because it's a European company
and got them to send me
an application
and the system
and the software
and everything.
So I start looking at this
and I'm like,
oh, this is fun.
So then go out
to the wonderful world
of Shodan
with the tool,
with the architecture,
and find out
that half of the United States
of America land
and quite a lot of Europe
all runs these types
of databases.
Are we having fun
with the lights?
Who's fucking around
with the flippers again?
I don't mind.
I'm good.
We can be in the dark
having conversations.
It is a hacker conference
after all.
So I start figuring
this stuff out
and then I realize
that almost all the databases
are using a default user ID
and a password.
Yay!
Admin, admin for the win.
Yay!
So I start logging in.
I figure out
where all the ones are
in the middle of this
neck of the woods
and a few other neck of woods
and they update,
the pedometer updates
the GPS settings
for where this cow is
so basically the farmer
can basically round up
all his entire herd
of beef burgers
across his thousands of acres
into one place
and then send them off
for dinner.
Well, we started rewriting
the database
because it was a fun thing
to do.
So every 28 minutes
we would go into the database
and rewrite the GPS settings
with a very good friend of mine
in Colorado.
We basically figured out
digital cattle rustling.
It was so much fun.
Fast forward to last year,
I get invited to go over
to the Middle East
and they're like,
hey, can you have some fun
and do a life hack?
And I'm like,
well, I'm not going to do
a life hack in the Middle East
because that could get
really, really nasty
and they get upset
but I'm like,
I'll do a pre-recorded
attack on something
and they're like,
what are you going to do?
And I'm like,
I have no fucking clue.
So I start looking
at the neck of the woods
I'm going to in the Middle East.
They have camels.
They have beauty pageants
for these camels.
These are expensive camels.
8 million US dollar
beauty pageant camel.
Yeah, and there's a lot of them.
What I didn't realize
at the time
is a lot of them
were owned by His Excellency.
I found that one out
on stage.
Because I also found another
there was a
what it was
there's a whole bunch of folks
in like upper Mongolia
Chinese neck of the woods
that are also doing
the same kind of idea
they're basically using
pedometers on the camels
to figure out where the camels are
and he goes out
on his motorbike
this is in the middle
of bug fuck nowhere
and I'm like,
okay, let's go see
if we can make friends
with that database.
Nice Chinese database
default admin passwords on there
might look very, very similar
to the US one for cows
surprisingly enough
and so I'm like,
all right, we can have
some fun with this.
Now the ones in
it was in Saudi
for a change
so you've got to have fun
with those folks.
And what I ended up doing
was I stood up on stage
and we took all of the
Saudi camels
and moved them
to the middle of China
and took all the Chinese
flea bitten camels
and moved them
to the prestigious place
in the middle of fucking Dubai.
The middle of
wherever the hell it was
the middle of Saudi
Riyadh actually in this case.
And did this up on stage
and showed this
so apparently
he's excellently
got hold of his people
and said,
where the hell are my camels?
And the guy was looking
at the database
going,
your camels are not here.
And looking at the camel
and going,
reboot.
And so,
this goes back
to the whole concept
and the whole idea
of analog humans
in a digital world.
How are we going
as we move forward
to understand
what is reality?
How many of us
question
what we see?
How many of us
take for granted
what is put
in front of us?
Versus
ask the questions
so that we can
understand more
effectively
what we're looking at.
So this again
comes back
to the human.
It again
comes back
to asking
more questions.
We all talk
about
trust
then verify.
We should have
reversed that
a long time ago
and go
verify,
be sarcastic,
verify again,
and then
maybe trust
you for five
minutes.
Yet we don't
do that.
So again,
for those of
you in this
industry,
for those of
you building
some of the
amazing tools
out there,
take a step
back.
Are you okay?
Do you need
water?
Whoever is
dying over
there?
Don't die,
please,
it's more
paperwork.
Is she okay?
All right,
just checking.
Do we need
to take her
outside?
Okay, not
outside.
Okay, I'm
armed.
I mean,
we're fine,
it's Vegas.
The lake's
filled up
again.
So we
come back
as you're
building
something.
Take a
step back
out of
the very
world that
we live
in.
I use
my mother
as a
yardstick.
You should
all find a
parent,
guardian,
or somebody
outside of
this realm
and ask
them the
same questions.
Go, hey,
if I give
this to you,
or I put
this in
front of
you, or
I let
you use
this, or
I let
you mess
around with
it, what
do you
think?
How do
you work
this?
How do you
use
this?
Can you
use
this?
What we
take for
granted is
us.
There's
7,990,000,000
odd lots
of people
out there
that haven't
got a
sodding clue
about what
we do.
So either
we have to
make it
more effective
and more
efficient,
or we
have to
get a
communication.
So I
have another
question for
everybody.
We're in
the
village.
There are
two sets
of
community
villages.
Not
Caesars
where I
went this
morning,
but the
other
Caesars
that way.
How many
of you
are going
to go
to the
other
villages
and go
hang out
at the
other
villages?
I like
that.
One thing
I would
love to
see more
of is
how do
we
collaborate
with other
villages?
How do
you hang
out with
the
car
hacking
village?
Let's
face it,
cars are
no longer
a device
to get
you from
point A
to point
B.
Cars are
now fully
integrated
passenger
experience
environments.
We're looking
with the
stuff we're
building with
the
airplane,
I'm
looking at
taking the
settings
you have
in your
car.
I'm
looking at
taking those
settings and
building that
into the
seat that
you will
fly on
our
airplane.
That's
all
application
layer,
identity,
management,
and all
sorts of
other
fun stuff.
That's
taking an
experience
from a
human
from one
device and
moving it
on to
another
device
seamlessly.
It's the
same thing.
I'll take people's
settings from
their phones
and their
tablets and
we'll move
them on to
the
entertainment
system that
we'll have
in the
plane.
Therefore,
everything that
you have
now is the
same thing
you'll have
in front of
you when
you fly on
the
airplane.
Now,
can we
do this?
Absolutely.
Are we going to
do it and
how do we
do it and
keep the
safety and
integrity of
it?
There's some
shit to
work out
yet.
But again,
this isn't
just us
working
alone.
I got
some
fun
time
tomorrow
in the
aviation
village.
That's
collaboration
between
AppSec,
DevSecOps,
networking,
and a whole
bunch of
other
villages.
This, again,
is why we're
here.
You're here to
learn,
you're here to
network,
you're here to
talk with
people,
not two
people,
and you're
here to
collaborate
between
each other.
So what
else are we
going to
go through?
Oh, I
know.
How many
of you are
vendors?
Anybody want to
admit at
this moment
in time?
Let's talk
about that
world.
Because I
was at a
dinner last
night.
I went out
last night
to
Super
Frisco.
It's
like a
whole series
of escape
rooms with
performing
artists.
It was
amazing.
But we
were all
sitting there
and there
were four
or five
different
vendors there
and we
had
conversations
and it
was
rather
nice.
It was
good
conversations
because
they
weren't
trying to
sell
shit.
If you
end up
working
on the
vendor
space,
we
have
an
adversarial
relationship
with
vendors.
We
absolutely
have an
adversarial
relationship.
From a
CISO's
perspective,
I feel
like I'm
targeted.
From a
vendor's
perspective,
they have
to stand
out.
We have
to do
a better
job of
this.
Both
from the
CISO
and us
in
technology,
this
wouldn't
be here
without
vendors.
We
all put
money in
and the
vendors
put money
in as
well.
So,
actually,
that is a
good
reminder.
Do me
a big
favor,
with
consent,
hug
the
hell
out
of
all
the
volunteers
in
this
place.
Thank
all of
these
people.
We
wouldn't
be here
without
their
tireless
work.
I
would
say
hug
a
goon.
But
you are
going to
get your
ass
paddled
if you
do
that.
I
nowadays
we
have to
be
more
civilized.
I
can't
do
that.
I
am
just
going
to
hug
you
to
death.
Hold
on
tight.
Again, it
comes down
to
communication.
It
comes down
to
the
collaboration.
The
other thing
I will
say as
well,
I did
a LinkedIn
post.
I
know
what it
was.
It
was the
Wednesday
podcast
with
Danny.
There
are 20,
30,000
of us
here
this
year.
Respect
each
other.
When
somebody
says
no,
they
actually
mean
no.
When
you see
somebody
alone,
reach
out and
help.
Double
check with
them as
well.
We
lose too
many people
in this
industry and
in the
military on
a daily
basis.
A friendly,
hey, can
I help
you?
Is there
anything you
need?
Do you
need food?
Do you
need a
minute's
worth of
peace and
quiet or
a friendly
voice?
This
week,
especially,
as this
week rolls
on, is
key.
Do me
all a
favor,
just keep
an eye
on each
other as
well.
Make
sense?
Good.
Thank you.
How are we
doing time
wise?
We're good.
I'm going to
open it
up.
Questions
for the
crazy
one on
stage.
I'll answer
pretty much
anything.
Go for
it.
That's a good
one.
For me,
collaboration
with
vendors is
giving
them
certain
time.
Perfect
example,
vendors
outreach.
I have
three basic
responses.
First
response is,
number one,
do your
research.
If you're
asking me
for 15
minutes of
my time,
you spend
5-15
minutes
looking
me up
first.
Secondly,
I'm easy
to find
on the
internet.
Thirdly,
see if
it's
something
you think
I'm
likely
to need.
I'll
give
them
that
feedback.
If I get
the generic
outreach
email,
I'll
send
them
that
feedback.
Secondly,
if it's
something
I'm
interested
in,
my
Friday
afternoons
are set
aside
for
vendors.
If it's
something
I'm
interested
in,
we'll
schedule
a
time.
If
after
that
it's
interesting,
it
gets
passed
on to
my
team.
I
gate
keep
my
team.
Sometimes
there's
new
tech
out
there.
I
want
to
know
about
it.
Then
I'll
let
my
team
spin
their
wheels on
it.
Thirdly,
I'll
explain
back.
I
will
give
feedback
to a
vendor.
I
spent
Tuesday
or
Wednesday
with
Danny
and
the
team.
We
spent
the
entire
day
going
through
vendor
pitches.
I
needed
alcohol
after
that
day.
I
gave
back
to
that
team.
I
will
give
feedback.
It
behooves
us
to
give
feedback.
That way
we all
get better.
And
that's
critical.
Now,
that's
Friday
afternoon.
I
turn up
and I
turn up
ready to
work.
I
won't
give
them
Monday
through
Thursday.
I'm
also
plugged
into
the
VC
community.
There's
a lot
of stuff
we do
to
encourage
it the
right
way.
LinkedIn
is the
same
thing.
I've
done a
bunch of
posts
on
LinkedIn.
I try
to not
be too
spicy
and too
blunt.
Sometimes it
works,
sometimes it
doesn't.
But I
try.
Yeah,
go for
it.
Does
that
help?
Repeat
the
question.
Go
for
it,
sir.
I'm
not
repeating
this
question
unless
it's
10
seconds.
Go
for it.
Go for
the
question.
answer it
shortly
down
for me.
Yep.
Yep.
Yep.
Yep.
Yep.
Yep.
Yep.
Yep.
Yep.
Yep.
Yep.
Yep.
Yep.
Alright, that's fair. So in other words, how do we do career development within our environment?
Okay. Career development. Yeah, yeah.
Now, you're talking to somebody that left school at 16.
So, I didn't do college. I spent one year... I spent less than one year at Oxford.
I was studying pure mathematics and cryptography at Oxford. I got bored left.
So, that's my entire world in traditional education.
Outside of that, I've had my MCT, my CISSP, my CCIE, and all that other stupid shit.
They've all got dust on them.
So this is a question for all of you.
How many of you would consider yourselves professionals within your worlds?
Professional development teams. Okay. How have you got there?
Blood, sweat, hard work.
10,000 hours. Who said that?
You're awesome. Thank you. Yeah, 10,000 hours.
5 solid years, 10 solid years of work.
I think it's tough because there's so much variety.
I mean, you all... come sit down or hang out.
This for me is such a challenging environment as far as that goes.
Because there are so many languages, there are so many structures,
and there's a huge difference between developing software
for like an engineering inside an avionics system
than there is for developing, you know, something that runs...
I was going to get my phone out without flashing everybody.
Something that runs an application on here.
So you've got criticality of systems.
But the other thing is as well, think about it.
From an engineering, basic standard engineering principles
haven't changed a huge amount in a long time.
Whereas, I mean, how often does software change?
Every minute, yeah.
I was going to be like every 10-15 minutes
and be civilized about the whole thing.
But we are in such an evolving environment that, you know...
I did Pascal, I did Fortran.
God, I fucking did basic for crying out loud.
Yeah, no shit. I can still program in assembly.
So, yeah. Fuck you.
Yeah, you actually want to break into anything?
Screw all your high-level shit.
Get down to the bits and bytes.
Because you'll bypass every fucking end point known to mankind.
And it's so much fun when clan strike goes...
Wee, I didn't see you.
Yeah, no, it's...
I mean, you'll tell me if I'm wrong on this one.
From my standpoint, professional development for me
is putting the skills I have into practice.
It is continuing to evolve them.
But if I learn, let's just say I learn...
I mean, at the moment, I'm learning Rust and a whole bunch of other stuff for AI work.
I'm having some fun with AI. It ain't pretty.
I'm learning a whole bunch of that side of it.
And I'm learning the structures, the architectures, some various other bits and pieces to do.
But once I've done that, I'll reach out to a bunch of people here and go,
Hey, can you help me? Can you sort some of this stuff out?
And I'll continue to evolve it.
That programming language itself has an evolutionary finite to it.
At that point, then I'm like, OK, how do I hand off to another language?
How do I hand off to another system?
How else?
I mean, how would you distinguish yourself,
the difference between a programmer, a CGM programmer, a lead programmer,
and a programmer that can reverse-engineer living crap out of anything?
Years, experience?
Yeah, software skills, implementation, documentation.
What else?
Experience, yeah. Depth and breadth of experience.
Say again?
Yeah, that's a tough one, because that's so very, very subjective.
Yeah, and this, I think, is the challenge you're running into.
In an engineering world, it's a very, very objective way of going,
engineer, senior engineer, lead engineer, da-da-da.
And I run into this at Boom all the time.
Is, you know, you'll have the engineering team,
average tenure in a company, 20-plus years.
Us, average tenure in a company, year or two?
And they're like, well, I'm sorry, you haven't got dust...
I mean, it's a very, very different mentality.
But again, communication, collaboration, and cooperation.
And it takes the engineers coming to the table to understand
that most of us kind of know what the hell we're doing,
but we also have to come to the table in a way
that we're willing to listen.
And that's something we haven't done well.
So I think it takes both.
But I don't want to go through a whole set of certification
on the stuff we're doing. I mean, we do it.
I mean, we do it on the CISSP, we do it on the annual stuff.
How many of you actually have to deal with CPE?
Actually, I don't, because I got banned from the CISC...
ISC squared. I got banned from ISC squared.
I'm like, yes!
Yeah, apparently when you break into avionics and airplanes
and make shit do the shit that shit shouldn't do,
yeah, they get all upset with that shit.
Yeah, we'll have that conversation in a minute.
I don't have an easy answer for you. I really don't.
Am I missing something? Tell me if I'm missing something.
Go for it.
Yeah, that's true. That's a huge one.
The support of the people around you.
It's kind of what we've been talking about on the human side.
Yeah, absolutely.
Other questions? Go for it.
I love your fucking hat, by the way. It's awesome.
I saw it, and I'm like, look.
Squirrel, squirrel, squirrel.
I was waiting for it to say, motherfucker, me next.
They're just so angry. I'm like, I have a problem.
Why are you bringing this to me?
Don't bring the problem to them.
No, no, no. Don't do it that way.
Have you done anything with social engineering?
Alright, use your social engineering skills.
If you walk in and go, hey, I've got a problem with this.
I've got a problem with this. You deal with it.
Yeah, exactly.
If I walk in and go, I'm sorry, I have no clue how to do with this.
Could you help me, please?
Because for 20 plus years, we've gone and gone, hey, I've got a problem with this.
You fucking fix it.
Tell me I'm wrong.
Yeah, that's the challenge.
As a security professional, I have blamed you people for fucking years.
I have looked at developers and gone, motherfuckers code better.
Tell me I'm wrong.
How many people in security have walked up and gone, hey, you're a coder.
What the fuck were you thinking?
Yeah.
Rather than come up to you and go, hey, you're a coder.
Can we sit down?
Let me show you what I've found that I would love some help with, please.
If you walk up to somebody in the engineering and network team and say, hey, look, I found this.
Can we find 10 or 15 minutes later on this week or next week or whenever you've got time,
can we sit down and quickly schedule it now?
Don't let them off the hook.
And then I would love to work with you on trying to solve this.
Is that okay?
Come at it.
Use those social...
I know we don't have...
Use the social engineering skills.
Like, seriously, go hang out with Rachel Arnold.
Go hang out with Rachel and just learn some of those different ways of approaches.
It's nuts.
And there's a human as well.
I'm tall.
I'm a lot smaller than I physically used to be.
But I'm still tall.
I'm large.
I'm imposing a bit.
I walk up to people like, shit, is it going to eat me or hump my leg?
And so a lot of the times when I walk and when I stand, I come down a bit.
I'm down a bit.
I'm siding a bit.
I've got the funny feet.
I've got the weird beard.
And you take people's levels of anxiety down.
And if you walk up with the coffee and donuts and say, hey, can we trade?
Can we do something?
So look at that as well.
Use those.
And if that doesn't work, here's the other way of doing it.
We just ran out.
We just started using strength finders in the office.
Go to the HR team.
Go to the people team and say, hey, I would love to be able...
And as a leader inside the organization, I've got people that don't want to work with each other.
I go to the HR team and I say, do me a favor.
Give me those two people's strength finders.
I want to see how to coach them on talking and working with each other.
We all have different strengths.
We all approach things differently.
It's all a matter of going, how do we find some common ground?
Does that help?
No easy answer.
I mean, short of drugging them and bribing them, it's always an option.
Yeah.
Yeah.
And that's it.
And it sucks in some ways.
But once you've done it once, guess what?
You end up forming a friendship.
And then they bring you into other meetings.
Yeah, it's...
And then now you have another advocate.
I mean, it's...
As a security industry, we've sucked.
We haven't done well at it.
So guess what?
We got a whole lot of human debt to go through before we get past that.
Does that help?
All right.
Go for it.
Go for it.
Wrong hand.
Mm-hmm.
Okay, so remote collaboration.
How do we do remote collaboration?
How many of you do remote collaboration?
I actually want to...
Holy shit.
You rock.
Do you do...
How many of you do remote collaboration...
Do remote collaboration successfully?
All right.
I'm going with you.
Go for it.
How do you do it successfully?
Ten seconds.
Seal meetings?
Oh, Zoom meetings and screen share.
Do you do fun Zoom meetings and screen...
Like coffee times, alcohol times, fun times?
Ice breakers.
Ice breakers.
Music.
Yeah.
So, like, non-work-related shit.
And find a time...
Okay, so here's a good one.
Actually, this goes on this one.
Imagine this.
A bunch of engineers and a bunch of software folks in America
dealing with a bunch of folks in Italy
and dealing with a bunch of folks in Spain for the first time.
As a European, it's been so fucking fun to watch.
I was just...
How y'all doing?
And the Italian person is just like...
English.
It's been brilliant.
So, here's the other part of this.
Put yourself in their fucking shoes.
If you're dealing with people across the world,
take a step back.
Stop using colloquialisms.
Stop using slang.
Slow the conversation down a little, please.
Because your first language isn't theirs.
Either that or learn their language.
Start thinking outside of your comfort zone.
So, that's one.
All right, add some others.
Give me some other collaboration.
I can't get used to you outside of a red shirt.
I don't like...
Yeah, I know.
Yeah, there we go.
Meet on their time zone.
Which means your ass has got to get up early in the morning
or you're doing a Zoom meeting late in the evening after dinner
with a bottle of alcohol in hand.
All right, other good collaboration tools for remote people.
What else you got?
A lot of one-on-one nerding out.
Yeah, there we go.
One-on-one nerding out.
Games times for crying out loud.
What else we got?
How many of you use Slack channels?
And have fun or crazy bits or the geek stuff
or the meme of the day channels?
All right, so let me ask another question
because as the CISO over at Boom,
one of the first things I did is I formed a CISO channel at Boom
and it's the Ask the CISO Anything channel.
We started out, we do awareness training every single month
and we make it fun.
It's a minute and a half, two minutes.
We use Gabrielle's stuff over at Wiser Training
and we have a shit ton load of fun with this.
I now have people who send me a screenshot
of the text message scam that they got
because they know that I run a program
that melts the attacker's phone.
I now get inbound shit sent to me.
They're like, hey, we see this.
When the people team send out a survey,
I get like 10 people going, hey, is this legit, people team?
I'm like, I fucking love you.
We have facilitated, and by the way,
I will wander around with $15, $25 gift cards
to say thank you to people.
Yeah, I will walk around and say,
hey, thank you for telling me that.
Word gets around real fast when you do that.
So it's all about the feedback and reward
and conversation and collaboration.
Again, use different tools.
Some people, no matter who they are,
don't want to be on Zoom.
So you give them a chat channel to be on.
Also, how many of you,
when was the last time anybody hand wrote a note
to say thank you to somebody?
Me, I actually did it the day before yesterday.
How many of you hand write a note?
Okay, so here's my challenge to every single one of you,
every single one of you.
Next time somebody does something good for you,
hand write a note to say thank you.
I don't care if you got to post it abroad,
but hand write that note and leave it somewhere they'll find it.
It's fucking amazing how much that means to people
still in today's age.
All right.
We got time for no more questions?
One more question.
One more question.
All right, one more question.
Anybody else got questions?
Or do I just wrap it up and say thank you?
All right, so I will wrap it up.
Okay, so how many of you need a refresher on DEF CON 101?
All right.
Three hours of sleep within a 24-hour period.
That's why power naps are good.
Two meals, one shower.
We're geeks, but we still smell.
All right, so look after yourselves.
We're out here in stupid heat, crazy weather,
surrounded by a whole lot of people.
Look after yourselves, and even more so,
look after each other, please.
With that, love you all.
Thank you very, very much.
DEF CON 101
www.defcon101.org