WEBVTT 00:08.420 --> 00:09.560 I kid you not. 00:09.560 --> 00:11.380 Okay, this shows age. 00:12.600 --> 00:14.600 We're doing a talk, so we're going to have some fun. 00:14.720 --> 00:18.420 You realize I'm going to piss you off because I'm going to walk backwards and forwards on this stage. 00:19.060 --> 00:20.300 This shows age. 00:20.300 --> 00:23.160 I still have, so... 00:23.160 --> 00:37.200 I think I still have the Polaroid that I took out of the window of the Flamingo looking over the Bellagio and the tall shower that they have over there from 20-odd years ago when my daughter... 00:37.760 --> 00:40.320 Once upon a time, I tried this whole marriage thing. 00:41.540 --> 00:45.340 I ended up getting married 20... it was actually 20 years ago. 00:45.340 --> 00:48.780 Because Morgan was born in 2003. 00:48.960 --> 00:50.400 Here we are, 2023. 00:50.740 --> 00:57.040 I still got the one freaking Polaroid from the White Chapel wedding chapel place from 20 years ago in this freaking place. 00:57.040 --> 01:00.460 And that was, I think, whatever it was, DEF CON 10 or 11. 01:00.460 --> 01:01.300 DEF CON 11. 01:01.300 --> 01:03.120 What are we, 31 this year, isn't it? 01:04.360 --> 01:05.080 Jeez. 01:05.760 --> 01:08.160 First one, I think, was like number 6 or number 7. 01:08.780 --> 01:11.180 So I just dated my... I can't do this. 01:11.880 --> 01:13.260 I need my hands. 01:13.280 --> 01:14.000 Sorry. 01:14.780 --> 01:15.820 I need hands. 01:15.820 --> 01:16.620 I got to do hands. 01:16.620 --> 01:17.460 Is that all right? 01:17.480 --> 01:18.560 You're going to hate me. 01:18.720 --> 01:19.620 Anyway, I'm doing hands. 01:19.620 --> 01:21.960 All right, so we're going to have a talk. 01:22.520 --> 01:26.100 And we're going to talk about the human aspect of things. 01:26.660 --> 01:29.300 How many of you are here for the first time? 01:29.300 --> 01:30.480 Start with an easy one. 01:30.480 --> 01:32.480 Holy sh... Bloody hell. 01:33.020 --> 01:35.020 Well, first and foremost, welcome. 01:35.720 --> 01:44.400 Secondly, those of us that have been here numerous times, find one of these people that's here first time and help them. 01:45.180 --> 01:50.140 DEF CON has gone to the point where even I have to find a map to figure out where the hell I'm going. 01:50.400 --> 01:53.260 Okay, so there are a lot of people here who have not been here. 01:53.260 --> 01:55.640 This is family. 01:56.440 --> 01:58.580 You help people here. 01:58.620 --> 01:58.920 All right? 01:58.920 --> 02:00.240 First and foremost. 02:00.560 --> 02:02.980 How many of you are following .mil or .gov? 02:04.000 --> 02:04.880 Family. 02:05.440 --> 02:07.300 You help each other. 02:07.300 --> 02:09.740 You collaborate with each other. 02:09.840 --> 02:11.140 Do you find somebody getting lost? 02:11.140 --> 02:12.800 Do you find somebody that doesn't know the way around? 02:12.800 --> 02:15.040 Take them under your wing and have fun with them. 02:15.040 --> 02:17.680 Don't get them drunk and get pictures of them on the Internet. 02:20.460 --> 02:21.940 That's happened before. 02:22.760 --> 02:26.860 Do not fall asleep at DEF CON in an open area. 02:26.860 --> 02:28.400 You will wake up. 02:28.780 --> 02:31.480 There will be ink on your face. 02:31.620 --> 02:34.040 There will be... just don't do it. 02:34.180 --> 02:36.800 20 years ago, the worst you had was a Polaroid. 02:36.800 --> 02:39.100 This day, it's going to end up all over the bloody Internet. 02:39.100 --> 02:40.840 Let's face it. 02:41.940 --> 02:50.000 For me, in this day and age, this whole conference is about seeing people. 02:50.000 --> 02:53.620 I come here to catch up with family. 02:53.740 --> 02:54.800 Front row. 02:54.920 --> 02:57.560 I come here to catch up with people I know. 02:57.560 --> 03:03.360 I come here, honestly, probably like a lot of you, to see what's out there work-wise as well. 03:03.840 --> 03:05.920 How many of you here are looking for jobs? 03:07.160 --> 03:08.040 OK. 03:09.320 --> 03:12.980 Those of you that are looking for people, now you know who to talk with. 03:13.300 --> 03:17.540 There was somebody wandering around with a breadboard just now for somebody that was looking for a job. 03:18.800 --> 03:27.900 This whole industry, for 20, 30, 40 years, we've been talking about technology. 03:28.140 --> 03:31.300 We've chased technology. 03:31.400 --> 03:34.020 And we've forgotten about the human. 03:35.280 --> 03:42.380 I remember the days, years ago, when we would stand up on stage and we would lament the user. 03:42.820 --> 03:45.200 The user kept clicking shit. 03:45.200 --> 03:46.800 The user kept moving stuff. 03:46.800 --> 03:48.160 The user wouldn't listen. 03:48.160 --> 03:49.360 The user did this. 03:49.360 --> 03:50.940 The user did that. 03:51.120 --> 03:52.380 We blamed them. 03:52.800 --> 03:56.080 And then when the user wouldn't change, we blamed the network team. 03:58.420 --> 04:08.580 And then, because the network team actually fought back, because they're geeks as well, we blamed the DBH, because they're weird, and they smell, and they're normally in the dark in the corner somewhere. 04:08.580 --> 04:09.680 They're easy to blame. 04:09.680 --> 04:10.420 It was kind of fun. 04:10.420 --> 04:12.220 They do weird database shit. 04:12.720 --> 04:17.500 And then when we couldn't blame them anymore, we blamed leadership. 04:17.940 --> 04:19.880 The CFO won't give me money. 04:19.880 --> 04:22.240 The CEO doesn't listen. 04:22.240 --> 04:24.440 The CISO's an arse. 04:24.840 --> 04:26.320 CISO. 04:26.340 --> 04:29.480 CTO doesn't want to talk with me. 04:29.860 --> 04:32.240 Chief of Engineering doesn't care. 04:33.420 --> 04:39.320 What we failed to do was look in the mirror. 04:40.800 --> 04:46.700 What we failed to do was go, how can we do differently? 04:47.120 --> 04:56.220 How can we talk with, not talk to, but how can we talk with people differently? 04:57.140 --> 05:00.100 I run a reasonable-sized team. 05:00.100 --> 05:02.620 I run a reasonable-sized organization. 05:03.340 --> 05:05.280 We build supersonic airplanes. 05:05.280 --> 05:06.120 We're building. 05:06.120 --> 05:17.160 Today, 11th of August, we are, touch wood, going through type approval for our experimental jet three and a half hours from here in Mojave. 05:17.640 --> 05:22.600 That means we can actually do testing faster than walking pace. 05:22.660 --> 05:27.880 For those of you who know about building engines and airplanes and shit, you get to a point of no return. 05:27.880 --> 05:37.200 So as you test this thing going up and down the runway, if you're going fast enough, your exit strategy is throw a throttle and get the thing off the ground and hope for the best. 05:37.260 --> 05:40.040 That's where we're at with the experimental jet. 05:40.840 --> 05:41.640 That's it. 05:41.640 --> 05:45.860 A team of humans have been sitting in sheds for goodness knows how many years putting shit together. 05:47.640 --> 05:49.980 All to do with collaboration. 05:50.480 --> 05:53.020 All to do with working together. 05:53.300 --> 05:54.060 Quick question. 05:54.060 --> 05:56.760 How many of you are in security today? 05:57.720 --> 06:02.600 How many of you are in networking or application or development or coding or that stuff? 06:02.600 --> 06:03.380 Okay. 06:03.600 --> 06:07.260 Again, look at each other. 06:08.200 --> 06:09.740 We're all one team. 06:10.420 --> 06:20.500 Whether you like it or not, whether you sit in different areas or different buildings or different locations, you're all one team. 06:21.920 --> 06:29.860 As an assessor, as somebody who's done virtual see-sawing, as somebody who's walked into organizations, there'll be too many... 06:29.860 --> 06:30.500 Come and sit in. 06:30.500 --> 06:35.720 Yeah, these guys are waving at you not to fucking do anything other than get your ass in and come sit down. 06:40.760 --> 06:41.820 Bad seats at the front. 06:41.820 --> 06:44.380 That way you can throw things and it doesn't have to hurt as much. 06:46.920 --> 06:51.820 I walked into a large car manufacturing facility in the middle of... 06:51.820 --> 06:54.940 I want to say it was Ohio or somewhere like that, so that narrows it down to one. 06:54.940 --> 06:56.160 I'm only a couple for you. 06:56.700 --> 06:59.860 I walked in and I was talking with the security team. 07:00.480 --> 07:02.740 And they're like, oh, we're going to go buy a new sim. 07:02.740 --> 07:03.920 I'm like, why are you going? 07:03.920 --> 07:05.560 Yeah, well, the network team run that. 07:05.860 --> 07:06.700 I go, all right. 07:07.320 --> 07:08.260 Why do you want to buy one? 07:08.260 --> 07:09.600 Well, because they bought theirs. 07:09.600 --> 07:10.620 I'm like, okay. 07:11.680 --> 07:13.320 Well, we need a different one. 07:13.320 --> 07:15.420 Well, are y'all going to talk to the network team? 07:15.440 --> 07:17.240 Well, no, we don't meet with that. 07:17.420 --> 07:19.140 Like, motherfuckers, why not? 07:19.900 --> 07:21.320 Well, because they're the network team. 07:21.320 --> 07:25.280 I'm like, do y'all get paid from the same company? 07:25.280 --> 07:26.260 Well, yes. 07:26.260 --> 07:26.980 Okay. 07:26.980 --> 07:37.800 Then take some of that money, go down to the damn donut shop, buy two dozen donuts, buy a couple of gallons of coffee, walk into their weekly meeting, and apologize. 07:37.800 --> 07:42.660 For being a bunch of fucking special snowflakes. 07:43.140 --> 07:47.680 And you can see they're like, oh, right. 07:50.710 --> 07:52.930 You can have your silo. 07:52.930 --> 08:00.210 I will not make you break your silo down, but you sure as hell will build a bridge to the others. 08:01.010 --> 08:02.370 Please. 08:02.670 --> 08:10.510 We had to come up with a new way of talking with people. 08:10.510 --> 08:13.150 And this isn't a cut on AppSec or DevSecOps. 08:13.150 --> 08:19.290 We had to come up with a word called DevOps and DevSecOps because we couldn't use the word collaboration. 08:21.470 --> 08:22.750 Am I wrong? 08:22.750 --> 08:23.590 No. 08:24.350 --> 08:26.350 This is what we've come to. 08:26.610 --> 08:29.190 We like the computers in front of us. 08:29.210 --> 08:30.290 You can't hear me? 08:30.290 --> 08:30.990 All right. 08:30.990 --> 08:32.710 I'll use the bloody microphone. 08:33.110 --> 08:33.670 Sorry. 08:33.670 --> 08:38.790 I will never, ever say no, and I will never ignore that one person. 08:38.790 --> 08:40.850 There's a very few people on the planet I listen to. 08:40.850 --> 08:42.230 She is one of them. 08:43.590 --> 08:44.010 All right. 08:45.190 --> 08:46.450 Where the hell was I? 08:46.450 --> 08:48.590 We were talking about collaboration, weren't we? 08:49.730 --> 08:50.890 So that is one thing. 08:51.010 --> 08:51.370 It's... 08:51.370 --> 08:52.390 I lost my train of thought. 08:52.390 --> 08:54.810 I squirrel, by the way, as you probably might have figured out. 08:54.810 --> 08:55.970 Welcome to ADHD. 08:57.770 --> 08:59.030 We were just talking. 08:59.030 --> 08:59.670 So how many of you... 09:00.190 --> 09:04.410 There's an amazing individual, Rachel Arnold, who is in our community. 09:04.410 --> 09:06.610 She runs the Coffee Morning Talk. 09:06.810 --> 09:09.110 And I was actually hunkered down over there, just giving... 09:09.110 --> 09:10.770 I was on the Coffee Talk this morning. 09:10.770 --> 09:12.270 Rachel runs the damn thing. 09:12.270 --> 09:16.750 And it was all about how to take care of yourself in this community. 09:16.950 --> 09:20.310 I am the poster child for how not to do it. 09:20.730 --> 09:21.870 By far and away. 09:21.870 --> 09:29.450 This is somebody who woke up this morning, had to pack up the house, because we rented the house from Monday to Friday, forgetting that Saturday and Sunday actually existed. 09:30.210 --> 09:31.570 And so I packed up the house. 09:31.570 --> 09:32.710 I'm like, where am I staying tonight? 09:32.850 --> 09:33.730 Fucked if I know. 09:34.270 --> 09:38.030 So all of my stuff is down in the car, in the car park at the Flamingo at the moment. 09:38.690 --> 09:40.010 And I'll figure it out later. 09:40.050 --> 09:41.250 We'll figure shit out. 09:41.590 --> 09:43.250 And Rachel's like, how does that make you feel? 09:43.250 --> 09:44.810 I'm like, eh, mildly stressed. 09:44.810 --> 09:48.310 But the worst case scenario, I can sleep in the back of the car, or I'm just going to do nighttime con here. 09:48.310 --> 09:49.450 It's more fun that way. 09:49.750 --> 09:55.970 We've done that more years, and you just kind of curl up on a sofa with a watcher, so that you don't end up getting crayoned in the middle of the night. 09:57.770 --> 09:59.610 So let's talk about the collaboration side. 09:59.610 --> 10:01.090 We're talking about DevSecOps. 10:01.090 --> 10:01.850 We're talking about AppSec. 10:01.850 --> 10:03.530 We're talking about all this other kind of stuff. 10:03.650 --> 10:05.350 And it definitely is one of those things. 10:05.350 --> 10:06.090 I mean, I remember... 10:06.090 --> 10:10.530 How many of you remember the days when there were three layers to the internet? 10:11.150 --> 10:16.230 There was the web server, the application layer, and the database layer? 10:17.210 --> 10:19.510 Life was so much fucking simpler back then. 10:19.510 --> 10:23.370 By the way, I will swear, I kind of apologize in advance, and I kind of don't. 10:23.370 --> 10:29.570 If you have sensitive ears, I will apologize for those, but I'm probably not going to change because every now and again, the odd F-bomb has its uses. 10:31.690 --> 10:39.110 Now, we've abstracted the internet to such a degree that we've got, what, 20, 30, 40, 50 different layers between everything? 10:39.270 --> 10:44.730 So no one person in our industry can understand what the heck is going on. 10:45.230 --> 10:47.010 We had Snowball's chance in hell. 10:47.010 --> 11:01.030 Now, when it was three layers, the web team could maybe send a representative over to the network and the application team who then might actually, like, throw a muffin or a donut into the database team and then charge in and ask more questions. 11:01.090 --> 11:05.850 But nowadays, with all these bloody layers and the abstraction, the ability to do that is gone. 11:06.250 --> 11:09.430 So we have to take a step away from the technology. 11:09.670 --> 11:14.410 We have to go, how do we work and collaborate more efficiently and effectively together? 11:14.730 --> 11:18.210 My office, two of the walls, whiteboards. 11:19.270 --> 11:27.570 Because if I have people, and we've got a local team, we've got a few folks that are remote, but if I've got the local team or even the remote team, we'll jump on the bloody whiteboard and we'll start figuring shit out. 11:27.870 --> 11:29.010 It's the easiest way. 11:29.010 --> 11:31.310 Yes, there's all the online stuff that you can use. 11:31.790 --> 11:33.070 I still like my whiteboards. 11:33.070 --> 11:34.970 It's easier to rub shit out on them still. 11:35.450 --> 11:37.970 And it's all about the collaboration side of things. 11:37.970 --> 11:40.530 It's all about, how do we talk with each other? 11:40.530 --> 11:42.410 How do we work with each other? 11:43.850 --> 11:49.230 You know, how many of you are sitting here with collaboration tools on your phones right now? 11:49.270 --> 11:51.170 Because I know that I'm trying to keep an eye. 11:51.170 --> 11:54.010 As I'm walking around here, people are like, hey, where are you? 11:54.290 --> 11:55.530 On LinkedIn. 11:55.550 --> 11:56.810 I can't do Twitter anymore. 11:56.810 --> 11:58.010 I got banned from Twitter. 11:59.810 --> 12:00.630 Yeah. 12:00.630 --> 12:01.790 Fuck if it's X. 12:01.790 --> 12:02.850 Stupid shit. 12:03.270 --> 12:04.530 I mean, seriously. 12:04.770 --> 12:07.170 Do you want to talk about the ultimate of narcissism? 12:07.190 --> 12:13.610 Buy a company for $44 billion and change its name to the one you've held on for 20 years. 12:13.610 --> 12:15.110 I'm like, you asshole. 12:17.890 --> 12:19.530 You know, I'm sitting there. 12:19.530 --> 12:24.950 I'm trying to coordinate life across, you know, like text messaging and WhatsApp and Signal and LinkedIn. 12:24.990 --> 12:26.670 I'm like, I'm just here. 12:26.670 --> 12:29.970 I'm putting a point in the map hope for the best and off we go. 12:30.130 --> 12:31.930 That's about as good as it gets. 12:32.470 --> 12:37.350 And so we've, again, taken the ability to communicate and now we've fragmented communication. 12:37.570 --> 12:39.690 My ask is one thing for anybody who wants to develop. 12:39.690 --> 12:43.910 Could I please have one tool that actually narrows all of those into one freaking place, please? 12:44.290 --> 12:45.450 Yeah, no shit. 12:45.450 --> 12:46.690 Tell me about it. 12:46.950 --> 12:47.330 Good. 12:47.330 --> 12:48.690 God's alive. 12:49.490 --> 12:53.070 So let's talk a little bit about journeys and stuff. 12:54.950 --> 12:56.930 Let's talk a little bit about journeys. 12:56.930 --> 12:57.850 How many of you... 12:57.850 --> 12:59.010 That's just a quick show of hands. 12:59.010 --> 13:03.670 How many of you have been in this industry, say, for five plus or maybe ten plus years? 13:04.250 --> 13:05.030 Nice. 13:05.030 --> 13:05.630 So we're going to hope... 13:05.630 --> 13:08.910 How many of you are just coming into this industry wondering what the hell is going on? 13:08.910 --> 13:10.850 Like three to five years in this industry. 13:10.850 --> 13:11.370 Yeah. 13:11.370 --> 13:15.970 Okay, again, those of us that are old farts in this industry, find one of these people. 13:15.970 --> 13:16.790 Don't abuse them. 13:16.790 --> 13:17.990 Don't get them drunk too much. 13:17.990 --> 13:19.690 Don't take naked photos of them. 13:19.910 --> 13:24.410 But take them under your wing and help them, please. 13:25.190 --> 13:26.730 Because this is family. 13:26.730 --> 13:30.930 These are called villages for a bloody good reason. 13:31.950 --> 13:35.550 Years ago, all the villages were in one sodding area. 13:36.070 --> 13:39.790 And then everybody realized that the villages were about as much fun as going to a main talk. 13:39.790 --> 13:42.550 You didn't have to stand in line for three hours, which is rather useful. 13:42.990 --> 13:45.850 So this is where we all learn. 13:46.350 --> 13:49.450 I go online and everybody says, hey, how did you get into this industry? 13:49.450 --> 13:51.650 I'm like, get your asses here and volunteer. 13:52.590 --> 13:55.510 One, you get a free badge more often than not. 13:55.650 --> 13:58.350 Secondly, somebody often comes to your room, if you're lucky. 13:58.710 --> 14:00.670 But you get to hang out with people. 14:00.670 --> 14:01.430 You get to learn. 14:01.430 --> 14:02.790 You get to talk. 14:03.330 --> 14:10.070 Most of us come into this industry a little, how should we say, off kilter in the brain department. 14:10.570 --> 14:13.310 We don't necessarily like to talk to other humans. 14:13.310 --> 14:15.430 It's easier to talk to the keyboard. 14:16.030 --> 14:20.410 A very, very good friend of mine, Ryan Cloutier, says it absolutely splendidly. 14:20.410 --> 14:24.350 We are analog humans working in a digital world. 14:24.710 --> 14:26.190 And he's perfectly right. 14:26.210 --> 14:35.450 The problem is that digital world is collapsing on the analog humans probably a lot faster than we want it to. 14:35.650 --> 14:44.590 Witness the latest thing when we decided to drop chat GPT on almost 8 billion people with no sodding instructions. 14:45.530 --> 14:52.370 It's like handing a kid a hand grenade, pulling the pin out and going, have a good time. 14:53.190 --> 14:55.090 Some of them will just stand there. 14:55.090 --> 14:59.110 This is that fight, flight, or freeze that humans have. 14:59.130 --> 15:01.450 Some of them will be like... 15:03.610 --> 15:06.090 Some of them will be like... 15:07.170 --> 15:08.510 Fuck you! 15:09.010 --> 15:11.590 And some are going to be like, run the fuck away! 15:12.190 --> 15:14.350 That's the Air Force people, by the way. 15:16.890 --> 15:18.130 I'm sorry. 15:19.450 --> 15:21.030 I'm sorry, yeah. 15:21.390 --> 15:22.910 Royal Marine Commandos. 15:22.910 --> 15:27.250 We actually took the grenades, stole everybody else's fucking grenades and charged. 15:28.410 --> 15:29.830 After a cup of tea. 15:31.510 --> 15:33.290 You all had coffee in this place. 15:33.290 --> 15:33.970 Burnt beans? 15:33.970 --> 15:34.530 Don't do it. 15:34.530 --> 15:35.250 Get a cup of tea. 15:35.250 --> 15:36.270 Be civilized. 15:38.150 --> 15:38.790 Alright. 15:40.290 --> 15:41.670 So let's talk absec. 15:41.670 --> 15:42.590 Let's talk humans. 15:42.590 --> 15:44.170 Let's talk integration and stuff like that. 15:44.170 --> 15:44.890 Actually, no, fuck it. 15:44.890 --> 15:45.950 Let's talk camels. 15:47.190 --> 15:48.750 Have any of you heard the camel story? 15:48.750 --> 15:51.630 How many of you have heard the cow story or the camel story? 15:52.150 --> 15:52.890 None of you. 15:52.890 --> 15:53.330 Oh, God. 15:53.330 --> 15:54.030 I had so much fun. 15:54.030 --> 15:55.790 This is application security. 15:55.790 --> 15:58.730 So , years and years ago, I'm driving across Wyoming. 15:58.730 --> 15:59.130 I'm going... 15:59.130 --> 16:00.530 I think I'm going up to some corner. 16:00.530 --> 16:01.910 I was going somewhere. 16:02.230 --> 16:04.030 And I'm driving across Wyoming. 16:04.190 --> 16:06.650 I'm going rather quickly across Wyoming. 16:06.650 --> 16:10.190 A hundred and something silly because you can do that across Wyoming. 16:10.790 --> 16:18.610 Normally, when I'm driving, I normally have a laptop or something with me and there's a couple of antennas poking out of it and I'm trying to see what the hell is going on in the world. 16:18.990 --> 16:23.290 I'm driving across the middle of bug fuck nowhere in Wyoming and the damn antennas keep pinging at me. 16:23.290 --> 16:23.750 I'm like, what? 16:23.750 --> 16:25.410 There's nothing here. 16:26.410 --> 16:29.570 Antennas going off, wireless networks going off, NFC and a few. 16:29.570 --> 16:30.790 I'm like, what the hell is out here? 16:30.790 --> 16:32.450 So, I pull off to the side of the road. 16:32.670 --> 16:33.210 Nearest one. 16:33.210 --> 16:33.970 I back up a little bit. 16:33.970 --> 16:34.950 I'm like, what's here? 16:34.950 --> 16:36.990 There's a cow staring at me. 16:37.770 --> 16:38.790 How are you all doing? 16:39.330 --> 16:40.870 Bing, bing, bing. 16:40.870 --> 16:41.750 I'm like, what the fuck? 16:41.750 --> 16:43.050 I get out of the car. 16:43.390 --> 16:45.730 I try chasing the cow across the fields. 16:47.150 --> 16:50.770 Me versus a thousand, 1,500 pounds of heavyweight animal. 16:50.770 --> 16:52.730 Not a smart thing to do, but hacker. 16:53.350 --> 16:58.090 I realize the cow has an earpiece in it and has a pedometer on. 16:58.230 --> 17:00.890 The pedometer is giving off a signal. 17:01.250 --> 17:03.230 The signal is a GPS signal. 17:03.230 --> 17:04.670 I'm like, oh, this is cool. 17:04.670 --> 17:08.750 I get online to Google's and I'm like, Googling cow pedometers. 17:08.750 --> 17:11.570 I find out there's these really freaking cool things. 17:12.210 --> 17:14.550 And the NFCs on the ears are on there as well. 17:14.550 --> 17:15.770 They talk to the pedometer. 17:15.770 --> 17:20.910 What it's doing is it's pulling temperature, heartbeat, movement, and a whole bunch of other things out. 17:20.950 --> 17:23.070 And it's sending it to a centralized database. 17:23.070 --> 17:25.390 Because when you buy these pedometers, you get a database. 17:25.390 --> 17:27.530 It was a Windows 98 machine at the time. 17:27.530 --> 17:28.390 I'm like, yay! 17:28.990 --> 17:30.310 Play, play, play, play, play. 17:32.590 --> 17:34.350 MySQL, MySQL database. 17:35.610 --> 17:38.530 So I'm sitting there and I'm like, well, one has to get one of these things. 17:38.530 --> 17:40.710 So one purchased one for one cow. 17:41.610 --> 17:43.430 eBay, by the way, great thing. 17:43.650 --> 17:45.450 Two of my accounts are now banned on eBay. 17:45.450 --> 17:47.170 They haven't found the other three yet. 17:48.970 --> 17:50.090 I fucking love eBay. 17:50.090 --> 17:51.470 It's so much fun to abuse. 17:52.390 --> 17:55.970 So I buy one of these things, start taking it to pieces, and realize all the fun and games. 17:55.970 --> 17:57.910 I then get hold of the vendor and the software. 17:57.990 --> 17:59.950 I call the vendor, I'm like, how are y'all doing? 17:59.950 --> 18:01.050 And they're like, hello. 18:01.810 --> 18:07.510 I start talking with them because it's a European company and got them to send me an application and the system and the software and everything. 18:07.510 --> 18:09.770 So I start looking at this and I'm like, oh, this is fun. 18:10.130 --> 18:22.610 So then go out to the wonderful world of Shodan with the tool, with the architecture, and find out that half of the United States of America land and quite a lot of Europe all runs these types of databases. 18:23.110 --> 18:24.430 Are we having fun with the lights? 18:24.430 --> 18:26.250 Who's fucking around with the flippers again? 18:26.610 --> 18:27.490 I don't mind. 18:27.490 --> 18:27.850 I'm good. 18:27.850 --> 18:29.530 We can be in the dark having conversations. 18:29.530 --> 18:31.570 It is a hacker conference after all. 18:32.310 --> 18:38.590 So I start figuring this stuff out and then I realize that almost all the databases are using a default user ID and a password. 18:38.590 --> 18:39.190 Yay! 18:39.190 --> 18:40.630 Admin, admin for the win. 18:40.630 --> 18:41.230 Yay! 18:41.230 --> 18:44.110 So I start logging in. 18:44.430 --> 19:01.790 I figure out where all the ones are in the middle of this neck of the woods and a few other neck of woods and they update, the pedometer updates the GPS settings for where this cow is so basically the farmer can basically round up all his entire herd of beef burgers across his thousands of acres into one place and then send them off for dinner. 19:03.530 --> 19:07.470 Well, we started rewriting the database because it was a fun thing to do. 19:07.470 --> 19:14.270 So every 28 minutes we would go into the database and rewrite the GPS settings with a very good friend of mine in Colorado. 19:15.770 --> 19:19.030 We basically figured out digital cattle rustling. 19:19.370 --> 19:20.710 It was so much fun. 19:21.190 --> 19:29.070 Fast forward to last year, I get invited to go over to the Middle East and they're like, hey, can you have some fun and do a life hack? 19:29.070 --> 19:38.890 And I'm like, well, I'm not going to do a life hack in the Middle East because that could get really, really nasty and they get upset but I'm like, I'll do a pre-recorded attack on something and they're like, what are you going to do? 19:38.890 --> 19:40.290 And I'm like, I have no fucking clue. 19:40.410 --> 19:43.830 So I start looking at the neck of the woods I'm going to in the Middle East. 19:44.250 --> 19:46.490 They have camels. 19:47.010 --> 19:50.230 They have beauty pageants for these camels. 19:50.850 --> 19:53.110 These are expensive camels. 19:53.110 --> 19:56.990 8 million US dollar beauty pageant camel. 19:57.670 --> 19:59.550 Yeah, and there's a lot of them. 19:59.610 --> 20:03.630 What I didn't realize at the time is a lot of them were owned by His Excellency. 20:04.630 --> 20:06.830 I found that one out on stage. 20:06.830 --> 20:23.890 Because I also found another there was a what it was there's a whole bunch of folks in like upper Mongolia Chinese neck of the woods that are also doing the same kind of idea they're basically using pedometers on the camels to figure out where the camels are and he goes out on his motorbike this is in the middle of bug fuck nowhere and I'm like , 20:23.890 --> 20:25.970 okay, let's go see if we can make friends with that database. 20:25.970 --> 20:35.250 Nice Chinese database default admin passwords on there might look very, very similar to the US one for cows surprisingly enough and so I'm like, all right, we can have some fun with this. 20:35.250 --> 20:40.110 Now the ones in it was in Saudi for a change so you've got to have fun with those folks. 20:40.770 --> 20:52.670 And what I ended up doing was I stood up on stage and we took all of the Saudi camels and moved them to the middle of China and took all the Chinese flea bitten camels and moved them to the prestigious place in the middle of fucking Dubai. 20:52.930 --> 20:56.630 The middle of wherever the hell it was the middle of Saudi Riyadh actually in this case. 20:56.910 --> 21:02.570 And did this up on stage and showed this so apparently he's excellently got hold of his people and said, where the hell are my camels? 21:02.950 --> 21:07.190 And the guy was looking at the database going, your camels are not here. 21:07.190 --> 21:13.140 And looking at the camel and going, reboot. 21:14.580 --> 21:22.340 And so, this goes back to the whole concept and the whole idea of analog humans in a digital world. 21:23.000 --> 21:29.900 How are we going as we move forward to understand what is reality? 21:31.060 --> 21:35.600 How many of us question what we see? 21:36.240 --> 21:40.300 How many of us take for granted what is put in front of us? 21:40.700 --> 21:47.320 Versus ask the questions so that we can understand more effectively what we're looking at. 21:47.640 --> 21:51.040 So this again comes back to the human. 21:51.300 --> 21:54.440 It again comes back to asking more questions. 21:54.440 --> 21:57.420 We all talk about trust then verify. 21:58.040 --> 22:08.780 We should have reversed that a long time ago and go verify, be sarcastic, verify again, and then maybe trust you for five minutes. 22:10.120 --> 22:12.200 Yet we don't do that. 22:13.180 --> 22:21.960 So again, for those of you in this industry, for those of you building some of the amazing tools out there, take a step back. 22:22.620 --> 22:23.540 Are you okay? 22:23.540 --> 22:24.680 Do you need water? 22:24.680 --> 22:25.760 Whoever is dying over there? 22:25.760 --> 22:27.740 Don't die, please, it's more paperwork. 22:28.100 --> 22:29.500 Is she okay? 22:29.640 --> 22:31.300 All right, just checking. 22:31.300 --> 22:33.020 Do we need to take her outside? 22:33.680 --> 22:34.920 Okay, not outside. 22:34.920 --> 22:36.180 Okay, I'm armed. 22:36.180 --> 22:37.900 I mean, we're fine, it's Vegas. 22:39.020 --> 22:41.120 The lake's filled up again. 22:42.960 --> 22:46.160 So we come back as you're building something. 22:46.540 --> 22:50.300 Take a step back out of the very world that we live in . 22:50.300 --> 22:52.860 I use my mother as a yardstick . 22:52.860 --> 23:01.060 You should all find a parent , guardian , or somebody outside of this realm and ask them the same questions. 23:01.060 --> 23:08.980 Go , hey, if I give this to you, or I put this in front of you , or I let you use this , or I let you mess around with it , what do you think ? 23:08.980 --> 23:10.260 How do you work this ? 23:10.260 --> 23:11.600 How do you use this? 23:11.600 --> 23:14.760 Can you use this? 23:15.060 --> 23:19.860 What we take for granted is us. 23:20.460 --> 23:28.840 There's 7,990,000,000 odd lots of people out there that haven't got a sodding clue about what we do . 23:29.300 --> 23:35.980 So either we have to make it more effective and more efficient, or we have to get a communication. 23:38.240 --> 23:39.980 So I have another question for everybody. 23:40.940 --> 23:43.480 We're in the village. 23:44.620 --> 23:47.460 There are two sets of community villages. 23:48.320 --> 23:54.600 Not Caesars where I went this morning, but the other Caesars that way. 23:54.860 --> 23:58.900 How many of you are going to go to the other villages and go hang out at the other villages? 23:59.960 --> 24:01.720 I like that. 24:01.920 --> 24:10.280 One thing I would love to see more of is how do we collaborate with other villages? 24:10.640 --> 24:16.400 How do you hang out with the car hacking village? 24:16.820 --> 24:21.880 Let's face it, cars are no longer a device to get you from point A to point B. 24:22.240 --> 24:30.100 Cars are now fully integrated passenger experience environments. 24:30.840 --> 24:36.980 We're looking with the stuff we're building with the airplane, I'm looking at taking the settings you have in your car. 24:40.940 --> 24:47.200 I'm looking at taking those settings and building that into the seat that you will fly on our airplane. 24:47.540 --> 24:52.180 That's all application layer, identity, management, and all sorts of other fun stuff. 24:52.480 --> 24:58.760 That's taking an experience from a human from one device and moving it on to another device seamlessly . 24:58.760 --> 25:00.500 It's the same thing. 25:00.500 --> 25:07.980 I'll take people's settings from their phones and their tablets and we'll move them on to the entertainment system that we'll have in the plane. 25:08.020 --> 25:13.340 Therefore, everything that you have now is the same thing you'll have in front of you when you fly on the airplane. 25:14.840 --> 25:17.200 Now, can we do this? 25:17.200 --> 25:17.640 Absolutely . 25:18.400 --> 25:22.460 Are we going to do it and how do we do it and keep the safety and integrity of it? 25:22.460 --> 25:24.340 There's some shit to work out yet. 25:25.200 --> 25:28.220 But again, this isn't just us working alone. 25:28.680 --> 25:32.000 I got some fun time tomorrow in the aviation village. 25:32.480 --> 25:38.880 That's collaboration between AppSec, DevSecOps, networking, and a whole bunch of other villages. 25:40.020 --> 25:42.040 This, again, is why we're here. 25:42.580 --> 25:53.920 You're here to learn, you're here to network, you're here to talk with people, not two people, and you're here to collaborate between each other. 25:55.600 --> 25:57.320 So what else are we going to go through? 25:57.320 --> 25:58.060 Oh, I know. 25:58.060 --> 25:59.540 How many of you are vendors? 26:00.460 --> 26:02.840 Anybody want to admit at this moment in time? 26:03.640 --> 26:05.600 Let's talk about that world. 26:06.060 --> 26:08.460 Because I was at a dinner last night . 26:08.460 --> 26:13.120 I went out last night to Super Frisco . 26:15.440 --> 26:21.780 It's like a whole series of escape rooms with performing artists. 26:21.780 --> 26:23.080 It was amazing . 26:24.400 --> 26:33.180 But we were all sitting there and there were four or five different vendors there and we had conversations and it was rather nice. 26:33.520 --> 26:36.800 It was good conversations because they weren't trying to sell shit. 26:38.000 --> 26:39.300 If you end up working 26:48.680 --> 26:57.520 on the vendor space, we have an adversarial relationship with vendors. 26:58.200 --> 27:02.120 We absolutely have an adversarial relationship. 27:02.780 --> 27:08.060 From a CISO's perspective, I feel like I'm targeted. 27:08.060 --> 27:12.880 From a vendor's perspective, they have to stand out. 27:13.040 --> 27:15.780 We have to do a better job of this. 27:16.680 --> 27:21.620 Both from the CISO and us in technology, this wouldn't be here without vendors. 27:22.460 --> 27:26.920 We all put money in and the vendors put money in as well. 27:31.380 --> 27:34.440 So, actually, that is a good reminder . 27:34.540 --> 27:39.260 Do me a big favor, with consent, hug the hell out of all the volunteers in this place. 27:39.260 --> 27:43.460 Thank all of these people. 27:43.540 --> 27:47.160 We wouldn't be here without their tireless work. 27:54.040 --> 27:56.300 I would say hug a goon. 27:57.140 --> 28:00.580 But you are going to get your ass paddled if you do that. 28:01.720 --> 28:05.740 I nowadays we have to be more civilized. 28:06.340 --> 28:10.120 I can't do that. 28:10.300 --> 28:13.620 I am just going to hug you to death. 28:13.620 --> 28:14.740 Hold on tight. 28:16.640 --> 28:19.220 Again, it comes down to communication. 28:19.400 --> 28:21.540 It comes down to the collaboration. 28:22.520 --> 28:26.380 The other thing I will say as well, I did a LinkedIn post. 28:26.760 --> 28:30.820 I know what it was. 28:30.820 --> 28:33.640 It was the Wednesday podcast with Danny. 28:35.900 --> 28:39.960 There are 20, 30,000 of us here this year. 28:40.140 --> 28:43.120 Respect each other. 28:43.320 --> 28:49.520 When somebody says no, they actually mean no. 28:49.760 --> 28:55.080 When you see somebody alone, reach out and help. 28:55.080 --> 28:57.280 Double check with them as well. 28:58.660 --> 28:59.300 We 29:02.920 --> 29:09.440 lose too many people in this industry and in the military on a daily basis. 29:09.880 --> 29:13.060 A friendly, hey, can I help you? 29:13.060 --> 29:14.520 Is there anything you need? 29:14.520 --> 29:16.020 Do you need food? 29:16.020 --> 29:21.160 Do you need a minute's worth of peace and quiet or a friendly voice? 29:21.160 --> 29:25.200 This week, especially, as this week rolls on, is key. 29:25.200 --> 29:29.800 Do me all a favor , just keep an eye on each other as well . 29:29.800 --> 29:30.740 Make sense ? 29:31.300 --> 29:31.960 Good . 29:31.960 --> 29:32.800 Thank you. 29:32.800 --> 29:33.640 How are we doing time wise ? 29:33.640 --> 29:34.180 We're good. 29:34.180 --> 29:35.340 I'm going to open it up. 29:37.480 --> 29:40.000 Questions for the crazy one on stage. 29:40.000 --> 29:41.880 I'll answer pretty much anything. 29:42.040 --> 29:44.260 Go for it. 29:52.710 --> 29:53.950 That's a good one. 29:53.950 --> 29:57.130 For me, collaboration with vendors is giving them certain time. 29:59.550 --> 30:02.310 Perfect example, vendors outreach. 30:05.370 --> 30:08.550 I have three basic responses. 30:09.150 --> 30:11.990 First response is, number one, do your research. 30:11.990 --> 30:18.550 If you're asking me for 15 minutes of my time, you spend 5-15 minutes looking me up first. 30:18.750 --> 30:23.370 Secondly, I'm easy to find on the internet. 30:23.430 --> 30:27.390 Thirdly, see if it's something you think I'm likely to need. 30:27.390 --> 30:28.810 I'll give them that feedback. 30:28.810 --> 30:32.770 If I get the generic outreach email, I'll send them that feedback. 30:39.550 --> 30:45.790 Secondly, if it's something I'm interested in, my Friday afternoons are set aside for vendors. 30:50.050 --> 30:53.970 If it's something I'm interested in, we'll schedule a time . 30:55.710 --> 31:01.950 If after that it's interesting, it gets passed on to my team . 31:01.950 --> 31:04.710 I gate keep my team . 31:09.090 --> 31:10.990 Sometimes there's new tech out there . 31:11.890 --> 31:15.450 I want to know about it. 31:15.450 --> 31:18.450 Then I'll let my team spin their wheels on it. 31:20.210 --> 31:22.570 Thirdly, I'll explain back. 31:22.570 --> 31:24.370 I will give feedback to a vendor . 31:26.210 --> 31:32.950 I spent Tuesday or Wednesday with Danny and the team. 31:33.220 --> 31:36.650 We spent the entire day going through vendor pitches. 31:37.150 --> 31:40.130 I needed alcohol after that day. 31:41.070 --> 31:45.290 I gave 31:48.590 --> 31:49.970 back to that team. 31:49.970 --> 31:52.610 I will give feedback. 31:53.290 --> 31:59.470 It behooves us to give feedback. 31:59.470 --> 32:01.570 That way we all get better. 32:02.650 --> 32:03.830 And that's critical. 32:03.830 --> 32:05.830 Now, that's Friday afternoon. 32:06.950 --> 32:11.250 I turn up and I turn up ready to work. 32:12.010 --> 32:13.870 I won't give them Monday through Thursday. 32:19.570 --> 32:23.710 I'm also plugged into the VC community. 32:25.610 --> 32:31.210 There's a lot of stuff we do to encourage it the right way. 32:31.490 --> 32:36.450 LinkedIn is the same thing. 32:36.890 --> 32:40.230 I've done a bunch of posts on LinkedIn . 32:40.450 --> 32:41.010 I 32:45.510 --> 32:49.290 try to not be too spicy and too blunt . 32:49.290 --> 32:51.890 Sometimes it works, sometimes it doesn't. 32:51.890 --> 32:52.890 But I try. 32:54.050 --> 32:55.550 Yeah, go for it. 32:55.770 --> 32:56.810 Does that help? 32:59.700 --> 33:01.060 Repeat the question. 33:01.060 --> 33:02.220 Go for it, sir. 33:08.280 --> 33:11.480 I'm not repeating this question unless it's 10 seconds. 33:12.640 --> 33:13.380 Go for it. 33:13.380 --> 33:14.180 Go for the question. 33:14.180 --> 33:16.180 answer it shortly down for me. 33:20.600 --> 33:21.160 Yep. 33:21.160 --> 33:21.380 Yep. 33:21.380 --> 33:21.900 Yep. 33:22.020 --> 33:22.540 Yep. 33:31.580 --> 33:32.220 Yep. 33:32.320 --> 33:33.120 Yep. 33:34.780 --> 33:35.140 Yep. 33:35.140 --> 33:35.540 Yep . 33:41.640 --> 33:41.700 Yep. 33:41.700 --> 33:41.980 Yep. 33:41.980 --> 33:42.380 Yep . 33:42.480 --> 33:42.520 Yep. 33:42.520 --> 33:42.940 Yep. 33:46.400 --> 33:47.640 Alright, that's fair. 33:47.640 --> 33:50.660 So in other words, how do we do career development within our environment? 33:50.780 --> 33:51.620 Okay. 33:53.660 --> 33:54.900 Career development. 33:54.920 --> 33:55.880 Yeah, yeah. 33:55.880 --> 33:58.840 Now, you're talking to somebody that left school at 16. 33:59.740 --> 34:01.320 So, I didn't do college. 34:01.320 --> 34:03.960 I spent one year... I spent less than one year at Oxford. 34:03.960 --> 34:06.860 I was studying pure mathematics and cryptography at Oxford. 34:06.860 --> 34:08.080 I got bored left. 34:08.080 --> 34:14.640 So, that's my entire world in traditional education. 34:14.960 --> 34:22.260 Outside of that, I've had my MCT, my CISSP, my CCIE, and all that other stupid shit. 34:22.260 --> 34:24.040 They've all got dust on them. 34:24.480 --> 34:26.440 So this is a question for all of you. 34:26.480 --> 34:30.080 How many of you would consider yourselves professionals within your worlds? 34:30.100 --> 34:31.300 Professional development teams. 34:31.300 --> 34:31.780 Okay. 34:31.780 --> 34:33.060 How have you got there? 34:34.180 --> 34:37.300 Blood, sweat, hard work. 34:37.740 --> 34:38.640 10,000 hours. 34:38.640 --> 34:39.320 Who said that? 34:39.500 --> 34:40.740 You're awesome. 34:40.860 --> 34:41.320 Thank you. 34:41.320 --> 34:42.780 Yeah, 10,000 hours. 34:42.900 --> 34:45.760 5 solid years, 10 solid years of work. 34:45.760 --> 34:48.640 I think it's tough because there's so much variety. 34:48.640 --> 34:51.840 I mean, you all... come sit down or hang out. 34:51.840 --> 34:55.040 This for me is such a challenging environment as far as that goes. 34:55.040 --> 35:06.380 Because there are so many languages, there are so many structures, and there's a huge difference between developing software for like an engineering inside an avionics system than there is for developing, you know, something that runs... 35:06.380 --> 35:08.640 I was going to get my phone out without flashing everybody. 35:09.500 --> 35:12.160 Something that runs an application on here. 35:12.200 --> 35:14.600 So you've got criticality of systems. 35:14.600 --> 35:17.740 But the other thing is as well, think about it. 35:17.740 --> 35:23.800 From an engineering, basic standard engineering principles haven't changed a huge amount in a long time. 35:24.240 --> 35:27.240 Whereas, I mean, how often does software change? 35:27.240 --> 35:30.160 Every minute, yeah. 35:30.160 --> 35:34.160 I was going to be like every 10-15 minutes and be civilized about the whole thing. 35:34.300 --> 35:37.860 But we are in such an evolving environment that, you know... 35:38.800 --> 35:41.320 I did Pascal, I did Fortran. 35:41.320 --> 35:43.540 God, I fucking did basic for crying out loud. 35:43.840 --> 35:44.740 Yeah, no shit. 35:44.740 --> 35:46.720 I can still program in assembly. 35:47.260 --> 35:48.240 So, yeah. 35:48.260 --> 35:49.020 Fuck you. 35:49.020 --> 35:51.200 Yeah, you actually want to break into anything? 35:51.200 --> 35:53.080 Screw all your high-level shit. 35:53.080 --> 35:55.500 Get down to the bits and bytes. 35:55.500 --> 35:59.400 Because you'll bypass every fucking end point known to mankind. 35:59.920 --> 36:02.280 And it's so much fun when clan strike goes... 36:02.280 --> 36:03.980 Wee, I didn't see you. 36:04.680 --> 36:05.660 Yeah, no, it's... 36:09.640 --> 36:13.120 I mean, you'll tell me if I'm wrong on this one. 36:13.120 --> 36:20.500 From my standpoint, professional development for me is putting the skills I have into practice. 36:20.620 --> 36:23.020 It is continuing to evolve them. 36:23.020 --> 36:25.380 But if I learn, let's just say I learn... 36:25.380 --> 36:28.940 I mean, at the moment, I'm learning Rust and a whole bunch of other stuff for AI work. 36:29.320 --> 36:30.700 I'm having some fun with AI. 36:30.700 --> 36:31.520 It ain't pretty. 36:31.760 --> 36:33.300 I'm learning a whole bunch of that side of it. 36:33.300 --> 36:36.820 And I'm learning the structures, the architectures, some various other bits and pieces to do. 36:36.820 --> 36:40.400 But once I've done that, I'll reach out to a bunch of people here and go, Hey, can you help me? 36:40.400 --> 36:42.000 Can you sort some of this stuff out? 36:42.020 --> 36:43.460 And I'll continue to evolve it. 36:43.460 --> 36:47.180 That programming language itself has an evolutionary finite to it. 36:47.640 --> 36:50.840 At that point, then I'm like, OK, how do I hand off to another language? 36:50.840 --> 36:52.560 How do I hand off to another system? 36:53.520 --> 36:54.440 How else? 36:54.440 --> 37:05.500 I mean, how would you distinguish yourself, the difference between a programmer, a CGM programmer, a lead programmer, and a programmer that can reverse-engineer living crap out of anything? 37:05.660 --> 37:07.280 Years, experience? 37:10.730 --> 37:13.930 Yeah, software skills, implementation, documentation. 37:14.130 --> 37:14.650 What else? 37:15.850 --> 37:16.870 Experience, yeah. 37:16.870 --> 37:18.550 Depth and breadth of experience. 37:18.970 --> 37:19.910 Say again? 37:26.170 --> 37:29.430 Yeah, that's a tough one, because that's so very, very subjective. 37:29.970 --> 37:32.830 Yeah, and this, I think, is the challenge you're running into. 37:32.830 --> 37:39.530 In an engineering world, it's a very, very objective way of going, engineer, senior engineer, lead engineer, da-da-da. 37:39.530 --> 37:41.810 And I run into this at Boom all the time. 37:42.490 --> 37:48.110 Is, you know, you'll have the engineering team, average tenure in a company, 20-plus years. 37:48.290 --> 37:51.410 Us, average tenure in a company, year or two? 37:51.890 --> 37:54.010 And they're like, well, I'm sorry, you haven't got dust... 37:54.010 --> 37:57.250 I mean, it's a very, very different mentality. 37:57.250 --> 38:00.190 But again, communication, collaboration, and cooperation. 38:00.850 --> 38:11.570 And it takes the engineers coming to the table to understand that most of us kind of know what the hell we're doing, but we also have to come to the table in a way that we're willing to listen. 38:11.570 --> 38:13.330 And that's something we haven't done well. 38:13.990 --> 38:15.910 So I think it takes both. 38:16.190 --> 38:20.190 But I don't want to go through a whole set of certification on the stuff we're doing. 38:20.190 --> 38:20.890 I mean, we do it. 38:20.890 --> 38:23.350 I mean, we do it on the CISSP, we do it on the annual stuff. 38:23.350 --> 38:25.330 How many of you actually have to deal with CPE? 38:25.330 --> 38:28.490 Actually, I don't, because I got banned from the CISC... 38:29.670 --> 38:30.270 ISC squared. 38:30.270 --> 38:31.610 I got banned from ISC squared. 38:31.610 --> 38:32.630 I'm like, yes! 38:33.530 --> 38:42.010 Yeah, apparently when you break into avionics and airplanes and make shit do the shit that shit shouldn't do, yeah, they get all upset with that shit. 38:42.410 --> 38:44.730 Yeah, we'll have that conversation in a minute. 38:44.930 --> 38:47.150 I don't have an easy answer for you. 38:47.170 --> 38:48.270 I really don't. 38:48.270 --> 38:49.410 Am I missing something? 38:49.410 --> 38:50.870 Tell me if I'm missing something. 38:51.530 --> 38:52.990 Go for it. 38:58.310 --> 38:59.350 Yeah, that's true. 38:59.350 --> 39:00.130 That's a huge one. 39:00.130 --> 39:01.290 The support of the people around you. 39:01.290 --> 39:02.730 It's kind of what we've been talking about on the human side. 39:02.730 --> 39:03.630 Yeah, absolutely. 39:04.650 --> 39:05.550 Other questions? 39:05.990 --> 39:06.510 Go for it. 39:06.510 --> 39:07.750 I love your fucking hat, by the way. 39:07.750 --> 39:08.390 It's awesome. 39:09.370 --> 39:10.670 I saw it, and I'm like, look. 39:10.890 --> 39:12.150 Squirrel, squirrel, squirrel. 39:12.150 --> 39:14.450 I was waiting for it to say, motherfucker, me next. 39:25.680 --> 39:26.800 They're just so angry. 39:26.800 --> 39:27.620 I'm like, I have a problem. 39:27.620 --> 39:29.200 Why are you bringing this to me? 39:30.220 --> 39:32.260 Don't bring the problem to them. 39:34.320 --> 39:35.480 No, no, no. 39:35.480 --> 39:36.840 Don't do it that way. 39:37.780 --> 39:40.620 Have you done anything with social engineering? 39:41.260 --> 39:43.720 Alright, use your social engineering skills. 39:43.760 --> 39:47.380 If you walk in and go, hey, I've got a problem with this. 39:47.580 --> 39:48.740 I've got a problem with this. 39:48.740 --> 39:49.880 You deal with it. 39:50.940 --> 39:52.000 Yeah, exactly. 39:52.080 --> 39:57.200 If I walk in and go, I'm sorry, I have no clue how to do with this. 39:57.200 --> 40:00.100 Could you help me, please? 40:04.000 --> 40:07.700 Because for 20 plus years, we've gone and gone, hey, I've got a problem with this. 40:07.700 --> 40:09.060 You fucking fix it. 40:09.520 --> 40:11.100 Tell me I'm wrong. 40:11.320 --> 40:14.580 Yeah, that's the challenge. 40:14.920 --> 40:21.200 As a security professional, I have blamed you people for fucking years. 40:21.580 --> 40:25.100 I have looked at developers and gone, motherfuckers code better. 40:25.100 --> 40:27.440 Tell me I'm wrong. 40:27.440 --> 40:30.720 How many people in security have walked up and gone, hey, you're a coder. 40:30.720 --> 40:32.780 What the fuck were you thinking? 40:33.680 --> 40:34.520 Yeah. 40:34.920 --> 40:38.260 Rather than come up to you and go, hey, you're a coder. 40:38.460 --> 40:39.720 Can we sit down? 40:39.720 --> 40:46.760 Let me show you what I've found that I would love some help with, please. 40:47.380 --> 40:51.660 If you walk up to somebody in the engineering and network team and say, hey, look, I found this. 40:51.660 --> 40:59.800 Can we find 10 or 15 minutes later on this week or next week or whenever you've got time, can we sit down and quickly schedule it now? 40:59.920 --> 41:01.300 Don't let them off the hook. 41:01.460 --> 41:04.420 And then I would love to work with you on trying to solve this. 41:04.420 --> 41:05.440 Is that okay? 41:06.060 --> 41:07.060 Come at it. 41:07.060 --> 41:07.900 Use those social... 41:08.620 --> 41:09.860 I know we don't have... 41:09.860 --> 41:11.940 Use the social engineering skills. 41:11.940 --> 41:14.440 Like, seriously, go hang out with Rachel Arnold. 41:14.440 --> 41:18.300 Go hang out with Rachel and just learn some of those different ways of approaches. 41:18.360 --> 41:19.900 It's nuts. 41:19.900 --> 41:22.320 And there's a human as well. 41:23.460 --> 41:24.200 I'm tall. 41:24.200 --> 41:27.480 I'm a lot smaller than I physically used to be. 41:27.520 --> 41:28.520 But I'm still tall. 41:28.520 --> 41:29.040 I'm large. 41:29.040 --> 41:29.800 I'm imposing a bit. 41:29.960 --> 41:33.220 I walk up to people like, shit, is it going to eat me or hump my leg? 41:34.200 --> 41:37.720 And so a lot of the times when I walk and when I stand, I come down a bit. 41:37.720 --> 41:38.300 I'm down a bit. 41:38.300 --> 41:39.060 I'm siding a bit. 41:39.060 --> 41:40.240 I've got the funny feet. 41:40.240 --> 41:41.180 I've got the weird beard. 41:41.180 --> 41:44.140 And you take people's levels of anxiety down. 41:44.340 --> 41:48.760 And if you walk up with the coffee and donuts and say, hey, can we trade? 41:48.760 --> 41:49.740 Can we do something? 41:49.740 --> 41:51.300 So look at that as well. 41:51.800 --> 41:52.640 Use those. 41:52.640 --> 41:55.520 And if that doesn't work, here's the other way of doing it. 41:56.320 --> 41:57.640 We just ran out. 41:57.640 --> 42:01.060 We just started using strength finders in the office. 42:01.120 --> 42:02.480 Go to the HR team. 42:02.480 --> 42:05.740 Go to the people team and say, hey, I would love to be able... 42:05.740 --> 42:10.160 And as a leader inside the organization, I've got people that don't want to work with each other. 42:10.160 --> 42:12.040 I go to the HR team and I say, do me a favor. 42:12.040 --> 42:13.960 Give me those two people's strength finders. 42:13.980 --> 42:18.140 I want to see how to coach them on talking and working with each other. 42:18.140 --> 42:20.440 We all have different strengths. 42:20.440 --> 42:22.280 We all approach things differently. 42:22.400 --> 42:25.740 It's all a matter of going, how do we find some common ground? 42:26.560 --> 42:27.380 Does that help? 42:27.900 --> 42:28.960 No easy answer. 42:28.960 --> 42:32.300 I mean, short of drugging them and bribing them, it's always an option. 42:33.620 --> 42:34.000 Yeah . 42:36.020 --> 42:36.660 Yeah. 42:36.660 --> 42:37.440 And that's it. 42:37.440 --> 42:39.420 And it sucks in some ways. 42:39.420 --> 42:41.140 But once you've done it once, guess what? 42:41.140 --> 42:42.560 You end up forming a friendship. 42:42.880 --> 42:46.440 And then they bring you into other meetings. 42:46.440 --> 42:47.820 Yeah, it's... 42:47.820 --> 42:50.000 And then now you have another advocate. 42:50.420 --> 42:51.440 I mean, it's... 42:52.160 --> 42:54.260 As a security industry, we've sucked. 42:54.260 --> 42:55.360 We haven't done well at it. 42:55.360 --> 42:55.960 So guess what? 42:55.960 --> 43:00.720 We got a whole lot of human debt to go through before we get past that. 43:00.780 --> 43:01.500 Does that help? 43:01.620 --> 43:02.700 All right. 43:05.670 --> 43:06.890 Go for it. 43:06.970 --> 43:08.230 Go for it. 43:09.430 --> 43:10.670 Wrong hand. 43:12.670 --> 43:13.750 Mm-hmm. 43:22.330 --> 43:24.070 Okay, so remote collaboration. 43:24.070 --> 43:25.590 How do we do remote collaboration? 43:25.750 --> 43:27.970 How many of you do remote collaboration? 43:27.970 --> 43:28.610 I actually want to... 43:28.610 --> 43:30.470 Holy shit. 43:30.690 --> 43:31.590 You rock. 43:31.590 --> 43:31.930 Do you do... 43:31.930 --> 43:33.430 How many of you do remote collaboration... 43:34.050 --> 43:36.650 Do remote collaboration successfully? 43:37.350 --> 43:38.150 All right. 43:38.430 --> 43:39.510 I'm going with you. 43:39.510 --> 43:40.090 Go for it. 43:40.090 --> 43:41.470 How do you do it successfully? 43:41.470 --> 43:42.410 Ten seconds. 43:44.670 --> 43:45.770 Seal meetings? 43:46.070 --> 43:48.110 Oh, Zoom meetings and screen share. 43:48.110 --> 43:50.370 Do you do fun Zoom meetings and screen... 43:50.370 --> 43:53.270 Like coffee times, alcohol times, fun times? 43:53.270 --> 43:54.030 Ice breakers. 43:54.030 --> 43:55.270 Ice breakers. 43:55.590 --> 43:56.630 Music. 43:56.790 --> 43:57.430 Yeah. 43:57.430 --> 44:00.210 So, like, non-work-related shit. 44:00.210 --> 44:01.490 And find a time... 44:01.490 --> 44:02.970 Okay, so here's a good one. 44:03.110 --> 44:05.170 Actually, this goes on this one. 44:05.890 --> 44:07.230 Imagine this. 44:07.610 --> 44:17.430 A bunch of engineers and a bunch of software folks in America dealing with a bunch of folks in Italy and dealing with a bunch of folks in Spain for the first time. 44:17.470 --> 44:21.090 As a European, it's been so fucking fun to watch. 44:21.750 --> 44:23.190 I was just... 44:23.630 --> 44:24.610 How y'all doing? 44:24.610 --> 44:26.470 And the Italian person is just like... 44:26.470 --> 44:27.870 English. 44:30.050 --> 44:31.410 It's been brilliant. 44:31.410 --> 44:32.910 So, here's the other part of this. 44:32.910 --> 44:36.290 Put yourself in their fucking shoes. 44:36.390 --> 44:40.890 If you're dealing with people across the world, take a step back. 44:41.130 --> 44:43.570 Stop using colloquialisms. 44:43.850 --> 44:45.910 Stop using slang. 44:45.910 --> 44:51.410 Slow the conversation down a little, please. 44:51.610 --> 44:55.170 Because your first language isn't theirs. 44:55.650 --> 44:59.270 Either that or learn their language. 45:01.210 --> 45:06.050 Start thinking outside of your comfort zone. 45:06.510 --> 45:07.050 So, that's one. 45:07.050 --> 45:07.870 All right, add some others. 45:07.870 --> 45:09.290 Give me some other collaboration. 45:13.030 --> 45:15.670 I can't get used to you outside of a red shirt. 45:15.670 --> 45:16.410 I don't like... 45:16.410 --> 45:17.510 Yeah, I know. 45:21.450 --> 45:22.730 Yeah, there we go. 45:22.730 --> 45:24.310 Meet on their time zone. 45:24.650 --> 45:31.110 Which means your ass has got to get up early in the morning or you're doing a Zoom meeting late in the evening after dinner with a bottle of alcohol in hand. 45:31.110 --> 45:35.410 All right, other good collaboration tools for remote people. 45:35.410 --> 45:36.410 What else you got? 45:36.870 --> 45:38.990 A lot of one-on-one nerding out. 45:38.990 --> 45:39.810 Yeah, there we go. 45:39.810 --> 45:41.050 One-on-one nerding out. 45:41.050 --> 45:42.590 Games times for crying out loud. 45:42.590 --> 45:43.610 What else we got? 45:45.690 --> 45:47.970 How many of you use Slack channels? 45:49.090 --> 45:54.930 And have fun or crazy bits or the geek stuff or the meme of the day channels? 45:55.110 --> 46:06.890 All right, so let me ask another question because as the CISO over at Boom, one of the first things I did is I formed a CISO channel at Boom and it's the Ask the CISO Anything channel. 46:07.410 --> 46:11.630 We started out, we do awareness training every single month and we make it fun. 46:11.630 --> 46:12.870 It's a minute and a half, two minutes. 46:12.870 --> 46:17.930 We use Gabrielle's stuff over at Wiser Training and we have a shit ton load of fun with this. 46:17.930 --> 46:28.370 I now have people who send me a screenshot of the text message scam that they got because they know that I run a program that melts the attacker's phone. 46:29.050 --> 46:31.510 I now get inbound shit sent to me. 46:31.510 --> 46:32.970 They're like, hey, we see this. 46:32.970 --> 46:38.050 When the people team send out a survey, I get like 10 people going, hey, is this legit, people team? 46:38.050 --> 46:39.950 I'm like, I fucking love you. 46:40.710 --> 46:47.670 We have facilitated, and by the way, I will wander around with $15, $25 gift cards to say thank you to people. 46:48.290 --> 46:51.770 Yeah, I will walk around and say, hey , thank you for telling me that. 46:51.770 --> 46:54.210 Word gets around real fast when you do that. 46:54.430 --> 46:59.510 So it's all about the feedback and reward and conversation and collaboration. 46:59.770 --> 47:00.870 Again, use different tools. 47:00.870 --> 47:04.030 Some people, no matter who they are, don't want to be on Zoom. 47:04.250 --> 47:06.850 So you give them a chat channel to be on. 47:08.030 --> 47:15.370 Also, how many of you, when was the last time anybody hand wrote a note to say thank you to somebody? 47:15.370 --> 47:18.990 Me, I actually did it the day before yesterday. 47:19.010 --> 47:21.530 How many of you hand write a note? 47:21.750 --> 47:25.970 Okay, so here's my challenge to every single one of you, every single one of you. 47:25.990 --> 47:32.390 Next time somebody does something good for you, hand write a note to say thank you. 47:32.390 --> 47:37.110 I don't care if you got to post it abroad, but hand write that note and leave it somewhere they'll find it. 47:37.110 --> 47:42.630 It's fucking amazing how much that means to people still in today's age. 47:42.630 --> 47:43.970 All right. 47:44.130 --> 47:46.490 We got time for no more questions? 47:46.490 --> 47:47.350 One more question. 47:47.410 --> 47:48.410 One more question. 47:48.410 --> 47:49.710 All right, one more question. 47:50.090 --> 47:51.350 Anybody else got questions? 47:51.350 --> 47:53.250 Or do I just wrap it up and say thank you? 47:53.830 --> 47:55.850 All right, so I will wrap it up. 47:55.850 --> 48:01.890 Okay, so how many of you need a refresher on DEF CON 101? 48:03.170 --> 48:04.370 All right. 48:05.430 --> 48:09.710 Three hours of sleep within a 24-hour period. 48:10.050 --> 48:11.550 That's why power naps are good. 48:11.550 --> 48:14.490 Two meals, one shower. 48:14.490 --> 48:16.550 We're geeks, but we still smell. 48:17.050 --> 48:20.210 All right, so look after yourselves. 48:20.210 --> 48:25.970 We're out here in stupid heat, crazy weather, surrounded by a whole lot of people. 48:26.130 --> 48:31.690 Look after yourselves, and even more so, look after each other, please. 48:31.950 --> 48:34.470 With that, love you all. 48:34.470 --> 48:35.970 Thank you very, very much. 48:41.930 --> 48:43.350 DEF CON 101 www.defcon101.org