Hello, AppSec Village.
Well, that's what we do, right? We pivot.
We respond to the circumstances and we remain resilient against them.
I just want to thank you all for being here.
Apologies, I don't have my speech printed out.
Oh, I can.
The other one.
Beautiful.
So I just want to thank you all for taking time out of your AppSec Village and your DEF CON
to be here to come hear me speak today.
I am the one woman purple team.
I am also this year's Cybersecurity Woman of the Year, Hacker of the Year.
But I'm going to talk to you today about defense things, I promise.
Because I truly believe in the mission and I love my AppSec practitioners
and that's why we're all here.
So, interesting, as I grew in my journey from red teaming to purple teaming,
right, collaborative function of security, new niche in recent years,
I began to really heavily consider the power of interdepartmental relationships, right?
That's my job. Go out, collaborate, build relationships, break down those silos,
don't be the mysterious red team, be someone who's an ally in defense.
That's what we're all here to do.
And so I started to not only think about but see the actual effect that simply
having conversations and having collab calls could have on cyber strategy.
And so often this year I've heard other speakers say, you know,
it's crucial for more of us to collaborate.
It's crucial to put your hand up and have conversations with each other.
It is crucial for us to work with each other because that is the only way
we're going to innovate forward.
And I am one of the people who highly advocates for that.
Some of the common words that I've seen this summer camp,
especially out on the expo floor, assurance.
A state of confidence that an outcome will be fulfilled.
Resilience.
Your ability to bounce back from the bad things happening, right?
Or hopefully thwart them from happening in the first place.
Trust.
A concept that embodies faith in the reliability of something or someone.
And I realized as you're seeing complete assurance, complete 24-7 monitoring,
zero trust, all these things, you can't have any of these words
without a strong relationship as a foundation.
And I think it just hammers home the idea that relationships
across cyber verticals are what's crucial for driving things like
application security forward.
So we work in a job where technology's exponential growth and capability
is matched only by the rapid equal evolution of cyber threats, right?
We've all seen orgs struggle due to vertical silos that hinder
information sharing and collaboration.
The concept is familiar. We've all seen it.
How well we perform in incident response literally depends on
how well we work with each other.
And yet we continue to not do those things.
So how does the power of relationships and collaboration
physically apply to application security?
It manifests in several key ways.
The answer is, again, collaboration.
Information is power.
We must recognize that sharing our knowledge, sharing our insights,
our experiences is our strongest weapon.
Just like collaborative and close personal relationships
bolster our personal lives, right?
It takes a village. It takes a village for anything.
It takes a village to secure our applications.
How does this actually manifest?
It manifests in several key ways in my experience.
Things that we've all heard before but are probably not being
well utilized or well leveraged.
DevSecOps.
Threat modeling.
Purple teaming.
These are the tools and the concepts that when you break down
and collaborate with each other help to secure applications
because securing code and securing architecture is not enough.
It's simply not enough.
We have to learn to rely and depend on and benefit from each other.
Yes, me as an offensive person, I am sitting here begging you
to learn to rely on me and let me rely on you
to help secure our applications.
So DevSecOps.
It's actually, a lot of people think it's just development and security, right?
But it's development, security, and operations.
Operations is actually a completely separate and crucial function of DevSecOps.
Development represents the creative force, right?
They make the things happen.
Security is obviously your safeguard.
We want to bake those things into the things that you are creating.
And operations is the smooth assembly of all those things happening together
and getting us to delivery of these things.
So in DevSecOps, culture, technology, and security coexist harmoniously.
And that's a beautiful example of security and collaboration
driving each other forward.
In threat modeling, just as resilient relationships
create a support network that bolsters our personal lives,
threat modeling establishes a crucial foundation that fortifies our applications.
I don't see enough orgs.
Threat modeling, I very clearly come in and say,
if you had just considered this, if you had just identified it,
if you had driven that remediation effort,
this wouldn't be a concern for you today
and you wouldn't be responding to it reactively today.
Threat modeling is one of my favorite proactive security measures out there.
Because...
I like to think of it as weaving a safety net underneath your application, right?
And that safety net is crafted with a web of insights
that anticipates threats before they emerge.
Just like a resilient community can predict and respond to
weather catastrophes and infrastructure outages and things like that,
we, as threat modelers, want to bring your teams together,
not just your developers, not just your red teamers,
your stakeholders, your designers, your UX, UI.
And we want to see all of those people bouncing off each other,
helping each other identify the vulnerabilities and the threats against them,
and proactively spending that mitigation dollar
targeting those remediation efforts, because those teams are inundated, right?
We're all inundated. We're all overextended and under-resourced.
This is one of the ways we can literally do more with what we've already got.
Do more with less. Threat modeling.
Finally, I wouldn't be giving this talk today
if we did not do a plug for purple teaming, right?
Purple teaming is one of those things that I chose to help build
because I believe in its foundational core values so much.
Purple teaming is really that bridge that connects diverse perspectives and skills.
Much like the way two of your best friends will have a completely separate answer to one of your problems,
purple teaming tries to take those two best friends and bring them together
and say, how could we do both?
How could we take aspects of what you both think is the right answer?
How can we learn and benefit from each other?
Through purple teaming, we cross-educate detection, investigation, remediation teams.
We teach them not only to understand what you're looking at, right?
What is this? How did this happen? Why did it get there?
What did the adversary want?
What was I hoping to gain with that piece that furthers me to the next piece?
Because sometimes we're very, very targeted in what we choose.
It's like, wow, they didn't go for any of that over here, but they went very, very hard at this over here.
Why?
And I love it when my defenders come to me and say,
I wouldn't have thought that was suspicious before,
but I remembered that was like the fifth step in the thing that you did,
and I saw all the other steps, and I knew we were in trouble.
That's beautiful.
Because through purple teaming, we amplify our ability to adapt and respond.
Just as strong communities rally together during times of crisis,
the combined efforts of red and blue and development and builder teams
is what's going to foster innovation and most of all preparedness.
We keep suffering incidents and breaches because the enemy is excellent at widespread coordination.
They're some of the only organizations I've literally seen who can get 50 people to come together for one goal.
If we could do that, if we could leverage those strategies and those capabilities and those things,
we would stand a much better chance.
At the end of the day, what we chase is cyber resilience, right?
We want to chase that ability to hopefully anticipate what's going to happen and stop it.
But if not, make sure that we are performing as security practitioners to respond, contain, and eradicate the problem.
But cyber resilience is no longer going to be a separate functional thing.
It's not developers versus security.
It's not red team versus blue team.
It's going to take all of us.
So just as relationships are the core of your support system in life,
the relationships we're going to have across our verticals and our functions is what's going to give resilience to our organization and our applications.
So as we conclude, because I started late, we just want to remember that cyber and tech are still people industries.
We are teammates behind our disciplines.
Threat modeling and purple teaming and DevSecOps, these aren't just methodologies.
They're not just buzzwords.
They're not just things that we say that we do.
They are the things that echo the values of what we do and guide our interactions with both technology and each other.
Embracing a human-centric approach, we acknowledge that the challenges may be dynamic, but so are we.
So thank you for sticking around through my delay today.
I want to thank my employer for letting me be here, Acquia Incorporated.
My teamie in threat modeling is right here.
Please bombard him later.
I sincerely appreciate you all giving me the time to talk to you today.
Collaborative security is near and dear to my heart.
I really believe that the more of you I get to know, the more you teach me, the more I learn, and the more I teach you, the better off security will truly be.
So thank you.
Thank you.
Thank you.
Thank you.
Thank you.