WEBVTT 00:09.080 --> 00:10.800 Hello, AppSec Village. 00:11.300 --> 00:12.540 Well, that's what we do, right? 00:12.540 --> 00:13.260 We pivot. 00:13.480 --> 00:17.640 We respond to the circumstances and we remain resilient against them. 00:18.280 --> 00:20.040 I just want to thank you all for being here. 00:21.020 --> 00:22.920 Apologies, I don't have my speech printed out. 00:23.820 --> 00:24.800 Oh, I can. 00:27.520 --> 00:28.560 The other one. 00:31.700 --> 00:32.340 Beautiful. 00:34.660 --> 00:40.240 So I just want to thank you all for taking time out of your AppSec Village and your DEF CON to be here to come hear me speak today. 00:41.640 --> 00:44.000 I am the one woman purple team. 00:44.240 --> 00:48.120 I am also this year's Cybersecurity Woman of the Year, Hacker of the Year. 00:48.140 --> 00:50.840 But I'm going to talk to you today about defense things, I promise. 00:51.080 --> 00:56.540 Because I truly believe in the mission and I love my AppSec practitioners and that's why we're all here. 00:56.800 --> 01:12.340 So, interesting, as I grew in my journey from red teaming to purple teaming, right, collaborative function of security, new niche in recent years, I began to really heavily consider the power of interdepartmental relationships, right? 01:12.340 --> 01:13.300 That's my job. 01:13.300 --> 01:21.020 Go out, collaborate, build relationships, break down those silos, don't be the mysterious red team, be someone who's an ally in defense. 01:21.040 --> 01:22.960 That's what we're all here to do. 01:23.720 --> 01:32.950 And so I started to not only think about but see the actual effect that simply having conversations and having collab calls could have on cyber strategy. 01:32.950 --> 01:39.690 And so often this year I've heard other speakers say, you know, it's crucial for more of us to collaborate. 01:39.690 --> 01:42.750 It's crucial to put your hand up and have conversations with each other. 01:42.750 --> 01:48.230 It is crucial for us to work with each other because that is the only way we're going to innovate forward. 01:48.510 --> 01:53.110 And I am one of the people who highly advocates for that. 01:54.150 --> 02:00.290 Some of the common words that I've seen this summer camp, especially out on the expo floor, assurance. 02:00.290 --> 02:04.090 A state of confidence that an outcome will be fulfilled. 02:04.270 --> 02:05.390 Resilience. 02:05.390 --> 02:09.590 Your ability to bounce back from the bad things happening, right? 02:09.590 --> 02:12.370 Or hopefully thwart them from happening in the first place. 02:12.550 --> 02:13.570 Trust. 02:13.610 --> 02:18.890 A concept that embodies faith in the reliability of something or someone. 02:19.070 --> 02:32.410 And I realized as you're seeing complete assurance, complete 24-7 monitoring, zero trust, all these things, you can't have any of these words without a strong relationship as a foundation. 02:32.910 --> 02:43.430 And I think it just hammers home the idea that relationships across cyber verticals are what's crucial for driving things like application security forward. 02:43.470 --> 02:57.530 So we work in a job where technology's exponential growth and capability is matched only by the rapid equal evolution of cyber threats, right? 02:57.530 --> 03:03.790 We've all seen orgs struggle due to vertical silos that hinder information sharing and collaboration. 03:03.790 --> 03:04.950 The concept is familiar. 03:04.950 --> 03:05.930 We've all seen it. 03:05.930 --> 03:10.570 How well we perform in incident response literally depends on how well we work with each other. 03:10.570 --> 03:13.130 And yet we continue to not do those things. 03:13.250 --> 03:20.110 So how does the power of relationships and collaboration physically apply to application security? 03:20.470 --> 03:23.490 It manifests in several key ways. 03:23.490 --> 03:25.830 The answer is, again, collaboration. 03:25.890 --> 03:27.570 Information is power. 03:27.670 --> 03:33.970 We must recognize that sharing our knowledge, sharing our insights, our experiences is our strongest weapon. 03:34.210 --> 03:39.410 Just like collaborative and close personal relationships bolster our personal lives, right? 03:39.410 --> 03:40.130 It takes a village. 03:40.130 --> 03:41.350 It takes a village for anything. 03:41.350 --> 03:44.350 It takes a village to secure our applications. 03:44.590 --> 03:46.430 How does this actually manifest? 03:46.430 --> 03:49.570 It manifests in several key ways in my experience. 03:49.650 --> 03:54.650 Things that we've all heard before but are probably not being well utilized or well leveraged. 03:55.010 --> 03:56.050 DevSecOps. 03:56.290 --> 03:57.510 Threat modeling. 03:57.670 --> 03:58.950 Purple teaming. 03:59.230 --> 04:09.270 These are the tools and the concepts that when you break down and collaborate with each other help to secure applications because securing code and securing architecture is not enough. 04:09.430 --> 04:10.350 It's simply not enough. 04:10.350 --> 04:15.430 We have to learn to rely and depend on and benefit from each other. 04:15.470 --> 04:23.310 Yes, me as an offensive person, I am sitting here begging you to learn to rely on me and let me rely on you to help secure our applications. 04:23.990 --> 04:25.290 So DevSecOps. 04:26.070 --> 04:30.410 It's actually, a lot of people think it's just development and security, right? 04:30.410 --> 04:32.850 But it's development, security, and operations. 04:33.310 --> 04:37.530 Operations is actually a completely separate and crucial function of DevSecOps. 04:37.650 --> 04:39.850 Development represents the creative force, right? 04:39.850 --> 04:41.370 They make the things happen. 04:41.690 --> 04:44.210 Security is obviously your safeguard. 04:44.250 --> 04:47.390 We want to bake those things into the things that you are creating. 04:47.390 --> 04:54.330 And operations is the smooth assembly of all those things happening together and getting us to delivery of these things. 04:54.790 --> 05:01.590 So in DevSecOps, culture, technology, and security coexist harmoniously. 05:01.590 --> 05:06.630 And that's a beautiful example of security and collaboration driving each other forward. 05:06.990 --> 05:18.870 In threat modeling, just as resilient relationships create a support network that bolsters our personal lives, threat modeling establishes a crucial foundation that fortifies our applications. 05:19.090 --> 05:21.230 I don't see enough orgs. 05:21.230 --> 05:33.110 Threat modeling, I very clearly come in and say, if you had just considered this, if you had just identified it, if you had driven that remediation effort, this wouldn't be a concern for you today and you wouldn't be responding to it reactively today. 05:33.350 --> 05:37.430 Threat modeling is one of my favorite proactive security measures out there. 05:39.210 --> 05:39.690 Because... 05:40.310 --> 05:44.130 I like to think of it as weaving a safety net underneath your application, right? 05:44.130 --> 05:50.030 And that safety net is crafted with a web of insights that anticipates threats before they emerge. 05:50.030 --> 06:06.850 Just like a resilient community can predict and respond to weather catastrophes and infrastructure outages and things like that, we, as threat modelers, want to bring your teams together, not just your developers, not just your red teamers, your stakeholders, 06:06.850 --> 06:08.950 your designers, your UX, UI. 06:08.950 --> 06:22.510 And we want to see all of those people bouncing off each other, helping each other identify the vulnerabilities and the threats against them, and proactively spending that mitigation dollar targeting those remediation efforts, because those teams are inundated, 06:22.510 --> 06:22.970 right? 06:22.970 --> 06:24.070 We're all inundated. 06:24.070 --> 06:26.730 We're all overextended and under-resourced. 06:26.730 --> 06:30.670 This is one of the ways we can literally do more with what we've already got. 06:30.670 --> 06:32.650 Do more with less. 06:32.970 --> 06:33.910 Threat modeling. 06:34.710 --> 06:39.950 Finally, I wouldn't be giving this talk today if we did not do a plug for purple teaming, right? 06:39.950 --> 06:48.130 Purple teaming is one of those things that I chose to help build because I believe in its foundational core values so much. 06:48.570 --> 06:53.830 Purple teaming is really that bridge that connects diverse perspectives and skills. 06:53.930 --> 07:03.970 Much like the way two of your best friends will have a completely separate answer to one of your problems, purple teaming tries to take those two best friends and bring them together and say, how could we do both? 07:03.970 --> 07:07.230 How could we take aspects of what you both think is the right answer? 07:07.230 --> 07:10.710 How can we learn and benefit from each other? 07:11.190 --> 07:19.370 Through purple teaming, we cross-educate detection, investigation, remediation teams. 07:19.370 --> 07:23.090 We teach them not only to understand what you're looking at, right? 07:23.090 --> 07:23.970 What is this? 07:23.970 --> 07:25.130 How did this happen? 07:25.130 --> 07:26.390 Why did it get there? 07:26.390 --> 07:28.390 What did the adversary want? 07:28.390 --> 07:32.470 What was I hoping to gain with that piece that furthers me to the next piece? 07:32.470 --> 07:35.230 Because sometimes we're very, very targeted in what we choose. 07:35.230 --> 07:40.490 It's like, wow, they didn't go for any of that over here, but they went very, very hard at this over here. 07:40.490 --> 07:41.230 Why? 07:41.610 --> 07:53.570 And I love it when my defenders come to me and say, I wouldn't have thought that was suspicious before, but I remembered that was like the fifth step in the thing that you did, and I saw all the other steps, and I knew we were in trouble. 07:53.890 --> 07:55.170 That's beautiful. 07:55.170 --> 07:59.890 Because through purple teaming, we amplify our ability to adapt and respond. 08:00.030 --> 08:11.870 Just as strong communities rally together during times of crisis, the combined efforts of red and blue and development and builder teams is what's going to foster innovation and most of all preparedness. 08:12.070 --> 08:19.210 We keep suffering incidents and breaches because the enemy is excellent at widespread coordination. 08:19.430 --> 08:24.330 They're some of the only organizations I've literally seen who can get 50 people to come together for one goal. 08:24.370 --> 08:32.250 If we could do that, if we could leverage those strategies and those capabilities and those things, we would stand a much better chance. 08:33.410 --> 08:37.650 At the end of the day, what we chase is cyber resilience, right? 08:37.690 --> 08:41.270 We want to chase that ability to hopefully anticipate what's going to happen and stop it. 08:41.270 --> 08:47.810 But if not, make sure that we are performing as security practitioners to respond, contain, and eradicate the problem. 08:48.450 --> 08:52.010 But cyber resilience is no longer going to be a separate functional thing. 08:52.010 --> 08:54.090 It's not developers versus security. 08:54.090 --> 08:56.370 It's not red team versus blue team. 08:56.370 --> 08:58.490 It's going to take all of us. 08:58.490 --> 09:13.170 So just as relationships are the core of your support system in life, the relationships we're going to have across our verticals and our functions is what's going to give resilience to our organization and our applications. 09:13.450 --> 09:23.410 So as we conclude, because I started late, we just want to remember that cyber and tech are still people industries. 09:23.410 --> 09:26.150 We are teammates behind our disciplines. 09:26.210 --> 09:30.570 Threat modeling and purple teaming and DevSecOps, these aren't just methodologies. 09:30.570 --> 09:31.450 They're not just buzzwords. 09:31.450 --> 09:33.630 They're not just things that we say that we do. 09:33.710 --> 09:42.210 They are the things that echo the values of what we do and guide our interactions with both technology and each other. 09:42.590 --> 09:50.170 Embracing a human-centric approach, we acknowledge that the challenges may be dynamic, but so are we. 09:50.650 --> 09:53.410 So thank you for sticking around through my delay today. 09:53.410 --> 09:56.570 I want to thank my employer for letting me be here, Acquia Incorporated. 09:56.690 --> 09:58.450 My teamie in threat modeling is right here. 09:58.450 --> 09:59.770 Please bombard him later. 10:00.130 --> 10:03.370 I sincerely appreciate you all giving me the time to talk to you today. 10:03.630 --> 10:05.470 Collaborative security is near and dear to my heart. 10:05.470 --> 10:13.290 I really believe that the more of you I get to know, the more you teach me, the more I learn, and the more I teach you, the better off security will truly be. 10:13.450 --> 10:14.830 So thank you. 10:14.830 --> 10:15.410 Thank you. 10:15.410 --> 10:16.510 Thank you. 10:16.510 --> 10:17.950 Thank you. 10:17.950 --> 10:20.330 Thank you.