1 00:00:05,090 --> 00:00:14,030 Hi everyone, my name is Savannah with Red Team Village, and today we have Bishop Fox with us today to kind of go through some of our interview questions of them being a sponsor of the village. 2 00:00:14,030 --> 00:00:17,190 I'm also going to pass it over to Greg and Omar to introduce themselves. 3 00:00:17,730 --> 00:00:21,990 Hi, I'm Greg Oldham, I'm with the Red Team Village, and I'm just happy to be here. 4 00:00:22,870 --> 00:00:31,890 And I'm Omar Santos, also with the Red Team Village, and also not only happy to be here, but thank you Bishop Fox and Elite for your support. 5 00:00:31,910 --> 00:00:34,630 And with that, I pass it to you to do a quick introduction. 6 00:00:35,150 --> 00:00:35,910 Absolutely. 7 00:00:35,910 --> 00:00:41,350 It is our pleasure, sincerely, to be involved with the Red Team Village again this year at DEF CON. 8 00:00:41,510 --> 00:00:54,950 So my name is Elite Dennis, I am a Senior Security Consultant on the Red Team at Bishop Fox, and I focus primarily on social engineering, incident response Red Team tabletops, and adversary emulation. 9 00:00:55,630 --> 00:00:56,670 Awesome. 10 00:00:56,670 --> 00:00:59,970 Well, with that being said, we can kind of dive into the questions. 11 00:01:00,330 --> 00:01:05,090 Our first question is going to be, why does Bishop Fox believe Red Team operations are important? 12 00:01:06,670 --> 00:01:15,970 Comprehensive Red Team assessment is really the only way that an organization can get an accurate view of their unique exposure and vulnerabilities. 13 00:01:16,890 --> 00:01:28,390 I think primarily the measure for the breadth of the attack surface only really becomes fully in view during a Red Team engagement. 14 00:01:28,390 --> 00:01:52,190 A lot of the types of testing that we do when we're beginning our security programs or to establish a baseline don't fully show that complete picture when it comes to where organizations are vulnerable, especially when we limit our focus and the scope of the attacks that we're including in the assessment, 15 00:01:52,190 --> 00:02:08,450 to eliminate things like social engineering or the ability to pivot between two different types of attack scenarios to come up with a more comprehensive view of an organization's stance and posture. 16 00:02:09,690 --> 00:02:10,390 Awesome. 17 00:02:10,390 --> 00:02:12,310 That definitely makes sense. 18 00:02:12,310 --> 00:02:14,850 Omar, I'm going to pass over to the next question for you. 19 00:02:15,050 --> 00:02:15,690 Absolutely. 20 00:02:15,690 --> 00:02:18,710 And now that you passed this, everybody's talking about AI, right? 21 00:02:18,710 --> 00:02:21,710 So we don't, we can, we cannot skip the topic. 22 00:02:21,710 --> 00:02:32,510 So with AI shaking the way that the industry is looking at security and how do you see affecting the whole industry as a whole, not only offensive security, but the industry as a whole? 23 00:02:32,810 --> 00:02:33,310 Sure. 24 00:02:33,310 --> 00:02:52,610 I know this is a huge concern for a wide variety of industries and job sectors specifically, where we've seen AI come into play with the development of malware and writing code for things that typically take some time to develop. 25 00:02:52,710 --> 00:02:58,210 We've also seen a lot of failure in the code that is coming out of artificial intelligence. 26 00:02:58,210 --> 00:03:06,850 And if we don't have skilled practitioners who can QA that code, remove bugs, find the flaws, then it's essentially useless. 27 00:03:06,970 --> 00:03:20,630 But I think that where AI can come in as a game changer and help to advance security on the whole is with the automation of mundane tasks that none of us want to perform. 28 00:03:20,630 --> 00:03:34,870 And where we have individuals that are suffering alert fatigue and just dealing with this immense volume of data that they have to analyze and go through, we can use AI to automate those types of tasks. 29 00:03:35,190 --> 00:03:44,490 And similar to the Industrial Revolution, where people were concerned that jobs would be lost due to machines doing all the work. 30 00:03:44,490 --> 00:03:54,650 I think we're going to see a similar result here where we do lose some jobs, but they are the mundane and process driven repetitive tasks. 31 00:03:54,650 --> 00:04:17,630 And we have humans that can be elevated into new roles and new jobs that come out of the use of AI in the context of security, giving more diverse options for skill sets to evolve over time, and essentially improve security on the whole, while not really having a net job loss. 32 00:04:17,630 --> 00:04:23,980 If anything, I see there being more opportunities for the advancement of AIs, the maintenance and the management of those over time. 33 00:04:24,580 --> 00:04:25,540 Yeah, that makes sense. 34 00:04:25,540 --> 00:04:26,640 Very well said. 35 00:04:26,640 --> 00:04:37,240 Now, how does your company see red teaming evolving, not only because of AI, but you know, making impact in the greater, in the next future, in the immediate future? 36 00:04:38,860 --> 00:04:52,420 Bishop Fox just released a report, and we found that 64% of organizations are employing red teams in some capacity, with more than half of those planning to increase that investment over the next 12 to 24 months. 37 00:04:52,420 --> 00:05:00,120 So that's pretty amazing, considering the fact that it was tough for us to sell just your basic pen tests, you know, 5-10 years ago to most organizations. 38 00:05:00,120 --> 00:05:11,520 And there's still some organizations that struggle, whether it's because they have immature security programs, or they're still trying to requisition the budget to allow for the investment in red teaming. 39 00:05:11,520 --> 00:05:22,600 I think we're seeing that the value of red teams is becoming clear to those who are in the position to make those decisions on where the money is invested in security programs. 40 00:05:22,600 --> 00:05:27,220 And as those programs evolve, we need more comprehensive testing. 41 00:05:27,320 --> 00:05:37,500 So the next steps here, I think we'll see a lot more need for red teaming from the perspective of both internal and external. 42 00:05:37,500 --> 00:05:54,680 It's great to have an internal red team, but it's also wonderful to be able to bring in another red team that's external to kind of give a different perspective, and to show your real external facing gaps, where there's a lot of assumptions that can be made internally. 43 00:05:54,840 --> 00:06:04,060 If you're within an organization, some folks think, well, yeah, this is being done by this tool, and you hire an outsider to come in and go, actually, there's a giant gap here. 44 00:06:04,220 --> 00:06:27,620 So we absolutely speculate that this adoption of red team services throughout, whether it's internal and the most mature security programs, or just the acceptance of purchasing red team, in addition to your standard pen test assessments, that that's just going to grow over the next five to 10 years. 45 00:06:28,140 --> 00:06:28,720 Yeah, I agree. 46 00:06:28,720 --> 00:06:36,300 And also the, the regulative landscape, you know, will also dictate that you have to have a third party as well. 47 00:06:36,300 --> 00:06:38,240 So very, very well said. 48 00:06:38,800 --> 00:06:43,320 There are thousands of red teamers probably watching you right now, right? 49 00:06:43,380 --> 00:06:51,980 And especially as we go through all the activities at DEF CON, a lot of people come to the Red Team Village because of the education, right? 50 00:06:52,920 --> 00:07:04,260 What are some word of advice or, you know, I guess the top three things that you will probably recommend somebody that will get started, especially if they want to work in your company, right? 51 00:07:05,020 --> 00:07:06,800 Yeah, absolutely. 52 00:07:06,800 --> 00:07:20,720 So finding that first security job can be extremely challenging, especially if you're part of the emerging workforce or those people who have just graduated and are starting to look for work. 53 00:07:20,720 --> 00:07:31,320 I would say don't be afraid to take a role that maybe isn't something that you feel will be your final destination in security. 54 00:07:31,340 --> 00:07:36,080 And also don't be afraid to take a role that's more on the defensive side. 55 00:07:36,080 --> 00:07:42,780 Because, I mean, if we're being honest, the defensive side can be a lot more difficult than the red teaming attacking side. 56 00:07:42,780 --> 00:07:46,120 I just have to find the path of least resistance, the shortest route. 57 00:07:46,120 --> 00:07:51,240 But on the defensive side, it's really difficult to protect everything all at once all the time. 58 00:07:51,440 --> 00:08:02,960 So getting a perspective on what that entails only makes you a better offensive security practitioner in the future, if you understand how companies are defended. 59 00:08:03,200 --> 00:08:17,880 So taking a junior-level role or a beginning consulting role that maybe isn't exactly where you want to end up only gives you that valuable experience that you can then use to springboard into your next position. 60 00:08:18,040 --> 00:08:30,880 And oftentimes, that will also give you the leverage to increase your compensation, and to find a role that speaks more to the types of skills that you want to grow and learn. 61 00:08:31,020 --> 00:08:48,100 So essentially, in short, don't be afraid to take a role that maybe isn't your most favorite, if it's in security, whether you're transitioning from another industry into security or starting out, you know, at the beginning of your work experience. 62 00:08:48,280 --> 00:08:55,180 And then just be prepared to learn as much as you can, keep an open mind, be coachable. 63 00:08:55,660 --> 00:09:08,900 And for those who want to join the Fox Den, I would highly encourage participating in those like extracurricular type activities, get involved in your security community, find ways that you can contribute there. 64 00:09:08,900 --> 00:09:13,980 Because I find that a lot of the best learning happens outside of the classroom, so to speak. 65 00:09:14,000 --> 00:09:31,760 And while certifications and cybersecurity programs and industry conferences are wonderful, doing the thing is going to teach you a lot more about how to do the thing professionally, than just learning in theory, how to do the thing. 66 00:09:31,840 --> 00:09:33,700 I agree 1000% with that. 67 00:09:33,700 --> 00:09:34,300 Very well said. 68 00:09:34,300 --> 00:09:36,680 So I've been asking you a lot of questions. 69 00:09:36,680 --> 00:09:41,880 So I'm going to pass it back to Greg, to continue some of the questions that we have. 70 00:09:42,600 --> 00:09:43,520 Thank you. 71 00:09:43,520 --> 00:09:44,740 No, I'm just kidding. 72 00:09:44,920 --> 00:09:50,000 So thank you again very much for for helping sponsor the Red Team Village. 73 00:09:50,560 --> 00:09:57,580 What do you think the importance of sponsoring community activities like the Red Team Village play in in our community? 74 00:09:59,620 --> 00:10:05,260 I gained my entry into this industry through DEF CON. 75 00:10:05,360 --> 00:10:11,100 And where I did the most learning was within the villages within DEF CON. 76 00:10:11,100 --> 00:10:23,240 And the the real driving force, and the thing that sets DEF CON apart from all other conferences, in my view, anyway, is that desire. 77 00:10:23,320 --> 00:10:30,520 And this really is in alignment with one of Bishop Box's main value statements, and that is getting better together, or get better together. 78 00:10:30,640 --> 00:10:37,460 And by keeping that knowledge sharing going, that's how we all get better together. 79 00:10:37,460 --> 00:10:46,660 Because if you get siloed into your single organization, or as an individual consultant in your own practice, you stop evolving and you stop growing. 80 00:10:47,080 --> 00:10:58,200 But having a team of people and then having the ability to collaborate outside of your organization, and learn from others who are facing the same challenges, that is something that I can't really put a dollar value on. 81 00:10:58,260 --> 00:11:03,940 And we don't really have a workforce gap, I think we have more of a skills gap in security. 82 00:11:03,940 --> 00:11:06,960 So we have the humans, we just need to make sure that they're skilled. 83 00:11:06,960 --> 00:11:24,500 And having access to this kind of education within Red Team Village and the other villages at conferences like DEF CON can allow people to find things that they may be interested in pursuing learning more about, without that barrier to entry of the cost of a certification , 84 00:11:24,500 --> 00:11:28,200 to only find out that, yeah, you know, I didn't really want to do this for a living. 85 00:11:28,200 --> 00:11:33,080 And now I've spent all this money and invested all this time in learning it, maybe it's not the right fit for me. 86 00:11:33,080 --> 00:11:49,260 Whereas with the villages, you can hop in for a weekend and figure out if that's something that you're into, and then spend the year between conferences, elevating your skill set and figuring out what you want to do next year, and making connections with people who you can collaborate with throughout the course of the year. 87 00:11:49,400 --> 00:12:12,140 So as far as Red Team Village and our investment, Bishop Fox is driven by contributing back to this community, just encouraging the sharing, encouraging the local meetups and the collaboration that happens between humans in real life, and continuing to promote this skill sharing and elevation throughout our community. 88 00:12:13,080 --> 00:12:14,340 Wise words. 89 00:12:14,340 --> 00:12:14,760 Thank you. 90 00:12:14,760 --> 00:12:17,920 I want to pass it back to Savannah. 91 00:12:17,920 --> 00:12:19,260 Do you have anything to say? 92 00:12:19,760 --> 00:12:22,920 Yeah, so we are going to kind of close it out from here. 93 00:12:22,920 --> 00:12:31,220 And we want to see if there's any final words that you have for anyone who's watching the stream today of any additional information you kind of want to add to the video today. 94 00:12:31,680 --> 00:12:35,200 Yeah, I would love to encourage volunteering. 95 00:12:35,580 --> 00:12:40,760 I can't even stress how important it is to make connections with people. 96 00:12:40,820 --> 00:12:51,880 And going to my first several DEF CONs, it was really intimidating to stop people and talk to them and try to strike up a conversation and network, because there's a lot of big personalities and a lot going on. 97 00:12:51,880 --> 00:12:53,640 And there's so many different places. 98 00:12:53,640 --> 00:13:01,820 But it's really neat if you can find a place that you can volunteer and start to create your own network and use that as like your home base. 99 00:13:02,000 --> 00:13:07,220 So volunteering in different villages, volunteering to help support your community efforts locally. 100 00:13:07,520 --> 00:13:22,180 These are all ways that you can not only get involved in the community and meet new people, but I have 100% received offers for every job that I've accepted in security through my connection with humans. 101 00:13:22,240 --> 00:13:29,240 And a lot of that can be traced back to that collaboration and volunteering and the promotion of education throughout our community. 102 00:13:29,940 --> 00:13:33,320 Yeah, I 100% agree with that, because I would not be with Red Team Village. 103 00:13:33,320 --> 00:13:35,460 I did not volunteer in 2019. 104 00:13:35,460 --> 00:13:37,120 That's where I met Omar. 105 00:13:37,760 --> 00:13:40,920 So 100% agree with volunteering. 106 00:13:40,920 --> 00:13:42,000 I think that's so important. 107 00:13:42,000 --> 00:13:48,340 And then going to local meetups, even outside of DEF CON, that's how you make the connections with people in the industry. 108 00:13:48,340 --> 00:13:49,620 It's so important. 109 00:13:49,620 --> 00:13:54,220 So get out there and make the connections and make sure you're networking at DEF CON too. 110 00:13:55,360 --> 00:13:57,280 All right, that's, that's all we have. 111 00:13:57,280 --> 00:13:58,700 So we can go ahead and wrap it up from here. 112 00:13:58,700 --> 00:14:03,140 We really appreciate you coming on the stream today, and hope you have a great rest of the day. 113 00:14:03,140 --> 00:14:04,940 Yeah, thanks so much for having me. 114 00:14:04,940 --> 00:14:06,900 I'm looking forward to volunteering this year as well. 115 00:14:06,900 --> 00:14:09,880 So I'll actually be in Red Team Village on Saturday afternoon. 116 00:14:10,060 --> 00:14:10,640 Sweet. 117 00:14:10,640 --> 00:14:11,320 Hear that? 118 00:14:11,320 --> 00:14:13,460 You're going to come to the village now on Saturday afternoon.