Security Lessons From the Woofmutts; Or, How I Learned to Embrace the Slobber

so I would like to introduce my dear friend kilted one chris roberts sweet fish you guys save me okay let me have it down a bit seems to be rather sensitive that better kind of all right so first and foremost welcome secondly let's get some [ __ ] out of the way first and i love you we're no rockstars we're just the same it just so happens for whatever bloody reason people seem to want to listen occasionally anybody that calls themselves a rock star you are allowed to taser them okay the world's best hacker is allowed to be taped there are a few of us who have actually decked him over that this is being recorded isn't it yes okay

we're gonna have some fun let's just get on with it all right on this alcohol up here if anybody feels the need for alcohol we will have alcohol if anybody just were offended by the f-word as well i'll apologize now because we are gonna swear at our own industry so there's a little bit of fun a couple of bits of intros why are we having this talk a little bit of a focus on the wolf mutts and then we'll kind of go from there let's do the simple intro for those of you that don't know me i'm wondering who the hell the bearded thing is i've been fortunate enough to be creeping around this industry probably since I was about

14 my father had me arrested when I was 14 we broke into a bank in the UK using a Commodore 64 and an Atari 6800 both were confiscated and I never got them back when on jumped out of airplanes for a living and did this kind of stuff made some airplanes go sideways for a living now hanging out with the TiVo folks yadda yadda yadda now the other reason that I'm proud we'll be up here as well is because of this sometimes our only simple role in life is to be a role model for others in what not to do quick show of hands how many of you are fairly new in this industry like the last couple years or

coming into it wanting to know the rest of you are cynical old farts yes excellent all right well this is kind of a bit of building this is the other pair that will feature fairly heavily in this kind of discussion for those of you to follow me on like LinkedIn or Twitter or anything a pair of Great Danes of recent lore recently last year or so kind of come into the family dayz is about a five year old now Milo is now a better 15 month old hundred and fifteen pound slob 150 pound slob or monster so why are we having these conversations why are we doing the higher ground why are we trying to reach out and everything else

well let's put it simply we're broken as an industry we have a few challenges I'm fortunate or not but I get to talk about it a fair man now here's the thing this discussion that we're having today isn't about the industry there's gonna be an entire week's worth of [ __ ] talking about it out there we're gonna talk about us why am i getting feedback is that cuz this one's on it might just be me thank you drive me nuts here's the logic on this one this is how much money we're gonna spend in our industry this year globally a hundred and twenty four billion dollars that is a serious chunk of change by anybody's imagination having

just come out of cyber week out in Israel very interesting individuals stood up and put this slide up that summer ship we lost in January alone don't worry about it go that's how much we lost in January almost two billion records so the question is the hell are we doing and quite honestly this is kind of where we are we're not in a good position we're spending more money we're losing everybody's data so this is kind of where we feel we have upgraded from a dumpster fire let's first off have an apology we screwed up I've been in this industry for 20-plus years probably more than that if you can when I first started and we spent a long time doing

it our way we spent a long time with us talking to us we haven't done a very good job and that's the one sorry guys I am bitter pain how do I turn that what's easier oh here that is better isn't it yeah okay so here's the thing that we need to really start talking about and this is really getting to what Kathleen sank this should be probably a fairly familiar image to all of us from the science realm this isn't help me obi-wan Kenobi this is looking at everybody that's coming into this industry this is looking at everybody that's around us all the new folks all the people that are here for the first time or second time that's our

future those are the people that we literally need to be taking aside we're going how can I help you and not only that anybody that wants to come into this fricking industry people hit me up on a fairly regular basis probably the same as a lot of us in here hit us up on a fairly regular basis how do I get in what do I do how do I start where do I research I for good or for bad have got a set of blog posts the christmukkah son myself and a couple of other people I respect in this industry have done on LinkedIn and on peer list and I'll send those to people that's like my first hey have a reader

this when you've gone through this now let's have a conversation because it gives them a grounding in an understanding i sat down when they get back from Japan I got back from Japan like Saturday or Sunday my now if I Drive I'm sitting in a bloody coffee shop and I've got my do you guys from years ago me ffs did the Fed shirt yeah I was wearing that one in the coffee shop and young kid came up to me she was sixteen years old she's like hey you with the feds I'm like no but I am Nili the hell out of them on a regular basis she's like oh can I ask you some questions and we talked for

like half an hour she wants to do like forensics she wants to human forensics I'm like his head knotty stuff his this stuff his Nickerson's he is peer list this is our role and not only looking outside of our own industry for people in 18 everything else I hear so many stories about the fact that we don't have enough people in our industry that we're missing 2 to 3 million people go down the [ __ ] dole queue go talk to the pipe fitters go talk to the people that maybe aren't building houses go talk to those people and encourage them hey you've got a brain it works you're inquisitive how can I help you get into

this industry how can our industry help you learn enough to get a start because know what one of my best friends I probably spent two hours talking to him on the drive out here last night one of my best friends works on trains owns John Deere Model A's and model B's can fix hit miss engines from the 1800s and as far as he's concerned a computer on an iPhone is good at about 200 yards for putting a grouping of five 303 Rams through but he's one of the best [ __ ] people I know to talk to about our industry because he has an entirely different perspective absolutely entirely he and I are the ones that did

some of the car hacking a DEFCON number two down at the pawn house place when we went out to thought Conn like number one or number two we talked about hacking tractors that was all him the aeroplane stuff for three years he and I spent time researching engines that's his knowledge and trains that I'm brave breaking [ __ ] on now sit with people who are not in our comfort zone much more useful to this industry and quite simply our job from the obi-wan Kenobi side is to help everybody in that field it literally should be what's our job I know X amount of hours for work and X amount of hours for mentoring the hell

out of people and the other part of it is we need them to learn from what we've done wrong not necessarily to not let them do the same thing because it's interesting to watch other people make similar mistakes because you like hey I didn't think about jumping off the cliff that way I like it same result though but I'll share points result exactly but it's also trying to help them understand to make different mistakes and we have done stuff right so learn from the successes that we've done introduce them to other people in our networks carefully sometimes now from my standpoint I've probably spent the last year or so learning from the dogs I'm going to share some of this with you

because it's kind of cool truth this is a rough one especially in our industry because we all feel we have to adhere to certain things the mental side of our industry isn't getting enough attention it's starting to but it needs a lot more attention and a lot of it is because you know we've put ourselves and we have to be a certain way we have to do certain things and it maybe goes against the grain as to who we are and we fight that on a daily basis but I'd argue at this point in time with the way the industry is and the maturity of the industry find somewhere where you can be true to

yourself fortunate where I am these days that my boss and I was actually sitting down and meeting with this morning I he walked down and the first thing you said is like where's the kilt I'm like I love you just for that now the problem is is I forgot to bring a belt I packed all my stuff and forgot a belt so I could wear the kilt but it would get hairy and scary at the same time so I'm going to find a belt then I'll put the kilt back on I promise we are not good at looking before we leap off the cliff at times watching the dogs is really interesting those two hunt in packs it's awesome they go

against the squirrels one antagonized is a squirrel and the other one sits at the other end of the fence waiting for the squirrel to arrive we should probably learn more effectively I am one of those bad role models I will leap off of the cliff and figure [ __ ] out on the way down sometimes it works well sometimes it ends spectacularly the first time Milo saw snow he went from the kitchen door probably three bounds to get across the patio landed in the snow mouth open and was like a hundred plus pounds snowplow and all you saw was this flurry of white black and white and snow ever he didn't give a [ __ ] didn't know what

it was looked interesting and he went for it that arguably is what makes us who we are in hacking community the inquisitiveness the desire to challenge the desire to change detection apart and potentially put it back together again with a couple of screws left over but I encourage all of us get out and experience and step outside that comfort zone again especially as we're mentoring new people into this industry one challenge I have for everybody here how many of you do like the ISS a ISACA and the local b-sides rather than summer camp madness most of us here's my challenge to you next time you go to one of those take somebody from the business

or take a friend who's not in security drag the finance person along drag HR along bring legal bring somebody from manufacturing if you have to tranquilize the temporarily to get them out of the office so be it bribe them with alcohol do something but bring somebody along who's not part of this industry

the funny foot that the worth mud has that is about the fifth or sixth Oh what do you have well sadly what I have is not whiskey with an e which was the request whiskey for y ou and it's not that oh oh oh oh can we trade yes absolutely we can trade X I have this at the moment here hold on to that for a second we have to that that's who's that that's just general that's we have to share with everybody Canadian Club small-batch with sherry - sherry cuspid I love the frickin gloves thank you sorry squirrel moments yeah expect squirrels in this damn we're gonna get yelled at did I didn't submit a talk

I got press-ganged yes so this is the outrageous speaker request as a it was a four whiskey with an e sorry accent of Canadian to do a Scotsman's work it didn't work out but which Canadian did you sit still very lovely yes sir awesome exactly mud and there's also requests for puppies but you know sorry I was gonna bring the beast with me but a he wouldn't fit in the car and I wasn't too sure how he'd react in here problems slobber on everybody oh that's totally cool huh that is true yeah that is a good point oh that is totally we all right this is getting shared with everybody or anybody who wants some we won't leave more

glasses and a wheeze thank you so much and thank you see you I told you for that did I put a request in a moment weakness much like when you accepted this talk oh yeah I better shut up and talk thank you yeah let's make sure that goes to everybody all right try and try again so squirrels yeah he's got a little of my funny feet here's the thing with that damn dog the funny feet started off on the floor after he chewed a few buried a couple in the garden didn't really damage them but just slobbered all over them they moved up a couple of feet and like kids as they get bigger and older they can reach

higher well so can he and they got higher now they're on the Shelf up here and he's still trying to figure how to get the stupid things alright communication this is one thing we are not good at we have to get better and not just among ourselves miss allanté thank you ooh that's yummy oh yeah that is a spot thank you all right oh thank you very very much at school this is yummy all right I better finish this those in green yellow all right we're not good at this let's be perfectly honest not just among ourselves but again as we're bringing people into this industry help them communicate with a business help them effectively discuss risk help them

have the conversations with the industry in a way the industry understands not if you spill my alcohol I will exactly all right that's gone up there do not spill the alcohol I will retaliate all right Nick you realize this again video after Eddie the video all right give me the case shut up give me squirrels all right we're good on this one but those of us that came out of the military actually had a different way of communicating it was basically be polite pre-professional how the plants kill everybody try not to do that in this industry replace kill with Taser sir fair good all right carpe tempt them seize them Oh goddamn it [ __ ] alcohol attack abuse bastards

all right naked they're not weighted [Music] feel like I'm in one of those damn shows all right you're awesome yes I'm throwing dogs out okay that one's howdy for him dogs did you go I [Laughter] did if I take these back their last two seconds I'll have a set of slobbered think I'll use again thrown out in a second all right we're talking this is great I love this carpe diem pay seize the moment this for me is a huge one this is an opportunity discussion this is taking a leap of faith discussion this is I'm gonna go ten minutes left to talk discussion all right you get the idea people hear conversations step out

of your comfort zone and the flip side is when somebody here comes up to asks you asks you when somebody comes up to ask you a question maybe that's their moment give them the time of day place this goes back to this rock star not rock star comment that rock star mentality means I'm better than you bull-fucking-shit I'm no different none of us here are if you end up in this space be the same way place give everybody the time that you possibly can make sense good learn from now one this one's a good one we all love taking responsibility for the good things but when [ __ ] goes wrong and it will go

wrong take responsibility for the bad stuff too I've done a bunch of stupid things in my time a bunch some of them quite publicly and you know I took the responsibility I [ __ ] up I screwed up a company I screwed up a bunch of stuff screwed up a bunch of research and it happens I have logic for it I have discussions for it I'll own it and I've learned from it and hopefully that helps others learn do the same thing please this one's a big one be yourself please be who you are be comfortable in your own skin if you're not figure out what makes you happy for me it is these things not quite

these things but the bigger versions and the whiskey I love showing the whiskey this goes with it [ __ ] what anybody else thinks my mother follows my Twitter feed which is poop good really scary and I love her for her and she gets all the pictures and all the other crazy stuff but occasionally she's like Christopher do we need to have a conversation yes mother okay I have to temper it a little bit my job with my I'm sorry I don't mean to throw quite that first the sole request from my boss when I started my job was try not to get arrested again try not to piss off the president and try to leave

airplanes alone and that was literally it and for that I love him I've been fortunate I found a good place if you're not in a good place find another place there are a lot of your companies and there's a bunch around here mostly a bunch you won't let people be who they want to be but we'll have that discussion afterwards most of the people around here will let people be who they want to be patients have some patience I'm not good at this one I will occasionally let my emotions rule everything else let's not do that I will occasionally do that I've had to learn I've had to learn effectively all of you do the same thing and as you mentor

people in this industry as you talk to people or as you are coming through this industry take some patience take a step back evaluate the situation and then move forward okay reality check when I first got the dogs I would chase them through the house with a cloth every time they came in muddly very quickly I'm like this isn't working you've got a cleaner it's easier but there are definitely worse things in life than muddy paws on the carpet push it into perspective all of us have been there we've all had really bad [ __ ] days and we know people around us that have had really bad [ __ ] days number one help those people we're

losing people in this industry a lot of us are former military and former gov we lose too many people every single day to people who don't think they can get out from under their problems all of us help others around you please and if you do feel that way for fucksakes reach out there's enough of us here to help and to listen deal good so wrapping it up this was our history to some degree it's still kind of is this is our future it has to take all of us okay and I mean all of us all of us in here know the challenges our industry has we know the issues we know the challenges from race

color creed orientation whatever the hell it is your job our job as people come through this industry break those [ __ ] barriers down March side-by-side with that person to make those barriers broken down make sense because it's going to take all of us and that's across the business this isn't an IT problem and InfoSec problem this is everybody's challenge we all have to figure out how to solve these problems that we have because we can if we work together was assess we have to collaborate and communicate a hell of a lot more effectively than we're doing so as you talk to the vendors and the people in here who are hiring ask what's your communication policy how do

you handle conflict how do you have two hard discussions with people how do you handle me if I turn up in trousers one day and a [ __ ] dress the next day how are you going to deal with that because that's who I am can you handle it because if you can we'll have a conversation if you can't why the [ __ ] you in this industry and advertising for people in this industry make sense good this is the other part red teaming 'he's cool you know what dressing up especially at this age in a frickin red angry suit and jumping over fences that ain't cool I don't look good in red spangles anymore

trust me not really not it wasn't pretty the hairy legs just didn't work well fixing shits a whole lot harder so my challenge to you focus on bringing people in but bring them in so they can help defense bring them in so they can help the blue team's bring them in so we can do what we meant to be doing which is protect our job in this industry is to protect the people who aren't in this industry you bring people in help them understand they're responsible for the charges that are around them I like this one this is like one of my favorite ones now we've all come at this from different angles all come from different

places but you know what role in this together work it out we as individuals will fail we work together we collaborate we help one another at individual levels at business levels in industries we help everybody up then we'll succeed traditional end slide as always so long and thanks for all the fish alright questions gotta see she's prepared I'm not two questions any questions you don't get alcohol unless you ask your question let's just make it simple Oh for god sakes come on yes now it's a good question see that was easy go for ask a question and I'm not as daft as that sounds it's actually probably the most important how many of you are probably

sitting here gun you know what I'd really want to ask this but I don't want to look like an idiot in front of everybody put the [ __ ] testosterone away and ask your damn question and the same thing goes in life hey why does that work how does that work how do I do that can I do I can't I do that please go for it who are some people in the industry that you look up to currently okay [ __ ] Cady probably is one God in our industry that's an interesting one at there so this a bunch of folks I love in this mark millar Mark's awesome he runs Def sack all day dev sigh cops all day

DevOps whatever the hell you want to call it he is really spearheading a ton of trying to get development security and operations toward much more collaborative good they're much more collaboratively together a little bit that makes sense so mark would definitely be one I mean but there's there's so many people you've got one standing at the back Cathy took a [ __ ] flier and said hey let's do a talk what do we do we did a talk what is she doing that she's kicking ass in this industry just in Whitehead he's running around here somewhere as well we took a flier on him five six years ago he's kicking ass in this industry I look

up to him because he took he just took the what was given and just made the best out he's kicking ass I know there's so many good people in this industry jack wherever Jack's running around in a multicolored suit I love him I mean he's like the grandfather of our industry I don't know who else I mean there's so many good people hello Catherine I mean God says you do damage frickin effort it put takes to put on this kind of stuff anybody that runs like a local b-sides chapter needs to be cuddled and hugged and probably fed alcohol on a day basis yeah I mean that that takes so much freaking what I look up to those

people because that takes a ton of dedication and work unless I mean there's so many other good people in this industry who have managed to effectively bridge the gap from like the technical industry to the business side and who are doing some amazing stuff Rubin over ioactive I mean some of the research he's put together over the last couple of years is amazing no really stop all right I better shut the hell up otherwise I'm getting the other did that help awesome thank you very very much everybody [Applause]