I’m Ed Anderson and I work at a company called RealSelf. At RealSelf we’re in the business of of providing a community / discussion forum / review framework for for a stigmatized topic, cosmetic surgery and dentistry. Not a dinner table topic in most households. I guess working here as given me a soft spot for stigmatized topics. I’ve noticed, and am concerned by the negative attitudes we of the computer industry are applying to infosec topic. First let’s define stigma. There’s a sociologist named Erving Goffman who wrote a very excellent essay on social stigma called Stigma : Notes on the Management of Spoiled Identity. Goffman defines stigma as : The phenomenon whereby an individual with an attribute which is deeply discredited by his/her society is rejected as a result of the attribute. Stigma is a process by which the reaction of others spoils normal identity. Stigma is a process by which the reaction of others spoils normal identity.
suggesting that we need more HUGOPS and Less SHAMEOPS for INFOSEC. I believe that we’re stigmatizing data breach events and to a lesser extent INFOSEC as a whole. We’re classifying data breach as deviant. Remember, stigma is spoiling normal identity aka penalizing the individual in order to protect a larger group. I believe that data breach isn’t actually deviant, and no additional protection comes to the rest of us on the internet when we ostracise the firms who disclose security events.
with #INFOSEC, as partners Maybe we’ll call it something crazy like #DEVSECOPS OBAMA: LOL JOE YOU CRAZY AF @edyesed Removing the stigma of pwn3r5h1p It’s my position that the good guys can work hard and do nothing wrong, and still end up pwned. And we’ll talk more about that. We as the tech elite are due for a change in our relationship with INFOSEC. A change in how we think about our own security, and how we think about other organization’s security. Much like the devops movement is doing for the dynamic between development / ops / “the business”, I think we can open our arms a little bit wider and bring security into our collaborative-business-partners group.
at the ones that had incidents OBAMA: Joe.. BIDEN: imma point just at the ones that had breaches OBAMA: JOE! BIDEN: imma point at the ones that pointed at others OBAMA: DANG JOE, #HUGOPS, CHIEF @edyesed Removing the stigma of pwn3r5h1p Let’s try to normalize in this room • Who’s had an incident in the past year and your defences were known to work? An incident is when a machine’s integrity or confidentiality is compromised. • Who’s had an incident in the past year and your defences were known to NOT work? • Anybody willing to admit to a breach? Breach is an incident that results in the confirmed disclosure of data to an unauthorized party. • Who’s made fun of another company’s incident or breach AND/OR Who’s sought information about other people like celebrities after finding out about a breached?
BIDEN: imma #hugops ‘em Removing the stigma of pwn3r5h1p Some Stigmatic examples • <HEADLINES FOR LINKEDIN BREACH> LinkedIn was in the news quite a bit this summer, having experienced a sizable breach in 2012. The userlist came out on the dark markets for such things. These hits are the first page of search results. There’s no shortage of headline writers stigmatizing the breach. • DISTURBING, BLAME, MORE HAXX LIKE YOU DO We can do better, we can solicit news outlets that take the time to write considered stories about data breach events. They exist ( for this event even ), but they are lower in the search rankings.
So many BIDEN: that’s what I’m sayin’! #HUGOPS Removing the stigma of pwn3r5h1p HOW PERVASIVE IS DATA BREACH? Just an unlucky few? NO! Here are some of the firms listed on haveibeenpwned.com for breach events during this calendar year. This is not a wall of shame for 2016. This is a recognition that no one is immune. Vigilante.pw ( another breach site ), has _30_ entries for THIS MONTH ALONE representing some 688,000 humans who’ve had some combination of email address, real name, location, browsing habits, and passwords stolen. • BREACH IS NOT A DEVIANT CONDITION
all of us that voted. J-LD: … BIDEN: #HUGOPS to my pwned peeps @edyesed Removing the stigma of pwn3r5h1p WHO IS IMPACTED BY DATA BREACH? The impact is shared by the firm where it happens, and by the consumer that uses the service. Let’s talk about those numbers For the calendar year 2015 The Verizon DBIR confirms that at least 120 _million_ people had some combination of Personally Identifiable Information, Personal Health Information, or Personal Financial Information Stolen by way of provider data breaches ( and that’s just what was reported ). 120 million is a big number. 130 million people voted in the 2016 US election. That’s roughly equivalent every single voter having had their information stolen. Other notable losses in 2015 In Feb -> 80 million individual’s records were stolen Blue Cross health insurance member company Anthem June -> Office of Personnel Management initially 4mm, but grew to 11mm. OPM breach linked back to Anthem July -> Ashley Madison October -> Experion reports loss of personal information of 15mm TMobile Customers
wasn’t it? CLINTON: Joe is so crazy BIDEN: I can’t believe James from Accounting clicked on that link! #pwn3d! BIDEN: for real, tho, it was a very convincing phish. OBAMA: Ladies and Gentlemen, your VP of Phishing @edyesed Removing the stigma of pwn3r5h1p Why is it this way? Computer Security in networked systems is a VERY COMPLEX consideration. If fact it’s so complex that we don’t have very high quality information about its fiscal impact on companies or individuals, and we don’t have high quality information about the breadth of the problem. It’s complicated because there are so many vectors of attack, technical and personal • Phishingl • Point of Sale ramscraping, • keylogging, • DoS, • DDoS, • XSS, • ROP attacks where the code you intend to run is run in combinations that you don’t intend • lions and tigers and bears oh my It’s complicated because those different attack types can be used in combination. The Bad guys spearfish James from Accounting and drop a keylogger on his box, and now they have what James from Accounting has.
breach is. BIDEN: I’m saying we don’t know how big the breach is. BARACK: <big sigh> BIDEN: Barack, it happens to lots of firms. BARACK: #HUGOPS? BIDEN: #HUGOPS #BESTOPS @edyesed Removing the stigma of pwn3r5h1p ITS DIFFICULT BECAUSE WE DON’T ALWAYS IMMEDIATELY UNDERSTAND THE DEPTH OF BREACH Exfiltrated data can he held infinitely, and is frequently sold in aggregate. If we assume positive intent from LinkedIn ( and I’d like to do so ), maybe they didn’t know how big their breach was until the user information appeared on the marketplace. LinkedIn is a publicly traded company with a reputation for hiring capable people. I believe their infosec staff to be at least at par. Linkedin isn’t the only subject to this. Other notable delays in understanding the size of a breach • Last.FM had a 2012 breach that wasn’t understood until 2016, • lookbook had a 2012-2106 • DROPBOX was in the 2012-2016 club, • Brazzers went 2013-2016 THIS IS HAPPENING ALL OVER THE PLACE
talk to you. BOEHNER: And then I talk to Barack BIDEN: And the user only talks directly to me. Since there’s so much indirection nobody has to sanitize user input, and we can all trust each other implicitly. KASICH+BOEHNER+OBAMA: … BIDEN: THE MICROSERVICES-OCRATS! @edyesed Removing the stigma of pwn3r5h1p Do microservices make this better? Not really. Microservices moves the complexity around, and it can be difficult to think of systemicly. It’s complicated because in microservice architectures, the number of moving pieces is immense. Each component hopefully has a very discreet concern, but the effect of all of the pieces working together is what has to be understood in order to make a real risk assessment In the old days, we had a 4byte file permission that represented the entire-ity of somebody’s ability to get at data. The matrix of permissions has gotten very complex, and we must be mindful of that in our internal risk assessments. Specifically in microservices, while the domain of security considerations for any single component might be reduced, we need to think about how the system is working to gather data. As a service provider, you should be aware of your surface area for attack You should be thinking about the value of the data that you’re keeping about your users. And you have to defend accordingly. If you’re not dealing with Financial or HealthCare data, there may not be legal guidelines for you to use as a guidebook for best practices.
BIDEN: Seriously. I just gave ‘em a pair of wire nips and said “This is the best firewall your Administration can put in”. And then I walked away and didn’t look back. OBAMA: … And they believed you … BIDEN: BARACK, IT WAS TRUE! Around 80% of threats are external. You can’t hack what you can’t see. @edyesed Removing the stigma of pwn3r5h1p WHO IS THE THREAT? Everybody’s most feared bad guy is THE INSIDER THREAT, but there’s about an 80% chance that your threat is external. Linkedin Hack, outsider. The Dyn DDOS, outsider. The Krebs DDOS, outsider. The outsider threat largely runs like a business much like yours. For reported breach events, they were largely believed to be organized crime syndicates. They are fiscally motivated. Somewhere between LAN party, Gordon Gecko, and Tony Montana . This is a big business with significant volumes of money and data moving around. Let us not kid ourselves that when pwnage comes it comes from the aging stereotype of some unskilled script kiddie who downloaded a root kit 5m ago and doesn’t know what they’re doing. So, If you’re following the toyota LEAN method, focus your efforts on external first. However, the next leading cause of breach is internal at about 15%. The internal Threat is a real thing, and it’s more complex to defend against because it can mean limiting access to data that people have a legitimate need to access for their jobs.
security incident? BIDEN: I demonstrated our Emergency Bow Communication System. I wrote a little note, tied it to my arrow, and away she went. BARACK: Joe... BIDEN: I'm telling you, Barack, it's a good plan! @edyesed Removing the stigma of pwn3r5h1p HOW DO THEY DO IT? • 67% of breaches happen within days • 21% of breaches happen within minutes This is the work of a professional organization, acting quickly. Weakness is identified and exploited with haste. The corollary there is that we as service providers need to be able to identify and act in these same windows of time. I encourage you to think about this in your own organizations, and get a plan together for what you’ll do when you have a security incident. I’d also encourage you to drill and/or practice your incident response plan. don't be like prankster joe and communicate with your infosec and ops team via message-attached-to-an-arrow. Keep your feedback loops inside the window of exploit identification to exercise.
was really quite good. We setup the traps ahead of time, and the bad guys just walked right into them. For the next administration, they'll need to use Security APIs for real time incident identification and contextual response. I don't envy that. #hugops @edyesed Removing the stigma of pwn3r5h1p WHAT’S IN THE FUTURE: Historically speaking, security has been a concern of the network border. A few things are happening that make that less true moving forward. CI/CD paired with immutable infrastructure and the containerization of applications have devalued the rootkit. Having a reduced opportunity for long lived shells inside your network hasn’t stopped the bad guys, tho. There’s some very interesting work happening right now in regards to security APIs. Products that can do things inspect http requests, and add threat scores to them in near-real time. But, what happens next? You must take action, right? And that action will be context dependent. We can block, we can slow down responses, we can make additional contextually appropriate . Security assessment and response is moving in towards the applications that we run and out to the devices where they run.
patches done. OBAMA: We practiced our security drills? BIDEN: We practiced our security drills. OBAMA: We encrypted our data at rest? BIDEN: We encrypted our data at rest. BIDEN: UR BUYING ICE CREAM FOR EVERYBODY HAHAHAHAHAHA! OBAMA: #HUGOPS #BESTOPS @edyesed Removing the stigma of pwn3r5h1p WHAT CAN WE DO? As providers, we’re going to keep our defenses up. • Patch • Security Monitoring ◦ AND DRILLING ON THOSE MONITORS ◦ Security integration tests ◦ If you don’t have your own Red Team, pair up with a commercial one, like hackerone • Devalue our data at rest. ◦ Information security is a game of time. Making the bad guys work harder for your data makes it less appealing.
Joe, you don’t have to do it BIDEN: MISTER, YOU ARE GETTING #HUGOPS AND THAT’S FINAL! GET OVER HERE YOU BIG LUG. @edyesed Removing the stigma of pwn3r5h1p WHAT ELSE CAN WE DO. When we hear about breaches, we’re gonna dig deep for the INFOSEC HUGOPS Do it amongst your real life connections, do it amongst your social networks. Being an example is a great way to be a positive conduit for change.
COMPLEX ONLY YOU CAN PREVENT STIGMA #HUGOPS @edyesed Removing the stigma of pwn3r5h1p Is there still more I can do? Yes, take it outside the bubble! Socialize the state of infosec with your networks that are not in the biz I know we all need something that’s not politics to talk about at the family gatherings this holiday season. There’s been a lot of news around infosec lately with the DYN DDOS Talk about infosec, talk about how many folks had their data stolen, talk about how many providers got breached, Talk about how difficult defense is. Talk to them about ways that they can consider their own exposure and make personal risk assessments.
is hard. * INFOSEC is complex. * Anybody doing business on the internet as a consumer or as a provider is in the game. * We as the tech elite can help to normalize society's reaction to data breach events. * we as the tech elite can help to educate the internet on how to be safe consumers, or at least help folks understand the active decisions they’re making with their personal data. • HUGOPS NOT SHAMEOPS Big thanks to you, and big thanks to @VP and @POTUS
persolserverworks
riyaamemiya
ezaki
masakiokuda
hiracky16
takahashim
kenichiodo
teamlab
glaforge
usanchuu
kaminashi
matthewcrist
garrettdimon
elsirapls
aleyda
reverentgeek
axbom
iamctodd
cassininazir
mongodb
tenderlove
