[BSidesLV] Magical thinking... v.2

Condensed (25-min) update of the TROOPERS keynote for the 2017 edition of Security BSides Las Vegas. Ground Truth track.
https://youtu.be/JB9nVJcfdR8

Transcript

1. ✨Magical thinking✨ … and how to thwart it. 1 Mara Tam Senior Fellow Center for Advanced Studies on Terrorism
2. 2 whois?
3. ✨Magical thinking✨ … and how to thwart it. 3 Mara Tam Senior Fellow Center for Advanced Studies on Terrorism
6. 6 ➢ fallacia non causae pro causa ◦ waking up ◦ where are we? ➢ bestiarum vocabulum ◦ magical thinking in the wild ➢ thwarting ◦ translation layers agenda?
7. 7 Prior art ✨Literature review✨
9. 9 __________ Honoré-Victorin Daumier, Don Quixote and Sancho Panza, ca. 1855, oil on oak, The National Gallery, London.
10. 10 ➢ policy hobbyists ◦ governance is a profession ➢ over-simplification (i.e. perpetual 101-ism) ◦ satisfying-but-facile helps nobody ➢ awareness raising ◦ we’re pretty flipping aware ➢ doomsaying ◦ see also : hand-wringing Curmudgeonly intro rant things I hate about ‘policy talks’
12. 12 ➢ policy hobbyists ◦ governance is a profession ➢ over-simplification (i.e. perpetual 101-ism) ◦ satisfying-but-facile helps nobody ➢ awareness raising ◦ we’re pretty flipping aware ➢ doomsaying ◦ see also : hand-wringing Curmudgeonly intro rant things I hate about ‘policy talks’
13. 13 ➢ ‘going dark’ ➢ crypto jihadis ➢ “intrusion software” ◦ that ‘standard execution path’ though bestiarum vocabulum magical thinking in the wild
14. 14 q : how dark is ‘dark’? a : It depends.
16. 16 q : crypto jihadis? a : Not really. “Every time there is an attack, we discover that the perpetrators were known to the authorities,” [...] “What this shows is that our intelligence is actually pretty good, but our ability to act on it is limited by the sheer numbers.” – François Heisbourg NYT, 17 Nov 2015
17. 17 q : crypto jihadis? a : Not really. (cont’d) “[W]hen it comes to internet communications we generally have to enlist the help of our American friends. Managing information sharing between an intelligence service of one country and a police service of another can be challenging on several fronts, including from a legal dimension [...].” – Alain Gringard Police Fédérale, Bruxelles
18. 18 ‘Complexity kills.’1 __________ 1 Enno.
20. 20 ➢ Operations and maintenance (O&M) ◦ ‘Steady state’ ➢ Development, modernisation, and enhancement (DME) ◦ Improves capability or performance ◦ Meets a regulatory or compliance requirement ◦ Includes capital expenditures (i.e. new stuff) O&M vs DME money doesn’t understand our problems
21. 21 __________ US Federal Government IT Funding. https://www.itdashboard.gov/drupal/summary/000
22. 22 __________ US Federal Government IT Funding, (FY) 2016. https://www.itdashboard.gov/drupal/summary/000 capex duct tape
26. 26 ❝ (4) The Department has approved the Wang One Way Interface (WOWI) for transmissions from unclassified Wang systems to post classified telecommunications processors. The purpose of the one way connection is to enable users of the unclassified system to send unclassified telegrams electronically from the desktop to the telecommunications processor while inhibiting any flow of classified data from the telecommunications processor down to the unclassified processor. The Department may approve other connections of this type in the future; ❞
29. 29 __________ richö + dominic, ‘Rusting up your GreatFET’, TROOPERS 2017.
30. 30 __________ Sergey [@k1k] Golovanov, ‘Hacking Team and Gamma International in “business-to-government’ malware”’, VB2013 : Berlin, https://www.virusbulletin.com/uploads/pdf/conference_slides/2013/Golovanov-VB2013.pdf. ➢ Exploit / 0day fetishism is not only impractical, it’s pretty useless. ➢ But! Don’t let that stop you if you’re in search of a windmill to joust.
32. 32 ➢ moar engineers will *not* solve this problem ➢ there is a new generalism for this field we have yet to articulate Translation layers they are missing and we need them
33. 33 ‘[...] every speaker, every writer, every practitioner in the field of cyber security who has wished that its topic, and us with it, were taken seriously has gotten their wish. [...] "we" and the cyber security issue have never been more at the forefront of policy. And you ain't seen nothing yet.’ __________ Dan Geer, ‘Cybersecurity as Realpolitik’, keynote address, BlackHat : Las Vegas, 6th August 2014. http://geer.tinho.net/ geer.blackhat.6viii14.txt
34. 34 Popular press citations, by section : ☢ 2/143 … 1.4% ☣ 3/125 … 2.4% 27/110 … 24.5% q : why is the cyber so hard? a : We set them up to fail.
36. 36 q : what do we do? a1 : Develop translation layers to communicate fluently between ‘technical’ and ‘mission’ space. a2 : Better the standard of documentation in technical and policy research. a3 : Accept the interlinkage of science and politics.
37. 37 questions? contact? ‣ @marasawr open dms ‣ marasawr [at] gmail ‣ linkedin.com/in/marasawr