[BSidesPDX] Friday keynote aka Magical thinking... v.3

Friday / first-day keynote for the 2017 edition of Security BSides in Portland, WA. Who remembers WANG?

Transcript

1. ✨Magical thinking✨ … and how to thwart it. 1 Mara Tam BSidesPDX 20th October 2017
2. 2 whois?
5. 5 ➢ curmudgeonly intro rant ◦ things I hate about ‘policy talks’ ◦ literature review ➢ fallacia non causae ut causae ◦ why CAN’T we have nice things? ➢ bestiarum vocabulum ◦ magical thinking in the wild ➢ adventures in thwarting ◦ translation layers agenda?
6. 6 Prior art ✨Literature review✨
9. 9 ❝ Ideas have value in proportion to how much they are shared. Your ideas are worthless until you share them with the world. ❞ – Michael Ossmann, BSidesPDX 2015.
12. 12 ❝ All offensive problems are technical problems, and all defensive problems are political problems. ❞ – Thomas Dullien [halvar flake], BlackHat Asia 2017.
13. 13 ➢ policy hobbyists ◦ governance is a profession ➢ over-simplification (i.e. perpetual 101-ism) ◦ satisfying-but-facile; helps nobody ➢ awareness raising ◦ we’re pretty h*ckin’ aware ➢ doomsaying ◦ see also : hand-wringing curmudgeonly intro rant things I hate about ‘policy talks’
16. 16 ➢ policy hobbyists ◦ governance is a profession ➢ over-simplification (i.e. perpetual 101-ism) ◦ satisfying-but-facile; helps nobody ➢ awareness raising ◦ we’re pretty h*ckin’ aware ➢ doomsaying ◦ see also : hand-wringing curmudgeonly intro rant things I hate about ‘policy talks’
17. 17 bestiarum vocabulum magical thinking in the wild
19. 19 q : how dark is ‘dark’? a : it depends
21. 21 q : crypto jihadis? a : not really “Every time there is an attack, we discover that the perpetrators were known to the authorities,” [...] “What this shows is that our intelligence is actually pretty good, but our ability to act on it is limited by the sheer numbers.” – François Heisbourg NYT, 17 Nov 2015
22. 22 q : crypto jihadis? a : not really (cont’d) “[W]hen it comes to internet communications we generally have to enlist the help of our American friends. Managing information sharing between an intelligence service of one country and a police service of another can be challenging on several fronts, including from a legal dimension [...].” – Alain Gringard Police Fédérale, Bruxelles
23. 23 ‘Complexity kills.’1 __________ 1 Enno.
25. 25 ➢ Operations and maintenance (O&M) ◦ ‘Steady state’ ➢ Development, modernisation, and enhancement (DME) ◦ Improves capability or performance ◦ Meets a regulatory or compliance requirement ◦ Includes capital expenditures (i.e. new stuff) O&M vs DME money doesn’t understand our problems
26. 26 __________ US Federal Government IT Funding. https://www.itdashboard.gov/drupal/summary/000
27. 27 __________ US Federal Government IT Funding, (FY) 2016. https://www.itdashboard.gov/drupal/summary/000 capex duct tape
36. 36 Almost 75% of the telephone systems serving our overseas posts are outdated -- so outdated that when we needed repairs in our vital 24-hour operations center, the AT&T repairman had to consult with Bell Labs on how to service the antiquated equipment. Almost 80% of our automated data processing equipment is obsolete -- so old that we can't get maintenance contracts or locate spare parts. That is why our FY 1996 request supports a modest $32.8 million Capital Investment Fund. This will be used to upgrade information systems, replace overseas telephone systems, and purchase a classified mainframe computer. It will improve our efficiency and productivity, reduce our maintenance costs on antiquated equipment, and help us continue to do more with less. * * * – Secretary of State Warren Christopher, Testimony to Senate Appropriations Committee, 1995.
38. 38 ❝ (4) The Department [of State] has approved the Wang One Way Interface (WOWI) for transmissions from unclassified Wang systems to post classified telecommunications processors. The purpose of the one way connection is to enable users of the unclassified system to send unclassified telegrams electronically from the desktop to the telecommunications processor while inhibiting any flow of classified data from the telecommunications processor down to the unclassified processor. The Department may approve other connections of this type in the future; ❞
41. 41 __________ richö + dominic, ‘Rusting up your GreatFET’, TROOPERS 2017.
42. 42 __________ Sergey [@k1k] Golovanov, ‘Hacking Team and Gamma International in “business-to-government’ malware”’, VB2013 : Berlin, https://www.virusbulletin.com/uploads/pdf/conference_slides/2013/Golovanov-VB2013.pdf. ➢ Exploit / 0day fetishism is not only impractical, it’s pretty useless. ➢ But! Don’t let that stop you if you’re in search of a windmill to joust.
44. 44 ➢ moar engineers will *not* solve this problem ➢ there is a new generalism for this field we have yet to articulate translation layers they are missing and we need them
45. 45 ‘[...] every speaker, every writer, every practitioner in the field of cyber security who has wished that its topic, and us with it, were taken seriously has gotten their wish. [...] "we" and the cyber security issue have never been more at the forefront of policy. And you ain't seen nothing yet.’ __________ Dan Geer, ‘Cybersecurity as Realpolitik’, keynote address, BlackHat : Las Vegas, 6th August 2014. http://geer.tinho.net/ geer.blackhat.6viii14.txt
46. 46 Popular press citations, by section : ☢ 2/143 … 1.4% ☣ 3/125 … 2.4% $ 27/110 … 24.5% q : why is the cyber so hard? a : we set them up to fail
47. 47 Popular press citations, by section : ☢ 2/143 … 1.4% ☣ 3/125 … 2.4% $ 27/110 … 24.5% q : why is the cyber so hard? a : we set them up to fail %
51. 51 personal contact > slacktivism
52. 52 a1 : develop translation layers to communicate fluently between ‘technical’ and ‘mission’ space. a2 : better the standard of documentation in technical and policy research. Seriously, we have to do better. a3 : accept the interlinkage of science and politics, engage more impactfully with the latter. q : what do we do?
53. 53 ➢ Find / phone your representative https:// www.house.gov/ representatives/find- your-representative ➢ Find / phone your senators https:// www.senate.gov/general/ contact_information/ senators_cfm.cfm
54. 54 questions? contact? MARA[at]QXN[dot]CH @marasawr
55. 55 further resources ➢ Emily Ellsworth is a font of knowledge on how to engage with Congress https://medium.com/ @emilyellsworth/what-the-latest-research-says- about-contacting-congress-843f0ad052b2 ➢ For a deeper dive, read the Congressional Management Foundation’s report on ‘Citizen-Centric Advocacy.’ http://www.congressfoundation.org/ projects/communicating-with-congress/citizen- centric-advocacy-2017
56. 56 further resources ➢ Department of Commerce technical advisory committee notices (recommend subscribing to email alerts if not a regular reader of the Federal Register). https://www.federalregister.gov/documents/search? conditions%5Bagencies%5D=industry-and-security- bureau&conditions%5Bpublication_date%5D%5Bgte%5D=01 %2F29%2F2017&conditions%5Bterm%5D=%22advisory+commi ttee%22&conditions%5Btype%5D=NOTICE&order=newest