Leveling Up Security @ Riot Games :: BruCon 2015

In his talk, Mark discusses his 2+ years at Riot Games. He explains:

- How the program was assessed
- What gaps were identified
- How the team has closed those gaps
- What the team has learned (including successes as well as failures)
- Where the Riot InfoSec team is headed

Warning: There will be no 0days in this talk :)

YouTube Link :: https://www.youtube.com/watch?v=7Y8iLXkyD7w

Transcript

1. Leveling Up Security @ Riot Games
2. AGENDA Final Boss? Game of Security Level Up Who
3. WHO AM I { “contact”: { “email”: “mhillick@riotgames.com”, “twitter”: “@markofu” }, “work”: {”Riot Games”: ”LoL” , ”cert” : {”GIAC GSE”: true}, ”life”: {”Everything”: ”busy”} }, “tags”: [ {”infosec”: 1}, {”challenge”: 1}, {”IR”: 1}, {”growth”: 1}, {”scale”: 1}, {”tons of damage”: 1}, {”fun”: 1}, {”DDoS”: 1} ], “learning”: [ {”Riot”: true} , {”Industry”: ”so much change”}, {”Sharing”: true} ] }
4. WHO AM I REALLY
5. 2,000+ RIOTERS IN 17 OFFICES
6. TEAMWORK
7. 67MILLION MONTHLY ACTIVE PLAYERS MORE THAN 27MILLION DAILY ACTIVE PLAYERS MORE THAN 7.5MILLION PEAK CONCURRENT PLAYERS
9. Aspire
11. AGENDA Final Boss? Game of Security Level Up Who
12. MOVE FAST - GOALS AGILITY SECURITY QUALITY
13. What brought us agility also brought us the Wild Wild West of Computing
14. VPC VPC VPC 1 # of VPNs AWS (1)
15. VPC VPC VPC 40 # of VPNs AWS (2)
16. !! # of VPNs VPC VPC VPC AWS (3)
22. AGENDA Final Boss? Level Up Who Game of Security
23. SUPPORT
24. Socialise Alignment Visibility RAISE THAT LEVEL
27. AWARENESS
28. SECURE CODE
29. SECURITY WEEK
30. RFCs
31. RED TEAM
32. SECURE OFFICE
33. OFFICE AS CODE { "offices": [ { "id" : "1", "code" : "LAX1", "aliases" : [ "LAX" , ”SoCal", "Santa Monica" ], "city" : "Los Angeles", "country" : "USA", "esports" : "false", "secure" : "true", "external_ip" : [ ”1.1.1.1/32", ”2.2.2.2/32" ] } ] }
34. VISIBILITY
35. VISIBILITY MATRIX Proprietary AWS Audit ; Sightstone ; Network Scanner
40. AGENDA Final Boss? Game of Security Level Up Who
41. FINAL BOSS
42. ALL THE THINGS
43. Hiring Standards & Verify Tools FUTURES
44. Outreach // Outreach // Outreach // Outreach FUTURES (2)
46. THUNDERDOME
47. -   RUNNING TO STAY STILL – DON’T
48. REACH OUT
49. Engage, Align & Support Learn & Iterate Remember Your Audience CONCLUSION
50. QUESTIONS