I've been involved in a lot of incidents. Here are some of them!

2. War Stories - From The
Front Lines Of InfoSec!
@stuhirstinfosec

3. Disclaimers;
I like memes.
I don’t take myself too seriously.
Some of these stories may or
may not have happened….
@stuhirstinfosec

4. Who Am I?
@stuhirstinfosec
• Public Speaker
• Run Security Scotland
Meet Up
• Run the AWS Security
Slack Forum
• Regular LinkedIn ‘Brain
Farter’

5. @stuhirstinfosec
The most difficult part of
security incidents is that we
don’t know what we don’t
know!
(and we often rely on people telling us!)

6. @stuhirstinfosec
INCIDENT
NUMBER ONE

7. @stuhirstinfosec
For legal
reasons, I can’t
tell you….

8. @stuhirstinfosec

9. @stuhirstinfosec
Boogle BadWords -
Compromised Passwords
Impact: £30,000 of account
spend
Attack vector: hack
What Happened/What Did We
Do….

10. @stuhirstinfosec
Lessons Learned!
2FA all the things!
Use a password manager!
Don’t trust 3rd parties, even boogle!

11. @stuhirstinfosec
INCIDENT
NUMBER TWO

12. @stuhirstinfosec
Open AWS ElasticSearch
Cluster
Impact: outage
Attack vector: ransomware
What Happened/What Did
We Do….

13. @stuhirstinfosec

14. @stuhirstinfosec
Open AWS S3 Buckets are
one of the easiest hacks to
do….
… you just need to find them!

15. @stuhirstinfosec
Lessons Learned!
Don’t make anything in AWS publicly
accessible by default!
Alert on S3 open to the world!
Automate, automate, automate!

16. @stuhirstinfosec
INCIDENT
NUMBER THREE

17. @stuhirstinfosec
Phishing email with
macro in Word doc
Impact: minimal
Attack vector: Phishing
What Happened/What
Did We Do….

18. @stuhirstinfosec
Lessons Learned!
Don’t jump to conclusions!
Allow yourself time to make
decisions!
Educate, train and test!

19. @stuhirstinfosec
INCIDENT
NUMBER FOUR

20. @stuhirstinfosec
Two mySQL databases with
default creds
Impact: thousands in bug
bounty payment
Attack vector: hack
What Happened/What Did We
Do….

21. @stuhirstinfosec
Lessons Learned!
Be careful who you get to carry
out work for you!
Lock down your data, all of it!

22. @stuhirstinfosec
INCIDENT
NUMBER FIVE

23. @stuhirstinfosec
The Mystery Chinese
‘Bots’
Impact: hours of
investigation!
Attack vector: none?!
What Happened/What Did
We Do….

24. @stuhirstinfosec
Lessons Learned!
Understand when an incident has
reached a conclusion!
Focus on what you CAN protect, not
on what you CAN’T

25. @stuhirstinfosec
INCIDENT
NUMBER SIX

26. @stuhirstinfosec
The Public Wi-fi
Password!
Impact: unknown
Attack vector: hack
What Happened/What
Did We Do….

27. @stuhirstinfosec
Lessons Learned!
Check your office space before
events!
Employ a healthy dose of paranoia!

28. @stuhirstinfosec
INCIDENT
NUMBER SEVEN

29. @stuhirstinfosec
The Trump Balloon
Impact: Twitter
craziness!
Attack vector: unknown
What Happened/What
Did We Do….

30. @stuhirstinfosec
Lessons Learned!
Don’t trust what you read on Twitter!
Be careful with what you say on social
media!
Protect your personal accounts - you’re
easy to find!

31. @stuhirstinfosec
INCIDENT
NUMBER EIGHT

32. @stuhirstinfosec
Wannacry
Impact: A month of
pain!
Attack vector: malware
What Happened/What
Did We Do….

33. @stuhirstinfosec
Where were we when Wannacry first kicked
off?

34. @stuhirstinfosec
Where was I for the week after it kicked off?

35. @stuhirstinfosec
Lessons Learned!
Don’t take holidays!
Be prepared to change your view
on something, quickly!

36. @stuhirstinfosec
INCIDENT
NUMBER NINE

37. @stuhirstinfosec
The p*ssed-off leaver!
Impact: £20k a week!
Attack vector:
insider/rogue employee
What Happened/What
Did We Do….

38. @stuhirstinfosec
1.84 days to spot
2.£20k a week cost
3.Nearly 50 failures in
process

39. @stuhirstinfosec
Lessons Learned!
Not everyone leaves ‘happy’
If you’re a manager, ensure
accesses have been removed!

40. @stuhirstinfosec
SOME OF THE MORE
LIGHT HEARTED
INCIDENTS!!!

41. @stuhirstinfosec

42. @stuhirstinfosec
And to leave you with….
Toilet humour….

43. @stuhirstinfosec

44. @stuhirstinfosec
Lessons Learned!
Don’t take your laptop into the
toilet!
Stickers help!

45. @stuhirstinfosec
Thank you!
We’re recruiting!
Twitter; stuhirstinfosec