1.
It’s
the
people,
stupid.
@jschauma
Jan
Schaumann

2.
@jschauma
Velocity
NY
2016

3.
@jschauma
Velocity
NY
2016

4.
@jschauma
Velocity
NY
2016

5.
@jschauma
Velocity
NY
2016

6.
@jschauma
Velocity
NY
2016

7.
@jschauma
Velocity
NY
2016

8.
ServerUserless
Systems
@jschauma
Velocity
NY
2016

9.
Useless
Systems
@jschauma
Velocity
NY
2016

10.
@jschauma
Velocity
NY
2016

11.
Change
vs.
more
of
the
same.
The
people,
stupid.
Don’t
forget
malware.
@jschauma
Velocity
NY
2016

12.
Developers
@jschauma
• That
can’t
happen.
• That
doesn’t
happen
on
my
machine.
• That
shouldn’t
happen.
• Why
does
that
happen?
• Oh,
I
see.
• How
did
that
ever
work?

13.
Developers
SRE
@jschauma
• That
never
worked.
• Must
be
the
network.

14.
Developers
SysAdmins
@jschauma
• It’s
not
the
network.
• Probably
a
bug
in
the
OS.
• Oh,
ok.
DNS.
• Don’t
monkey
around
with
/etc/hosts.
SRE

15.
Developers
SysAdmins
BOFH
@jschauma
• An
African
or
European
swallow?
• You
don’t
know
what
you’re
doing.
SRE

16.
Developers
SysAdmins
BOFH
Infosec
@jschauma
• That’s
not
how
you
do
this.
• Nobody
knows
what
they’re
doing.
SRE

17.
Developers
SysAdmins
BOFH
Infosec
New
Yorkers
@jschauma
• What?
I
don’t
care,
keep
walking.
Don’t
talk
to
me.
• Seriously,
don’t
stop
in
the
middle
of
the
street.
I
will
cut
you.
SRE

18.
Developers
SysAdmins
BOFH
Infosec
New
Yorkers
New
York
Infosec
SysAdmin
@jschauma
SRE

19.
@jschauma
Velocity
NY
2016

20.
@jschauma
Velocity
NY
2016

21.
@jschauma
Velocity
NY
2016

22.
@jschauma
Velocity
NY
2016

23.
@jschauma

24.
@jschauma
Velocity
NY
2016

25.
@jschauma

26.
@jschauma
Velocity
NY
2016

27.
@jschauma
Velocity
NY
2016

28.
@jschauma

29.
@jschauma
Velocity
NY
2016

30.
@jschauma
Velocity
NY
2016

31.
@jschauma
Velocity
NY
2016
How
not
to
be
seen

32.
@jschauma
Changing
other
people’s
habits
is
a
wicked
problem.
Velocity
NY
2016

33.
@jschauma
Prod
Corp
Long-­‐lived
SSH
ConnecCons
Velocity
NY
2016

34.
@jschauma
Firewall
/
ACLs
/
idled(8)
…
Velocity
NY
2016

35.
@jschauma
Reverse
SSH
tunnel
Privkeys
on
prod
cron(8)
iniCated
callbacks
…
Velocity
NY
2016

36.
@jschauma
Velocity
NY
2016

37.
@jschauma
Velocity
NY
2016

38.
@jschauma
hLps://is.gd/80zCWX
Velocity
NY
2016

39.
@jschauma
Why
we
take
our
shoes
off
at
the
airport.
Velocity
NY
2016

40.
@jschauma
NSA-­‐proofing
TLS
cipher
spec
LiSle
Bobby
Tables
Secrets
on
GitHub
XSS
#Infosec:
Silicon
Valley’s
TSA
Velocity
NY
2016

41.
Security
is
not
a
value.
@jschauma
Velocity
NY
2016

42.
Nobody
cares
about
security.
@jschauma
Velocity
NY
2016

43.
Nobody
cares
about
security.
That
is
neither
incompetence
nor
malice,
it’s
pragmaSsm.
@jschauma
Velocity
NY
2016

44.
@jschauma
People
driven
defense
EffecCve
defense
“sophisCcated”
“military
grade
encrypCon”
“NSA-­‐proof”
“even
more
cyber”
“cyber”
Vendor
Crap
“Security
Appliances”

45.
@jschauma
Velocity
NY
2016

46.
@jschauma
Ceci n’est pas un hacker.
Velocity
NY
2016

47.
@jschauma
Velocity
NY
2016

48.
@jschauma
Velocity
NY
2016

49.
@jschauma
Velocity
NY
2016

50.
@jschauma
Velocity
NY
2016

51.
@jschauma
Velocity
NY
2016

52.
@jschauma
Velocity
NY
2016

53.
Safety,
not
(just)
security.
@jschauma
Velocity
NY
2016

54.
A
system
is
secure
if
it
protects
the
user
when
used
correctly.
A
system
is
safe
if
it
protects
the
user
even
when
used
incorrectly.
@jschauma
Velocity
NY
2016

55.
@jschauma
Velocity
NY
2016

56.
@jschauma
If
your
reacSon
is
“well,
not
like
that”,
you
have
a
poka-­‐yoke
problem.
Fix
that.
Velocity
NY
2016

57.
@jschauma
The
most
convenient
/
intuiSve
way
to
use
your
applicaSon
must
be
the
safest
way
to
use
your
applicaSon.
Velocity
NY
2016

58.
@jschauma
Users
will
not
change
default
sengs.
Velocity
NY
2016

59.
@jschauma
Users
will
not
change
default
sengs.
(Unless
a
less
secure
opSon
is
available.)
Velocity
NY
2016

60.
@jschauma
Failure
must
not
lead
the
user
to
change
their
default
sengs.
Velocity
NY
2016

61.
@jschauma
Failure
must
not
lead
the
user
to
change
their
default
sengs.
Safety
overrides
must
be
temporary.
Velocity
NY
2016

62.
@jschauma
Your
applicaSons,
services,
standards,
etc.,
must
age
gracefully.
Velocity
NY
2016

63.
Poka-­‐yoke
so^ware
&
systems
• safe
defaults
• safe
failure
mode
• automated,
regular,
unaLended
updates
• puts
usability
ahead
of
‘security’
• encourages
desired
behavior
• builds
/
strengthens
safe
habits
• follows
the
users’
desire
path
Velocity
NY
2016

64.
@jschauma
Velocity
NY
2016

65.
@jschauma
Velocity
NY
2016

66.
Change
vs.
more
of
the
same
• avoid
the
downward
spiral
of
cynicism
• your
users,
developers,
engineers,
…
are
not
stupid;
they’re
trying
to
get
their
job
done
• focus
on
realisSc
threats,
not
high-­‐profile
security
theater
• understand
that
your
aLackers
are
moSvated,
dedicated,
human
adversaries
The
people,
stupid.
• security
is
not
an
end-­‐goal
• build
safe
applicaSons
&
services
• understand
your
users’
desire
paths
• Poka-­‐yoke
Go!
@jschauma
Velocity
NY
2016

67.
“Fundamentally,
the
problem
isn’t
about
security.
It’s
about
people.”
@jschauma
-­‐
Bill
Clinton
(not
quite)
Thanks!

68.
Image
ALribuSons
• Monty
Python,
Paul
Townsend
hLps://flic.kr/p/nVFKH5
• Serverless,
PolarFlex
Rack
Blanking
hLp://polargy.com/air-­‐flow-­‐accessories/42u-­‐blanking-­‐
panels.php
• Downward
spiral,
Davo
Sime
hLps://thenounproject.com/term/downward-­‐spiral/
589704/
hLps://creaSvecommons.org/licenses/by/3.0/us/
• Mouse,
MarSn
Driver,
hLp://wallpapersafari.com/w/UzqRxW
• Silly
Walk
Street
Sign,
Kayla
Reed,
hLp://www.avclub.com/arScle/crosswalk-­‐norway-­‐makes-­‐
ciSzens-­‐do-­‐monty-­‐python-­‐si-­‐203164
@jschauma