Everything is Awful (And You&#x27;re Not Helping)

Slides from my talk at BSidesSF 2016. Transcript available at https://www.netmeister.org/blog/everything-is-awful.html

Everything
is
Awful.

@jschauma
BSidesSF
2016

@jschauma
BSidesSF
2016

https://v.gd/thingOfTheDay

@jschauma
BSidesSF
2016

#Infosec
“research”

(aka
browsing
Shodan)

And
YouWe’re
Not
Helping.

@jschauma
BSidesSF
2016

@jschauma
BSidesSF
2016

One
of
these
two
people
probably
has
some

really
interes;ng
OpSec
stories
to
tell…

…
the
other
one
keynotes
RSAC.

Being
really
good
at
one
thing

does
not
make
you
an
expert

in
all
things.

@jschauma
BSidesSF
2016

💡

@jschauma
BSidesSF
2016

#Infosec
!=
Real
World

@jschauma
BSidesSF
2016

where
Hanlon’s
Razor
is
dull.

Welcome
to
#Infosec,

@jschauma
BSidesSF
2016

Why
Glenn
can’t
encrypt.

@jschauma
BSidesSF
2016

https://v.gd/hackersStealHospital

@jschauma
BSidesSF
2016

https://v.gd/ccSignatureFun

@jschauma
BSidesSF
2016

https://v.gd/securusDataBreach

@jschauma
BSidesSF
2016

https://libraryfreedomproject.org/

Don’t
fuck
with
librarians.

@jschauma
BSidesSF
2016

💡

https://v.gd/FreedomToRead
https://en.wikipedia.org/wiki/Doe_v._Gonzales

Everything
is
Awful.

And
We’re
Not
Helping.

@jschauma
BSidesSF
2016

@jschauma
BSidesSF
2016

The
“S”
in
RSA…

…does
not
stand
for

Sean
Penn.

💡

@jschauma
BSidesSF
2016

Absolutely
secure

systems
do
not
exist.

@jschauma
BSidesSF
2016

Absolutely
secure

systems
do
not
exist.

To
halve
your

vulnerability,
you
have

to
double
your

expenditure.

@jschauma
BSidesSF
2016

Absolutely
secure

systems
do
not
exist.

To
halve
your

vulnerability,
you
have

to
double
your

expenditure.

Cryptography
is

typically
bypassed,
not

penetrated.

💡

@jschauma
BSidesSF
2016

Absolutely
secure
systems
do
not
exist.

Keep
calm,
that’s
ﬁne.

Raising
the
cost
of
an
aaack

is
oben
suﬃcient.

Know
your
Threat
Model.

@jschauma
BSidesSF
2016

https://v.gd/noSilverBullet

@jschauma
BSidesSF
2016

HTTPS

Essen;al
Complexity:

•  exposes
port
443

•  uses
TLS

•  speaks
HTTP

Accidental
Complexity:

•  weak
Ciphers
enabled

•  30
diﬀerent
versions
of
at
least
5
diﬀerent

TLS
libraries
deployed

•  apache,
nodejs,
nginx,
Tomcat
,
…

💡

Reducing
complexity

reduces
aaack
surface.

@jschauma
BSidesSF
2016

@jschauma
BSidesSF
2016

Data
is
your
friend.

@jschauma
BSidesSF
2016

Cumula;ve
payout

by
vuln.

@jschauma
BSidesSF
2016

Why
not

“APT
breaking
our
cryptos”?

💡

Cryptography
is
typically

bypassed,
not
penetrated.

@jschauma
BSidesSF
2016

@jschauma
BSidesSF
2016

US
gov
risk
management

@jschauma
BSidesSF
2016

US
gov
risk
management

#infosec
focus

“APT”

breaking
our

cryptos
SQLi

Keys
on

GitHub

XSS

"If
you
think
your
problems
can

be
solved
by
cryptography,

you're
probably
wrong.”

-‐-‐
Robert
Morris

@jschauma
BSidesSF
2016

Everything
is
Awful.

(Keep
calm,
that’s
ﬁne.)

@jschauma
BSidesSF
2016

💡

@jschauma
BSidesSF
2016

Is
the
internet
on
ﬁre?

@jschauma
BSidesSF
2016

The
internet
is
always

going
to
be
on
ﬁre.

Don’t
waste
your
;me
on
busy

work.

Measure
your
impact.

Priori;ze.

@jschauma
BSidesSF
2016

Don’t
waste
your
;me
on
busy

work.

Measure
your
impact.

Understand
your
threat
model.

Priori;ze.

@jschauma
BSidesSF
2016

Don’t
waste
your
;me
on
busy

work.

Measure
your
impact.

Have
a
threat
model.

Priori;ze.

@jschauma
BSidesSF
2016

Measure
your
impact.

Priori;ze.

Help
others
take
responsibility.

Guide
them.

@jschauma
BSidesSF
2016

💡

Everybody
else's
job
is
more

complicated
than
you
think.

@jschauma
BSidesSF
2016

Measure
your
impact.

Priori;ze.

Be
helpful.

Teach.

Listen.

@jschauma
BSidesSF
2016

Measure
your
impact.

Priori;ze.

Be
helpful.

Teach.

Listen.

…and
stop
with
the
fucking
Sun
Tzu
quotes.

@jschauma
BSidesSF
2016

Content Security Policies are another tool we should have in our security toolbelt to help protect users of our sites. In this session I’ll cover what they are, why they’re needed, how they work and the limitations on what they can & cannot do to protect users. I’ll demo attacks a CSP will block, break things, show what the different CSP directives & options will do and introduce some of the tools available to help with implementing a CSP on your sites!

Cloud Native Security: Rotate, Repair, Repave

VMware Tanzu

SpringOne Platform 2016 Speaker: Justin Smith; Director, Pivotal Enterprise software security traditionally resists change as a matter of unquestioned policy. Vulnerability is a function that changes with time. The probability of being exploited increases with the accumulation of long lived credentials and unpatched code. The question that must be asked is: how can a security strategy which resists change keep up with the pace of the modern threat landscape? This asymmetry in speed and adaptiveness only creates advantages for the attacker. What if the only what to increase security is to move as fast as possible? Continuously rotating credentials, patching systems, and rebuilding clusters to minimize windows of vulnerability decreases the threat profile in time and severity. This presentation will outline principles and practices of Cloud Native Security and how Cloud Foundry can be part of your strategy to increase velocity and security.

Bank heists make great stories. This year, we’ve got some really good stories to tell courtesy of a trusted network known as SWIFT, and some banks that believed they were inherently protected by virtue of being connected – except they weren’t. Hundreds of millions of dollars have revealed some ugly truths and dangerous assumptions. In this security fairy tale we’ll talk about scary godmothers, big bad wolves, fire breathing dragons and what’s inherently wrong with the banking system. Because the emperors have no clothes on.

Quality of Life, Multiple Lines of Defense

Michal Špaček

Presumptive Design: "It's not research! We're getting stuff done!"

Agencies and client UX professionals alike point out a growing trend: companies are becoming allergic to research. Budgets are shrinking and making the case to leaders grows more difficult each month. Working in small groups, professionals from across the UX spectrum (research, design and communications) will learn Presumptive Design (PrD), a technique for capturing the unmet, and often unspoken, needs of our stakeholders. PrD *is* a research method, but because it begins with designing an artifact, stakeholders are far more receptive to it as a process. Further, the method is fast, reducing time *and cost* to insights. Attendees will learn the theoretical frameworks behind PrD as well as gain hands-on experience practicing the method. By the end of the course, attendees will have completed one full cycle of a PrD engagement, including feedback from external users.

CONFidence 2018: XSS is dead. We just don't get it (Mario Heiderich)

PROIDEA

XSS is about twenty years old by now and appears to be alive and kicking. JavaScript alerts are still popping left and right and bug bounty programs are drowning in submissions. But is XSS really still a problem of our time? Or is it just an undead foul-smelling zombie vulnerability from the dark ages of string concatenation that doesn't wanna perish because we are just too f**** stubborn? This talk will be an hour-long rant (yes, swearwords, leave your kids at home), paired with a stroll through the history of XSS and related issues. We will go back into the year 1998 and see how it all started, how things developed, what we tried to do against it and how hard we failed every single time. We will also look at the future and predict what is about to happen next. Mostly nothing - but good to know, right? We will not only look at our own failures but also see how the entire infrastructure and monetization of the web contributed to us being simply not capable or even just willing to fix XSS. And we might as well see if any of those behavioral and structural patterns can be compared to other human failures - and see if there is something we all can learn. Or, at least, agree that we knew it all along and are all on the same page.

Progressive web and the problem of JavaScript

Owasp austinNeil Matatall

SAAS IS THE ENEMY OF OPEN SOURCE GOOD THING THAT WE ARE IN THE POST-SAAS ERA

Ori Pekelman

Dealing with doxxing

Emma Carew Grovum

20 famous quotes that should help you to think about cyber attacks!

Charles Steve

Pentest trends 2017

Jorge González

Mike McQuaid — How to Not Fail at Using Open-Source Software in Your Organisa...

Turing Fest

JavaScript isn't evil.

Using UX skills to craft your career

North Texas Chapter of the ISSA

This presentation will approach the unique challenges that UX professionals face when crafting their career path and finding roles that are both appropriate fits for their existing skillsets and offer opportunities to grow. It will help the attendees understand UX career options and help them craft their work samples and personal interactions to maximize their chances for success, whatever that looks like to them. Participants will learn to use the core concepts they utilize for their project work to how they present themselves and their work. I’ll cover: The varying career paths within UX and definitions of success Information on what employers are looking for in UX professionals Ways to utilize existing UX skills to illustrate strengths and articulate value within a work environment or to potential employers Tips to improve work samples to demonstrate expertise Methods to present and brands oneself

There is no security (and it feels just fine)

Jonathan Care

NTXISSACSC4 - A Day in the Life of a CISO

A Day in the Life of a CISO The intent of this presentation is to present the diverse nature of being a CISO today within the context of a public, regulated and targeted organization. The content is to both inspire and warn those whose career choices may include the CISO destination. Mark Nagiel SVP/CISO, PrimeLending (4th. largest mortgage company in the US) Director, Information Security (MetroPCS/T-Mobile) VP, Technology/VP Information Security (InCharge Institute - Financial Services) Co-Founder, Network Audit Systems, Inc. (Acquired by Armor Holdings (NYSE company) InfoSec Chief (Niagara Mohawk Power Corp.)

ExpoQA 2018 - Why software security has gotten worse? And what can we do abou...

Santhosh Tuppad

As technology evolved, software security faced huge challenges and as the years passed, the world has seen drastic changes far too quickly. And along with these advancements, even black-hat hackers or malicious hackers have evolved also very well. Today, the internet is the place for everyone where hackers dwell almost all the time. Every day new applications are released to the web and users start using them and even get addicted to them due to outstanding UX. But, wait! Did someone think about the "security" layer of these applications? Well, we often don’t and most of the applications today suffer from "beggarly / bad security". In this talk, Santhosh Tuppad will focus on the pitfalls of bad security and why software security has failed in a pretty way. He will also shed light on how your users may be facing bigger problems than you can imagine due to bad software that lacks security testing. He will also demonstrate some of the lethal problems that exist in the industry and will talk about technical impact, business impacts like reputation damage, revenue loss and a lot more. Not only that, Santhosh won’t end his talk without some hacking demonstrations that will for sure wow you. Finally, he will tell you how you can start security testing from day 1 and start contributing in terms of building secure software. From this talk, you will gain an understanding about the problems that a lack of security testing presents and you find out about tool-assisted security testing; performing security tests through questioning. After the talk, you will be able to start identifying risks and report comm.on vulnerabilities giving you a feeling of “I can do this”

The Razors Edge - Cutting your TLS Baggage

Defense at Scale

Protecting Data in Untrusted Locations

Headless Host Scanning

Similar to Everything is Awful (And You're Not Helping)

PuppetConf 2016: How You Actually Get Hacked – Ben Hughes, Etsy

Puppet

DevSecOps - a 2 year journey of success & failure!

Stu Hirst

How to Rob a Bank: The SWIFT and Easy Way to Grow Your Online Savings

Cheryl Biswas

Quality of Life, Multiple Lines of Defense

Michal Špaček

Presumptive Design: "It's not research! We're getting stuff done!"

CONFidence 2018: XSS is dead. We just don't get it (Mario Heiderich)

PROIDEA

Progressive web and the problem of JavaScript

Owasp austinNeil Matatall

SAAS IS THE ENEMY OF OPEN SOURCE GOOD THING THAT WE ARE IN THE POST-SAAS ERA

Ori Pekelman

Dealing with doxxing

Emma Carew Grovum

20 famous quotes that should help you to think about cyber attacks!

Charles Steve

Pentest trends 2017

Jorge González

Mike McQuaid — How to Not Fail at Using Open-Source Software in Your Organisa...

Turing Fest

JavaScript isn't evil.

Using UX skills to craft your career