SlideShare a Scribd company logo
TurtleSec
Turtle
Sec
@pati_gallardo
TurtleSec
Good
Morning!
TurtleSec
Welcome to
Bugs As A Service
TurtleSec
Our Problem
We’re not too sure about it yet...
Is it serious?
Do we have to fix it now?
Is it easy to fix?
How long will it take?
Let me introduce...
TurtleSec
TurtleSec
Imagine if we could place
it in some sort of system
TurtleSec
Maybe how to solve the
problem says something
about the problem
Crisis
Management
Experimentation
Debugging
Automation
Routine
Engineering
Good practice
TurtleSec
TurtleSec
Chaos
Clear
Complicated
Complex
Cynefin framework
by
Dave Snowden
TurtleSec
The people who work there
Ellis
Designer
Parker
Incident R.
Alec
Dev
Bailey
SRE
TurtleSec
The people that don’t really know where they belong
Finley
Tech Lead
Oakley
Sr Dev
Kian
QA
TurtleSec
Our Team
So, let's take a look at...
Parker
Incident R.
Kian
QA
Bailey
SRE
Oakley
Sr Dev
Alec
Dev
Finley
Tech Lead
Ellis
Designer
TurtleSec
BAAS, Bugs As
A Service
Finley
Tech Lead
Oakley
Senior Dev
Alec
Dev
Parker
Incident Resp.
Kian
QA
Bailey
SRE
Ellis
Designer
TurtleSec
Oh, yeah, sorry…
I almost forgot...
Jeff
Sales Guy
TurtleSec
And ehh...
Brad
The Customer
TurtleSec
It’s Saturday,
and today
they will all have
A Really Bad Day
- I can’t work like this
KDE Akademy 2021 Turtle
Sec
Patricia Aas - Trainer & Consultant
C++ Programmer, Application Security
Currently : TurtleSec
Previously : Vivaldi, Cisco, Knowit, Opera Software
Master in Computer Science
Pronouns: she/her
@pati_gallardo
Turtle
Sec
TurtleSec
So back to our
Heroes
TurtleSec
There was an alert in production
Kian started looking at the logs
They look weird
Kian pings the team on slack
Kian
QA
TurtleSec
We might
have a
problem
TurtleSec
Oakley was home on the couch
She takes a look at the logs
Yeah, they do look odd
She logs into the server
Has a look at what is running
Things look off
She pings Bailey
Oakley
Senior Dev
TurtleSec
Bailey was busy building IKEA shelves,
but has notification sound on on her
phone just in case
She catches up and says:
“Nothing has happened. It’s Saturday.
Everything was fine yesterday.”
Bailey
Site Reliability Eng.
TurtleSec
But something is off
Performance is down
Massive amounts of data is
being pulled off the server
TurtleSec
Ok, we have a problem
And it is unfolding as we speak
TurtleSec
TurtleSec
Chaos
But we still don’t know
anything
TurtleSec
Parker pops in,
takes one look
and tells Bailey to take the site and the
server offline immediately.
She hops on a slack thread with Kian and
Bailey.
Something is Seriously Wrong.
Parker
Incident Responder
TurtleSec
Parker
Incident Responder
Kian
QA
Bailey
SRE
TurtleSec
TurtleSec
Server is offline
We’re not bleeding data anymore
But we still don’t know anything
Complex
TurtleSec
Chaos
Our Heroes
moved our problem out of Chaotic domain
and into the Complex domain.
TurtleSec
Ellis & Finley show
up on Slack because
of another matter.
There were some
strange tweets.
Cryptic Tweets
Ellis
Designer
Finley
Tech Lead
TurtleSec
TurtleSec
Finley joins Oakley
in trying to debug
the system on an
Zoom call.
They ping Alec to
join them.
Finley
Tech Lead
Oakley
Senior Dev
TurtleSec
Alec
Dev
Alec was gaming,
but sees the ping
and begrudgingly takes the Zoom call.
- Come on! It’s Saturday!
TurtleSec
Finley
Tech Lead
Oakley
Senior Dev
Alec
Dev
Zoom:
Mob
Debugging
TurtleSec
Ellis is deep in the Twittersphere trying to
figure out what is going on…
Ellis
Designer
TurtleSec
Brad
Customer
Jeff
Sales Guy
What is
going on???
The server is
offline????
I’m sure it’s nothing!
Let me check with
the team!!!
TurtleSec
Finley
Tech Lead
Oakley
Senior Dev
Alec
Dev
Jeff
Sales Guy
What is going on???
I’ve got the client on
the phone he says the
server is offline????
I need info ASAP!!
TurtleSec
Alec
Dev
Listen!
We’re trying to
work here!
TurtleSec
Jeff
Sales Guy
I have a paying
customer on the
line!!!
I need answers
NOW!!!!
TurtleSec
Alec
Dev
I can’t work
like this!
TurtleSec
Finley has to break off
the debugging session
to manage Jeff and the
Customer.
Finley
Tech Lead
Jeff
Sales Guy
!!!
TurtleSec
Ellis has been digging and the tweets
seem to have been fake.
They author doesn’t have any data,
it was just accidental that it came at the
same time as the alert.
Ellis
Designer
TurtleSec
Kian
QA
Meanwhile Kian has also made some
discoveries…
“Someone” had committed the server
credentials to the open GitHub repo.
Luckily only non-sensitive public data
was on that server.
The data being pulled was just public
stuff that was on their website anyway.
TurtleSec
Kian
QA
Ellis
Designer
TurtleSec
TurtleSec
Complicated
The data that was leaked was not sensitive
But the intruder had access to the server
Complex
TurtleSec
Our Heroes
Complex
Complicated
TurtleSec
Finley
Tech Lead
Oakley
Senior Dev
Alec
Dev
Zoom:
Discussion
on Fix Plan:
- Remove the creds from git
history
- A new server instance with new
creds should be started
TurtleSec
Finley
Tech Lead
Oakley
Senior Dev
Alec
Dev
TurtleSec
Complicated
Our Heroes
Clear
TurtleSec
Kian
QA
Bailey
SRE
Oakley
Senior Dev
Oakley and Bailey get up a new server instance,
point all traffic towards it
and bring both the site and the server online again.
Kian does initial testing of the live website.
Bugs As A Service is back!
TurtleSec
Clear
We had managed to move the problem
All the way to the clear domain
And there we managed to fix it
Complicated
Complex
Chaos
TurtleSec
Clear
Our Heroes
TurtleSec
Our problems start off
as unknowns…
Then they move
Crisis
Management
Experimentation
Debugging
Engineering
Good practice
Chaos
Clear
Complicated
Complex
Automation
Routine
TurtleSec
Complex Complicated
Clear
Chaotic
Solving Problems
Cynefin
Framework
by
Dave Snowden
TurtleSec
So, Finley, what’s the
lesson here?
Don’t push creds to
GitHub?
Lol, no I mean really!
What should we
learn from this?
That folks are
different is a feature
not a bug?
Finley
Tech Lead
Alec
Dev
Then they think
differently?
TurtleSec
TurtleSec
Chaos
Clear
Complicated
Complex
Cynefin framework
by
Dave Snowden
TurtleSec
Never underestimate QA,
they know where all the
bodies are buried!
Kian
QA
The REAL
lesson is...
TurtleSec
BAAS, Bugs As
A Service
Finley
Tech Lead
Oakley
Senior Dev
Alec
Dev
Parker
Incident Resp.
Kian
QA
Bailey
SRE
Ellis
Designer
TurtleSec
The End
TurtleSec
TurtleSec
Turtle
Sec
@pati_gallardo

More Related Content

Similar to I can't work like this (KDE Academy Keynote 2021)

Similar to I can't work like this (KDE Academy Keynote 2021) (7)

Learn you some Ansible for great good!
Learn you some Ansible for great good!Learn you some Ansible for great good!
Learn you some Ansible for great good!
 
A Tale of Two Workflows - ChefConf 2014
A Tale of Two Workflows - ChefConf 2014A Tale of Two Workflows - ChefConf 2014
A Tale of Two Workflows - ChefConf 2014
 
Scaling Up Lookout
Scaling Up LookoutScaling Up Lookout
Scaling Up Lookout
 
SRECon 18 Immutable Infrastructure
SRECon 18 Immutable InfrastructureSRECon 18 Immutable Infrastructure
SRECon 18 Immutable Infrastructure
 
#SREcon Immutable Infrastructure: rethinking configuration mgmt
#SREcon Immutable Infrastructure: rethinking configuration mgmt#SREcon Immutable Infrastructure: rethinking configuration mgmt
#SREcon Immutable Infrastructure: rethinking configuration mgmt
 
Secrets management in the cloud
Secrets management in the cloudSecrets management in the cloud
Secrets management in the cloud
 
Your Goat Antifragiled My Snowflake!: Demystifying DevOps Jargon - ChefConf 2015
Your Goat Antifragiled My Snowflake!: Demystifying DevOps Jargon - ChefConf 2015Your Goat Antifragiled My Snowflake!: Demystifying DevOps Jargon - ChefConf 2015
Your Goat Antifragiled My Snowflake!: Demystifying DevOps Jargon - ChefConf 2015
 

More from Patricia Aas

More from Patricia Aas (20)

NDC TechTown 2023_ Return Oriented Programming an introduction.pdf
NDC TechTown 2023_ Return Oriented Programming an introduction.pdfNDC TechTown 2023_ Return Oriented Programming an introduction.pdf
NDC TechTown 2023_ Return Oriented Programming an introduction.pdf
 
Telling a story
Telling a storyTelling a story
Telling a story
 
Return Oriented Programming, an introduction
Return Oriented Programming, an introductionReturn Oriented Programming, an introduction
Return Oriented Programming, an introduction
 
Dependency Management in C++ (NDC TechTown 2021)
Dependency Management in C++ (NDC TechTown 2021)Dependency Management in C++ (NDC TechTown 2021)
Dependency Management in C++ (NDC TechTown 2021)
 
Introduction to Memory Exploitation (Meeting C++ 2021)
Introduction to Memory Exploitation (Meeting C++ 2021)Introduction to Memory Exploitation (Meeting C++ 2021)
Introduction to Memory Exploitation (Meeting C++ 2021)
 
Classic Vulnerabilities (MUCplusplus2022).pdf
Classic Vulnerabilities (MUCplusplus2022).pdfClassic Vulnerabilities (MUCplusplus2022).pdf
Classic Vulnerabilities (MUCplusplus2022).pdf
 
Classic Vulnerabilities (ACCU Keynote 2022)
Classic Vulnerabilities (ACCU Keynote 2022)Classic Vulnerabilities (ACCU Keynote 2022)
Classic Vulnerabilities (ACCU Keynote 2022)
 
Introduction to Memory Exploitation (CppEurope 2021)
Introduction to Memory Exploitation (CppEurope 2021)Introduction to Memory Exploitation (CppEurope 2021)
Introduction to Memory Exploitation (CppEurope 2021)
 
Thoughts On Learning A New Programming Language
Thoughts On Learning A New Programming LanguageThoughts On Learning A New Programming Language
Thoughts On Learning A New Programming Language
 
Trying to build an Open Source browser in 2020
Trying to build an Open Source browser in 2020Trying to build an Open Source browser in 2020
Trying to build an Open Source browser in 2020
 
Trying to build an Open Source browser in 2020
Trying to build an Open Source browser in 2020Trying to build an Open Source browser in 2020
Trying to build an Open Source browser in 2020
 
DevSecOps for Developers, How To Start (ETC 2020)
DevSecOps for Developers, How To Start (ETC 2020)DevSecOps for Developers, How To Start (ETC 2020)
DevSecOps for Developers, How To Start (ETC 2020)
 
The Anatomy of an Exploit (NDC TechTown 2019)
The Anatomy of an Exploit (NDC TechTown 2019)The Anatomy of an Exploit (NDC TechTown 2019)
The Anatomy of an Exploit (NDC TechTown 2019)
 
Elections: Trust and Critical Infrastructure (NDC TechTown 2019)
Elections: Trust and Critical Infrastructure (NDC TechTown 2019)Elections: Trust and Critical Infrastructure (NDC TechTown 2019)
Elections: Trust and Critical Infrastructure (NDC TechTown 2019)
 
The Anatomy of an Exploit (NDC TechTown 2019))
The Anatomy of an Exploit (NDC TechTown 2019))The Anatomy of an Exploit (NDC TechTown 2019))
The Anatomy of an Exploit (NDC TechTown 2019))
 
Elections, Trust and Critical Infrastructure (NDC TechTown)
Elections, Trust and Critical Infrastructure (NDC TechTown)Elections, Trust and Critical Infrastructure (NDC TechTown)
Elections, Trust and Critical Infrastructure (NDC TechTown)
 
Survival Tips for Women in Tech (JavaZone 2019)
Survival Tips for Women in Tech (JavaZone 2019) Survival Tips for Women in Tech (JavaZone 2019)
Survival Tips for Women in Tech (JavaZone 2019)
 
Embedded Ethics (EuroBSDcon 2019)
Embedded Ethics (EuroBSDcon 2019)Embedded Ethics (EuroBSDcon 2019)
Embedded Ethics (EuroBSDcon 2019)
 
Chromium Sandbox on Linux (NDC Security 2019)
Chromium Sandbox on Linux (NDC Security 2019)Chromium Sandbox on Linux (NDC Security 2019)
Chromium Sandbox on Linux (NDC Security 2019)
 
Keynote: Deconstructing Privilege (C++ on Sea 2019)
Keynote: Deconstructing Privilege (C++ on Sea 2019)Keynote: Deconstructing Privilege (C++ on Sea 2019)
Keynote: Deconstructing Privilege (C++ on Sea 2019)
 

Recently uploaded

How to Position Your Globus Data Portal for Success Ten Good Practices
How to Position Your Globus Data Portal for Success Ten Good PracticesHow to Position Your Globus Data Portal for Success Ten Good Practices
How to Position Your Globus Data Portal for Success Ten Good Practices
Globus
 

Recently uploaded (20)

GlobusWorld 2024 Opening Keynote session
GlobusWorld 2024 Opening Keynote sessionGlobusWorld 2024 Opening Keynote session
GlobusWorld 2024 Opening Keynote session
 
Paketo Buildpacks : la meilleure façon de construire des images OCI? DevopsDa...
Paketo Buildpacks : la meilleure façon de construire des images OCI? DevopsDa...Paketo Buildpacks : la meilleure façon de construire des images OCI? DevopsDa...
Paketo Buildpacks : la meilleure façon de construire des images OCI? DevopsDa...
 
Advanced Flow Concepts Every Developer Should Know
Advanced Flow Concepts Every Developer Should KnowAdvanced Flow Concepts Every Developer Should Know
Advanced Flow Concepts Every Developer Should Know
 
Developing Distributed High-performance Computing Capabilities of an Open Sci...
Developing Distributed High-performance Computing Capabilities of an Open Sci...Developing Distributed High-performance Computing Capabilities of an Open Sci...
Developing Distributed High-performance Computing Capabilities of an Open Sci...
 
Globus Compute wth IRI Workflows - GlobusWorld 2024
Globus Compute wth IRI Workflows - GlobusWorld 2024Globus Compute wth IRI Workflows - GlobusWorld 2024
Globus Compute wth IRI Workflows - GlobusWorld 2024
 
First Steps with Globus Compute Multi-User Endpoints
First Steps with Globus Compute Multi-User EndpointsFirst Steps with Globus Compute Multi-User Endpoints
First Steps with Globus Compute Multi-User Endpoints
 
OpenFOAM solver for Helmholtz equation, helmholtzFoam / helmholtzBubbleFoam
OpenFOAM solver for Helmholtz equation, helmholtzFoam / helmholtzBubbleFoamOpenFOAM solver for Helmholtz equation, helmholtzFoam / helmholtzBubbleFoam
OpenFOAM solver for Helmholtz equation, helmholtzFoam / helmholtzBubbleFoam
 
How to Position Your Globus Data Portal for Success Ten Good Practices
How to Position Your Globus Data Portal for Success Ten Good PracticesHow to Position Your Globus Data Portal for Success Ten Good Practices
How to Position Your Globus Data Portal for Success Ten Good Practices
 
TROUBLESHOOTING 9 TYPES OF OUTOFMEMORYERROR
TROUBLESHOOTING 9 TYPES OF OUTOFMEMORYERRORTROUBLESHOOTING 9 TYPES OF OUTOFMEMORYERROR
TROUBLESHOOTING 9 TYPES OF OUTOFMEMORYERROR
 
SOCRadar Research Team: Latest Activities of IntelBroker
SOCRadar Research Team: Latest Activities of IntelBrokerSOCRadar Research Team: Latest Activities of IntelBroker
SOCRadar Research Team: Latest Activities of IntelBroker
 
Accelerate Enterprise Software Engineering with Platformless
Accelerate Enterprise Software Engineering with PlatformlessAccelerate Enterprise Software Engineering with Platformless
Accelerate Enterprise Software Engineering with Platformless
 
Globus Compute Introduction - GlobusWorld 2024
Globus Compute Introduction - GlobusWorld 2024Globus Compute Introduction - GlobusWorld 2024
Globus Compute Introduction - GlobusWorld 2024
 
2024 RoOUG Security model for the cloud.pptx
2024 RoOUG Security model for the cloud.pptx2024 RoOUG Security model for the cloud.pptx
2024 RoOUG Security model for the cloud.pptx
 
Large Language Models and the End of Programming
Large Language Models and the End of ProgrammingLarge Language Models and the End of Programming
Large Language Models and the End of Programming
 
How Recreation Management Software Can Streamline Your Operations.pptx
How Recreation Management Software Can Streamline Your Operations.pptxHow Recreation Management Software Can Streamline Your Operations.pptx
How Recreation Management Software Can Streamline Your Operations.pptx
 
Using IESVE for Room Loads Analysis - Australia & New Zealand
Using IESVE for Room Loads Analysis - Australia & New ZealandUsing IESVE for Room Loads Analysis - Australia & New Zealand
Using IESVE for Room Loads Analysis - Australia & New Zealand
 
Understanding Globus Data Transfers with NetSage
Understanding Globus Data Transfers with NetSageUnderstanding Globus Data Transfers with NetSage
Understanding Globus Data Transfers with NetSage
 
Exploring Innovations in Data Repository Solutions - Insights from the U.S. G...
Exploring Innovations in Data Repository Solutions - Insights from the U.S. G...Exploring Innovations in Data Repository Solutions - Insights from the U.S. G...
Exploring Innovations in Data Repository Solutions - Insights from the U.S. G...
 
Into the Box 2024 - Keynote Day 2 Slides.pdf
Into the Box 2024 - Keynote Day 2 Slides.pdfInto the Box 2024 - Keynote Day 2 Slides.pdf
Into the Box 2024 - Keynote Day 2 Slides.pdf
 
Designing for Privacy in Amazon Web Services
Designing for Privacy in Amazon Web ServicesDesigning for Privacy in Amazon Web Services
Designing for Privacy in Amazon Web Services
 

I can't work like this (KDE Academy Keynote 2021)