The Red Team, hackers, criminal organizations, and nation states, are a constant threat. The systems we build are the targets. We need to understand the human collateral that hangs in the balance. We embrace methodologies to write better code and make our lives better. They do nothing for the rest of humanity that is directly affected by security vulnerabilities we introduce. In this session we'll put a human face on the users of our software. It will challenge you to think in terms of flesh and blood rather than ones and zeros. We are all the Blue Team. We protect the rest of humanity. Join us in the fight. The Red Team is coming!

1. @adam_englander
The Red Team Is Coming!
Adam Englander
iovation

2. @adam_englander

3. @adam_englander
Red vs. Blue
Lone Gunmen
Hactivists
Competitors
Organized Crime
Nation States
You

4. @adam_englander

5. @adam_englander

6. @adam_englander

7. @adam_englander

8. @adam_englander
68% of people reuse passwords
Source: August 2015 Password Survey
https://s3.amazonaws.com/launchkey-blog/LaunchKey_Password_Survey_Results.pdf

9. @adam_englander

10. @adam_englander
Multi-Factor Auth has limited adoption
Source: August 2015 Password Survey
https://s3.amazonaws.com/launchkey-blog/LaunchKey_Password_Survey_Results.pdf

11. @adam_englander
The Path to Pwnage
Your
Website
Bank
Account
Credit Card
Account
Cloud
Document
Storage
Government
ID
Identity
Theft
Shadow
Card
Account
Malware
Propagation
Key Logging
Account
Takeover
User’s
Email
Account

12. @adam_englander

13. @adam_englander

14. @adam_englander
–FTC Annual Summary of Consumer Complaints for 2017
399,225 reports of identity theft were
made last year in the United States.

15. @adam_englander
–Las Vegas Review Journal
https://www.reviewjournal.com/business/8-identity-theft-myths-you-should-ignore/
“The FTC estimates that it takes an
average of six months and 200 hours of
work to recover from an instance of
identity theft”

16. @adam_englander

17. @adam_englander
FIPSHIPPA
PCI DSS

18. @adam_englander

19. @adam_englander

20. @adam_englander
PHP
http://php.net/manual/en/security.php

21. @adam_englander
OWASP
https://www.owasp.org

22. @adam_englander
websec.io
https://websec.io/

23. @adam_englander
Security BSides
http://www.securitybsides.com/

24. @adam_englander

25. @adam_englander
iovation.com/dummies

26. @adam_englander

27. @adam_englander

28. @adam_englander
https://joind.in/talk/2c002
Please rate this talk

29. @adam_englander
• Compliance: By Nick Young [CC BY-SA 3.0]
• Botnet: By Joey Devilla [CC BY-SA 4.0], via Wikimedia Commons
• The Red Pill or the Blue Pill: By Paul L Dineen [CC BY-SA 2.0]
• All other photos were public domain