so welcome everyone thank you for
joining us um this is the first day
of the
um upstate village in this year's def
con defcon 29
um
it was kind of hard for us to cancel
this year's in-person part again
after last year as well
but we felt
[Music]
i'm very excited to have all these
people joining us virtually
because it shows me that
the community lives even without
the in-person part and this is always
very heartwarming
the good news is that
the world became a bit smaller with
kovit because
we suddenly have speakers that could
never come to defcon before that
um also attendees we have attendees that
are joining us from all over the world
and to you i say good morning or good
evening or
a nice day
no matter where you are we're happy that
you joined us
and this is really
an exciting
way for us to start we're going to start
um our sessions with a panel of
specialists
um
this is going to be the colorful upset
red blue or purple
panel
so
my name is erazy alon i'm the founder
and mayor of absolute village i will be
the moderator today
and in this session we will hear from
three experts
each expert will speak for
about seven minutes to share their
perspective
or big idea
one after the other
um following all three
three speakers we will have a qa session
for the remaining time
just voice panel you can write a
question
in the chat in the text channel
at any time and i will try to
[Music]
put all the questions in the discussion
in the panel later
uh if you have
a specific speaker you want to ask the
question please specify that in your
question
so let's get started
first in line we have pedro umbilio
security researcher hardware maker
software breaker
red to the bones hacker
pedo will share with us his red
perspective take it away
thanks there is
so hello everyone it's it's really great
to be here at defcon 29
as arya says i know that the conditions
are less than ideal but still it's great
to see conferences going above and
beyond to deliver meaningful content
even with the the situation that that
we've been facing uh almost two years
now
so my name is pedro blano aka crypto and
i've come to talk to you about red team
exercises and their focus on apsec
now i've done my share of red team
exercises throughout the years
everything from hollywood style social
engineering designing and placing custom
implants inside an organization office
to less elaborate but not necessarily
less time consuming
network assessments pen testing code
reviewing software reverse engineering
and exploitation and so forth
what i really want to stress today in
this short conversation we are having is
the following
red teams and or general offensive
security exercises are or should be the
most realistic exercise that your
company can make to stress test the
ability to extend and recover from real
attacks
so let me rephrase this regular
offensive security exercises are the
most realistic security exercises that
your company can make
now it does not matter how solid you
think your defenses are does not matter
how expensive is your software or
equipment does not matter how many
issues you solved in your sas report it
does not matter how agile is your
devsecops implemented and it does not
matter how much money you put in your
bug bounty program
all of those things they help of course
but none none of those matters if you
don't actually test all your defenses in
a real world scenario
because attackers won't play nice
attackers won't respect your rules of
engagement nor your very well-defined
scope and attackers for sure won't focus
only on your android application and
leave the api servers alone for example
they won't leave the database server and
test it because it's off school so that
won't happen and that's why you should
care
now
this is where red teams shine we think
like attackers we go beyond cvss or the
low high low impact vulnerability
classification or even bug bounty scores
and rewards
we know malicious attackers are always
innovating they are figuring out new
attack vectors and so are we
they constantly search for new
vulnerabilities and how to exploit them
how to stay undetected new ways to
deploy phishing campaigns and lateral
movement and so forth and so are we
as a red team
we will be hopefully
the first wave of highly motivated and
skilled attackers that a company will
face
so in apsec
red team exercises are often viewed as
you know some form of code auditing
code review application pen testing or
in some cases a bug bounty program
that's limited in scope and limited in
time
but it can be and should be much more
than that
because as red teamers we become users
and we aim for administrators we explore
in-depth your application ecosystem how
all the pieces interconnect and the
potential vulnerabilities and risks that
are associated with those
vulnerabilities
because some risks may not even have a
cvss score worth of mention
but the pr cost would just be too much
for example
and this is something that you probably
won't catch on a bug bounty or code
review
we are attackers that care about your
organization and try to figure out how
to inflict harm in every possible way
before others do
now
i'm not trying to remove value here from
bug bounty programs they have their
intrinsic value
in my case sometimes even between
engagements
i i occasionally participate in bug
bounties for fun and of course profit
but here's the thing
i've received bounties on critical
issues more than once and until this day
i still
don't have the you know the the real
idea of what the application was for
i i just knew that i shouldn't be able
to perform certain operations without
even being authenticated like for
example
delete all users from a system or
forward avatar reports to the internal
network
in a network device
but i never really understood what i was
attacking nor i had the perspective of
the company core businesses and the
risks they prioritized so
in this sense i wasn't worried about the
organization i was just worrying about
getting a quick a nice bounty
and this is where i think red teams
differentiate at least in my conception
of what the red team should be
we become users of your applications and
we explore them in that from all angles
we try to understand your user base your
business models to have a clear view of
what's at stake
and in this way we strive to make your
company safer and understand your
organization values and cultures and i
think this goes way beyond an on off
engagement
i think so
you know red team assessment benefits
for organizations i think they are clear
because organizations can have a
snapshot in time on how secure they are
at that moment
they can measure how well devsecops is
benefiting their code for example they
can compare different sustain or code
analysis tools for performance in the
real world
and i think importantly organizations
can identify new risks that are they
were not in the original threat and
attack models so
in this way they can reliably assess
their state of readiness when a threat
actor decides to attack
and all of this that we are talking
about is critical information for
decision makers to properly plan for the
future
and i think it can hardly be obtained by
other means except for a realistic
attack exercise
a red team exercise is not just about
discovery the organization weaknesses
and vulnerabilities but it's a really an
attempt to employ lateral and outside of
the box thinking regarding the overall
security of the organization and its
business in a way it's a statement
and it's a clear effort from the
organization to understand their current
security stance and to continuously
improve it while going forward it's a
it's a commitment with secure
development now and for the future
well if you take anything along with uh
with you regarding my intervention here
i think it i hope it's the following
red teams and their regular offensive
security engagements are the most
realistic security exercises your
company can make security wise and in my
opinion one of the best ways to measure
and prepare for real world attacks with
all its implications
and
that's what i had to say
for today
it is
excellent
thank you so much pedal
thank you a lot of takeaways
from that
um so our blue
our blue expert
is not here yet
um so we're going to jump straight
uh to the next
expert tanya tanya
tanya
is
uh not someone we need to introduce i
think but anyway she's the ceo and
founder of we hack purple
um
let's try and unite us all in one common
goal and share the share your purple
perspective then go ahead
dania are you with us
okay so while we try and get tanya and i
see that luis join us
so that's a that's a good timing so let
me introduce you our next speaker is
luis chris gomes
he is the one that got away from
from upsec to the baldur
he was born a security fanatic now he's
a cso with 14 years in big tech and
banking blue teams moving now to a more
managed focused role
lewis will will share with us his blue
perspective thank you
thank you
for
having me um
first of all i'm older of blue teams i
always see this as a evolution of
bluetooth
for me
it's
mostly pros
versus joe
lewis
honestly comes from the fact that normal
red in the amount of shine
uh
can you can am i am i speaking too low
or is it
cutting no you are
it's cut
uh what about now
it seems better let's try let's try
again okay
sorry so i need to be uh more a little
bit faster in order to maintain this
precarious situation that i have on
internet
um so in terms of blue team advances or
the history evolution of blue teams what
i see happening right now is that up
until now blue teams always relied on
pattern matching
log leaking and being the guys that are
behind the wheel like we are trying to
catch up with red teams and the result
of that is that we never get the amount
of time that we need to be creative
and moving forward from the from the
history that we've been uh pursuing up
until now it's always we are a step back
or
or we are a step behind the attackers
the only evolution possible is for us to
leverage
uh machine learning or ai in order to to
remain uh on top of what is pattern
matching of what we do today
but allowing us humans the human part
the creative part of security to be on
top of our game and creating stuff that
the red team never seen before
because up until now what we what we
have been seeing is we always try to
catch up to them to people like pedro
or even after when tanya speaks people
like tanya but we never reach that level
of development and moving forward we can
only achieve
the ultimate blue team security module
if we are able not only to shift left
but the event driven
and being event driven it's not like uh
there is an action for every security
pattern that we know is actually
creates a layer deeper than that is
being creative enough that the red team
is now after us they need to understand
us instead of us just understanding them
it's time to level up the playing field
that is my
my ultimate evolution in terms of blue
team as of now
if you have a possibility you have a
couple more minutes here
okay so uh as a last note i would just
like to say that uh
moving forward
this type of situations where you see ml
or ai which is kind of a buzzword to be
honest but doing it's not only if
clauses right it's actually being data
driven
we are moving into this scenario but
it's really hard for example for any
management uh in security or even
security expert
to really put the ego aside and show the
value of a blue team uh in terms of
being a profit center not a cost center
right
the only way for us to do that is to be
enablers or to be inside of the way of
working
of companies as of now and we are not we
are
normally the gatekeepers we are the the
guys that are on the door saying hey
this is risky in this pattern before and
we are never bringing up to the table
the research part of work i i bet there
is a thousand blue guys in
in in any of these
conversations between blue and red team
that want to do more but they are stuck
in doing the the old ways of doing
things like the cms the teams the
all of the
the tooling instead of the creative part
of the game
so the evolution of us as a blue team is
to move into a research field not to do
the repetitive tasks that that machines
excel at we don't excel at that
you muted yourself i think
i did i mean um
this was my end point i'm i i was trying
to make a little bit of
of my own um ideas in the end
but uh also i will leave i'll leave some
room for developing the questions in the
questions yeah i actually have a lot of
questions to you but uh let's wait for
the panel to
yeah next speaker um is our purple
expert again tanya janka ceo and founder
of weak purple
take it away
oh looks like she just disconnected by
accident
yeah
seems like we have
some technical difficulties today
i have invited her to speak
tanya feel free to hit that button that
you hit last time to join us
hi are you able to hear me now
yes we are
well oh my gosh discord
so many
rude words that i would like to say
about it but anyway let's talk about
appstack instead so thank you so much
for having me
um
so i want to talk about purple team so
the two previous speakers spoke about
you know red team offensive security the
idea of you know testing our bounds
making sure that our defenses actually
work and then of course our other
speakers spoke about blue team like
setting up defenses making
you know making sure all of our bases
are covered
you know uh assessing risk making sure
those risks are covered etc so i like to
think of purple team as sort of well i
guess collaborative
application security
so i know people talk about purple team
exercises where they pit the red team
and the blue team
against each other and they kind of you
know
the red team attacks the blue team
defends and sees you know how it goes
and i know that's a thing but it
actually happens very rarely
it out in the wild
it's very very rare people do those
exercises and most the time what is
happening is collaborative security
whenever i've done appsec wherever i've
worked i've been that bridge
between the security team and the devs
i try to break down silos and make sure
they're actually talking
i try to like every time the security
team is going to do something that
affects the software developers or the
the devops people i try to talk with
them about it and pass it by them
and make sure that i get their opinion
and their feedback and we adjust so that
we're not breaking all the cool stuff
they're doing
i use a lot of empathy and advocacy so
by empathy i mean i try to figure out
you know what matters to the security
team what matters to the dev
teams
and then try to adjust accordingly and
you know when we're making decisions try
to remember this team needs that or that
team has this deadline or this team
won't be able to succeed with this
without that and so how can we secure
that so that they can still do it or
what other way could we accomplish the
thing they need but securely
and then with advocacy what i mean is
socializing and spreading the word so
that can mean sometimes you know me
giving a lunch and learn
it can mean me holding a consultation so
i've written a new policy i want
everyone's opinion first before i
release it i want to talk to teams that
might not be able to be compliant for a
long time and how we can work together
to make that happen
and constantly reinforce that no one's
getting fired
i'm not making a policy to run around
and smash people with
making a policy
so that we can try to achieve that
and try to kind of hurt everyone in the
same way so that then we can have
a steady security
posture across our entire organization
it also means
putting people
first
and then processes and then tooling and
figuring out how we can make all of
those things function at the absolute
best capacity so i've seen places where
they you know buy five hundred thousand
dollars worth of super cool appsec tools
and they have the process for actually
pushing out a bug fix is
awful
and the people are frustrated and i'm
like why are we spending 500 000 on
these three tools when instead we could
hire someone to redo the processes or we
could hire a consultant that will set up
a bunch of pipelines for us and automate
this or do you know what i mean and so
like looking from a holistic approach at
all the different things and making sure
we're not just concentrating on one of
those three pillars
and then the last thing that purple team
really focuses on and this is same with
all the devops people and all the
security people is continuous learning
and so you as a security person i'm
pretty sure everyone listening to this
you're at defcon because you want to
learn because you want to improve
yourself well part of security is us
teaching all the rest of the business
the security lessons that we've learned
and as they apply to them so if you have
people that are product owners teaching
them about why security is value it's
value for the customers it's part of the
product it is a non-functional
requirement that's absolutely essential
or it's about working with the devs and
teaching them the cool new tool that you
found or tricks that you found for
helping them secure their systems better
or talking to the operations team about
you know there's this vulnerability out
in the wild right now i'm really
concerned about it can we test our
systems
so
you as a security person spreading and
sharing important knowledge that applies
to different areas of the business so
you want to continuously learn but you
also want to help the rest of the
business continuously learn security
so that we can meet our goals secure
apps
and that's what i wanted to share the
idea that purple team is collaborative
application security that we bring all
the different teams together we share
the knowledge
we are the bridge that brings everyone
together and i know that that sounds
like
you know care bears and hugs and
rainbows but really if you are trying to
work in absec and you aren't good with
empathy or advocacy like you're gonna
it's an uphill battle every day for you
if you don't know how to negotiate if
you don't know how to persuade
if you don't know how to see anyone
else's side
you're gonna have a really tough time
and that is what i have to say for now
until question period
awesome
yeah so thank you so much for that uh we
got to the panel part of this session
so if anyone has a question
please feel free to write it down in the
colorful absence text channel and we'll
try to dig some questions out of there
but first tony i want to to start with
you uh it's a
it's a
lasting first out so you spoke last
let's say
let's get a bit into this collaborative
security that you talk about because you
mentioned that
what exactly does that mean how does it
look like
uh in a day-to-day basis i'm a developer
in the company what what does a
collaborative security looks like for me
it means that the security team
talks to you
not only when
not only when there's bad news i
personally
believe that so whenever i start doing
appsec somewhere i want to meet every
day if i can i want them to know my door
is open
and i start sharing information as soon
as i can so let's say you know i want us
to have a secure coding standard and so
on i'm going to start it off as
conversations so hey we don't have any
sort of standards for secure coding i
really want us to have sam you know
here's one from the book i wrote because
i can do that um but i was hoping we
could start with this what do you think
like and invite them to meetings talk
with them about it
teach it to them
right because like there'll be junior
devs where it might be new to them and
they'll be senior dabs where maybe they
know it by the back of their hand
for teams supporting lots of legacy
stuff it's like okay so
you don't have to be compliant the first
day with this i understand your app is
old enough to vote
so what can we do to make it um
so what can we do to reduce the risk
the idea of collaborative security is
not i push out rules and they'll have to
jump through these hoops and then make
it through these gates where they can't
get their jobs done it's me helping them
secure their apps
and sometimes helping them means
teaching them sometimes helping them
means you know getting budget so we can
get a tool that they like using but i
also think does good security
it means when i do a proof of concept i
definitely need their opinion like if
let's say i'm trying to pick like a new
dashed tool
i want the devs to come and take a look
i want their opinion on you know here's
some output from the tool does this make
any sense to you like how could it make
more sense if i'm looking at a few tools
i want to invite some of the devs to
come along and look at the tools with me
because if they're going to use it every
day i think they should their opinions
should be heard
and so the idea of collaborative
security is
i don't think that that word is new but
i think security teams actually applying
it with the way they do their work
is somewhat new
when i was a devs seriously whereas they
would just come to my desk and tell me i
was a shitty dev
they'd just be like we stand it with
this it's garbage i'm like can i use the
scanner tool they're like no
like can i see it no
here's the report i'm like great who can
explain it to me you should know go away
you stuck
i feel like
that's not collaborative
yeah okay so so collaborative basically
means the opposite of what we see in
most places
yes but i swear it's cheating place
after place they're changing the way
they do things they're trying hard not
every place but i'm seeing big changes i
really am
angry
so
luis tell me how how much important
collaboration is in a blue team
well that is one of the most key uh i
would say
develop some that we need to make for
sure for example during incident
procedures one of the things that we
like the most is a
full understanding of the data flows the
only people that can uh explain to us
normally either are the
sres the devops or the or the developers
right so when we create a war room if we
don't have the necessary connections and
the right mentality to be on board uh
against uh um a unified threat what you
get is like uh you ping somebody on
slack then
the guy is not is not really answering
you need to ping the manager then
creates a scenario like tanya said that
people feel uh fear and accountability
what if i i don't answer what if i take
too much time and in bed the bad
decision flow starts when whenever you
start to rush things right when
everything is clear and you do what the
auditors call fire drills which is in
fact
a similar exercise that we actually put
to the test these types of procedures
that is where you see the biggest flaws
in in collaboration um
one of the good examples that i can give
you is that normally uh we don't even
invite red team
participants to the war rooms it's only
the blue team and a couple of uh asset
managers within the the channel
but i i think that that is a one of the
examples that we need the red team there
because the fresh ideas that come from a
guy that is looking into the eyes of an
attacker are super important also so
everybody that are a part of the system
should be
heard and should be a part of the
conversation that's the only way for
blue teams to live through others not by
themselves trying to put walls or gates
in the middle
so i'm going to ask you a question now
from
from the channel
um
from your blue perspective do you think
the time for application security is not
enough as adversaries has basically
unlimited time um this is a question by
a.m
yeah that is interesting like uh the way
that i am evolving the multiple business
units under under my scope for for blue
teaming or what i call
a defensive point of view is that we
integrate
a lot of of threat sources in in
log information right but do we do
anything uh ahead of the attack like do
we do any preparation in terms of uh of
patterns of risk a good example uh would
be
normally we integrate i'll give a real
life example integrate a new relic and
we put aws information we put a bunch of
thread feeds and i don't know something
else that in the middle like i don't
know splunk something everything is
coordinating in terms of events the
number one question that i make for for
absec individuals on on the blue team
side is are you doing anything new that
will create a different layer of of
proportion in terms of uh complexity for
the attacker with that information
instead of just listing the pattern or
verifying a threat risk by combining
multiple sources are you doing anything
new in order to create a different
complexity level a good example would be
for example if we if you white list the
normal human behavior within your your
application like you know that a user
would go for
uh
i mean i'll give you one example from my
world we'll go for classifieds we'll go
for an ad right like you see on ebay
amazon whatever
is it normal for an individual that
connects to that to go directly or from
log
in directly to password
uh do you rate that action in any way
shape or form as a high risk uh action
since he completely bypassed all the
menus that the human would see there and
therefore you put that under scope uh
and the next section would be if the guy
tries to change the password then send
them a challenge or something and this
will be dynamic behavior right so even
if the guy changed but he's not
following a normal trend of a human are
you able to
capitalize on the massive amount of data
and create a dynamic baseline that is
always trying to verify the risk level
of an action and create a complexity for
the for the attacker if you do that then
you have enough time because the guy is
always trying to think what can i do
that will mimic a human to a certain
extent
it doesn't know he is probably going to
try to try and create noise and
therefore you will automatically know
that he's an attack uh i don't know if
you is this a good example
yeah yeah it's an excellent example
and this is exactly what we're talking
about here when we try to compare our
efforts with
um let's call it unlimited time that
adversaries have
um
so so pedro looking from your red
perspective we talked about adversaries
and their um theoretical unlimited time
you are the adversary in this um you
definitely don't have an unlimited time
um
so what is your perspective on that and
i think in general what are the
challenges to organizations or to red
teams
um when designing the ready exercises
because you do have limitations after
all
yeah sure and the limitations are
actually very very important
well that's that's that's a real uh
issue uh
at least for
for small medium-sized companies uh
even for for even larger companies
time is not unlimited and since time is
money money money is also not unlimited
so there's the the issue how much time
and how much money can you invest
in in the red team exercises in a way
that you can really get the benefits out
of it and
and makes it a valid exercise instead of
just you know putting a check box under
the okay we perform the red team
exercise whatever that means
um
there are several challenges that that
that
you know
red teamers have and also
companies have for example usually some
of the challenges start at the the very
very beginning uh with scope and rules
of engagement uh you know companies uh
want uh and red team exercise and when
they sit down with us and we are trying
to design the exercise figuring out
what's important for them what's the
risk assessment and the threat and the
tech models uh we come up with the the
scope and the rules of engagement and
usually it's kind of uh
like this the red teamers want access
to everything
and the companies go like okay if it's a
production server it's of limits it's uh
the smartphone app is just a better
version and
there's those two or three critical
legacy servers that you cannot touch
and
you know senior staff cannot be social
engineers just you know the the
junior staff so they put this
amount of rules of engagement that are
not really
realistic
from the point of view of a real
attacker and it's our job
as a red teamer as a security person to
properly explain
uh the reasons
and
drive the the customer to
to a point that he understands that
certain things should be tested and of
course we as red teamers also have to
have some flexibility to understand that
there are some systems that are really
critical
and
for in order for them to be touched if
there's no uh test machines uh you
should be really really careful about
doing that
uh
so there's kind of this game that
happens uh
at the very start
then then of course as uh
as a
red teamer there's also uh other types
of challenges uh tanya and and
english talked a lot about persons and
and uh
the importance that that
a person
has in in the security uh
life cycle of a company which is
paramount uh
so i i would like to bring this this
topic that's quite trending that's uh
headaches uh while doing red team
exercises well for example there's been
some news of phishing campaigns in in
which the context was a i think a salary
bonus or a promotion or whatever and
then uh people on the news reported oh
there's off limits you shouldn't you
know play with the person's employees
feelings and so forth and ethics can be
a real challenge especially in in social
engineering because
you know in a way you are scamming
people
so but
also the entire exercises is a challenge
and the exercise must be valid so if you
think about a phishing campaign as just
you know sending an email to trick users
then yes that's that's a low blow but a
phishing campaign under the the umbrella
of a social engineering campaign is it's
much more than that it should be you
know awareness sessions should be
promoted success metrics should be
analyzed defenses should be evaluated
and this should not never be about the
person or who clicked the malicious link
for example uh it's about how did that
email ended up in the user's mailbox in
the first place what defenses were there
in place
how many users clicked the link how up
to date is your infrastructure how
segmented it is a resistant to attack so
this is not about the person
that clicked the link it's about the
company as a whole
have the has the company you know reduce
training programs or
are is the company you know promoting
the right security mindset uh explaining
and training the their employees
um in the end when something fails it's
always the company fault and it's not
a person's fault
so i believe it's possible to conduct
realistic social engineering campaigns
you know without making people feel like
crap yes
so the blame issue the blame issue is
always always uh something that is uh on
fire that's a really great segue to a
question that we got from
a ghost e3 or
i'm not sure how to pronounce it ghost
um
this is for tanya so tanya how do you
build bridge
between
dev teams and security compliance teams
and also i will add my question here of
how do you look at security compliance
and versus
security best practices
that is a great question
i would have to say that
i
i go over and i talk to them like a
person
you would not believe how many apps
i've joined or security teams that i've
joined where i said
oh okay so the decks are doing this did
you go talk to them and they're like
well no
did you go and have a meeting with them
do they even know who you are and
they're like well no like i want the
dads to all know who we are like they
might not
know every member of the aptek team but
like they should know we exist they
should know we're here to help and i
want a bunch of them to know my face and
i know with covid right now a lot of us
are not working in person and that is
totally cool
um but you know having a zoom meeting
talking with them on slack or teams or
discord or whatever you use at work to
chat
so i would first start with going over
like especially if you're starting a new
job it's kind of easy as an excuse to go
introduce yourself
i'll ask can i come to a team meeting
and like speak like three minutes on
like hi i'm tanya i'm new i'm part of
the apsec team you know here's what i do
i'm here to help you
and start like that
and then when there's a compliance thing
that i want or there's a thing that i
want i rate them and i'm like hey i have
this thing i have to do
um i'm wondering if we could meet up and
chat about how we could do it in the
least painful way possible
i also i i have some self-deprecating
jokes that i will use because sometimes
i find compliance pain in the butt and i
don't necessarily love it i also try to
automate things so it's not as annoying
and then when the results come out i
explained so now we negotiate because i
know they're not going to do all the
things i need like if you have to follow
hipaa or gdpr
or um
iso 27001 salk2 whatever the thing is
you can't negotiate on that because you
must you know if you're handling credit
cards you must do certain things to be
pci compliant and i will explain that
but we might negotiate on when or how or
who does which work like maybe my team
can help with some of the things maybe
we'll get a consultant to help with
stuff like one of the places where i
work
you know we started using a sas tool for
the first time and we literally found
like 80 000 bugs because they have lots
of legacy and they have like hundreds
and hundreds of apps
and the devs just
for obvious reasons we're a little
uncomfortable and we said listen we're
going to hire two people for four months
to triage all of these validate 100 of
the results for you
and then if there's time left they'll
even help you fix the bugs but we're
gonna pay for this to assist you and
like we don't expect you to validate
these results that's our responsibility
but we need you to help us fix those
bugs and so then we're gonna have
meetings with them to talk with them
about okay so you know there's this many
bugs
we're worried about that many
can we plan them out in your upcoming
releases that you're planning and like
put them in your schedule and so then
we're not like
essentially
putting an avalanche of work on them and
then walking away
you know we're working with them and so
that's how i do it i do a lot of talking
to them i also do a lot of
so like i realize that i'm here as a
speaker at def con so people are like
you're great at presenting but i'd like
to note i sucked when i started
it took a long time to get good at it
and so
it
like anyone listening here like if you
do lunch and learns and you do little
presentations even if you're not great
at it the fact that you're trying people
will see that and they'll get to know
you and it sounds weird but it breaks
down a lot of barriers and so then when
i go to talk to that team
that one dev that went to all the lunch
and learns or went to some of them it's
like oh
hi tanya i'm like hi how's it going and
it's like you already have an ally on
that team a person who's like in it with
you
and like they'll
try to help you they don't even realize
it's just like people love helping and
if they're going to your presentations
or they're going to the meetups with you
or whatever the thing is
they're they see the value of what
you're doing and they want to help you
get there
and so yeah that's those are my
suggestions
there was another question in the tech
chat
um that was for me but
all of the t like all of us could answer
if you want eras the one
about um
implementing
new security tools
yeah so
you mentioned you mentioned the novel
previous answer i think this is part of
the avalanche right implementing new
security tools
um tons of practices
um this is definitely an overload for
developers many times so how do you keep
the balance in this part of the
avalanche
yeah i i teach them the tool
i so
i involve them with proof of concepts if
they want to come and then when it when
it comes out i teach them the tool i
also try to create like little resources
that go with the tool so for instance
like one place where i've been doing
some consulting so we wanted to put
some tools into their pipelines
and you know they have the pipe i'm not
gonna do all of them so what i did was
is like we did it and tuned it and did
everything in one pipeline and then we
shared the yaml with everyone like the
code and we're like you build the task
like this you would you know add it here
this is where it needs to go here is the
code for it here is this here is that
and then like made this cute little
video of us implementing it
and then turned it all into like an
email of how they can do it themselves
and to ask us if they have problems
and then
again like have a meeting with us after
you run the scanner we'll go over the
results with you and i realize that this
doesn't scale very well but lots of
teams
you offer they don't accept but knowing
that you're there if they get stuck is
what matters if that makes sense
and so
teaching it to them offering as many
things as you can and also telling them
what things they have to fix and what
which things they don't have to
so for instance if there's like a
licensing violation it's like whoa we
don't want to get sued but if you know
there's high mediums and lows coming
from you know about some of your
dependencies
telling them in advance like listen you
have to fix all the highs but we can
negotiate on mediums and lows
telling them that it makes it less scary
so try to make it less scary and let
them know you're there
i i i totally agree with that i hear a
lot from
um people who are
wondering about if they want to use
something and ask them what would make
you use that and and sometimes they say
the simplest thing like
if i knew who my focal point was if i
have any issue with it something like
that it's it's so easy so so i agree 100
with me
we do we do build uh something similar
like daniel was saying like for example
we do have currently on the pipelines we
run assassins uh on the qa in pre-prod
and then we run dust at the point of
deployment when you deploy that in
in in production
uh and the reports are catered meaning
the reports that come out of this uh
secure development lifecycle are catered
to each team like they the the report
goes on a monday with the introduced uh
vulnerabilities or or the path to to
learn
on the report of monday and on the
bottom part of the report
we curate the best learning resources
that they can
get to
to achieve a mitigation of those types
of vulnerabilities like for example if a
team is really good at making queries to
the database and they do the proper
sanitization but they are really bad at
access
or authorization
we on the bottom we would have an
excellent article for for idols and
explain
how can they mitigate it from from
scratch right uh and if that is not
needed every month we do a
monthly with all the
developers
explaining uh the scores like they have
actual in a sense of capture the flag
they have scores of
how much did you improve over time not
how much did you get worse because if
you get worse means that me as a blue
team or me as a security individual
maybe i need to enable them in a more
secure environment so i need to help
them to get better not just blame them
for not having the right patterns of
behaviors right
so we catered more to them instead of
they catering to us and be afraid of
security
yeah
so you had a question for pedals right
uh i do i mean this is mostly for pedro
because this is a hot topic for for blue
teams is better when you're doing a red
team exercise is it important for you to
be whitelisted or you prefer to be seen
as the as the attacker from the outside
regardless of the the complexity or time
constraints
yeah that's also an interesting question
from the point of view
that kind of relates with the time slash
money that the company
is willing to invest
for me ideally
i see a red team exercise more like a
black box as exercise it can be kind of
gray box exercise but never never
white box and i say this because
uh we need to understand the different
uh
the differences between a vulnerability
assessment that's one thing the
penetration testing that's that's
another thing and then there's red
teaming
uh red teaming by definition should have
more time uh
at least
more stretched in time you don't you
don't have to be permanently attacking
the the organization that you're trying
to
to to enter
but
you need enough time to be creative to
to figure out new
you know maybe new attack vectors
depending on the rules of engagement
even a physical presence
might be
allowed and those are the the fun ones
where you can actually go into the
into the facilities of a company and you
know drop an implant and so forth so
yeah
i agree i agree
i agree i mean mine is mostly my my
question is mostly from the fact that
when we are doing the the blue team
preparation for
i even prefer not to know when
i prefer not to advise teams when they
are about to get a red team assessment
just to verify the incident procedures
and all of the security layers that we
sell so much to the board they should be
able to sustain a non uh it's not like
hackers are gonna call your company and
gonna be like hey uh we're gonna breach
you in seven days so be ready it's like
they they are there all the time right
yeah yeah
so that's why whitelist for me is a hard
time
if you're doing just straight
penetration testing i think whitelist is
a is a plus i think it should be in sync
with the with the blue team uh
uh you can actually test a lot much more
stuff you can have a
a better vision of what the company does
and
which assets the the company has and and
it's also okay to to to test the blue
team
and
you should be working this together
maybe not completely
as we are used to uh
with the definition that we have we have
now
as a as a purple team but definitely
working together and
and maybe tanya can explain how can we
fit in a purple team
uh after the exercise or during the
exercise if it's uh
if it's a
white box kind of pen testing and how
how can we fit in the purple team when
there's a red team exercise that is not
by definition supposed to be coordinated
with with the blue team
i feel like
i just want to give a heads up that
we're approaching the end of our time so
please all of you uh deal panelists keep
your answers
short and sweet
awesome
i
i feel like security
is really really really good at keeping
secrets
and as an industry
like at like the security professionals
like boots on ground we kind of suck at
marketing
and if we could learn to share more
information like for instance you know
the red team doesn't want to tell
everyone they're coming but having
presentations after
letting devs come
so like quite often like we just don't
include the devs we just don't include
um like the devops team the operations
folks
in these presentations if we could
share more like i was super nervous when
i started doing it i was worried that
all of them would think i was stupid to
be honest like tanya screwed this up
like there was a security incident she
sucks that a security incident happened
but they didn't turned out they're
really interested they learned and they
did better
and so maybe what we need to do is start
figuring out more ways that safely we
can share when possible
awesome anyone else
a very quick question
for our blue luis
you talked about
artificial intelligence you talked about
machine learning tooling
aren't you
killing your own team um kind of
automating your role and cutting the
branch you're sitting on
um
now they hate doing uh the part that
they are doing today right so
they are always uh
trying to get outside of of the hamster
wheel
that they live looking at uh
known patterns or imagine so today
uh something like heartbleed 2 comes out
oh my god let's let's look to the logs
did we get attack
before this is this pattern known
they they hate that side of living on
the path right they normally live either
on the past or they live on the present
with afraid of the future
um what i try to pass for them is can
you imagine the freedom that is you
looking so far to the future that you
are predicting all your threat scenarios
and building uh the the positive layers
of of security on top of it with the
developers with the infrastructure
experts with guys like pedro trying to
test us with people like tanya teaching
us how to build the process in a more uh
humane way right that is what we need to
do like if we are afraid of machine
learning or ai
why are you here do you want to do
repetitive work there is
there is no um
no end game for that because at some
point like pedro said that money will
will come in and say look why am i
paying seven eight nine ten senior stock
analysts
and threat intelligence and whatever
when i can have a tool that does this
and and cut the cost by 80
and that's where the humans go in and
say wait a minute i like to buy the tool
but i want to customize it and put my my
my top
expertise on on that so we can be ahead
instead of behind of the attackers that
is for me a win-win situation for a
cool sounds good
okay the last question
tanya for you let's make it quick
although i read the question i don't
think we can how do companies culturally
make the shift from red
versus blue to purple
i think it has to do with training
and i think that if it comes from the
top that's the best
but if you can hire that one person with
that infectious personality
where they are so excited about security
and they're open to sharing
and then encouraging it so it might be a
consultant it might be that you need to
add a new security person to your team
it could be that you send the managers
on training and they come back
i mean like
obviously i'm going to tell you like buy
my book because it's going to tell you
all the stuff i've had a lot of people
say like you teach absec in this really
soft way but i do it because that's what
actually works
and if you send someone into a knapsack
job and they don't know that you have to
compromise you have to negotiate you
have to persuade like half of your job
every day is convincing devs and
management and the rest of the security
team to go along with your plan and meet
in the middle
and so yeah
i i believe that you kind of have to
build that skill set and people some
people poo poo soft skills but i don't
think you can get far without them in
apsec
yeah
okay and we are the end of the hour uh
actually one minute beyond thank you so
much for our panelists
and uh luis gomes and tanya thank you so
much for being with us today for the
opening panel for the apsec village
defcon 29
keep safe everyone
we can keep on the chat
[Music]
go for it and have a great con
thank you all bye bye
thank you
thanks