Calcifying Crisis Readiness
summary
Argues organizations must run no-notice full-scope penetration tests in production, combine Chaos Monkey-style fault injection with military “react to contact” drills, and run bug bounty programs to find real, actionable failures. Cites Shamoon wiping 35,000 hosts and Sony’s ~$10–15M recovery, and notes Heartbleed left ~4% of public hosts vulnerable over a weekend. Reports one major organization already trialing the method and claims it produces repeatable playbooks, measurable response times, and tools/processes that actually work in the real environment.
AI-written summary · about
chapters (16)
- 0:00Introduction
- 0:55Fire Drills
- 2:30Blackberries
- 3:06Shamoon
- 3:35Heartbleed
- 3:56Patch Rates
- 5:06The Gift
- 5:47Training
- 8:00Penetration Testing
- 9:02Scoped penetration
- 10:51Chaos Monkey
- 11:54Bring it all together
- 12:23Learning from the past
- 17:52Rebuttal
- 18:21Collaboration
- 18:52Contact Information
related talks
17mA Resilient Journey
20mEvolving from patch management to risk mitigation
21mhow to reconcile high-performance hosting and innovation projects with IT security
49mLessons from DevSecOps Trenches
12mConfessions of a reformed pentester
52mContinuous Security
01h 11m2024 Security BSides // Adam Pennington
33mLearning from Past Security Breaches: Strengthening AppSec Efforts and Focus