Not Go Quietly Adaptive Strategies and Unlikely Teammates
summary
Argues that targeted influence beats one-size-fits-all security: use procurement to force vendor SDLC and contract penalties, use general counsel to win DLP/netwitness and privacy budgets, and use devops patterns (automation, chaos monkey, instrumentation) to get defensible, well-run infrastructure. Shows failures: PCI-compliant networks fall to metasploit (H.D. Moore’s law), 21 Sony incidents include only six Anonymous attacks, and the “50-day Summer of Lulz” succeeds against neglected sites. Describes wins: BigFix + NetFlow for hunting, WAF-as-a-service via procurement, and reorganizing reporting to gain funding.
AI-written summary · about
chapters (39)
- 0:00Start
- 1:41Who am I?
- 3:41A Story of a CISO...
- 4:03Depressed? You Are Not Alone...
- 6:01Forces of Constant Change
- 8:31Consequences: Value & Replaceability
- 9:50Feel Like Surrendering?
- 10:18A Modern Pantheon of Adversary Classes
- 13:10Profiling a Particular Actor
- 15:34Script Kiddies (aka Casual Adversary)
- 17:03Organized Crime
- 17:41Nation States (Adaptive Persistent Adversaries)
- 18:20Hacktivists Chaotic Actors
- 19:04Auditors/Assessors/QSA
- 19:51Attacker Power - HD Moore's Law
- 20:25Where Would You Prefer To Be In the Zombie Apocalypse?
- 25:30Sphere of Control
- 25:51Sphere of Influence vs. Control
- 26:06Rage, rage against the dying of the light
- 29:39Control & Influence "Swim Lanes"
- 32:13Under-tapped Researcher Influence
- 32:39Its Easier with Teammates
- 33:03Surprising Teammates
- 33:38DEFENDER: General Counsel
- 35:21DEFENDER: Procurement / Supply Chain
- 37:17DEFENDER: Chief Information Officer
- 38:09DEFENDER: Chief Technology Officer
- 39:03DEFENDER: Chief Financial Officer
- 39:34DEFENDER: Senior Vice President, Sales
- 40:03DEFENDER: DevOps
- 42:11Battle: PCI Compliance Round 2
- 42:47Battle: Intellectual Property Round 2
- 43:49Battle: Web Properties Round 2
- 43:59Case Study: Gaining Situational Awareness
- 45:11Case Study: Using Customers To Your Advantage
- 46:38Case Study: Changing Report Structure Co.
- 47:19Case Study: Adversary Driven!
- 47:32CISO: The New "Nick Fury"
- 50:06Thank You & Additional Resources
related talks
49mLessons from DevSecOps Trenches
33mInterview with
51mThinking Differently About Security
39mProactive Security, less buzzword, more action
46mIn Search of Security Shangri-la
45mHow to win friends and influence your security team
05mEnterprise security: A new hope
40mTotal Security: Investigative Perspectives from Public to Private Sector