Thread by @jpdanner

Its nearly #purplecon time with @kanocarra!

Front row with some of the #purplecon krew.

Almost showtime!

@pikelet @hipsterjazzbo

Some ace haikus.

And a @mangopdf
#purplecon

Majestic AF
@ryankurte @jsstott
#purplecon

YAS
#purplecon

Its @purpleconNZ time!

With @mangopdf @ryankurte @jsstott @__nolang

#purplecon

Why the purple aesthetic?

Hacker culture is about doing your own thing and rebelling.

But hacker cons seem to look the same.

#purplecon

#purplecon gives you a new standard to follow! Rebel!

@purpleconNZ

#purplecon is about positive, defensive, actionable security advice.

Let the experiment begin!

@purpleconNZ

Thank you @purpleconNZ sponsors!
@insomniasec @vendhq @Google FireEye Atlassian
#purplecon

Con complete with Bubble Tea!

#purplecon

Now its @Sereeena talking about the the intersection between security & humans

#purplecon

Everyone deserves security, but security is hard.

#purplecon

We abandon a whole scope of people who make the wrong security choices.

Is that right? That's your mom, dad, CEO, colleagues.

Do we abandon them?

#purplecon

Security is hard. So most people are bad at security.

#purplecon @Sereeena

The current system enables security problems

#purplecon @Sereeena

We have two personas:
- People who have no idea what to do
- People who know what to do, but not how to implement it
#purplecon @Sereeena

In security, the perfect is the enemy of the good.

Trying to force people to use the BEST security means they won't adopt anything at all

#purplecon @Sereeena

Security recommendations need to be personalised for each person. Where do their needs fall on these continuums?

#purplecon @Sereeena

Go @Sereeena
#purplecon

Effective security advice needs to be:

Incremental
Personalised
Habitual

#purplecon @Sereeena

Our current process for communicating security doesn't work.

We have a pervasive culture of shaming people and it DOESN'T WORK.

#purplecon @Sereeena

This means that people won't ask for advice. Then they can make REALLY bad decisions.

#purplecon @Sereeena

How do we teach people then?

Show them, don't tell them. Lead by example.

#purplecon @Sereeena

Who does this well?

YouTube Vloggers!

#purplecon @Sereeena

So @Sereeena made a YouTube security channel!

#purplecon

Now its @errbufferoverfl talking about the paper towns to stop pirates stealing maps.

#purplecon

Basically you put a fake town on your map. And if a competitor also puts this fake town on THEIR maps, then they're pirating your maps!

Ah ha!

#purplecon @errbufferoverfl

What do paper towns have to do with InfoSec?

#purplecon @errbufferoverfl

So you can use canary tokens to alert you of people doing nefarious things!
Maybe it's an attacker or maybe an insider threat.

#purplecon @errbufferoverfl

Canary tokens be like:
#purplecon @errbufferoverfl

Apparently Atlassian Space Crab makes mean canary (crab?) tokens for AWS

#purplecon @errbufferoverfl

You need to have good logging & alerting for these tokens.

Canarys are only useful if they sing!

#purplecon @errbufferoverfl

You can have URL tokens, AWS credentials tokens, DNS tokens.

Make them look juicy and interesting to attract the haxors

#purplecon @errbufferoverfl

Then it's the haxors denied!

#purplecon @errbufferoverfl

Very low signal to noise ratios*

*if deployed correctly

#purplecon @errbufferoverfl

Canary tokens alone won't keep you safe. Just part of a holistic security approach.

#purplecon @errbufferoverfl

Now its @mossnz talking about containers.

#purplecon

What are containers?

#purplecon @mossnz

Abstractions are our friends.

All good code needs a good problem to solve.

What about storing cloud limes?

Answer: Redis.

#purplecon @mossnz

Can fire up a local Redis container to test lime storage.

#purplecon @mossnz

But, but! How do I docker a node app?

#purplecon @mossnz

Multiple dockers? Need docker networking!

#purplecon @mossnz

Now we're at the stage where, if we were trying to draw an owl, we would have two intersecting ovals.

#purplecon @mossnz

How do we trust what we're running?

Need to trust the people building the tools.

Compilers can alter programs. Including the compiler that compiles the compiler. 😱
#purplecon @mossnz

But, if we can't trust public container, do we have to build I will all ourselves?

Must we rebuild the cosmos?

#purplecon @mossnz

This is why we have CI pipelines!

#purplecon @mossnz

Building a CI pipeline with Circle CI

#purplecon @mossnz

Use Container Diff to see if anything upstream has changed

#purplecon @mossnz

The :latest tag in docker is not your friend.

Its NOT the latest build.

Extremely confusing.

#purplecon @mossnz

Build the container, check diff, scan for CVEs

#purplecon @mossnz

We've been on a container building journey

#purplecon @mossnz

Now its "Caring for our Pen Tester Friends" with @SparkleOps!

#purplecon

Hello @SparkleOps!

#purplecon

How to run a good penetration test. What we all need to succeed.

#purplecon @SparkleOps

Back when Brendan was young QA Tester, he tested software for gas pipelines provisioning.

#purplecon @SparkleOps

Back in the wonderful era of waterfall projects!

#purplecon @SparkleOps

Testing a new system?!

Much excite!

#purplecon @SparkleOps

Testing job done!

Or...

#purplecon @SparkleOps

Maybe not?

"This is full of P1 bugs"

But it was built to spec!

#purplecon @SparkleOps

What about duplication detection?

Not in the spec, but makes sense.

#purplecon @SparkleOps

Doesn't detect high pressure gas 'splosions.

Again, not in the spec.

#purplecon @SparkleOps

"Did you even test this at all?"

Vicious.

#purplecon @SparkleOps

Ouch. What happened?

#purplecon @SparkleOps

Brendan doesn't have any context!

Context means he knows what to actually look for.

#purplecon @SparkleOps

QA testing has gotten better.

#purplecon @SparkleOps

But pen testing still operates at the end with little context like... waterfall!

#purplecon @SparkleOps

Starting out means devs are surprised and there is poor handover.

Being pen tested can be scary for devs

#purplecon @SparkleOps

"Is this production environment ready for pen testers?"
"Don't worry! I turned off anything that can go wrong!"
Brendan: 😱

#purplecon @SparkleOps

At testing time we usually hand over the bare minimum.
We're not setting up our pen tester friends for success.

#purplecon @SparkleOps

How can we fix this?

Bring your pen testers into your team!

#purplecon @SparkleOps

The mindset we need:
#purplecon @SparkleOps

How do we scope the engagement?

#purplecon @SparkleOps

On-site engagement builds rapport

#purplecon @SparkleOps

Ensure you handover as much context as possible.

#purplecon @SparkleOps

Ensure you've budgeted resources for support & remediation

#purplecon @SparkleOps

Sharing is caring!

#purplecon @SparkleOps

How do we know we're getting better?

#purplecon @SparkleOps

I think @jsstott has something in his beard.

#purplecon

Bubble tea with @Sereeena!

#purplecon

I'm enjoying Mike's sticker game.

#purplecon

Now @mikeloss is telling us how to make pen testers sad

#purplecon

Who is this Mike jerk?

#purplecon @mikeloss

How to make your pen testers sad

#purplecon @mikeloss

What is your infrastructure?

#purplecon @mikeloss

Who is looking after your infrastructure?

#purplecon @mikeloss

How can we make @girlgerms happy and @mikeloss sad?

#purplecon @mikeloss

Things we can do:

Implement LAPS
Disable default local Admin
Remove passwords from GPO

#purplecon @mikeloss

What else?

- Implement a custom AD password filter
- Deal with default passwords
- Unfuck the passwords on service accounts

#purplecon @mikeloss

And...

- Kick stale RDP sessions
- set login type restrictions
- turn host-based firewall back on

#purplecon @mikeloss

- Set SMB signing to "Required"

#purplecon @mikeloss

Now for some not-so-low-hanging fruit:

- segmentation & segregation
- MFA ALL THE THINGS!
- Put vaults in the right place

#purplecon @mikeloss

If you can implement X for everyone, implement it for the people you CAN!

#purplecon @mikeloss

Security is like carving a sculpture. It doesn't happen all at once.

#purplecon @mikeloss

Now Sophie from @NZPrivacy is telling us about encoding privacy
#purplecon

Why Privacy?
#purplecon @NZPrivacy

Privacy principles:

#purplecon @NZPrivacy

Moar principles:

#purplecon @NZPrivacy

And...

#purplecon @NZPrivacy

We want information to be collected in a responsible manner in a way that does tweak people's creepy trousers.

#purplecon @NZPrivacy

Privacy & security go hand in hand

#purplecon @NZPrivacy

"Nobody in their right mind reads all the GDPR privacy policies we get emailed"

#purplecon @NZPrivacy

Aim is to turn us all into "subversive privacy developers".

#purplecon @NZPrivacy

Encode privacy into your design to enable privacy by default.

Engineer and encourage people privacy options.

#purplecon @NZPrivacy

My favourite saying from Sophie:

"Delicious bucket of data"

#purplecon @NZPrivacy

Now its @petrajane talking about securing the meaty bits!

#purplecon

Here we go!

#purplecon @petrajane

Are oyr systems cables and drives and slack integrations?

No. Our systems are people!

#purplecon @petrajane

We try and solve people with technical solutions.

This isn't great.

#purplecon @petrajane

If your users are so stupid why do they keep outsmarting you?

#purplecon @petrajane

How do we secure the people who make up critical parts of our systems instead of just blaming them?

#purplecon @petrajane

Why aren't things working?

As a consultant you can give them the best possible advice but they may not take it.

#purplecon @petrajane

How do we get people to understand what we're saying?

Humans make sense of their world by making connections. They might have different reference points and interpret things differently.

#purplecon @petrajane

How do we bridge these gaps in communication?

We can tell stories. Facts may not fit into their mental scaffolding in the way we imagine. But if we spin a narrative we create our own scaffolding.

#purplecon @petrajane

We think that our brains work better than computers. So we think we're better than we are at things that computers do very well.

We're very bad at maintaining constant vigilance.

#purplecon @petrajane

We need to make it easier for people feel safe to ask questions and make mistakes. Can't do that if we insist on blame & shame.

#purplecon @petrajane

People are predictable. Its tough for people create truly secure and unique things (passwords, etc)

#purplecon @petrajane

When things change it can be difficult for people to accept new realities.

We need to take people on the journey as to WHY the reality/advice has changed.

#purplecon @petrajane

Pukeko are thriving because they take security seriously!

Form small groups of birds that all look after they group's eggs collectively.

#purplecon @petrajane

Pukekos all take their security roles seriously and they all have a role to play.

How can we turn humans into security pukekos?

We tend to view security as a secondary (or tertiary) priority. Find out why.

#purplecon @petrajane

If you want to walk in someone's shoes, don't take their shoes! Go talk to them! Don't just imagine what they might think/feel.

#purplecon @petrajane

Security is a cost centre. Find a way to flip that and deliver real value to the people you're trying to security.

Shouldn't be an adversarial relationship. Should be a symbiotic relationship.

#purplecon @petrajane

Find the people who are the implicit influencers and pitch them. Turn them into champions. Others will follow their example.

People are frightened of us. They think we're going to be mean.

#purplecon @petrajane

We should not try and get people to care about security. It's just a means to an end.

Small steps make us feel empowered to be part of the solution. Starts with simple gestures where people can show that they care.

#purplecon @petrajane

How do we do this right?

Security is a means to an end. We want to help make small gestures close to home. How do you secure your Facebook? Your home wifi? How do you backup?

Once they're invested, can see the businesses issues. Make everyone a champion

#purplecon @petrajane

Engaging with people is hard. But we need to be mindful.

Who am I protecting? How can I take them on this journey?

#purplecon @petrajane

All @petrajane's slides are available as a colouring book!

The slides are GORGEOUSLY illustrated.

#purplecon @petrajane

Now its happy happy food time!

Our regularly scheduled #purplecon tweeting will resume in an hour.