#Kawaiicon @kawaiiconNZ

Long live @kawaiiconNZ!
#Kawaiicon

#Kawaiicon
Just because your path doesn't look like others doesn't mean you're not a hacker.
#Kawaiicon @runasand

You're both trying to solve hard problems in inventive ways.
#Kawaiicon @runasand

InfoSec doesn't have that. There is no set path or the right way to get there.
#Kawaiicon @runasand

Do the things you find interesting, the things that excite you, the things that make you happy.
#Kawaiicon @runasand

We can create the jobs that we want.
#Kawaiicon @runasand

The idea that they needed to provide reporters with this training wasn't something that anyone was asking for.
#Kawaiicon @runasand

By identifying that gap they created new and interesting jobs that didn't exist before.
And a couple other examples
#Kawaiicon @runasand



Nek minnit...
#Kawaiicon @runasand

They loved it!
#Kawaiicon @runasand

You don't want your pedantic security demands to block the story going on page 1.
#Kawaiicon @runasand

How do enable that but still maintain security?
#Kawaiicon @runasand
#Kawaiicon @runasand

We often strongly identify with the work that we do.
Is what I'm doing now in line with what I want to achieve? Does it make me happy? If yes, great! If no, reconsider.
#Kawaiicon @runasand @mjenkins

Please share with her over the next couple days and share with each other.
#Kawaiicon @runasand

Trust is different in automotive systems.
Dependable system can fault, but is mitigated.
#Kawaiicon



Many fault mitigations in place.
#Kawaiicon



#Kawaiicon
#Kawaiicon

#Kawaiicon @pink_tangent


Remediation isn't cheap. And it happens repeatedly.
#Kawaiicon @pink_tangent

"If you just put the endpoint security on the file servers, that'll solve the problem!" Nope.
#Kawaiicon @pink_tangent

Can they support legacy applications?
What about virtual environments?
#Kawaiicon #KawaiiconNZ @pink_tangent

#Kawaiicon #KawaiiconNZ @pink_tangent
#Kawaiicon #KawaiiconNZ @pink_tangent

Deploy to your environment and just see what it comes up with over a few months.
Test it in silent mode so you get reporting but it doesn't kill your apps
Needs asset archiving
#Kawaiicon #KawaiiconNZ @pink_tangent

They were told not to allow waste water to flow into the lake, so the stored it in the hollow bridge.
But then there was a storm. One pontoon sank & dragged down others...
#Kawaiicon #KawaiiconNZ @hashoctothorpe

#Kawaiicon #KawaiiconNZ @hashoctothorpe
They had problems keeping up with the pumping schedule.
Some pontoons had more water which caused torsion and the winds twisted the pontoons more. This caused cracks to open and the pontoon to sink.
#Kawaiicon #KawaiiconNZ @hashoctothorpe
#Kawaiicon #KawaiiconNZ @hashoctothorpe
(*mostly)
#Kawaiicon #KawaiiconNZ @hashoctothorpe

Keep the conversation blame free.
Don't make bad jokes
#Kawaiicon #KawaiiconNZ @hashoctothorpe

The key to understanding systems and people with different perspectives than you do.
No two people have experience of the same incident.
#Kawaiicon #KawaiiconNZ @hashoctothorpe

Things to avoid:
"you"
"why"
And more...
#Kawaiicon #KawaiiconNZ @hashoctothorpe



This isn't compassionate and it's not helping to identify the problem
#Kawaiicon #KawaiiconNZ @hashoctothorpe

What questions can we ask to get the longest answer. Different from what we normally want in business.
We are looking for a remediation item.
#Kawaiicon #KawaiiconNZ @hashoctothorpe

How were people able to make that error?
#Kawaiicon #KawaiiconNZ @hashoctothorpe

- Stay on time and on topic
- Practice interrupting (for a good reason)
- Who is talking and who isn't?
- Let's talk about humour (or please don't)
#Kawaiicon #KawaiiconNZ @hashoctothorpe




Then move on & never bring it up again.
#Kawaiicon #KawaiiconNZ @hashoctothorpe

#Kawaiicon #KawaiiconNZ @hashoctothorpe
Hiding malicious code in bit of memory that is not executable.
#Kawaiicon #KawaiiconNZ

#Kawaiicon #KawaiiconNZ

Who let this old guy on stage?
Apparently there is a code brown?!
A risk register line item that has never been activated before!
#Kawaiicon #KawaiiconNZ @Metlstorm

The loser can be show that the results are false.
#Kawaiicon #KawaiiconNZ
They will do almost anything to avoid it.
#Kawaiicon #KawaiiconNZ
Supervised (the government is responsible for the validity of your vote) vs remote (you're responsible for validity of your vote)
#Kawaiicon #KawaiiconNZ

Should responsibility be on the state or the individual?
#Kawaiicon #KawaiiconNZ

Difference is in the scale of the require conspiracy.
#Kawaiicon #KawaiiconNZ

Argument is it will cause increased turnout. But that hasn't played out in reality.
#Kawaiicon #KawaiiconNZ

More likely your disenfranchise a cohort without easy access to the internet.
#Kawaiicon #KawaiiconNZ
Need individual verifiability & universal verifiability (so everyone knows that all the votes were correctly counted).
#Kawaiicon #KawaiiconNZ

Doesn't offer what we want.
So why are we still deploying it?
#Kawaiicon #KawaiiconNZ

These are all done by Scytl - but nobody knows who they're owned by and people who look into it get shut down quickly. 😳
References to @SarahJamieLewis
& @VTeagueAus
#Kawaiicon #KawaiiconNZ

They opened up the central voting system to Scytl because there were "performances problems".
Please. No.
#Kawaiicon #KawaiiconNZ

They were sharing a SSL cert with... Lots of orgs.
Lots of bad bad not good.
#Kawaiicon #KawaiiconNZ


And they broke the separation principle.
#Kawaiicon #KawaiiconNZ


Auditor says its ok because the vendor is reputable.
But... They were breached over that period.
#Kawaiicon #KawaiiconNZ



27 findings, some very critical. And weird redactions.
#Kawaiicon #KawaiiconNZ




#Kawaiicon #KawaiiconNZ

Now its something impossible that is actually happening
#Kawaiicon #KawaiiconNZ @vashta_nerdrada

#Kawaiicon #KawaiiconNZ @vashta_nerdrada

#Kawaiicon #KawaiiconNZ @vashta_nerdrada

Build for resiliency, don't try and predict black swans.
#Kawaiicon #KawaiiconNZ @vashta_nerdrada

#Kawaiicon #KawaiiconNZ
#Kawaiicon #KawaiiconNZ @SophiaFrentz


Even if you consent, you're providing info on your immediate family.
#Kawaiicon #KawaiiconNZ @SophiaFrentz

#Kawaiicon #KawaiiconNZ @SophiaFrentz

Its not all bad! And electronic medical records provide quick access to information.
#Kawaiicon #KawaiiconNZ @SophiaFrentz

#Kawaiicon #KawaiiconNZ @SophiaFrentz


We have to consider social issues when creating technical solutions.
With technical solutions we're just amplifying existing social problems.
#Kawaiicon #KawaiiconNZ @SophiaFrentz

- Make responsible individual decisions
- Educating non-sector friends on needs, requirements & values
- Be the squeaky wheel!
#Kawaiicon #KawaiiconNZ @SophiaFrentz

Nobody else should be able to make those decisions without the patient's explicit consent.
#Kawaiicon #KawaiiconNZ @SophiaFrentz
#Kawaiicon #KawaiiconNZ @SophiaFrentz

#Kawaiicon #KawaiiconNZ



With photos.
And internals.
And... Dave's details.
#Kawaiicon #KawaiiconNZ



This should be fun! Basically incrementing a field on the card.
#Kawaiicon #KawaiiconNZ

Known vulnerability where you can use one key to calculate other keys.
#Kawaiicon #KawaiiconNZ




Will he tell us? No.
So Gallagher won't do electro-product testing on him.
#Kawaiicon #KawaiiconNZ



#Kawaiicon #KawaiiconNZ

Old cards just scream out their secret the second they're powered up.
#Kawaiicon #KawaiiconNZ


Try and intercept the communication between a legit card & reader.
#Kawaiicon #KawaiiconNZ

Reader says do it again.
#Kawaiicon #KawaiiconNZ

Not very subtle...
#Kawaiicon #KawaiiconNZ




#Kawaiicon #KawaiiconNZ


And... The NZ Government department didn't appreciate Matt scanning their RFID readers and seized his laptop... 😱
#Kawaiicon #KawaiiconNZ


#Kawaiicon #KawaiiconNZ


But for other people our advice can be because that advice would be physically difficult or impossible to follow.
#Kawaiicon #KawaiiconNZ @lady_nerd

#Kawaiicon #KawaiiconNZ @lady_nerd
If we can't protect our future old selves, how do we protect our elders today?
#Kawaiicon #KawaiiconNZ @lady_nerd


#Kawaiicon #KawaiiconNZ @lady_nerd
Being digitally active is kind of a human right. It is a substantially increasing part of the day-to-day for all demographics.
#Kawaiicon #KawaiiconNZ @lady_nerd


How many of these do we do in the digital space?
Most of them.
#Kawaiicon #KawaiiconNZ @lady_nerd

Diagnostic Frameworks for Daily Living
#Kawaiicon #KawaiiconNZ @lady_nerd



#Kawaiicon #KawaiiconNZ @lady_nerd



#Kawaiicon #KawaiiconNZ @lady_nerd

#Kawaiicon #KawaiiconNZ @lady_nerd


Mass collection of data!
Lets do a digital independence assessment for a country.
Refine the assessment.
#Kawaiicon #KawaiiconNZ @lady_nerd



#Kawaiicon #KawaiiconNZ @lady_nerd




@kawaiiconNZ #Kawaiicon #KawaiiconNZ