Shall We Play a Game: Better Living Through Wargames - James Powell

[Music]

[Music] [Applause]

[Music]

[Music]

[Music]

[Music]

[Music]

anybody's in the urine I actually have had my my perspective should be a little bit realizes all the tools that I use to happen to love its machines Windows machines go here to work in bringing their the same tools and the security professionals use they just have slightly different perspective over using them in slightly different ways and it's so it's years later I was lying up but we got to work to talk about it's not really that much different it's actually true but it kind of took me to stop reading this to get that through my head and Coptic episode things are coming up so so people even thoughts I just assumed that that's personal

against ever more games and after the bike challenges from the but when I started working the friends of mine are also even an IT none of them ever to that so I was like okay well how do we did that out there how can we you know start shifting up in these perspectives making making an application of platform security rights so it's kind of where we got to the top so that leads us to you know what exactly are these after the black challenge we think there are more games and how neat so after the play anybody probably participated except for the black challenge it is basically the in information security competition so they were very different for Ronald

Rivest Isles there's a jeopardy style it's kind of speaking to my training and so what what that means is you've got like you can attribute it's free you can have forensics analysis script or reverse engineering a lot of interesting things and which usually worked in different set of tasks sometimes they lock down the harder task easier tasks sometimes you get a big black horse what you want to and the way you get points it is you saw the challenge and get apply your submitted once you've been team competition in the CTF towns and that's actually good because you can diversify your sister it's nice I think those famous example of this is the DEFCON CTF qualification the YouTube the

next type which is the intact events syntax is kind of a networks you have attackers we're trying to try to attack other teen servers you're also trying to fill your own servers and the more attacks you pull off and the more visible all you get an attack any of those points this is actually the first type of CTF there applause there's actually really easy one to set up if you want to fire Rumble it's called networking the middle and it's truly to set up need to put around with it on your own it's free in the most famous example this is CTF which is the DEFCON so you can't miss it Piketty and the individuals most times it's easy when a

diversifier skills in 20 minutes very fast CTF time or if you're interested in any more digital offerings and say I did pretty much the lot there's not enough so this is a pursue a different type of Cynthia challenge which is important there are mobile time you don't mind in action pull off almost always the single-player finish your ss-18 into a machine and I'm trying to get to different levels it is very much the fact you start off with very easy box and they increase in difficulty and what aim is good a bit that's a pretty difficult so services the tea service value mostly hasidism market smashing sack its next act is more reverse engineering

people with this so he's never run in the back actually read this alright so you know this executable called level 0 let's see what happened we're on it is we're password password fell off and they just kept increasing than they thought meaning you don't be pop something out for its that's not password so let's see well we know it's an executable that's a vision II didn't file a nice easy actually sorted so let's see amazing utility called strings

so chop the extra when you see it on the screen be Sox leave a try

and I'm due the first coffee shop in size actually and this would be this weekend for your past work to get to the next level or get job I'll see you basically want the next level good SSH in that password football next challenge

so dizzy if it were spring that's basically we're getting a transition to prep on actual greens and to player on traditional medicine so know we've talked about like certifications you know different training education all those things different kind will double your beginning out especially with your Arnette not me you don't realize even if you don't realize what the right questions are most of the Africa time degree drivers that into the computer security used to search for things hit the ground and took out to the conference's so once you start with even hoppy as a set of books I need Oprah I started reading a lot great books you did better here because you except make better view make good beer to know

how they drive you but but most of those things gaming buy some stuff but he your security the first thing you realize is well what one of the people the radiators in the field question to my heart sometimes it's very difficult over to begin so majors up again and there is this amazing company you start searching you sign these letters are now signed a contract security full squad for secure command security box every day these little pieces of things as I've been before it didn't really help me with a lot of triangular because be better disappearance so well I work for company maybe it'll some get a training the training is I saw the prices of the

black at training and after they locked me up the ass up my desk they kept looking at and they passed out when I kept doing that and then you also sign up for that training because if you're got paid best money and you have a dragon you want must be able to give them something back to this to do more training since I'm doing this training I eat this is my you're an amazing book Richard several Mason looks person I was introduced to this block photography back in the day he is very good considering the next and so let's say that I was hooking up sit down the Bruce and talk to him about Neiman's because I tried to be positive

freshman in college it's very dense nominations here I took ready to be policy here once again and so part of it is local knowledge photography there's going to be a point about five minutes into the conversation we just goes right over my head which tell me one thing I probably built analysis or cryptography tell me you're gonna have to simple to anybody who's much farther ahead of him in the field because it's very difficult for those guys right now they get was instinct to the level or an extra a beginner and get into so we've looked at our traditional about this we've got the introduction of games games helped us tack keep the biggest transition point

where we can't start more effectively using the books the training you know being able to search online knowing it's around us so I saw TED talk which led me to the book reality games make sure for my traits rules feedback system and voluntary participation so this is you talk about how gaming basically changed her life she be made realize that places are talking funny video games begin do not wish to drill out play video games they actually can teach us a lot of things games in general and make you better at things and actually there your setup is what else so let's kind of very so in a game there's always right I mean everybody just like Marco you have to

get to the plaque even before the time runs out how did your goal try to collect as many points as you can along the way if you don't make it here it's all so it's great because it's a clear objective you're playing the game sometimes will even provide you with help long way that's like on your quest they tell you where to get what's kind of nice and there's always a solution for the problem because there wasn't a solution it's not relatable this is great for when you're playing warnings yet because if you just said I'll say well I don't look at let's say the most real just forgetting I'm going through this today I'm gonna take one of the packages

there I'm gonna find a hole well there may not be a blur the way give them a little more all right they're probably but may not know where to look you may not know where the source code so you don't really have it fine no in the beginning that's what you want something that you know you can answer you know you're not you're spinning of those so the next thing for a lot of people different rules probably something like following existed so this is the greatest edition of Dungeons and Dragons ever existed and we can discuss it amazed at half years so well actually this kids deal is about democracy it was this nice sandbox to

play in and that's very comfortable to give them as Majer beginner you need kind of boundaries in the wild they also give us holes in the fact that if you look at the rule to the system they arrange abilities that are not rules and especially the working stare in the visual arts is aging into this box you can actually protect you from the cheaters so once they get and didn't steal if you fulfill the answer right now I'm sure you get all the work that's that's not so the sauce to be honest we're playing a game which I'm actually one point for people who are trying more than skill because if you have the office yourself and you can't cheat you

find the into really easily and get that that's that's looking it's actually madness so feedback sis you mixes and Ross good you get the flag or you finish a lot you get immediate feedback if you relax if that's something good everybody Mario and drying so good about you die and where you get four small and that media tells you you pretty much suck at this game you should probably try to better and that's the great thing about it you can easily find where you're still up in these games like this may be the first challenge you don't then it's inside to the next one picks you about eventually used to difficulty level you to stop great value what

you're doing games are kind of meeting that they practice upon this feedback system your training readable you may not get a chance to the exercise of the comic book until a month later then you gotta find the book actually many minutes in the books what you need it's a bit tricky for a lot of sitting speed backwards to then reinforce something which makes involuntary no one made you do this you're doing it to yourself seriously you will give it up your grace on you side the bloody big you're honestly getting business and no one pitch builds you think of it no it's gonna make you go to game let me draw it right here you little it's pretty good

friends that's true okay so that says a job I used to admission great goal problems those guys yeah this you know so you start by altering gain get to this point where I remember at one point one of the challenges I was at like three Google's heads up and I was reading about you know the inner workings of shop 256 once again remember I'm not that good at now so we need by - this is not my idea of fun times per game but I decided to play just because I wanted to see what the next level is gonna give me as a challenge and that's what makes games of these because we're people I'm gonna

train me of course the vicinity watch that meetings we can you know we can grant policy down on top of them and they're just gonna ignore us but you get them to do this to themselves and they think there would be more kilometer but they're going to learn something before any time and that's kind of nice there is actually and it's actually most of you get small people City Missouri and the IRC channel is a SAP you have a huge support structure you're not at this on your off and these games give you the framework to start asking questions decides you know the one I see every day this you know how how I do

something you know there's not great where there's no scope you do this you know it makes you it also don't your people are previous look at this you didn't have people are coming here not of your home so we're giving you guys hot background is not me in security expert and that kind of shows you why games can be good doesn't actually make a difference in in and make you better at security particularly in cases I've been studying that's been an application of hot food security so in it make coverage and think about so if you're coming or actually tended make people eat your systems more critically and you're trying to harm them I think in and I

definitely hear so the thing is that if we're talking about very taking people from a developer's they know languages and not systems for you know this is that means same thing they're very good that understanding how systems work it's what is it they're all their systems maybe what they need is not so much new tools the distributed perspective I got a couple 13 and I realized about my opinion and I'm certainly understanding that all these tools that I've used for completely purpose to be easily used for you know actually even the compromising system is for even showing whether we this is assistance either just trying to play how am i consuming so from the matrix or

ground you hasn't really changed just your perception of reality we don't really like in this you know you know but all the developers in the world this is happening they're all to say that's this is marking up a security professional I'm going to be an interesting test we just let these yet to be better to think more critically things different than the systems they set up so that you know all the guys are doing their stuff asleep it is a four that leads from the activity perspective is even of a pattern recognition so you start see these things you know I didn't for me it was like and this was just a simple predictions their weight is

really big so you start relaxing these things purchased it was a sort of second similar to you than the as you playing the games as you keep practicing these things you start seeing things quick very quick it is it actually begins to nobody said they makes you think more about okay well this is something that's a considered very easy level I've seen it on the Box I have that's how we've had probably and so allege as you continue moving through this as you continue to get your patent or initiatives better and better and I think that Americans right now these social people who do kind of think we know everything so it's very it's very

part time students people good systems my own abilities whether they're kind of my head over the least because their immediate reaction is no no I had the same and you're wrong as I return yeah I don't find bugs people keeps you start taking ownership of the things you find your novice you're not afraid of you don't like these things happen but if you can recognize that Baxter you can fix them and start learning how to write could have better purpose you start learning how the part of the systems a finishing recognize all these important movies and you know block this does sound a lot of hard work in the end but let me chose computer because it's easy

it's difficult news live like this so any tabletop bands will we be able top on YouTube that's excellent okay so if he watched he take the private oxpeckers so the vector vector is like a game that you can get you know you may say games the deep relied on your huge nerd in an eviction records game you can introduce to the not rhythm you have and get them to plug in for the velocity are probably great people so brief so that I listed in my walk home Baker sitting from unit swap ready for her pitcher and then I ask you guys to participate so hold your eyes I promise you and will not be something terrifying

scrutiny open in my mind with that content even put your eyes and I want you to do is take back I'll trigger the first game really captured here is his older one to the first day of the wall give me more game to be apart in Vinci immediately I don't remember exactly how he felt the first time did you like just absolutely God open your eyes so yes the Green River that feeling right it felt like even property or multiplayer you're unstoppable [Music]

absolutely

[Laughter]

and Lowe's is we actually up or even you know working at the red teamers and you just truly behold someone system I mean three that was that to the two things okay the reason why initially got to the security because I was there's someone there the nice thing about you CCM working challenges nobody comes to arrest you can you compromise that system there why's that so decide that evening it's just a game right so noble it makes my Mario your friends make our you know what insert your game you're going on for people who are a little bit older know what made you do it you get that you can be terrible friends and it would like something to

get back into the little planet right so there's just lower threshold okay it's just not so you know people would say oh security is really there's things they've already done we certain what there's a gap in your knowledge right you start becoming convinces people I know it can't mean it really can't be this easy I should have realized this earlier all but when you start kind of gaming you kind of read that virtual I finish and know this and start trying something new and then it feels familiar user lies or good at this they start trying to find more difficult challenges it's not to know which was a minute things if it's just a game

who cares and then if you stuck your comments at brilliance you ask for them you know I know when I got some life he was little to me by the minute I ran by headed into the same room all three times well now and the intermixing they also get the gallery someone actually let me stop the next and some of her down while you're doing you're trying to do but it was a game it's not trying to figure out a problem but it not enough I see play museums learning having over that threshold it has actually helped me to ask so i'ma know that's way to handle the certain algorithm but there is somebody at my company youth dollars going to be

the flashing them makes the software back it's a nice thing and finally it's flop like you know laundry a plug-ins because they're fun you keep fighting competitive on that's basically doing that remember no the walls playing these games people have actually asked you to come play the games they're opening the garlic just means you're not going to get vertigo that's a very awkward parking you start talking behind in systems is a game differently went crazy and like with a stronger with all right so steam back briefly cover will be talking so do I use the word cyber irritating online this is the word cyber is really CT network games are games that security experts is treated people play any

person that interested in operational security or information security so they're these games are games Neil pleasure challenges and conferences interests remodel and that's great as its choosing homes and seals and they can increase their there especially these gates ones without talking about their application and platformers any place that it's not that we wanted not here you can almost make these guys exactly what you you just hold them to kind of have that little oops the back there in it says what here else to do is that and you should stop

[Music]

not very popular party decision per se but gamification of everything we do every form that we contribute to whether we put stuff on stacks some slower learner has to be use it back is points you earn in here need to get that instant recognition for what you're contributing back so I can use really interesting that here you talk more we'll look into that develop out some more on how you can apply that someone mine is actually why the security makes makes us as humans and I find that good-natured hey you the top for kids to have because it's very you see there you go through the worse thing that is you're going through a common courtesy

just breaks your system it's like it's the hungry laughs he talked about eating Maslow's hierarchy there yeah this is cool there's nothing else I'll finish early [Applause]