Yo Dog! I got some Regs for your Regs

much more you look fine to me thank you

Oh juice and you

you No

I'm officially

where

can everybody hear Moses raise your hand if you can hear it they can't hear all right good morning it is one story oh my god all right so this is the very obscure this is my right it's a talk around complexity that is our lives so i figured i'd make fun of it so i made it i mean the whole thing is i mean now um so my opinions are my own so if anybody's ever curious so my name is Moses Fernandez was somebody actually said we honored if you were kind to speak at the b-sides Orlando event and it took at the RT know you would be a great representative for the Florida into their community I'm not sure what

they were smoking about it I'm here so are drinking so right Cisco Systems there were small I'm a sans community instructor for their way back now the co-chair of the and if you want to know more about me just come ask so oh of course huge supporter of the lean in lean in together anybody here know what that is we knew a few people so so definitely want to make sure people see them so last i think it was about this time last year last year I had a couple interesting talks we talked about the noodle arms race as in culture and people and tools are not that important and really around whether asked the community to fit into that

Maxine and it was interesting right we talked about what i thought was the infosec armors so was the idea that things were kind of spiraling out of control and in the last 12 months have been really really busy so things feel that looks are live so I want to kind of expand my so sorry it has to be the one alright so first I want to talk about three pins so first one is around failure failure i think is a an interesting topic that we should all come to enjoy especially in this view any big your failed ever sweetie we are favored me um so first we're all curious people grow up here is people and then we don't wear a tin hats

in four hats at night only all right homie I'll get in this room and Butler this is just terrible i have to mention a kind of calm but we often in this room in listening to someone i meet our and we all start thinking the same way tag a hivemind metallic and so we all started thinking and assuming that things are the way they are you either go really a positive and anybody popularity says we are really negative quite everything is tonight high grade there's no good answers and spirulina so where I think what should be a beauty story is a group thing or hand minds anybody ever see me on Twitter you understand but there is a

high mind out there and that people start to look at that headline by the way black and blue all sorts of wonder what happens doing that hammering so one of the things I've realized in micro beer is that we seem to have this concept of a resume generating event anybody ever heard that term right really generating event yeah what why right why would that be a resume resume generator so I was believed in you know over the past year or so and so few things that I want to talk about what is can we fail are we allowed to as a community fail and be okay for everyone she decided to be a nurse I guess is here about numbers in health

care for about 10 years so anybody know who this is funny Alexander Fleming is famous for a favor while identifying is famous for invention penicillin and the way he invented penicillin was to failure actually he Archie had a contained and they're supposed to be are clean and free of bacteria and he had a failure in his own lab protocol and so there are two year for the bacteria boom penicillin was discovered what actually all of his peers thought it was that crazy or that he is because they couldn't replicate his conditions and the truth I rotate them because they were working in a clean room he is actually replicating it was he had a breach or failure in his lab and

introduced force was invented so failure but gonna go so deep into happening i talked about airlines and airplanes and and different failure scenarios you can't help but wonder if really the people that are responsible for some of these things including um okay so perfect it down right you get a balloon filled with some kind of gas it's close everyone does Twitter doesn't happened um anomaly flies and running balloons yeah this time did your blimp it's fun but not our normal mode so last year all saying you know this is a this we've got this situation where we are in a panic and everyone's an answer now but he got super blood answer right now because we

have to solve the security problem immediately hackers are bidding for the ball and so really it's because the marketplace that you're in of generating going to use just the way you work as a society the world is unforgiving and so the security guys have to be perfect to get an imperfect especially not publicly so here's what we should be asking that's one thing we need to think about and if we can fail well one of the consequences of me failing should actually does this seem to a anybody hear her DevOps cafe oh so I should I talk to her when i get about him you know that their whole concept of culture and community in a elevator and

really these talks are around the same thing so one of the things also same tells us he interview sydney decker city better a few folks here really also interview with him and it was great because now i could take some of the city's actual words put in sliding and i asked him hey can I use some ear fold so he said yeah absolutely and so that comes from for his thought process around safety safety systems and quality control so can you fail are we allowed to fail and if we fail well then work how many people here are taking down arrow all right okay awesome how do you with your fire soldiers even watch just watch how

people here would fire give you the same thing twice okay however you do the same thing three times there is no few times huh I mean why I don't know why all right so let's let's explore this because that is we are using something in this conversation we are losing a lot of information so what happens in a lot of places is you did no one ever and you need you have to take the personnel and privilege Frank and so what happened is my name is still incendiary

as we came out you burn which and anyone solved nobody will ever do that again we're that close well so then you get into these weird areas work who's doing weapon nobody's doing anything right yes this little house a grateful is as soon as try and signal down the failure or whatever it is where the field was Miss keeper two of the six of a few individuals in the system within ourselves learning we don't know why that person did it because we did the most for area or the evil thing you can which is I understand only did further know you're under then they will see the consequences of their persons actions right so that's a problem and so we

think that we are actually in control we're going with complexity on total complexity where people and that's not true so we start working in the environment right nobody does anything right because if you do anything do we [ __ ] it carefully so making any changes changes a bad evil and I mr. falling behind in the market this early years older went to a place where they still had systems operating systems and stuff from the landings as they're ubiquitous really apart from the desktops and you wonder why don't you stop what we can do and so you have these guys gonna be busy cuz you busy stuff Billy change there was a river ok so what fun is amorous book services or

just responses here are almost never almost never the result of guy perform a trick performance reviews immediately why do you get monthly package that's not right all right all the network went down immediate for me that's how it should be awkward and so there is a result of just improper relationships remain in a minute please or something and most of it is because I've heard talk to you inside all right you got to be the best together be number one you got to be the one at the top or you will be only the strong survive how many of these names are familiar sickly a farm bill actor and about microsoft where around me touch tablet things right in the same

thing headed to the enterprise I artist a feeling it was of the top 50 fortune 500 companies of this country of this technique only for about forty percent of all directions arrived

and because of that because these destructive anybody we're going to creative destruction and what does that mean create a disruption that means people are gonna come in and take over the market because you can have it and so that's the just what we face and so what I'm going to go back first lesson that I wanted to go home today is finger in a sense is a good thing as long as you take away something you have to feed back you have to this is an engineering science in a lot of ways but it's not a known quantity so you have to take something back with you there first and why do you say so the number one thing

is failure in a sense is a good thing

well because we can't fail because we have to be perfect in a young science because we're not allowed to be certain things I fear is coming so I'm going to call it up right now see if a part of it its nature I'm not a lawyer I'm not your lawyer so cfa there are channels connect but if you want to talk about is this which does he I think but at this point these numbers are sent to wash away we carry market Oh another 500 million credit card numbers and other hundred million medical record numbers I think about 35 so I'm in a database swimmer this is not include sony this is not include income or

primero this is just some so we gotta talk about regulation because I just have a few have some kind of recognition and the lawyers might say no oh it's not we're going to reform it but I have a feeling that at some point a hundred years from now something so if something's going to happen well from the car to the team will talk about a relationship this is a part of the talk that everybody needs I really is very healthy huge thing people out on the streets you know Wikipedia is going to go dark all the fuss is gonna go doorstop certain campaigns this is the fear the fear is the clamping down of everything no here so what we do is say

you know what we can now replace the air we're not ready yourselves that's the answer so provision so anybody here went to Andrew I don't know Andrew those a lot of people talking about oh so Hansley there was a lot of everything that's homestead but that's bad and I remember that lead into this world when we have no right enter the perfect example we probably needed better housing codes just a little bit so banking regulation to me anything you like history history history so i can see it's having our way of saying bankruptcy so what is the history of man 30 well Monty desks Monty changing tasks existed Madison's mother this is an area where people going

exchange money to get my nine and when the money changers ran out of mind berkeley where common banking thing don't quit marijuana and then they would signify that they were out of business it would simplify this by literally breaking layer batches to mention a break right now and so that word right 34 if you look at most modern day baby runs where people say it's a form of a liquidity challenge right it's in the form of the bank is out of money I better go get my money before her I can actually use them right and if you think about America prior to the Federal Reserve when you had a putting a child before ftse brother when

you had a liquidity run I told the FDIC the Federal Reserve good or evil whatever it in four hats whatever you like they actually do stop guaranteeing money so that you can stop the bank runs and stop making things next that's a constant we can talk about 2000 and we've talked about 2008 and the banking and shadow banking or whatever this is just the historical nature of bedrooms first your variation is an example where regulation goes bananas um let me get her phone down he sees how many 649 but I had anyone to see well this is why you see the urn system was highly highly regulated in the early days this is a holster of you

should not travel because world you don't support the world right um the NTSB was very uh walk down right travel was a highly regulated industry until the current administration started a visionary eventually the airlines you still have some fallout from many many hundreds of years of airline regulation let's get a little better now you're not going today 400 month now we have all these issues is deregulated is their example of deregulation good the problem is or the not the problem but what they did to make sure that the airline is still be good it is a number one thing in the air on deregulation air is safety if everyone's followed the sky no one's gonna fly right let's go back to the

Senators ancient Rick my credit card gets breached does it really matter mean right is it gonna do walking to the car issue because it is no affect anybody but I was falling out of this guy I don't so actually created a market if we market um but safety was in a month no so what is here we already have the cfa we already have Kalia we already have self-regulation pcrs of renovation that's what governor so private company ish where do you see tirate sista people as under orders ever seen Holly Tekkit warriors recertification federal kind of laws um we don't know great I mean we do see that something will be out there one of

the biggest I think we're going to see regulation other than the fact that our credit card and our personal information is continuously increased is in a form of this this is a Bluetooth rfid-enabled thanks maker right so peace makers are interesting they just leave no parking and doctors don't want to keep this technology so why don't you two booths you there are bitter civil to start to him to to modify please me well if somebody were to find some uber and all of a sudden stop somebody's hurt or playing around substance work how many corners for how many detectives on a prank and so that's a problem right because there could be some problem i

wanna hear when I'm tracking you can kind of just make it do something seriously energy to a person as in it works and so because of things like this you have seen relationship where you just can't put internet has hatched devices today right that's that's that's tough that's one of the reasons I think regulation you might be fun however just came in regulation go away grandmary nation airlines and governor all right hawlucha house is it already plumbers in your house barbers you're going right so when somebody talks about regulation in a little scary I think some of it will be okay it's not all bad it's not all there so we just need to be aware

hopefully you're contacting some point so is this tour number two the last thing that I really want to talk about this will be the majority of the conversation is where we are as a community today to see in room those people that want to hear others vehicle tax and everything in a born near there however does not want peace of the other things that there's a better word or before it's not hopeful sign so if you want to know the way forward sometimes it's good to look backers sometimes so far but I breach 1556 right so this happened and like things exactly the other side if you can either [ __ ] 1 MPA or talking about it out of turn or use

lie okay so nobody can really say how this app okay let's take a better case because this is a bad case this is the case where unfortunately who can tell me how this happened the same weekend okay so can you do it on a tractor right and you know the time is right I've seen this before that's how we just happen because or because we did your honor people that work in the city known for that I told us so this is now common law at target was in fact we all agreed its peer reviewed and target being a jock means a martyr to the PI because all ipad cyber we're so important that the whole company's

ruined because of cyber swear but we can explain this part where they're worth more to it anywhere they're there most of their cyber that's the answer it's not they could be another reason exactly why all right so I mean it's true that the muscle fix fiber camera or doing some other kind of mechanical business move was not it because Sager was a reason so fine back to me I saw this the other day and I said yeah divorce from Harry yeah people are the shareholders don't understand cyber we don't measure cyber security and we have no impurity in fact so therefore ignore that vaio soft alright this is from the Harvard Business Review I think that it's a

really good reason why I start Martinez of it is but target is to leave oh I know it because I'm a cyber security guy in grandparents told me that feature look by a gentleman named Charles Duhigg hey may I read this book oh we gotta read this book this book is awesome how the power had that create patterns in our lives and those patterns subconsciously or consciously a faculty you he talks about somebody who had a really bad case of emphysema affected his brain he lost the long haul to marry me he had even were one in five minutes hello however he still knows that I've used about him making a new house because he thought it

so often that its literal he knows how to get up he's about to be asked him where the bathroom is he has an idea but he would still be there no there's actually a company out there I was able to figure out what people were pregnant before already this whole Yvonne has anything to select the middle to late two thousand super innovative company yes gonna trouble for setting courtesy coupons so changer um but there's no way this company knows that Amelia could have had a cyber security issue except was Bernie so target was this innovative company when I came to be back here right so you're left in this question huh so if target is innovative I don't know which one is

it you're either really get early that so do you have stretching ahead so torii gate is a mystery to me I don't think we know a full answer on the game is my performance are those who work hard oh you're going to reach response team when you have some kind of relationship there so we go back to painting good target have had some emails for me so it goes I remember this is a kid this was very the coolest in your therapy is here was an extra piece of your mind now I don't know but net but the cool thing to be with astronaut you were like a modern-day Explorer who's really cool we also mean I was being first or second

grade and we're watching our teacher going to space pitbull yeah that's pretty bad so it comes out to shuttle complexity and what happened so gently explosion I don't know about this we know about this because there was a commissioner for up challenger explosion that the NCS be participating in your own jurisdiction but they participated in it and we found that there was a technical issue with a challenger in which is open fake well how did the o-ring fail and over theater tank explodes published by assets so the only manufacturer actually must sign off on a la Jeanette Lee because supposedly the mob stepping in parables to pee wees you know if you use for a while for

Austin morning Barbara the nervousness of the organs at 50 degrees no idea what happens in 50 degrees whatever happening was NASA had been overrun with what they call go fever lot of systems very complex all these systems check out on someone please don't want to lunch so they want to go and so they launched anyway and I was yeah that was a failure but we reconstructed this over couple years and so that ball is how we know what happened technically and operationally at NASA so tell me how did at her party so I'm going to this song we deny ourselves an immense amount of learning as a community because the only I've looked it up i waited all the commission

reports from the Senators party have me as their channel for understanding these events I'm not saying that the meat is bad i'm not seeing investigative journalism is bad but you know where is it peer review you don't know maybe nobody so here's my urging my idea is that we do we try to anything what business keep working so hun business people learn it yes you study group and then they come up with something now you're saying well you know how would we mechanically do that for our field is only 30 40 years old it's not the same here whatever you want to say about business medical field recorders or accounting are tilted those of you know

so I don't do this came on but this is kind of a direction we need to go in because if not we're just going to keep paddles over-regulation comes someone do something so I hate this picture here this is why back of the neck napkin math I love you myth had to do this it should be sold as communities pieces paper not my back of the neck in math five minute dire flow there because it all sorts of problems with this when I how'd you get entity to commit a technical and operational hi Lisa there collectanea what questions you ask your students to pick it's really hard it's not that easy to just say boom it's

done what we do it heartedly it's a big effort but I think it's somewhere we need to go so i thought i would propose it the concept would be simple body it shouldn't have a profit motive look at it yes you can when you finish school yeah but those kids schools are hiring funded so that you do have a proper order yeah but they should be also biased because the people that are attending the schools don't actual is work on the back to school so it isn't it is socially appearing here should not include speculations that's easy right that's the easy part me how he's move the hard part is how do you know nice

David should you another mine seder who should you an atomized right so I the apartment of health services it creeps to have the government agency is that

there needs to be other avenues right there needs to be a way to figure out if there was a technical issue an operational issue how do I team business leaders know what to do they don't because only those in the network right don't have the experience I don't give a today's talk about 300 degrees your hand perfectly okay right holy [ __ ] up to fail because we talked about the stock price is not time to the cyber breach so then what's the problem why are we firing people right these are all the cultural dynamic things that are happening that we need to address because I started as a bunt but I no longer necessary across right

there were mean sea level d key positions mystery city night cause of ep one of you my name is fired because i didn't put in XYZ product like if that was going to be gradual so hood that's what you thought about here here so we need to think about how to start finding these problems and finding the answers so if you kind of know measuring is one of the things we don't do very well right but if you're gonna build really cool cars you get a visual on I was mechanic before measuring we ever so far mine photo for my cell is called and said we should you should here to talk about stammers now people can't working just saying and

so samurai swords your I was like really as you keep it talk about samurais schools sword papers papers so what is a belly what do samurais fourth dude huh if you know thanks 500k that's how to kill it is all samurai swords to figure out their effectiveness one way of doing it is to what amulet killing um the other way of doing is actually kill people

each other so max he should go over there the Japanese open the box and we immediately close the box and we turned every single man that was an apple to user with apple powerbook me so what happened the Japanese realized that body control was time to even feel the packaging so the manuals weren't the right way if the actual machines were not the right word if the time he was not the right way then the quality of the entire product was subject to question and he really wanted to go in a lot of that comes from this your con something they're based on a fatty part is hella hard at work you want to relegate there so everything was

measured everything was passed down everything was presents so you had the ultimate condition and they didn't have it religious chants there will be in effect the chemical makeup of the tour so that's why you're passing oh by the way we head on a better issue called that sushi and perky I'm who has that samurai people in the feudal system they could just kill hutch initial 10 just one round ten people are you stressing the sword it was a factor so you got they were doing a Malaysian right they're actually looking at rights and but people cut out for white people too so sometimes if you wanna get good you want to measure and you want to know

what's happening so he doesn't finches her people are horrible bad but we're not learning how they do it how to stop it and so they keep happening over and over and over again and we're just like yeah that's bad we saw his entry it's not reviewable because we don't know how to measure because it's the kimono are you going to keep close we can talk about your boots our friends over here and nobody knows so we have another interesting issue it lesson which is how we incentivize people all right wheel centralize them by robots I believe your participate in a book bank in no pods no bugs but you're bad no to all of us and so I

remember this in the 90s and I was like wow we've been fighting this this is a comic from the 90's I was a cure we've been playing this problem for a long time we're just going to write ourselves a bunch of minivans and what we doing hey write a bunch of bugs solve the problem no software flaws right so I'm just moving for this track to make sure that everything is green pill bugs are bugs are bugs here we're all still getting hacked in hacking right so this is obviously work we don't know so maybe what we should do is licensed under miss your license ball that's got yet if his license and everybody knows how to do

this they're just perfect two times not turns out that licensing is a challenge for a number of reasons because I wrote this office and one harm me well professionals how many people you think we are professionals I'll be doing here engineers architects hikers tickers that's no profession so time looks really long question discipline so we're actually we're actually a job we're actually just modification is a very good reason for this we are actually occupation there's not just study that came out by the National Academy of professionals I think it's a cybersecurity is a broad field we can all test that for educators whoever or whatever which needs of an inning however professional nation is something

that can happen for certain people are the sort of time we just you do that Washington do now cybersecurity reporter and report we're about a million people short and if you started to listen to people now but you go through school tane what you started that's how you started in the summer of 2006 and you graduated any fall of flowing time big time okay well you started your college career with bloggers and you entered on with icons so there's a disconnect right so now everything in our field can be just happened so certain disciplines wanting to be mature that's that's that's part of the issue going back to this if you don't have a good organizational

educational body that's looking at security things like this start to watch way right because we should have PFC people in tomorrow how do the taking of data bullet case study anonymize data related to that it works maybe that we learn from the states of the people in the last four we go and you describe with these bugs all you're planning but that was an initial class or cash crops so before you're discouraged because the something that we do not do very well we don't measure her now so we had a lack of peer-reviewed documentation there are HD papers on classes of those plaster but nine overall mechanical a hey girl said of you not share lessons from these

breaches all to life like I said how do I'm depot happen in order we do a few things well we didn't try to share stories and fun hey we kind of do these peer reviews right if you come out with something and say I am but I'm world number one hacker Twitter doesn't like that we do have our language well I was not important having your own language like a doctor means we're on our way to this who do I see the game will be plugging our CISOs that's there I know that people but the original auditors started out as accounting folks because the original IT systems where accounting systems so how do I see that

that tibor how did your CEO of your company said how to get there so before you go off and listen to people talk about Liverpool I have story about a profession so I started off like ours that potentially is there for example deliver to nurse but one of the most interesting meanwhile bear seen is that long time ago we had a storage of people doctors immediately more care something and so the problem here is that you just take people off the street you show them how to assume somebody and people start dying in their rooms infection instead of the initial reason that you're there for seven Gail created a methodology or an actual structure for our treat people

right ready yeah it's crazy if you wash your hands or if you had watch the tool that you use depends on the player bacteria doesn't happen so crazy story anyway so this person some end product of years different nurses became researchers became philosophers became people of thinking status and so you listen to their work and you read their work so kids are only doing today we are at a point where we are at the quote unquote precipice when I feel the president of our field and so there is an opportunity a real opportunity to submit yourself in history now when you're a kid you think I don't know jeez world and you got home or you say maybe I don't want to change

the world I can't do it or too old but let's say you can there is opportunity for every one of us to really cement ourselves in the field because if we're going to add a many people winner and so that's a purty to leave your mark on humanity because with IOT or we'll be back tomorrow and so it's now so I say thank you to these sites community for having me comes on and draw the day if you need to talk to me or see me i'll be around and you can find me here that's all

you