What Dungeons and Dragons taught me about InfoSec

it was a joy lost knowledge this presentation is swept under the Dragons tell me about necro set so i started out i reside with pictures that kind of try to describe me edit thank you Frank

so just a little bit back after I'm having really a 12 year old stuff in the 32 year old man's body I like my vocal exercise science fiction starter I like bourbon ooh yes hyphen cigars so in addition to having really good Louisville bourbon house every time two years old bourbon on here's the Gulf house Friday night so tell much i like it into a DB tough up and something to her miss Alden evening terms though I do move my mind starting to shift a little bit at attentive host equal force academy tool I mean it's more about me I want to be some of his flavors I actually got talking to what's wrong with my presentations that saw

this fun event so all views and opinions in this presentation or my own and do not reflect the opinions or beliefs of my employer or any other affiliated organizations so don't worry angry letters remember I like it feeds me sort of legends of dragons never played actually a current asset but should how many in the room in action plate you're at a hacker thank you so I really get this presentation I thought the Venn diagram of like dungeons and dragons players and like DVD players would be very late but oh it must almost be the same circle no actually I think first one did the presentation to people the room actually the answer that as an

affirmative on a room of like 20-30 some are people so I was a little surprised but you know it's it's a standard role-playing game you know before with a shooters role-playing games were world of warcraft DICE's character sheets lots of robots and all these things came together and the little ventures as opposed my presentations I enjoy searching the internet for things safe mode safesearch being an optional function so I always liked this slide it's going to be what people actually think we've done this with dragons that play you know it's I think it's very true I think it speaks a little bit too to the mentality that some of the people but also to the way that people have

received you know people were I think this even come apartments to the point that spacer was talking about earlier date has talked with use talking about this perception we had the quotes from from the director and from from the head of hair for Cyber Command basically talking about you know they very much hinted at these stereotypes of hackers and inviting professionals in general I think and and so if you know you see a lot of that here annoy people have perceptions so the first lesson that kind of take out a ton from dragons is that it takes a team you know and by that in those & Dragons you have to care the important thing to

take away from this is never whether it's done from dragons or modern RPGs like warcraft you know pc bae systems they all have similar constructs and that's because most of them in the end they're somewhat based on letters and dragons so all those games have different reasons versus have different skills and abilities different traits we all have different they're different classes which had different skill sets right you have you have combat and physical characters like barbarians and fighters who get in there and beat the crap out of everything you have naija users you stand in the back in cast wizard cast spells and heal people and so you have different classes that have come together to make a crease of team

because you know one person alone can necessarily do everything so whether it's Dungeons and Dragons you're going into it you know you've got your Dungeon Master they're being the story or you know you're playing modern role playing games and you've got dungeons and grades all these other things you know you can't go in there by yourself you need to have a team of people let's come together to make you stronger than you actually go again searching the interesting too much actually did find a picture with somebody to kind of explained classes and legends of dragons using the Avengers so what class is a nympho set so I kind of trying to break this up kind of give

a high level view couple classes but it's not strictly speaking all of them right you're going to have developers guys who are great a code who build the programs that using who may build the exploits that you're using their testing writing the scripts that you can use for animation whatever else they might doing you've got you venture metasploit masters you've got your pen test teams you have your guys who go in do your testing their skill sets are very driven behind us behind those totals functions we have hard drives right guys who who know the ins and outs of tribes who know who know how to how to configure maintain computer systems most abstract want to have up here is the network

gurus you know guys no water shark you know the man who you know guys who can look at a pcap and can like figure out exactly what's going on without any tool except Wireshark and a couple filters they're like this is exactly what's happened there's dozens of tools that automate lots of that grade you can adjust all these P caps and I'll show you pictures data flows but you know you spending in those nothing's perfect you still have those guys who just do that I'm looking fo essence right whether that's desktop server based it was folks or mobile guys and a lot of times these are overlapping other areas right because your developers odds are going to have some

specialty in one or more of the operating systems because anymore with all these mobile constrained architectures developing is more restrictive than just writing hey I were ansi c co double column in the system and it should work so second we got that so in Dungeons and Dragons a dispositive multi-class you know in the real world we called the jack of all trades but it's very you know it's this idea you know somebody who's good at multiple multiple things you know there's the same you know jack of all trades master Tom I tonight the disagree someone with that I think you can have somebody who has a broad range he's maybe not good at all of the skills but he might be

excellent at networking but and it goes to you know he might know about hardware he could be you know good dad or or have we're just having our general skills and other areas that may be useful another portion of Dungeons and Dragons days alignments and the first time I is limitation I got really bogged down into the alignment and the second time I did it I further clock down to it because this is one of the questions I got asked was why don't understand the alignments and then I realized something important this from the projector this presentation which is it doesn't matter the there's a couple slides out of here that seriously it's not human ok a bit like a so so the

important thing here you know with all these isn't so much to get bogged down in the wherewithal and how to's of how characters and classes and alignments work with in Dungeons and Dragons but the thing I think that is most important and what I'm trying to get across is that it takes a mix of all of these things right so you can apply to some extent people into different areas and alignments and you have to have that right in the agent we different personalities on the team if everybody is the exact same things the exact same way and has that same mentality you don't have somebody who may not just about that person who's can look at this

from a different perspective and be like a wait why are we still doing this the same way if we did something else maybe would work better so I didn't leave this one extra sidelines kind of clarify for anybody who really does care display the good versus evil that one's pretty clear most people get get the concept you know Cary brothers affecting the innocence that wants to kill everything more table muffled chaotic OHS gets a little more confusing for so I love the send but the waffle side to a rules order tradition try to explain the lawful people because people like uh Camille awful people the best way to describe it is the door world dominator a person has

this moral code of structure but it may be different from everybody else's but he wants to impose it on very he wants the Walden kind of his vision whereas the cab people individual is the whole destroyer right if you don't care how the one of the better examples for cab evil is installed the dark knight the portrayal the Joker in that movie is pretty spot-on for chaotic and so what did i do I had make version of this that has alarming stigmatism so you know I tried to break it down a little bit the good on the top and bias but you know the it's basically all your different types of testing feed rate so

CA your certification guys they're going to be lawful oh great they have a set of rules they won't follow the rules and make sure everything gets checked off and everything is done right that meets those rules they're not you know if they're just like okay this is good this is good that's good it all looks good they were neutral good you know I kind of put routines it and the reason I said that put that there was they're not quite following the rule of doing see anywhere but on the same side they're on where I say that think the red team's are which is you have a red team during the true penetration test they need to

be looking at your networks and the same methods and ways that that your black hats in your wife particular your black pants or your main adversaries are going to attach the devil the river so they have to be Milan the kids and the end within your organization within your groups those are always going to be perceived as the good right there the ones trying make better some of the some of your add meds and your help desk folks probably see them is equal because they come in break everything and now they get stuff fixing the great lawful neutral milego brought blocks are developers but I couldn't find another good pitcher for in Melbourne that the help desk is true

neutral white hats chaotic control the bottom of the lawful evil those those are the bosses right she's going to have to mobile to have the order but but but ultimately they get they sometimes get to where the put the put neutral evil as the lawyers you know you did maybe the lot of people but you know it's to them it's more you know about keeping their keeping the company and keeping your bottom then if you out of people's the black hats this is a guy to anything n want to break into your networks that are the ones who want to and you know still information they want to fix your websites whatever nefarious reason they

might have you know whether it's just for the the giggles order for the lulz you know that's ultimately that's you know before your enemies I suppose so the second lesson media director this is where the dungeon master so so those have been played before you know Dungeon Master's one who's created scenarios that you're playing and who's depending on how he will in how people he is have had some whose main purpose and lightness to make sure you all dodge others want to see you to progress and so it's really you know this is what's behind that little screen adult steven all the plans but i think that's the important thing right this is the person

who has the plan it has the vision of what of what needs to be done and a lot of times the other side it's the if the players and once actually playing the game whose job it is Jackson came great in the end how many of us have managers who are actually doing the doing day to day technical another so much but it's you know moving the way herding cats it's quite the reality I my second run around as a manager trying to get everybody in the same place at the same time to do the same thing is or even something similar to the same thing is very hard for you if you've hung out google at hacker

conferences it's again very similar right how do you get everybody who can in the same direction at the same time yeah even though I'm pretty sure people the fire alarm right now their vehicle hackers will be round like I don't seem shy don't smell okay I don't smell smoke I'm he okay bit I will admit to coming up this time I don't know if your dose by the elevator there's these stacks of recycling that's the top one has a cell phone on it there are no cell phones in it right now that was a little sad I was hoping somebody might be might be the cell phone then I was going to change the whole

direction of the topper talk about why don't you sell phones so we have any Dungeon Master's right you know people will dictate what we're doing dictation store into it you know how things are going to be done whether it's the customers whether that's customers are external to your company doing consulting if you're doing I to support head and an internal support for your for your own company right then the other people with your company area customers your team needs you your technical team your troop supervisor is even tougher man because in the end you know as you go up there how much vision they have specifically for you narrows but their vision overall fits in so if you upper

management level there's the global we know I have this this is what the company needs to do the supervisor should bow that will say ok will make this happen the mic would we need to do this and so then that leads out to you if you have team leads between you and a manager they filter out in a delegate tasks you know they another ones that keep us truly on traffic that right so all these people kind of dictate the story to us they're the ones who leave and if you did have if you didn't have this sort of structure right then you put a hundred hundred guys in a room and try to convince the doll go in what

direction are they going to go there not somebody truly to step up we you know the odds of attica the both of them all won't be in same direction are going to be something are or at least in the same general grip so we got into the third list and this kind of grows out of again me googling answer for dinner so everything had worked as a doctor great I did not have to fabricate these pictures of innovating before but I thought they look incredibly similar to the fact that one is a metal diagram it's just eight shows I think it shows kind of the is a little bit bit so maybe a little it is a bit too little in some

sense but it's a it's kind of fun dagger to look at but the reality is when you're playing Dungeons and Dragons you navigate a dungeon and going as a team you looking around to find you know treasures or sacred princess and you go through the potential at you go through and it ultimately you're trying to get tier incorporate whatever that is it varies but you navigate through from point to point to do the same thing in that works right if you're coming in as a tester and you're looking at network you're doing the exact same thing if you're in goal is to get back for all the data is stored you're going to navigate through

and whichever method is most effective sometimes you can walk straight in because it's a giant hole in wall instead of a door and other times you have to work a little harder and so that's where the first thing comes obstacles when you go into a dungeon you have things that are going to be you know they might be doors you all's making traps we have the same thing in network sorry we have firewalls different types of appliances that are all doing the same thing and some extent you can even argue that well non-direct necessarily directly strict obstacle you know if there's a lot of traffic ideas and I guess become the exact the room child obstacles well if it's a door in

dungeons and dragons like you have a world who comes in Dixville great get you through and now you're on to the next tonight estate and you'll be in a network if you're doing your time to attacking trying to get into a network from now places and different ones to where you have to pivot in front well I got one machine now I need to try to use that so it's not that sort of straight and so you know we work around obstacle right and some of you might just turn off if you don't have a road to pick a lock you were buried at the door until it falls which comes to Travis you know whether

it's the Indiana Jones style of giant bowl or you know it's honey pots or is it designed to lure you away from your old target you know it's always to try to to capture your attention and keep you from getting where you want me and that guess they're just other forms of obstacles sometimes you just have to run with there's creatures right Anika dungeon you had to convince of creatures if you've ever played DD there's probably thousands of in the various books rule guides and your Dungeon Master pronounce will be equal with sku you know whether it's little innocent looking Cobalts or skeletons or purchase dragging you have different things you have different pictures again who who's

who are always occupying your what so I try to create some creatures bento said you know and this is where you have your IDs or IPS is your near antivirus your seems you know anything doing a lot of collection any of those sort of things that are monitoring and watching that you know they may not necessarily unlike the creatures in a dungeon which could actually literally more times than not these are going to just alert you to the fact and somebody's there somebody else coming to kill you back so but in the end all these pieces come together and so you get this this view that where you know you're trying to get to a goal and that goal is your treasure

right so a network this treasure could be anything range if the person is going to be attacking your network is you know people we're going to fix your website maybe if you go well it is just your web server if if you actually have real proprietary data or how personal personal information than the network people might want then that was the treasure you know dozen dragons it's always you know it's almost it was troubled armor since for such a fine your goal is to get something the other knows there might be more altruistic management but I mean in cold rain and use that as a side effect of coming lots of gold so so the fourth lesson using your

imagination playing the game great here's this map again how do you go from pieces of paper and little markers on there to seeing yet you know seeing your team and senior yorker come together and destroy a dragon we'd have to use our imagination right if you don't have any imagination Dungeons and Dragons doesn't come from so what's the reality of computers that ain't the very cliche image but there you know when we interact with computer systems and electronics in general we have some sort of human usable interface right but the reality is that human usable interface is just a cover for what's actually going on and this goes all the way down to both working on computer systems to looking

at networking trafficking my background of college was never me and I I think correction likes of the NM like where

Kirsten w but the reality is even that's not everything right I mean really is the physical layer thing which mean you're using that signal is sent in one of various methods right over ethernet the voltages along the water or modulated to represent fits the you know wireless you know the signals signals are changed amplitudes and frequencies in order to to accommodate the same the same concentrator so we have to in some ways abstract this because you know it's not to me before so this also leads to solving problems you know two pictures again I like so you know the keyboard not found press f1 to resume or the using six different adapters that you can put your microSD

card but ultimately you doing dungeons and dragons you you know whether you're running into a trap or you run to a wall or something gets in your way to futures we're going you know we had an infosec we have problems we have to celebrate things I always work the way they're supposed to through those high ball thingies address was not sure which kind of feeds it's nice into less than five which is the elements a chance nothing ever goes the way you expected you I think anybody who's ever worked at the computer is well aware that even some of us who were the experts are more small fix something by magic break we don't know why wasn't working five

minutes ago but I just did x and outwards so done with dragons you know some kind of show beginning you know one of the elements was all the dice and all the table so everything the game is based on this on the system of chance you know you have a character sheet that has you know certain stats and points in it but in the end or you do anything you have to pick up one of these dice and roll if it's a bad night cursing the whole time so again more great pictures you know dungeon dragons the dice that may ultimately they when you're doing character creation you roll dice to interest animals when you go into combat

we inform any actions nice to see you pit what you're going to hit you know when you're go to hit something you know you roll your damage and there's nothing more frustrating than having the big bulky barbarians swing and miss and roll one and then chop the head off of this from an infosec it's the same one right we have devices that break we haven't put into won't work loading code that doesn't compile exploit the run blue screen whatever it is we run into these problems right so it's always non clear-cut you know sure ninety percent of the time you might go ahead and run the same vibe commands on every computer it's going to work perfectly but you

know the next week you go back and you do it you know you did it one day patch tuesday turn around and come back the next weekend you know something's not working again it's always fun to try to figure out over end of this just working as well you know anything that can possibly go wrong with there's there's plenty of lists on the internet of work these laws of combat dragons anything else and there's probably ten times as many for work these laws of computing apparently some very angry sis admins exist out there who have nothing to do in their free time except break lists names so the summer so there's five lessons right it takes a

team having people who can work together who have different skills you can come together and together better than the funny thing about it takes the team is I probably took a longer life to learn that limit ensure that we first to admit that up all evolved five years ago yeah thank you thank you be honest yeah that would be about ready till about five years ago yeah I more times than not my mentality was I can do a fashion for myself with less people and I'm probably messed up some crap new year director beat somatic GPU and straighten going in the right direction every network was it done you have to use your imagination as I learned every

day things so I put a good thank you so we're good i fail to do this with every other time the other times I've done this presentation this year so this is going to be a big retirement its presentation kind of experiment I gave you four times but much like space for excited this morning you know how you know James came up in casting a dirty contest and talked I got it too but it definitely felt a little friend I you know I'm not saying she fun secret meeting horror but it doesn't it was kind of like yeah you should really submit because you know not everybody goes to every conference it's just like I'm sitting down and she's standing up

which is the only way she could be looking down at me and it was a little it was a little intimidating that's all I'm gonna say but like to thank psets Delaware for having me here a second year represented in fact I'd like to think I actually taught somebody something that you're not sure I think i just read to me or people think Darrell's got a car matters own they've all allowed me the opportunity to get up here try to impart some knowledge much of it if somebody takes something away a couple more things and you won't break it but this makes my ether old feed batches this anybody that for all the feedback and drove get it again I also

love to make him and fozzie max for Pecola mean the couch is gone but it was an effective heckling and not mean-spirited so I appreciate it no I think everyone is here today coming and listening to what I have to say and anyone else who may be watching food to them I talked earlier in the year who I felt a thing does anyone have any questions I managed to get through in 30 minutes I'm sorry