HG - How Living and Quilting History made me a better Cybersecurity Professional

all right I hope this lives up to everybody's expectations of it um most of this is going to be storytelling about my day job versus my night job and the stories and lessons that I've learned from living history uh quilting history that really apply to cyber and I hope that it helps you find synergies in your own uh Hobbies Lifestyles and other things to learn these lessons and move forward so how living history and quilting made me a better cyber security professional so uh I'm Mia Clift by day I've been in it and cyber security for 26 years some days I wonder how long it how it's been that long but here we are um currently

I'm principal executive adviser in cybery engineering for liberty insurance and uh that means that I get to advise cesos on what's going on in their infrastructure but I also get to evaluate insurance for their security posture to make uh our Underwriters informed about whether or not they're a decent risk to ensure uh in the future we're hoping to be able to be partners with our insurance so that's super fun it's an amazing job I love every day um it's exhausting it's only been about eight months some days it feels like five minutes some days it feels like five years uh outside of that I'm also a mentor for cyers which is an organization that supports

underrepresented communities in cyber I teach a GRC class for them and I lead their mentorship program as a mentor Advocate I also am a mentor for isaka and wus uh as I said I teach governance risking compliance I'm a presenter and a writer uh and I'm passionate about improving the cyber security posture of businesses of all sizes whether it's small medium large I'm specifically passionate about a critical infrastructure space my previous role was in water and wastewater and boy do I have stories but by night I issue all technology since 2000 I've been a living history participant participating mostly in 1745 to the 1812 I forget that uh things happened in this country between 1840 and 1870 I like to say that I was

hanging out with Queen Victoria in England at that time can't imagine why um and then I jump forward I do uh a little bit of victo Edwardian and I do uh auxiliary territorial service in Britain because they were women with motorcycles and that's freaking epic so that's my living history background my primary role when I lived on the East Coast I live in Minnesota now uh was of an 18th century surgeon uh I also took my Greyhounds and did an organization called historic hounds so we would could go and talk about the history of greyhounds in uh the world specifically in the 18th century because George Washington had them uh bradock had them uh Von stman took his during the

American Revolution campaign up and down the East Coast he was at Valley Forge so my Greyhounds and I got to go have parties um I also am a collector and restore of antique sewing machines uh as you can see in my photo there I'm an antique quilt collector I'm also a quilter I hand quilt I do hand piecing and I do machine piecing uh I'm also studying I'm a journ and quilt appraiser I took my quilt appraisal classes this year now I'm appraising to become a master appraiser and certified in a few years that's my retirement career when I'm tired of looking at Cyber postures oops go back so the reason I put this presentation together is not

just because I like talking about quilts and history all day CU that's super fun but also because all of your lived experiences can contribute to your cyber role and really all of your career roles every every lived experience that you have can be a story it can be a lesson that you can apply to what you're doing and it can bring Humanity to any of the presentations and any of the discussions that you're having with your teams with your leadership even with educating your next Generation even just looking at what is going on in my cyber world and how do I explain it in a way that people are going to get one of the things that I consider one of

my greatest advantages and I take this from my living history practice and talking to the public is is two things one analogies are amazing and I do a lot of them but also you have to learn to read your audience there are going to be people who want to come and learn all the little nitty-gritty bits about everything in the history of everything and then there's going to be the person who comes up to you and is like where's the alcohol cuz I want to get drunk before you operate on me and then you have to do a very brief explanation that alcohol was considered a stimulant in the 18th century and then they get bored

and wander off because you've ruined their mystique and they just want to go because their kids are here and there's food or something so you have to learn to address your audience in that way and by reading the room and by doing that in living history and all my other backgrounds I've been able to apply that to my life and I hope that in doing these lessons today you'll take away some lessons that maybe are are valuable to you as well so the rule number one of history and I'm going to I'm say it a little bit more crass uh if it ain't primary source it's crap to use uh the Saturday Night Live thing about if it ain't Scottish

it's crap um you need primary source documentation anybody can tell you anything my great-grandmother made this quilt my great-grandmother didn't make this quilt but somebody will tell you that to make a buck somebody will tell you a story to get you engaged somebody will tell a story to sell a historic site or sell tickets and all that kind of stuff it's not always true so the on the screen is records um for the pension office for the War of 1812 my sth great-grandfather was named Thorton and his obituary in the ston newspaper in Virginia says celebrated veteran of the War of 1812 now as a 1812 living history person I was like this is great I can join like maybe I can join

the sons of the American Revolution or the Daughters of the American Revolution and because I had a an a war of 1812 person maybe his kid was in it and I I can do some genealogy so we we du some we did some digging and we found the pension papers there is 42 pages of documentation here that basically says that my great great great great great great grandfather served six days so he was ineligible for a pension so again while everybody was like oh he did this great thing he fought in the War of 1812 he he went to he went out to a militia muster for six days and was like yeah I'm done

here so primary source is imperative to verify that information that you have heard or that information that you are curious about and that applies to cyber in that trust but verify mentality anybody can tell you anything about their network but if you don't have proof in the pudding it doesn't exist when I was doing GRC one of my greatest examples was you know you can tell me that aliens are guarding your server room but unless I see the Men in Black show up and take you know take pictures of your little men outside it doesn't exist you can tell me anything you can tell me you have MFA everywhere but if I don't actually see evidence of that MFA

it doesn't exist and that's a challenge sometimes because it's hard to actually quantify and and visualize some of the things that we have but that goes back also to being authentic with each other and you can do that through your personal and and also just saying you know I understand not everything is going to be accurate you're not going to have all the answers to everything that goes back to you try to do the best you can with primary source but always trust but verify lesson two folklore and urban legends can be both helpful and hurtful so on the screen I have two things there's a uh there's a 50 caliber lead bull bullet and a cal trop so I'm going

to talk about the bullet not as much about the Cal trop Cal trops are fun but a longer story um there is a urban legend and it was popularized by Hollywood that when you had surgery in the 18th century because you didn't have anesthesia uh that you would bite a bullet while they were operating on you and so without fail I have tons of people who would come up to me and be like where's the bullet for me to bite on again it goes in it goes hand inand with where's the bottle of whiskey um the reality is that there's some truth to that they found lead bullets in North Carolina around some battlefields that

had tooth marks on them but the reality of met and this is the reality of humans if say you had a lead ball in your mouth and you were biting down on it and somebody immediately punches you in the chest or Cuts you on something what do you do you suck in a deep breath and you swallow so then you're choking and we don't have the himl maneuver for a few more years so you're going to die on that table what the reality is is that in North Carolina you have wild bores wild bores like the taste of lead wild boar teeth look a lot like human molar imprints so the the hypothesis running now amongst historians and

archaeologists is that the bullets that they found were eaten by pigs not bit down on for surgery so if you ever see that you go about that I talk to a person who studied this long and hard um and so really what it was was a stick so if you've ever seen the movie Master and Commander they were probably the most historically accurate in doing surgery at that time and it's also a great movie highly recommend it the Cyber equivalent here is that the truth is always strer Than Fiction how many of us have that no there I story I have several I know you guys all have them and so we can tell stories

that are scarier and Stranger Than the stuff that's coming out and the example that I have here is you know the Wi-Fi toothbrushes that were going to be bought bought netted and taken over the world the reality was is that that was a thought experiment by a company that got released and then fear mongered across the world fearmongering isn't the way to get people to move in the right direction ction it just worries people and then they're like I'm never going to do anything ever what you have to do is say yes there is a threat of Bot Nets because of iot your toothbrush is probably not going to be the biggest concern that we have so again use the

truth to your advantage use those urban legends to educate but also educate that there's a bit of distrust within that and I mean there's tons of urban legends that I could talk about all day especially when you get into quilting too but this is this is something some of the primary ones that I dealt with on a regular basis I mean my parents called me about the toothbrush thing and I'm like you don't even have Wi-Fi toothbrushes why are you wearing but but but no don't move on lesson three you have to understand the bigger picture to see the whole story so this quilt that's on the screen is this quilt that is here this quilt

was made in around 1840 probably in Pennsylvania but if you look at this quilt all of the diamonds are the exact same size every single diamond out of this piece is the exact same size the other part of it is you can see it looks really cool it looks almost chaotic in its own right but if you step back it's got five or six different oh my god um five or six different uh patterns within it and these are the kinds of quiles that I like I call them organized chaos because you can see a habit within them and you can see uh some really cool patterning yes hi hi so I uh in case uh folks don't

know we have this thing called outrageous speaker requests here at bsides and when you you know several months ago fill out your uh your presentation uh submission uh you you put down I know all green M&M's or whatever right so uh I believe you made a request for a signed photograph or a cameo with Sebastian yes and uh technically any signed photograph of anything signed by anyone would satisfy that request Fair um anybody named Sebastian fine yes uh we I decided to kind of combine the two you get to have a cameo with Sebastian or rather he's going to have a cameo with you during your talk what what and it is it is signed damn

it oh my God and I hate you so bad right now because you knew about this oh my God and then as a bonus we got you you did not oh

my my God thank you so much you're very welcome where would you like this right there it's fineti Sebastian Stan the winner Soldier I have a kind of crush does anybody have something slightly heavy I could clip on this um yeah he was he was the Winter Soldier in the Marvel series Bucky Barnes he's also he was on a Once Upon a Time and some other stuff but those are the big ones thank you for speaking oh my God you didn't know what to do the Cameo holy thank you oh my God

I don't what am I okay so side Side Story really quick because we have the minute um I went to London and uh I got to see uh the guy who played Admiral p pooo in a Stage production uh uh he was in the Horatio Hornblower series and that was when I was doing 1812 in Napoleonic and I went to the side door to say hello and I was like oh I'm going to say something really cool and he's going to invite me out to a pub and we're going to have great history discussions and the only thing I said was a whole bunch of actors in Washington DC think you're super cool and he looked at me and he was like oh

thanks and like signed my playbook and then left and I was like that was the most embarrassing thing so I'm totally going to embarrass myself in about five minutes or whenever this Cameo happens so thank you so

much all right so back to quilting um so you have to understand the bigger picture to see the whole story and this is very apparent in cyber you can't just say everything is locked down you have to see everything you have to understand the whole story while somebody can check every box and say we're completely secure I I know you're lying not everybody is completely secure it's it goes back to another story um in my last job we were setting up a monitoring solution for our OT environment and uh the leader of that team went to his engineer who I was talking to regularly and he goes so once we have this monitoring solution we're done with

security right cuz he thought that that was just all he needed that was the one part of the picture that was going to solve all their problems we can't do that that's not the reality so um you really do have to see the whole picture to enjoy the story and then you get lost in the story so you know realizing that the back of this quilt was made in the around 18 you know 1848 the back is Pennsylvania because Pennsylvania likes colors on their backings where most places didn't and things like that so you you learn and and find more stories and then you find more rabbit Hool to go down to learn more about your environment and

where you want to go next and how you want to improve Lesson Four there's always more that meets the eye so this is my absolute favorite quilt in my collection I call it organized chaos it was made in Western Pennsylvania around 1860 so it looks chaotic doesn't it like it's hard to look at but you have to look closer so you see all of the peonies so those are the red flower looking ones and then next to them there are Le Moine Stars which are the star blocks and then on the diagonal you have pin wheel blocks so this quilter without being able to put up a design wall to see all of the stuff from a distance was

able to figure out this whole image and every time I look at it I see a new aspect of the quilt and a new complexity so I call it organized chaos because it is organized and honestly to me it looks like a garden in the fall where the leaves have fallen around the flowers so in that quilt I know a lot of people who wouldn't buy that quilt because they don't understand it how many environments have you been in or how many organizations have you talked to or how many cyber environments have you worked in that were chaotic but you could see the beauty within you could see the pattern and you could see how it

all played together and sometimes it did look chaotic on the outside but on the inside it's beautiful the other lesson and this is one of my favorites especially as I've dealt in the OT space everything old is new again so doing 18th century medicine everybody talks about blood leing and leeches um leeches were not as commonly used as you would think most of the time they were used on the in infir children or on sensitive areas like your eyes um your ears and your toes but to that end I did have pet leeches for a time uh sippy gulpy and gugger um I had to go to a local butcher shop and get blood for them about every

3 months so that they would eat uh and they were wonderful they swam around uh two of them ended up escaping and disappearing until I moved out of the house that I was in and one of them lived a very long life because I took care of them the thing about it is leeches are now being used in medicine today so um they're not being used to take blood away what they're doing is they're using the leeches for reattachment surgery so in the saliva of a leech there's an anti-coagulant so if you put that on a a reattached limb and let them start sucking blood they actually recalibrate the circulation so they bring blood flow

back to things like ears noses and fingers and there's such a great success with it there's actually a company called leeches USA that supplies all of Med medicinal leeches you personally can also buy from leeches. Biz at $8 a pop with a $25 flat shipping but that's the thing everything old is New Again the PLC on the left was built in 1975 that was the first PLC my father ever built he tells me it's probably still an operation in the middle we have a gopher terminal one of the things I tell new cyber security people is if you want to understand networking go to gopher because you have to do it menu based and you have to know how to get around

networks point to point to point which is routing at its most basic form today all of our routing happens automatically it's rare that we see some you know we see a down detector because of a Dos attack but I remember back in the day this is me being old you know we had to Route everything around the internet so um we still have that and then of course in OT environments we still have Windows XP Windows 85 I heard uh a colleague of mine tell me that uh she was told that there's Windows home on her network currently so you know everything old still exists my oldest Quil in my collection is made in 1816 so everything old is New Again

people people are starting to come back to quilt revivals as well people are getting back into history and we're learning new things even while dealing with those Legacy pieces the final lesson is there's always more to learn so this picture is from a 1910 book that singer put out called singer's instructions for lace work and art embroidery that is embroidery on a piece of veneer this is my new challenge because I found it in the book and I was like there's no way so uh when I leave here I'm going to the Virginia quilt Museum to demonstrate trle embroidery and I'm going to be doing embroidery on veneer but that's the thing is there's always

new things I got that book and I was just looking at it for the thread painting and the lace work and then I opened up chapter 90 and Bre around W I'm like you got to be kidding me but it's a new rabbit hole to fall down and it's technology everything's changing even if it's not changing there's always a new rabbit hole to fall down if you would have told me 5 years ago I would be where I am or even 3 years ago that I would be learning about OT and going to my dad and being like explain PLC is better for me I would have told you you're crazy but here we are and who

knows what rabbit holes I'll fall down tomorrow and I hope you fall down rabbit holes too thank you so

much if you like history and you like quilts and textiles and you want to see more about the things that I do that way you can find me on uh Facebook at by hand um you can find me on uh LinkedIn and I also have a database project called the feedack project that's cataloging um feed saacks from 1935 to 1965 that are printed colorways about 20,000 of them so feel free to do that are there any

questions all right thank you so much