Opening and Keynote

Now with that as we are officially open I would like to welcome our first speaker now starting out keynote I'm very proud of our lineup that's mostly normally done so I'm going to be inviting Shan Rien to come to the He is from DMV and he's going to be giving us a talk on the investigative mindset, the key to success. Now, I'm not going to introduce him. He's going to tell you all about himself. Well, we have another little surprise for you. We have an artist, one of our students in the in the audience. He's there. Put your hand up. You will actually be drawing all the sessions and the doodles will be released after the fact for you guys to

download from the website. So Sean, the floor is yours. >> Thank you very much. Um, lady of the artist, can you give me a full head of hair, please? Some lose a bit of weight at the front. Yeah, some of that will do. Thank you, Veronica. Um, I'm really pleased to be here. Um, I'll give you a small world story. So, Veronica contacted me quite some time ago. I found for a while said, "Would you be a speaker at our bite?" I went, "Yeah, of course." Anyway, we got to know each other and I found out she was from South Africa. Now, back in 2003, 2004, I was working in South Africa when I was in

the police as you'll see um with the South African police in the digital forensic laboratory. Anyway, we got chatting and I turned around and I said, "This is a really long shot, but do you know a guy called Bug Grobler who is the head of the unit that I'm still in touch with?" And she went he is the reason she is here today. Now, what a small world, >> eh? >> Oh, and congratulations on your black hat. >> No, no, I saw it posted. No, that I only know a couple of people that have done black hat. Congratulations. Okay, so this is about an investigative mindset. I shall try and make it as entertaining as possible. Uh, I like to

think I have a sense of humor, so please don't be too strict. Although most of you are wearing t-shirts, I've I've dressed down for today, but I'm English. Hey. Right. So, we're going to look at what an investigative mindset is. And it doesn't matter whether you're a red teamer, a blue teamer, purple teamer, um a forensic investigator, an intelligence operative. The general principles apply. Okay? Now, I warn you now, part of this presentation is interactive. I'm going to ask questions. If you don't answer me, I will pick on you. Okay? I'm like that. Okay? So, before we start, I'm going to introduce myself in a bit more detail. This is an important message. Uh for the

non- Norwegian speakers, I'm led to believe that says important message. I do speak Norwegian, but badly, but I do understand it. So, be very careful. Um Yeah. Yeah. I'm a foreigner. About must be eight, nine years ago, I was presenting at a big conference in Oslo, 400 people, and people loved it. But one guy was going, "Who do you think he is?" Okay, so I always put this up now and it always gets a laugh. So, who am I and why should you listen to me? As Ronica said, I work for DMV, which is the global third party insurance company, specifically DMV Cyber. Um, I do lots of things. I'm an old guy. I've been doing this for a very, very long

time. First got my hands on a computer at work in 1978. Yeah, some of you weren't even around then, but yeah, about 1978. Um and over the years all sorts of security um particularly cyber security but specifically digital forensics. The interesting part I think is I was a detective for Scotland after 26 years before I retired in 2015. 4 days later I moved to Norway. Anyone want to guess why? >> Same vision flight. >> Well ah a woman. Yes it was a woman. Yeah. >> Way out as an older guy. Moved to a foreign country. Uh skiing. Absolutely. Yeah. I love the cold weather. Absolutely love it. I live in front. Um I've worked on all sorts of things.

Counterterrorism espionage kidnap human trafficking, the UK national high-tech crime unit. The reason I mention that is over those years you've seen an evolution in techniques and tools, but the mindset remains pretty much the same. And it depends whether you're offensive or defensive. Um although I investigated as a normal detective uniform first and then as a detective for 19 years I specialized in IT cyber cyber investigations. And back in those days it's the old saying in the land of the blind the oneeyed man is king. There weren't many people that had any sort of competence and there certainly wasn't in law enforcement. It was a really good opportunity to go down when you combine forensics and incident

response with investigative, you know, the day-to-day stuff. It gets quite interesting. Boom. Fun facts. Uh, anyone here not being on an airplane? >> No, I thought not. Picture at the top left hand side. That is the reason you can only take 100 milllers of fluid on board a plane even to this day. That was in 2006. There was a plot to blow up seven transic Atlantic airliners in flight causing massive death. I was a lead forensic investigator for that digital forensics. We found all the evidence and I gave all the evidence in court and it took about four years. Now there's a good lesson to come out of this regarding communication. How you as experts in your field communicate your

findings or your thoughts to other people. So when these terrorist jobs start and this was the biggest one there was at the time and there was probably 1,800 police officers involved in this in London alone plus all around the world. Um the pressure from the government for briefing and foreign government is intense. You know they they really want minute-by-minute updates. And I was running the digital forensic labs and about four times a day we would be called up to Scotland meeting room and all the heads would say right what have you got? What have you got? What have you got? And it was all about briefing up to the government because I had to answer questions. And

on about day three, I think it was, we've been working around the clock, sleeping on desks, just, you know, whatever. So I got there and one of the bosses called me. He said, "Shan, Sean, how you getting on?" I said, "Yeah, fine." "Yeah, fine. How are you?" And he said "Um so how much have you got so far?" I said, "Well, it's early stages, but we probably got, I don't know, about 100 computers at the moment, two or 300 phones, but basically if you're anywhere near a terrorist investigation, we're gone." And in those days, we had internet cafes, plus personal devices. He said, "Right, right." He said um so how many terra diggy mega things have

you got bites and I went oh my it's difficult to say but in those days it's about four terabytes so far which we've managed to image you know do a forensic copy and he said and he was probably a bit older than me which is going back 15 years he said um yeah okay but if it was all printed out how much would it pay now when he like many people were told that a floppy disc was 1.2 meg and it was 100 pages of A4 in 12 point print printed. I said, "No, sir. You don't understand. It's got these days we've got video. We got program files. We've got to look at everything." He said,

"No, come on. You you've got to give me something because you know I'm briefing up to the commander and the commander briefs the chief constable and the chief constible briefs the cabinet office and the prime minister." I said, "I can't do it." He said, "San, don't be so bloody awkward. Will you give me some information?" I went, "Okay." Sorry. If it was all printed out, it would fill Scotland Yard four times over. Scotland at the time there's two tower blocks of 15,000 people. Okay. So it's quite a big thing. You went there you go. Wasn't hard was it? And off it goes. So we're in the we're in the lab next door next door and we've

got these big TV screens up Sky News and uh um someone comes to say John did you just seen what um Theresa May the current the prime minister at the time has just said? No. So she was in the houses of the parliament TV cameras a whole lot briefing the country briefing parliament counterterrorism SO15 have done this they captured this many computers they made so many arrests and it's a vast amount of data and if it was all printed out it would feel Scotland Yard four times over he still doesn't know who I am but so the lesson there is is communication and understanding as an investigator Don't just take what you're told at face value, you know, you've got

to dig into it because people come up with misconceptions we see a bit further. Second one down very briefly. This is the London Olympics in 2012. I was the um uh head of the uh digital forensics for terrorism and the cyber operations team lead. They were really really worried that the bad guys would hijack a ship, the big one. And they've done this before back in the early 80s in London. They got caught there and they they were going to capture a ship and ram it into the um south coast in the sailing events. So loss of life, damage, reputational damage to the UK and the Olympic movement. So it was myself and two and

we were trained by the UK special forces. Um so that is me danging out of a helicopter and that's me at the side of a ship. How to board ships. So the the special forces would attack, capture, and kill. And when it was safe, they'd go, "All right, boys, in you come." And we would uh you know, be helicoptered in. And the idea was to do fast time forensics. You know, if you've got a ship uh and you've got their computers and phones, we want to know where they've been. Second lesson, evidence is really comes from one place. So if you know where that vessel's been to approach the ship, you can check the shore. You can check a uh mini bank

cameras. You can check shops. You can check bank records, you know. So, it's all about building this big spiders web of a picture. Um, anyone got children's? Yeah, of course you have. Um, anyone heard of the Kelly Tubbies, the children's Yeah. Anyone? >> Well, these elite special forces, probably the best in the world. And then you've got us Scotland detectives coming down from cash terrorism. Um, maybe slightly, you know, and they used to call us the terror tubbies. So we let him get away with it. Uh and just moving very quickly, this is the poisoning of Alexander Lenenko in 2011 by the Russians where they put podium 210 in his food and he died. That's me

on the left. So we had to digital forensics in full suits in pressure controlled rooms. It was very low radioactivity, but I'm not taking any chance. I already had my children, but this guy with white, he was a bit concerned. Um again hybrid this is a security assessment done fairly recently in Norway looking at cyber but physical about what could people do what doubt could they cause. So that's where the investigative mindset comes in. It's not about people boarding it and being awkward and chaining themselves to the vessel. It's about if they got into your server room they might not have done anything but you don't know that. So when you're planning, you know, either

post or forward investigation, that's what you have to look at. Um, offshore. Now, forensics, the word forensic has no uh translation into Norway, into Norwegian, the way that English speaking. So the definition of forensic is the application of science to law. The nearest I found in Norway, I've been here quite a few years now, is medicine, which is pathology, you know, after death and that sort of thing. So forensics is typically reactive. Something has happened. You're trying to find out what has happened, who did it, so on. And you never do either pen testing or you never do penetration testing on a production environment, particularly in the industrial sector. Couple of years ago, just before the

World Cup or three years ago, the authorities were really worried that after all that other criticism they've had of human rights and, you know, treatment of orientation so on, they couldn't afford a cyber attack. So, he wanted these rigs or some of these rigs tested to see if they were vulnerable. Now, he couldn't pen test them in the traditional sense. We couldn't red team them because you put one packet in there into old industrial equipment and it goes back and falls over and you got millions and millions of dollars a day. What you can do is use forensics proactively. And what that means is because you're not putting anything on the system at all, no packets, all

you're doing is using a bit of CPU. And if you monitoring the CPU usage in agreement with the operators, if it goes over 17 pull, you know, cuz some of this stuff is really, really flaky. Some of it's 50 years old on the operational technology. And finally, this is in the Yemen. This was a terrorist job. That is a stage photo, but they wouldn't let us go outside without body armor and a hat cuz there snipers. As I went into Yemen, I had all my friends at kit. I got searched in a very loud voice. They said to me, "You are MI5 British intelligence." I went, "No, no, please. I'm working with the embassy phone." No,

no, you're MI5. So, I got detained for about an hour. Longest hour of my life. Okay, let's move on to the good stuff. Two things I do not want to hear you say. Two words. I do not want to hear the word guess. I do not want to hear the word assume. Okay, that is different from reasoning. But when someone says, "Oh, I guess the shops open at 9." Because they normally do, evidentially or investigatively, it means absolutely nothing. Um, and assume, "Oh, yeah, I think that's true. I trust that person perhaps or I trust that source. No, if anyone says that you're going to get a free holiday to Salbar in January in your shorts,

>> right? So, any doubts on that? >> Yes. >> Okay. Types of investigation. How we doing? I'm notoriously going over so I'm keeping on my watch. So, there's two types of investigation. It's a quite a broad word. So what does it in fact mean? So an investigation is by definition reactive. Something has happened. You know there's been an accident, there's been a crime, there's been whatever and an investigation or an inquiry is um put together. It's all about the who, what, how, when, where. It may result in proceedings. Now whether that's criminal proceedings in court or whether it's civil proceedings for damages, the burden of proof is different, but it's going to be reviewed by somebody else. So you've got to get

it right. I'll tell you now, it's happened to somebody I know. They gave evidence in court, they made a mistake on setizes and um they were proven wrong in court and they could never give evidence in court again because the defense would bring it up. Is it right that on this date you gave this evidence? How can we trust your opinion? You have got to be right. If it's for proceedings, it could be internal proceedings. You know, it could be discipline. It could be HR, something like that. But if you get it wrong, your reputation or you might have to go and do something else. Admissible. This is important. Various legal systems have different rules. In America, if you achieve if you

obtain evidence and you're not exactly perfect in the way that you've done it, it'll be excluded no matter what. A video and 10 witnesses and if you've got that video without a search warrant, it's not admitted. UK is different. It's up to the judge. But things like product of torture. Okay. Um no government in west will allow evidence obtained by torture um to be used in court. Um sometimes you might have been a bit sneaky in how you've got your evidence. Yeah. So it won't be admissible. So when you're doing reactive investigations for proceedings, you've got to stick to the rules and it's it seeks the truth based on facts. Okay? And this is important as

you'll see in a moment. It has to be based on fact. It has to be capable of being poked into by the defense. In an adversarial system, that's how it works. It's different. In France, they have the inquisitorial system. So you need to know what legal system you're working in. And by definition, they're quite structured. You know, you go out, you identify sources, you get evidence, you test evidence, you try and find other evidence, put it together, and it goes to the prosecutors. On the other hand, I would say this intelligence investigation applies to a lot of people here. So by definition, it's proactive. You don't know the answer. Yeah. You are you have gaps in your knowledge. So you have to

have an investigative mindset to find out what those gaps are. Know find out what you don't know. Then you task into those gaps. It's forwardlooking. It threats its risks and intentions. Subjective. It's not necessarily admissible. In some jurisdictions, the UK, um, intercept evidence of telephone conversations are not admissible in court, okay? But they can be used for intelligence. When I was on kidnap, the amount of times that we went into court with when we caught them, and we always did and the uh jury would send up a note to the um the judge and say, "Yor, how did that unit know to be at intersection 42 on the M1 motorway at 3:56 in the morning?" And then the judge, because

he'd been brief, would go, "Very good question. Move on." Yeah. So, it was inadmissible. we couldn't use that sort of evidence in court. Um it could be um that you trick someone. It could be an undercover thing and you want to protect the methodology is it could be signals intelligence. What DHQ, NSN, NSN, NSA, some of that will never be exposed because you want to protect how you did it. If you tell the bad guys, then they're going to avoid it. It's often incomplete. It's rumors. It gives you indicators. But what it allows you to do is infer. Infer, make an educated guess. So >> guess. >> Ah, good. Someone's awake. An educated guess. But thing is here,

they're interchangeable. So quite often an intelligence operation will um lead you somewhere where you can actually evidence it in a correct way. And that's called parallel evidencing. the example I just mentioned. Yeah, we were at that motorway. We saw that red car. We pulled it over and we rescued the hostage. How we got there, we're not either inadmissible or we're not going to admit it except for the judge in private. Yeah. So, parallel evidencing investigation turns to evidence. Evidence leads to intelligence. And there's three main types of investigative detective. Hence the Sherlock Holmes P. I deduce this and your characteristics will be these. Yeah. And you can see that this is these traits are engineers, scientists,

detectives and analysts. They have general rules and theories and they apply them to the problem. However, I think a lot of you are going to relate to this inductive from the bottom. You observe patterns and you form ideas from specific observations. When you're pentesting and you get the feel and you see what's open and you see what the defenses are like, that's where you're doing the bottom up approach. You're being a bit more creative. It's rare to find intelligence and investigations handled at the same time by the same person. Different mindset and it's very difficult when you know something not to reveal that in evidence. If your life been caught, you can't lie. If you've

been part of the intelligence aspect of it, you can't really um do the reproduction and this is artists, entrepreneurs and qualitative researchers. So what are you? Yeah, I didn't expect an answer. >> Okay, trust. This is an important thing. Depending on where you go in the world, people tr and it's not each other so much. It's as a society, not male, female, whatever. It's as a country. Do you trust your institutions? Uh, zero is I don't trust anyone. 10 is I trust whatever you say. France 3.3. Any French people here? Good. Is that true? Very low trust of your institutions, governments. You don't trust me. >> Oh, >> no. And I've got a lot of friends and they

will say the same thing. England 5.5. Yeah, that's about right. I'm a Brit. I think England might agree as well. have a healthy respect for some of our institutions uh until we had Boris the buffoon and Liz the cluster a lot of that went out the window um you go up to Norway 7.4 before I give a lot of presentations and um I come on stage and people say Sean it's all very interesting but it won't happen in Norway really why is that it's the gang of wars so when you're doing this investigation bear this in mind you know you you have to examine yourself now good okay I think we're going to get there what is

intelligence and how do we get it what go back collection of information. Okay, it could be from anywhere. It may be true, it may be false, doesn't matter. But it can be processed and analyzed. You identify what you don't know. It can be used to give you an advantage militarily politically commercially. Industrial espionage. It can be gathered from absolutely everywhere. So this takes it outside of admissible. Sometimes it can be combined with statistics and common knowledge. Anyone come across the birthday paradox? Yeah, good. Couple of nods. How many people do you how many randomly selected people do you need in a room to have a more than 50% chance of having the same birthday? Not the year, but the

the day of the month and the month. >> 23. >> Yeah, you're right. Um so 23 and that defies logic and to have over was it 99% chance how many people do you need? >> 15 >> 75. >> Okay. >> Yeah. So you know you can use statistics and intelligence. You can't go to court and say statistically that person there he's like to have done it because he's got a beard and a start and he's bald like me. What's that say about me? Um, you know, you can't use those in court, but you can use it as intelligence and it allows you to infer to make an educated who picked me up last time. Yeah, good. Right, let's have a getting

quite close on time. So, I wanted to do this with you. This is a picture of a cupping ball. In fairly quick time, I want to know what you can infer. So, shout it out. And when you give me an answer, I my first question is going to be why. Why do you think that? Yeah. Question for the end. What is the gender of the person using that cutting board? >> It depends. >> I'm sorry. >> It depends. >> It depends. >> It depends. >> You're a lawyer, aren't you? >> Universal answer to any question a phrase this person asked you. >> Yeah. But that's that's the whole thing here. It's about influence, but it could

depend on so many things. Okay. Number one, we're running out of time. Make me an influence about the person using that cutting board. >> Right-handed. >> Right-handed. Why? >> Because the map is on the right side. >> Excellent. Okay. Um, tell me about the knife. Uh, someone else. Yeah. >> Japanese. >> Japanese. How much? >> Thousand. >> Yeah. Expensive. >> Yeah. >> Yeah. Maybe 2,000. So you could infer that if a person hasn't received that as a present but they bought it, they could tell you they like cookies and they've got some economic, you know, they've got spare money. Yeah. I did this in NU NTNU in Trinim and we talked about the economy and someone shouted out not a

student. >> Yeah. Okay. Good. Excellent. Next. >> Not a vegan. >> Not a vegan. Why? >> Eggs. >> Eggs. Yeah. Well, they could be vegan, but they're not important. >> Vegetarian. Ah, >> thank you. Yeah, learn something every day, right? Um, yeah. Good. Excellent. Next. Yeah, >> it's located in Norway. >> I'm sorry. >> It's located in Norway. >> Good. Why? >> The cheese it says, and I don't know it's not. >> I don't know if you can get the cheese in other countries where the slogan is in Norwegian. >> Oh, is it? Where else could it be with that language? That writing >> Denmark. >> Denmark. >> Could be Denmark. So, you narrowed it

down geographically. It could be uh anything else. >> Think they're making carbonara. It's >> I I asked. Yeah. Go on. That's it. >> Probably not a trained chef. That's not what you do with an onion when you're cutting it. >> Exactly. Yeah. So that can either infer that they're just well it's either a stage photo or it's they're not a train check. So good. All these things can bits of information to build up other bits of information. >> The eggs might be raw. Why else would you put them in the groove like that to keep them from rolling away? You don't want them to break. >> Excellent. And what else the eggs tell you? And the cheese and the

>> structured. >> Structured possibly. Um >> and not go in there. Um, are they allergic to those ingredients? Probably not. >> Sorry. >> Probably not lactose intolerant. >> Probably not. Yeah. >> Um, and the thing is if this does happen, if you wanted to take out somebody really really important like CEO from a merger meeting or something like that, if you can get these allergens into their food, Yeah. Um, then they would disappear for three days into the small room. So you can say that they are not allergic. I know it's a bit off the wall, but this this has happened. Okay. Um, what else? Okay. Male or female? >> Why?

>> Yeah, could be. Um, anyone else? Okay. Okay. Um, look at the shadow being thrown across the board. Yeah. From bottom right to bottom there. Um, where do you think the light sources generating that shadow? >> The ceiling. >> Whites. >> Uh, the angle. >> Exactly. >> It feels like the seal the ceiling light is behind the person. >> Yeah. >> And uh from the female my female friends, they are more uh likely to use lamps rather than ceiling lights. >> Yeah. Good working assumption. Yeah. Um, but sticking with the ceiling, right? Sorry. >> Are they tall? >> Why' you say that? >> They're closer to the light, so the shadow is sort of bigger.

>> Yeah. >> And it's more blurred. >> And it's more blurred. What about these shadows at the top in the eggs going the opposite direction? >> Reflective surface. >> Could be a reflective surface or >> sources. >> Multiple sources. What could that other source be? >> Window. >> Yeah. >> Yeah. Okay. So, you you you inferring a structure of a building and something about the people perhaps. Um when I did this before a few times, someone shouted out, "It's a woman." Or this man shouted out, "It's a woman." Oh, why is that? He said, "My wife's so untidy in the kitchen." Um okay. Uh and again, I did it in Stockholm to a client and I said, "How

tall?" And the guy said 186 and I just like three horses, two men two days ago, you know, Indian style. Um I said why do you say that? And it was just a guess. I took this photo. It is a stage photo. I'm 186 and all the observations you made are correct. So by bringing in all these incomplete bits of information, you're building up a bigger picture. You have a depth of one which means nothing, a depth of two, corroboration, additional information. I got a couple more minutes for me. >> Yeah, thank you. >> What do I do with mine? So that that's um that's intelligence or taking bits from anywhere. It could be from children. When I was doing

informant handling, recruiting insiders, um there was a procedure where we could actually recruit children informed. That's all being stopped now. Um you may not want to use them for evidence. You'd be silly to really, but you could use them for intelligence gathering. Um, when I was out in the Yemen, we collected a load of information out there from computers. No government would allow it to be used in court because it was obtained by torture. We assume. Yeah. But no government will turn a blind eye to intelligence no matter how it's got. Can you imagine, you know, it had been another and the government knew about it in advance, but because that information comes from dodgy sources, they didn't

act on it. Yeah. All everyone's going to act on intelligence. Good. Um the form of intelligence is that there's no one to validate it. There's no one to test it. There's no one to defend it. There's no court to examine it. So you come up with this thing called 5x5 by five, which is a grading system. And what you do when you're looking at your sources is how reliable is the source. So an A is absolutely never been wrong. And that would normally apply only to things like DNA, you know, or some hard scientific evidence. And as it goes down is well, yeah, they're almost always right. Uh often right and wrong goes down. Uh the

information credibility is it corroborated? Is it um how do that person know it? Is it by have they ever heard it? Do they know it themselves? And finally, the head of the instructions is where it can go. So one is distribute widely. Five is what we call compartmentalization that can only go to main person in land organization. That's very common in intelligence operations at national level. Uh so to finish off an investigative mindset is curiosity. Don't let the rules hamper you. As long as you know how to convert them lawfully into evidence, you'll be fine. critical thinking absolutely essential. France 3.3, Finland 8.6, but they teach their kids critical thinking in schools. Why is that

important? Denmark 8.6. They have the highest number of breaches caused by human error in GDPR. Yeah. Because they trust everyone. If you found out Denmark, I'll tell you whatever you want. Objectivity. Know where you're going. Persistence. And always think to yourself, why? Why? That person has just come out from the left. Why? You know, and if you train yourself, you can just become cynical as I in conclusion be honest with yourself. Are you what type of investigator are you? But once you know what you are, you can either try and counter it. So it's like countering bias in research. This is a big problem. Don't project your own morals and ethics onto problems or solutions. I see so many people in

cyber security. They look at a situation and they go, "Nobody will be so bad as to turn off the electricity to the incubator in a special care baby unit and kill a baby." Yes, they bloody well do. So, but a lot of people think, "No, I I just can't imagine that." And they blink at themselves and they miss everything on the outbuild. My advice, start on the out, overlay it with the risk, overlay it with the cost and the legal authority, then come up with your conclusion. But do not do that to start with. Uh be curious. That's obvious. Never stop asking questions. Never guess. I said it. I can say it now. Never guess.

Uh infer and test if you have to. And something I always say, security is a mindset first and foremost. It doesn't matter if you can do white assembly in your sleep. Yeah. Security is a mindset personal format. And that is it. I apologize for going slightly over time. Uh, any questions? I'm going to be around until about 1:00 when I'm going back up to the frozen north.

>> Thank you very much.

You can't add that much that just