BSidesSLC 2016 -- Insert Title Here -- Jack Daniel

[Music] Higher performance communication resources and faster and more reliable technology. Higher performance communication resources. [Applause] Hello. I have to change hats. I'll explain why in a minute. This is not my hat. It's a friend of mine's hat. I can't give it to him because he's dead. We'll talk about that in a minute. How's that for a bummer? Um, good job, Jack. So um

you can do it. technology.

Come on, you can do it. Maybe you can't do it. I'm standing right here. I could just give up on this and use the technology. Uh, so anyway, I don't I don't know what I'm talking about. I finally have decided I'm just going to admit this. Uh stories, rants, tangents, and intermittent content possibly. Go. Come on, you can do it now. I'm just technology. Why are you fine? So anyway, let's start here. Let's talk about bides a little bit. Uh you are here. That's the global map. that uh locations that have held security besides events since July 29th and 30th of uh 2009. Uh the green dots are places that um have yet to host one but have one

scheduled. Um you will note that there are ones in uh across the US. Calgary is the one up north. Um, Kiev in the Ukraine, Athens, Greece, and Tel Aviv, Israel are all coming online this year as besides events. Um, Sean's talking about community. You are part of a community. This is the 240th event since a handful of us got together in Vegas in July of '09. um 21 countries, every continent but Antarctica, 88 cities, uh 60 events in 2014, 62 last year. Um and as Sean said, these happen and he sort of over these events happen because of a dedicated organizing team, dedicated volunteer team, speakers, sponsors, and those of you that come and participate. I like to

use the word participant, not attendee. you're part of this. Um, is this anyone's first BIDS event? A sweet. That is fantastic. That is fantastic. Well, welcome to our family. Welcome to our community and we actually it there's more than one Bsides community, but there's a big global community and it is fantastic. Um, and it's fantastic to be part of. And for those of you that this is your first event, um, meet people, learn, share, connect with folks. That's what this is about. Um, I won't make fun of any other conferences like maybe one that happened in San Francisco last week. But, uh, you know, some events have, you know, founders circle badges and stuff. We're

a growing community. If you add onto your house, you have to add onto the foundation. A growing and vibrant community needs a growing foundation. So, if you've never been to a Bsides before and didn't know what one is was until a couple weeks ago, you're part of the founders circle because you are part of what makes Bides what it is. So, thank you for that. You are here. You're part of that. Thank you. And so, on to community. So, you kind of stole my thunder, but what is a community? We have a lot of them. Some of you have noticed there's some of us that are like real information security people and professionals and work for companies and

like usually have to go to the corporate conferences and then we get to come to events like this that we like um and we kind of straddle it because the RSA community uh at large uh is different than this community. It's different than the defcon community. The black hat community is not the same as defcon anymore. Sometimes uh we get wound up and uh don't play nice. Um you may have noticed some folks like to create drama, especially on the internet. Um it's fun but not productive. Um but we have to find the good in the communities. If I were more of a um sociologist, I would probably have to use the word tribes to describe this. Um

tribes and nations. I think the the hacker tribes, there are a lot of them and we're sort of under that that nation flag of tribes. But um it's extremely valuable. But I'm um already wandering. So just so that I can say I gave you some information of some value um I'm going to throw three slides up. If you're involved in a hacker club, especially at a school or uh high school, tech school, university, pivot project is a new project. Um there are a handful, I think we're at six or seven labs there now. Um, these are great resources for underresourced um, hacker clubs, particularly in education, but they're open to anyone. They tend to work best if it's, you

know, some sort of, uh, leadership to kind to support people. They're an hour to hour and a half. Uh, they're continuously being driven. A lot of educators are involved in this. Um, a couple of folks from SANS, Ed Scotas is one of the driving forces. Um Allan Por is behind it which means there's some some finance available to it. But anyway, this is a cool resource for anybody that's involved in education. Uh you know, if you're somewhere that has a killer program, MIT doesn't need this help, but your average school does uh or club does. Uh if you're into software assurance u and you pay taxes in the United States, you've already paid for this. Uh continuous insurance.org

uh software assurance marketplace. It's an online software security testing thing. load your code in, see how it works. Um, it's it's from the DHS. It's one of the things I think they do very well. Um, you'll get a ton of information back. If you do uh code security, it'll overwhelm you. But it's a good place to go to get some some baselines for free. It's already paid for, so it's free. Um, free as in we've already paid for it, so you might as well use it if that's your world. Uh, finally, a plug for one of my side projects, the shoulders of infosc. We have a lot of people that uh that came before us and we don't always know who

they are, why they are. When you land in this industry, you start running just to try to keep up and we rarely have the opportunity to look over our shoulder and figure out how we got where we are. And um a lot of the older generation is gone. And so I'm trying to do it. It's just a dumb wiki now, but there's some a lot of links out, a lot of information about folks. But on to what might be a topic. I don't know. Um, this is a Dan Gear quote from some years ago. Security's too wide to master, too deep to know, and too fast to photograph. Those of you who know or know of Dan

Gear, I want you to think about that. If Dan can't keep up, I'm screwed. Wait, wait. You feel that way, Dan? Yes. Ah, we're screwed. Um, and it can be overwhelming, right? I mean, if if we're fighting the battle, I mean, that that the pros versus Joe's scenario, that sounds way too real for a lot of us that that play or have played defender uh and not at play, right? That's that's a little terrifying. It's like, you're all fired. Well, you wouldn't give us the money to fix it. I freaking told you so. Um and then the new team comes in, right? And that's that when you're in that scenario. I'm a huge fan of cloud-based disaster

recovery, by which I mean you should always have a copy of your resume on Google Docs.

So, you know, infosc can be a challenge. Um, this is this is what I like to call the the infosc pose. On good days, on bad days, a pigeon craps on your head.

tell me that's not true. Now, the flip side is if if you're doing pen testing, if you're doing red team stuff, it's different. You always win. And after a while, you realize, wait, if I'm winning, we're we're not winning. Like h wait, that's not quite right. It causes some conflict. So, how do we cope? Um how do we cope with these challenges?

Um, I hate to, well, I'll paraphrase Hunter S. Thompson. Um, he was a little more hardcore than me. I hate to advocate a life based on caffeine and alcohol, but it works for me. Uh, it's it's not terribly healthy, though. Um, but what I want to talk about is how we do this. Not just cope, not just survive, but we thrive. So, we actually enjoy our lives. We love what we're doing. Here's one of the challenges. Tell anybody familiar with this one. I like to hack stuff. I like to do stuff. Oh, look. I can make a job out of it. Oh, well, that beats all the fun out of doing this crap. For some of the older and older of you

and those in management, the next phase of that iteration is, oh, I've built a company or I've joined a company and we're growing. So, I need to find young people who have that spark that I had that got me into this and then beat it out of them, too. Oh, I I may have made that comment in front of Dill Dog once and he just was like glanced over at the weld and they were like, but anyway, so how do we move on? Well, one of the things I want is to learn how to use a keyboard. I've had enough of you. Yeah, I know the timer's running. You just don't work. You um I want to tell you about a story

about a friend of mine. Doesn't work in it. Um didn't work in it. Uh but he made some bad decisions. Uh he was under stress. Uh he was overconfident. He knew what he was doing better than anybody else in the world and made a bad decision. That doesn't ring any bells with anybody in this room, I'm sure. Robin Wallbridge. Uh, for many years I thought he was the greatest mariner I had ever met in person. Um, that's him standing on the deck of his ship. He was the master and captain of the Bounty, the replica built for the Marlon Brando movie made in the early 60s. He had done um river boats, steam and paddle wheel as well as traditional

river boats. He had run uh the the Gulf to the east coast uh tanker routes. Um he has he had navigated everything from canoes and kayaks and rowboats to super tankers. Uh had decades on square riggers. He was uh the second um on the HMS Rose before that uh pulled out of uh regular service. That's rotting somewhere on the West Coast now. Uh but Bounty was uh had a couple of interesting things. Was made as a movie prop. They were going to burn it at the end of they were going to scuttle it at the end of the movie. Brando said it was too nice a boat. They couldn't do that. Uh and therefore it

kept uh its entire life from the 60s until a few years ago uh being patched up because it was built to be thrown away. Um, this is her under sail. Uh, not much sale, just enough to kind of make it look picturesque because, uh, the engines are running or it wouldn't be moving with the sales dangling. I got involved with Bounty, uh, some years ago, late 90s. Uh, she was in for a major refit at Dian Kelly's shipyard in Fair Haven, across the across the harbor from um, New Bedford, the famous whailing port. And um the lower third of the planking and framing was replaced. And you can sort of see that she's up on

the rails. It's 110 112 ft sparred length. She's a goodiz boat. She's bigger than the original Bounty by the way. They made her extra large to carry all the gear cuz all the cameras and everything went on on that. This is the kind of work we did. Those are double saw frames. Fun word. Fux that individual frame pieces. It's not one big rib. There are several of them. They're 5 to 6 in wide, 8 to 12, 8 to 10 inches deep. Uh they're green oak. They drop trees in uh the forests of Connecticut, run them to a sawmill, and bring them over to us while they're still uh green. And then we put them in

place. Plankings 2 and 3/4 to 3 in thick. Put that in a steam box. If you've ever done any woodworking, think about taking green oak, 3 in thick, 6 in wide. Put it in a steam box until you can bend it to fit a boat. I learned a lot about boats, ships, excuse me. Um, I spent all of my spare time for like 6 months, five months working on this thing, including on very picturesque days um in the snow. It's no fun doing that in the snow. So, I I grew to know the ship and love it. Uh, the crew, Robin, and I became friends there. That's us closing her off. That's us launching her. Um, you'll note the the

things sticking up are that rail that that uh railway she was on. And yes, we cracked the ice to um launch her. Couple days later, we sailed south. Um, so I spent a couple weeks as crew on her, helped to rescue her a few times. She had a a sinking incident. Um, so I spent a lot of time on her and stayed in touch with the captain and he was a great friend and um, he made a bad decision a few years ago. This bad. This is uh, Hurricane Sandy, October 2012. She had sailed through worse. Robin had been on her through worse. Um, but he underestimated the size of that storm and how long he and the crew and

the ship could handle Hurricane Sandy, how massive that storm was. Uh, there were um 16 people on board. The Coast Guard uh retrieved 14 souls, as they like to say in the Coast Guard, alive 90 miles offshore. If you ever want to see some heroism, the Weather Channel has a 1-hour special on the rescue. One of the rescue divers is in an H60, the bigger helicopters that the Coast Guard uses, says he's never been in anything like this. He's never done this kind of rescue. He's going 90 miles offshore in a hurricane. 90 mi offshore means they're about I forget how far inland the uh air station is that they fly out of. Uh but they didn't have more

than about 30 minutes on site because they were running out of fuel. every drop they would he would drop him. They would have to pick him up and then take him back because the life rafts were blowing away too fast. Camera points at him and says, you know, how do you feel about this? Like I'm I'm kind of scared, but this is what I signed up for. It's like, yep, that's Coasties. Uh anyway, uh one person was lost and recovered. Her name was Claudine Christian, actually a descendant of Fletcher Christian. And um Robin was lost with the ship. We don't know for sure, but one of those orange bits is probably Robin trapped and rigging in his um life fest. It is a

survival suit. It's probably the last picture of my friend Robin. This hat um last time I saw him, I was wearing my green uh George Kirbian son's uh paint hat, and he said, "I want one of those. I didn't know they had hats." I like, "I'll get you one." So, I bought it for him. I haven't been able to give it to him. Um, someday if I'm sentimental and sailing again, I might sail out and drop it overboard. Uh, but uh Oh, time for a tangent. All right, so completely off. Here we go. If you have a familyrun business and don't have a web presence, you might want to think about having a web presence, especially if you Google

your familyun business's name. And the only thing that shows up on the first page of Google is the EPA super fund site information. Kirby has been doing paint for a very long time. Uh and so they sort of had that problem. It's like you guys really need a website. Everybody comes to us. It's like, yeah, you just don't want people to try to find your phone number and find you're a super fun site. Uh so anyway, that's a story. I I I added that uh because uh I was in Tampa last week and I was on the water on a cruise ship, very different than that. And I realized the last time I was on those waters uh I

was in a ship which is now at the bottom of the ocean. Um, so anyway, a little perspective. Hopefully none of our decisions, but people's lives in danger. And not just the 16 of you on the boat, the crews that had to go out. Um, but our, you know, our decisions do have consequences and, uh, sometimes we make bad decisions. So, some of you may know some years ago a group of us did a study on stress and burnout. This is not that talk. I talk's pretty depressing. There's some depressing bits here like this let's scare the out of them story I just told you. Um but we learned some things about that and from that we learned that you know a

lot of people um like what we do. We tend to stay in the business because we like it and then it burns us out and we leave. Um most of us think we have a strong support network. We later found out that that was a skewed number. Uh the reason it was skewed is because most of the respondents came from people that we knew from the bides community and therefore we have a strong support network. It's like hey that's sweet. Not everybody has that. Um we consider our work valuable to us personally. Um others value our work. That's sort of hit or miss. You know sometimes people do a lot of times they don't. Uh we try

to make the world a safer place and sometimes succeed. Um, we like to think critically. We like to problem solve. Um, maybe we'd like the problems to back off just a little bit from time to time, but you know, we like to problem solve. Uh, and you know, it tends to pay well, but that's not the critical reason we do it. Um, you know, we don't like management politics. We don't like uh egos and rock stars and media hype. This says the idiot with the long beard and the top hat. Um, we don't media hype. uh we don't like the the bad bad business decisions and and more on that later. Some of them aren't bad, we

just don't understand them and nobody tells us why. Um but we like the fact that there's a lot to learn. We like the fact we actually have fun doing what we're doing at times. We go to great conferences. Um we hang out with smart people. Room full of brilliant people here. Why you're listening to me? I don't know. But they asked me here's something that I've learned. Um, and it didn't just come on when uh in old age. Uh, something about stress and memory loss. If you find yourself under stress and don't manage your stress, you're going to find your job performance goes to hell because you need to know stuff to be an infosc. And stress will screw up

your memory like you wouldn't believe. If it drives too far, if any of you have had major health issues, major family crises, and unfortunately, you know, that's fairly common, you probably noticed that. And if you have sustained family medical issues or you have medical issues, um, you can probably handle that. And if you hate your job and your job is driving you stark craving mad on top of it, you're going to find that you have notepads everywhere and you can't even figure out which notepad has the important notes for your stuff and it's on, you know, um, so one of the side effects and one of the things is that we actually, if we let ourselves drill into it, you know, a

stressed state, our performance goes off in large part because of memory. Should you be fortunate enough to live to be somewhat older? This gets a lot worse, I think. I don't remember. So, I'm going to talk about three words. These are the the the bad words. And the the bad words, well, two are bad and one is good. Um, but these are the the words we watch for as we're trying to stay away from from problem areas with three words. One of the words, um, is efficacy. This is a good word. If we feel we're personally effective, that doesn't mean we're beating the bad guys, but we feel that we're doing our job, we feel productive, that's healthy.

When you lose that, that becomes problematic. So, when you see that thing where you don't feel you're being as effective, you need to look at it and stop and think. It's like, oh, what's what's going on? Um, exhaustion is another one. These two turn out to be uh highly interrelated in uh crisis cases because if you think you're doing a good job, you will drive yourself ragged and it's okay because you're be being effective and then something goes wrong and you realize or you think you're not being effective and now you no longer have the emotional drive to do it and the exhaustion collapses on you. Um and those are the folks that we often see.

And then the third one it's kind of hard to talk about because it's cynicism and uh in everything we've looked at that's like cynicism that's core competency for infosc and the the trick there I want to make a distinction it's hard to measure without a conversation tests can't really measure it well standardized tests um you it's really hard to be effective in infosc if you're not skeptical Now, skeptical is cool. It's like, "Yeah, okay. Uh, can you back that up? Can Can you back that up without citing Ponamon?" Uh, friends don't let friends sight pon. Um. [Laughter] Ah. Isn't that the truth? Um, [Music] so, um, yeah, don't fall for stuff, right? Again, there was that thing last week in San

Francisco and there was a lot of stuff to fall for. So, don't fall for stuff. But there's a difference between that and not believing in anything. Although, uh, one of my favorite Carlin quotes is inside every cynic is a disappointed idealist. That may personally sting a bit. Uh but anyway, those are the the words you're trying to do. Uh so we did a study on burnout. The cool thing was that half the people had no indicators. They were nice and healthy and it was fantastic. And uh a handful of us did analysis on those respondents to figure out what the patterns were, what the keys were and this is what we found. It's a better random number generator

than NSA has given NIST to give us. Um, there were no patterns. So, I know where I am. So, some of you I know are not coffee drinkers. That's cool. Um, but you don't have to drink coffee to appreciate the metaphor. This is a part of my breakfast shrine. Uh, there's a toaster there. I hardly ever use that. There's also a giant fruit press juicer um next to that so I can have fresh orange juice. Here's something really weird. We've got a we got a place for the winter down in coastal Georgia. So, we're minutes from 30 minutes from uh northern Florida. So, good fresh oranges are readily available in bags at the supermarket cheap.

Can anybody explain to me why it is if you buy fresh oranges, even juice oranges, cut them in half and squeeze them and drink what comes out, it doesn't taste like orange juice. It's like commercial product rant. Anyway, so um the way this works is think about the poor coffee bean. Um you pick a little bean, ship it across the world, you roast it, grind it up, add hot water under extreme pressure, and something comes out the bottom that might be good or bad. Um if you've done it right, it's like, wait, abused all through your life and then add heat and pressure. That sounds like working an infosac, right? Um so what do you do with that? Well, most

people don't shoot espresso straight. Um, but you know, if it comes out right, you get a nice rich crema and you've got, you know, you can actually taste flavors other than just the the puckering bitterness. And then we, you know, maybe add water or sweeteners or creamers or flavorings uh to taste. And that's sort of where we are. We have to take where we land going through life. Um, and I hate this slide. I did this some a while ago and there's just way too much stuff in here, but we're going to talk through it because I um here's that coffee grinder press steamer thing uh boiled down and we take some of the stuff that comes in at the top and we

the goal is to stay above the red line to to get out of that exhaustion, cynicism, being less good at our job, uh physical and mental illness, substance abuse, that's a whole another conversation. Um, not going to say anything about anyone in particular. You'll figure a few of them I'm talking about. Uh, we have a bunch of really smart people in the hacker community and security industry and they like to push their body to limits and that's cool. Like I said, I um I went to high school and college in the 70s. You can make assumptions about my uh stance on recreational pharmaceuticals. Um, but let me just say this. Um, you can call it biohacking, but when it's drug

abuse, tough people stronger than you have failed and died, and I don't want to lose any more friends. Um, wow, Jack, you're being you're supposed to be upbeat on this one in front of me. Um, but no, it's and it's easy to rationalize. We've lost a few and some of you know who I'm I'm talking about. Uh, and we don't want to lose anymore. Uh, but the substance abuse, you know, is one of our challenges. If you go to Defcon, you go to RSA, you go to Black Hat, you go to Besides Vegas, you go to Shmukcon, uh you see people drink a lot. And what you don't know is whether those people drink a lot or do other substances um

all the time at that level or if they just have, you know, let themselves go wild every now and then. Um which is not great, but it's very different than, oh, they're that drunk every day. Um, so we're trying to avoid getting there. So if we work in the top, notice burdens are work, family, personal, and social. Wait, aren't those the things that help us? Yeah, they are, but they're kind of, you know, family is easy to pick on, right? Family is an amazing support mechanism. And they're still family, right? You know, there are some challenges. uh social and professional support, um autonomy and control. More on that, and personality and coping skills. Some people just don't get stress. They

simply do not understand how you can complain about stress, how you can get frustrated working in this industry. It's just too damn cool. I have two friends, both named Dave, who like make fun of us every time we talk about these things because they don't understand that. It's like ah well on the other hand um in the past couple of years I've had this thing where people in their uh mid20s to early 30s come up to me and say hey when I got into the business you guys were doing all that stress and burnout stuff and I laughed at you cuz that was stupid. How could you old people be upset about this? This is the

most amazing job. It's stuff I love to do. It's my hobby and I get a paycheck for it and if I don't like it I can go somewhere else cuz there are plenty of jobs. I don't know what's wrong with you people. But um so now now I'm a few years in and you got a few minutes to talk. Like yes, yes I do. Um I do have a few minutes to talk. Let's talk. Um and one of the things that I didn't realize cuz I dropped out of I had the decency to drop out of college early and drop out of a cheap school. Uh my children also had the same thing. They dropped out of

cheap colleges. Uh so uh the number of young people that are under uh an enormous financial aid uh student loan burden is really depressing and that's not just an infosac problem. Um one of my congress my congressman um I was at a fundraiser for him and one of his uh another congress person from an adjacent district was there and the the topic came up and she had an aid. So, you know, congressional aids don't make a lot of money. Uh, carrying about $145,000 in student debt. That's not for a medical degree. You know, that's political science or something that pays nothing until you make it to K Street and become a lobbyist. So, where do we go? How do we make these

things work? Um, I'm going to tell you dumb you already know, and I want you to actually pay attention. Uh, take time for yourself. Turn things off. Really? This is painful, right? This is pain. No, I like technology. Yep. I know you like technology. Turn it off. Really off. But but but I I know. Look. Look. I feel your pain. Last week I blew $30 for an hour of internet on the stupid boat. I did it one evening and I I was completely offline for five days. I was a little twitchy. The backlog of email when I got back on, you know, I logged into Slack and the various email accounts and text messages everywhere and it's like a

but it was all right. I was offline. I hung out with my wife. We like went through the jungles of Honduras and took boat rides through mangrove swamps and hand cut canals carved by according to the tourism people carved by pirates to hide their stuff. More likely hacked by local fishermen to get to the giant lagoon you couldn't get to otherwise but you know whatever. uh saw Mayan ruins and stuff, you know, in in Guatemala and Mexico. Really cool stuff. Um and I was disconnected. Uh it was kind of cool. Uh some companies are actually starting to do this. It's one of the few things Volkswagen's doing right lately. Uh the guy at the head of VW USA uh quit

yesterday. Um he was the guy he was like the one logical person in VW of America uh through their little crisis. Um and so the dealers are in uproar. I used to be in the car business. Um, and uh, so I pay attention to that and every time I get frustrated with infosc, I remember being in the car business and then I have to go take a shower, but then I feel better when I wash that off me. It's like I feel guilty for not helping people that are doing car hacking stuff, but decades in that business, it's just sleazy. Um, but VW, at least in Germany, if you don't need email overnight, you don't have access to email overnight.

got a company Blackberry. That's all right. It's not going to connect. You can't pull your email except when you're supposed to. What a crazy idea. Do your job. Um I used to work for a German company. Germans have a reput Go ahead and offend people all over the world. Jack, offend people all over the world. Germans have the reputation, a well-deserved uh reputation for being um very hardworking people. That's because they're in Europe.

Wow, I said that. Um, that's right. They've heard that before. Um, get out of infosc for hobbies and recreation. That's right. You You like to ride bikes, you like to ski, you like to run, you like to do whatever. Sure, put a array of computers on the handlebars of your bicycle, but get out, you know, get get away from it. Come back to it. It's more fun. Um, if you've got a job that's evolved into something horrible like compliance or management or something evil, um, you know, come to things like this and and do the hack stuff that you thought was fun. Do it as a hobby. Um, and there's a really important reason for doing this and it's a canary reason.

So, you need family time and personal time. Um, the canary reason is this classic all sorts of health things, whether you want to call it mental health or general health. If you love to play golf, um, or whatever it is, if you love to ski, love to cross country ski or snowshoe, um, and it's not something that's tied to your job, that's a canary. When you think to yourself, "God, it's a gorgeous day. Did you see that sunrise this morning? But I I'm not going to the mountains. I don't want to ski that. I'm tired of it. I'm tired of It's like, wait, no. This is something you love. Now, our our hobbies evolve over time, but when the

things that uh keep you going, start not doing it. You need to stop and think, are there other things going wrong? Uh, health matters. Growing old sucks, usually less than the alternative. Um, take care of yourself. Uh, maybe only so you can take care of others, but uh, pay attention to your health. Um, When you're 20, you can ignore all sorts of things. When you're in your 30s, uh you can ignore fewer of them. Once you hit 40 and then, you know, when I visit the doctor or go to the hospital for something, it's like they just see dollar signs. Oo, old dude with insurance.

General common sense. don't face challenges alone. One of the great things about this, one of the reasons that this stress and burnout research and these ongoing conversations happened was because a handful of us would like, "Hey, you looked like at Schmukon. What's up, dude?" Um, and that just grew and grew until the circle of people was was very large that we were kind of keeping tabs on. Hey, she didn't look so great. What's going on? Yeah, she's got some family stuff. All right. Well, you know, don't want to don't want to bring in personal stuff. we're not that close, but I'm just going to, you know, go by and say hi and make sure that, you know, people know we're

thinking about them. Uh, in a workplace, more on this later, but don't make employees face challenges alone. Um, used to be PCI, the QSAs used to be like the the people that got shredded fast. It's now incident response, incident response, uh, folks, DFIR folks are getting shredded. Um, support them. Friends and family, assets and liabilities, mutual support rocks. um you you have to stop and think who needs support and you know sometimes there's value in you providing support to somebody because it makes you feel like you're doing something good which you probably are. Um, one thing about this I will say uh we say that if if I forget it sometimes when uh when you see people

that like maybe you're a little bit off just say hi you know depends on how well you know them what your relationship is how much you go you know unless you're an actual mental health professional that they've gone to there's some lines you're not going to cross but you know hey you seemed a little off you under the weather or just stress training Um, and just the fact that people give a about them is going to make a difference, right? When people ask, that's kind of cool. It's kind of cool. And then, uh, the one thing that I have to say now after saying that is so like today, tomorrow, over the weekend or whatever, if like four or five of your

friends say to you, "Hey, you okay? You seemed a little off." Uh, don't get mad at them, which is going to be your first response. Be like, "Huh, maybe I should pay attention." um briefly road warrior. How many people travel for work more than say 10 or 15%. Handful. Not too many. That's that's good. Travel for work is not the same as travel for fun. You can make it suck less. Um everybody ends up working in their hotel room and then when they're not on site, they work in the coffee shop because that's where everybody goes. Don't find something better. You don't have to be an old drunk like me to find out that there are some bars that are the best

co-working spaces around during the day. In San Francisco, I hang out at Vuvio, the old beat poet hangout in it's fantastic cuz when I can't think anymore, it's next door to City Lights, one of the best bookstores on the planet. Walk across, grab a book or magazine, take 15 or 20 minutes off, and then dive back in. Um, and it's not a whole bunch of people that are just obnoxious. It's, you know, fairly quiet. Uh, but find find a place where you can actually like have a world around you other than that wallpaper that they have over the desk at the courtyard. Um, think about how you pack. You know, if you haven't learned these things,

packing better, I'm not going to tell you how to pack, but people have to figure out what works for them and what doesn't. Uh, you know, take less stuff. We tend to eat and drink uh too much and the wrong kinds of food. Um, water is a magic word. We don't get enough water on the road. More on that in a moment. Know your surroundings. Um, the fact that you're in a bad neighborhood is not as obvious as the crows are carrying knives. We rarely have it quite this obvious. Like, holy I'm not leaving my hotel. Uber, Uber, taxi, what? Um, but if you go out and ask people, um, where can I go? Uh, and you have to have

some, you have to put some thought into it. I'm an old white dude. I get away with a lot. I'm a tall old white dude. Um, it's different for other people, but um, you know, one of the things I do is even when I'm not drinking, I will often go to a restaurant and rather than sit at a table by myself, I'll park at the bar and eat. A lot of people think that's sad. I don't because then you chat with the bartender and then you find out if cool stuff's going on and you figure if you can sneak it out or they'll say you know they know where the where the service folks go which is good

food and good drink cheap for those little bit of you know a little bit of time but get out and enjoy the city a little bit if you can I know that's much uh water people don't hydrate enough if you travel air travel dehydrates you um coffee dehydrates you alcohol dehydrates you road food dehydrates you um more water um Water's problematic on the road because it's $8 a bottle at the rest at the stupid hotel and it's just swamp water, tap water. Um, but it makes a real difference if you fly a lot. Uh, my my doctor uh told me years ago, take a clarin D before you fly. Every time before you get on an airplane, clarin D.

But I'm not stuffed. I You want your sinuses wide open so you don't pop ears and you don't have as much grief. Like, okay. Um this this guy has been my primary care physician since I was a teenager. Yes, he is old. Um he also advocates uh for those of us that are in the north and have forced hot air heat sus passages dry out. You get on an airplane, it's a petri dish full of whatever. You can netti pot if you're into water boarding yourself, but you know the saline misters or something to keep the nasal passages, especially a couple days before, keep them dry. I don't get sick very often, even though I

travel a lot and go to a lot of conferences and talk to a lot of different people. Um, of course, I also don't have children in my life, those little roving petri dishes of disease that go to school, incubate, and then bring it home to mom and dad. But um that's it. And here's the counterintuitive stuff. How to feel better about yourself. Do more work. It's like no no no I'm shredded. I can't. No. Do more work, but do work you want to. Again, got into this to do hacking and now you're sitting there with a clipboard full of a digital clipboard full of compliance crap. come to these events, play participate, you know, play some of the online games,

do work you want to do. They don't appreciate you at work or don't show it. Do things where people like say crazy like thank you, right? Maybe maybe that's through school, maybe that's through your your kids school, maybe that's through church, maybe that's local ISSA or Isaca or Linux user group. go and give a talk and share what you know. Um, a lot of folks appreciate that. It's kind of cool. People say thank you. Uh, and you learn cool stuff because anytime you give a talk, you have to like know what you're talking about. Except for me, I've gotten to a point where I just fake it all. Uh, mentoring is a great way to see your

own hypocrisy. Mentoring is great. There are always a lot of people who could use some advice and you don't have to be an expert um to mentor people in various, you know, whether how no matter how formal or informal. One of the fantastic things about mentoring is uh you really do get to see your own hypocrisy. Yeah. You know, I've been in that situation a couple of times and the one thing that you just don't want to do is this, right? And Oh, yeah. Yeah. That Exactly. Cuz Yep. That's what happens. And then you're just miserable and you regret it for years, right? Right. Okay. Hey, good. I'll talk to you again next week. All right.

Because you've done that, right? You've made that mistake. And the the beauty is hopefully if you tell other people not to do it the next time you will maybe learn from yourself or worse, you know, maybe they'll learn from your mistakes instead of having to make them yourselves. So, uh, volunteer, mentor, speech share um, you know, be part of the bides community, help volunteer next year or whatever else you want to do. Join the cruise, you know, ask if the folks at Defcon need help. That's a really big con. They need some people. It doesn't happen by itself. Local Linux user group where six people get together, that doesn't happen by itself. People need people.

Um, OASP, whatever works. Um, things like, uh, if you're engaged in communities like church or other things where people could get a really basic don't do dumb talk, hey, do that. They'll say thank you. It's really cool when people say thank you. Um Sean mentioned this at the beginning. One of my favorite people to quote from is Isaac Newton. Um he was a pretty smart dude. He sort of changed the way we view the world for the ever since. Right. Um changed our view and of the world and understanding of the world forever and borrowed. This is not an original quote. He paraphrased uh someone he learned from. If I've seen uh further it is only

by standing on the shoulders of giants. Um, and I like to point out that um, you need to understand that you don't have to be a giant to offer someone a shoulder to stand on. I believe, maybe I'm being a little too idealistic in my old age. I believe that by offering your shoulders for others to stand on, that's how you become a giant. It's by providing that. Now, we all have, you know, things to do. And as as Gandhi famously said, the problem with altruism is there's nothing in it for me. Um, I think he said something about there being a problem with attribution on the internet, too. But, uh, but here's the deal. There is something

in it for you. You feel better because you do cool stuff. You make connections. You network. Um, and I'm not saying do it for mercenary reasons, but when you do good stuff, um, when you help other people, they're more likely to help you when you need it. Um, and they're more likely to help you when you don't need it. So anyway, uh, education, learn something new. That's always we like that. If you're in this industry, you like to learn stuff. Um, education's work, so it has to be, uh satisfying. Um, sometimes you need to make little changes, sometimes you need need to make big changes. Uh, let me quickly address those of you in management roles.

Um, do you have too many qualified trained employees and is it easy hiring the folks you need? I know the answer to that one from a study. Um, this is one that like psychologists and other propeller heads uh put a lot of work into in 1991. The capacity to influence organizational policies, especially those with direct impact on staff members work reduces susceptibility to burnout. Let's we don't need to read that. So, how do you torture somebody without violating the Geneva Convention? You take away their feeling of control. That's it. Breakfast sometime between 6:00 and 8 every day. It's not the same meal either. No pattern. Lunch, same thing. Lights out, different time. You can put generals and deposed

dictators in a mansion and make sure they don't feel any predictability in their situation. And after a few months, they start to become unhinged. So they don't know what's going on. They don't understand why things are happening. They don't have control over them. And it makes them really, really uncomfortable. Thankfully, none of us have ever worked or work in environments where we don't understand what's done and why. We don't understand the time. Oh, wait. Yeah, that's work, right? Even when you have to do dumb stuff, uh, make sure people understand why. It goes a long way. It's like look, you know, the company just IPOed, therefore Wall Street, therefore the quarters numbers make mean more to those

people. That's the way it works. Uh maybe you want to go to one of your buddies startups if this is going to kill you, but this is how that works. It's like, oh, I get it, you know. Um have some control. Uh provide feedback. You know, let people know what's going on. Don't let them face challenges alone. Um, DFIR, as I mentioned, there aren't enough qualified instant responders and so they get work piled on them until they melt down and leave and then there are even fewer people and they burn them out. Um, allow employees to disconnect, maybe force it, offer education. You probably all heard the joke or line, you know, the two executives talking

about paying for uh employee training. It's like, "What if we train them and they leave?" The other one says, "What if we don't train them and they stay?" I got to wrap this up, but um a lot of this comes down to really understanding what's important to you. You know, it's like when we talk about talking to the business, we have to know what's important to the business. Email can't fail. It's like really there are enterprises where Slack can't fail, but email can go away for a couple of days and people will get over it, right? There are other places where if the email goes down, money stops flowing instantly. Email maybe really is. You

know, it's not as important as the people that run Exchange think it is, but that's a whole another thing. Um, I want to talk about two guitars. Uh, these are the offtheshelf, these are not the owner's originals. Uh towards me is a Fender Strat, the Dick Dale Beast model. Other side is a a Gibson Lucille, an ES 355 variant. Uh Dick Dale plays that. Uh BB King played the other one. Interestingly, the 335 is what people think that is. It's 355. It's a stereo guitar. BB was one of the few people that played stereo electric. Um,

so you might have heard this song from the ' 50s, '60s, ' 80s, '90s. This is Dick Dale's cover of Musloop. Dick Dale plays a guitar called The Beast. looks kind of like this except it was handbuilt for him by Leo Fender. It was handtuned by Leo Fender and he has played the same guitar since the late 50s. He also carries the same Showman amps to every show he does that Leo built for him by hand. That guitar matters to him. This guitar is um you can see actually the neck's flipped on that. He plays left-handed but a right-handed neck. He plays wrong but he shreds so hard that the higher note strings are on the

shorter machine heads. So the strings are about 4 and 1/2 in shorter and so they take more abuse and he plays so hard that matters. Uh but it's a customuilt guitar. That's not it. But, you know, that's kind of what it looks like, but not really. But this is a guitar that he has carried on the road since 58 or 59. What really matters? BB played Lucille, but if you go to like hard rock cafes, you see a guitar called Lucille on the wall. [Music] He was uh playing a a show. Um he just spent $35 for a guitar, not one of these. And um the way they heated the juke joints was they put a 55gallon drum

of kerosene, half full of kerosene in the middle of the floor and these plywood shacks lit it on fire and that was the heat. Um barrel got knocked over, place burned down, band ran out. He realized he'd left his guitar in, ran back in to grab the guitar. They get in the car, they go on. Next day they hear seven people died. Heard the story. It was two guys fighting over a woman named Lucille. He named that guitar and every guitar he had afterwards Lucille to remind him never to do anything that stupid again. So he found a guitar that was good for him and his guitar mechanic would take an offtheshelf model and put a couple of

tweaks in it and off we go. So the reality is, you know, you see a master guitarist, Dick Dale or BB King or somebody, you look at that guitar and think it's important to him. You know, BB King needed a Lucille. You know, maybe you don't need whatever it is you're doing. Dick Dale needs it. If that if if you've got that axe that uh that Leo built for you in the 50s, take care of it. It'll take care of you. But know what matters. And that's really what it what it's about. Uh focus on what's important to you. Uh, I'm going to leave you with another quote, one of my favorite quotes, uh, for besides

audiences, uh, from Isaac Newton. I do not know what I may appear to the world, but to myself, I seem to have been only like a boy playing on the seashore, and diverting myself in now and then, finding a smoother pebble or prettier shell than ordinary, whilst the great ocean of truth lay all undiscovered before me. Newton felt that way about his discoveries. He found interesting shells and pretty pebbles and changed the world. Um, if you go out and you find your shells and find your pebbles, you're going to change your world for the better and maybe other people's worlds for the better because you're doing things that matter to you. And then the stupidity at

work doesn't matter as much. The family stuff is easier to deal with. The bad stuff and the good stuff is even better because you can share it with people. And with that, it is not the end. This is the beginning of two days of cool stuff. And with that, thank you very much. Um, enjoy the next two days.

[Applause]