Bea Hughes's guest appearances

Bea Hughes

Brakeing Down Security Podcast

Page it to the Limit

Liz Fong-Jones

Kevin Johnson

Ben Johnson

Tony Robinson

Jack Rhysider

Marcus Carey

Jared Folkins

Laurie Barth

Tanya Janca

John Allspaw

Emily Freeman

Chris Hadnagy

Jay Gordon

Sean Malone

Adam Baldwin

OwlTail

Sarai Rosenberg

Security for people that are new to Security: Sarai talks to us about how security is about assessing risk and deciding what you care about in your systems, what you want to protect, and what you want to do about these risks. Bea hops in to describe security as being about managing risk, and harm reduction as you can’t defend everything equally. “You can’t secure everything, not everything in your company is the most important thing” Debunking a Security Myth In debunking a common myth in security, Bea talks to us about how there isn’t always one solution for everyone: “That there’s one solution that works for everyone, that what is a big risk for me for my product, for my software is going to be a risk for every software, the threats that I have to care about the things that I want to protect are completely different than the threats that you may want to protect and the things that you care about.” Values of the PagerDuty Security Team Bea and Sarai talk about the values on the PagerDuty security team and why the team has those values. Sarai talks about how at previous companies, there was naming and shaming of folks who failed things like phishing tests, and how at PagerDuty “we try to make it easy to bring in other people, never hesitate to escalate”. You Can’t Prevent Phishing, But… Sarai talks to us about how while you can’t prevent phishing, there are ways to help people use their emails in a secure way without trying to trick employees so you can catch them and call them out. Instead of creating a negative experience Sarai tells us that it’s ok to fail. Bea talks to us about how it’s not the fault of specific people to accept risk instead: “Present this information in a secure way, and not chastise them for doing their job”, instead as a security team you need to update what you’re doing to enable folks to do their jobs. How do you Impart your Values on the Rest of the Company Sarai and Bea talk about how it is important to make security training fun for the participants, and how through the use of lockpicking you can “find things that people can use so they understand that security is about defense and depth”. They go on to share with us how Security has a collective responsibility to be collaborative. Bea expands on why lockpicking is a great example of the vulnerability of security but is part of a “layer of security”. How the Security Team Tackles Incident Response We talk about how PagerDuty’s Security team has a little bit of a different take on incident response because it is a mixture of traditional security response which is responding to attacker or breaches, and how tuning alerting also comes into play. Sarai: “It’s this cycle of tuning our alerts as we add more and more monitors”. Julie: “…and tuning is so important because eliminating the noise, reducing the noise; helps with alert fatigue, it makes life better for your engineers”. Reducing the Noise, Getting Rid of Stuff Bea talks to us about how to reduce the noise, and how if you can get rid of unnecessary services you have less to secure. Bea: “Step one, in buying an IDS, don’t; if you do by mistake, delete all the rules and then slowly add them in because every IDS rule set has way too many things to actually be useful”. Bea goes on to say how alerts should have outcomes and be high quality. Quick Wins Sarai discusses how quick wins are great and how there are so many risks out there, so let’s look at one particular process.  “Start with basic things and the easiest things to implement”. By starting with something quick and easy we get that quick wins. Bea talks about how having a security win not be perfect is better than pretending that you can get to 100%. What is the one thing you wish you would have known sooner Sarai tells us how she wished she realized that she has a lower risk tolerance than other security and software people in general and that she should: “Just go for it, go try something, see if it works, see what happens if I break something. As long as I have a plan to go backwards then might as well try it”. Bea brings us the closing wisdom of “stop worrying about your crypto because that’s probably not where you are going to get owned in a security sense”, and Sarai says: “Cryptography problems are actually social problems… it depends on your use case”. Additional Resources  PagerDuty Home Page Handmade security at Etsy PagerDuty’s Security Training Episode transcribed by Rev

<h3>Security for people that are new to Security:</h3> Sarai talks to us about how security is about assessing risk and deciding what you care about in your systems, what you want to protect, and what you want to do about these risks. Bea hops in to describe security as being about managing risk, and harm reduction as you can’t defend everything equally. “You can’t secure everything, not everything in your company is the most important thing” <h3>Debunking a Security Myth</h3> In debunking a common myth in security, Bea talks to us about how there isn’t always one solution for everyone: “That there’s one solution that works for everyone, that what is a big risk for me for my product, for my software is going to be a risk for every software, the threats that I have to care about the things that I want to protect are completely different than the threats that you may want to protect and the things that you care about.” <h3>Values of the PagerDuty Security Team</h3> Bea and Sarai talk about the values on the PagerDuty security team and why the team has those values. Sarai talks about how at previous companies, there was naming and shaming of folks who failed things like phishing tests, and how at PagerDuty “we try to make it easy to bring in other people, never hesitate to escalate”. <h3>You Can’t Prevent Phishing, But…</h3> Sarai talks to us about how while you can’t prevent phishing, there are ways to help people use their emails in a secure way without trying to trick employees so you can catch them and call them out. Instead of creating a negative experience Sarai tells us that it’s ok to fail. Bea talks to us about how it’s not the fault of specific people to accept risk instead: “Present this information in a secure way, and not chastise them for doing their job”, instead as a security team you need to update what you’re doing to enable folks to do their jobs. <h3>How do you Impart your Values on the Rest of the Company</h3> Sarai and Bea talk about how it is important to make security training fun for the participants, and how through the use of lockpicking you can “find things that people can use so they understand that security is about defense and depth”. They go on to share with us how Security has a collective responsibility to be collaborative. Bea expands on why lockpicking is a great example of the vulnerability of security but is part of a “layer of security”. <h3>How the Security Team Tackles Incident Response</h3> We talk about how PagerDuty’s Security team has a little bit of a different take on incident response because it is a mixture of traditional security response which is responding to attacker or breaches, and how tuning alerting also comes into play. Sarai: “It’s this cycle of tuning our alerts as we add more and more monitors”. Julie: “…and tuning is so important because eliminating the noise, reducing the noise; helps with alert fatigue, it makes life better for your engineers”. <h3>Reducing the Noise, Getting Rid of Stuff</h3> Bea talks to us about how to reduce the noise, and how if you can get rid of unnecessary services you have less to secure. Bea: “Step one, in buying an IDS, don’t; if you do by mistake, delete all the rules and then slowly add them in because every IDS rule set has way too many things to actually be useful”. Bea goes on to say how alerts should have outcomes and be high quality. <h3>Quick Wins</h3> Sarai discusses how quick wins are great and how there are so many risks out there, so let’s look at one particular process. “Start with basic things and the easiest things to implement”. By starting with something quick and easy we get that quick wins. Bea talks about how having a security win not be perfect is better than pretending that you can get to 100%. <h3>What is the one thing you wish you would have known sooner</h3> Sarai tells us how she wished she realized that she has a lower risk tolerance than other security and software people in general and that she should: “Just go for it, go try something, see if it works, see what happens if I break something. As long as I have a plan to go backwards then might as well try it”. Bea brings us the closing wisdom of “stop worrying about your crypto because that’s probably not where you are going to get owned in a security sense”, and Sarai says: “Cryptography problems are actually social problems… it depends on your use case”. <h3>Additional Resources</h3> <ul> <li><a href="https://www.pagerduty.com/" rel="nofollow" target="_blank">PagerDuty Home Page</a></li> <li><a href="https://legacy.devopsdays.org/events/2014-minneapolis/proposals/Handmade%20security%20at%20Etsy/" rel="nofollow" target="_blank">Handmade security at Etsy</a></li> <li><a href="https://sudo.D.com/" rel="nofollow" target="_blank">PagerDuty’s Security Training</a></li> <li>Episode transcribed by <a href="https://www.rev.com" rel="nofollow" target="_blank">Rev</a></li></ul>

Security With Bea Hughes and Sarai Rosenberg

Realistic Threats  Nation states aren’t after you  https://twitter.com/beajammingh/status/1191884466752385025  https://twitter.com/beajammingh/status/1198671660150226946  https://twitter.com/beajammingh/status/1198671952824565762    https://www.leviathansecurity.com/blog/the-calculus-of-threat-modeling    What are credible threats? Malicious insiders -  Non-malicious insiders -  https://www.scmagazine.com/home/security-news/not-every-insider-threat-is-malicious-but-all-are-dangerous/     Education issue?     Is there such a thing as ‘non-malicious’ or is this just bunk?   Real threats  https://resources.infosecinstitute.com/5-new-threats-every-organization-prepared-2018/ CIO magazine threats -- buzzword threats (we should totally containerize all the things) Vulns that have names (blue team is stuck dealing with ‘theoretical’ issues e.g. SPECTRE/MELTDOWN) Lack of well-priced training?     Dev Training?     Security Training?   Better management communication will reduce threats     Building trust so they don’t freak when ‘$insert_named_vuln’ shows up     Gotta frame it to business needs     “Everyone is vulnerable” - keep FUD to a minimum, don’t exaggerate.     Know your industry’s threats (phishing, money transfer fraud, malware Patreon donor:  Michael K. $10 patron! Layer8conf - https://www.workshopcon.com/events https://layer8conference.com/   Regarding diversity scholarships, it's being worked on and the number of available spots will highly depend on the number of Sponsorships the conference secures. As a side note WorkshopCon will sponsor a number of Layer8 conference tickets if people follow @WorkshopCon on Twitter and tweet to us why they are interested in Social Engineering and OSINT topics with hashtag #sendMeToLayer8. We will select folks from those tweets with the emphasis being on folks coming from underrepresented or minority groups. In terms of sponsorship information for Layer8, Patrick wants people to send an email to sponsors@layer8conference.com Please let us know if you have any other questions, and thank you so much for giving us a hand spreading the word!!!   Saturday June 6, 2020, RI Convention Center   https://www.dianainitiative.org/ https://twitter.com/DianaInitiative   Conference in Las Vegas (Aug 6-7, 2020) (Thu &amp; Fri) Check out our Store on Teepub! https://brakesec.com/store Join us on our #Slack Channel! Send a request to @brakesec on Twitter or email bds.podcast@gmail.com #Brakesec Store!:https://www.teepublic.com/user/bdspodcast #Spotify: https://brakesec.com/spotifyBDS #RSS: https://brakesec.com/BrakesecRSS #Youtube Channel:  http://www.youtube.com/c/BDSPodcast #iTunes Store Link: https://brakesec.com/BDSiTunes #Google Play Store: https://brakesec.com/BDS-GooglePlay Our main site:  https://brakesec.com/bdswebsite #iHeartRadio App:  https://brakesec.com/iHeartBrakesec #SoundCloud: https://brakesec.com/SoundcloudBrakesec Comments, Questions, Feedback: bds.podcast@gmail.com Support Brakeing Down Security Podcast by using our #Paypal: https://brakesec.com/PaypalBDS OR our #Patreon https://brakesec.com/BDSPatreon #Twitter: @brakesec @boettcherpwned @bryanbrake @infosystir #Player.FM : https://brakesec.com/BDS-PlayerFM #Stitcher Network: https://brakesec.com/BrakeSecStitcher #TuneIn Radio App: https://brakesec.com/TuneInBrakesec

Realistic Threats  Nation states aren’t after you <a href="https://twitter.com/beajammingh/status/1191884466752385025" rel="nofollow" target="_blank"> https://twitter.com/beajammingh/status/1191884466752385025</a> <a href="https://twitter.com/beajammingh/status/1198671660150226946" rel="nofollow" target="_blank"> https://twitter.com/beajammingh/status/1198671660150226946</a> <a href="https://twitter.com/beajammingh/status/1198671952824565762" rel="nofollow" target="_blank"> https://twitter.com/beajammingh/status/1198671952824565762</a> <a href="https://www.leviathansecurity.com/blog/the-calculus-of-threat-modeling" rel="nofollow" target="_blank"> https://www.leviathansecurity.com/blog/the-calculus-of-threat-modeling</a> What are credible threats? Malicious insiders -  Non-malicious insiders - <a href="https://www.scmagazine.com/home/security-news/not-every-insider-threat-is-malicious-but-all-are-dangerous/" rel="nofollow" target="_blank"> https://www.scmagazine.com/home/security-news/not-every-insider-threat-is-malicious-but-all-are-dangerous/</a>     Education issue?     Is there such a thing as ‘non-malicious’ or is this just bunk? Real threats <a href="https://resources.infosecinstitute.com/5-new-threats-every-organization-prepared-2018/" rel="nofollow" target="_blank"> https://resources.infosecinstitute.com/5-new-threats-every-organization-prepared-2018/</a> CIO magazine threats -- buzzword threats (we should totally containerize all the things) Vulns that have names (blue team is stuck dealing with ‘theoretical’ issues e.g. SPECTRE/MELTDOWN) Lack of well-priced training?     Dev Training?     Security Training? Better management communication will reduce threats     Building trust so they don’t freak when ‘$insert_named_vuln’ shows up     Gotta frame it to business needs     “Everyone is vulnerable” - keep FUD to a minimum, don’t exaggerate.     Know your industry’s threats (phishing, money transfer fraud, malware Patreon donor:  Michael K. $10 patron! Layer8conf - <a href="https://www.workshopcon.com/events" rel="nofollow" target="_blank">https://www.workshopcon.com/events</a> <a href="https://layer8conference.com/" rel="nofollow" target="_blank">https://layer8conference.com/</a> Regarding diversity scholarships, it's being worked on and the number of available spots will highly depend on the number of Sponsorships the conference secures. As a side note WorkshopCon will sponsor a number of Layer8 conference tickets if people follow @WorkshopCon on Twitter and tweet to us why they are interested in Social Engineering and OSINT topics with hashtag #sendMeToLayer8. We will select folks from those tweets with the emphasis being on folks coming from underrepresented or minority groups. In terms of sponsorship information for Layer8, Patrick wants people to send an email to sponsors@layer8conference.com Please let us know if you have any other questions, and thank you so much for giving us a hand spreading the word!!! Saturday June 6, 2020, RI Convention Center <a href="https://www.dianainitiative.org/" rel="nofollow" target="_blank">https://www.dianainitiative.org/</a> <a href="https://twitter.com/DianaInitiative" rel="nofollow" target="_blank">https://twitter.com/DianaInitiative</a> Conference in Las Vegas (Aug 6-7, 2020) (Thu &amp; Fri) Check out our Store on Teepub! <a href="https://brakesec.com/store" rel="nofollow" target="_blank">https://brakesec.com/store</a> Join us on our #Slack Channel! Send a request to @brakesec on Twitter or email bds.podcast@gmail.com #Brakesec Store!:<a href="https://www.teepublic.com/user/bdspodcast" rel="nofollow" target="_blank">https://www.teepublic.com/user/bdspodcast</a> #Spotify: <a href="https://brakesec.com/spotifyBDS" rel="noopener nofollow" target="_blank">https://brakesec.com/spotifyBDS</a> #RSS: <a href="https://brakesec.com/BrakesecRSS" rel="nofollow" target="_blank">https://brakesec.com/BrakesecRSS</a> #Youtube Channel:  <a href="http://www.youtube.com/c/BDSPodcast" rel="nofollow" target="_blank">http://www.youtube.com/c/BDSPodcast</a> #iTunes Store Link: <a href="https://brakesec.com/BDSiTunes" rel="nofollow" target="_blank">https://brakesec.com/BDSiTunes</a> #Google Play Store: <a href="https://brakesec.com/BDS-GooglePlay" rel="nofollow" target="_blank">https://brakesec.com/BDS-GooglePlay</a> Our main site:  <a href="https://brakesec.com/bdswebsite" rel="nofollow" target="_blank">https://brakesec.com/bdswebsite</a> #iHeartRadio App:  <a href="https://brakesec.com/iHeartBrakesec" rel="nofollow" target="_blank">https://brakesec.com/iHeartBrakesec</a> #SoundCloud: <a href="https://brakesec.com/SoundcloudBrakesec" rel="nofollow" target="_blank">https://brakesec.com/SoundcloudBrakesec</a> Comments, Questions, Feedback: <a href="mailto:bds.podcast@gmail.com">bds.podcast@gmail.com</a> Support Brakeing Down Security Podcast by using our #Paypal: <a href="https://brakesec.com/PaypalBDS" rel="nofollow" target="_blank">https://brakesec.com/PaypalBDS</a> OR our #Patreon <a href="https://brakesec.com/BDSPatreon" rel="nofollow" target="_blank">https://brakesec.com/BDSPatreon</a> #Twitter: <a href="https://twitter.com/brakesec" rel="noopener nofollow" target="_blank">@brakesec</a> <a href="https://twitter.com/boettcherpwned" rel="noopener nofollow" target="_blank">@boettcherpwned</a> <a href="https://twitter.com/bryanbrake" rel="noopener nofollow" target="_blank">@bryanbrake</a> <a href="https://twitter.com/infosystir" rel="noopener nofollow" target="_blank">@infosystir</a> #<a href="http://Player.FM" rel="nofollow" target="_blank">Player.FM</a> : <a href="https://brakesec.com/BDS-PlayerFM" rel="nofollow" target="_blank">https://brakesec.com/BDS-PlayerFM</a> #Stitcher Network: <a href="https://brakesec.com/BrakeSecStitcher" rel="nofollow" target="_blank">https://brakesec.com/BrakeSecStitcher</a> #TuneIn Radio App: <a href="https://brakesec.com/TuneInBrakesec" rel="nofollow" target="_blank">https://brakesec.com/TuneInBrakesec</a>

2019-043-Bea Hughes, dealing with realistic threats in your org