Sign Delaware Banking Living Will Secure

Industry sign banking delaware living will secure

there's and I find that it's helpful to take what I learned from my regular day-to-day consulting clients and try to distill it and make it easier for people coming up to learn from their mistakes and go out and make new ones and this has been inspired by essentially a lot of my work now is taking small shops that are maybe one or two funding rounds past a good idea a garage or a dorm room to they're making money they've they've you know I'm thinking of a shop one of my shops is they're doing something really intimate with Salesforce that makes it better and then my eyes glaze over because they're talking about sales but their problem is from my point of view as a security strategist as a I used to be a pen tester and now I don't call myself one anymore cuz pen testing is boring write me dead for saying that but a lot of my a lot of my challenges now are how do you take that small shop and that small shop up until now has been nailing small businesses you know we have we have two accounting firms of 30 people in the Atlanta suburbs we've got we've got a NZ window company with sales all across the Northeast and all of a sudden the sales rep calls up Bank of America and says holy I got a demo next week and it goes from you were selling to shops of 20 30 50 employees and you go and you just you you are gonna get to pitch you are something as a service to Bank of America what's the difference anyone run into this problem yet this sales rep what are they what's the next thing they're doing after they're gonna pitch Bank of America what's their next great concern their concern is do I get a 35-foot boat or a 40-foot though right they're like holy I get 20% Commission on that sale and it's all gonna go smooth until there's oh we just have one question about this you fill out this little security questionnaire about how you are going to secure our valuable data and at some point you hear the you know you hear the music skip what are you trying to turn the lights off okay I've been a professor long enough I'm happy to do that so this is you're tasked with that job how do we make this security questionnaire just think of every shop I've worked at before I do this work who filled out that vendor questionnaire Wow sales rep right guy who wants to make the sale again should we do that thing what's DLP okay that is the voice of reason yeah I just said yes for all this [Music] I didn't know what what are these words meant but we can do all this in a week actually my favorite one doing one of these I'm helping a client pitch a large state agency and I hear a sales rep say we can pass FedRAMP in two weeks and like you don't have policies but you don't have any like true no and I just kick him out of the chair and unfortunately the problem is is that there is a woman who's like in charge of like something in sales like after sales support so she's probably wondering why am i trying to like play footsie with her oh my god I'm trying to kick him can you kick him stop the sales rep from speaking instead she's like why are you doing that and I actually just kind of nudged her chair into him I stopped and I do apologize after like look I had to make him stop saying things and it was that I was gonna fake a seizure like that was the next move I had that's the sort of commitment I have for clients like I will stop you from doing something you can't walk back so Who am I why am i justified to be here ranting about this I am I think that's my title risk advisory services for Leviathan security group out of Seattle I of course you know they don't let me go to Seattle that often because my Philadelphia accent and my sense of time doesn't really work well there I'm a lawyer as well just not your lawyer my day job is against a concerted security consultant but not your security consultant that can be fixed I have business cards and I sign retainers I do the stuff I'm gonna rant about how to rapidly mature your shop how to spend as little money as possible and get as much bang for your security buck and I used to grade the stuff I'm gonna talk about my gig before this was being an Assessor not an auditor because an auditor implies a third party can benefit from it no I was contracted by a Blue Cross Blue Shield to go and torture their subcontractors and go so you say you do this thing prove it or not maybe you maybe you lose the contract maybe we give it to the other shop that does what you do because they don't suck as badly so who are you and why are you here you work for an adequately staffed and funded security program want to know how the other half lives right I'm assuming not you know I'm assuming if you are working for losing oh no we've got it we've got four fully staffed all our recs are closed I have I have a fairly unlimited budget and like then you wake up and go oh you're right I have nine open wrecks for a team of a team of twelve I'm current I'm currently 18 18 - duze behind so yeah no one is adequately funded no one has the staff they need you just got promoted into security management hey remembering you were like senior nerd and then your boss left and you're like and the other senior nerd was like one two three not it hey congratulations your manager what no I'm fantastic too late or maybe you got suckered into it it's gonna be me you are gonna get them you're gonna get the appreciation that you've always wanted from vendors who want to sell you things all right this is bill from rapid7 you know what we do do you know what I do no please stop calling so the old managers walked away and you got promoted that's actually one of my clients they're their security manager literally like I said I can't do this not like jump to another shop just like I think he's delivering pizza or uber just like saw the writing on the walls like I know I've signed too many I've I've let too much slide I gotta go Harr anyone ever been this guy or gal you're the first security hire so who's the see so me says in this vendor it says in this this this org sheet I'm the see so and the firewall manager and I are response ah oh boy it's good it's it's yeah and you look at the policy and it's like the instant response team shall be headed by the sea so and the instant response team shall be the sea so and anyone else who the sea so can contain strong-armed into help right so you're the first security hire at that shop so you you have to rapidly mature your IT operations and your other operations really really quickly to be able to maintain existing client relationships and get new ones this is sales driven which some may scare some of you if you're if you think about it though the right way what's the advantage of a sales driven model for security you've got allies I'm thinking of a traditional company where you have sales people these are people who say nice things in order to in order to convince other people to do what they want so if you can get sales reps people whose job it is to manipulate sorry um convinced in a favorable manner and you get a sales rep who recognizes that the one obstacle between him and that 35-foot Chris Kraft is a thing called I PS I di I I pee urine I don't know do we need one of these things I will sit outside this the the CFO's office and get that thing you that blinky box thing you want because I want to sell Bank of America all of a sudden you don't have to do it you can go and make those people your house so you go and find compliance or somebody else there's because it's just you you have no power if you are there's there only security hire you haven't back you have a portfolio and nothing but if you can go and make some allies you can you might be able to win some of these so why do we care about security because the law makes us right these are just letters and numbers and right HIPAA requires that we gdpr requires that we 23 NYC are ours the new New York cybersecurity law mg/l 93 inches the Massachusetts one I could go into these but that's off in a driver right the law requires that we do something about security because these breaches are getting crazy yeah that drives a lot because your customers require it what's a scarier phone call at 4:54 on a Friday your biggest customer complaining that you are a regulator our customer are of course why do we care about security because your organization cares about security I have heard that line so many times and my answer is usually uh-huh yeah yeah I still love the Equifax CEO when he says the guy whose job it was to make sure those systems were patched didn't do it and oh well I'm like you know what you probably have more quality control over the press release right if someone used the wrong Pantone color there was someone else to QC that thing right you used the wrong font whoa you got to stop and pull that back yet did you QC because I'm imagining the person whose job was to make sure that apache struts is updated I wasn't like oh I'm just a complete it's like yeah I've here's my to-do list this you know 9000 line spreadsheet Apache struts was 2300 deep in there I was going to get to that but I was still trying to clear February right so so if we you know this is this is a this is open the few shops that actually care about security maybe there are some maybe you even work for what maybe you still believe it but really there's a legal there's a legal fight over it our customers require these are the two that might actually show up and make you do a thing so this is a great question I use this to stump consultants who try to work for our shop when I interview them what's the appropriate what's the appropriate expenditure for security that asks for that in one bullet point what would you say whatever it takes up to and including the budget we already have I've often liked the 10% of your IP spent where'd you pull that one from I could show you but it would be rude right usually the answer is what do our customers demand what are our peers doing but really we know that what the actual question is what's the least we can get away with what's the least I can spend and still have an appropriate and I should put that in the air quotes appropriate level of security what's the least we can get away with and hopefully by the end of this we can figure out what we can do in the least amount that still is good enough it still meets your actual requirements you use this this phrase actual requirements not what the law requires or your customers ask for because there's a difference between anchor Americo quests that you do this thing versus Bank of America pull the business if you don't what is it one's a request yeah there's a hard demand filter out the things you actually have to do and concentrate on those debt wins where you can outside of that thick or hard kernel of your security program should be what can I do that actually is a hard requirement or I lose business No let's start the finding terms because I'm speaking of securing this ad morphus you know the gray goo oh I'll have to securities please case you're unfamiliar controls or individual measures to detect prevent or mitigate security risks pentesting is a control a firewall is a control a request that your employees show up to work sober is a control some of these are enforceable but we've got you know physical you have an 8 foot high fence with concertina wire around your around your secure facility that procedural how often do you do a vulnerability scan with clawless once every I feel like it right some kind of some kind of procedure that you task with somebody to say you got to go do the thing access rights review technical you actually have a blinky box to do a thing and many of you are familiar but just see we're talking about things compliance these are the it's written on policy that you do these things if you don't we may fire you are we may dock you pay our we may make you sing I'm a little teapot in the break room some kind of punishment to take you do the things you're supposed to do don't give your passwords to everybody don't put your passwords on post-it notes don't have a shared login for everyone in the HR department those controls frameworks are big collections of controls that we all agree to such as ISO mist 853 COBIT I mean NIST is already kind of for masochists unless you actually have to usually want to think what should we pick I'm like ISO is the easiest to fake because you've got scope you can scope down ISO to almost nothing like PCI where you know PCI certified this box but nothing in it and therefore right my sack D is compliant you know you can play games with scope you can play games with these things but you got basically your collection of control dude stuff you you promised to do then an outsider will assume if you say we have an iso certified or iso aligned policy kit it means that you're probably doing a bunch of these things now those are the two terms I'll use again so so many controls so little time including my proofreading the my doc so implementing controls requires money effort and Burdick using this is to three different things money I gotta go spend money to go buy the thing I got to buy the blinky box I got to buy the antivirus subscription I've got to buy the something as a service I got to go pay Splunk some money or more money effort I actually have to have someone who either works for me or I've hired at a high rate go do the thing turn the crank right design configure maintaining use that control to do the thing and pen tests well that's that's that's that's money and then effort to go and we'll mediate those findings track them down and make sure they happen so and then there's burden policy that says we have a five minute lockout on all PC screens does that cost money no you can set that with GPO in a couple minutes is it effort minimal will result in complaints yes will you get yelled at when you have things like when you get those really stringent things like we're going to air that next thing you know people on the people on the Bank of America team have two pcs on mister Bank America business only the rest is for other because you put up some burdensome control to satisfy a need I'm gonna use that burden as that's often what gets you the most kickback because I spend money that gets spent and the only person is really worried is accounting but you spent it it's done no longer it no longer rears its ugly face effort the only person is really complaining about that is the poor you know the the the man or woman you said go validate that thing that's what you're doing today go check the firewall rules make sure they're compliant with this standard once a month yes it's that time of the month go do it burden burdens the one that keeps coming back and regular people your end-users your customers going to go I don't have to do this I have to change my password the Bank of America so how do you select the controls right just ISO or our covet our NIST is going to have a set of controls that you should plunk in HIPAA and GLBA and those may also suggest controls you have to take all of them Oh you pick the ones you've got to do do the things that are mandatory and here's this is the biggest way to save money and do this on a budget is figure out what controls you actually have to do the problem is is that this is this control set this actual real hard controls you've got to do is specific to your organization in a in a period of time that same organization two years later may have a different control set as you sign contracts with new clients who made you do things because you changed business because regulations change you got into this business you exited this business so you are figuring this out as you go if you are new to this or your company is new to this you're figuring this out and here's the fun trick basic rule of consulting is I don't have to know everything I just have to be half an hour ahead of my clients you as head of security or you as a new security manager do not know have to do everything don't have to know everything you just have to know how to be ahead of your customers and your end users before they ask it will come across as a genius there is nothing wrong with pulling up the Wikipedia page about the thing during a con call however one point if you've got like if you're a fetishist ab ut keyboards sherry Reds or cherry Browns are really really noisy so if when you hear the so Alex can we do that thing yes yes we can so I have been asked to get a quieter keyboard for for con calls and I have wind this in such a way that I've made my clients happy it's okay to wing it as long as you validate that you did it right later when you're not under would not under crunch time so how do you select the controls how extensive should they be so how we can do the old-fashioned way cost-benefit risk based right jet engine Plus peanut butter equals risk I think is what my old boss used to say and I never listen to him because he's Canadian thanks James ideas this right the the probability of an event times the impact of that event with with without controls if the cost of that is greater than the cost of the control plus the probability of the event still happening in the impact of the event with that control you put the control in place if they're equal to wash if the cost of the control plus the probability of the plus the potential impact of the control width with it is higher than the then the control than the probability without the control you don't do it you accept the risk that's great right but you know remember when you took calc 1 and Cal tune you learned how to optimize and you know wow I can solve problems until you realize a problem with this right implement the control if the benefits if the benefit is great you know you the cost is cost control is less than the unmitigated probability really hard to quantify what's the probability that you're gonna get breached this year 100% what's the probability how much does that probability go down if you buy something really new and shiny from Palo Alto this year yes depends are you if you are Palo Alto sales rep you'll say our research shows that oh nice actually better yet knowing knowing if they're proper enterprise sales rep seventy-three point that added that added little alcohol but oh yeah so the only thing you can actually guarantee you have a good idea to guess is the cost right like this would be great if you could quantify all this rest so you can make some guesses but you're at the end of the day you're like I I don't know I think I feel better knowing that there's a for you hundred thousand dollar box from Palo Alto that does next-gen threat hunting threat centric something I don't know it's awesome here that thing when it fires up it's noisier than the freaking Sun efore 20 that's that's underneath of it I don't know what that does but it's still there so it's a great idea it only really works when you absolutely have a I know that the risk is dramatically reduced and the impact is dramatically reduced and the cost ain't that high the rest is your wing so as nice as this model is it doesn't actually work second model is I don't want that to happen right how many times you get a regular line manager and non-technical manager waving around one of those magazines often times it's the award-winning air airline magazine outside this issue this issue is about cybersecurity you're like oh god what the hell is this guy gonna be on a badly we need up flame wall ah what is incredibly there calling you like while waiting for their luggage like we have a flame all right firewall no no Flint I do we have one of those yeah yeah sure because that breach thing that sounds horrible like yeah yeah it is that's why I'm here why am I taking your call no you don't want that thing to happen and I want you to guarantee that thing won't have no I sure yeah I don't want that thing to happen again ring hi who authorized to put the entire customer list on piece pin my favorite is who authorized to put all of our prospectus ease on scribed like ah you're in trouble cuz you're right they all are on scribe what are they doing there so I don't want that happen again I want you to guarantee that that horrible thing that made us all a scramble won't happen again right do your Lord Shane God knows we do Airlines airport security like that oh oh people might people's shoes may explode so you have to take off your shoes and I'm waiting for some entrepreneurial Isis or al-qaeda member to go like the suppository bomb just like yep yep gonna make you all do some extra special time in line right you want to prevent that horrible thing from happening yes and I call this the senior management protection program I told the security guy to do that thing now you're in this well did you give me the budget to do that thing let me take it out your existing budget like yeah about that so this is the I told you to fix that you didn't on you so more ways of controlling selection controls some controls are soon because they're low cost and high estimated right we use encryption you know I often have this one full disk encryption of laptops that may hold sensitive data it's a no-brainer now right because pretty much every OS you can get unless you're that poor bastard is still running some kind of like plan 9 running on on brain-fuck if you've got some relatively modern OS that you're supporting full disk encryption it's an easy thing to do is click the box done one of the many check boxes I've got fixed right expensive you know highly well we're low impact high expense you like I'm not doing up it like kind of knee-jerk of course we do that thing hit those controls or what we call the laughs test if I heard that another shop wasn't doing this thing I'd freak I'd laugh problem is that I no longer laugh because many of my clients don't do like the primitive things like that was like why is CalNet still open oh it's a useful way to administer your next box like dude I like the 90s too but they're over now ssh has been scape like i don't know about that so i know under laughs I cry so I should replace this with like does it make me drink more but right so you've got some controls because they just you do them you do them why you've already got a budget for it why are we replacing the firewalls because we have money in the budget and we used to have firewalls so it's easy to say I am replacing the old ones with the new ones is that low-cost highest made an impact no but it's easy regulation requires it this is a great way to cut through some except I know way too many beardy sucide means who will why my favorite is a friend of mine who literally stood up in front of a manager and said I think you're violating HIPAA because you are sending protected health information in clear-text and that violates HIPAA now of course I'm going to ask two questions one was HIPAA relevant he was doing a pen test and he was sending a pen test report to the client I was asked to send a pen test report to the client how many pen test reports have Phin unless you've really screwed something up should be not right you may allege like here is data and you exit out but he was convinced that the pen test report included pH I the second one was he said HIPAA requires encryption anyone and anyone want to argue that that you have to encrypt pH I under HIPAA good you don't pressable so maybe it doesn't maybe the regulation doesn't require but the number of times people want to get into a regulatory fight over over this is rare I do it because well lawyer but that's kind of neither here nor there right your customers tell you what they want you to do you've got your base controls cuz you've already had them or you want to just not be laughed at by your compatriots but then your customers will tell you what they want and that's a half-decent way of figuring out what is considered normal for your industry how can you tell vendor requirements and contracts and vendor assessments you know the number of contracts have said that have you've got these controls the ones that scare me are the ones that have a blank there right you will you provide the following contracts like like don't let the sales rep write that don't cuz they'll add things because they want to make the sale happen like now you just agreed to do all those things that a week ago you didn't know what they were we got one of those DLP things right no don't would you like to try to install one today so here is a body of knowledge that you can steal from if you are new to the industry you can go get them make some friends in your industry there is a meet-up for people in for for informational security people in healthcare or financial service or whatnot yeah no these people on a social basis if they like you are and and this is one of those reciprocal things what you do is you take the ones that you're getting hit with I'll off the serial numbers so you have a body of knowledge about what everyone's expecting it's a really quick way doesn't violate in NBA if you're just taking the information out of it right these are the controls I'm not naming the client I'm naming you're the ones I see that all the ones asked for you want the common ones you want to want you want the ones that all your customers are demanding that body of knowledge is valuable share don't be a dick share that information right because it it also an away from from the perspective of the vendor the vendor would like to not have to fight you tooth-and-nail to put in some controls they would like you to have a pretty good idea of what controls they're expecting so use that as your first body knowledge so talk about that so you've got this big pile of controls right I so plus you read the last eight vendor assessments and you went through and asked legal to dump all the appendices from the contracts and now you've got this whole selection got a hundred and twenty-five different controls to select from how do you pare that down right because now like holy I have a hundred and twenty two controls my own kind of seat-of-the-pants risk assessment says we might have twenty in place partially in places how do I go from that big body to a smaller one how do I cut it out how do we cut out ones that I don't think I need until you make me and so so I'm gonna give you a couple guidelines and a dirty trick so if you have three requirements that you think you need first one only gets checked after an incident right it's checked didn't you have that in place and the only time we're gonna ask is post breach number one number two we ask that you prior to the contract do it but you can self certify like say PCI sac D I say I do these things parmitt 3 gets checked by people who can cost you money which requirement do you bill great this in this like the chances that you get breached no it's it's less than a hundred percent and then again even if it's like hey you should have had this in place sometimes you're then arguing would that have stopped it right you know the number of times they have had arguments about blp would have prevented that the opie would have prevented that except they walked out with a hard drive I've not seen DLP stop physical theft you know and I really want some like some sales rep from Symantec to go ours would like okay awesome well you sign that new contract I would love to see that so you you actually go and say this is the requirement that I care about which are the ones they're actually that the vendors going to check on I want to make the vendor Assessor happy not saying you don't do the other two other two are slightly lower importance so easily cheaply verified things get checked even if they're lower value a tell a story and I love telling a story because it's it it's one of those something that CI I have a rule that says many times I will see something it seems just asinine and stupid but I'll ask why because sometimes you find out there's a really good reason for the story I'm going to tell that a rock band called Van Halen um Van Alen had a rule that said if you had brown M&Ms in a bowl in the dressing room they could walk from the show and you would have to pay the reason why was theirs there they were one of the first they've kind of built the idea of a giant arena show had massive loads power weight on the theatrics and essentially people would just sign the contract riders and these look an engineering degree you know engineering diagrams in these contract writers saying we're gonna show up and we need all the power all the mounts and if the last thing you had here is a folk show no we need like real infrastructure and we don't want we want to make sure that you read the goddamn contract you read these requirements said yes we checked we have the power we can support the weight we can we can move things in or out however to validate that you've got power every 18 inches 60 feet off the stage is hard you can however force them to identify something that you can check so there is a bias towards things you can easily show to say we are doing that thing here is proof as you show if you if there's something you can validate and you aren't doing and you say you're doing it it means you lied about something that was easy to check that makes me believe you less when you say the hard to check thing we're doing so what are they easily so like a sock - I hate them because I've gotten people through them and I have well because they always send like second-year accountants who don't know what any of the words mean and I've had I've actually during a sock - someone said you don't have a policy on Incident Response I'm like have you read my document called incident response policy and like well that doesn't discuss IR like you know what IR is right well IR is different than instant response like so like find/replace there's a whole IR section that was copied and pasted from the instant response like see I've and the fact that I that bet you know what what security tool do you use the most Microsoft Word finder in place not a client of sock to sock to is easy like vomit up and go there we do those things does it make you more secure no because it's a bundle lies at at a point in time was not obvious to an accountant who's had two years experience but that's easy to check right I asked for you know if I'm an outside vendor and I say I want your last three years of pen tests how many of you who are doing those pen tests will go I'm not showing that honored and why am I asking if I'm asking for the last three years what do I want to say that's one but you thank you are they the same report because as a pen tester the most sat the saddest moment of my time was writing it was was realizing reviewing the last pen test report that I could save the 12 hours I normally book to write a pen test report with change date it was for Vaughan unfixed Mike so extra brode in the bottom like why am I doing this juicy didn't catch it and I'm like and during the readout like I would like to skip to Section four point five why am I here look I've identified a new finding that says you are not remediating the problems and this bothers me like Alex you're doing pen testing why are you lecturing them like cuz why why are we here now I'm in strategy where I get to go and say that's the more valuable findings you didn't fix it last time the pen test is useless why spend run time for someone to pound your systems if you're not gonna do anything about it and I get when you have like the informational ones because there's nothing like I can determine the version of the OS Wow that would be a big guest it's got you know it doesn't have any of the microsoft services but has ssh i'm gonna guess it may be a UNIX box just say it that's okay that doesn't bother me but like I can get RCE and you didn't fix that problem three years running that shows that trend that's the easily verified thing I want to show you know if I'm worried about about a vendor I want to see that you fix the problems so I'm gonna say some crazier things you all say this right compliance bang equals security usually that's from people who are so well funded that they can actually have like a threat hunting P I get called about that like would you like to be on our threat hunting team like I don't know what that really is that sounds like it should have a trademark by SecureWorks on it you know like that's great but really I want it you know most of my shops like could you patch the from last year that's the I'm the bone hunting team did patch it can hit are there systems that have been out of complianc from 90 days and then some are like we've had systems out of patch out of patch for 900 days Mike like how are you allowed to do that but oh they support our core infrastructure like your stop please stop talking when you like you're just making this worse so yes compliance bangle security but one's easier to show from vendor sessom point of view from a your client has four hours to figure out whether or not to jump in front of the freight train that is the business deal right because if you're a shop big enough think of it from the vendor assess or one of you right your job is to is to write up a spreadsheet that asks a bunch of questions and all you do is read lies all day your job is to throw up a hand and say I really think this is a bad idea and you have limited political capital you can't stop that many deals so what you want to do is show enough that means if you are not the biggest way from that that week that's all you have to do to make the sale right someone else has openly lied that we can like I'm gonna go put a hurting on them you you're just a garden-variety schmuck I will let you pass I might put a requirement or two in but you're gonna make the sale so but proving it oftentimes proving compliance as far as improving security because every time I see I get a client's like they demanding a right to audit like a right to pen test like I have never seen one Xers ever I've been doing this for way too many but don't ask to show all you see all your paper because that's a lot easier so compliance isn't security but from a vendor point a vendor perspective it's the same it's better it is possible to over control it is possible to overspend on a control cuz that Palo Alto sales guy was really nice and we went to a steak dinner I think the bill was like $8.00 and you're like oh sure and they you know like you wake up the next morning and there's a thank you note from the pallet hill sales rep like what did I sign that's really that's beautiful and blinky box you're like that just blew half my security budget i overspent I over controlled and the problem is is that checking a box really hard doesn't check the surrounding boxes I know check security is bad yeah but if you first you check all the boxes right and then when you're done with that you can now go back to the castle cuz yeah I think if the check box Security's you go walk around the castle and go there's a wall here Rick the stones are fine and you're looking for like gates open it's missing gates on fire right and when you jog around and come back you're like now we can talk about higher end stuff and my check boxes all the check boxes are filled I can now really think about moat design or power you know tower configuration and stuff like that but odds are you're scuttling around checking boxes cuz that's all you have time to do you've got open wrecks for five people to help you with that but guess what checking the boxes is probably the best bang for your buck until you can do them the other stuff is no I'm thinking of like every big breach falls back to one of those you did something you failed to do something that is relatively programmatically easy to do target got alerts that you didn't do anything about Equifax you didn't patch a known vulnerable was enough to have it all happen but while yes compliances and security check all your boxes first it's a part of this nutritious balanced breakfast so good controls the ones that people are actually asking this is customer based but it's you're looking for them to go and say this is what we really care about other stuff is stuff that you have to be independently convinced you have no allies for that other control that you want but ain't no one asking for and maybe you can justify it maybe you think no this blinky box or this this policy or this thing will pay off but you're the only person in the room advocating for that it's really easy to say 60% of our customers require this control means that I can go to six percent of the sales reps and say back me up on this make that sale easier and at that point that sales rep will now pay attention you because you just said something to them you said I want to help you buy a boat all of a sudden you went from the weird twitchy guy in the break room to the guy who can help me get a bow like all of a sudden you were now relevant to me hey you will stop doing the other sales rep e things and now pay attention to you for a minute don't freak him out explain in small words you've got three bullet points and two of them are oxygen is necessary for life I like money you've got a third bullet point where you can explain why you need that control so proving your assertions if you say you're doing a thing how do you prove it people ask for more than a self-certification any of my clients run into this problem like hey we can promise everything this we self-certify we have somehow found that a sack be a line that says we have an ISO 27001 - aligned security program but we have not yet certified we have an internal pentesting so we don't use an external vendor we do our own vulnerability scanning we don't use we have not used a qsa because we're under the size something like that so sometimes you'll get a vendor who will demand prove it show me that you do the thing so this makes you have a fallback position when you know that the vendor is gonna ask for more dirt the things you should have you should be doing then you are and you can prove that you're doing this is where I talk about policy and and and and standards and artifacts of compliance and most people's eyes glaze over except that this can be a magical thing where you can shut up a vendor Assessor Traxxas vomit documentation on them it go away ain't no longer bother because they figure anyone who's willing to drop a bunch of documentation that shows they're doing that they're actually looking they're going and checking the box and make sure the castle hasn't fallen over odds are just going back to looking looking at the worldview of the vendor Assessor your job is to make sure that they don't get fired what can get them fired a breach for a vendor that they said was okay are you blue all your political capital trying to stop at the old from happen those are the two extremes of their lives so if you can give them enough warm fuzzy feelings that they're not worried about you you get a pass from them you don't have to be perfect you just have to be good enough and showing documentation it's a good way to do that so artifacts be able to drop a risk register of all the issues these are all the things that bugged me from a security perspective big ugly Excel spreadsheet lists are so big that using Archer are our Sam and then if you're that big on I feel for you I've tried to fight with Archer and our Sam and risk fabric and I think that really they're all basically an Excel spreadsheet with ugly your front but all the stuff you're worried about that you have to fix goes in it goes in one ugly spreadsheet or a database are something that says I am worried about those things I will check them off when I can so at any given time I can say here's what's still on my plate that I have to worry about because it shows that even if I have a horrible pen cast all the things are broken but I have a remediation plan and you can show better that the last time you had a horrible pen test and you remediated the things it means that your promises that say I will fix that before your company's data flows through me all of a sudden a little bit of process here buys you a lot of credibility for your security program this is cheap this is some effort on your behalf it's not a lot of burden on your end-users you can suffer through this there may be times where you're sucking this into if you have internal audit or accounting or regulatory groups they may want you may want to merge the risk registers to say that way you can compare and contrast their risks the stuff they're afraid of but you should be able to vomit out in one document here's all the stuff that I'm worried about I haven't yet remediated but I'm planning to these are the ones that we decided we're not remediating we're accepting the risk it show it builds good faith it shows that you're doing the things you say you're doing there's nothing like dropping a really nice policy kit that's perfectly compliant with iso 27001 and - and then when you ask so do you do any of this that's that awkward silence because you're not I can have you know asking when I did that when I did assessments he'll be something like so when was the last time you actually tested your IR plan like oh we've never done that but your policy says you tested annually like oh it does doesn't it so if you show had an incident this is what we did even if the incident is Bob at the loading dock got a piece of malware on the Maui on me on the combination malware collector inch and FedEx box did you do the thing you do this proves that you do the thing what did you do random Malwarebytes next shows you do the thing shows that the things that you can show easily you're doing so therefore the hard things are probably doing too tract exceptions right there's nothing like when you get the answer it says are all your systems is all are all your are all your systems running supported operating systems and people check yes and invariably there's a kiosk in the reception area that's running XP like but you said you were this annex you know the XP extended they're like no like shouldn't leave the proof that you're not doing the thing in front of the auditor it's okay to have that XP box because you say I do have an XP box that runs the incredibly important task of telling you what office any individual works in we do have systems that don't meet our policy but there's a we accepted the risk XP box in a kiosk in st. Louis and isn't plugged into anything else but it shows that I'm not lying to you because I'm point that pointed that out that doesn't mean I'm were that means that I'm less worried about by a cluster of wind mm boxes that haven't been patched since the since like the George Bush administration running something core as you called out the thing said there are places where I'm not compliant but I think it's okay you're showing that you're working what you say you're working the cheap control you no substitution so a lot of times you have a technical control that's really really hard trying to think there was one I tried to get a client through this and they wanted to show that you could not access the jump box from an outside country and we said we can whitelist and blacklist IPs and like what if they use a proxy like what you want us to like did catch something and figured help and like fine you know what the only people coming into the jump box are the remote support P half of which are in Canada so technically half of our staff is violating your requested policy of only us-based people can can login to our boxes though I couldn't put in a technical control I instead just put a policy control and it says you know you must click I hate curling and socialized medicine to login Trump is better looking than Justin Trudeau yes and therefore by policy I bar the Canadians from logging in and it's a stupid controls a stupid request but it was a vendor I was a client that had a lot of money and we're willing to pay what the what are my client wanted for this service so I'm like well put in it we'll put in a compliance control that's a hundredth the cost it's slight burden but I can't come up with a technical control to rewrite your application to make this happen so also I can replace controls by SOAs right I have say say you get someone who's got very very rigorous physical security controls quickest way to do that I'm not building out a data center for your nitpicky performance that you know physical security I'm gonna shove it in AWS hey that's those controls are an SLA that say Amazon has these physical controls in space Don I don't have to build a secure Kiriko low I don't have to do all that like Amazon's doing that thing well you're not gonna trust Amazon at the usin physical security I haven't seen any Amazon racks at 401 North Broad and Philly so I'm assuming they at least go to decent colors I like playing the homeless vagrant our sis admit on a two-day rollout at 401 North Broad and and we figured out that the it depends on what boxes the person sleeping on I've done that I've actually didn't hug someone like dude you can't sleep in front of my rack and they muttered something I'm like let's see they smell bad ill-kept yes okay but nonetheless like right I can I can replace it you requested control that I can't meet maybe I can I can handle this with an SLA somewhere as I'm doing this it four-bit I'm not doing this for all of my services I'm doing this for you one vendor or one client because it's cheaper stovepiping this is more advanced I'm doing stuff just for one control they have a stupid overburden thing because they want to do something perverse with your with your service you've got essentially like a box knockoff and all of a sudden a large health insurer wants to use your thing you know like ah our tool is not built for this we're not we don't have all the compliance controls in I would like to put them in but that would piss off all my other customers well maybe I can cheat and just create a second segregated system for them I use the same software you should same Cole are you I mean not the cold same sim configs and all that but there's a different landing page that you guys go to that I can put all the controls you want in you you you say they say they had these this list of unreasonable demands you know like wait this is just for you something you have two choices when you get a large client that once something this otherwise they're like that's gonna be expensive that's right you're gonna cost money and you have to now go from a technical decision to a business decision I kind of went through this analysis with one of my clients they wanted essentially we had to rebuild their app well and we like the cost to remediate all these requirements that no other clients ask for comes out to about $60,000 how much are we going to be making from that client and the sales reps like a hundred so like so $40,000 is a revenue just to put in implement these controls odds are it may not be worth it however just say during the call when you're talking to security people we can do that but for you those additional controls we're gonna offer you a special deal instead of $100,000 to 140,000 we're gonna charge you more at those controls you actually asked for and sometimes you'll get a we're fine with that we'll sit we'll pay you more money are you may decide how many other people will also want these controls we lay that off but you turned a technical set of technical issues into a business decision you as a company decide to shoulder these new costs you spread do you spread the cost back to the customer he open and obvious about like you you've got all nitpicky and want all these controls this is what it's gonna cost odds are by this point you've gotten deep in by the time you're doing the vendor assessment all the other shops that were pitching or have fallen out so you might be able to get away with that I've we've negotiated that or you may actually have to decline the work like one was essentially a software testing app that a large hospital chain wanted to use doing live testing on live data like so you're all HIPAA compliant here like no there's literally like we crowdsource testing so anyone can log in so that means like 110,000 people can and Det thi from the system's they're testing no we cannot make that HIPPA compliant because HIPAA requiring the you limit data to the people who need to see it a bunch of a bunch of basically click farm level QA testers in Chandigarh aren't going to do that that's not limited to the people we need to see it we cannot become HIPAA compliant for your needs it's gonna be too expensive to modify your service just for you he can't take the work because we don't ask we don't think we're gonna get any more work from similarly situated customers now of course this isn't your decision this is the decision you he p the business people make but you go and very honestly say it's gonna cost more to do this thing so if you fail to convince a customer take it a lesson cause we didn't do that thing it cost us this add the requirement to the next sprinter quarter if you think you can was one of those we could do it if we knew we had to had time oh that's how that's how you can kind of build a body of knowledge for the controls you need and get some support to build it questions Oh you you as in you okay I think that's here we've got usually the self-certification with something that's out by an open body like like PCI allows you to if you're below a certain size number of transactions you can describe your controls and say and without having an outsider test them you say we do all these things that's a self-certification right I have seen you know there are open certifications that don't require third party to validate what you've done like I can validate I can say I meet HIPAA recline I can I I as a is their virtual C so say a me older quirements have hit them and if you trust me that's great that's a self-certification a third-party certification B where a third-party comes in and says we who have no skin in the game other than we would like to not we would like to not have a bad commercial name have reviewed this stuff and we think it meets those requirements like I trust is an example PC PCI after qsa if you're if you're a tier one provider where you say third party came in and looked at this and did this I don't think you're gonna have a questions of illegality I think I'll have a questions of do I buy yourself self certification or do I make you on the vent if I'm the the prospective client do I if I don't trust you do I go make you get a certification do I make you get a third party to say I believe that their certification is valid you oh okay so I create I I create a a certification test my own software and so like ISC you you you to get ahead um until you make it a requirement like I'm thinking sis peas required for some there's some if you are in DoD are yeah it's you can make a requirement there would be a question of is it unfair is it some kind of unfair competition I haven't seen anything that's I haven't seen the case yet because I'm thinking if you do if was a if it was specific to a vendor say for example I required you've got a vendor specific certification to work on device then you get into hazing where that is there's there's sort of like right to repair in the light but I I don't know where you would get a i'm sheree a legal claim against a certifying body for creating certain but I don't I don't I don't know my answer my long-term my TLDR answers I'm not sure okay you Belt certification you you yes there's a better rant about this by Duncan minutes at gherkin this is his talk two or three years ago about certifications and it's a great rant about ISC bangla sis P is a marketing exercise like this I don't know I have somehow managed to stumble through my career with getting only two certifications in my life none of which are like I have the CCS k because my boss made me get it I have an old Apple laptop certification to do repairs under Apple care and somehow that's been okay like I'm a would yes there's that certification yes I oh yeah their bar dues and cles and all that but it's rare that my like my day job is being a security consultant so the number of times the fact that a lawyer comes into play isn't that often because I'm not giving legal advice giving technical and procedural advice and really marketing advising how to you take your tiny little shop and go huh go and be able to hunt big clients and a lot of times I do the I play that I play the role of ice-t I walk you're the vendor Assessor around the room a few times and basically convince them like I will give you the I will give you good enough answers so you can go back and not get beat up for not asking the right question and I'm not gonna lie to you I will give very crafted answers that make that explain why our security while it may look woefully bad because we don't have you know we're 16 people we don't have a separate group that does this but this is why it's not certifications is an interesting I don't I think they have a value I realized some this is the own way off point but I talked to people coming up right how how did you get where you're at I'm like that's not the right question to ever ask me like I took the wrong path to get where I'm at it's a meandering path clearly to do security I think you need to break into it certifications don't sell a person's gotta sis P is at least gonna get listened all person without assists be it's like who are you unless you've otherwise built in me I mean generally this at this point in my career it's like oh you're the your you know you're the the loudmouth guy with the ponytail who yells a lot and that's you know that's more valuable than this appeal but coming up clearly you don't even get a phone call from a recruiter if you don't have something so it Elise establishes that you could pass a test you could sit still for long enough and answer questions about the appropriate height of a fence is that enough Oh cuz I remember doing comm 1.0 and meeting people had all the Microsoft certifications and couldn't explain what a domain controller I remember the one was couldn't understand how to troubleshoot a simple IP connectivity problem was this machine is looking for a DHCP server that thousand things it's like well I have an MC se I'm like I can troubleshoot move the PC from here to here the old Network had a DHCP server the other one doesn't hey MCSE again I'm going to you I'm going to take your mouse is he just like you like and it was so I don't want to be the knee jerk certs or but I we are for every story we have someone who's certified is smart there are three stories about the person's got a lot of certs and has no common sense about how to do the thing whether it's why is this not working why does the why does this not these requirements why does Qualis keep crashing why does koalas keep showing all these vulnerabilities why can't I patch this right and some kind of context I think certs that would get in the door and then after that its its reputation and quality Oh [Applause]