Son Of Sun Tzu

In Michael Brunton-Spall's weekly cyber security newsletter, which can be found here https://tinyletter.com/CyberWeekly/letters/cyberweekly-33-who-are-we-at-cyberwar-with, he highlighted a recent Twitter thread by Perry Metzger that garnered a great deal of attention. The thread can be found here https://twitter.com/perrymetzger/status/1075928695058120705 or there's a nice formatted display of the entire text here: https://threader.app/thread/1075928695058120705 .

I recommend you read the thread, but the quotes from Metzger that "Computer security is warfare. No, really, it's war." and "Security _is_ adversarial. In warfare, you don't survive if you're second rate, you die" sum up his central point, that cyber security is a technical discipline, focused on defending against dedicated and capable foes, where the main determinant of victory, if not the sole determinant, is if you are more skilful than your opponent. There's also a strong theme against the value of certifications, but without offering any kind of viable alternative or better methodology of rating ability.

In reply to Metzger's thoughts Brunton-Spall used him blog to highlight how many security issues are caused by "accident, misconfiguration or error", emphasising that "we aren’t at war with advanced 'cyber-adversaries' whatever that means, but that we are at war with ourselves, with the software that we build", and looking to safety engineering for solutions.

I think they're both wrong.

And right.

Metzger is right in that some of the situations within cyber security require an adversarial mindset, and makes an excellent point that this aspect to cyber security is often missed. However this is lost in all of their comments about technical excellence being the dominant reason for success, if not the sole reason; similarly Metzger imagines a world where the enemy are only "High quality paid professionals", there's no concept of levels of risk here, no nuance regarding the different types and ranges of ability required for the many different positions within the industry or within criminal organisations. Similarly no appreciation for all those roles where security is just part of the overall job description, system administrators for example.

And as I've argued in my recent set of presentations, the current approach to incident response based on containment and recover misses many of the opportunities present when you're up against an active and sentient adversary, and the effect you can have on them - so the adversarial point appeals to me, but it's lost in everything else.

My "military" experience has all been gained through Xbox Live, and I don't get to wargame as often as I like - but I've been fortunate enough to have access to experienced war-fighters and those working in Operational Research, and been through simulations of conflict at various levels of abstraction. The ability to win conflicts is not based on a linear scale comparing your technically adeptness against your opponent, this is an idea of warfare based on DragonBall Z, not any kind of real world conflict. The relevance of communication, of logistics, of morale, and of an overall strategy based on forethought and feedback, are crucial to highlight here if you're going to bring in any kind of military thinking into the industry at all. In my own presentations I argue we are over-simplifying the requirements of the situation by emphasising a golf-like approach to individual ability, which suits a game like golf, but certainly doesn't suit our complex area of operation, where the ability to work within and against teams is much more relevant.

However similarly Brunton-Spall makes a great point, so many cyber security breaches are a result of failure on the part of the defenders, due to incorrect processes or those processes not being followed correctly, in such a way that the nature and skill level of the attackers is almost irrelevant. As Brunton-Spall states, he'll be focusing this year on "how we can build systems that are resistant to misconfiguration or accident". While it's not the complete solution, I agree in that there is so much more that the industry can do here - for example looking at the Checklist Manifesto style approach to executing administrative tasks, inspired by improvements in the world of medicine.

I think examining these analogies and references to other areas are useful, both in what they illuminate and when the analogy breaks because it has been stretched too far. Some of what cyber security is conflict, some of the methods cyber security needs are well-established within safety engineering, but simply advocating one approach or the other is too simplistic for our inordinately complex field, and while the appeal to a safety engineering mindset is far more useful than the "OORAH!" of a particularly distorted view of armed conflict, I think some combination of the two is the way forward.

As to the best analogy for computer security as a whole, I think Wendy Nather summarises the situation well, as she often does, in that crime is a "fine analogy", https://twitter.com/wendynather/status/1076847905208700928. Crime is a vague concept, with a wide scale of events covered, from petty fraud to mass murder - we should appreciate that cyber security is similarly broad, and learn useful lessons from others where we can, but aggressively toss them aside when they do not.

After my presentation of Lessons from the Legion at "Cyber London hosted by Capital One", way back in July of this year Dan Tilley dropped me an email with some interesting questions. As he asked such good questions, and I was happy with my answers, with his permission I've put this together as a blog post.

What do you thinks security vendors can do to improve and adopt the approach you describe in your presentation?

Partly what yours seems to be doing, which is improve visibility of both your assets and attacks to them. Those basics are hard ( Wendy Nather has been tweeting some useful stuff about this recently ), just making something like asset management easier makes everything else easier for security practitioners.

Then mainly it's inter-operability, shared standards for classification/taxonomies and for how they're communicated, that makes it much easier to add a product into an environment, and integrate it into existing systems, with minimal extra effort by security teams. My presentation is the beginning of an approach, I *think*, that emphasizes detection and response over prevention/protection.

Oh, and ease of use in general, not just for inter-operability. Thinkst's Canary is a huge advance in this area, and has sales to match that advance - also I gather that's why Duo Security are doing so well too. Technically a product only has to be good enough if it's actually usable by existing resources, it doesn't matter how well engineered it is if security staff just don't have the time or skills to implement it - and as with Canary, a very aggressive approach to false positives is essential to not suffer "alert fatigue".

I would like to hear more about your analogy of cyber security/resilience to military operations and whether you think it is more akin to asymmetric warfare?

I think in general there's a lot to learn from the right parts of kinetic warfare ( i.e. some parts of that RAND document are hugely relevant, the importance of human factors, the importance of effective forces over sheer size, and so on ) but also there's much to ignore - it's much easier to be innovative in the cyber domain than in the physical world, and the nature of "cyber weapons" is so different to that of convention weapons I sometimes wonder whether the same term should be used.

As for asymmetric warfare - kind of. Some parts are very relevant, for example the attackers tend not to have a home base, they "live off the land", and can operate using guerrilla tactics - which makes them ephemeral and requires much greater resource from the defenders than the attackers. But on the other hand the success of insurgents tends to be based on the populace they operate within, whereas that "populace"... the computers and networks under attack... should be completely loyal to, and under the control of, the defenders - so a lot of the "hearts and minds" type factors simply don't apply.

Without going into too many half-researched analogies, also with military operations success seems to be depend, to a great deal, on preparation and logistics, I'd argue cyber security/resilience is the same - by the time you're in the conflict you should have already won it.... and there are inevitably relevant Sun Tzu quotes ;)

Do bear in mind my understanding of asymmetric warfare comes from a few wargames and a couple of books ( The War of the Flea, and The Defense of Jisr Al Doreaa spring immediately to mind ), so education welcome. I think it's a fascinating subject, and certainly has enough lessons within it that the cyber security industry could save itself decades by using the right ones, and will learn something by figuring out when analogies don't work or are taken too far.

You mentioned playbooks in your talk how can we go about setting up essentially a database/storage of these playbooks and more importantly how could we go about sharing this information across the community in a relevant way?

First of all you need a structure to put the adversary's TTPs into - Fusion-X's "enhanced cyber kill chain" looks interesting, and also I've glanced very briefly at MITRE's ATT&CK, but they're both on the "to do" list. From there I know STIX and TAXII are relevant, but I have an elementary "wikipedia level" understanding of both.

From there it's the building of trust networks through things like CISP I think... but this is where I think I'd advocate a very different approach. As with everything else above, this is a high level feeling I'd love a chance to start exploring through actual facts and research... but I wonder whether the Intelligence background of the industry, and particularly the number of ex-Intelligence people in the industry, has actively harmed our efforts. While it's understandable in standard warfare, or espionage, not to let the enemy find out what you know about them - in cyber conflict it might be different - which comes down to what "weapons" are, as I mentioned above. All weapons are based on knowledge, a lot of which is given up in their use, so the gain in telling everyone about the new enemy weapon you've uncovered through being attacked by it is much greater than what you lose by revealing to the enemy that their weapon has been uncovered - also the revelation forces the enemy to upgrade. If you share information with as many other blue teams as possible, and they reciprocate, that makes the size of your "team" larger, and the size of the pool of information on adversaries much larger, forcing the enemy to upgrade more and more frequently, which should become harder.

Also the advantage to the defenders is that they gain operational effectiveness by working together in this way, whereas it's something attackers can't replicate. If attackers share their methods with others, meaning they receive less individual benefit from them, they'll be less effective - so the blue teams have a strategy the attackers can't match. This assumes every other "blue team" is in a position to make use of that knowledge, and many other things... these are half-thought through ideas. I don't know if they're of value or not, which is partly why I'm being much more enthusiastic about sharing them... get my ideas out into the world and see if they survive.

Overview

A summary of my presentation "Lessons From The Legion", from Thursday October 18th 2018. I've been offered a couple more of opportunities to present this, from which I'm hoping to generate more interesting and useful conversations, so this will undoubtedly evolve, your feedback is welcome.

A very high level summary would be this tweet, if you want to point someone at a very short summary:

"people trying to excel at self-taught technical skills are sub-optimal at strategic decisions required for a nebulous conflict, their emphasis should be on team work, and on the strategies of, and constraints on, their adversaries; they should seek inspiration elsewhere"

As a less brief summary, but trying to keep things snappy, my reasoning is as below. A slide by slide summary is too dense, and makes me realise how many ideas I've pushed into the audience's heads in half an hour.

Logical Progression of the talk

Introduction

I have a question - In Cyber Security - if we're all so smart, which we are, and we all work so hard, which we do, why is everything so awful?

To try and figure this out my presentation is an "investigation wall", a set of interconnected ideas and theories where I try and figure out what the solution is to this mystery.

I start with John Kindervag's presentation "Winning the Cyberwar With Zero Trust", which explains the difference between a strategy "The Big Idea" and the tactical and operational level solutions you use to achieve your big idea. John Kindervag's "Win the War With Zero Trust" can be found via BrightTalk here: https://www.brighttalk.com/webcast/10903/280059

So what "big idea" has emerged from the tactics we've chosen?

The main three areas I'm familiar with, as a cyber security practitioner, are:

• System Administrators / Developers
• Penetration Testing
• Incident Response

The strategy in all three areas is based on being the most technically skilful practitioner you can - sysadmins patch as quickly and as thoroughly as they can through knowledge of their operating systems, developers code as securely as they can through knowledge of their languages; penetration testing aptitude and success is based entirely on how technically adept the pentester is and how well they apply the "flaw hypothesis methodology"; and incident responses work on their forensics skills to learn how to spot different attacks, and prepare playbooks to run through once an attack has been detected.

Arguably the way this strategy has come about is because of how we train and practice for each area - all of which is based on self-motivated learning, and a passion for the job that is often described as "eat, sleep, breathe security". Therefore the emphasis is on individual skill and knowledge rather than on wider context.

Where has this choice got us? I cite various references that illustrate the poor state of cybersecurity, and the danger that poor cybersecurity poses to organisations in general and civilisation as a whole.

BreachLevelIndex.com is, well, here: https://breachlevelindex.com/

Rapid 7 on the number of CVEs is here: https://blog.rapid7.com/2018/04/30/cve-100k-by-the-numbers/

The Global Risks Report 2018 from the World Economic Forum can be obtained here: https://www.weforum.org/reports/the-global-risks-report-2018

This method of practising reminds me of golf. Excelling at golf is based on individual skill, which is reflected in how a player performs in the game - because success in the game is based almost solely on individual performances. Even in a team game of golf, with a team and against an opposing team, there is very little your team-mates or opponents can do to directly affect your standard of play. And the actual course will be static also, apart from the vagaries of weather.

There is nothing wrong in practising like golf if you're going to play golf, however the practice of cyber security is nothing like the game of golf, I think we need to look at a different game.

Using this kind of analogy, and cross-pollentating ideas, between areas is generally derided, but if you look hard enough there are examples where this works. In this version of the presentation I just used the idea of TRIZ, of abstracting problems and solutions in order to determine what kind of solution is required in a rapid way.

TRIZ on Wikipedia is here: https://en.wikipedia.org/wiki/TRIZ and the main British consultancy, as far as I can tell, is here: https://www.triz.co.uk/

So, if we're practising for golf, but not playing golf, what game are playing?

I argue that our industry feels a lot more like American Football. It is a ridiculously complex and violent sport, with many specialisms, and very much a team game where your success or failure is very dependent on the quality of your team and your ability to work with them, and how you act against and react to your opponent. In addition it's the sport that is closest to actual conflict - and I think cyber security has a lot to learn from wargaming - the simulation of war, and War Studies in general.

( as a side note, a French General, on watching the game around 1916, said something along the lines of "that isn't a sport, that is war" - if you know a good source for that quote do get in touch )

Therefore we should look to learn lessons from a successful American Football team. American Football is the only sport where each team has essentially two squads on it - an Offense for when your team has possession of the ball, and a Defense for when your team does not.

I think that as defenders in cyber security, even red teamers are looking to improve the performce of the blue team and the survivability of defenders, we should look to the best Defense. Possibly influenced by personal biases, but backed up by many sports facts I'll quote in the novella length version of this description, I have chosen the Legion of Boom, the Seattle Seahawks defense from 2011 to 2017, as an example to follow.

Looking at the central tenets of the team, and the defensive philosophy of the Seattle Seahawks head coach, Pete Carroll ( who has approximately 40 years of experience and an exemplary record ), I pick some of the main lessons from the Seahawks successful Defense:

First lesson - train how you fight

Because American Football is such a complex game it is necessary to practice complex play calls and formations in advance, and to ensure that each individual knows their responsibility, and everybody else's responsibility, on each play so that they can function as a team.

Because the teams are so large there are enough players for the second and third string players in each squad to form "scout teams". These teams imitate the playing style and formations of upcoming opponents so that both they, and the first string players, understand what is coming up in next week's game, and also are less surprised by any of their opponents individual styles in the game.

This links into the concept from wargaming of the Caffrey Triangle, showing how a red team - in a red team exercise specifically designed to assist the blue team - should act depending on the objectives of the engagement. The Caffrey Triangle is mentioned here https://paxsims.wordpress.com/2016/08/19/connections-2016-conference-report/ , I've had it explained to me in person, we all need to be talking about this a lot more, in both cyber security and wargaming. I argue that in military simulations or exercises the red team or red force is often in the bottom left hand corner of that triangle, just there to give the blue team something to shoot at. Penetration testers work almost solely at the top of the triangle, being the most effective attackers they can regardless of geneuine threats or limitations. I think commonly in cyber security the red force, whatever it is, should operate in the right hand corner, emulating the TTPs of genuine adversaries in order to prepare the blue team for their real world opponents.

Rory McCune is a good person to watch about the limitations of pentesting, the presentation of his that I refer to, Penetration Testing Must Die - Rory McCune at BSides London 2011, is here: https://www.youtube.com/watch?v=MyifS9cQ4X0

As an example of the difference between trying to fix everything, and trying to fix only what our adversaries will exploit, I cite Jeremiah Grossman on the Kenna Security report, highlighting 2% of vulnerabilities are exploited, is here: https://twitter.com/jeremiahg/status/996469856970027008 I've got into interesting discussions on how true or untrue that figure may be, watch this space.

I also use the presentation "Playbooks - Common Traps & Pitfalls in Red-teaming" by Andrew Davies and Jon Medvenics from CRESTCon is here: https://www.youtube.com/watch?v=bYTrwzFUSSE; where they state that a great deal of what they've seen from red teamers is from the "Advanced Penetration Testing" book, so you can key on those specific methods in order to detect attacks.

This issue also reminds me of "The Base of Sand Problem", the RAND report that highlights the problems in military modelling/simulations/wargaming that, for me, resonate with issues we face, can be found here: https://www.rand.org/pubs/notes/N3148.html. This report essentially says that the military modelling and analysis industry has made some crucial mistakes about what it focuses on, which leads to the ineffective use of its resources. In this context, a footnote that states military victories are based on the ratio of effective forces, not on who simply had the largest force compared to their opponent.

Second lesson - eliminate the big play.

There is not time to explain the Seahawks' use of "Cover-3 with a single high Free Safety", and their general approach of keeping the ball in front of the defenders to ensure the Defense always has another chance to prevent their opponents scoring, so I look at personnel choices.

Most NFL defenses, when choosing personnel, have emphasised their Defensive Line, the first line of defense against an opponent, who line up closest to the "enemy". Carroll has always specifically looked to the Defensive Backs, the last line of defense, most notably the Free Safety position, which is what he played in college.

This is reflected in the NIST Cyber Security Framework, and the five Core Functions. I am old enough to remember when Identify and Protect were the only aspects seen as useful, but slowly we are learning that Detect, Respond, and Recover are at least as important in surviving an attack, rather than believing in the "Defender's Dilemma", that if an attacker breaches us we have immediately lost.

I cite Adrian Sanabria from his presentation at the RSA conference earlier this year: https://www.youtube.com/watch?v=bMkVjDx3cqQ, on "It’s Time to Kill the Pentest", but just he has a great slide on how a hack is a series of steps, not a single event.

I would argue ( I forget I actually said during the presentation ) that the emphasis should be on Detect, Respond, Recover - the last line of defense, not the first. I had a very interesting but quick conversation about that with Panaseer afterwards. Unfortunately I was interrupted while on their BrightTalk webinar earlier in the month, and couldn't make time to read the 451 Research report, but I'm intrigued in how their services fit in, or don't fit in, with my current way of thinking.

This ability to recover is important because we all work in "Cyber Resilience" now, where the emphasis is on recovering from a breach, not just on preventing it. It's worth reading "Cyber Resilience", Phil Huggins' Black Swan Security blog here: http://blog.blackswansecurity.com/2016/02/cyber-resilience-part-one-introduction/. I emphasise the "Pace of Decision Making" aspect.

This links to John Boyd's OODA loop, OODA loops are described well on Wikipedia https://en.wikipedia.org/wiki/OODA_loop, here, please pay me to research these concepts.

Through a description of the OODA loop process, Observe your current situation and decide all the relevant factors, Orient yourself and your adversaries within that space, Decide on the next course of action, and then Act to execute that execution, Boyd argued that by going through this process faster than your opponent, by "getting inside their OODA loop", you could defeat your opponent through speed rather than sheer power. The problem is, as we're defenders, the opponent always starts their OODA loop before we start ours, so how do we catch up?

Final lesson - Out hit your opponent

I reference the "The Base of Sand Problem" again https://www.rand.org/pubs/notes/N3148.html, because it states that first order determinantes of victory in conflict is based on processes, tactics, and strategy - these are harder to define and measure; but I argue we should focus on our own way of thinking, our opponents way of thinking, and crucially how we can affect our opponents' processes, tactics, and strategy.

It is a physical game, it is a collision sport, and there are psychological and as well as other gains to be made by simply hitting your opponent as hard as you can.

Also this tallies with the previous aim, to eliminate the big play, as it physically puts the defenders in an excellent position to tackle or otherwise collide with their opponents - but I don't have time to go into this level of detail on the game. For this I use clips from Richard Sherman, Earl Thomas, but mainly Kam "Bam Bam" Chancellor executing the "Shoulder Punch", a Seahawks tackling technique which is as it sounds.

The Seahawks tackling video summarising their techniques is shown here: https://www.youtube.com/watch?v=6Pb_B0c19xA; for Chancellor himself, I think this video sums up what he provided in the narrow focus I use, you may recognise part of it: https://www.youtube.com/watch?v=qgh8HmKVja8

The aim here is to inflict pain on your opponent, and to reduce the speed of their OODA loop. I've learnt here to specifically state that I'm not advocating any kind of "strikeback" methodology, but in showing that on the blue team we've forgotten that we're facing an opponent, and we can affect that opponent. The pyramid of pain I refer to is David Bianco's, taken from http://detect-respond.blogspot.com/2013/03/the-pyramid-of-pain.html; that illustrates the more complex aspects of their practice are of more value to your adversaries, so when you understand them and can act against them, you cause them the greatest amount of pain.

To me the explanation of this comes from Bartle's Taxonomy of player types, there's a good summary: https://en.wikipedia.org/wiki/Bartle_taxonomy_of_player_types; the "killers", people who like outwitting, defeating, demoralising a human opponent, those "killers" all join the Red Team when they enter cyber security, which means that aggressive and effective approach is lost from blue team strategies.

For this specific "performance" we had just watched Sarka give a great presentation on human weaknesses, yet we ignore the humans who are our adversaries and focus on technical defenses and techniques. The specific slide used a card from Reciprocal Strategies, who can be found here: https://www.reciprocalstrategies.com/resources/brt_cards/.

Haroon Meer has been arguing for more hackers to join the blue team for several years, I show a clip from his Null Con keynote, which can be watched here: https://www.youtube.com/watch?v=2F3wWWeaNaM. Do persevere with the flickering screen.

To inflict that required pain I think deception is key, I'm reminded of Clifford Stoll's "The Cuckoo's Egg" book, and how incident response started with deception. Paul Midian's presentation can be found here: https://www.youtube.com/watch?v=KvksyvF6MN4. For more on deception please refer to my post about my DevSecCon "remix" of these ideas.

But the emphasis here, just as an overarching strategy, is not to only think how you can improve your own abilities and skills, and the strengths of your organisation, but how you can degrade the effectiveness of your adversary.

END

Questions on supporting evidence are welcome by email or in the comments or even on Twitter, and overall if you've any questions please do get in touch.

And while I realise it's not the most useful of documents, a PDF of the presentation is here.Lessons-CyberTech-4point7-presentedpdf

I've a note on presenting guidance I make a point of reading whenever I'm putting something together, I figure it would be useful to others too:

( updated 19th September 2018 )

Recommended reading

Before you start reading, an excellent summary of most advice you'll receive is in Zach Holman's "The Talk on Talks", which is here https://www.youtube.com/watch?v=YVb2GsJHejo ; watch that, it's about fifty minutes long. Then visit Zach's site at https://speaking.io/

Now you've got an overview, concentrate on the overall format using How to give an Effective Presentation: https://qz.com/work/1110377/how-to-give-an-effective-presentation/

This presents the idea of how to structure the talk overall... and how to get your ideas together. I would emphasise this, I still struggle with trying to put too much in, spending days on research, and then realising I have a 90 minute presentation for a fifty minute slot. The sooner you can determine what is and isn't in the talk, the more time you'll save.

If you want to be above average then avoid all of the "anti-patterns" Troy Hunt mentions in this article... a bit of preparation and avoiding very basic pitfalls can take you a long way: https://www.troyhunt.com/speaker-style-bingo-10-presentation/

For a step beyond that, Thom Langford has written a good three part guide to presenting, this is worth working through:

Part 1: https://thomlangford.com/2018/05/18/the-art-of-the-presentation-part-1-of-3/

Part 2: https://thomlangford.com/2018/05/30/the-art-of-the-presentation-part-2-of-3/

Part 3: https://thomlangford.com/2018/07/20/the-art-of-the-presentation-part-3-of-3/

If you want the level beyond that then make the most of the transitions, moving on to the next slide on the right word can make all the difference, as described in this piece. However this does require practice, I've only become this good after repeatedly giving the same presentation four times a day for a week: https://medium.com/@saronyitbarek/transitions-the-easiest-way-to-improve-your-tech-talk-ebe4d40a3257

Confidence tips

Practice. Preferably in front of family or colleagues or friends, but if it comes down to it just practice in a room on your own with the laptop and a timer. That way you know the timing works, you'll at least have an inkling of what slide is coming next as you present - and if you can get any kind of audience they'll give you feedback on what does or doesn't make sense.

If you need confidence just before a performance... power pose with fists clenched... and by "power pose" I mean that rather silly looking stance Tory MPs have adopted recently where they stand with their legs slightly too far apart. In that pose your body will automatically think you're about to enter some kind of conflict and boost you with the right chemicals for a fight.

This idea was mentioned to me by my first mentee for BSides London, just imagine that the audience are penguins... flapping and squawking away, or waddling down to the water's edge for fish. It's silly, and nonsensical, but if it works it puts a smile on your face before you walk out there to face everyone.

And one last point, if you're an introvert, as per this tweet: https://twitter.com/KevinGoldsmith/status/963850794440187904, presenting gives you something to talk about with people, rather than having to navigate the morass of small talk.

Another entry that will help that one person on the Internet who's facing the same problem I have.

You have an Acer Travelmate B117-M, and wish to back it up over its wireless interface to a network drive; using Clonezilla booted from a USB stick, not a DVD.

What to do...

Firstly, boot the laptop, press F2 to take you into the BIOS.

Go to the "boot" option, and change the option of UEFI from Secure to... whatever the other option is, I'm backing up my own device as I type this.

Go to the Clonezilla website, and download the "bionic" version. The different downloads are listed here: https://clonezilla.org/downloads.php

Install it on a USB key by, very carefully, following the instructions on: https://clonezilla.org/liveusb.php

Note - the stable version of Clonezilla loads the right iwlwifi driver for the Intel Wireless 7265 network card, but it doesn't work. Check the output of "dmesg" for further information, but I couldn't see any way of fixing tha easily.

Note - the size of USB stick needed is slightly larger than those old 256MB USB sticks you've got lying around... so don't bother.

Boot the laptop, press F12 to take you to the boot options.

Choose your USB key.

Boot into Clonezilla.

Use the alt key, and either F2 or the right arrow, to move to a terminal window. Type "sudo bash" to become the root user.

The instructions for setting up wireless networking are here: https://www.linuxbabe.com/command-line/ubuntu-server-16-04-wifi-wpa-supplicant, but the important lines are:

wpa_passphrase your-ESSID your-passphrase > /etc/wpa_supplicant.conf
wpa_supplicant -c /etc/wpa_supplicant.conf -i wlan0

That will associate you with your local wireless access point.

From there just run clonezilla as normal.

( a couple of extra notes: while trying to solve this I upgraded the laptop's BIOS to version 1.25, which I downloaded and ran from here: https://www.acer.com/ac/en/GB/content/support-product/6660?b=1 ; the Clonezilla USB key only booted when I set it up with an MBR partition using the "o" option in fdisk... or that might have been me forgetting to run "makeboot.sh" )

InfoSec Recruiting – Is the Industry Creating its own Drought?

This can be found at: https://www.liquidmatrix.org/blog/2018/07/16/infosec-recruiting-industry-creating-drought/ . An interesting point of view from someone on both sides of the recruitment process. I don't think the problem Fischer highlights is respnsible for the drought, but poor recruiting and evaluation processes certainly don't help.

Why you should have your own black box | Matthew Syed | TEDxLondonBusinessSchool

This can be found on YouTube at https://www.youtube.com/watch?v=MmVCYqs3mko, presented by Matthew Syed. This is a really well put contrast between the growth mindset of the aeronautical industry, and the fixed mindset of the healthcare industry - and how the difference in culture between the two makes such a difference in outcomes. He then expands on that, and makes some excellent points. This is worth fifteen minutes of your time.

A Complete Guide to Getting What You Want

I probably read to many self-help articles as I try and figure out what I actually want to do and where I fit. But contrary to the comment at the start of it, this is a relatively short read: https://www.raptitude.com/2018/06/getting-what-you-want/ , and steps through the stages of figuring out what you want and how to get it.

Favourite quote, which I must remember to use elsewhere, is

"We’re fearful creatures after all, with an evolutionary impulse to cling to virtually any tolerable status quo, no matter how dull or crappy it is."

The Only Thing You Need to Get Good At

I recently discovered raptitude.com, another useful resource highlighted to me by the wonderful Career Shifters.

This blog post in particular is at https://www.raptitude.com/2017/03/only-thing-get-good-at/ ; and is a very high level explanation of stoicism, which has always intrigued me, and this post explains how you should only be concerned with that which you can control. Easier said than done, but wirth saying all the same.

As a side note, it highlighted to me my attitudes towards Left wing and Right wing politics in general; In general I think the policies of the left wing are far more effective, but think their tactics are awful; and while I generally dislike the policies of the right wing for various reasons - most significantly because they don't work, but I think their tactics are far more effective. I also think that's a massive over-generalisation for now and I'll stick with it in practice and see if it survives. That's something I'm tempted to expand on... but of course I've no political influence, and nothing personally to gain from doing so, so that would be a waste of time from a stoic point of view.

From chaotic ripples to complicated waves

Due to my interest in TRIZ I came across Ron Donaldson's blog, and this entry, at https://rondon.wordpress.com/2018/07/23/from-chaotic-ripples-to-complicated-waves/ , was particularly interesting. I like the aim of just enough rules to enable other teams in different areas to follow a successful example, rather than taking something that's worked and trying to make different areas, with different cultures, identical. I also liked that staff happiness, rather than just patient happiness, is seen as a gain - there can be too much emphasis on the "customer", with staff just seen as another resource to be manipulated appropriately.

Overview

A summary of my presentation "Lessons From The Legion". I'm hoping to give the presentation more often, in order to generate more interesting and useful conversations, so this will undoubtedly evolve, your feedback is welcome.

Alternatively, if you've requested a copy of my slides... I've directed you to this summary instead. For various reasons I'm conscious of how complex copyright law is, and I think I'm just on the right side of it, but I'm not aiming to test that more than necessary. Also the aim is always that the slides help you understand what I'm saying, and help me to remember what to say next, if they're standalone then I've not presenting my ideas effectively.

A very high level summary would be this tweet, if you want to point someone at a very short summary:

"people trying to excel at self-taught technical skills are sub-optimal at strategic decisions required for a nebulous conflict, their emphasis should be on team work, and on the strategies of, and constraints on, their adversaries; they should seek inspiration elsewhere"

As a less brief summary, but trying to keep things snappy, my reasoning is as below. A slide by slide summary is too dense, and makes me realise how many ideas I've pushed into the audience's heads in less than an hour, so I've tried to be more logical below.

Logical Progression of the talk

Introduction

I have a question - In Cyber Security - if we're all so smart, which we are, and we all work so hard, which we do, why is everything so awful?

Most presentations will start with an explanation of who the speaker is, their history, and why you should listen to them, and then give you an answer to the technical question they posed. This presentation is more of an "investigation wall", where the investigator links diverse ideas and newspaper clippings and surveillance photos and post-it notes with string to try and reveal an idea.

Also those technical presentations tend to be tactical, and I think the problem is that we have unintentionally decided on a vague strategy based on tactical choices, rather than an informed strategic choice has decided which tactics we should use.

John Kindervag's presentation "Winning the Cyberwar With Zero Trust" is a good example of thinking at a strategic level and making informed tactical choices accordingly, I specifically mention it here because I borrow some of his slides.

The main three areas I'm familiar with, as a cyber security practitioner, are:

• System Administrators / Developers
• Penetration Testing
• Incident Response

The strategy in all three areas is based on being the most technically skilful practitioner you can - sysadmins patch as quickly and as thoroughly as they can through knowledge of their operating systems, developers code as securely as they can through knowledge of their languages; penetration testing aptitude and success is based entirely on how technically adept the pentester is and how well they apply the "flaw hypothesis methodology"; and incident responses work on their forensics skills to learn how to spot different attacks, and prepare playbooks to run through once an attack has been detected.

Arguably the way this strategy has come about is because of how we train and practice for each area - all of which is based on self-motivated learning, and a passion for the job that is often described as "eat, sleep, breathe security". Therefore the emphasis is on individual skill and knowledge rather than on wider context.

Where has this choice got us? I cite various references that illustrate the poor state of cybersecurity, and the danger that poor cybersecurity poses to organisations in general and civilisation as a whole.

This method of practising reminds me of golf. Excelling at golf is based on individual skill, which is reflected in how a player performs in the game - because success in the game is based almost solely on individual performances. Even in a team game of golf, with a team and against an opposing team, there is very little your team-mates or opponents can do to directly affect your standard of play. And the actual course will be static also, apart from the vagaries of weather.

There is nothing wrong in practising like golf if you're going to play golf, however the practice of cyber security is nothing like the game of golf, I think we need to look at a different game.

Using this kind of analogy, and cross-pollentating ideas, between areas is generally derided, but if you look hard enough there are examples where this works. In particular the idea of TRIZ, of abstracting problems and solutions in order to determine what kind of solution is required in a rapid way.

So, if we're practising for golf, but not playing golf, what game are playing?

I argue that our industry feels a lot more like American Football. It is a ridiculously complex and violent sport, with many specialisms, and very much a team game where your success or failure is very dependent on the quality of your team and your ability to work with them, and how you act against and react to your opponent.

Therefore we should look to learn lessons from a successful American Football team. American Football is the only sport where each team has essentially two squads on it - an Offense for when your team has possession of the ball, and a Defense for when your team does not.

I think that as defenders in cyber security, even red teamers are looking to improve the performce of the blue team and the survivability of defenders, we should look to the best Defense. I classify Defense in American Football, and cyber security, as a "weak link game", where the overall ability of the team is decided by the ability of the worse players on your squad, not the best.

Possibly influenced by personal biases, but backed up by many sports facts I'll quote in the novella length version of this description, I have chosen the Legion of Boom, the Seattle Seahawks defense from 2011 to 2017, as an example to follow.

Looking at the central tenets of the team, and the defensive philosophy of the Seattle Seahawks head coach, Pete Carroll ( who has approximately 40 years of experience and an exemplary record ), I pick some of the main lessons from the Seahawks successful Defense:

First lesson - eliminate the big play.

There is not time to explain the Seahawks' use of "Cover-3 with a single high Free Safety", and their general approach of keeping the ball in front of the defenders to ensure the Defense always has another chance to prevent their opponents scoring, so I look at personnel choices.

Most NFL defenses, when choosing personnel, have emphasised their Defensive Line, the first line of defense against an opponent. Carroll has always specifically looked to the Defensive Backs, the last line of defense, most notably the Free Safety position, which is what he played in college.

This is reflected in the NIST Cyber Security Framework, and the five Core Functions. I am old enough to remember when Identify and Protect were the only aspects seen as useful, but slowly we are learning that Detect, Respond, and Recover are at least as important in surviving an attack, rather than believing in the "Defender's Dilemma", that if an attacker breaches us we have immediately lost.

I would argue ( and if I remember during the presentation I'll actually say it ) that the emphasis should be on Detect, Respond, Recover - the last line of defense, not the first.

Second lesson - train how you fight

Because American Football is such a complex game it is necessary to practice complex play calls and formations in advance, and to ensure that each individual knows their responsibility, and everybody else's responsibility, on each play so that they can function as a team.

Because the teams are so large there are enough players for the second and third string players in each squad to form "scout teams". These teams imitate the playing style and formations of upcoming opponents so that both they, and the first string players, understand what is coming up in next week's game, and also are less surprised by any of their opponents individual styles in the game.

This links into the concept from wargaming of the Caffrey Triangle, showing how a red team - in a red team exercise specifically designed to assist the blue team - should act depending on the objectives of the engagement. I argue that penetration testers work almost solely at the top of the triangle, being the most effective attackers they can, when they should operate in the right hand corner, emulating the TTPs of genuine adversaries in order to prepare the blue team for their real world opponents.

Also I stress here that any kind of practice is required, as the discipline of Incident Response is notorious for organisations referring to their plans for the first time, or even writing them the first time, during an actual incident. Constant practice is crucial, especially when we are moving from being in Cyber Security to proposing Cyber Resilience.

Third lesson - know your enemy

I briefly introduce John Boyd's concept of the OODA loop - Observe Orient Decide Act - as a way of understanding how you process information in a conflict, and how "getting inside your opponents OODA loop" by progressing through the steps faster than them, leads to victory.

This takes me to showing plays by Bobby Wagner, a Linebacker with the Seattle Seahawks, and arguably the best player at this position, and who has stated that the game is "90% mental" because as you can only get as fast or as strong as everyone else. I show a play whereby, even though on defense, even though on the side of the ball that's meant to react to the play, Wagner knows what the offensive is going to do and so is able to take advantage of that to disrupt his opponent.

As a side note - this emphasis on researching your opponent, and therefore being so much more confident during a game, has many more references from the entire Legion of Boom, especially their three most well known Defensive Backs. I have some references, and some video clips... when I say there's a three hour version of this presentation waiting to be written I'm not joking.

I link this to the RAND paper from 1991, the Base of Sand Problem, mainly because of the excellent footnote that explains that the effective of forces - their training, logistics, and positions - is much more crucial to deciding who is the victor in a particular conflict, than the sheer size of any force.

Also I use references that your opponent has a limited number of playbooks, and therefore learning them is an achievable aim, rather than attempting to defend all assets against all attacks from all possible adversaries.

Fourth lesson - out hit your opponent

The second of Pete Carroll's tenets, it is a physical game, it is a collision sport, and there are psychological and as well as other gains to be made by simply hitting your opponent as hard as you can.

Also this tallies with the first aim, to eliminate the big play, as it physically puts the defenders in an excellent position to tackle or otherwise collide with their opponents - but I don't often have time to go into this level of detail on the game.

For this I use clips from Richard Sherman, Earl Thomas, but mainly Kam "Bam Bam" Chancellor executing the "Shoulder Punch", a Seahawks tackling technique which is as it sounds.

The aim here is to inflict pain on your opponent, and to reduce the speed of their OODA loop. I've learnt here to specifically state that I'm not advocating any kind of "strikeback" methodology, but in showing that on the blue team we've forgotten that we're facing an opponent.

I link this to the standard Incident Response methodology, which is based on Gold, Silver, and Bronze Commanders, and is designed for what I'd describe as "non-sentient opponents". Maybe we need to add a "Francium Commander", based on the most dangerous of elements, where an incident would be handed over to someone who would specifically attempt to deceive and disrupt the enemy. This could be achieved through deception, in making your opponent so unsure of their context that they are reduced to ITIL type processes to ensure they aren't detected. Also I emphasise that this is a team game, and that sharing adversary TTPs with other defenders assists everyone and builds the size of your time.

Summary

Usually at this point I stress that I'm not sure of my ideas, but that F-Secure's purchase of MWR shows that someone else agrees, at least in general, with some of what I'm proposing.

Also that what I'm advocating, which is only half-thought through at best, is a change in strategy and/or doctrine and/or ideology. These are the most difficult changes to make, and the least liked, organisations prefer simple solutions that state they'll eradicate the problem, regardless of their actual effectiveness. However as many have said, for example Anton Chuvakin of Gartner, the industry does not have enough staff, and already has more than enough products, yet we are still facing more of the same problems.

At this point I summarise all of the above, and kind of finish indecisively to encourage questions rather than proposing I have definitive answers.

END

The latest set of references should be elsewhere on this blog, please scroll down, or up, the find the version related to whichever "performance" you watched.

Combining the logic above with those references is something I should do, but at the moment I'm happy to do that "live" during the performances of this talk. Questions on supporting evidence are welcome by email or in the comments, and overall if you've any questions please do get in touch.

If all's gone to plan this blog post should appear just as questions are finishing at my presentation at Cyber London ( which was detailed here https://www.meetup.com/London-Cyber-Capital-One/events/252353488/ ).

As before, I've categorised references by type, kind of, I figure that's the easiest way for people to navigate this. They're in alphabetical order, but with an index of "the thing I think I put to the fore when mentioning this", which isn't the most objective criteria. Constructive feedback always welcome - I'm sure there's a better way to list these, but I'm not sure how.

Books:

"Bullshit Jobs" is by David Graeber, there's a description here https://www.penguin.co.uk/books/295446/bullshit-jobs/

The Numbers Game by Chris Anderson covers Strong Link and Weak Link games, and well, actually, I should buy this and read it, but this article covers all you need to know for the level I use it at: http://www.asalesguy.com/soccer-and-messi-basketball-and-lebron-how-one-is-like-sales-and-the-other-isnt/

Blog posts:

First Mover Advantage - Tenable's blog post on the how quickly attackers and defenders evaluate vulnerabilities: https://www.tenable.com/blog/quantifying-the-attacker-s-first-mover-advantage ; I've literally grabbed the headline thanks to the pointer to this from Dark Reading: https://www.darkreading.com/prnewswire2.asp?rkey=20180524PH05742&filter=3849

Peak security product - Anton Chuvakin's point on not having enough people is here https://blogs.gartner.com/anton-chuvakin/2018/06/21/is-security-just-too-damn-hard-is-productservice-the-future/ ( at the time of writing I don't expect to be able to mention it, but this Leviathan Security paper is a useful resource for highlighting that there will never be enough people: https://static1.squarespace.com/static/556340ece4b0869396f21099/t/559dada7e4b069728afca39b/1436396967533/Value+of+Cloud+Security+-+Scarcity.pdf ; with a hat tip to Harron Meer on this podcast: https://securityboulevard.com/2018/07/we-have-the-silver-bullet-for-bs-detection-ciso-security-vendor-relationship-podcast/ )

Rapid 7 on the number of CVEs is here: https://blog.rapid7.com/2018/04/30/cve-100k-by-the-numbers/

SR-71 Blackbird: this might have made it in as a very quick reference, I thought of that context listening to this podcast: https://www.lockheedmartin.com/en-us/who-we-are/business-areas/aeronautics/skunkworks/insideskunkworks.html#Episode-1

Presentations:

Blinky Boxes - Frasier Scott's presentation on threat modelling has slides here: https://speakerdeck.com/zeroxten/threat-modeling-the-ultimate-devsecops I think this is part of his current repetroire, so best caught live of course - at the time of preparing this I'm not sure how much he'll have used in his talk following mine.

CTFs - The Last CTF Talk You'll Ever Need from DEFCON 25, is here: https://www.youtube.com/watch?v=MbIDrs-mB20

CTRL+Break The OODA Loop by Abel Toro of Forcepoint from BSides London 2018 isn't up yet on their channel https://www.youtube.com/channel/UCXXNOelGiY_N96a2nfhcaDA ; it was on Track 3, I'm hoping that was recorded... or that Abel will be giving the presentation again.

The Cuckoo's Egg reference was inspired by Paul Midian's BSides Glasgow 2018 keynote "Everything You Know Is Wrong" - https://www.youtube.com/watch?v=KvksyvF6MN4

Cyber Defense Threshold - this is from Sean T Malone's presentation "Using An Expanded Cyber Kill Chain Model to Increase Attack Resiliency", the video is here: https://www.youtube.com/watch?v=1Dz12M7u-S8 and the slides are here: https://www.blackhat.com/docs/us-16/materials/us-16-Malone-Using-An-Expanded-Cyber-Kill-Chain-Model-To-Increase-Attack-Resiliency.pdf

Hackers being needed on the Blue Team comes from Haroon Meer's Nullcon Goa 2018 keynote: https://www.youtube.com/watch?v=2F3wWWeaNaM

Ian Fish - Crisis Management - from CrestCON 2018 - is here: https://www.youtube.com/watch?v=R1UOW3xGpZE

Intruder's Dilemma - is mentioned in this from BSides Munch 2018: https://www.youtube.com/watch?v=PQgsEtRcfAA

Penetration Testing Must Die - Rory McCune at BSides London 2011 - is here: https://www.youtube.com/watch?v=MyifS9cQ4X0

Playbooks - Common Traps & Pitfalls in Red-teaming by Andrew Davies and Jon Medvenics from CRESTCon is here: https://www.youtube.com/watch?v=bYTrwzFUSSE

Strategy - John Kindervag's "Win the War With Zero Trust" can be found via BrightTalk here: https://www.brighttalk.com/webcast/10903/280059

Reports:

The Base of Sand Problem, the RAND report that highlights the problems in military modelling/simulations/wargaming that, for me, resonate with issues we face, can be found here: https://www.rand.org/pubs/notes/N3148.html

The Cyber Resilience Report from KPMG, that really makes the point that preparation is key, can be found here: https://assets.kpmg.com/content/dam/kpmg/ie/pdf/2017/09/ie-cyber-resilience-2.pdf

The Global Risks Report 2018 from the World Economic Forum can be obtained here: https://www.weforum.org/reports/the-global-risks-report-2018

Outpost24's report on their survey of RSA attendees can be found here: https://outpost24.com/sites/default/files/2018-05/RSA-2018-Survey-Outpost24.pdf

State of CyberSecurity Report - InfoSecurity Magazine - where they highlight regulation can drive security - can be found here: https://www.infosecurity-magazine.com/white-papers/state-of-cyber-security-report/

Seattle Seahawks and other less cybery references:

The article "Bobby Wagner Can See into the Future" is here: https://www.si.com/mmqb/2017/06/29/nfl-bobby-wagner-seattle-seahawks

Bobby Wagner's PFF rating is from this tweet: https://twitter.com/PFF/status/1005914257563836416 ( as a side note, check out this video on Luke Kuechly, who's also on that list, that's basically team-mates and rivals saying how smart he is https://www.youtube.com/watch?v=umfgvffJ6M0 )

Fewest points allowed - this ESPN article summarises it nicely http://www.espn.co.uk/nfl/story/_/id/17886833/how-seattle-defense-dominated-nfl-five-years-running-nfl-2016

Introduction - the quick cartoon shoulderpunch is taken from this introduction to the game: https://www.youtube.com/watch?v=3t6hM5tRlfA

Kam Chancellor - I think this video sums up what he provided in the narrow focus I use, you may recognise part of it: https://www.youtube.com/watch?v=qgh8HmKVja8 ( as a side note, while I don't think it's relevant to the analogy, Kam Chancellor appears to have retired http://www.espn.com/nfl/story/_/id/23967587/kam-chancellor-seattle-seahawks-safety-appears-announce-retirement-via-twitter - this is a good video summary of what he provided to the team https://www.youtube.com/watch?v=8SltNCS4Jg0 )

Legion of Boom - there's a nice retrospective that's just a five minute video: https://www.youtube.com/watch?v=N73r5HemB0M

If you want an emphasis on the boom, watch this: https://www.youtube.com/watch?v=xF6OLtz280Y

My main source for Pete Carroll's philosophy, in many senses of the word, is here: https://www.fieldgulls.com/football-breakdowns/2014/2/3/5374724/super-bowl-48-seahawks-pete-carrolls-richard-sherman-marshawn-lynch ; I have a lot of reading to look forward to.

If you want to see just how many players there are on a team then you'll see the Seahawks roster here: https://www.seahawks.com/team/players-roster/

Tackling video - the Seahawks 2015 video summarising their technique is shown here: https://www.youtube.com/watch?v=6Pb_B0c19xA

Olivia Jeter, Defensive End for Blandensburg High School, is covered in these videos: https://www.youtube.com/watch?v=yAYS2VnfFi8 and https://www.youtube.com/watch?v=5xD8qjihHf8 Yes, I do realise that those videos are from 2014, but she provides such great soundbites, I must find out what happened to her.

YouGov's survey on British interest in various sports is here: https://yougov.co.uk/news/2018/01/10/what-most-boring-sport/

Tweets:

Jeremiah Grossman on the Kenna Security report, highlighting 2% of vulnerabilities are exploited, is here: https://twitter.com/jeremiahg/status/996469856970027008 I've got into interesting discussions on how true or untrue that figure may be, watch this space.

Websites:

AIS - The article from Cyberscoop on the DHS's Automated Information Sharing portal being underused is here: https://www.cyberscoop.com/dhs-ais-cisa-isnt-used-jim-langevin/

Bananas - Chiquita using pharmaceutical packaging is detailed here: http://archive.boston.com/business/globe/articles/2007/03/07/yes_we_have_one_banana/

Banks using mobile phone companies ... I had a single reference for this and lost it, so as per my real world presentation, I think I said something generic like "there's many examples of banks talking to many different industries", do get in touch if you find any particularly good ones.

Bartle's Taxonomy of player types is taken from this: https://en.wikipedia.org/wiki/Bartle_taxonomy_of_player_types

BreachLevelIndex.com is, well, here: https://breachlevelindex.com/

The Caffrey Triangle is mentioned here https://paxsims.wordpress.com/2016/08/19/connections-2016-conference-report/ , I've had it explained to me in person, we all need to be talking about this a lot more, in both cyber security and wargaming.

Cyber Resilience - Phil Huggins' Black Swan Security blog is here: http://blog.blackswansecurity.com/2016/02/cyber-resilience-part-one-introduction/

Cyberscape - the amount of tools we have, is taken from Momentum's cyberscape: https://momentumcyber.com/docs/CYBERscape.pdf

Dentistry using space technology is here: https://phys.org/news/2010-10-benefits-space-technology-dentists.html

DevSecOps WAF concept is described here: https://www.acrosec.jp/what-is-a-devsecops-waf/?lang=en

Emergency response - the three element model can be seen is some detail here on the College of Policing website: https://www.app.college.police.uk/app-content/operations/command-and-control/command-structures/

Francium - my main inspiration for choosing the element Francium is here: http://www.sparknotes.com/mindhut/2013/09/06/the-worlds-most-dangerous-elements

Full Spectrum Response - yes, it is something I've read about only briefly, and it is for the battlefield rather than as a viable response to your regional office receiving a phishing email. There's a short PDF here: https://www.northropgrumman.com/Capabilities/Cybersecurity/Documents/Events/Datasheets_IA15/IA15_FSO_Datasheet.pdf

HorseSenseUK - Equine Assisted Education - can be found here: http://horsesenseuk.com/

Incident Response, the four stages - I detailed that in this blog post: http://blog.sonofsuntzu.org.uk/post/2017/03/26/Notes-on-Incident-Response-from-the-SC-Congress

Incident Response Timelines - this is taken from the Logically Secure website, and can be found here: https://www.logicallysecure.com/blog/ir-metrics-part-1/

Intruder's Dilemma - I think the first reference to it from Richard Bejtlich is here: https://taosecurity.blogspot.com/2009/05/defenders-dilemma-and-intruders-dilemma.html

MWR - the TechCrunch article I refer to, where F-Secure note the need for offensive capability, is here: https://techcrunch.com/2018/06/18/f-secure-to-buy-mwr-infosecurity-for-106m-to-offer-better-threat-hunting/

Naval - Paul Raisbeck, who uses his naval experience in what is loosely described as management consultancy, can be found here: https://www.linkedin.com/in/paulraisbeck/ , and a relevant piece by him here: https://www.linkedin.com/pulse/what-could-your-business-learn-from-royal-navy-people-paul-raisbeck/

OODA loops are basically described here, but again, please pay me to research these concepts: https://en.wikipedia.org/wiki/OODA_loop

Playbooks, Rick Howard, the CSO of Palo Alto, on the small number of opponent's playbooks: https://www.csoonline.com/article/3207692/leadership-management/exploit-attacker-playbooks-to-improve-security.html

Practice - "any incident response plan is only as strong as the practice that goes into it" is from Mike Peters, Vice President of RIMS, the industry body for Risk Management. Best to search online for that specific quote and use whichever source will look best in your board level presentation.

RASP, being Runtime Application Security Protection, is described here: https://www.softwaresecured.com/what-do-sast-dast-iast-and-rasp-mean-to-developers/

Strikeback - yes, I have thought it's a bad idea for just over twenty years now: http://seclists.org/firewall-wizards/1998/May/69

TRIZ on Wikipedia is here: https://en.wikipedia.org/wiki/TRIZ and the main British consultancy, as far as I can tell, is here: https://www.triz.co.uk/

Overall

Sometimes I get the gist of something and use that. If you know any of these ideas better than I do, meaning that I've missed a nuance, or not read an important reference, please do get in touch. I always appreciate constructive corrections.

Further to my presentation at DC151 please find a list of the most relevant references. It's almost all the same as those from earlier meetings, but I did want to highlight what a pleasure it was to present there, thanks to everyone who came, and to those who took part in the discussion afterwards - I've still got a couple of pages of notebook notes to work through.

As before, I've categorised references by type, kind of, I figure that's the easiest way for people to navigate this. Constructive feedback always welcome - I'm sure there's a better way to list these, but I'm not sure how.

Books:

"Bullshit Jobs" is by David Graeber, there's a description here https://www.penguin.co.uk/books/295446/bullshit-jobs/

The Numbers Game by Chris Anderson covers Strong Link and Weak Link games, and well, actually, I should buy this and read it, but this article covers all you need to know: http://www.asalesguy.com/soccer-and-messi-basketball-and-lebron-how-one-is-like-sales-and-the-other-isnt/

Blog posts:

Peak security product - Anton Chuvakin's point on not having enough people is here https://blogs.gartner.com/anton-chuvakin/2018/06/21/is-security-just-too-damn-hard-is-productservice-the-future/

Rapid 7 on the number of CVEs is here: https://blog.rapid7.com/2018/04/30/cve-100k-by-the-numbers/

Presentations:

Blinky Boxes - Frasier Scott's presentation on threat modelling has slides here: https://speakerdeck.com/zeroxten/threat-modeling-the-ultimate-devsecops I think this is part of his current repetroire, so best caught live of course; or seeing as he's in DevOps, it'll have iterated several times already.

CTFs - The Last CTF Talk You'll Ever Need from DEFCON 25, is here: https://www.youtube.com/watch?v=MbIDrs-mB20

CTRL+Break The OODA Loop by Abel Toro of Forcepoint from BSides London 2018 isn't up yet on their channel https://www.youtube.com/channel/UCXXNOelGiY_N96a2nfhcaDA ; it was on Track 3, I'm hoping that was recorded... or that Abel will be giving the presentation again.

The Cuckoo's Egg reference was inspired by Paul Midian's BSides Glasgow 2018 keynote "Everything You Know Is Wrong" - https://www.youtube.com/watch?v=KvksyvF6MN4

Hacker's being needed on the Blue Team comes from Harron Meer's Nullcon Goa 2018 keynote: https://www.youtube.com/watch?v=2F3wWWeaNaM

Ian Fish - Crisis Management - from CrestCON 2018 - is here: https://www.youtube.com/watch?v=R1UOW3xGpZE

Intruder's Dilemma - is mentioned in this from BSides Munch 2018: https://www.youtube.com/watch?v=PQgsEtRcfAA

Penetration Testing Must Die - Rory McCune at BSides London 2011 - is here: https://www.youtube.com/watch?v=MyifS9cQ4X0

Playbooks - Common Traps & Pitfalls in Red-teaming by Andrew Davies and Jon Medvenics from CRESTCon is here: https://www.youtube.com/watch?v=bYTrwzFUSSE

Strategy - John Kindervag's "Win the War With Zero Trust" can be found via BrightTalk here: https://www.brighttalk.com/webcast/10903/280059

Reports:

The Base of Sand Problem, the RAND report that highlights the problems in military modelling/simulations/wargaming that, for me, resonate with issues we face, can be found here: https://www.rand.org/pubs/notes/N3148.html

The Cyber Resilience Report from KPMG, that really makes the point that preparation is key, can be found here: https://assets.kpmg.com/content/dam/kpmg/ie/pdf/2017/09/ie-cyber-resilience-2.pdf

The Global Risks Report 2018 from the World Economic Forum can be obtained here: https://www.weforum.org/reports/the-global-risks-report-2018

Outpost24's report on their survey of RSA attendees can be found here: https://outpost24.com/sites/default/files/2018-05/RSA-2018-Survey-Outpost24.pdf

State of CyberSecurity Report - InfoSecurity Magazine - where they highlight regulation can drive security - can be found here: https://www.infosecurity-magazine.com/white-papers/state-of-cyber-security-report/

Seattle Seahawks and other less cybery references:

The article "Bobby Wagner Can See into the Future" is here: https://www.si.com/mmqb/2017/06/29/nfl-bobby-wagner-seattle-seahawks

Bobby Wagner's PFF rating is from this tweet: https://twitter.com/PFF/status/1005914257563836416 ( as a side note, check out this video on Luke Kuechly, who's also on that list, that's basically team-mates and rivals saying how smart he is https://www.youtube.com/watch?v=umfgvffJ6M0 )

Fewest points allowed - this ESPN article summarises it nicely http://www.espn.co.uk/nfl/story/_/id/17886833/how-seattle-defense-dominated-nfl-five-years-running-nfl-2016

Introduction - the quick cartoon shoulderpunch is taken from this introduction to the game: https://www.youtube.com/watch?v=3t6hM5tRlfA

Kam Chancellor - I think this video sums up what he provided in the narrow focus I use, you may recognise part of it: https://www.youtube.com/watch?v=qgh8HmKVja8 ( as a side note, while I don't think it's relevant to the analogy, Kam Chancellor appears to have retired http://www.espn.com/nfl/story/_/id/23967587/kam-chancellor-seattle-seahawks-safety-appears-announce-retirement-via-twitter - this is a good video summary of what he provided to the team https://www.youtube.com/watch?v=8SltNCS4Jg0 )

Legion of Boom - there's a nice retrospective that's just a five minute video: https://www.youtube.com/watch?v=N73r5HemB0M

If you want an emphasis on the boom, watch this: https://www.youtube.com/watch?v=xF6OLtz280Y

My main source for Pete Carroll's philosophy, in many senses of the word, is here: https://www.fieldgulls.com/football-breakdowns/2014/2/3/5374724/super-bowl-48-seahawks-pete-carrolls-richard-sherman-marshawn-lynch ; I have a lot of reading to look forward to.

If you want to see just how many players there are on a team then you'll see the Seahawks roster here: https://www.seahawks.com/team/players-roster/

Tackling video - the Seahawks 2015 video summarising their technique is shown here: https://www.youtube.com/watch?v=6Pb_B0c19xA

Olivia Jeter, Defensive End for Blandensburg High School, is covered in these videos: https://www.youtube.com/watch?v=yAYS2VnfFi8 and https://www.youtube.com/watch?v=5xD8qjihHf8 Yes, I do realise that those videos are from 2014, but she provides such great soundbites, I must find out what happened to her.

YouGov's survey on British interest in various sports is here: https://yougov.co.uk/news/2018/01/10/what-most-boring-sport/

Tweets:

Jeremiah Grossman on the Kenna Security report, highlighting 2% of vulnerabilities are exploited, is here: https://twitter.com/jeremiahg/status/996469856970027008 I've got into interesting discussions on how true or untrue that figure may be, watch this space.

Websites:

Bananas - Chiquita using pharmaceutical packaging is detailed here: http://archive.boston.com/business/globe/articles/2007/03/07/yes_we_have_one_banana/

Banks using mobile phone companies ... I had a single reference for this and lost it, so as per my real world presentation, I think I said something generic like "there's many examples of banks talking to many different industries", do get in touch if you find any particularly good ones.

Bartle's Taxonomy of player types is taken from this: https://en.wikipedia.org/wiki/Bartle_taxonomy_of_player_types

BreachLevelIndex.com is, well, here: https://breachlevelindex.com/

The Caffrey Triangle is mentioned here https://paxsims.wordpress.com/2016/08/19/connections-2016-conference-report/ , I've had it explained to me in person, we all need to be talking about this a lot more, in both cyber security and wargaming.

Cyber Resilience - Phil Huggins' Black Swan Security blog is here: http://blog.blackswansecurity.com/2016/02/cyber-resilience-part-one-introduction/

Cyberscape - the amount of tools we have, is taken from Momentum's cyberscape: https://momentumcyber.com/docs/CYBERscape.pdf

Dentistry using space technology is here: https://phys.org/news/2010-10-benefits-space-technology-dentists.html

Emergency response - the three element model can be seen is some detail here on the College of Policing website: https://www.app.college.police.uk/app-content/operations/command-and-control/command-structures/

Francium - my main inspiration for choosing the element Francium is here: http://www.sparknotes.com/mindhut/2013/09/06/the-worlds-most-dangerous-elements

HorseSenseUK - Equine Assisted Education - can be found here: http://horsesenseuk.com/

Incident Response, the four stages - I detailed that in this blog post: http://blog.sonofsuntzu.org.uk/post/2017/03/26/Notes-on-Incident-Response-from-the-SC-Congress

Incident Response Timelines - this is taken from the Logically Secure website, and can be found here: https://www.logicallysecure.com/blog/ir-metrics-part-1/

Intruder's Dilemma - I think the first reference to it from Richard Bejtlich is here: https://taosecurity.blogspot.com/2009/05/defenders-dilemma-and-intruders-dilemma.html

MWR - the TechCrunch article I refer to, where F-Secure note the need for offensive capability, is here: https://techcrunch.com/2018/06/18/f-secure-to-buy-mwr-infosecurity-for-106m-to-offer-better-threat-hunting/

Naval - Paul Raisbeck, who uses his naval experience in what is loosely described as management consultancy, can be found here: https://www.linkedin.com/in/paulraisbeck/ , and a relevant piece by him here: https://www.linkedin.com/pulse/what-could-your-business-learn-from-royal-navy-people-paul-raisbeck/

OODA loops are basically described here, but again, please pay me to research these concepts: https://en.wikipedia.org/wiki/OODA_loop

Playbooks, Rick Howard, the CSO of Palo Alto, on the small number of opponent's playbooks: https://www.csoonline.com/article/3207692/leadership-management/exploit-attacker-playbooks-to-improve-security.html

Practice - "any incident response plan is only as strong as the practice that goes into it" is from Mike Peters, Vice President of RIMS, the industry body for Risk Management. Best to search online for that specific quote and use whichever source will look best in your board level presentation.

TRIZ on Wikipedia is here: https://en.wikipedia.org/wiki/TRIZ and the main British consultancy, as far as I can tell, is here: https://www.triz.co.uk/

Overall

Sometimes I get the gist of something and use that. If you know any of these ideas better than I do, meaning that I've missed a nuance, or not read an important reference, please do get in touch. I always appreciate constructive corrections.

Just a brief summary of the articles I've found showing that Gareth Southgate has sought knowledge outside of his specific area:

BBC 26th June 2018 - https://www.bbc.co.uk/sport/football/44616567 - interesting that the Seahawks and the use of set-pieces are specifically mentioned.

Telegraph 26th June 2018 - https://www.telegraph.co.uk/world-cup/2018/06/26/gareth-southgate-fuelled-englands-world-cup-bid-inspiration/ - a useful summary of just how many other sports Southgate has referred to, notably the way NFL stars are presented to the media.

See also this from the Guardian https://www.theguardian.com/football/2018/jun/25/england-set-pieces-world-cup ; this from MyNorthwest in the USA http://sports.mynorthwest.com/477017/keen-to-embrace-us-sporting-ideas-southgate-revives-england/? ;

Hopefully the England team does well enough that I can use this quote from Southgate: "One of the reasons some of our guys have travelled is to see how the NFL operate because we don't have to do things the way they've always been done, we can try different things that work" ( my emphasis ) - from http://www.espn.co.uk/football/england/story/3371770/england-boss-gareth-southgate-looks-to-super-bowl-for-inspiration

And a note to myself, if I rewrite my current presentation with more soccer references, Sir Bobby Robson is very quotable: https://www.bbc.co.uk/sport/football/44605562 ; this from Alan Shearer:

As a player, I always knew there would be opportunities at set-pieces, if not for me then for one of my team-mates.

At Newcastle, Sir Bobby Robson would tell us "there is always one dope who falls asleep" and we would try to pick out the defender who would let his side down.