who here likes free Wi-Fi hands up now that’s reasonable we all like something
that’s reasonable we all like something
that’s reasonable we all like something free interestingly though I don’t think
free interestingly though I don’t think
free interestingly though I don’t think that I love a free Wi-Fi is necessarily
that I love a free Wi-Fi is necessarily
that I love a free Wi-Fi is necessarily translated through to this morning and
translated through to this morning and
translated through to this morning and this afternoon earlier before we came in
this afternoon earlier before we came in
this afternoon earlier before we came in here my colleagues and I and I came in
here my colleagues and I and I came in
here my colleagues and I and I came in we set up a Wi-Fi access point we built
we set up a Wi-Fi access point we built
we set up a Wi-Fi access point we built a landing page to look like TEDx
a landing page to look like TEDx
a landing page to look like TEDx and we asked you to enter in email
and we asked you to enter in email
and we asked you to enter in email addresses and enter in a password we’ve
addresses and enter in a password we’ve
addresses and enter in a password we’ve done this with malicious intent if
done this with malicious intent if
done this with malicious intent if anyone recognizes their email address up
anyone recognizes their email address up
anyone recognizes their email address up there yeah for the next 15 minutes or so
there yeah for the next 15 minutes or so
there yeah for the next 15 minutes or so you’re my victim now if you look at a
you’re my victim now if you look at a
you’re my victim now if you look at a couple of the email addresses at the
couple of the email addresses at the
couple of the email addresses at the bottom I think people perhaps on to our
bottom I think people perhaps on to our
bottom I think people perhaps on to our little trick and in the circumstance of
little trick and in the circumstance of
little trick and in the circumstance of what we’ve done this morning
what we’ve done this morning
what we’ve done this morning perhaps that’s actually a good thing my
perhaps that’s actually a good thing my
perhaps that’s actually a good thing my name is Sven Ross and I’m here to talk
name is Sven Ross and I’m here to talk
name is Sven Ross and I’m here to talk to you today about the modern cyber
to you today about the modern cyber
to you today about the modern cyber threat the modern cyber problem I think
threat the modern cyber problem I think
threat the modern cyber problem I think it’s worth exploring this because as we
it’s worth exploring this because as we
it’s worth exploring this because as we enter into as we are now in the digital
enter into as we are now in the digital
enter into as we are now in the digital age and as we step forward into a future
age and as we step forward into a future
age and as we step forward into a future and with the future blueprint we use
and with the future blueprint we use
and with the future blueprint we use technology almost pervasively throughout
technology almost pervasively throughout
technology almost pervasively throughout our lives and I think we need to
our lives and I think we need to
our lives and I think we need to understand the risk that it poses and
understand the risk that it poses and
understand the risk that it poses and for every advantage that we take of
for every advantage that we take of
for every advantage that we take of Technology perhaps there’s something or
Technology perhaps there’s something or
Technology perhaps there’s something or someone out there using it to their
someone out there using it to their
someone out there using it to their advantage as well but what is a cyber
advantage as well but what is a cyber
advantage as well but what is a cyber threat what is hacking now I won’t ask
threat what is hacking now I won’t ask
threat what is hacking now I won’t ask for any contribution from the audience
for any contribution from the audience
for any contribution from the audience so I just like to give I guess my own
so I just like to give I guess my own
so I just like to give I guess my own interpretation of what this is I broadly
interpretation of what this is I broadly
interpretation of what this is I broadly set hacking is the manipulation of
set hacking is the manipulation of
set hacking is the manipulation of technology or process or both in order
technology or process or both in order
technology or process or both in order to deliver effect that was that wasn’t
to deliver effect that was that wasn’t
to deliver effect that was that wasn’t intended by the originator of that
intended by the originator of that
intended by the originator of that technology or process and with malicious
technology or process and with malicious
technology or process and with malicious intent it can come in many forms it can
intent it can come in many forms it can
intent it can come in many forms it can come in a simplistic form such as a
come in a simplistic form such as a
come in a simplistic form such as a social engineering attack that we
social engineering attack that we
social engineering attack that we engineered this morning against you guys
engineered this morning against you guys
engineered this morning against you guys it can be brutal and chunky such as a
it can be brutal and chunky such as a
it can be brutal and chunky such as a brute-force attempt against your
brute-force attempt against your
brute-force attempt against your password trying to crack your password
password trying to crack your password
password trying to crack your password or it can be a touch more elegant and
or it can be a touch more elegant and
or it can be a touch more elegant and sophisticated such as placing a little
sophisticated such as placing a little
sophisticated such as placing a little bit of malicious software on your laptop
bit of malicious software on your laptop
bit of malicious software on your laptop so that when you enter your banking
so that when you enter your banking
so that when you enter your banking credentials it captures it as you’re
credentials it captures it as you’re
credentials it captures it as you’re entering the keystrokes and sends it off
entering the keystrokes and sends it off
entering the keystrokes and sends it off to a sense
to a sense
to a sense service or someone can log into your
service or someone can log into your
service or someone can log into your bank account and steal your money now I
bank account and steal your money now I
bank account and steal your money now I think we’re a little misled by the media
think we’re a little misled by the media
think we’re a little misled by the media when it comes to somewhat the cyber
when it comes to somewhat the cyber
when it comes to somewhat the cyber threat is and this is the crux of my
threat is and this is the crux of my
threat is and this is the crux of my talk this morning and I think we’re
talk this morning and I think we’re
talk this morning and I think we’re mislead because we see photos like this
mislead because we see photos like this
mislead because we see photos like this we see images where the focus is 100% on
we see images where the focus is 100% on
we see images where the focus is 100% on the code on the technology on the ones
the code on the technology on the ones
the code on the technology on the ones of zeroes and sometimes we see things
of zeroes and sometimes we see things
of zeroes and sometimes we see things like this where it’s definitely the code
like this where it’s definitely the code
like this where it’s definitely the code that’s coming to attack us but it’s not
that’s coming to attack us but it’s not
that’s coming to attack us but it’s not and that’s what I’d like to cover this
and that’s what I’d like to cover this
and that’s what I’d like to cover this morning this afternoon but first I
morning this afternoon but first I
morning this afternoon but first I haven’t always want to suit a little bit
haven’t always want to suit a little bit
haven’t always want to suit a little bit about me how many ways one suit so I
about me how many ways one suit so I
about me how many ways one suit so I haven’t always worn pink shirts I
haven’t always worn pink shirts I
haven’t always worn pink shirts I haven’t always been a normal person for
haven’t always been a normal person for
haven’t always been a normal person for the greater part of my adult life I
the greater part of my adult life I
the greater part of my adult life I spent in the military specifically the
spent in the military specifically the
spent in the military specifically the army and serving in Special Forces
army and serving in Special Forces
army and serving in Special Forces regiments now when I tell people this
regiments now when I tell people this
regiments now when I tell people this they’d have images again perhaps a
they’d have images again perhaps a
they’d have images again perhaps a little misleading they’d see things like
little misleading they’d see things like
little misleading they’d see things like this in their head sexy Brad Pitt
this in their head sexy Brad Pitt
this in their head sexy Brad Pitt jumping out of helicopters um I didn’t
jumping out of helicopters um I didn’t
jumping out of helicopters um I didn’t do that I did things more like this and
do that I did things more like this and
do that I did things more like this and now I’m not talking about the very
now I’m not talking about the very
now I’m not talking about the very good-looking man holding the radio
good-looking man holding the radio
good-looking man holding the radio handset I’m talking about the short
handset I’m talking about the short
handset I’m talking about the short dumpy man who you can’t see carrying the
dumpy man who you can’t see carrying the
dumpy man who you can’t see carrying the radio when he’s back I did a little bit
radio when he’s back I did a little bit
radio when he’s back I did a little bit of that I did a lot of looking at
of that I did a lot of looking at
of that I did a lot of looking at computer networks staring at satellite
computer networks staring at satellite
computer networks staring at satellite networks and otherwise looking at the
networks and otherwise looking at the
networks and otherwise looking at the ones and zeros run around and run run
ones and zeros run around and run run
ones and zeros run around and run run around running around the ether lots of
around running around the ether lots of
around running around the ether lots of lots of diagrams like that very boring
lots of diagrams like that very boring
lots of diagrams like that very boring stuff I spent pretty much all my adult
stuff I spent pretty much all my adult
stuff I spent pretty much all my adult life using technology to make sure that
life using technology to make sure that
life using technology to make sure that people could communicate but I guess
people could communicate but I guess
people could communicate but I guess being in the army I also spent a lot of
being in the army I also spent a lot of
being in the army I also spent a lot of my adult life making sure or using
my adult life making sure or using
my adult life making sure or using technology to make sure that other
technology to make sure that other
technology to make sure that other people couldn’t communicate and so
people couldn’t communicate and so
people couldn’t communicate and so whilst it’s not the sexy Hollywood image
whilst it’s not the sexy Hollywood image
whilst it’s not the sexy Hollywood image of what Special Operations does I think
of what Special Operations does I think
of what Special Operations does I think it’s what lends me the credibility to
it’s what lends me the credibility to
it’s what lends me the credibility to stand up in front of this afternoon and
stand up in front of this afternoon and
stand up in front of this afternoon and talk about what constitutes the modern
talk about what constitutes the modern
talk about what constitutes the modern cyber threat but before we do I just
cyber threat but before we do I just
cyber threat but before we do I just want to tell a little story a little
want to tell a little story a little
want to tell a little story a little history lesson
history lesson
history lesson it’s 1960 a gentleman named Colonel John
it’s 1960 a gentleman named Colonel John
it’s 1960 a gentleman named Colonel John Boyd a veteran US Air Force fighter
Boyd a veteran US Air Force fighter
Boyd a veteran US Air Force fighter pilot who served in the Korean War
pilot who served in the Korean War
pilot who served in the Korean War was working on a program in the Pentagon
was working on a program in the Pentagon
was working on a program in the Pentagon to develop a new fighter jet and he
to develop a new fighter jet and he
to develop a new fighter jet and he developed a theory of aircraft
developed a theory of aircraft
developed a theory of aircraft maneuverability called the energy
maneuverability called the energy
maneuverability called the energy manoeuvrability theory now I’m about as
manoeuvrability theory now I’m about as
manoeuvrability theory now I’m about as far from an aeronautical engineer as you
far from an aeronautical engineer as you
far from an aeronautical engineer as you can get so I’m going to be very high
can get so I’m going to be very high
can get so I’m going to be very high level on this and Colonel John Boyd
level on this and Colonel John Boyd
level on this and Colonel John Boyd forgive me
forgive me
forgive me the theory postulated that the thrust to
the theory postulated that the thrust to
the theory postulated that the thrust to weight ratio and the wing orientation of
weight ratio and the wing orientation of
weight ratio and the wing orientation of a fighter jet was what lent it it’s is
a fighter jet was what lent it it’s is
a fighter jet was what lent it it’s is what gave it an advantage in air combat
what gave it an advantage in air combat
what gave it an advantage in air combat maneuvers not necessarily its speed or
maneuvers not necessarily its speed or
maneuvers not necessarily its speed or its ability to dive I’ll leave that
its ability to dive I’ll leave that
its ability to dive I’ll leave that there anyway as he developed this theory
there anyway as he developed this theory
there anyway as he developed this theory and thrown a lot of numbers through a
and thrown a lot of numbers through a
and thrown a lot of numbers through a lot of very big computers sitting under
lot of very big computers sitting under
lot of very big computers sitting under the Pentagon he was saying yes this is
the Pentagon he was saying yes this is
the Pentagon he was saying yes this is exactly what’s diskant this is this is
exactly what’s diskant this is this is
exactly what’s diskant this is this is what describes the air superiority this
what describes the air superiority this
what describes the air superiority this is what describes a better fighter jet
is what describes a better fighter jet
is what describes a better fighter jet as he applied this theory to his combat
as he applied this theory to his combat
as he applied this theory to his combat experience from the Korean War
experience from the Korean War
experience from the Korean War he flew f-86 sabres he couldn’t really
he flew f-86 sabres he couldn’t really
he flew f-86 sabres he couldn’t really understand the dot what the data of his
understand the dot what the data of his
understand the dot what the data of his theory and then what the results and
theory and then what the results and
theory and then what the results and kill ratio between the American aircraft
kill ratio between the American aircraft
kill ratio between the American aircraft and the North Korean Soviet and Chinese
and the North Korean Soviet and Chinese
and the North Korean Soviet and Chinese aircraft was telling him the American
aircraft was telling him the American
aircraft was telling him the American aircraft significantly outperformed or
aircraft significantly outperformed or
aircraft significantly outperformed or the Americans significantly outperformed
the Americans significantly outperformed
the Americans significantly outperformed their communist counterparts the f-86
their communist counterparts the f-86
their communist counterparts the f-86 and previous iterations of American
and previous iterations of American
and previous iterations of American aircraft shot down a lot more Mickey
aircraft shot down a lot more Mickey
aircraft shot down a lot more Mickey fifteens
fifteens
fifteens now according to Boyd’s e/m theory this
now according to Boyd’s e/m theory this
now according to Boyd’s e/m theory this shouldn’t make sense the MIG was in fact
shouldn’t make sense the MIG was in fact
shouldn’t make sense the MIG was in fact faster it was seeking weakening more
faster it was seeking weakening more
faster it was seeking weakening more maneuverable its wing orientation was
maneuverable its wing orientation was
maneuverable its wing orientation was superior to previous iterations the
superior to previous iterations the
superior to previous iterations the Sabre had by this stage of the war
Sabre had by this stage of the war
Sabre had by this stage of the war caught up with the mixed design but the
caught up with the mixed design but the
caught up with the mixed design but the numbers were skewed he didn’t understand
numbers were skewed he didn’t understand
numbers were skewed he didn’t understand why was this and it wasn’t until he was
why was this and it wasn’t until he was
why was this and it wasn’t until he was looking at a picture but possibly not
looking at a picture but possibly not
looking at a picture but possibly not dissimilar to what I’ve got behind me
dissimilar to what I’ve got behind me
dissimilar to what I’ve got behind me and what you’re looking at and he
and what you’re looking at and he
and what you’re looking at and he noticed something really imperceptible a
noticed something really imperceptible a
noticed something really imperceptible a detail that would otherwise be missed
detail that would otherwise be missed
detail that would otherwise be missed and if you can see it it’s at the rear
and if you can see it it’s at the rear
and if you can see it it’s at the rear of the canopy of the meet 15 is slightly
of the canopy of the meet 15 is slightly
of the canopy of the meet 15 is slightly more armoured and then the perspex of
more armoured and then the perspex of
more armoured and then the perspex of the canopy itself was ever so slightly
the canopy itself was ever so slightly
the canopy itself was ever so slightly thicker the designers of the MEK had
thicker the designers of the MEK had
thicker the designers of the MEK had opted for higher protection and a high
opted for higher protection and a high
opted for higher protection and a high degree of safety for the pilot this was
degree of safety for the pilot this was
degree of safety for the pilot this was easier Rico moment John Boyd knew as a
easier Rico moment John Boyd knew as a
easier Rico moment John Boyd knew as a fighter pilot fighter pilot himself the
fighter pilot fighter pilot himself the
fighter pilot fighter pilot himself the prices he went through during air combat
prices he went through during air combat
prices he went through during air combat maneuvers
maneuvers
maneuvers and the advantage that 300 180 270
and the advantage that 300 180 270
and the advantage that 300 180 270 degrees of visibility provided him and
degrees of visibility provided him and
degrees of visibility provided him and that imperceptibly small piece of armor
that imperceptibly small piece of armor
that imperceptibly small piece of armor to his rear during a combat maneuvers as
to his rear during a combat maneuvers as
to his rear during a combat maneuvers as you’re flipping planes over and looking
you’re flipping planes over and looking
you’re flipping planes over and looking all around you was significant and at
all around you was significant and at
all around you was significant and at that point he realized there’s two
that point he realized there’s two
that point he realized there’s two factors yes it’s the aircraft but it’s
factors yes it’s the aircraft but it’s
factors yes it’s the aircraft but it’s also the speed at which you make
also the speed at which you make
also the speed at which you make decisions particularly in an adversarial
decisions particularly in an adversarial
decisions particularly in an adversarial contest and particularly in a contest
contest and particularly in a contest
contest and particularly in a contest done at significant speed that affords
done at significant speed that affords
done at significant speed that affords you victory he developed a second theory
you victory he developed a second theory
you victory he developed a second theory clever fella he developed a theory
clever fella he developed a theory
clever fella he developed a theory called the OODA loop and that is
called the OODA loop and that is
called the OODA loop and that is observation orientation decision and
observation orientation decision and
observation orientation decision and action
action
action and he postulated that all intelligent
and he postulated that all intelligent
and he postulated that all intelligent beings go through this loop as we make
beings go through this loop as we make
beings go through this loop as we make decisions as we react to the world
decisions as we react to the world
decisions as we react to the world around us and as we choose to engage
around us and as we choose to engage
around us and as we choose to engage with the problem in front of us he said
with the problem in front of us he said
with the problem in front of us he said it’s true of individuals and he says
it’s true of individuals and he says
it’s true of individuals and he says it’s true of organizations as well but
it’s true of organizations as well but
it’s true of organizations as well but what does that have to do in a modern
what does that have to do in a modern
what does that have to do in a modern cyber problem what does human decision
cyber problem what does human decision
cyber problem what does human decision cycles have to do with being hacked
cycles have to do with being hacked
cycles have to do with being hacked remember at the start I said that it’s
remember at the start I said that it’s
remember at the start I said that it’s not the technique the focus is on
not the technique the focus is on
not the technique the focus is on technology and I believe this to be a
technology and I believe this to be a
technology and I believe this to be a little misleading it’s misleading
little misleading it’s misleading
little misleading it’s misleading because cyber threats are human
because cyber threats are human
because cyber threats are human it’s not the ones and zeros that attack
it’s not the ones and zeros that attack
it’s not the ones and zeros that attack you it’s not a piece of malware that
you it’s not a piece of malware that
you it’s not a piece of malware that sits on your laptop and it’s not the
sits on your laptop and it’s not the
sits on your laptop and it’s not the phishing email somewhere someone has
phishing email somewhere someone has
phishing email somewhere someone has made a decision to use technology to
made a decision to use technology to
made a decision to use technology to attack you to take something from you to
attack you to take something from you to
attack you to take something from you to take malicious action using technology
take malicious action using technology
take malicious action using technology using process and act against you that
using process and act against you that
using process and act against you that could be a confronting thought certainly
could be a confronting thought certainly
could be a confronting thought certainly is for me and I’ve spent a long time in
is for me and I’ve spent a long time in
is for me and I’ve spent a long time in the army a long time in the military
the army a long time in the military
the army a long time in the military knowing that I have an enemy somewhere
knowing that I have an enemy somewhere
knowing that I have an enemy somewhere so for those of us in everyday life the
so for those of us in everyday life the
so for those of us in everyday life the thought that somewhere someone is trying
thought that somewhere someone is trying
thought that somewhere someone is trying to act against us I agree it can be
to act against us I agree it can be
to act against us I agree it can be confronting but as we step into not to
confronting but as we step into not to
confronting but as we step into not to step into as we now live in a digital
step into as we now live in a digital
step into as we now live in a digital age and everything we do is increasingly
age and everything we do is increasingly
age and everything we do is increasingly leveraged and reliant upon technology I
leveraged and reliant upon technology I
leveraged and reliant upon technology I think it’s interesting to note and
think it’s interesting to note and
think it’s interesting to note and important to note that for every
important to note that for every
important to note that for every advantage technology brings us there’s a
advantage technology brings us there’s a
advantage technology brings us there’s a darker side to it and that someone can
darker side to it and that someone can
darker side to it and that someone can use this technology
use this technology
use this technology to act against us so because the cyber
to act against us so because the cyber
to act against us so because the cyber threat is human it’s complex and it’s
threat is human it’s complex and it’s
threat is human it’s complex and it’s adaptive it’s complex because it
adaptive it’s complex because it
adaptive it’s complex because it leverages technology and it’s adaptive
leverages technology and it’s adaptive
leverages technology and it’s adaptive because it’s human it has its own
because it’s human it has its own
because it’s human it has its own decision cycle so at the start of every
decision cycle so at the start of every
decision cycle so at the start of every cyberattack there has been a human who
cyberattack there has been a human who
cyberattack there has been a human who has gone through their own odor loop and
has gone through their own odor loop and
has gone through their own odor loop and their action is to attack you now being
their action is to attack you now being
their action is to attack you now being coming from the military we’ve had a bit
coming from the military we’ve had a bit
coming from the military we’ve had a bit of experience now I’ve had experience in
of experience now I’ve had experience in
of experience now I’ve had experience in engaging with a complex and adaptive
engaging with a complex and adaptive
engaging with a complex and adaptive enemy spent a little bit of my life in
enemy spent a little bit of my life in
enemy spent a little bit of my life in Afghanistan probably too long and the
Afghanistan probably too long and the
Afghanistan probably too long and the enemy we fought over there was complex
enemy we fought over there was complex
enemy we fought over there was complex and adaptive and we learned some very
and adaptive and we learned some very
and adaptive and we learned some very tough lessons but we learned some quick
tough lessons but we learned some quick
tough lessons but we learned some quick lessons about how to deal with this and
lessons about how to deal with this and
lessons about how to deal with this and it was about defeating their Ruta loop
it was about defeating their Ruta loop
it was about defeating their Ruta loop getting inside the enemy’s OODA loop
getting inside the enemy’s OODA loop
getting inside the enemy’s OODA loop because at the moment I think in the
because at the moment I think in the
because at the moment I think in the world today we are all very much in
world today we are all very much in
world today we are all very much in sorry the the adversary the cyber threat
sorry the the adversary the cyber threat
sorry the the adversary the cyber threat is inside our odor loop they’re able to
is inside our odor loop they’re able to
is inside our odor loop they’re able to observe orient decide and act against us
observe orient decide and act against us
observe orient decide and act against us with a lot more speed than we are and
with a lot more speed than we are and
with a lot more speed than we are and certainly Afghanistan it led us to
certainly Afghanistan it led us to
certainly Afghanistan it led us to changing our methodology of operations
changing our methodology of operations
changing our methodology of operations we moved to intelligence-led operations
we moved to intelligence-led operations
we moved to intelligence-led operations rather than coming up with a plan
rather than coming up with a plan
rather than coming up with a plan allocating resources and monolithically
allocating resources and monolithically
allocating resources and monolithically following that plan and this was a not
following that plan and this was a not
following that plan and this was a not quite a revolution but certainly an
quite a revolution but certainly an
quite a revolution but certainly an evolution in in the way we conducted our
evolution in in the way we conducted our
evolution in in the way we conducted our business and really all that meant was
business and really all that meant was
business and really all that meant was we need to speed up our decision-making
we need to speed up our decision-making
we need to speed up our decision-making we need our decision cycle to be faster
we need our decision cycle to be faster
we need our decision cycle to be faster than the enemy’s we need to be able to
than the enemy’s we need to be able to
than the enemy’s we need to be able to disrupt his decision cycle I think we’ve
disrupt his decision cycle I think we’ve
disrupt his decision cycle I think we’ve all been in situations where bid Nova
all been in situations where bid Nova
all been in situations where bid Nova serial contact context or otherwise
serial contact context or otherwise
serial contact context or otherwise where we feel reactive we feel like
where we feel reactive we feel like
where we feel reactive we feel like we’re on the back foot we feel like
we’re on the back foot we feel like
we’re on the back foot we feel like decisions are being made around us and
decisions are being made around us and
decisions are being made around us and we can only react to it our opponents
we can only react to it our opponents
we can only react to it our opponents OODA loop is faster than ours and I
OODA loop is faster than ours and I
OODA loop is faster than ours and I think we’ve been in situations where we
think we’ve been in situations where we
think we’ve been in situations where we feel around the front foot we’re making
feel around the front foot we’re making
feel around the front foot we’re making decisions faster than the adversary and
decisions faster than the adversary and
decisions faster than the adversary and this in this is the crux of Boyd’s
this in this is the crux of Boyd’s
this in this is the crux of Boyd’s theory is those able to observe orient
theory is those able to observe orient
theory is those able to observe orient decide and act faster than the other or
decide and act faster than the other or
decide and act faster than the other or win the engagement I know you’re
win the engagement I know you’re
win the engagement I know you’re thinking spin what does this have to do
thinking spin what does this have to do
thinking spin what does this have to do with with me
with with me
with with me what does I have to do with my place in
what does I have to do with my place in
what does I have to do with my place in the world and how I engage with
the world and how I engage with
the world and how I engage with technology
technology
technology well I’d like to offer I guess a little
well I’d like to offer I guess a little
well I’d like to offer I guess a little vignette a little analogy of how I think
vignette a little analogy of how I think
vignette a little analogy of how I think we can all disrupt the adversaries Oh de
we can all disrupt the adversaries Oh de
we can all disrupt the adversaries Oh de loop I’d like to think about passwords
now hopefully those people had actually
now hopefully those people had actually logged into our little are a little
logged into our little are a little
logged into our little are a little trick this morning didn’t actually enter
trick this morning didn’t actually enter
trick this morning didn’t actually enter your real password that you’ve used
your real password that you’ve used
your real password that you’ve used elsewhere but I’ll tell you what some
elsewhere but I’ll tell you what some
elsewhere but I’ll tell you what some people probably did you know what you
people probably did you know what you
people probably did you know what you see on they up the board behind me is
see on they up the board behind me is
see on they up the board behind me is examples of bad passwords now we know a
examples of bad passwords now we know a
examples of bad passwords now we know a lot about passwords these days because
lot about passwords these days because
lot about passwords these days because every major breach that occurs every
every major breach that occurs every
every major breach that occurs every huge dump of credentials on the Internet
huge dump of credentials on the Internet
huge dump of credentials on the Internet is available for researchers such as us
is available for researchers such as us
is available for researchers such as us and also bad card researchers we now
and also bad card researchers we now
and also bad card researchers we now know a lot about how humans construct
know a lot about how humans construct
know a lot about how humans construct passwords when you use bad passwords
passwords when you use bad passwords
passwords when you use bad passwords like this you leave yourself vulnerable
like this you leave yourself vulnerable
like this you leave yourself vulnerable why is that you say spen but there’s
why is that you say spen but there’s
why is that you say spen but there’s clever people who write clever
clever people who write clever
clever people who write clever technology and clever mathematicians who
technology and clever mathematicians who
technology and clever mathematicians who encrypt my password and that’s true
encrypt my password and that’s true
encrypt my password and that’s true typically as you enter a password into
typically as you enter a password into
typically as you enter a password into any legitimate site it goes through
any legitimate site it goes through
any legitimate site it goes through what’s called a hash algorithm and that
what’s called a hash algorithm and that
what’s called a hash algorithm and that means the string of text or numbers that
means the string of text or numbers that
means the string of text or numbers that you’ve put in results in an enormous
you’ve put in results in an enormous
you’ve put in results in an enormous string that’s completely reversible so
string that’s completely reversible so
string that’s completely reversible so you can’t actually reverse engineer that
you can’t actually reverse engineer that
you can’t actually reverse engineer that hash back into the password you entered
hash back into the password you entered
hash back into the password you entered but because we know so much about the
but because we know so much about the
but because we know so much about the way humans construct passwords because
way humans construct passwords because
way humans construct passwords because we have because we and the adversary has
we have because we and the adversary has
we have because we and the adversary has advantage to high compute we can
advantage to high compute we can
advantage to high compute we can somewhat cheat that process we can use
somewhat cheat that process we can use
somewhat cheat that process we can use our knowledge of the way humans
our knowledge of the way humans
our knowledge of the way humans construct passwords to defeat that hash
construct passwords to defeat that hash
construct passwords to defeat that hash and essentially recreate it and
and essentially recreate it and
and essentially recreate it and therefore learn the passwords because
therefore learn the passwords because
therefore learn the passwords because they’re so simple so when you all use
they’re so simple so when you all use
they’re so simple so when you all use passwords in the internet if you use
passwords in the internet if you use
passwords in the internet if you use passwords of their short if you use
passwords of their short if you use
passwords of their short if you use passwords that are not random and if you
passwords that are not random and if you
passwords that are not random and if you use passwords that are not complex
use passwords that are not complex
use passwords that are not complex you’re giving the adversary the
you’re giving the adversary the
you’re giving the adversary the advantage you’re speeding up his
advantage you’re speeding up his
advantage you’re speeding up his decision cycle by being lazy his ability
decision cycle by being lazy his ability
decision cycle by being lazy his ability to observe simple password use or in
to observe simple password use or in
to observe simple password use or in himself to your situation in your
himself to your situation in your
himself to your situation in your context make a decision to act against
context make a decision to act against
context make a decision to act against that password and then actually enact
that password and then actually enact
that password and then actually enact that cracking or enact that guessing
that cracking or enact that guessing
that cracking or enact that guessing process it is made very simply
process it is made very simply
process it is made very simply this is what I’d like to leave you with
this is what I’d like to leave you with
this is what I’d like to leave you with today that the pervasiveness of
today that the pervasiveness of
today that the pervasiveness of technology today tomorrow and the day
technology today tomorrow and the day
technology today tomorrow and the day after that means that we all have a role
after that means that we all have a role
after that means that we all have a role to play in disrupting the modern cyber
to play in disrupting the modern cyber
to play in disrupting the modern cyber threat the modern cyber problem and it
threat the modern cyber problem and it
threat the modern cyber problem and it could be as simple as using long complex
could be as simple as using long complex
could be as simple as using long complex and random passwords thank you very much
and random passwords thank you very much
and random passwords thank you very much [Applause]
”
Be First to Comment