Thecavalryisus owasp eee-oct2015_v2
- 1. I AM THE CAVALRY http://iamthecavalry.org @iamthecavalry SHOULDN’T YOU BE ALSO?
- 2. CLAUS CRAMON HOUMANN Infosec Community Manager @ Peerlyst (A start-up Infosec community/Social platform that wants to turn the tables on cyber security) Infosec Consultant The Analogies contributor Twitter: @claushoumann
- 3. IDEA “Our dependence on technology is growing faster than our ability to secure it”
- 4. IDEA “Our society has evolved faster than our laws”
- 6. ALL SYSTEMS FAIL* * Yes; all
- 7. WHERE DO WE SEE CONNECTIVITY NOW? In Our Bodies In Our Homes In Our InfrastructureIn Our Cars
- 8. HEARTBLEED + (UNPATCHABLE) INTERNET OF THINGS == ___ ? In Our Bodies In Our Homes In Our InfrastructureIn Our Cars
- 9. SAY BABY MONITORS AGAIN? In Our Homes Source: Rapid7 research/Mark Stanislav: Baby monitors https://www.rapid7.com/docs/Hacking-IoT-A-Case-Study-on-Baby-Monitor-
- 10. THEN
- 11. BUT ALSO
- 12. IT’S SAFETY NOT JUST SECURITY Ouch!
- 13. Cars have computers Computers have security issues Security issues in cars are safety issues Safety issues can cost or imperil lives
- 14. www.iamthecavalry.org @iamthecavalry Past versus Future Bolt-On Vs Built-In
- 15. SOMEONE WILL FIX IT FOR US Chapter 2
- 19. A DO-OCRACY OF DO’ERS. W H ER E D OIN G STARTS W ITH EMPATHY And by ripples I mean
- 23. The Point?
- 24. NEVER DOUBT THAT A SMALL GROUP OF THOUGHTFUL, COMMITTED CITIZENS CAN CHANGE THE WORLD; IT’S THE ONLY THING THAT EVER HAS. - MAR GAR ET MEAD ( A N A M E R I C A N C U LT U R A L A N T H R O P O L O G I S T )
- 25. •The The Cavalry isn’t coming… It falls to us Problem Statement Our society is adopting connected technology faster than we are able to secure it. Mission Statement To ensure connected technologies with the potential to impact public safety and human life are worthy of our trust. Collecting existing research, researchers, and resources Connecting researchers with each other, industry, media, policy, and legal Collaborating across a broad range of backgrounds, interests, and skillsets Catalyzing positive action sooner than it would have happened on its own Why Trust, public safety, human life How Education, outreach, research Who Infosec research community Who Global, grass roots initiative WhatLong-term vision for cyber safety Medical Automotive Connected Home Public Infrastructure I Am The Cavalry
- 26. Connections and Ongoing Collaborations 5-Star Framework 5-Star Capabilities Safety by Design – Anticipate failure and plan mitigation Third-Party Collaboration – Engage willing allies Evidence Capture – Observe and learn from failure Security Updates – Respond quickly to issues discovered Segmentation & Isolation – Prevent cascading failure Addressing Automotive Cyber Systems Automotive Engineers Security Researchers Policy Makers Insurance Analysts Accident Investigators Standards Organizations https://www.iamthecavalry.org/auto/5star/
- 27. www.iamthecavalry.org @iamthecavalry 5-Star Cyber Safety Formal Capacities 1. Safety By Design 2. Third Party Collaboration 3. Evidence Capture 4. Security Updates 5. Segmentation and Isolation Plain Speak 1. Avoid Failure 2. Engage Allies To Avoid Failure 3. Learn From Failure 4. Respond to Failure 5. Isolate Failure
- 28. 5 STARS 5 star ICS 5 star IoT 5 star medical devices
- 29. www.iamthecavalry.org @iamthecavalry And! • Dräger on board with I am the Cavalry as first medical device producer working directly in sync with us • Their Product Security Manager is even directly involved now
- 30. AND MORE IN OTHER AREAS COMING We try to connect researchers to 1. Lawmakers to inform of meaningful changes to laws to enforce secure by default 2. Vendors/producers to inform of secure ways to build securely by design and of identified vulnerabilities 3. Purchasers of devices (example: Pacemakers, car distributors) to explain to them why they need to contractually demand security – if there is demand vendors will supply
- 31. AND YES I DID SAY LAWMAKERS It is WEIRD for you to have to listen to. I agree, but
- 32. WHAT YOU CAN DO Chapter 5
- 33. CONNECTIONS/CONNECTORS WANTED Breakers and Builders Legal and Policy Citizens, Connectors Parents/Guardians Community Leaders/Bloggers/Podcasters/etc.
- 34. MOUNT UP AND BE THE CAVALRY YOU DON’T ACTUALY NEED A HORSE
- 36. -> OWASK SKF -> OWASP SECURITY SHEPHERD -> OWASP ZAP Recommendations: Use SDLC