hype hangover to happy hacking hango… · + debunked myth of no remote attack surface + software...
TRANSCRIPT
Hype Hangover to Happy Hacking
Beau Woods@beauwoods
November 19, 2015Bucharest, Romania
http://www.wired.com/2015/07/hackers-remotely-kill-jeep-highway/
http://www.wired.com/2015/07/hackers-remotely-kill-jeep-highway/
Effects+ Solidtechnicaldemonstration+ Debunkedmythofnoremoteattacksurface+ Softwarepatchavailable;recallincreasedadoptionrate+ Carrierblockreducedexposure- Vastmajorityofaffectedvehiclesstillvulnerable- Stereotypeofsecurityresearchersas“reckless”- Disruptedpositiveoutreachbyautomakers,inmotion- Deployedantibodiestofutureresearch(ers)- Consumerconfidenceshaken,affectingGDPandjobs
http://qz.com/470505/us-officials-warn-that-medical-devices-are-vulnerable-to-hackers/
Effects+ Solidtechnicaldemonstration+ Flaweddeviceremovedfromthemarketatsafepace+ Encouragedpositiveoutreachbystakeholders+ Reinforcespublicconfidenceinhealthcaresystem+ Forgedalliancesandpathwaystostreamlinefutureactions+ Legitimizedotherresearchersandtheirwork+ Clearbenefitofsecurityresearchersintheecosystem- Devicesstillinusewheresafertreatmentsaren’tavailable
http://qz.com/470505/us-officials-warn-that-medical-devices-are-vulnerable-to-hackers/
HypeHangoverCycle•Discovery ofapotentialissueinaconnecteddevice.•Disclosuretriggersremediationandattention.•Hype spreadsatthespeedofPRandopportunists.•Confusion overtakesfactsandtruthgetstangled.•Reaction isinstinctiveandoftenmisinformed.•Correction formsaroundoneormorereactions.•Return totrustwithfalsesenseofsecurity.…whichleadstoDiscovery ofmoreflaws
Aftermath
Criminalizeorimpederesearch
Drainfinancialandotherresources
Trustunreliabledependencies
Autonomy:Self-directedconfidence
Mastery:Goodandgettingbetter
Purpose:Foragreatergood
Medical Automotive ConnectedHome
PublicInfrastructure
Ourdependenceonconnectedtechnology isincreasingfasterthanourabilitytosecureit.
We’veneverbeenmoreneeded,andneverfeltlessready!
The CavalryWhen is
Coming
The CavalryIsn’t Coming
The CavalryI AmIt falls to us.
Why Trust,publicsafety,humanlifeHow Education,outreach,researchWho WillingalliesacrossstakeholdersWho Global,grassrootsinitiativeWhat Long-termvisionforcybersafety
I Am The Cavalry
EmpathyTreatothersasassetsandallies,ratherthanadversaries
Outreach
Outreach
JointheTeamTakeadvantagewhereyourdayjoboverlapswithpublicsafetyandhumanlifeissues
Takeajobinanaffectedindustry
EducationLearnandpracticeCommunicationsMediaPublicPolicyIndustryprimers
ResearchPrioritiesConferencePresentations
HumanLife
IntellectualProperty PII PHI PCI
MobileMalware
HigherConsequence LowerConsequence
*Consider theimpact,nottheplatform.
Makingadifference•Empathy•Outreach• JointheTeam•Education•ResearchPriorities
Hype Hangover to Happy Hacking
Beau Woods@beauwoods
November 19, 2015Bucharest, Romania