I just gave a little talk to my team about breaches, passwords and things that go “Boom!” like, oh, nuclear power plants.  Because apparently the US DOE (Department of Energy) keeps. Getting. Hacked.  An investigation over 4 years showed that there were 1131 attacks, 159 compromises and of those 53 were at root level (meaning you really got pwned).  Since glow-in-the dark isn’t my best look, I’m a little concerned about keeping those plants safe. If the guys looking after critical infrastructure aren’t getting it right, then we all need to paying more attention to what we do with our passwords.

Bottom Line: Passwords are your first line of defence. Done right, they are an effective deterrent and the attackers move on. Done badly, you’ve just handed over the keys to your digital kingdom. I don’t have to remind you about the password file named “Passwords” from the Sony Hack.  Or the sorry excuses for passwords (no – not actual excuses) emerging from the Ashley Madison dump. I highly recommend the helpful and direct guidance freely given by Jessy Irwin, the owner of the sign bunny to the right …

If you want to do this right – and believe me you do – then you’re going to need to put some effort and commitment into it.  Every organization, every business, needs to have a password policy in place, and not one that they just pay lip service to or to serve as a manufacturing site for replacements. There must be guidelines issued to end users, and a policy that is both monitored and enforced.  It’s not like Halloween, where you hand them out freely.

I present to you my 10 Commandments of Good Passwords. And like Pharaoh Yul Brynner said “So let it be written, so let it be done!”

One of the coolest things I got to learn about this past August at Hacker Summer Camp was this: How to Hack a Mainframe.  That’s just crazy, right?  Isn’t everything Windows and Unix and OS X?  Who uses mainframes? Ahh – well that’s where things get interesting.

E.V.E.R.Y.B.O.D.Y.

The talks were served up like a one-two punch. The first was “The Internet of Mainframes”, given by Phil Young, aka Soldier of Fortran, at the Underground track at BSidesLV.  That carried over and was expanded on at DefCon by Phil and Chad Rikansrud, aka Bigendian Smalls, in their joint talk “Security Necromancy – Further Adventures in Mainframe Hacking”.  Both of these guys work with major financial institutions and their job is protecting all that money.  So they really, really, know their stuff when it comes to the mainframe world. They also just happen to be hackers. Having cut my tech teeth in a mainframe shop I can tell you it is a world unto itself, pretty much sequestered from the fun and games on the internet. Or so you would think. But hackers like to ask “what if” and “how do I”.  And that’s where our story begins. Cue Slideshow!

This past week I had my best adventure yet. I went to Hacker Summer Camp. Yes, that’s right!  Imagine – tens of thousands of attendees at the single biggest week for Information Security professionals as three major conferences converge on the city of Las Vegas. Hackers were everywhere in Sin City. That does seem rather apropos. Some attended all three conferences: Black Hat, DefCon and BSidesLV.  Given that this was on my time and my dime, I couldn’t swing the higher rates of Black Hat, however I was able to do BSidesLV and DefCon.  There is always plenty of press about the two larger conferences, Black Hat and DefCon.  But I want to tell you about BSidesLV, the “little” conference that could… change the world.

BSides are a much-loved series of community-driven security events, and run by volunteers.  They are accessible, affordable and are not about selling stuff but rather about generating ideas and relationships. My first experience with BSidesLV has been truly rewarding, both as a speaker in their Proving Grounds track, and as a volunteer.  Proving Grounds is an incredible opportunity for inexperienced or first time speakers to be mentored by someone experienced, and help them get to the conference. That’s a huge deal when you’re just starting out. My mentor was fun to work with, very supportive, and steered me clear of pitfalls as we worked on my presentation. This was a major commitment on his part, as we teleconferenced every two weeks from May thru July, and I reaped all the rewards. When I stepped up to the podium, I was more excited than nervous to give the talk I had always wanted to deliver. Now, I can’t wait to do another talk. And I watched my fellow novice speakers deliver their talks with confidence and skill, setting them on course to go do more.

(Image from Tripwire as they covered talk by @GRC_Ninja)

Volunteering with BSidesLV has turned out to be a gift I gave myself, because it was an opportunity to become part of the community and to give back. What I’ve discovered is that so many members are willing to give freely of their time and talent to make this conference available to all who want to attend. There are no entrance fees. Just opportunities to learn, grow and connect. To say I feel privileged just to be here would be an understatement. Being part of a community like this when you are just starting out encourages new ideas and creative approaches, without which security cannot meet the constant evolution of threats.  BSides is all about learning as a community, supporting members through informal mentoring, and fostering collaboration from the ground level.  You can see it in the collection of hallway huddles. Or by impromptu conversations that invite passersby and last for hours. Passion fuels innovation. Which perfectly reflects the theme at this year’s BSidesLV: The Next Big Thing.

BSidesLV offers more than just innovative and informed perspectives on security matters.  Yes, there are all the “big” talks happening on hot-button issues, like hacking cars and zero days.  But security grows when those within the community probe and question beyond the obvious, pushing us toward the next “big” thing, so that when it happens, we were already looking for it.  Bigger conference venues aren’t always receptive to security unknowns, whether they be ideas or people.  That’s why organizations like BSides have developed and continue to grow in popularity. They invite new ideas, and welcome uninitiated security enthusiasts (like me) into the fold.

Infact, this year saw a marked increase in attendance, and entry badges were gone early.  I overheard several conversations citing the quality and diversity of the talks at BSidesLV in comparison to some at Blackhat.  It was good to have Tripwire actively covering the talks and sharing them with the community at large, as well as Peerlyst.  This kind of collaboration furthers relationships and opportunities within InfoSec, and acknowledges the genuine passion and hard work of so many talented people here.

BSidesLV has so much to offer as a community within the larger security community, and as a forum that welcomes collaboration and innovation to challenge what we know.  This “little” conference is earning some high praise and recognition among its larger counterparts, and if I were a betting person, I’d lay odds this is where the next “big” things will be discovered.