Keynote: What Got Us Here Wont Get Us There
summary
Claim: the industry is losing — big breaches (Target, OPM, Sony) happen despite big budgets because fundamentals break: one compromised external vendor or one stolen credential leads to full domain compromise. Evidence: Linux and Chromium each balloon to ~20 million LOC, commodity devices contain processors and writable firmware, a single Python package (simplejson ~18M downloads) depends on one maintainer, and a Java serialization flaw shows third‑party libs bite you. Practical fixes offered include network segmentation, simple PowerShell checks to alert on new domain admins, and deploying Canary-style honeypots and bespoke tooling instead of chasing Big Data or more pentests.
AI-written summary · about
chapters (27)
- 0:00Introduction
- 1:55The Problem
- 7:00Assange and WikiLeaks
- 8:50Complexity
- 12:43Repositories
- 14:05We are in bad shape
- 16:10We dont have a shot
- 19:08Security antipatterns
- 25:12Big data
- 26:47Threat intelligence
- 29:41Realtime learning
- 33:17Cargo cult science
- 34:22Bad habits
- 34:34Dont be like that
- 36:11Bring back the honey pots
- 38:28Rich Smith from Etsy
- 40:37Excuses
- 42:35Disclosure debates
- 43:34Zeroday obsession
- 44:58The Golden Rule
- 46:06Passive Exercise
- 49:03Beyond Cop
- 50:11The Power of Simplicity
- 51:34We Can Relook at Everything
- 52:18Cheap Hacks
- 54:11Building Stuff
- 55:07Summary
related talks
13mKeynote: Hacking the OSS Supply Chain
01h 00mKeynote - Our Kryptonite: A Defendable Internet
18mKeynote
56mKeynote: AppSec: From Outsiders to Allies
41mThe Divine and Felonious Nature of Cyber Security
17mKeynote: Fighting The Next War - Future Threats to OSS and Software Supply Chain...
11mKeynote: Securing Open Source
13mKeynote: Hacking the OSS Supply Chain