As always, just a full on day and my brain is a little fried. The talks were good, the vibe was good, and the jokes were good.
A few thought provoking ones, Peter Gutemann's "The Cost of Stunt Cryptography" had morphed into the cost of vanity CVEs. This is a topic close to my heart since I've been in semi constant arguments about tools like dependabot and the security theatre involved in the "we must immediately patch these vulnerabilities with no exploitation path in your environment". Reading the experience of the curl project devs with this side of things had really already crystalised a lot of these thoughts for me. But so good to see Gutemann putting some actual numbers on the cost and highlighting things like the cost of FIPS recertifiaction.
One of his preferred solution of adding a "vanity" severity to CVEs to both record they don't need action and provide a little bit of pushback on it does rather appeal to me.
Kind of a nice parallel with Jess Lowe's talk on the problems with low quality data in CVES causing problems for ingestion into these kinds of automated vunerability tools anyway. Really highlighting that the voice of people consuming CVE data isn't really represented, so the incentives of everyone involved is just to raise more CVEs, ratchet up the severity, don't worry about the data quality. Perhaps a leason from Izzy's talk (more on that later) "Slow is smooth, smooth is fast".
Probably the most thought provoking for me though really was "Inside NZ's Digital Identity Stack" from Nick von Dadeleszen. I really wasn't expecting to enjoy this one from the description, but really changed my perspective a bit. I've been pretty against the digital license proposal assuming it was just a cover for a mega identity database. But the talk highlighted:
The actual problem with the current state of affairs they're trying to solve: That for a lot of places you provide your license or your passport (buying booze, renting a car, checking into a hotel) they take a full copy of everything, but they don't need everything. This creates it's own abuses like pubs posting people's licenses of on facebook (yes really). So we want to limit the data shared to what's actully required for the user.
The proposal isn't creating new databases, or really using the ones that exist. There is already a database of passports, of licenses, that exists today, it's not being used or changed for this. Rather it really is kind of the digital equivalent of a paper license. Using cryptography to allow it to be trusted, but all the data actually on your phone, just like it is in your wallet today.
That some of the privacy protections are actually enshrined in law by the enabling legislation. E.g. it will be illegal to have it phone home each time, which significantly prevents digital ID being used for tracking.
Also recognising the risks and the possible abuses that haven't been fully addressed is a really good start to building trust.
Then there were the talks I always enjoy of learning from the past to draw lessons for what we do these days. Izzy's "A SecOps manager, an epidemiologist and a bacterium walk into a bar" talking about the famous cholera epidemic around the Broad St Pump and John Snow the father of modern epidemiology and what we can learn from that for where we are today. This is one I need to watch again, but a lot of the key points are:
Question the consensus, if everyone is agreeing straight away, have you actually asked the questions you need to, do you have all the right perspectives in the room?
Question if you've found the actual cause or just the most obvious thing, we so often jump to conclusions based on the perspective we're starting with
Test your assumptions, don't just ignore the examples that don't fit the pattern you expect, chase them down, do they prove or contradict your theory?
What's the question I really don't want to be asked? Someone is going to ask it eventually so ask it yourself, when you're with friends, because it will surface what you need to be able to awnser.
Make sure what your communicating as a result can be understood outside the team, can still do the job when you're not in the room.
John Snow died before germ theory was accepted, but because of the maps he'd prepared, after his death, when there was another epidemic people picked up the torch of how it was spreading and lives were saved.
The big one, sometimes you need to slow down to get to the actual end faster. There is a special forces training motto "Slow is smooth, smooth is fast". Or the traditional Festina Lente that I remember Dad drilling into me as a teen.
D. Roc and Smiling Dragon talking about what to do for incident response in "How to have a successful failure" using as a base the explosion of the Piper Alpha oil platform in 1988. Very sobering as an example, but it really drives home the lessons. We may be working with less stakes, but the principles apply. Keeping logs of decisions for the RCA, but also to reassure yourself when you wake at 3AM relitigating the decisions. Make decisions to keep options open, because once you've close an option it's closed. Making sure you have clear control structures in place; The one person who people know is communicating the decisions. And call in help early, the example is that the Privacy Commission would much rather be called early when there might be a data breach and investigation is early than 1 hour before the 72 hour legal requirement.
The other thing that really stuck with me about this one was the focus on looking after the team. The stress and guilt of a serious incident can take a hidden toll. The importance of a blameless culture and recovery is not just that people don't hide incidents, that guilt can gnaw at people and destroy lives, so the "break production, buy a beer" can work for small things as team building, but if there's a major incident you don't play those games, you do not blame, it is not someones fault. You only talk about someone's involvement in an incident as praise for identifying the weakness, for responding quickly, for addressing it.
There was the usual slate of ones that were interesting dives, just seeing how people work and what they can discover which I enjoyed. But probably the one that really made me laugh was Zell Marcovivvi accidentally creating a Neopets Crime Ring, I mean, every step to get there was entirely reasonable and sensible in isolation, and who amongst us hasn't just stepped back one day and realised we've created a crime ring without realising it?