SESSION ID: HUM-W09 I Had My Mom Break Into A Prison. Then, We Had Pie. John Strand Owner Black Hills Information Security @strandjs #RSAC #RSAC Goals Look at physical assessments and how they are run today Case study: mothers, pie and cancer Case study: Iowa, courthouses and how not to (most likely) not get arrested How hard is it to break into a "difficult" location? Dealing with customer reactions You can always be sued. Get over it. The need for outreach. Or, this is really all our fault. Presenter’s Company Logo – replace or delete on master slide 2 #RSAC What We Are Doing Today Most testing companies and customers are scared The Iowa situation: An informative and very abbreviated recap Most assessments... Water, food/package delivery, tailgating, lockpicking, etc. – Wash, rinse, repeat – Consistency is safe. Consistency is mediocre • Doing something "different" can be very difficult Stagnation is bad in security Fear is not a good pedagogical tool Presenter’s Company Logo – replace or delete on master slide 3 #RSAC A Little Bit Of Background Presenter’s Company Logo – replace or delete on master slide 4 #RSAC Off To Prison She Goes!! Presenter’s Company Logo – replace or delete on master slide 5 But Wait! She Has A Secret Weapon! Presenter’s Company Logo – replace or delete on master slide 6 #RSAC #RSAC "She must be ok.. Presenter’s Company Logo – replace or delete on master slide 7 #RSAC ..we are still getting shells." Presenter’s Company Logo – replace or delete on master slide 8 #RSAC A Quick Note On Cancer... Presenter’s Company Logo – replace or delete on master slide 9 Case Study: Iowa, Courthouses And How Not To (Most Likely) Not Get Arrested More Iowa background Where are we now? Physical security and downstream impacts Most of us have been or have come very close to getting arrested Psychic paper and flashlights Presenter’s Company Logo – replace or delete on master slide 10 "I have my permission to test memo right here." #RSAC #RSAC Apply! Or, Moving Forward Education and outreach are critical Awarenesscon in Adel Iowa – Sheriff – Local community – No fistfights • Huge hat tip to SecDSM and Bsides Iowa • But... All this is our burden to bear • We need to be reaching out to the community Presenter’s Company Logo – replace or delete on master slide 11 Let's not be these people... #RSAC What can you do at work? Security information should not come from: USA Today, Fox News, Drudge Report, Huffington Post or Highlights We all need to be giving back and doing all we can to make others aware Newsletters Social engineering testing based on rewards Weekly Brown bag sessions And…. Presenter’s Company Logo – replace or delete on master slide 12 “Harry the hippopotamus says.. STOP CLICKING ON LINKS FROM STRANGERS!!!!” #RSAC Stories like.. this one My mom… It is relatable It is not just facts and statistics Has a human side (Hello RSA Theme!!) Gets the point across of respectfully challenging everyone (even those who seem to be in authority) Humans latch on to narratives Empathy is powerful Use them Presenter’s Company Logo – replace or delete on master slide 13 #RSAC I Had A Weird Childhood... Presenter’s Company Logo – replace or delete on master slide 14 My Mom Always Said I Had A Choice... Presenter’s Company Logo – replace or delete on master slide 15 #RSAC